npm - @wildo-ai/external-connectors-models - Versions diffs - 1.1.11 → 1.1.13 - Mend

@wildo-ai/external-connectors-models 1.1.11 → 1.1.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (109) hide show

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.d.ts CHANGED Viewed

@@ -516,9 +516,16 @@ export declare enum CodingAgent_EndOfTurnClassification {
      */
     SELF_PAUSE = "self_pause",
     /**
-     * The agent asked something only the caller can answer — a real decision, a
-     * missing credential, an ambiguity in the task. The session parks and the
-     * question is surfaced; auto-continuing would make the agent answer itself.
+     * The agent's prose READS as asking something only the caller can answer — a
+     * decision, a missing credential, an ambiguity in the task.
+     *
+     * A reading, not a question: since #3710 it does NOT park the session. A run
+     * parks only on a question the agent asked through the protocol (a form
+     * elicitation, `CodingAgent_SessionSuspension`), because prose is where an
+     * agent narrates, and a model reading "first checking the money value shape…"
+     * as a question parked an unattended run for a person who was not there. The
+     * ladder continues this turn like a {@link SELF_PAUSE}, telling the agent how
+     * to ask, and the verdict stays on the continuation record for audit.
      */
     NEEDS_INPUT = "needs_input",
     /**
@@ -538,13 +545,8 @@ export declare enum CodingAgent_EndOfTurnClassification {
  * what was classified and what was sent back.
  */
 export declare const CodingAgent_ContinuationRecordSchema: z.ZodObject<{
-    /** 1-based index of the turn that ENDED at this boundary. */
     turnIndex: z.ZodNumber;
     classification: z.ZodEnum<typeof CodingAgent_EndOfTurnClassification>;
-    /**
-     * The tail of the agent's end-of-turn message the classification was made
-     * from. A bounded excerpt, not the transcript — enough to audit the judgment.
-     */
     agentMessageTail: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type CodingAgent_ContinuationRecord = z.infer<typeof CodingAgent_ContinuationRecordSchema>;
@@ -553,32 +555,17 @@ export type CodingAgent_ContinuationRecord = z.infer<typeof CodingAgent_Continua
  *
  * The ACP sibling of `AgentApprovalSuspension` on the LLM transport: the
  * invocation returns, but its output must not be read as a completed result —
- * `suspension` present means the final message is a QUESTION. The caller
+ * `suspension` present means the agent ASKED: `question` is what it put through
+ * the protocol (a form elicitation), never its prose (#3710). The caller
  * surfaces the question, and the answer re-enters the SAME session:
  * `resumable: true` promises the agent advertised `loadSession`, so the session
  * survives the child process and even a host restart.
  */
 export declare const CodingAgent_SessionSuspensionSchema: z.ZodObject<{
-    /** The ACP session to resume with the answer. */
     sessionId: z.ZodString;
-    /** The agent's question, verbatim — its end-of-turn message. */
     question: z.ZodString;
-    /** 1-based turn the session parked after. */
     turnIndex: z.ZodNumber;
-    /**
-     * Whether the session can be re-entered after the agent process is gone.
-     * False when the agent does not advertise `loadSession`: the question is
-     * still real, but answering it starts a NEW session that must restate task
-     * context — a degradation the caller should surface, not hide.
-     */
     resumable: z.ZodBoolean;
-    /**
-     * An INFORMATIONAL freshness bound for the question (ISO timestamp), surfaced to the operator —
-     * never a reaping deadline. No child process is held open while a run is parked (see
-     * `awaitingInputTtlMs`), so there is nothing that closes at this instant. It said "when the parked
-     * child process will be closed" until 2026-09-24, contradicting the contract above it, and a host
-     * read it that way and aborted answerable questions at boot (#1533).
-     */
     parkedUntil: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type CodingAgent_SessionSuspension = z.infer<typeof CodingAgent_SessionSuspensionSchema>;
@@ -712,36 +699,15 @@ export declare const CodingAgent_RunTaskOutputSchema: z.ZodObject<{
     rawStopReason: z.ZodOptional<z.ZodString>;
     turnCount: z.ZodOptional<z.ZodNumber>;
     continuations: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        /** 1-based index of the turn that ENDED at this boundary. */
         turnIndex: z.ZodNumber;
         classification: z.ZodEnum<typeof CodingAgent_EndOfTurnClassification>;
-        /**
-         * The tail of the agent's end-of-turn message the classification was made
-         * from. A bounded excerpt, not the transcript — enough to audit the judgment.
-         */
         agentMessageTail: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
     suspension: z.ZodOptional<z.ZodObject<{
-        /** The ACP session to resume with the answer. */
         sessionId: z.ZodString;
-        /** The agent's question, verbatim — its end-of-turn message. */
         question: z.ZodString;
-        /** 1-based turn the session parked after. */
         turnIndex: z.ZodNumber;
-        /**
-         * Whether the session can be re-entered after the agent process is gone.
-         * False when the agent does not advertise `loadSession`: the question is
-         * still real, but answering it starts a NEW session that must restate task
-         * context — a degradation the caller should surface, not hide.
-         */
         resumable: z.ZodBoolean;
-        /**
-         * An INFORMATIONAL freshness bound for the question (ISO timestamp), surfaced to the operator —
-         * never a reaping deadline. No child process is held open while a run is parked (see
-         * `awaitingInputTtlMs`), so there is nothing that closes at this instant. It said "when the parked
-         * child process will be closed" until 2026-09-24, contradicting the contract above it, and a host
-         * read it that way and aborted answerable questions at boot (#1533).
-         */
         parkedUntil: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strip>;
@@ -818,4 +784,12 @@ export declare function readCodingModelDestinations(providerConfigurations: Read
 export declare const ACP_WRITING_TOOL_KINDS: ReadonlySet<string>;
 /** Whether an ACP tool kind writes the workspace; an absent kind is no evidence that it does. */
 export declare function isWritingAcpToolKind(kind: string | undefined): boolean;
+/**
+ * The file locations ONE ACP `session/update` claims as WRITTEN: the `locations` of a `tool_call` or
+ * `tool_call_update` whose kind writes ({@link isWritingAcpToolKind}). An update may omit its kind, so the kind of
+ * each call is remembered by its `toolCallId` in `toolCallKinds`, which the caller keeps per session. The ONE rule:
+ * the session runner gathers a run's `reportedFileLocations` with it, and the companion keeps a live run's claims on
+ * disk with it (#3205), so the two cannot disagree about what a run claimed. Pure apart from that memo.
+ */
+export declare function writtenLocationsOfAcpSessionUpdate(sessionUpdateKind: string, update: unknown, toolCallKinds: Map<string, string>): string[];
 //# sourceMappingURL=agent-client-protocol.external-connectors-models.schemas.d.ts.map

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,yCAAyC,EAC1C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EACvB,oDAAoD,EAEpD,sCAAsC,EACrC,MAAM,oDAAoD,CAAC;AAoC9D;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;GAQG;AACH,oBAAY,4BAA4B;IACtC,oFAAoF;IACpF,IAAI,SAAS;IACb;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,gFAAgF;IAChF,wBAAwB,6BAA6B;CACtD;AAED;;;;;;;GAOG;AACH,oBAAY,0CAA0C;IACpD,cAAc,mBAAmB;IACjC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sGAAsG;AACtG,oBAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,2BAA2B,gCAAgC;IAC3D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,YAAY,iBAAiB;CAC9B;AACD,oDAAoD;AAEpD;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qCAAqC,GAC7C,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,oBAAY,mCAAmC;IAC7C,yDAAyD;IACzD,cAAc,mBAAmB;IACjC,0EAA0E;IAC1E,kBAAkB,uBAAuB;IACzC,yGAAyG;IACzG,eAAe,oBAAoB;CACpC;AAED;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,mDAAmD,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,yGAAyG;AACzG,oBAAY,iDAAiD;IAC3D;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;OAKG;IACH,YAAY,iBAAiB;CAC9B;AACD,uDAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,iDAAiD,EAC5D,+BAA+B,EAAE,OAAO,GACvC,OAAO,CAST;AAED;;;;;;;;;;;;;;;GAeG;AACH,kHAAkH;AAClH,oBAAY,gDAAgD;IAC1D,sFAAsF;IACtF,QAAQ,aAAa;IACrB;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AACD,gEAAgE;AAEhE,qGAAqG;AACrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0CAA0C;;;;;;;kBAgC5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD;;;;;GAKG;AACH,qGAAqG;AACrG,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+LrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAc/J,oBAAY,wBAAwB;IAClC,iFAAiF;IACjF,eAAe,yBAAyB;CACzC;AAED;;;;;;;;;GASG;AACH,oBAAY,sBAAsB;IAChC,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,qDAAqD;IACrD,UAAU,eAAe;IACzB,6DAA6D;IAC7D,iBAAiB,sBAAsB;IACvC,mCAAmC;IACnC,OAAO,YAAY;IACnB,oEAAoE;IACpE,SAAS,cAAc;IACvB;;;;;;;;;OASG;IACH,YAAY,uBAAuB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,aAAa,kBAAkB;IAC/B;;;;;OAKG;IACH,UAAU,eAAe;IACzB~~;;;;OAIG~~;IACH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC~~;IAC~~/C,~~6DAA6D;;;IAG7D;;;OAGG;;kBAEH,~~CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG~~;;;;;;;;;GASG~~;AACH,eAAO,MAAM,mCAAmC~~;IAC9C,iDAAiD;;IAEjD,gEAAgE;;IAEhE,6CAA6C;;IAE7C;;;;;OAKG;;IAEH~~;;;;;;~~OAMG;;kBAEH~~,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAwBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;;;iBA+C/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,mCAAmC,GAAG,yCAAyC,GAAG;IAC5F,sBAAsB,EAAE,OAAO,uCAAuC,CAAC;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8CAA8C;;;iBAGzD,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAErH,eAAO,MAAM,8BAA8B;;;;iBA4BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,+BAA+B~~;;;;;;;;;;;;;;;QAvN1C~~,~~6DAA6D;;;QAG7D;;;WAGG;;;;QAgBH,iDAAiD;;QAEjD,gEAAgE;;QAEhE,6CAA6C;;QAE7C;;;;;WAKG;;QAEH;;;;;;WAMG;;;iBAiPH,~~CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;CAC5D;AAED,uFAAuF;AACvF,MAAM,WAAW,6BAA6B;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,2BAA2B,CAQzC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,6BAA6B,CAiC/B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAE/F,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE"}
1	+ {"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,yCAAyC,EAC1C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EACvB,oDAAoD,EAEpD,sCAAsC,EACrC,MAAM,oDAAoD,CAAC;AAoC9D;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;GAQG;AACH,oBAAY,4BAA4B;IACtC,oFAAoF;IACpF,IAAI,SAAS;IACb;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,gFAAgF;IAChF,wBAAwB,6BAA6B;CACtD;AAED;;;;;;;GAOG;AACH,oBAAY,0CAA0C;IACpD,cAAc,mBAAmB;IACjC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sGAAsG;AACtG,oBAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,2BAA2B,gCAAgC;IAC3D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,YAAY,iBAAiB;CAC9B;AACD,oDAAoD;AAEpD;;;;;;GAMG;AACH,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qCAAqC,GAC7C,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,oBAAY,mCAAmC;IAC7C,yDAAyD;IACzD,cAAc,mBAAmB;IACjC,0EAA0E;IAC1E,kBAAkB,uBAAuB;IACzC,yGAAyG;IACzG,eAAe,oBAAoB;CACpC;AAED;;;;;;;GAOG;AACH,oBAAY,yBAAyB;IACnC,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,aAAa,kBAAkB;IAC/B,OAAO,YAAY;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,mDAAmD,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,yGAAyG;AACzG,oBAAY,iDAAiD;IAC3D;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;OAKG;IACH,YAAY,iBAAiB;CAC9B;AACD,uDAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,iDAAiD,EAC5D,+BAA+B,EAAE,OAAO,GACvC,OAAO,CAST;AAED;;;;;;;;;;;;;;;GAeG;AACH,kHAAkH;AAClH,oBAAY,gDAAgD;IAC1D,sFAAsF;IACtF,QAAQ,aAAa;IACrB;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AACD,gEAAgE;AAEhE,qGAAqG;AACrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,0CAA0C;;;;;;;kBAgC5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD;;;;;GAKG;AACH,qGAAqG;AACrG,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+LrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAc/J,oBAAY,wBAAwB;IAClC,iFAAiF;IACjF,eAAe,yBAAyB;CACzC;AAED;;;;;;;;;GASG;AACH,oBAAY,sBAAsB;IAChC,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,qDAAqD;IACrD,UAAU,eAAe;IACzB,6DAA6D;IAC7D,iBAAiB,sBAAsB;IACvC,mCAAmC;IACnC,OAAO,YAAY;IACnB,oEAAoE;IACpE,SAAS,cAAc;IACvB;;;;;;;;;OASG;IACH,YAAY,uBAAuB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,aAAa,kBAAkB;IAC/B;;;;;OAKG;IACH,UAAU,eAAe;IACzB;;;;;;;;;;;OAWG;IACH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC;;;;kBAS/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC;;;;;;kBAsB9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAwBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;;;iBA+C/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,mCAAmC,GAAG,yCAAyC,GAAG;IAC5F,sBAAsB,EAAE,OAAO,uCAAuC,CAAC;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8CAA8C;;;iBAGzD,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAErH,eAAO,MAAM,8BAA8B;;;;iBA4BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmE1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;CAC5D;AAED,uFAAuF;AACvF,MAAM,WAAW,6BAA6B;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,EAAE,SAAS;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,2BAA2B,CAQzC,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,6BAA6B,CAiC/B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAuC,CAAC;AAE/F,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAU3I"}

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.js CHANGED Viewed

@@ -721,9 +721,16 @@ export var CodingAgent_EndOfTurnClassification;
      */
     CodingAgent_EndOfTurnClassification["SELF_PAUSE"] = "self_pause";
     /**
-     * The agent asked something only the caller can answer — a real decision, a
-     * missing credential, an ambiguity in the task. The session parks and the
-     * question is surfaced; auto-continuing would make the agent answer itself.
+     * The agent's prose READS as asking something only the caller can answer — a
+     * decision, a missing credential, an ambiguity in the task.
+     *
+     * A reading, not a question: since #3710 it does NOT park the session. A run
+     * parks only on a question the agent asked through the protocol (a form
+     * elicitation, `CodingAgent_SessionSuspension`), because prose is where an
+     * agent narrates, and a model reading "first checking the money value shape…"
+     * as a question parked an unattended run for a person who was not there. The
+     * ladder continues this turn like a {@link SELF_PAUSE}, telling the agent how
+     * to ask, and the verdict stays on the continuation record for audit.
      */
     CodingAgent_EndOfTurnClassification["NEEDS_INPUT"] = "needs_input";
     /**
@@ -757,7 +764,8 @@ export const CodingAgent_ContinuationRecordSchema = z.strictObject({
  *
  * The ACP sibling of `AgentApprovalSuspension` on the LLM transport: the
  * invocation returns, but its output must not be read as a completed result —
- * `suspension` present means the final message is a QUESTION. The caller
+ * `suspension` present means the agent ASKED: `question` is what it put through
+ * the protocol (a form elicitation), never its prose (#3710). The caller
  * surfaces the question, and the answer re-enters the SAME session:
  * `resumable: true` promises the agent advertised `loadSession`, so the session
  * survives the child process and even a host restart.
@@ -765,7 +773,7 @@ export const CodingAgent_ContinuationRecordSchema = z.strictObject({
 export const CodingAgent_SessionSuspensionSchema = z.strictObject({
     /** The ACP session to resume with the answer. */
     sessionId: z.string().min(1),
-    /** The agent's question, verbatim — its end-of-turn message. */
+    /** The agent's question as it asked it through the protocol: the elicitation's message and the fields it asks. */
     question: z.string().min(1),
     /** 1-based turn the session parked after. */
     turnIndex: z.number().int().positive(),
@@ -1088,4 +1096,25 @@ export const ACP_WRITING_TOOL_KINDS = new Set(['edit', 'delete', 'move']);
 export function isWritingAcpToolKind(kind) {
     return kind !== undefined && ACP_WRITING_TOOL_KINDS.has(kind);
 }
+/**
+ * The file locations ONE ACP `session/update` claims as WRITTEN: the `locations` of a `tool_call` or
+ * `tool_call_update` whose kind writes ({@link isWritingAcpToolKind}). An update may omit its kind, so the kind of
+ * each call is remembered by its `toolCallId` in `toolCallKinds`, which the caller keeps per session. The ONE rule:
+ * the session runner gathers a run's `reportedFileLocations` with it, and the companion keeps a live run's claims on
+ * disk with it (#3205), so the two cannot disagree about what a run claimed. Pure apart from that memo.
+ */
+export function writtenLocationsOfAcpSessionUpdate(sessionUpdateKind, update, toolCallKinds) {
+    if (sessionUpdateKind !== 'tool_call' && sessionUpdateKind !== 'tool_call_update')
+        return [];
+    const fields = typeof update === 'object' && update !== null ? update : {};
+    const toolCallId = typeof fields.toolCallId === 'string' ? fields.toolCallId : undefined;
+    if (toolCallId !== undefined && typeof fields.kind === 'string')
+        toolCallKinds.set(toolCallId, fields.kind);
+    const toolKind = typeof fields.kind === 'string' ? fields.kind : (toolCallId !== undefined ? toolCallKinds.get(toolCallId) : undefined);
+    if (!Array.isArray(fields.locations) || !isWritingAcpToolKind(toolKind))
+        return [];
+    return fields.locations
+        .filter((entry) => typeof entry === 'object' && entry !== null && typeof entry.path === 'string')
+        .map((entry) => entry.path);
+}
 //# sourceMappingURL=agent-client-protocol.external-connectors-models.schemas.js.map

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uCAAuC,GAExC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EAEvB,0DAA0D,EAC1D,sCAAsC,GACrC,MAAM,oDAAoD,CAAC;AAE9D,iEAAiE;AACjE,8BAA8B;AAC9B,WAAW;AACX,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,8DAA8D;AAC9D,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,qCAAqC;AACrC,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,wEAAwE;AACxE,2EAA2E;AAC3E,4CAA4C;AAC5C,EAAE;AACF,+BAA+B;AAC/B,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,qEAAqE;AACrE,iEAAiE;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,8BAEX;AAFD,WAAY,8BAA8B;IACxC,2EAAyC,CAAA;AAC3C,CAAC,EAFW,8BAA8B,KAA9B,8BAA8B,QAEzC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC,oFAAoF;IACpF,6CAAa,CAAA;IACb;;;;;OAKG;IACH,6DAA6B,CAAA;IAC7B,gFAAgF;IAChF,qFAAqD,CAAA;AACvD,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,0CAGX;AAHD,WAAY,0CAA0C;IACpD,+EAAiC,CAAA;IACjC,iGAAmD,CAAA;AACrD,CAAC,EAHW,0CAA0C,KAA1C,0CAA0C,QAGrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sGAAsG;AACtG,MAAM,CAAN,IAAY,qCA4FX;AA5FD,WAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,wEAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,gFAAuC,CAAA;IACvC;;;;;;;;;;;;;;OAcG;IACH,gFAAuC,CAAA;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,oGAA2D,CAAA;IAC3D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sEAA6B,CAAA;AAC/B,CAAC,EA5FW,qCAAqC,KAArC,qCAAqC,QA4FhD;AACD,oDAAoD;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CACtD,OAA8C;IAE9C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,qCAAqC,CAAC,aAAa;YACtD,OAAO,CAAC,CAAC;QACX,KAAK,qCAAqC,CAAC,iBAAiB;YAC1D,OAAO,CAAC,CAAC;QACX,KAAK,qCAAqC,CAAC,iBAAiB;YAC1D,OAAO,CAAC,CAAC;QACX,KAAK,qCAAqC,CAAC,2BAA2B;YACpE,OAAO,CAAC,CAAC;QACX,KAAK,qCAAqC,CAAC,YAAY;YACrD,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,mCAOX;AAPD,WAAY,mCAAmC;IAC7C,yDAAyD;IACzD,wEAAiC,CAAA;IACjC,0EAA0E;IAC1E,gFAAyC,CAAA;IACzC,yGAAyG;IACzG,0EAAmC,CAAA;AACrC,CAAC,EAPW,mCAAmC,KAAnC,mCAAmC,QAO9C;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,oDAAuB,CAAA;IACvB,sDAAyB,CAAA;IACzB,4DAA+B,CAAA;IAC/B,gDAAmB,CAAA;AACrB,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,gDAAgD,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,yGAAyG;AACzG,MAAM,CAAN,IAAY,iDAwBX;AAxBD,WAAY,iDAAiD;IAC3D;;;;OAIG;IACH,sGAAiD,CAAA;IACjD;;;;;;;;OAQG;IACH,kIAA6E,CAAA;IAC7E;;;;;OAKG;IACH,kFAA6B,CAAA;AAC/B,CAAC,EAxBW,iDAAiD,KAAjD,iDAAiD,QAwB5D;AACD,uDAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wCAAwC,CACtD,SAA4D,EAC5D,+BAAwC;IAExC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,iDAAiD,CAAC,sBAAsB;YAC3E,OAAO,IAAI,CAAC;QACd,KAAK,iDAAiD,CAAC,oCAAoC;YACzF,OAAO,+BAA+B,CAAC;QACzC,KAAK,iDAAiD,CAAC,YAAY;YACjE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,kHAAkH;AAClH,MAAM,CAAN,IAAY,gDAgBX;AAhBD,WAAY,gDAAgD;IAC1D,sFAAsF;IACtF,yEAAqB,CAAA;IACrB;;;;OAIG;IACH,6FAAyC,CAAA;IACzC;;;;;OAKG;IACH,qFAAiC,CAAA;AACnC,CAAC,EAhBW,gDAAgD,KAAhD,gDAAgD,QAgB3D;AACD,gEAAgE;AAEhE,qGAAqG;AACrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D;;;;;;;;;;OAUG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,mDAAmD;AAEnD;;;;;GAKG;AACH,qGAAqG;AACrG,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CACxD,8BAA8B,CAAC,kBAAkB,CAClD;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;;;;;OAcG;IACH,6BAA6B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/E,iEAAiE;IACjE,6BAA6B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,OAAO,CAChF,0CAA0C,CAAC,cAAc,CAC1D;IACD,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CACtE,qCAAqC,CAAC,aAAa,CACpD;IACD,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC,OAAO,CAC5F,gDAAgD,CAAC,kBAAkB,CACpE;IACD;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD;;;;;;;;;;OAUG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D;;;;;;;;;;;;OAYG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAChE;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0CAA0C,CAAC,CAAC,QAAQ,EAAE;IAC5G;;;;;;;;;OASG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACrG,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,wEAAwE;YACjF,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,+EAA+E;YACxF,IAAI,EAAE,CAAC,kBAAkB,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,wBAAwB;IACxB,IACE,OAAO,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;QAC1E,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,EAC3E,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,8FAA8F;YACvG,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IAED,IACE,OAAO,CAAC,sBAAsB,KAAK,0CAA0C,CAAC,uBAAuB;QACrG,CAAC,OAAO,CAAC,4BAA4B,EACrC,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,kFAAkF;YAC3F,IAAI,EAAE,CAAC,8BAA8B,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,IACE,OAAO,CAAC,sBAAsB,KAAK,0CAA0C,CAAC,uBAAuB;QACrG,OAAO,CAAC,4BAA4B,KAAK,SAAS,EAClD,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,oFAAoF;YAC7F,IAAI,EAAE,CAAC,8BAA8B,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,+EAA+E;IAC/E,IACE,OAAO,CAAC,iBAAiB,KAAK,qCAAqC,CAAC,YAAY;QAChF,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,uBAAuB,CAAC,WAAW,CAAC,EACjH,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0GAA0G;YAC5G,IAAI,EAAE,CAAC,mBAAmB,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,mDAAmD;AAEnD,MAAM,CAAC,MAAM,uCAAuC,GAAG,0DAA0D,CAAC,MAAM,CAAC;IACvH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,0CAA0C,CAAC;CACpF,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,MAAM,CAAC,0BAA0B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACtG,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,4EAA4E;YACrF,IAAI,EAAE,CAAC,4BAA4B,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKH,iEAAiE;AACjE,gCAAgC;AAChC,WAAW;AACX,oEAAoE;AACpE,6EAA6E;AAC7E,qEAAqE;AACrE,qEAAqE;AACrE,wDAAwD;AACxD,iEAAiE;AAEjE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,iFAAiF;IACjF,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,sBAsBX;AAtBD,WAAY,sBAAsB;IAChC,4CAA4C;IAC5C,+CAAqB,CAAA;IACrB,qDAAqD;IACrD,mDAAyB,CAAA;IACzB,6DAA6D;IAC7D,iEAAuC,CAAA;IACvC,mCAAmC;IACnC,6CAAmB,CAAA;IACnB,oEAAoE;IACpE,iDAAuB,CAAA;IACvB;;;;;;;;;OASG;IACH,6DAAmC,CAAA;AACrC,CAAC,EAtBW,sBAAsB,KAAtB,sBAAsB,QAsBjC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,mCAuBX;AAvBD,WAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,sEAA+B,CAAA;IAC/B;;;;;OAKG;IACH,gEAAyB,CAAA;IACzB;;;;OAIG;IACH,kEAA2B,CAAA;IAC3B;;;;;OAKG;IACH,wFAAiD,CAAA;AACnD,CAAC,EAvBW,mCAAmC,KAAnC,mCAAmC,QAuB9C;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,6DAA6D;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC;IAC3D;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,6CAA6C;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD,iEAAiE;IACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3D,0CAA0C;IAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD;;;;;;;OAOG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,qBAAqB,CAAC;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,oDAAoD;IACpD,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE,kFAAkF;IAClF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;;;;OAaG;IACH,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC,QAAQ,EAAE;IAC1F;;;;;;;;;OASG;IACH,+BAA+B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvD,uEAAuE;IACvE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uCAAuC,GAAG,uCAAuC,CAAC,MAAM,CAAC;IACpG,KAAK,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,oDAAoD,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC;AAQH,kEAAkE;AAClE,mBAAmB;AACnB,kEAAkE;AAElE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB;;;;;;;OAOG;IACH,0BAA0B,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IACpF;;;;;;;;OAQG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAChE;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9B,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACxC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;IACvE;;;;;OAKG;IACH,UAAU,EAAE,mCAAmC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AA8BH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,2BAA2B;AACzC;;;;;;GAMG;AACH,sBAAyD;IAEzD,MAAM,YAAY,GAAkC,EAAE,CAAC;IACvD,MAAM,2BAA2B,GAA2D,EAAE,CAAC;IAE/F,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrE,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,qBAAqB,KAAK,IAAI,IAAI,OAAO,qBAAqB,KAAK,QAAQ;YAAE,SAAS;QAC1F,MAAM,gBAAgB,GAAI,qBAAiD,CACzE,sCAAsC,CAAC,qBAAqB,CAC7D,CAAC;QACF,IAAI,gBAAgB,KAAK,IAAI,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,SAAS;QAEhF,MAAM,QAAQ,GAAI,gBAAoD,CAAC,iBAAiB,CAAC;QACzF,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,SAAS;QAEhE,KAAK,MAAM,mBAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAmC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1F,MAAM,OAAO,GAAI,QAAoC,CAAC,mBAAmB,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAI,OAA8D,EAAE,iBAAiB,CAAC;YACpG,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0CAA0C,CAAC;iBAC1F,SAAS,CAAC,QAAQ,CAAC,CAAC;YAEvB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7D,2BAA2B,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACvE,SAAS;YACX,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpD,YAAY,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/F,iGAAiG;AACjG,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,OAAO,IAAI,KAAK,SAAS,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC","sourcesContent":["import { z } from \"zod\";\nimport {\n ExternalProvider_OperationContextSchema,\n ExternalProvider_OperationDefinition_Base,\n} from \"../core/operations.external-connectors-models.schemas\";\nimport {\n APPLICATION_ENVIRONMENT,\n ExternalProvider_ExchangeProtocol_Configuration_Base,\n ExternalProvider_ExchangeProtocol_Configuration_BaseSchema,\n ExternalProvider_ExchangeProtocol_Kind,\n } from \"../core/commons.external-connectors-models.schemas\";\n\n//===============================================================\n// Agent Client Protocol (ACP)\n// --------\n// Execution protocol for CODING AGENTS: a long-lived JSON-RPC 2.0 session over\n// stdio between Wildo (the ACP client) and an agent subprocess that reads and\n// writes a workspace, runs commands, and asks permission before doing so.\n//\n// This is Zed's Agent Client Protocol (agentclientprotocol.com), NOT IBM's\n// \"Agent Communication Protocol\" — that one is agent-to-agent and overlaps\n// `A2A_CONNECTOR`. The two share an acronym and nothing else.\n//\n// # Why this is not a one-shot CLI transport with extra fields\n//\n// The transport this REPLACED (removed 2026-08-27) modelled ONE-SHOT command\n// execution: compose argv, feed stdin, wait for exit, parse stdout. Every field\n// it owned (`outputParserMode`, `jsonOutputPath`, per-operation argument\n// templates) described that shape. A\n// coding agent is the opposite shape — a session that streams progress, calls\n// back into the client for permission, survives many turns, and reports token\n// usage as it goes. Modelling it as a one-shot text call is precisely what left\n// the previous lane with no token accounting, no permission channel, no\n// cancellation and no resumption: those are not missing features, they are\n// consequences of the wrong protocol shape.\n//\n// # Deliberately AGENT-NEUTRAL\n//\n// Wildo's default coding agent is Claude Code (through Zed's ACP adapter), but\n// nothing in this contract names it. Every agent-specific concept is either\n// negotiated at runtime (the agent advertises its capabilities and session\n// modes in its `initialize` / `session/new` responses) or authored as opaque\n// `sessionMetaExtensions`. That is what makes selecting a different registered\n// ACP agent a configuration change rather than a new execution lane.\n//===============================================================\n\n/*\n Where the agent subprocess runs.\n \n Only one host exists today, and it is the same constraint the coding lane has\n * always had: the agent must share a filesystem with the workspace it mutates.\n * A remote host is not a variant of this — it would need the workspace shipped\n * to it, which is a different design, so it is deliberately not enumerated\n * until it exists.\n /\nexport enum AgentClientProtocol_RunnerHost {\n BACKEND_SUBPROCESS = \"backend_subprocess\",\n}\n\n/\n How the spawned agent authenticates to its own model provider.\n \n ACP additionally defines a protocol-level `authenticate` method, advertised\n * through the agent's `authMethods` array. That is NOT enumerated here: when an\n * agent advertises auth methods the runner negotiates them at `initialize`\n * time, which is a runtime handshake rather than authored configuration. These\n * modes describe what the HOST does before the process starts.\n /\nexport enum AgentClientProtocol_AuthMode {\n /* The agent needs no credential (a local model, or an agent that refuses work). /\n NONE = \"none\",\n /\n The agent resolves its own credential from host state — an operator's prior\n * interactive login, a keychain entry, an ambient cloud identity. Wildo\n * injects nothing and can see nothing. This is the correct mode for a\n * developer-machine coding agent.\n /\n HOST_MANAGED = \"host_managed\",\n /* Wildo resolves a secret by ref and injects it into the child environment. /\n SECRET_REF_ENV_INJECTION = \"secret_ref_env_injection\",\n}\n\n/\n Which directory becomes the ACP session's `cwd`.\n \n ACP requires `cwd` to be an ABSOLUTE path and treats it as the session's\n * primary filesystem context. The absolute path itself is never authored here:\n * it is host authority supplied at invocation time, which is what makes a\n * profile portable across applications and machines.\n /\nexport enum AgentClientProtocol_WorkingDirectoryPolicy {\n WORKSPACE_ROOT = \"workspace_root\",\n WORKSPACE_RELATIVE_PATH = \"workspace_relative_path\",\n}\n\n/\n The MOST autonomy a session started from this profile may be granted.\n \n This is a Wildo-owned vocabulary, deliberately expressed in terms of what the\n * CLIENT must still decide rather than in any agent's mode identifiers. Agents\n * advertise their own modes at `session/new` (Claude's adapter offers\n * `default`, `auto`, `acceptEdits`, `plan`, `dontAsk`, `bypassPermissions`),\n * and those identifiers are agent-specific strings — binding a provider profile\n * to them would make the contract unusable for any other agent and would break\n * the moment an agent renames one.\n \n It is a CEILING, not a selection: the caller (for application creation, the\n * autonomy mode of the journey) chooses at or below it. An authored ceiling is\n * what lets an application say \"no session started from this profile may ever\n * skip the permission gate\" independently of what any individual run requests.\n \n Policies describe admitted tool-kind sets, not nested levels. Invocation overrides\n * intersect those sets with the profile: READS and EDITS have an empty intersection.\n * The rank helper is a presentation ordering only and must not select authority.\n /\n/* @wildo_source:part:start acp.permission-ceiling facet:layer:config facet:audience:app-developer /\nexport enum AgentClientProtocol_PermissionCeiling {\n /\n Every permission request the agent raises must be answered by the client.\n \n Note what this does and does not promise: it guarantees the CLIENT decides\n * every request the agent RAISES, not that the agent raises one per action.\n * Which tool calls escalate is the agent's own policy — measured against\n * Claude's adapter, file edits and writes prompt while a read-only shell\n * command does not. Treat this as \"no blanket pre-approval\", never as \"a\n * complete inventory of what the agent did\"; that inventory comes from the\n * tool-call stream and, authoritatively, from the change set.\n /\n PROMPT_ALWAYS = \"prompt_always\",\n /\n File edits are auto-accepted; everything else must still be answered.\n \n \"Must still be answered\" is a promise the CLIENT keeps, and it is only\n * keepable because the runner refuses to hand the decision to the agent.\n * Measured live against Claude's adapter on 2026-08-27: selecting that\n * agent's own `acceptEdits` session mode ALSO auto-approves arbitrary shell\n * commands, so a mutating `printf > file` executed with no permission request\n * at all and wrote outside the task's declared mutation scope. Under the\n * strictest mode the identical prompt escalated and was denied, and nothing\n * was written.\n \n So this ceiling is implemented by keeping the agent in its most-escalating\n * mode and auto-allowing edit-kind requests HERE. The agent's similarly named\n * mode is deliberately not selected: it grants strictly more than its name.\n /\n AUTO_ACCEPT_EDITS = \"auto_accept_edits\",\n /\n The protocol's NON-MUTATING tool kinds are auto-accepted; everything else must still be\n * answered — and with no human at the other end, that means denied.\n \n The read-only lane. `read`, `search`, `fetch` and `think` are exactly the kinds the Agent Client\n * Protocol itself classes as non-mutating; `edit`, `delete` and `move` are its mutating set and are\n * refused here, as are `execute` (which can mutate anything) and `other` (unclassified, so\n * fail-closed).\n \n Added 2026-08-29 because neither existing ceiling could express a research agent, MEASURED\n * rather than assumed: a probe under {@link PROMPT_ALWAYS} with every location refused had both\n * `WebFetch` and `WebSearch` arrive as `toolKind: 'fetch'` and be `ceiling_refused`, and the agent\n * ended its turn saying it would not guess a price from memory. So PROMPT_ALWAYS denies research\n * outright, and {@link AUTO_ACCEPT_EDITS} admits precisely the inverse of what research needs.\n /\n AUTO_ACCEPT_READS = \"auto_accept_reads\",\n /\n The non-mutating kinds AND the file-mutating kinds are auto-accepted; `execute` and the\n * unclassified `other` must still be answered — and with no human at the other end, that means\n * denied.\n \n Added 2026-09-04 for the research-agent evidence store, and MEASURED before it existed rather\n * than after: switching the research profile from {@link AUTO_ACCEPT_READS} to\n * {@link AUTO_ACCEPT_EDITS} — so the agent could persist findings to disk — silently inverted the\n * lane's whole posture, because the ceilings are kind-SETS, not nested ranks: a live compliance\n * run spent two rounds with every WebFetch/WebSearch refused, and its only output was a store\n * note titled \"NO EVIDENCE COLLECTED\". A lane that both reads the world and persists what it\n * read needs this member; neither existing set contains the other.\n \n The confinement story is unchanged: this ceiling decides KINDS, and the dispatch's location\n * predicate still decides PATHS — a research profile on this ceiling with a store-only predicate\n * can fetch anything and write only its evidence directory.\n /\n AUTO_ACCEPT_READS_AND_EDITS = \"auto_accept_reads_and_edits\",\n /\n No permission gate: every tool kind is pre-approved, `execute` and the unclassified `other`\n * included. Reserve for a disposable or isolated workspace.\n \n *This member also removes the task's mutation scope for shell commands, and that is a property\n of shell commands rather than of this value.** The scope predicate runs AFTER the ceiling and\n * denies any location the task did not authorise even here — so declared file EDITS stay confined.\n * But it decides on the `locations` a permission request carries, and a shell command carries\n * NONE, because what a command writes is not derivable from the command string. Every ceiling\n * below this one refuses `execute` outright, so the empty-location case never reaches the\n * predicate; under this one it does, and `locations.some(...)` over an empty array is vacuously\n * satisfied. A mutating command therefore reaches the workspace inside a complete, well-formed\n * permission record showing it was allowed.\n \n Not closable by deriving a scope from the command: any parse is defeated by `sh -c \"$CMD\"` or a\n * redirect through a substituted path, and an invented scope that can be walked around is worse\n * than a stated absence. So the residual exposure under this member is exactly \"shell commands are\n * unbounded\", the answer to it is git plus the post-run change set, and the companion WARNS on\n * every run whose mutation followed a permitted act that declared no location — which is how it\n * stops being invisible. Author this member to state that plainly; do not author it expecting the\n * mutation scope to hold for commands.\n \n Note this is a DIFFERENT hole from an agent that never asks (see\n * {@link AgentClientProtocol_PermissionEscalationBehaviour}): that one costs you both guards for\n * every act, and dispatch refuses a narrower ceiling against such an agent. This one costs you the\n * scope guard for one act kind, against a fully compliant agent.\n /\n UNRESTRICTED = \"unrestricted\",\n}\n/* @wildo_source:part:end acp.permission-ceiling /\n\n/\n Stable presentation order for {@link AgentClientProtocol_PermissionCeiling}.\n \n Never use this rank to authorize or clamp a request. READS and EDITS admit disjoint\n * tool-kind sets; choosing the numerically lower one can grant operations forbidden\n * by the profile. Dispatch computes their intersection instead.\n /\nexport function agentClientProtocolPermissionCeilingRank(\n ceiling: AgentClientProtocol_PermissionCeiling,\n): number {\n switch (ceiling) {\n case AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS:\n return 0;\n case AgentClientProtocol_PermissionCeiling.AUTO_ACCEPT_READS:\n return 1;\n case AgentClientProtocol_PermissionCeiling.AUTO_ACCEPT_EDITS:\n return 2;\n case AgentClientProtocol_PermissionCeiling.AUTO_ACCEPT_READS_AND_EDITS:\n return 3;\n case AgentClientProtocol_PermissionCeiling.UNRESTRICTED:\n return 4;\n }\n}\n\n/\n How a coding agent's host-login status command reports \"signed in\".\n \n An ACP agent that is not signed in still completes `initialize` and `session/new`; it fails the\n * first `session/prompt` (Claude's adapter 0.81.1: JSON-RPC `-32000 Authentication required`,\n * reproduced 2026-09-25). So the handshake proves nothing about the login, and a real prompt spends\n * a turn. Every agent's own CLI can answer without either — `claude auth status --json`,\n * `codex login status`, `opencode auth list` — but each answers in its own way, which is this enum.\n /\nexport enum AgentClientProtocol_HostLoginSignal {\n /* Signed in exactly when the status command exits 0. /\n EXIT_CODE_ZERO = 'exit_code_zero',\n /* Signed in when the command prints JSON whose named field is `true`. /\n JSON_BOOLEAN_FIELD = 'json_boolean_field',\n /* Signed in when the command exits 0 and its output does NOT match a pattern (e.g. `0 credentials`). /\n OUTPUT_EXCLUDES = 'output_excludes',\n}\n\n/\n What a host-login probe found for one coding agent.\n \n Four states, because the remedies differ: NOT_INSTALLED needs an install, SIGNED_OUT a login, and\n * UNKNOWN (the status command ran and its answer could not be read, or timed out) must never be\n * reported as either — reading it as SIGNED_IN dispatches a run that fails mid-turn, reading it as\n * SIGNED_OUT sends a signed-in operator to log in again.\n /\nexport enum CodingAgentHostLoginState {\n SIGNED_IN = 'signed_in',\n SIGNED_OUT = 'signed_out',\n NOT_INSTALLED = 'not_installed',\n UNKNOWN = 'unknown',\n}\n\n/\n How a dispatch refused because the coding agent's operator is not signed in begins — thrown by the\n * engine before an ACP session opens, and recognised by the companion as the HOST's failure (not the\n * task's), so a signed-out host does not spend a task's attempt budget. One constant for both sides.\n /\nexport const CODING_AGENT_NOT_SIGNED_IN_MESSAGE_PREFIX = 'The coding agent is not signed in on this host';\n\n/\n Whether THIS agent raises `session/request_permission` before it mutates —\n * the one property that decides whether Wildo's in-flight guards can fire at all.\n \n # Why a permission ceiling needs this to mean anything\n \n For agent-owned I/O, Wildo's in-flight controls are enforced in the CLIENT's ANSWER to a\n * permission request: {@link AgentClientProtocol_PermissionCeiling} decides the\n * tool KIND, and the dispatch's location predicate decides the PATHS. Neither is\n * a sandbox, an interposed filesystem, or a syscall filter — they are answers.\n * Client-hosted writes independently check both controls. An agent doing its OWN I/O\n * without asking is bound by neither, and the ceiling\n * an application authored is a LABEL rather than a guarantee.\n \n That is not hypothetical and it is not a fault in the agents. MEASURED with\n * `wildo acp probe`:\n \n - Codex (`@agentclientprotocol/codex-acp`, 2026-09-06) raises nothing before\n * an in-workspace write in ANY of its three modes, including with an explicit\n * `approval_policy = \"untrusted\"`. Its safety model is a SANDBOX, so an\n * in-workspace write is safe by ITS construction and there is nothing to ask\n * about. A different architecture, not a defect.\n * - OpenCode (1.18.27, 2026-09-04/05) does the same under its DEFAULT\n * configuration, and escalates correctly when pointed at a permission\n * configuration file. So for that agent the answer is conditional on\n * something the HOST supplies.\n * - Claude's adapter (`@agentclientprotocol/claude-agent-acp` 0.73.0) raises,\n * and both guards fire.\n \n # Why it is DECLARED rather than inferred, and why it is required\n \n It cannot be inferred before a run: an agent that never asks and an agent that\n * had nothing to ask about are indistinguishable from an empty decision list, and\n * by the time the list is empty the workspace has already been mutated. The\n * post-run change set remains the authoritative account of what a run touched —\n * this declaration is what lets the framework say, BEFORE the run, whether that\n * change set is the only account there will be.\n \n The provider declares it because the provider is the party that ran the probe.\n * It is REQUIRED on the runtime contract for the same reason `modelDelivery` is:\n * this lane has now shipped three safety-relevant fields that were authored,\n * documented and read by nothing (`hostConfigurationInheritance`, the model\n * channel, the provider's inherited environment). An author who cannot ship the\n * gap is better than one who discovers it on a dispatched run.\n \n It is a CLAIM, never an alibi. The companion still judges each completed run\n * from that run's OWN permission decisions and change set, so an agent whose\n * behaviour changes between versions cannot keep a stale, reassuring declaration.\n /\n/* @wildo_source:part:start acp.permission-escalation facet:layer:config facet:audience:app-developer /\nexport enum AgentClientProtocol_PermissionEscalationBehaviour {\n /\n The agent escalates before mutating, so the ceiling and the mutation scope\n * are both enforceable in flight. The only value under which a ceiling\n * narrower than UNRESTRICTED means what it says.\n /\n RAISES_BEFORE_MUTATION = \"raises_before_mutation\",\n /\n The agent escalates ONLY when the host points it at a permission\n * configuration it does not adopt by default.\n \n The configuration is therefore not hardening — it is the condition under\n * which the agent may be dispatched with a gate at all, and the variable that\n * carries the pointer is named on the contract so the dispatch can CHECK that\n * a profile supplies it instead of trusting a docstring that says it must.\n /\n RAISES_ONLY_UNDER_HOST_CONFIGURATION = \"raises_only_under_host_configuration\",\n /\n The agent never escalates before mutating, under any configuration this\n * framework can supply. Its own safety model is elsewhere (a sandbox), and\n * Wildo's in-flight guards are inert for it by construction — the post-run\n * change set is the only account of what it touched.\n /\n NEVER_RAISES = \"never_raises\",\n}\n/* @wildo_source:part:end acp.permission-escalation /\n\n/\n Can Wildo's in-flight permission ceiling and mutation-scope predicate fire for\n * this agent, as it will actually be started?\n \n The single definition of that question, so the dispatch's refusal, the run's\n * recorded metadata and any operator-facing report cannot disagree about it.\n \n `escalationConfigurationSupplied` answers only the conditional member: it is\n * whether the composed child environment will actually carry the pointer the\n * contract names. Deliberately a parameter rather than something this function\n * reads, because the environment is composed by the dispatch and a predicate\n * that guessed at it would be a second, quieter answer.\n * assurance-control: WILDO.SOFTWARE.AI_PRODUCED_CHANGE_CONTROL — the one answer to whether the ceiling and write scope can fire for an agent: always, never, or only when its configuration pointer reaches it.\n /\nexport function agentClientProtocolInFlightGuardsCanFire(\n behaviour: AgentClientProtocol_PermissionEscalationBehaviour,\n escalationConfigurationSupplied: boolean,\n): boolean {\n switch (behaviour) {\n case AgentClientProtocol_PermissionEscalationBehaviour.RAISES_BEFORE_MUTATION:\n return true;\n case AgentClientProtocol_PermissionEscalationBehaviour.RAISES_ONLY_UNDER_HOST_CONFIGURATION:\n return escalationConfigurationSupplied;\n case AgentClientProtocol_PermissionEscalationBehaviour.NEVER_RAISES:\n return false;\n }\n}\n\n/\n How much of the HOST MACHINE's agent configuration a session inherits.\n \n Coding agents read configuration from the filesystem — instructions, skills,\n * slash commands, sub-agent personas, tool permissions — and they layer several\n * scopes. Measured against Claude's ACP adapter, the default is to load ALL of\n * them, including the operator's personal `~/.claude`: a probe session returned\n * roughly forty commands and a persona belonging to the machine running it,\n * none of which the application authored.\n \n That inheritance is not simply undesirable, which is why this is a three-way\n * choice rather than a boolean. A dispatched coding task SHOULD read the\n * application's own instructions and installed skills — that is how the\n * application teaches the agent to use its framework. What it should not\n * silently absorb is whoever happens to be logged in.\n /\n/* @wildo_source:part:start acp.host-configuration-inheritance facet:layer:config facet:audience:app-developer /\nexport enum AgentClientProtocol_HostConfigurationInheritance {\n /* No filesystem-sourced agent configuration. The prompt is the whole instruction. /\n ISOLATED = \"isolated\",\n /\n Configuration owned by the workspace (its committed instructions, its\n * installed skills, its checked-in settings) — but not the operator's\n * personal configuration. The correct default for a dispatched task.\n /\n APPLICATION_SCOPED = \"application_scoped\",\n /\n Everything the agent would load if a human had started it by hand,\n * including operator-level configuration. Honest about what it is: the run\n * then depends on machine state Wildo neither authored nor recorded, so a run\n * is not reproducible on another machine.\n /\n HOST_INHERITED = \"host_inherited\",\n}\n/* @wildo_source:part:end acp.host-configuration-inheritance /\n\n/* @wildo_source:part:start acp.execution-profile facet:layer:config facet:audience:app-developer /\n/\n WHERE a coding run's content actually goes, per MODEL (issue #308, join 2).\n \n An ACP coding session sends the composed task prompt, retrieved context and — through the agent's\n * own file reads — the application's SOURCE CODE to the selected model vendor. For an application\n * built with Wildo that can include the customer's domain model, schemas, seed data shapes and\n * business rules. So the destination is a processor-register fact, not a runtime detail.\n \n ## Why this is per MODEL and not per provider\n \n A generalist agent routes to several vendors, so its OWN legal identity is not the identity of the\n * vendor a given run reaches: OpenCode is a binary on the host, and the same profile can send code to\n * Anthropic or to OpenAI depending on one model id. A per-provider declaration structurally cannot\n * express that — it would name the agent's publisher as the recipient of code the publisher never\n * receives, which is false in the direction a reader cannot check.\n \n ## Why it lives on the EXECUTION PROFILE\n \n The profile is already where an application authors the policy it owns, and the model is selected at\n * dispatch time against that profile. The competing home — `providerComplianceChoices`, where every\n * other compliance answer lives — cannot carry it: that surface is keyed by provider ref and has one\n * entry per provider, which is exactly the shape that cannot say \"per model\".\n \n `ApplicationProviderComplianceChoice` warns against putting a compliance answer somewhere \"nothing\n * can read it without knowing the provider\", and `providerConfigurations` is genuinely an opaque\n * `Record<string, unknown>` bag. That objection is answered rather than ignored:\n * {@link readCodingModelDestinations} is the named reader, exported beside this schema, and the\n * compliance renderer calls it instead of reaching into the bag and guessing a shape. The hazard the\n * warning names is a fact nobody can FIND; a named reader is what removes it.\n /\nexport const AgentClientProtocol_ModelDestinationSchema = z.object({\n /\n The legal entity that receives the code — the model vendor, NOT the agent's publisher.\n \n Required, because a destination that cannot be named is not a destination a processor register can\n * state. There is no framework default: the framework does not know which account an operator\n * authorised, and inventing one would publish a recipient nobody declared.\n /\n vendorLegalEntityName: z.string().trim().min(1),\n /\n Where that vendor processes it.\n \n Open strings for the same reason `ProviderComplianceProfile.processingRegions` uses them: these\n * are the VENDOR's own labels and a closed enum here would be this repository inventing a\n * vocabulary it does not own.\n /\n processingRegions: z.array(z.string().trim().min(1)).min(1),\n /\n The INTERMEDIARY, when the run reaches the vendor through one (issue #308, join 3).\n \n A hosted gateway — OpenCode Zen, an Anthropic-compatible proxy reached through a base-URL\n * override — receives the content before the vendor does. It is therefore its own processor and must\n * appear as a sub-processor DISTINCT from the vendor behind it: naming only the vendor understates\n * the chain by one party, and naming only the gateway understates it by the other.\n \n Absent means the run reaches the vendor directly. That is a claim, not a silence — declaring a\n * destination at all is what makes it one.\n /\n gateway: z.object({\n legalEntityName: z.string().trim().min(1),\n processingRegions: z.array(z.string().trim().min(1)).min(1),\n }).optional(),\n}).strict();\nexport type AgentClientProtocol_ModelDestination = z.infer<typeof AgentClientProtocol_ModelDestinationSchema>;\n/* @wildo_source:part:end acp.execution-profile /\n\n/\n One authored way to start an ACP agent.\n \n Mirrors the shape a provider's execution profiles have always had: the\n * spawnable command plus the policy that decides whether it may run at all.\n /\n/* @wildo_source:part:start acp.execution-profile facet:layer:config facet:audience:app-developer /\nexport const AgentClientProtocol_ExecutionProfileSchema = z.object({\n runnerHost: z.enum(AgentClientProtocol_RunnerHost).default(\n AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS,\n ),\n /\n The executable that speaks ACP on stdio — OPTIONAL, and normally omitted.\n \n How to START an agent is the PROVIDER's knowledge: the package, the pinned\n * version, the launcher. An application that restates it holds a second copy\n * of a version it does not own, which is how the adapter pin came to be\n * declared in two places with no mechanical link. Omit these and the provider\n * contract supplies them; set them only to run an agent the provider does not\n * describe, and accept owning the version if you do.\n /\n command: z.string().min(1).optional(),\n args: z.array(z.string()).optional(),\n /\n Host environment variables forwarded into the child.\n \n The runner starts from a minimal identity allowlist and adds only what is\n * named here. Full inheritance is never available: the process that spawns\n * the agent holds platform secrets that must not reach it. Naming one does\n * not get past that: a variable the framework declares secret (a platform or\n * application runtime secret, an inbound endpoint or system-of-record\n * secret, or any provider's declared secret) is refused by `wildo config\n * sync`, on every read and at startup, and at dispatch. A provider credential\n * the agent needs is handed to it through `secretEnvVarName` instead. The\n * refusal covers what the framework declares; a secret in the developer's\n * own shell environment is not the framework's to know, so name only what\n * the agent needs.\n /\n inheritedEnvironmentVariables: z.array(z.string().min(1)).optional(),\n authMode: z.enum(AgentClientProtocol_AuthMode),\n secretRef: z.string().optional(),\n secretEnvVarName: z.string().optional(),\n /\n The environments this profile may run in — REQUIRED, and never widened by\n * default.\n \n This is the gate that keeps a workspace-mutating agent out of production.\n * It is carried here explicitly rather than inherited from anything, because\n * the equivalent guard on the protocol this replaces was enforced by a single\n * function that a new transport could have quietly failed to call.\n /\n allowedApplicationEnvironments: z.array(z.enum(APPLICATION_ENVIRONMENT)).min(1),\n /* Optional further narrowing to named platform environments. /\n allowedPlatformEnvironmentIds: z.array(z.string()).optional(),\n workingDirectoryPolicy: z.enum(AgentClientProtocol_WorkingDirectoryPolicy).default(\n AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_ROOT,\n ),\n workingDirectoryRelativePath: z.string().optional(),\n permissionCeiling: z.enum(AgentClientProtocol_PermissionCeiling).default(\n AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS,\n ),\n hostConfigurationInheritance: z.enum(AgentClientProtocol_HostConfigurationInheritance).default(\n AgentClientProtocol_HostConfigurationInheritance.APPLICATION_SCOPED,\n ),\n /\n Wall-clock ceiling for one prompt turn.\n \n On expiry the runner sends `session/cancel` and waits for the agent to\n * settle rather than killing the process: ACP defines cancellation as\n * cooperative, and an agent that is mid-edit should be allowed to stop\n * cleanly. A hard kill remains the fallback if the agent does not honour it.\n /\n turnTimeoutMs: z.number().int().positive().optional(),\n /\n How many times one invocation may AUTO-CONTINUE the agent after it ends a\n * turn with a self-imposed pause (\"shall I continue?\").\n \n The autonomous lane's answer to the agent's own checkpoint reflex: a turn\n * classified as SELF_PAUSE is re-prompted to continue on the same session\n * rather than read as a finished result. Bounded because an agent that pauses\n * forever must eventually be settled rather than looped — on exhaustion the\n * run settles with what it has, recorded as such. Zero disables continuation\n * entirely (every END_TURN is final, the pre-2026-09 behaviour).\n /\n maxAutoContinuations: z.number().int().nonnegative().default(8),\n /\n How long an operator answer to a parked question stays valid — the deadline\n * stamped onto the suspension as `parkedUntil`.\n \n The parked run does NOT hold a live agent process open for this window: the\n * child is closed the moment the run parks (holding it would occupy the lane's\n * single-flight slot while an operator who may never answer decides). Because\n * the agent persists the session on disk, a later answer re-enters it through\n * `session/load` — so this is an informational freshness bound the host and UX\n * surface, not a timer that reaps a process. It applies only when the agent\n * advertises `loadSession`; otherwise the question is real but unanswerable\n * on the same session, and `resumable` says so.\n /\n awaitingInputTtlMs: z.number().int().positive().default(900_000),\n /\n Ceiling on the bytes of session events this run PERSISTS.\n \n Semantics are TRUNCATE, not reject — deliberately the opposite of the\n * output cap this replaces, which killed a run for being talkative after it\n * had already mutated the workspace. Losing the tail of a transcript is a\n * reporting loss; losing the run is a work loss.\n /\n maximumRecordedEventBytes: z.number().int().positive().optional(),\n /\n Per-model processing destinations — see {@link AgentClientProtocol_ModelDestinationSchema}.\n \n OPTIONAL, and its absence is REPORTED rather than refused. A stale framework region list must not\n * be able to brick an application build, and an operator who has just moved a vendor should be able\n * to say so before the framework catches up — the same warn-do-not-block posture\n * `appAssertedProcessingRegions` already takes for provider regions. The compliance brief names a\n * coding profile that declares none, so the gap is visible without being fatal.\n /\n modelDestinations: z.record(z.string().trim().min(1), AgentClientProtocol_ModelDestinationSchema).optional(),\n /\n Opaque, agent-specific options passed as `_meta` on `session/new`.\n \n ACP reserves `_meta` for extensions, and agents use it for options their\n * own runtime understands and no other agent would. Keeping it opaque is what\n * keeps the rest of this contract agent-neutral — but it is also unvalidated\n * and unportable by construction, so anything Wildo needs to GUARANTEE (the\n * environment gate, the permission ceiling, configuration inheritance) is a\n * typed field above and never expressed here.\n /\n sessionMetaExtensions: z.record(z.string(), z.unknown()).optional(),\n}).strict().superRefine((profile, context) => {\n if (profile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION && !profile.secretRef) {\n context.addIssue({\n code: \"custom\",\n message: \"`secretRef` is required when `authMode` is `SECRET_REF_ENV_INJECTION`.\",\n path: [\"secretRef\"],\n });\n }\n\n if (profile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION && !profile.secretEnvVarName) {\n context.addIssue({\n code: \"custom\",\n message: \"`secretEnvVarName` is required when `authMode` is `SECRET_REF_ENV_INJECTION`.\",\n path: [\"secretEnvVarName\"],\n });\n }\n\n // A host-managed or unauthenticated profile carrying a secret binding is a\n // contradiction the runner would resolve silently — injecting nothing while\n // the authored configuration claims a credential is in play. Refuse it, so\n // \"this profile injects no secret\" is a property of the schema rather than of\n // a reviewer's reading.\n if (\n profile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION &&\n (profile.secretRef !== undefined \|\| profile.secretEnvVarName !== undefined)\n ) {\n context.addIssue({\n code: \"custom\",\n message: \"`secretRef`/`secretEnvVarName` are only valid when `authMode` is `SECRET_REF_ENV_INJECTION`.\",\n path: [\"secretRef\"],\n });\n }\n\n if (\n profile.workingDirectoryPolicy === AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_RELATIVE_PATH &&\n !profile.workingDirectoryRelativePath\n ) {\n context.addIssue({\n code: \"custom\",\n message: \"`workingDirectoryRelativePath` is required when using `WORKSPACE_RELATIVE_PATH`.\",\n path: [\"workingDirectoryRelativePath\"],\n });\n }\n\n if (\n profile.workingDirectoryPolicy !== AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_RELATIVE_PATH &&\n profile.workingDirectoryRelativePath !== undefined\n ) {\n context.addIssue({\n code: \"custom\",\n message: \"`workingDirectoryRelativePath` is only valid when using `WORKSPACE_RELATIVE_PATH`.\",\n path: [\"workingDirectoryRelativePath\"],\n });\n }\n\n // An UNRESTRICTED ceiling on a profile that may run outside development is\n // the one combination with no legitimate reading: it authorises an agent to\n // mutate a non-development workspace with no gate and no record of a decision.\n if (\n profile.permissionCeiling === AgentClientProtocol_PermissionCeiling.UNRESTRICTED &&\n profile.allowedApplicationEnvironments.some((environment) => environment !== APPLICATION_ENVIRONMENT.DEVELOPMENT)\n ) {\n context.addIssue({\n code: \"custom\",\n message:\n \"`permissionCeiling: UNRESTRICTED` is only valid for a profile restricted to the DEVELOPMENT environment.\",\n path: [\"permissionCeiling\"],\n });\n }\n});\nexport type AgentClientProtocol_ExecutionProfile = z.infer<typeof AgentClientProtocol_ExecutionProfileSchema>;\n/* @wildo_source:part:end acp.execution-profile /\n\nexport const AgentClientProtocol_ConfigurationSchema = ExternalProvider_ExchangeProtocol_Configuration_BaseSchema.extend({\n defaultExecutionProfileRef: z.string().optional(),\n executionProfiles: z.record(z.string(), AgentClientProtocol_ExecutionProfileSchema),\n}).superRefine((config, context) => {\n if (config.defaultExecutionProfileRef && !config.executionProfiles[config.defaultExecutionProfileRef]) {\n context.addIssue({\n code: \"custom\",\n message: \"`defaultExecutionProfileRef` must reference an existing execution profile.\",\n path: [\"defaultExecutionProfileRef\"],\n });\n }\n});\nexport type AgentClientProtocol_Configuration = ExternalProvider_ExchangeProtocol_Configuration_Base & z.infer<typeof AgentClientProtocol_ConfigurationSchema>;\n\n\n\n//===============================================================\n// Coding-agent operation family\n// --------\n// The semantic operation an ACP session serves. Deliberately NOT an\n// `LLMProvider_OperationKey`: a run that edits a worktree, executes commands\n// and requests authorisation is a different KIND of work from a text\n// completion, and the two enums being disjoint is what lets an agent\n// configuration be narrowed by its operation key alone.\n//===============================================================\n\nexport enum CodingAgent_OperationKey {\n /* A bounded, scoped change to a workspace, performed by an autonomous agent. /\n RUN_CODING_TASK = \"coding.runCodingTask\",\n}\n\n/\n Why a prompt turn ended.\n \n The wire values are ACP's own — this is the thin boundary where the\n * protocol's vocabulary is translated into a named one Wildo can branch on and\n * explain. `CANCELLED` in particular must stay distinguishable from `END_TURN`:\n * a cancelled run's partial change set is a different fact from a completed\n * run's, and a lane that conflates them reports work as finished that was\n * interrupted.\n /\nexport enum CodingAgent_StopReason {\n /* The agent finished of its own accord. /\n END_TURN = \"end_turn\",\n /* The model's output limit was reached mid-work. /\n MAX_TOKENS = \"max_tokens\",\n /* The agent's own per-turn request budget was exhausted. /\n MAX_TURN_REQUESTS = \"max_turn_requests\",\n /* The model declined the task. /\n REFUSAL = \"refusal\",\n /* The client asked the session to stop, and the agent complied. /\n CANCELLED = \"cancelled\",\n /\n WILDO'S OWN marker, not an ACP wire value: the agent reported a stop reason\n * this protocol version does not define.\n \n It exists so an unknown value cannot discard evidence. The alternative —\n * throwing — happens AFTER the turn, i.e. after the workspace has already been\n * mutated, so it would turn a completed run into an error whose change set\n * nobody records. Callers must treat this like `CANCELLED`: not a working\n * result, but a run whose changes are real and must still be captured.\n /\n UNRECOGNISED = \"wildo.unrecognised\",\n}\n\n/\n What an END_TURN actually meant — the judgment the turn ladder branches on.\n \n ACP delivers every voluntary stop identically: `end_turn` plus whatever the\n * agent last said. Three very different situations arrive in that one shape,\n * and only reading the message tells them apart, which is why this is decided\n * by an auxiliary LLM classification rather than by a heuristic on the text:\n * a regex that recognises \"shall I continue?\" is an invented vocabulary for\n * someone else's prose.\n /\nexport enum CodingAgent_EndOfTurnClassification {\n /* The agent finished the task; the turn is a final result. /\n TASK_COMPLETE = \"task_complete\",\n /\n The agent paused of its own accord — \"next?\", \"want me to proceed?\" — a\n * checkpoint reflex, not a need. The ladder answers it with the continuation\n * prompt instead of surfacing it, because at this level those checkpoints are\n * deliberately avoided (autonomy directive, 2026-09-04).\n /\n SELF_PAUSE = \"self_pause\",\n /\n The agent asked something only the caller can answer — a real decision, a\n * missing credential, an ambiguity in the task. The session parks and the\n * question is surfaced; auto-continuing would make the agent answer itself.\n /\n NEEDS_INPUT = \"needs_input\",\n /\n The classifier itself failed or timed out. FAILS OPEN to settlement: the\n * turn is treated as TASK_COMPLETE, because an auxiliary call must never hang\n * the autonomous lane or discard a mutated workspace — but the failure is\n * recorded as this value rather than laundered into a confident judgment.\n /\n CLASSIFIER_UNAVAILABLE = \"classifier_unavailable\",\n}\n\n/\n One auto-continuation the turn ladder performed, recorded per turn boundary.\n \n Kept as a record rather than a counter for the same reason permission\n * decisions are: a run that continued five times and one that never paused are\n * different runs, and the difference is diagnosable only if each boundary says\n * what was classified and what was sent back.\n /\nexport const CodingAgent_ContinuationRecordSchema = z.strictObject({\n /* 1-based index of the turn that ENDED at this boundary. /\n turnIndex: z.number().int().positive(),\n classification: z.enum(CodingAgent_EndOfTurnClassification),\n /\n The tail of the agent's end-of-turn message the classification was made\n * from. A bounded excerpt, not the transcript — enough to audit the judgment.\n /\n agentMessageTail: z.string().optional(),\n});\nexport type CodingAgent_ContinuationRecord = z.infer<typeof CodingAgent_ContinuationRecordSchema>;\n\n/\n A run that STOPPED WITHOUT FINISHING because the agent needs an answer.\n \n The ACP sibling of `AgentApprovalSuspension` on the LLM transport: the\n * invocation returns, but its output must not be read as a completed result —\n * `suspension` present means the final message is a QUESTION. The caller\n * surfaces the question, and the answer re-enters the SAME session:\n * `resumable: true` promises the agent advertised `loadSession`, so the session\n * survives the child process and even a host restart.\n /\nexport const CodingAgent_SessionSuspensionSchema = z.strictObject({\n /* The ACP session to resume with the answer. /\n sessionId: z.string().min(1),\n /* The agent's question, verbatim — its end-of-turn message. /\n question: z.string().min(1),\n /* 1-based turn the session parked after. /\n turnIndex: z.number().int().positive(),\n /\n Whether the session can be re-entered after the agent process is gone.\n * False when the agent does not advertise `loadSession`: the question is\n * still real, but answering it starts a NEW session that must restate task\n * context — a degradation the caller should surface, not hide.\n /\n resumable: z.boolean(),\n /\n An INFORMATIONAL freshness bound for the question (ISO timestamp), surfaced to the operator —\n * never a reaping deadline. No child process is held open while a run is parked (see\n * `awaitingInputTtlMs`), so there is nothing that closes at this instant. It said \"when the parked\n * child process will be closed\" until 2026-09-24, contradicting the contract above it, and a host\n * read it that way and aborted answerable questions at boot (#1533).\n /\n parkedUntil: z.string().optional(),\n});\nexport type CodingAgent_SessionSuspension = z.infer<typeof CodingAgent_SessionSuspensionSchema>;\n\n/\n What one coding turn consumed.\n \n EVERY field is optional, and that is a statement about the protocol rather\n * than laziness. ACP guarantees only the context-window pair (`used` / `size`)\n * on its usage notification; token breakdowns and monetary cost are agent\n * EXTENSIONS — Claude's adapter reports all of them, another agent may report\n * none. Code that enforces a budget must therefore decide what to do when the\n * number it wants is absent, and the schema makes that unavoidable rather than\n * letting a missing value read as zero.\n \n This is the capability the transport it replaces could not express at all:\n * a one-shot CLI reported nothing, so budgets were reduced to wall-clock and\n * run-count proxies.\n /\nexport const CodingAgent_UsageSchema = z.object({\n /* Context-window tokens in use at the end of the turn (ACP: `usage_update.used`). /\n contextUsed: z.number().int().nonnegative().optional(),\n /* Total context window available (ACP: `usage_update.size`). /\n contextWindowSize: z.number().int().nonnegative().optional(),\n inputTokens: z.number().int().nonnegative().optional(),\n outputTokens: z.number().int().nonnegative().optional(),\n /* Tokens READ from the prompt cache — typically the dominant term for a coding turn. /\n cachedReadTokens: z.number().int().nonnegative().optional(),\n /* Tokens WRITTEN to the prompt cache. /\n cachedWriteTokens: z.number().int().nonnegative().optional(),\n totalTokens: z.number().int().nonnegative().optional(),\n /\n Monetary cost of the turn, when the agent reports one.\n \n Kept as an amount + currency pair rather than a bare number: a budget\n * denominated in an unstated currency is not a budget. Amount is a plain\n * number because it arrives that way; anything that ACCUMULATES cost should\n * round explicitly at its own boundary rather than trusting float addition.\n /\n cost: z.object({\n amount: z.number().nonnegative(),\n currency: z.string().min(1),\n }).optional(),\n});\nexport type CodingAgent_Usage = z.infer<typeof CodingAgent_UsageSchema>;\n\n/\n Transport metadata for a completed coding run.\n \n Note where this lives: WITH the coding-agent family, not in the LLM\n * protocol's transport union. A coding run is not an LLM call with a different\n * wire format, and recording it inside the LLM execution-metadata union would\n * re-create, one layer down, exactly the mis-modelling this protocol exists to\n * end.\n /\nexport const AgentClientProtocol_ExecutionTransportMetadataSchema = z.object({\n protocolKind: z.literal(ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL),\n providerRef: z.string(),\n executionProfileRef: z.string(),\n model: z.string().optional(),\n /* The ACP major version agreed at `initialize`. /\n negotiatedProtocolVersion: z.number().int().positive().optional(),\n /* The agent's self-reported build — the first question when a run misbehaves. /\n agentName: z.string().optional(),\n agentVersion: z.string().optional(),\n /\n The agent-declared session mode the run actually executed under.\n \n Recorded verbatim as the agent named it, because it is the agent's\n * vocabulary and the mapping from Wildo's ceiling is lossy in one direction:\n * knowing the run was clamped to `PROMPT_ALWAYS` does not tell a later reader\n * which of the agent's modes that became.\n /\n sessionModeId: z.string().optional(),\n /\n Whether the agent this run started DECLARES that it escalates before\n * mutating, and whether Wildo's in-flight guards could therefore fire.\n \n Recorded on the run because the ceiling alone no longer explains the run:\n * `permissionCeiling: PROMPT_ALWAYS` against an agent that never asks and\n * against one that always asks describe two completely different runs, and\n * nothing else in this metadata tells them apart. A later reader looking at a\n * change set needs to know whether anything stood between the agent and it.\n \n Optional because the declaration is a provider fact and a run recorded\n * before this field existed genuinely has no answer — absence must not read as\n * `false`, which would assert an unbound run that may have been fully bound.\n /\n permissionEscalation: z.enum(AgentClientProtocol_PermissionEscalationBehaviour).optional(),\n /\n The resolved answer for THIS run, from\n * {@link agentClientProtocolInFlightGuardsCanFire} — the declared behaviour\n * combined with whether the composed environment actually supplied the\n * configuration a conditionally-escalating agent needs.\n \n Kept beside the behaviour rather than derived by each reader, because the\n * conditional member cannot be resolved from the behaviour alone and a reader\n * that tried would answer `true` for an agent that was dispatched unconfigured.\n /\n inFlightPermissionGuardsCanFire: z.boolean().optional(),\n /* The ACP session, retained so a later turn can resume or fork it. /\n sessionId: z.string().optional(),\n});\nexport type AgentClientProtocol_ExecutionTransportMetadata = z.infer<typeof AgentClientProtocol_ExecutionTransportMetadataSchema>;\n\nexport const CodingAgent_OperationContext_BaseSchema = ExternalProvider_OperationContextSchema.extend({\n usage: CodingAgent_UsageSchema.optional(),\n executionTime: z.number().optional(),\n finishedAt: z.string().optional(),\n transport: AgentClientProtocol_ExecutionTransportMetadataSchema.optional(),\n});\nexport type CodingAgent_OperationContext_Base = z.infer<typeof CodingAgent_OperationContext_BaseSchema>;\n\nexport type CodingAgent_OperationDefinitionBase = ExternalProvider_OperationDefinition_Base & {\n operationContextSchema: typeof CodingAgent_OperationContext_BaseSchema,\n supportedModels?: string[],\n};\n\n// ===============================================================\n// Coding-agent I/O\n// ===============================================================\n\n/\n Model-selection configuration for a coding agent.\n \n Deliberately smaller than its LLM sibling, and the omissions are the design.\n * There is no `temperature`, `topP` or penalty here: those tune a completion,\n * and an ACP agent is not one — it runs its own inner loop, chooses its own\n * tools and manages its own sampling. Offering an application knobs the\n * transport cannot honour would be worse than offering none, because it would\n * read as configuration and behave as decoration.\n \n `maxTokens` is likewise absent: a coding run's budget is enforced by the\n * caller against reported usage after each turn, not requested up front — the\n * agent decides how many model calls its task needs.\n /\nexport const CodingAgent_OperationModelConfiguration_Schema = z.object({\n model: z.string(),\n providerRef: z.string(),\n});\nexport type CodingAgent_OperationModelConfiguration = z.infer<typeof CodingAgent_OperationModelConfiguration_Schema>;\n\nexport const CodingAgent_RunTaskInputSchema = z.object({\n /\n The rendered task handed to the agent as the turn's prompt.\n \n A single string on purpose: the caller owns task composition (for\n * application creation, a typed task contract renders it), and the transport\n * must not become a second place where task semantics are assembled.\n /\n prompt: z.string().min(1),\n /\n The autonomy this particular run asks for.\n \n INTERSECTED, never honoured blindly: dispatch admits only tool kinds shared by\n * this policy and the execution profile's `permissionCeiling`. Absent means the profile's ceiling\n * — which is itself the safe default — so omitting it can never widen\n * authority, only leave it where the profile put it.\n /\n requestedPermissionCeiling: z.enum(AgentClientProtocol_PermissionCeiling).optional(),\n /\n Present when this run ANSWERS a parked session rather than starting a task.\n \n Carries the `sessionId` from a prior run's `suspension`; the transport\n * re-enters that session via `session/load` and delivers `prompt` (the\n * answer) as the next turn. Refused — not degraded — when the agent does not\n * advertise `loadSession`: silently starting a fresh session would present a\n * context-less answer as a continuation.\n /\n continuationOfSessionId: z.string().min(1).optional(),\n});\nexport type CodingAgent_RunTaskInput = z.infer<typeof CodingAgent_RunTaskInputSchema>;\n\nexport const CodingAgent_RunTaskOutputSchema = z.object({\n /* The agent's closing message — its own account of what it did. /\n finalMessage: z.string(),\n stopReason: z.enum(CodingAgent_StopReason),\n /\n Absolute paths the agent REPORTED writing, from its tool-call stream: the locations of its `edit`,\n * `delete` and `move` tool calls, never those of a read or a search (#1805).\n \n A claim, not a record. An agent reports what its own tooling surfaces, and\n * nothing prevents it writing a file it never mentions — measured against\n * Claude's adapter, file operations happen inside the agent and are reported\n * afterwards rather than routed through the client. Use this to NARROW an\n * attribution question; never as the answer. The authoritative record of what\n * changed is the workspace diff taken around the run.\n /\n reportedFileLocations: z.array(z.string()).optional(),\n /\n How many permission requests the client REFUSED during the turn.\n \n Recorded because under the strictest ceiling refusal is the NORMAL outcome,\n * not an exception: without this number a run in which the agent proposed five\n * changes and was refused every one is indistinguishable from a run in which\n * it proposed nothing. The agent's own closing message cannot be relied on to\n * say so.\n /\n deniedPermissionCount: z.number().int().nonnegative().optional(),\n /\n One record per permission request, with the REASON it was decided.\n \n The count above says HOW MANY were refused; this says WHY, which is the half that makes a\n * refusal actionable. A run under an UNRESTRICTED ceiling came back with two refusals and no\n * files written, and nothing recorded could distinguish \"the scope predicate refused a path\"\n * from \"the agent offered no option the client would select\" — opposite defects with an\n * identical outward appearance, and neither diagnosable without dispatching another agent.\n \n Deliberately carries no prompt or file CONTENT: the tool kind, the declared paths, the\n * option kinds offered, and the decision.\n /\n permissionDecisions: z.array(z.strictObject({\n allowed: z.boolean(),\n reason: z.string(),\n toolKind: z.string().optional(),\n locations: z.array(z.string()),\n offeredOptionKinds: z.array(z.string()),\n })).optional(),\n /\n The agent's verbatim stop reason when it was one this version does not\n * define. Present exactly when `stopReason` is `UNRECOGNISED`.\n /\n rawStopReason: z.string().optional(),\n /\n How many prompt turns this invocation drove on the session. Absent means\n * one — the single-turn shape every pre-ladder consumer already assumes.\n /\n turnCount: z.number().int().positive().optional(),\n /\n One record per turn boundary the ladder judged — auto-continues, the park,\n * the settlement. See {@link CodingAgent_ContinuationRecordSchema}.\n /\n continuations: z.array(CodingAgent_ContinuationRecordSchema).optional(),\n /\n Present when the run PARKED on a genuine question instead of finishing.\n * `finalMessage` is then the QUESTION, and `stopReason` is the wire-true\n * `END_TURN` — this field is what stops that reading as a completed result.\n * Callers that ignore it record work as done that is waiting on an answer.\n /\n suspension: CodingAgent_SessionSuspensionSchema.optional(),\n});\nexport type CodingAgent_RunTaskOutput = z.infer<typeof CodingAgent_RunTaskOutputSchema>;\n\n/\n One declared coding destination, joined to the provider and profile that declare it.\n \n Flat rather than nested because every consumer so far wants to enumerate destinations, not walk a\n * tree — and a nested shape makes \"which provider declares nothing\" a hole a caller has to notice\n * rather than a row it is handed. {@link CodingModelDestinationReading} carries both.\n /\nexport interface CodingModelDestinationEntry {\n readonly providerRef: string;\n readonly executionProfileRef: string;\n readonly model: string;\n readonly destination: AgentClientProtocol_ModelDestination;\n}\n\n/* What {@link readCodingModelDestinations} found, including what it found MISSING. /\nexport interface CodingModelDestinationReading {\n /* Every declared destination, sorted by provider, profile then model. /\n readonly destinations: readonly CodingModelDestinationEntry[];\n /\n Profiles that can run a coding agent and declare NO destination at all.\n \n Reported as its own list rather than as an absence, because this is the gap a compliance brief\n * must name: a run through such a profile sends source code somewhere the register cannot describe.\n /\n readonly profilesWithoutDestinations: readonly { readonly providerRef: string; readonly executionProfileRef: string }[];\n}\n\n/\n Read per-model coding destinations out of an application's provider configurations.\n \n ## Why this function exists at all\n \n `providerConfigurations` is `Record<string, Record<string, unknown>>` — genuinely opaque, and\n * `ApplicationProviderComplianceChoice` warns for that reason that \"a compliance answer must not live\n * somewhere nothing can read it without knowing the provider\". The destination has to live there\n * anyway (it is per MODEL, and no per-provider surface can hold it), so the objection is answered by\n * making the reader NAMED and exported beside the schema instead of leaving each consumer to reach in\n * and guess a shape. A compliance renderer calls this; it never parses the bag.\n \n ## What it does with malformed input\n \n SKIPS it, silently, and this is deliberate rather than lax. The function's job is to report what an\n * application declared, and it is called from a compliance BRIEF — a lane that must not fail because\n * one provider's opaque configuration has an unexpected shape. A profile whose destinations do not\n * parse contributes nothing and therefore surfaces in `profilesWithoutDestinations`, which is the\n * honest reading: nothing usable was declared.\n \n Nothing is lost by that leniency, because a malformed profile is ALREADY refused where it matters:\n * `getAgentClientProtocolExecutionProfile` parses every profile through\n * {@link AgentClientProtocol_ExecutionProfileSchema} when a run resolves one, and throws\n * `ErrorType.CONFIGURATION` naming the provider and profile. So a bad destination fails the CODING RUN\n * loudly, with an author present, while the compliance brief still reports the other twenty providers.\n * Two surfaces, two correct answers — and note that the profile schema is `.strict()`, so before\n * `modelDestinations` existed as a declared field an application COULD NOT have authored it at all.\n /\nexport function readCodingModelDestinations(\n /\n * `unknown` per value, not `Record<string, unknown>`, because that is what the bag genuinely is at\n * every consumer — `ProviderConfigurations` types each entry as optional and the companion's own\n * local view types it as `unknown`. Declaring a narrower parameter would push a cast onto every\n * caller, which is how a reader written to STOP callers guessing a shape starts making them assert\n * one.\n /\n providerConfigurations: Readonly<Record<string, unknown>>,\n): CodingModelDestinationReading {\n const destinations: CodingModelDestinationEntry[] = [];\n const profilesWithoutDestinations: { providerRef: string; executionProfileRef: string }[] = [];\n\n for (const providerRef of Object.keys(providerConfigurations).sort()) {\n const providerConfiguration = providerConfigurations[providerRef];\n if (providerConfiguration === null \|\| typeof providerConfiguration !== 'object') continue;\n const acpConfiguration = (providerConfiguration as Record<string, unknown>)[\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL\n ];\n if (acpConfiguration === null \|\| typeof acpConfiguration !== 'object') continue;\n\n const profiles = (acpConfiguration as { executionProfiles?: unknown }).executionProfiles;\n if (profiles === null \|\| typeof profiles !== 'object') continue;\n\n for (const executionProfileRef of Object.keys(profiles as Record<string, unknown>).sort()) {\n const profile = (profiles as Record<string, unknown>)[executionProfileRef];\n const declared = (profile as { modelDestinations?: unknown } \| null \| undefined)?.modelDestinations;\n const parsed = z.record(z.string().trim().min(1), AgentClientProtocol_ModelDestinationSchema)\n .safeParse(declared);\n\n if (!parsed.success \|\| Object.keys(parsed.data).length === 0) {\n profilesWithoutDestinations.push({ providerRef, executionProfileRef });\n continue;\n }\n\n for (const model of Object.keys(parsed.data).sort()) {\n destinations.push({ providerRef, executionProfileRef, model, destination: parsed.data[model] });\n }\n }\n }\n\n return { destinations, profilesWithoutDestinations };\n}\n\n/\n The ACP tool kinds that WRITE the workspace (#1805) — the one source for \"is this tool call a write?\".\n \n A concurrent coding run claims a file only on evidence it wrote it: a writing tool call's locations, or an\n * ALLOWED permission request for a writing tool. A read or a search reports locations too, and claiming those\n * committed files a run only read under its name.\n \n semantic-literal-boundary: ACP's `ToolKind` is the protocol's open string vocabulary, translated here.\n * spec-cite: ACP v2 schema, `ToolKind` = \"read\" \| \"edit\" \| \"delete\" \| \"move\" \| \"search\" \| \"execute\" \| \"think\" \| \"fetch\" \| \"switch_mode\" \| \"other\" (types.gen.d.ts, @agentclientprotocol/sdk; protocol docs \"Tool Calls — Creating\").\n * `execute` is left out: a shell command may write, but the locations it reports are what it was pointed\n * at, not what it wrote, and a run that wrote through its shell is exactly the case claims cannot see.\n /\nexport const ACP_WRITING_TOOL_KINDS: ReadonlySet<string> = new Set(['edit', 'delete', 'move']);\n\n/* Whether an ACP tool kind writes the workspace; an absent kind is no evidence that it does. */\nexport function isWritingAcpToolKind(kind: string \| undefined): boolean {\n return kind !== undefined && ACP_WRITING_TOOL_KINDS.has(kind);\n}\n"]}
1	+ {"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,uCAAuC,GAExC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EAEvB,0DAA0D,EAC1D,sCAAsC,GACrC,MAAM,oDAAoD,CAAC;AAE9D,iEAAiE;AACjE,8BAA8B;AAC9B,WAAW;AACX,+EAA+E;AAC/E,gFAAgF;AAChF,0EAA0E;AAC1E,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,8DAA8D;AAC9D,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,qCAAqC;AACrC,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,wEAAwE;AACxE,2EAA2E;AAC3E,4CAA4C;AAC5C,EAAE;AACF,+BAA+B;AAC/B,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,qEAAqE;AACrE,iEAAiE;AAEjE;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,8BAEX;AAFD,WAAY,8BAA8B;IACxC,2EAAyC,CAAA;AAC3C,CAAC,EAFW,8BAA8B,KAA9B,8BAA8B,QAEzC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,4BAYX;AAZD,WAAY,4BAA4B;IACtC,oFAAoF;IACpF,6CAAa,CAAA;IACb;;;;;OAKG;IACH,6DAA6B,CAAA;IAC7B,gFAAgF;IAChF,qFAAqD,CAAA;AACvD,CAAC,EAZW,4BAA4B,KAA5B,4BAA4B,QAYvC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,0CAGX;AAHD,WAAY,0CAA0C;IACpD,+EAAiC,CAAA;IACjC,iGAAmD,CAAA;AACrD,CAAC,EAHW,0CAA0C,KAA1C,0CAA0C,QAGrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,sGAAsG;AACtG,MAAM,CAAN,IAAY,qCA4FX;AA5FD,WAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,wEAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,gFAAuC,CAAA;IACvC;;;;;;;;;;;;;;OAcG;IACH,gFAAuC,CAAA;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,oGAA2D,CAAA;IAC3D;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sEAA6B,CAAA;AAC/B,CAAC,EA5FW,qCAAqC,KAArC,qCAAqC,QA4FhD;AACD,oDAAoD;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,wCAAwC,CACtD,OAA8C;IAE9C,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,qCAAqC,CAAC,aAAa;YACtD,OAAO,CAAC,CAAC;QACX,KAAK,qCAAqC,CAAC,iBAAiB;YAC1D,OAAO,CAAC,CAAC;QACX,KAAK,qCAAqC,CAAC,iBAAiB;YAC1D,OAAO,CAAC,CAAC;QACX,KAAK,qCAAqC,CAAC,2BAA2B;YACpE,OAAO,CAAC,CAAC;QACX,KAAK,qCAAqC,CAAC,YAAY;YACrD,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,mCAOX;AAPD,WAAY,mCAAmC;IAC7C,yDAAyD;IACzD,wEAAiC,CAAA;IACjC,0EAA0E;IAC1E,gFAAyC,CAAA;IACzC,yGAAyG;IACzG,0EAAmC,CAAA;AACrC,CAAC,EAPW,mCAAmC,KAAnC,mCAAmC,QAO9C;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,oDAAuB,CAAA;IACvB,sDAAyB,CAAA;IACzB,4DAA+B,CAAA;IAC/B,gDAAmB,CAAA;AACrB,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,gDAAgD,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,yGAAyG;AACzG,MAAM,CAAN,IAAY,iDAwBX;AAxBD,WAAY,iDAAiD;IAC3D;;;;OAIG;IACH,sGAAiD,CAAA;IACjD;;;;;;;;OAQG;IACH,kIAA6E,CAAA;IAC7E;;;;;OAKG;IACH,kFAA6B,CAAA;AAC/B,CAAC,EAxBW,iDAAiD,KAAjD,iDAAiD,QAwB5D;AACD,uDAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wCAAwC,CACtD,SAA4D,EAC5D,+BAAwC;IAExC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,iDAAiD,CAAC,sBAAsB;YAC3E,OAAO,IAAI,CAAC;QACd,KAAK,iDAAiD,CAAC,oCAAoC;YACzF,OAAO,+BAA+B,CAAC;QACzC,KAAK,iDAAiD,CAAC,YAAY;YACjE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,kHAAkH;AAClH,MAAM,CAAN,IAAY,gDAgBX;AAhBD,WAAY,gDAAgD;IAC1D,sFAAsF;IACtF,yEAAqB,CAAA;IACrB;;;;OAIG;IACH,6FAAyC,CAAA;IACzC;;;;;OAKG;IACH,qFAAiC,CAAA;AACnC,CAAC,EAhBW,gDAAgD,KAAhD,gDAAgD,QAgB3D;AACD,gEAAgE;AAEhE,qGAAqG;AACrG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C;;;;;;OAMG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D;;;;;;;;;;OAUG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,mDAAmD;AAEnD;;;;;GAKG;AACH,qGAAqG;AACrG,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CACxD,8BAA8B,CAAC,kBAAkB,CAClD;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;;;;;OAcG;IACH,6BAA6B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC;;;;;;;;OAQG;IACH,8BAA8B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/E,iEAAiE;IACjE,6BAA6B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,OAAO,CAChF,0CAA0C,CAAC,cAAc,CAC1D;IACD,4BAA4B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CACtE,qCAAqC,CAAC,aAAa,CACpD;IACD,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC,OAAO,CAC5F,gDAAgD,CAAC,kBAAkB,CACpE;IACD;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD;;;;;;;;;;OAUG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D;;;;;;;;;;;;OAYG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAChE;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE;;;;;;;;OAQG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0CAA0C,CAAC,CAAC,QAAQ,EAAE;IAC5G;;;;;;;;;OASG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACrG,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,wEAAwE;YACjF,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,+EAA+E;YACxF,IAAI,EAAE,CAAC,kBAAkB,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,wBAAwB;IACxB,IACE,OAAO,CAAC,QAAQ,KAAK,4BAA4B,CAAC,wBAAwB;QAC1E,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,EAC3E,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,8FAA8F;YACvG,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IAED,IACE,OAAO,CAAC,sBAAsB,KAAK,0CAA0C,CAAC,uBAAuB;QACrG,CAAC,OAAO,CAAC,4BAA4B,EACrC,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,kFAAkF;YAC3F,IAAI,EAAE,CAAC,8BAA8B,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,IACE,OAAO,CAAC,sBAAsB,KAAK,0CAA0C,CAAC,uBAAuB;QACrG,OAAO,CAAC,4BAA4B,KAAK,SAAS,EAClD,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,oFAAoF;YAC7F,IAAI,EAAE,CAAC,8BAA8B,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,+EAA+E;IAC/E,IACE,OAAO,CAAC,iBAAiB,KAAK,qCAAqC,CAAC,YAAY;QAChF,OAAO,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,uBAAuB,CAAC,WAAW,CAAC,EACjH,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0GAA0G;YAC5G,IAAI,EAAE,CAAC,mBAAmB,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,mDAAmD;AAEnD,MAAM,CAAC,MAAM,uCAAuC,GAAG,0DAA0D,CAAC,MAAM,CAAC;IACvH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,0CAA0C,CAAC;CACpF,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,MAAM,CAAC,0BAA0B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACtG,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,4EAA4E;YACrF,IAAI,EAAE,CAAC,4BAA4B,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKH,iEAAiE;AACjE,gCAAgC;AAChC,WAAW;AACX,oEAAoE;AACpE,6EAA6E;AAC7E,qEAAqE;AACrE,qEAAqE;AACrE,wDAAwD;AACxD,iEAAiE;AAEjE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,iFAAiF;IACjF,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,sBAsBX;AAtBD,WAAY,sBAAsB;IAChC,4CAA4C;IAC5C,+CAAqB,CAAA;IACrB,qDAAqD;IACrD,mDAAyB,CAAA;IACzB,6DAA6D;IAC7D,iEAAuC,CAAA;IACvC,mCAAmC;IACnC,6CAAmB,CAAA;IACnB,oEAAoE;IACpE,iDAAuB,CAAA;IACvB;;;;;;;;;OASG;IACH,6DAAmC,CAAA;AACrC,CAAC,EAtBW,sBAAsB,KAAtB,sBAAsB,QAsBjC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,mCA8BX;AA9BD,WAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,sEAA+B,CAAA;IAC/B;;;;;OAKG;IACH,gEAAyB,CAAA;IACzB;;;;;;;;;;;OAWG;IACH,kEAA2B,CAAA;IAC3B;;;;;OAKG;IACH,wFAAiD,CAAA;AACnD,CAAC,EA9BW,mCAAmC,KAAnC,mCAAmC,QA8B9C;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,6DAA6D;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC;IAC3D;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,iDAAiD;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,kHAAkH;IAClH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,6CAA6C;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD,iEAAiE;IACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC3D,0CAA0C;IAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD;;;;;;;OAOG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3E,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,qBAAqB,CAAC;IACrF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,oDAAoD;IACpD,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE,kFAAkF;IAClF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;;;;;;;;;;;OAaG;IACH,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC,QAAQ,EAAE;IAC1F;;;;;;;;;OASG;IACH,+BAA+B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvD,uEAAuE;IACvE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uCAAuC,GAAG,uCAAuC,CAAC,MAAM,CAAC;IACpG,KAAK,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,oDAAoD,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC;AAQH,kEAAkE;AAClE,mBAAmB;AACnB,kEAAkE;AAElE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACrE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB;;;;;;;OAOG;IACH,0BAA0B,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IACpF;;;;;;;;OAQG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;;;;OAQG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAChE;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9B,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACxC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACd;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;IACvE;;;;;OAKG;IACH,UAAU,EAAE,mCAAmC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AA8BH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,2BAA2B;AACzC;;;;;;GAMG;AACH,sBAAyD;IAEzD,MAAM,YAAY,GAAkC,EAAE,CAAC;IACvD,MAAM,2BAA2B,GAA2D,EAAE,CAAC;IAE/F,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrE,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,qBAAqB,KAAK,IAAI,IAAI,OAAO,qBAAqB,KAAK,QAAQ;YAAE,SAAS;QAC1F,MAAM,gBAAgB,GAAI,qBAAiD,CACzE,sCAAsC,CAAC,qBAAqB,CAC7D,CAAC;QACF,IAAI,gBAAgB,KAAK,IAAI,IAAI,OAAO,gBAAgB,KAAK,QAAQ;YAAE,SAAS;QAEhF,MAAM,QAAQ,GAAI,gBAAoD,CAAC,iBAAiB,CAAC;QACzF,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,SAAS;QAEhE,KAAK,MAAM,mBAAmB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAmC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1F,MAAM,OAAO,GAAI,QAAoC,CAAC,mBAAmB,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAI,OAA8D,EAAE,iBAAiB,CAAC;YACpG,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,0CAA0C,CAAC;iBAC1F,SAAS,CAAC,QAAQ,CAAC,CAAC;YAEvB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7D,2BAA2B,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBACvE,SAAS;YACX,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpD,YAAY,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,2BAA2B,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/F,iGAAiG;AACjG,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,OAAO,IAAI,KAAK,SAAS,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAAC,iBAAyB,EAAE,MAAe,EAAE,aAAkC;IAC/H,IAAI,iBAAiB,KAAK,WAAW,IAAI,iBAAiB,KAAK,kBAAkB;QAAE,OAAO,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,UAAU,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,OAAO,MAAM,CAAC,SAAS;SACpB,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAAC;SACnJ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport {\n ExternalProvider_OperationContextSchema,\n ExternalProvider_OperationDefinition_Base,\n} from \"../core/operations.external-connectors-models.schemas\";\nimport {\n APPLICATION_ENVIRONMENT,\n ExternalProvider_ExchangeProtocol_Configuration_Base,\n ExternalProvider_ExchangeProtocol_Configuration_BaseSchema,\n ExternalProvider_ExchangeProtocol_Kind,\n } from \"../core/commons.external-connectors-models.schemas\";\n\n//===============================================================\n// Agent Client Protocol (ACP)\n// --------\n// Execution protocol for CODING AGENTS: a long-lived JSON-RPC 2.0 session over\n// stdio between Wildo (the ACP client) and an agent subprocess that reads and\n// writes a workspace, runs commands, and asks permission before doing so.\n//\n// This is Zed's Agent Client Protocol (agentclientprotocol.com), NOT IBM's\n// \"Agent Communication Protocol\" — that one is agent-to-agent and overlaps\n// `A2A_CONNECTOR`. The two share an acronym and nothing else.\n//\n// # Why this is not a one-shot CLI transport with extra fields\n//\n// The transport this REPLACED (removed 2026-08-27) modelled ONE-SHOT command\n// execution: compose argv, feed stdin, wait for exit, parse stdout. Every field\n// it owned (`outputParserMode`, `jsonOutputPath`, per-operation argument\n// templates) described that shape. A\n// coding agent is the opposite shape — a session that streams progress, calls\n// back into the client for permission, survives many turns, and reports token\n// usage as it goes. Modelling it as a one-shot text call is precisely what left\n// the previous lane with no token accounting, no permission channel, no\n// cancellation and no resumption: those are not missing features, they are\n// consequences of the wrong protocol shape.\n//\n// # Deliberately AGENT-NEUTRAL\n//\n// Wildo's default coding agent is Claude Code (through Zed's ACP adapter), but\n// nothing in this contract names it. Every agent-specific concept is either\n// negotiated at runtime (the agent advertises its capabilities and session\n// modes in its `initialize` / `session/new` responses) or authored as opaque\n// `sessionMetaExtensions`. That is what makes selecting a different registered\n// ACP agent a configuration change rather than a new execution lane.\n//===============================================================\n\n/*\n Where the agent subprocess runs.\n \n Only one host exists today, and it is the same constraint the coding lane has\n * always had: the agent must share a filesystem with the workspace it mutates.\n * A remote host is not a variant of this — it would need the workspace shipped\n * to it, which is a different design, so it is deliberately not enumerated\n * until it exists.\n /\nexport enum AgentClientProtocol_RunnerHost {\n BACKEND_SUBPROCESS = \"backend_subprocess\",\n}\n\n/\n How the spawned agent authenticates to its own model provider.\n \n ACP additionally defines a protocol-level `authenticate` method, advertised\n * through the agent's `authMethods` array. That is NOT enumerated here: when an\n * agent advertises auth methods the runner negotiates them at `initialize`\n * time, which is a runtime handshake rather than authored configuration. These\n * modes describe what the HOST does before the process starts.\n /\nexport enum AgentClientProtocol_AuthMode {\n /* The agent needs no credential (a local model, or an agent that refuses work). /\n NONE = \"none\",\n /\n The agent resolves its own credential from host state — an operator's prior\n * interactive login, a keychain entry, an ambient cloud identity. Wildo\n * injects nothing and can see nothing. This is the correct mode for a\n * developer-machine coding agent.\n /\n HOST_MANAGED = \"host_managed\",\n /* Wildo resolves a secret by ref and injects it into the child environment. /\n SECRET_REF_ENV_INJECTION = \"secret_ref_env_injection\",\n}\n\n/\n Which directory becomes the ACP session's `cwd`.\n \n ACP requires `cwd` to be an ABSOLUTE path and treats it as the session's\n * primary filesystem context. The absolute path itself is never authored here:\n * it is host authority supplied at invocation time, which is what makes a\n * profile portable across applications and machines.\n /\nexport enum AgentClientProtocol_WorkingDirectoryPolicy {\n WORKSPACE_ROOT = \"workspace_root\",\n WORKSPACE_RELATIVE_PATH = \"workspace_relative_path\",\n}\n\n/\n The MOST autonomy a session started from this profile may be granted.\n \n This is a Wildo-owned vocabulary, deliberately expressed in terms of what the\n * CLIENT must still decide rather than in any agent's mode identifiers. Agents\n * advertise their own modes at `session/new` (Claude's adapter offers\n * `default`, `auto`, `acceptEdits`, `plan`, `dontAsk`, `bypassPermissions`),\n * and those identifiers are agent-specific strings — binding a provider profile\n * to them would make the contract unusable for any other agent and would break\n * the moment an agent renames one.\n \n It is a CEILING, not a selection: the caller (for application creation, the\n * autonomy mode of the journey) chooses at or below it. An authored ceiling is\n * what lets an application say \"no session started from this profile may ever\n * skip the permission gate\" independently of what any individual run requests.\n \n Policies describe admitted tool-kind sets, not nested levels. Invocation overrides\n * intersect those sets with the profile: READS and EDITS have an empty intersection.\n * The rank helper is a presentation ordering only and must not select authority.\n /\n/* @wildo_source:part:start acp.permission-ceiling facet:layer:config facet:audience:app-developer /\nexport enum AgentClientProtocol_PermissionCeiling {\n /\n Every permission request the agent raises must be answered by the client.\n \n Note what this does and does not promise: it guarantees the CLIENT decides\n * every request the agent RAISES, not that the agent raises one per action.\n * Which tool calls escalate is the agent's own policy — measured against\n * Claude's adapter, file edits and writes prompt while a read-only shell\n * command does not. Treat this as \"no blanket pre-approval\", never as \"a\n * complete inventory of what the agent did\"; that inventory comes from the\n * tool-call stream and, authoritatively, from the change set.\n /\n PROMPT_ALWAYS = \"prompt_always\",\n /\n File edits are auto-accepted; everything else must still be answered.\n \n \"Must still be answered\" is a promise the CLIENT keeps, and it is only\n * keepable because the runner refuses to hand the decision to the agent.\n * Measured live against Claude's adapter on 2026-08-27: selecting that\n * agent's own `acceptEdits` session mode ALSO auto-approves arbitrary shell\n * commands, so a mutating `printf > file` executed with no permission request\n * at all and wrote outside the task's declared mutation scope. Under the\n * strictest mode the identical prompt escalated and was denied, and nothing\n * was written.\n \n So this ceiling is implemented by keeping the agent in its most-escalating\n * mode and auto-allowing edit-kind requests HERE. The agent's similarly named\n * mode is deliberately not selected: it grants strictly more than its name.\n /\n AUTO_ACCEPT_EDITS = \"auto_accept_edits\",\n /\n The protocol's NON-MUTATING tool kinds are auto-accepted; everything else must still be\n * answered — and with no human at the other end, that means denied.\n \n The read-only lane. `read`, `search`, `fetch` and `think` are exactly the kinds the Agent Client\n * Protocol itself classes as non-mutating; `edit`, `delete` and `move` are its mutating set and are\n * refused here, as are `execute` (which can mutate anything) and `other` (unclassified, so\n * fail-closed).\n \n Added 2026-08-29 because neither existing ceiling could express a research agent, MEASURED\n * rather than assumed: a probe under {@link PROMPT_ALWAYS} with every location refused had both\n * `WebFetch` and `WebSearch` arrive as `toolKind: 'fetch'` and be `ceiling_refused`, and the agent\n * ended its turn saying it would not guess a price from memory. So PROMPT_ALWAYS denies research\n * outright, and {@link AUTO_ACCEPT_EDITS} admits precisely the inverse of what research needs.\n /\n AUTO_ACCEPT_READS = \"auto_accept_reads\",\n /\n The non-mutating kinds AND the file-mutating kinds are auto-accepted; `execute` and the\n * unclassified `other` must still be answered — and with no human at the other end, that means\n * denied.\n \n Added 2026-09-04 for the research-agent evidence store, and MEASURED before it existed rather\n * than after: switching the research profile from {@link AUTO_ACCEPT_READS} to\n * {@link AUTO_ACCEPT_EDITS} — so the agent could persist findings to disk — silently inverted the\n * lane's whole posture, because the ceilings are kind-SETS, not nested ranks: a live compliance\n * run spent two rounds with every WebFetch/WebSearch refused, and its only output was a store\n * note titled \"NO EVIDENCE COLLECTED\". A lane that both reads the world and persists what it\n * read needs this member; neither existing set contains the other.\n \n The confinement story is unchanged: this ceiling decides KINDS, and the dispatch's location\n * predicate still decides PATHS — a research profile on this ceiling with a store-only predicate\n * can fetch anything and write only its evidence directory.\n /\n AUTO_ACCEPT_READS_AND_EDITS = \"auto_accept_reads_and_edits\",\n /\n No permission gate: every tool kind is pre-approved, `execute` and the unclassified `other`\n * included. Reserve for a disposable or isolated workspace.\n \n *This member also removes the task's mutation scope for shell commands, and that is a property\n of shell commands rather than of this value.** The scope predicate runs AFTER the ceiling and\n * denies any location the task did not authorise even here — so declared file EDITS stay confined.\n * But it decides on the `locations` a permission request carries, and a shell command carries\n * NONE, because what a command writes is not derivable from the command string. Every ceiling\n * below this one refuses `execute` outright, so the empty-location case never reaches the\n * predicate; under this one it does, and `locations.some(...)` over an empty array is vacuously\n * satisfied. A mutating command therefore reaches the workspace inside a complete, well-formed\n * permission record showing it was allowed.\n \n Not closable by deriving a scope from the command: any parse is defeated by `sh -c \"$CMD\"` or a\n * redirect through a substituted path, and an invented scope that can be walked around is worse\n * than a stated absence. So the residual exposure under this member is exactly \"shell commands are\n * unbounded\", the answer to it is git plus the post-run change set, and the companion WARNS on\n * every run whose mutation followed a permitted act that declared no location — which is how it\n * stops being invisible. Author this member to state that plainly; do not author it expecting the\n * mutation scope to hold for commands.\n \n Note this is a DIFFERENT hole from an agent that never asks (see\n * {@link AgentClientProtocol_PermissionEscalationBehaviour}): that one costs you both guards for\n * every act, and dispatch refuses a narrower ceiling against such an agent. This one costs you the\n * scope guard for one act kind, against a fully compliant agent.\n /\n UNRESTRICTED = \"unrestricted\",\n}\n/* @wildo_source:part:end acp.permission-ceiling /\n\n/\n Stable presentation order for {@link AgentClientProtocol_PermissionCeiling}.\n \n Never use this rank to authorize or clamp a request. READS and EDITS admit disjoint\n * tool-kind sets; choosing the numerically lower one can grant operations forbidden\n * by the profile. Dispatch computes their intersection instead.\n /\nexport function agentClientProtocolPermissionCeilingRank(\n ceiling: AgentClientProtocol_PermissionCeiling,\n): number {\n switch (ceiling) {\n case AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS:\n return 0;\n case AgentClientProtocol_PermissionCeiling.AUTO_ACCEPT_READS:\n return 1;\n case AgentClientProtocol_PermissionCeiling.AUTO_ACCEPT_EDITS:\n return 2;\n case AgentClientProtocol_PermissionCeiling.AUTO_ACCEPT_READS_AND_EDITS:\n return 3;\n case AgentClientProtocol_PermissionCeiling.UNRESTRICTED:\n return 4;\n }\n}\n\n/\n How a coding agent's host-login status command reports \"signed in\".\n \n An ACP agent that is not signed in still completes `initialize` and `session/new`; it fails the\n * first `session/prompt` (Claude's adapter 0.81.1: JSON-RPC `-32000 Authentication required`,\n * reproduced 2026-09-25). So the handshake proves nothing about the login, and a real prompt spends\n * a turn. Every agent's own CLI can answer without either — `claude auth status --json`,\n * `codex login status`, `opencode auth list` — but each answers in its own way, which is this enum.\n /\nexport enum AgentClientProtocol_HostLoginSignal {\n /* Signed in exactly when the status command exits 0. /\n EXIT_CODE_ZERO = 'exit_code_zero',\n /* Signed in when the command prints JSON whose named field is `true`. /\n JSON_BOOLEAN_FIELD = 'json_boolean_field',\n /* Signed in when the command exits 0 and its output does NOT match a pattern (e.g. `0 credentials`). /\n OUTPUT_EXCLUDES = 'output_excludes',\n}\n\n/\n What a host-login probe found for one coding agent.\n \n Four states, because the remedies differ: NOT_INSTALLED needs an install, SIGNED_OUT a login, and\n * UNKNOWN (the status command ran and its answer could not be read, or timed out) must never be\n * reported as either — reading it as SIGNED_IN dispatches a run that fails mid-turn, reading it as\n * SIGNED_OUT sends a signed-in operator to log in again.\n /\nexport enum CodingAgentHostLoginState {\n SIGNED_IN = 'signed_in',\n SIGNED_OUT = 'signed_out',\n NOT_INSTALLED = 'not_installed',\n UNKNOWN = 'unknown',\n}\n\n/\n How a dispatch refused because the coding agent's operator is not signed in begins — thrown by the\n * engine before an ACP session opens, and recognised by the companion as the HOST's failure (not the\n * task's), so a signed-out host does not spend a task's attempt budget. One constant for both sides.\n /\nexport const CODING_AGENT_NOT_SIGNED_IN_MESSAGE_PREFIX = 'The coding agent is not signed in on this host';\n\n/\n Whether THIS agent raises `session/request_permission` before it mutates —\n * the one property that decides whether Wildo's in-flight guards can fire at all.\n \n # Why a permission ceiling needs this to mean anything\n \n For agent-owned I/O, Wildo's in-flight controls are enforced in the CLIENT's ANSWER to a\n * permission request: {@link AgentClientProtocol_PermissionCeiling} decides the\n * tool KIND, and the dispatch's location predicate decides the PATHS. Neither is\n * a sandbox, an interposed filesystem, or a syscall filter — they are answers.\n * Client-hosted writes independently check both controls. An agent doing its OWN I/O\n * without asking is bound by neither, and the ceiling\n * an application authored is a LABEL rather than a guarantee.\n \n That is not hypothetical and it is not a fault in the agents. MEASURED with\n * `wildo acp probe`:\n \n - Codex (`@agentclientprotocol/codex-acp`, 2026-09-06) raises nothing before\n * an in-workspace write in ANY of its three modes, including with an explicit\n * `approval_policy = \"untrusted\"`. Its safety model is a SANDBOX, so an\n * in-workspace write is safe by ITS construction and there is nothing to ask\n * about. A different architecture, not a defect.\n * - OpenCode (1.18.27, 2026-09-04/05) does the same under its DEFAULT\n * configuration, and escalates correctly when pointed at a permission\n * configuration file. So for that agent the answer is conditional on\n * something the HOST supplies.\n * - Claude's adapter (`@agentclientprotocol/claude-agent-acp` 0.73.0) raises,\n * and both guards fire.\n \n # Why it is DECLARED rather than inferred, and why it is required\n \n It cannot be inferred before a run: an agent that never asks and an agent that\n * had nothing to ask about are indistinguishable from an empty decision list, and\n * by the time the list is empty the workspace has already been mutated. The\n * post-run change set remains the authoritative account of what a run touched —\n * this declaration is what lets the framework say, BEFORE the run, whether that\n * change set is the only account there will be.\n \n The provider declares it because the provider is the party that ran the probe.\n * It is REQUIRED on the runtime contract for the same reason `modelDelivery` is:\n * this lane has now shipped three safety-relevant fields that were authored,\n * documented and read by nothing (`hostConfigurationInheritance`, the model\n * channel, the provider's inherited environment). An author who cannot ship the\n * gap is better than one who discovers it on a dispatched run.\n \n It is a CLAIM, never an alibi. The companion still judges each completed run\n * from that run's OWN permission decisions and change set, so an agent whose\n * behaviour changes between versions cannot keep a stale, reassuring declaration.\n /\n/* @wildo_source:part:start acp.permission-escalation facet:layer:config facet:audience:app-developer /\nexport enum AgentClientProtocol_PermissionEscalationBehaviour {\n /\n The agent escalates before mutating, so the ceiling and the mutation scope\n * are both enforceable in flight. The only value under which a ceiling\n * narrower than UNRESTRICTED means what it says.\n /\n RAISES_BEFORE_MUTATION = \"raises_before_mutation\",\n /\n The agent escalates ONLY when the host points it at a permission\n * configuration it does not adopt by default.\n \n The configuration is therefore not hardening — it is the condition under\n * which the agent may be dispatched with a gate at all, and the variable that\n * carries the pointer is named on the contract so the dispatch can CHECK that\n * a profile supplies it instead of trusting a docstring that says it must.\n /\n RAISES_ONLY_UNDER_HOST_CONFIGURATION = \"raises_only_under_host_configuration\",\n /\n The agent never escalates before mutating, under any configuration this\n * framework can supply. Its own safety model is elsewhere (a sandbox), and\n * Wildo's in-flight guards are inert for it by construction — the post-run\n * change set is the only account of what it touched.\n /\n NEVER_RAISES = \"never_raises\",\n}\n/* @wildo_source:part:end acp.permission-escalation /\n\n/\n Can Wildo's in-flight permission ceiling and mutation-scope predicate fire for\n * this agent, as it will actually be started?\n \n The single definition of that question, so the dispatch's refusal, the run's\n * recorded metadata and any operator-facing report cannot disagree about it.\n \n `escalationConfigurationSupplied` answers only the conditional member: it is\n * whether the composed child environment will actually carry the pointer the\n * contract names. Deliberately a parameter rather than something this function\n * reads, because the environment is composed by the dispatch and a predicate\n * that guessed at it would be a second, quieter answer.\n * assurance-control: WILDO.SOFTWARE.AI_PRODUCED_CHANGE_CONTROL — the one answer to whether the ceiling and write scope can fire for an agent: always, never, or only when its configuration pointer reaches it.\n /\nexport function agentClientProtocolInFlightGuardsCanFire(\n behaviour: AgentClientProtocol_PermissionEscalationBehaviour,\n escalationConfigurationSupplied: boolean,\n): boolean {\n switch (behaviour) {\n case AgentClientProtocol_PermissionEscalationBehaviour.RAISES_BEFORE_MUTATION:\n return true;\n case AgentClientProtocol_PermissionEscalationBehaviour.RAISES_ONLY_UNDER_HOST_CONFIGURATION:\n return escalationConfigurationSupplied;\n case AgentClientProtocol_PermissionEscalationBehaviour.NEVER_RAISES:\n return false;\n }\n}\n\n/\n How much of the HOST MACHINE's agent configuration a session inherits.\n \n Coding agents read configuration from the filesystem — instructions, skills,\n * slash commands, sub-agent personas, tool permissions — and they layer several\n * scopes. Measured against Claude's ACP adapter, the default is to load ALL of\n * them, including the operator's personal `~/.claude`: a probe session returned\n * roughly forty commands and a persona belonging to the machine running it,\n * none of which the application authored.\n \n That inheritance is not simply undesirable, which is why this is a three-way\n * choice rather than a boolean. A dispatched coding task SHOULD read the\n * application's own instructions and installed skills — that is how the\n * application teaches the agent to use its framework. What it should not\n * silently absorb is whoever happens to be logged in.\n /\n/* @wildo_source:part:start acp.host-configuration-inheritance facet:layer:config facet:audience:app-developer /\nexport enum AgentClientProtocol_HostConfigurationInheritance {\n /* No filesystem-sourced agent configuration. The prompt is the whole instruction. /\n ISOLATED = \"isolated\",\n /\n Configuration owned by the workspace (its committed instructions, its\n * installed skills, its checked-in settings) — but not the operator's\n * personal configuration. The correct default for a dispatched task.\n /\n APPLICATION_SCOPED = \"application_scoped\",\n /\n Everything the agent would load if a human had started it by hand,\n * including operator-level configuration. Honest about what it is: the run\n * then depends on machine state Wildo neither authored nor recorded, so a run\n * is not reproducible on another machine.\n /\n HOST_INHERITED = \"host_inherited\",\n}\n/* @wildo_source:part:end acp.host-configuration-inheritance /\n\n/* @wildo_source:part:start acp.execution-profile facet:layer:config facet:audience:app-developer /\n/\n WHERE a coding run's content actually goes, per MODEL (issue #308, join 2).\n \n An ACP coding session sends the composed task prompt, retrieved context and — through the agent's\n * own file reads — the application's SOURCE CODE to the selected model vendor. For an application\n * built with Wildo that can include the customer's domain model, schemas, seed data shapes and\n * business rules. So the destination is a processor-register fact, not a runtime detail.\n \n ## Why this is per MODEL and not per provider\n \n A generalist agent routes to several vendors, so its OWN legal identity is not the identity of the\n * vendor a given run reaches: OpenCode is a binary on the host, and the same profile can send code to\n * Anthropic or to OpenAI depending on one model id. A per-provider declaration structurally cannot\n * express that — it would name the agent's publisher as the recipient of code the publisher never\n * receives, which is false in the direction a reader cannot check.\n \n ## Why it lives on the EXECUTION PROFILE\n \n The profile is already where an application authors the policy it owns, and the model is selected at\n * dispatch time against that profile. The competing home — `providerComplianceChoices`, where every\n * other compliance answer lives — cannot carry it: that surface is keyed by provider ref and has one\n * entry per provider, which is exactly the shape that cannot say \"per model\".\n \n `ApplicationProviderComplianceChoice` warns against putting a compliance answer somewhere \"nothing\n * can read it without knowing the provider\", and `providerConfigurations` is genuinely an opaque\n * `Record<string, unknown>` bag. That objection is answered rather than ignored:\n * {@link readCodingModelDestinations} is the named reader, exported beside this schema, and the\n * compliance renderer calls it instead of reaching into the bag and guessing a shape. The hazard the\n * warning names is a fact nobody can FIND; a named reader is what removes it.\n /\nexport const AgentClientProtocol_ModelDestinationSchema = z.object({\n /\n The legal entity that receives the code — the model vendor, NOT the agent's publisher.\n \n Required, because a destination that cannot be named is not a destination a processor register can\n * state. There is no framework default: the framework does not know which account an operator\n * authorised, and inventing one would publish a recipient nobody declared.\n /\n vendorLegalEntityName: z.string().trim().min(1),\n /\n Where that vendor processes it.\n \n Open strings for the same reason `ProviderComplianceProfile.processingRegions` uses them: these\n * are the VENDOR's own labels and a closed enum here would be this repository inventing a\n * vocabulary it does not own.\n /\n processingRegions: z.array(z.string().trim().min(1)).min(1),\n /\n The INTERMEDIARY, when the run reaches the vendor through one (issue #308, join 3).\n \n A hosted gateway — OpenCode Zen, an Anthropic-compatible proxy reached through a base-URL\n * override — receives the content before the vendor does. It is therefore its own processor and must\n * appear as a sub-processor DISTINCT from the vendor behind it: naming only the vendor understates\n * the chain by one party, and naming only the gateway understates it by the other.\n \n Absent means the run reaches the vendor directly. That is a claim, not a silence — declaring a\n * destination at all is what makes it one.\n /\n gateway: z.object({\n legalEntityName: z.string().trim().min(1),\n processingRegions: z.array(z.string().trim().min(1)).min(1),\n }).optional(),\n}).strict();\nexport type AgentClientProtocol_ModelDestination = z.infer<typeof AgentClientProtocol_ModelDestinationSchema>;\n/* @wildo_source:part:end acp.execution-profile /\n\n/\n One authored way to start an ACP agent.\n \n Mirrors the shape a provider's execution profiles have always had: the\n * spawnable command plus the policy that decides whether it may run at all.\n /\n/* @wildo_source:part:start acp.execution-profile facet:layer:config facet:audience:app-developer /\nexport const AgentClientProtocol_ExecutionProfileSchema = z.object({\n runnerHost: z.enum(AgentClientProtocol_RunnerHost).default(\n AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS,\n ),\n /\n The executable that speaks ACP on stdio — OPTIONAL, and normally omitted.\n \n How to START an agent is the PROVIDER's knowledge: the package, the pinned\n * version, the launcher. An application that restates it holds a second copy\n * of a version it does not own, which is how the adapter pin came to be\n * declared in two places with no mechanical link. Omit these and the provider\n * contract supplies them; set them only to run an agent the provider does not\n * describe, and accept owning the version if you do.\n /\n command: z.string().min(1).optional(),\n args: z.array(z.string()).optional(),\n /\n Host environment variables forwarded into the child.\n \n The runner starts from a minimal identity allowlist and adds only what is\n * named here. Full inheritance is never available: the process that spawns\n * the agent holds platform secrets that must not reach it. Naming one does\n * not get past that: a variable the framework declares secret (a platform or\n * application runtime secret, an inbound endpoint or system-of-record\n * secret, or any provider's declared secret) is refused by `wildo config\n * sync`, on every read and at startup, and at dispatch. A provider credential\n * the agent needs is handed to it through `secretEnvVarName` instead. The\n * refusal covers what the framework declares; a secret in the developer's\n * own shell environment is not the framework's to know, so name only what\n * the agent needs.\n /\n inheritedEnvironmentVariables: z.array(z.string().min(1)).optional(),\n authMode: z.enum(AgentClientProtocol_AuthMode),\n secretRef: z.string().optional(),\n secretEnvVarName: z.string().optional(),\n /\n The environments this profile may run in — REQUIRED, and never widened by\n * default.\n \n This is the gate that keeps a workspace-mutating agent out of production.\n * It is carried here explicitly rather than inherited from anything, because\n * the equivalent guard on the protocol this replaces was enforced by a single\n * function that a new transport could have quietly failed to call.\n /\n allowedApplicationEnvironments: z.array(z.enum(APPLICATION_ENVIRONMENT)).min(1),\n /* Optional further narrowing to named platform environments. /\n allowedPlatformEnvironmentIds: z.array(z.string()).optional(),\n workingDirectoryPolicy: z.enum(AgentClientProtocol_WorkingDirectoryPolicy).default(\n AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_ROOT,\n ),\n workingDirectoryRelativePath: z.string().optional(),\n permissionCeiling: z.enum(AgentClientProtocol_PermissionCeiling).default(\n AgentClientProtocol_PermissionCeiling.PROMPT_ALWAYS,\n ),\n hostConfigurationInheritance: z.enum(AgentClientProtocol_HostConfigurationInheritance).default(\n AgentClientProtocol_HostConfigurationInheritance.APPLICATION_SCOPED,\n ),\n /\n Wall-clock ceiling for one prompt turn.\n \n On expiry the runner sends `session/cancel` and waits for the agent to\n * settle rather than killing the process: ACP defines cancellation as\n * cooperative, and an agent that is mid-edit should be allowed to stop\n * cleanly. A hard kill remains the fallback if the agent does not honour it.\n /\n turnTimeoutMs: z.number().int().positive().optional(),\n /\n How many times one invocation may AUTO-CONTINUE the agent after it ends a\n * turn with a self-imposed pause (\"shall I continue?\").\n \n The autonomous lane's answer to the agent's own checkpoint reflex: a turn\n * classified as SELF_PAUSE is re-prompted to continue on the same session\n * rather than read as a finished result. Bounded because an agent that pauses\n * forever must eventually be settled rather than looped — on exhaustion the\n * run settles with what it has, recorded as such. Zero disables continuation\n * entirely (every END_TURN is final, the pre-2026-09 behaviour).\n /\n maxAutoContinuations: z.number().int().nonnegative().default(8),\n /\n How long an operator answer to a parked question stays valid — the deadline\n * stamped onto the suspension as `parkedUntil`.\n \n The parked run does NOT hold a live agent process open for this window: the\n * child is closed the moment the run parks (holding it would occupy the lane's\n * single-flight slot while an operator who may never answer decides). Because\n * the agent persists the session on disk, a later answer re-enters it through\n * `session/load` — so this is an informational freshness bound the host and UX\n * surface, not a timer that reaps a process. It applies only when the agent\n * advertises `loadSession`; otherwise the question is real but unanswerable\n * on the same session, and `resumable` says so.\n /\n awaitingInputTtlMs: z.number().int().positive().default(900_000),\n /\n Ceiling on the bytes of session events this run PERSISTS.\n \n Semantics are TRUNCATE, not reject — deliberately the opposite of the\n * output cap this replaces, which killed a run for being talkative after it\n * had already mutated the workspace. Losing the tail of a transcript is a\n * reporting loss; losing the run is a work loss.\n /\n maximumRecordedEventBytes: z.number().int().positive().optional(),\n /\n Per-model processing destinations — see {@link AgentClientProtocol_ModelDestinationSchema}.\n \n OPTIONAL, and its absence is REPORTED rather than refused. A stale framework region list must not\n * be able to brick an application build, and an operator who has just moved a vendor should be able\n * to say so before the framework catches up — the same warn-do-not-block posture\n * `appAssertedProcessingRegions` already takes for provider regions. The compliance brief names a\n * coding profile that declares none, so the gap is visible without being fatal.\n /\n modelDestinations: z.record(z.string().trim().min(1), AgentClientProtocol_ModelDestinationSchema).optional(),\n /\n Opaque, agent-specific options passed as `_meta` on `session/new`.\n \n ACP reserves `_meta` for extensions, and agents use it for options their\n * own runtime understands and no other agent would. Keeping it opaque is what\n * keeps the rest of this contract agent-neutral — but it is also unvalidated\n * and unportable by construction, so anything Wildo needs to GUARANTEE (the\n * environment gate, the permission ceiling, configuration inheritance) is a\n * typed field above and never expressed here.\n /\n sessionMetaExtensions: z.record(z.string(), z.unknown()).optional(),\n}).strict().superRefine((profile, context) => {\n if (profile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION && !profile.secretRef) {\n context.addIssue({\n code: \"custom\",\n message: \"`secretRef` is required when `authMode` is `SECRET_REF_ENV_INJECTION`.\",\n path: [\"secretRef\"],\n });\n }\n\n if (profile.authMode === AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION && !profile.secretEnvVarName) {\n context.addIssue({\n code: \"custom\",\n message: \"`secretEnvVarName` is required when `authMode` is `SECRET_REF_ENV_INJECTION`.\",\n path: [\"secretEnvVarName\"],\n });\n }\n\n // A host-managed or unauthenticated profile carrying a secret binding is a\n // contradiction the runner would resolve silently — injecting nothing while\n // the authored configuration claims a credential is in play. Refuse it, so\n // \"this profile injects no secret\" is a property of the schema rather than of\n // a reviewer's reading.\n if (\n profile.authMode !== AgentClientProtocol_AuthMode.SECRET_REF_ENV_INJECTION &&\n (profile.secretRef !== undefined \|\| profile.secretEnvVarName !== undefined)\n ) {\n context.addIssue({\n code: \"custom\",\n message: \"`secretRef`/`secretEnvVarName` are only valid when `authMode` is `SECRET_REF_ENV_INJECTION`.\",\n path: [\"secretRef\"],\n });\n }\n\n if (\n profile.workingDirectoryPolicy === AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_RELATIVE_PATH &&\n !profile.workingDirectoryRelativePath\n ) {\n context.addIssue({\n code: \"custom\",\n message: \"`workingDirectoryRelativePath` is required when using `WORKSPACE_RELATIVE_PATH`.\",\n path: [\"workingDirectoryRelativePath\"],\n });\n }\n\n if (\n profile.workingDirectoryPolicy !== AgentClientProtocol_WorkingDirectoryPolicy.WORKSPACE_RELATIVE_PATH &&\n profile.workingDirectoryRelativePath !== undefined\n ) {\n context.addIssue({\n code: \"custom\",\n message: \"`workingDirectoryRelativePath` is only valid when using `WORKSPACE_RELATIVE_PATH`.\",\n path: [\"workingDirectoryRelativePath\"],\n });\n }\n\n // An UNRESTRICTED ceiling on a profile that may run outside development is\n // the one combination with no legitimate reading: it authorises an agent to\n // mutate a non-development workspace with no gate and no record of a decision.\n if (\n profile.permissionCeiling === AgentClientProtocol_PermissionCeiling.UNRESTRICTED &&\n profile.allowedApplicationEnvironments.some((environment) => environment !== APPLICATION_ENVIRONMENT.DEVELOPMENT)\n ) {\n context.addIssue({\n code: \"custom\",\n message:\n \"`permissionCeiling: UNRESTRICTED` is only valid for a profile restricted to the DEVELOPMENT environment.\",\n path: [\"permissionCeiling\"],\n });\n }\n});\nexport type AgentClientProtocol_ExecutionProfile = z.infer<typeof AgentClientProtocol_ExecutionProfileSchema>;\n/* @wildo_source:part:end acp.execution-profile /\n\nexport const AgentClientProtocol_ConfigurationSchema = ExternalProvider_ExchangeProtocol_Configuration_BaseSchema.extend({\n defaultExecutionProfileRef: z.string().optional(),\n executionProfiles: z.record(z.string(), AgentClientProtocol_ExecutionProfileSchema),\n}).superRefine((config, context) => {\n if (config.defaultExecutionProfileRef && !config.executionProfiles[config.defaultExecutionProfileRef]) {\n context.addIssue({\n code: \"custom\",\n message: \"`defaultExecutionProfileRef` must reference an existing execution profile.\",\n path: [\"defaultExecutionProfileRef\"],\n });\n }\n});\nexport type AgentClientProtocol_Configuration = ExternalProvider_ExchangeProtocol_Configuration_Base & z.infer<typeof AgentClientProtocol_ConfigurationSchema>;\n\n\n\n//===============================================================\n// Coding-agent operation family\n// --------\n// The semantic operation an ACP session serves. Deliberately NOT an\n// `LLMProvider_OperationKey`: a run that edits a worktree, executes commands\n// and requests authorisation is a different KIND of work from a text\n// completion, and the two enums being disjoint is what lets an agent\n// configuration be narrowed by its operation key alone.\n//===============================================================\n\nexport enum CodingAgent_OperationKey {\n /* A bounded, scoped change to a workspace, performed by an autonomous agent. /\n RUN_CODING_TASK = \"coding.runCodingTask\",\n}\n\n/\n Why a prompt turn ended.\n \n The wire values are ACP's own — this is the thin boundary where the\n * protocol's vocabulary is translated into a named one Wildo can branch on and\n * explain. `CANCELLED` in particular must stay distinguishable from `END_TURN`:\n * a cancelled run's partial change set is a different fact from a completed\n * run's, and a lane that conflates them reports work as finished that was\n * interrupted.\n /\nexport enum CodingAgent_StopReason {\n /* The agent finished of its own accord. /\n END_TURN = \"end_turn\",\n /* The model's output limit was reached mid-work. /\n MAX_TOKENS = \"max_tokens\",\n /* The agent's own per-turn request budget was exhausted. /\n MAX_TURN_REQUESTS = \"max_turn_requests\",\n /* The model declined the task. /\n REFUSAL = \"refusal\",\n /* The client asked the session to stop, and the agent complied. /\n CANCELLED = \"cancelled\",\n /\n WILDO'S OWN marker, not an ACP wire value: the agent reported a stop reason\n * this protocol version does not define.\n \n It exists so an unknown value cannot discard evidence. The alternative —\n * throwing — happens AFTER the turn, i.e. after the workspace has already been\n * mutated, so it would turn a completed run into an error whose change set\n * nobody records. Callers must treat this like `CANCELLED`: not a working\n * result, but a run whose changes are real and must still be captured.\n /\n UNRECOGNISED = \"wildo.unrecognised\",\n}\n\n/\n What an END_TURN actually meant — the judgment the turn ladder branches on.\n \n ACP delivers every voluntary stop identically: `end_turn` plus whatever the\n * agent last said. Three very different situations arrive in that one shape,\n * and only reading the message tells them apart, which is why this is decided\n * by an auxiliary LLM classification rather than by a heuristic on the text:\n * a regex that recognises \"shall I continue?\" is an invented vocabulary for\n * someone else's prose.\n /\nexport enum CodingAgent_EndOfTurnClassification {\n /* The agent finished the task; the turn is a final result. /\n TASK_COMPLETE = \"task_complete\",\n /\n The agent paused of its own accord — \"next?\", \"want me to proceed?\" — a\n * checkpoint reflex, not a need. The ladder answers it with the continuation\n * prompt instead of surfacing it, because at this level those checkpoints are\n * deliberately avoided (autonomy directive, 2026-09-04).\n /\n SELF_PAUSE = \"self_pause\",\n /\n The agent's prose READS as asking something only the caller can answer — a\n * decision, a missing credential, an ambiguity in the task.\n \n A reading, not a question: since #3710 it does NOT park the session. A run\n * parks only on a question the agent asked through the protocol (a form\n * elicitation, `CodingAgent_SessionSuspension`), because prose is where an\n * agent narrates, and a model reading \"first checking the money value shape…\"\n * as a question parked an unattended run for a person who was not there. The\n * ladder continues this turn like a {@link SELF_PAUSE}, telling the agent how\n * to ask, and the verdict stays on the continuation record for audit.\n /\n NEEDS_INPUT = \"needs_input\",\n /\n The classifier itself failed or timed out. FAILS OPEN to settlement: the\n * turn is treated as TASK_COMPLETE, because an auxiliary call must never hang\n * the autonomous lane or discard a mutated workspace — but the failure is\n * recorded as this value rather than laundered into a confident judgment.\n /\n CLASSIFIER_UNAVAILABLE = \"classifier_unavailable\",\n}\n\n/\n One auto-continuation the turn ladder performed, recorded per turn boundary.\n \n Kept as a record rather than a counter for the same reason permission\n * decisions are: a run that continued five times and one that never paused are\n * different runs, and the difference is diagnosable only if each boundary says\n * what was classified and what was sent back.\n /\nexport const CodingAgent_ContinuationRecordSchema = z.strictObject({\n /* 1-based index of the turn that ENDED at this boundary. /\n turnIndex: z.number().int().positive(),\n classification: z.enum(CodingAgent_EndOfTurnClassification),\n /\n The tail of the agent's end-of-turn message the classification was made\n * from. A bounded excerpt, not the transcript — enough to audit the judgment.\n /\n agentMessageTail: z.string().optional(),\n});\nexport type CodingAgent_ContinuationRecord = z.infer<typeof CodingAgent_ContinuationRecordSchema>;\n\n/\n A run that STOPPED WITHOUT FINISHING because the agent needs an answer.\n \n The ACP sibling of `AgentApprovalSuspension` on the LLM transport: the\n * invocation returns, but its output must not be read as a completed result —\n * `suspension` present means the agent ASKED: `question` is what it put through\n * the protocol (a form elicitation), never its prose (#3710). The caller\n * surfaces the question, and the answer re-enters the SAME session:\n * `resumable: true` promises the agent advertised `loadSession`, so the session\n * survives the child process and even a host restart.\n /\nexport const CodingAgent_SessionSuspensionSchema = z.strictObject({\n /* The ACP session to resume with the answer. /\n sessionId: z.string().min(1),\n /* The agent's question as it asked it through the protocol: the elicitation's message and the fields it asks. /\n question: z.string().min(1),\n /* 1-based turn the session parked after. /\n turnIndex: z.number().int().positive(),\n /\n Whether the session can be re-entered after the agent process is gone.\n * False when the agent does not advertise `loadSession`: the question is\n * still real, but answering it starts a NEW session that must restate task\n * context — a degradation the caller should surface, not hide.\n /\n resumable: z.boolean(),\n /\n An INFORMATIONAL freshness bound for the question (ISO timestamp), surfaced to the operator —\n * never a reaping deadline. No child process is held open while a run is parked (see\n * `awaitingInputTtlMs`), so there is nothing that closes at this instant. It said \"when the parked\n * child process will be closed\" until 2026-09-24, contradicting the contract above it, and a host\n * read it that way and aborted answerable questions at boot (#1533).\n /\n parkedUntil: z.string().optional(),\n});\nexport type CodingAgent_SessionSuspension = z.infer<typeof CodingAgent_SessionSuspensionSchema>;\n\n/\n What one coding turn consumed.\n \n EVERY field is optional, and that is a statement about the protocol rather\n * than laziness. ACP guarantees only the context-window pair (`used` / `size`)\n * on its usage notification; token breakdowns and monetary cost are agent\n * EXTENSIONS — Claude's adapter reports all of them, another agent may report\n * none. Code that enforces a budget must therefore decide what to do when the\n * number it wants is absent, and the schema makes that unavoidable rather than\n * letting a missing value read as zero.\n \n This is the capability the transport it replaces could not express at all:\n * a one-shot CLI reported nothing, so budgets were reduced to wall-clock and\n * run-count proxies.\n /\nexport const CodingAgent_UsageSchema = z.object({\n /* Context-window tokens in use at the end of the turn (ACP: `usage_update.used`). /\n contextUsed: z.number().int().nonnegative().optional(),\n /* Total context window available (ACP: `usage_update.size`). /\n contextWindowSize: z.number().int().nonnegative().optional(),\n inputTokens: z.number().int().nonnegative().optional(),\n outputTokens: z.number().int().nonnegative().optional(),\n /* Tokens READ from the prompt cache — typically the dominant term for a coding turn. /\n cachedReadTokens: z.number().int().nonnegative().optional(),\n /* Tokens WRITTEN to the prompt cache. /\n cachedWriteTokens: z.number().int().nonnegative().optional(),\n totalTokens: z.number().int().nonnegative().optional(),\n /\n Monetary cost of the turn, when the agent reports one.\n \n Kept as an amount + currency pair rather than a bare number: a budget\n * denominated in an unstated currency is not a budget. Amount is a plain\n * number because it arrives that way; anything that ACCUMULATES cost should\n * round explicitly at its own boundary rather than trusting float addition.\n /\n cost: z.object({\n amount: z.number().nonnegative(),\n currency: z.string().min(1),\n }).optional(),\n});\nexport type CodingAgent_Usage = z.infer<typeof CodingAgent_UsageSchema>;\n\n/\n Transport metadata for a completed coding run.\n \n Note where this lives: WITH the coding-agent family, not in the LLM\n * protocol's transport union. A coding run is not an LLM call with a different\n * wire format, and recording it inside the LLM execution-metadata union would\n * re-create, one layer down, exactly the mis-modelling this protocol exists to\n * end.\n /\nexport const AgentClientProtocol_ExecutionTransportMetadataSchema = z.object({\n protocolKind: z.literal(ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL),\n providerRef: z.string(),\n executionProfileRef: z.string(),\n model: z.string().optional(),\n /* The ACP major version agreed at `initialize`. /\n negotiatedProtocolVersion: z.number().int().positive().optional(),\n /* The agent's self-reported build — the first question when a run misbehaves. /\n agentName: z.string().optional(),\n agentVersion: z.string().optional(),\n /\n The agent-declared session mode the run actually executed under.\n \n Recorded verbatim as the agent named it, because it is the agent's\n * vocabulary and the mapping from Wildo's ceiling is lossy in one direction:\n * knowing the run was clamped to `PROMPT_ALWAYS` does not tell a later reader\n * which of the agent's modes that became.\n /\n sessionModeId: z.string().optional(),\n /\n Whether the agent this run started DECLARES that it escalates before\n * mutating, and whether Wildo's in-flight guards could therefore fire.\n \n Recorded on the run because the ceiling alone no longer explains the run:\n * `permissionCeiling: PROMPT_ALWAYS` against an agent that never asks and\n * against one that always asks describe two completely different runs, and\n * nothing else in this metadata tells them apart. A later reader looking at a\n * change set needs to know whether anything stood between the agent and it.\n \n Optional because the declaration is a provider fact and a run recorded\n * before this field existed genuinely has no answer — absence must not read as\n * `false`, which would assert an unbound run that may have been fully bound.\n /\n permissionEscalation: z.enum(AgentClientProtocol_PermissionEscalationBehaviour).optional(),\n /\n The resolved answer for THIS run, from\n * {@link agentClientProtocolInFlightGuardsCanFire} — the declared behaviour\n * combined with whether the composed environment actually supplied the\n * configuration a conditionally-escalating agent needs.\n \n Kept beside the behaviour rather than derived by each reader, because the\n * conditional member cannot be resolved from the behaviour alone and a reader\n * that tried would answer `true` for an agent that was dispatched unconfigured.\n /\n inFlightPermissionGuardsCanFire: z.boolean().optional(),\n /* The ACP session, retained so a later turn can resume or fork it. /\n sessionId: z.string().optional(),\n});\nexport type AgentClientProtocol_ExecutionTransportMetadata = z.infer<typeof AgentClientProtocol_ExecutionTransportMetadataSchema>;\n\nexport const CodingAgent_OperationContext_BaseSchema = ExternalProvider_OperationContextSchema.extend({\n usage: CodingAgent_UsageSchema.optional(),\n executionTime: z.number().optional(),\n finishedAt: z.string().optional(),\n transport: AgentClientProtocol_ExecutionTransportMetadataSchema.optional(),\n});\nexport type CodingAgent_OperationContext_Base = z.infer<typeof CodingAgent_OperationContext_BaseSchema>;\n\nexport type CodingAgent_OperationDefinitionBase = ExternalProvider_OperationDefinition_Base & {\n operationContextSchema: typeof CodingAgent_OperationContext_BaseSchema,\n supportedModels?: string[],\n};\n\n// ===============================================================\n// Coding-agent I/O\n// ===============================================================\n\n/\n Model-selection configuration for a coding agent.\n \n Deliberately smaller than its LLM sibling, and the omissions are the design.\n * There is no `temperature`, `topP` or penalty here: those tune a completion,\n * and an ACP agent is not one — it runs its own inner loop, chooses its own\n * tools and manages its own sampling. Offering an application knobs the\n * transport cannot honour would be worse than offering none, because it would\n * read as configuration and behave as decoration.\n \n `maxTokens` is likewise absent: a coding run's budget is enforced by the\n * caller against reported usage after each turn, not requested up front — the\n * agent decides how many model calls its task needs.\n /\nexport const CodingAgent_OperationModelConfiguration_Schema = z.object({\n model: z.string(),\n providerRef: z.string(),\n});\nexport type CodingAgent_OperationModelConfiguration = z.infer<typeof CodingAgent_OperationModelConfiguration_Schema>;\n\nexport const CodingAgent_RunTaskInputSchema = z.object({\n /\n The rendered task handed to the agent as the turn's prompt.\n \n A single string on purpose: the caller owns task composition (for\n * application creation, a typed task contract renders it), and the transport\n * must not become a second place where task semantics are assembled.\n /\n prompt: z.string().min(1),\n /\n The autonomy this particular run asks for.\n \n INTERSECTED, never honoured blindly: dispatch admits only tool kinds shared by\n * this policy and the execution profile's `permissionCeiling`. Absent means the profile's ceiling\n * — which is itself the safe default — so omitting it can never widen\n * authority, only leave it where the profile put it.\n /\n requestedPermissionCeiling: z.enum(AgentClientProtocol_PermissionCeiling).optional(),\n /\n Present when this run ANSWERS a parked session rather than starting a task.\n \n Carries the `sessionId` from a prior run's `suspension`; the transport\n * re-enters that session via `session/load` and delivers `prompt` (the\n * answer) as the next turn. Refused — not degraded — when the agent does not\n * advertise `loadSession`: silently starting a fresh session would present a\n * context-less answer as a continuation.\n /\n continuationOfSessionId: z.string().min(1).optional(),\n});\nexport type CodingAgent_RunTaskInput = z.infer<typeof CodingAgent_RunTaskInputSchema>;\n\nexport const CodingAgent_RunTaskOutputSchema = z.object({\n /* The agent's closing message — its own account of what it did. /\n finalMessage: z.string(),\n stopReason: z.enum(CodingAgent_StopReason),\n /\n Absolute paths the agent REPORTED writing, from its tool-call stream: the locations of its `edit`,\n * `delete` and `move` tool calls, never those of a read or a search (#1805).\n \n A claim, not a record. An agent reports what its own tooling surfaces, and\n * nothing prevents it writing a file it never mentions — measured against\n * Claude's adapter, file operations happen inside the agent and are reported\n * afterwards rather than routed through the client. Use this to NARROW an\n * attribution question; never as the answer. The authoritative record of what\n * changed is the workspace diff taken around the run.\n /\n reportedFileLocations: z.array(z.string()).optional(),\n /\n How many permission requests the client REFUSED during the turn.\n \n Recorded because under the strictest ceiling refusal is the NORMAL outcome,\n * not an exception: without this number a run in which the agent proposed five\n * changes and was refused every one is indistinguishable from a run in which\n * it proposed nothing. The agent's own closing message cannot be relied on to\n * say so.\n /\n deniedPermissionCount: z.number().int().nonnegative().optional(),\n /\n One record per permission request, with the REASON it was decided.\n \n The count above says HOW MANY were refused; this says WHY, which is the half that makes a\n * refusal actionable. A run under an UNRESTRICTED ceiling came back with two refusals and no\n * files written, and nothing recorded could distinguish \"the scope predicate refused a path\"\n * from \"the agent offered no option the client would select\" — opposite defects with an\n * identical outward appearance, and neither diagnosable without dispatching another agent.\n \n Deliberately carries no prompt or file CONTENT: the tool kind, the declared paths, the\n * option kinds offered, and the decision.\n /\n permissionDecisions: z.array(z.strictObject({\n allowed: z.boolean(),\n reason: z.string(),\n toolKind: z.string().optional(),\n locations: z.array(z.string()),\n offeredOptionKinds: z.array(z.string()),\n })).optional(),\n /\n The agent's verbatim stop reason when it was one this version does not\n * define. Present exactly when `stopReason` is `UNRECOGNISED`.\n /\n rawStopReason: z.string().optional(),\n /\n How many prompt turns this invocation drove on the session. Absent means\n * one — the single-turn shape every pre-ladder consumer already assumes.\n /\n turnCount: z.number().int().positive().optional(),\n /\n One record per turn boundary the ladder judged — auto-continues, the park,\n * the settlement. See {@link CodingAgent_ContinuationRecordSchema}.\n /\n continuations: z.array(CodingAgent_ContinuationRecordSchema).optional(),\n /\n Present when the run PARKED on a genuine question instead of finishing.\n * `finalMessage` is then the QUESTION, and `stopReason` is the wire-true\n * `END_TURN` — this field is what stops that reading as a completed result.\n * Callers that ignore it record work as done that is waiting on an answer.\n /\n suspension: CodingAgent_SessionSuspensionSchema.optional(),\n});\nexport type CodingAgent_RunTaskOutput = z.infer<typeof CodingAgent_RunTaskOutputSchema>;\n\n/\n One declared coding destination, joined to the provider and profile that declare it.\n \n Flat rather than nested because every consumer so far wants to enumerate destinations, not walk a\n * tree — and a nested shape makes \"which provider declares nothing\" a hole a caller has to notice\n * rather than a row it is handed. {@link CodingModelDestinationReading} carries both.\n /\nexport interface CodingModelDestinationEntry {\n readonly providerRef: string;\n readonly executionProfileRef: string;\n readonly model: string;\n readonly destination: AgentClientProtocol_ModelDestination;\n}\n\n/* What {@link readCodingModelDestinations} found, including what it found MISSING. /\nexport interface CodingModelDestinationReading {\n /* Every declared destination, sorted by provider, profile then model. /\n readonly destinations: readonly CodingModelDestinationEntry[];\n /\n Profiles that can run a coding agent and declare NO destination at all.\n \n Reported as its own list rather than as an absence, because this is the gap a compliance brief\n * must name: a run through such a profile sends source code somewhere the register cannot describe.\n /\n readonly profilesWithoutDestinations: readonly { readonly providerRef: string; readonly executionProfileRef: string }[];\n}\n\n/\n Read per-model coding destinations out of an application's provider configurations.\n \n ## Why this function exists at all\n \n `providerConfigurations` is `Record<string, Record<string, unknown>>` — genuinely opaque, and\n * `ApplicationProviderComplianceChoice` warns for that reason that \"a compliance answer must not live\n * somewhere nothing can read it without knowing the provider\". The destination has to live there\n * anyway (it is per MODEL, and no per-provider surface can hold it), so the objection is answered by\n * making the reader NAMED and exported beside the schema instead of leaving each consumer to reach in\n * and guess a shape. A compliance renderer calls this; it never parses the bag.\n \n ## What it does with malformed input\n \n SKIPS it, silently, and this is deliberate rather than lax. The function's job is to report what an\n * application declared, and it is called from a compliance BRIEF — a lane that must not fail because\n * one provider's opaque configuration has an unexpected shape. A profile whose destinations do not\n * parse contributes nothing and therefore surfaces in `profilesWithoutDestinations`, which is the\n * honest reading: nothing usable was declared.\n \n Nothing is lost by that leniency, because a malformed profile is ALREADY refused where it matters:\n * `getAgentClientProtocolExecutionProfile` parses every profile through\n * {@link AgentClientProtocol_ExecutionProfileSchema} when a run resolves one, and throws\n * `ErrorType.CONFIGURATION` naming the provider and profile. So a bad destination fails the CODING RUN\n * loudly, with an author present, while the compliance brief still reports the other twenty providers.\n * Two surfaces, two correct answers — and note that the profile schema is `.strict()`, so before\n * `modelDestinations` existed as a declared field an application COULD NOT have authored it at all.\n /\nexport function readCodingModelDestinations(\n /\n * `unknown` per value, not `Record<string, unknown>`, because that is what the bag genuinely is at\n * every consumer — `ProviderConfigurations` types each entry as optional and the companion's own\n * local view types it as `unknown`. Declaring a narrower parameter would push a cast onto every\n * caller, which is how a reader written to STOP callers guessing a shape starts making them assert\n * one.\n /\n providerConfigurations: Readonly<Record<string, unknown>>,\n): CodingModelDestinationReading {\n const destinations: CodingModelDestinationEntry[] = [];\n const profilesWithoutDestinations: { providerRef: string; executionProfileRef: string }[] = [];\n\n for (const providerRef of Object.keys(providerConfigurations).sort()) {\n const providerConfiguration = providerConfigurations[providerRef];\n if (providerConfiguration === null \|\| typeof providerConfiguration !== 'object') continue;\n const acpConfiguration = (providerConfiguration as Record<string, unknown>)[\n ExternalProvider_ExchangeProtocol_Kind.AGENT_CLIENT_PROTOCOL\n ];\n if (acpConfiguration === null \|\| typeof acpConfiguration !== 'object') continue;\n\n const profiles = (acpConfiguration as { executionProfiles?: unknown }).executionProfiles;\n if (profiles === null \|\| typeof profiles !== 'object') continue;\n\n for (const executionProfileRef of Object.keys(profiles as Record<string, unknown>).sort()) {\n const profile = (profiles as Record<string, unknown>)[executionProfileRef];\n const declared = (profile as { modelDestinations?: unknown } \| null \| undefined)?.modelDestinations;\n const parsed = z.record(z.string().trim().min(1), AgentClientProtocol_ModelDestinationSchema)\n .safeParse(declared);\n\n if (!parsed.success \|\| Object.keys(parsed.data).length === 0) {\n profilesWithoutDestinations.push({ providerRef, executionProfileRef });\n continue;\n }\n\n for (const model of Object.keys(parsed.data).sort()) {\n destinations.push({ providerRef, executionProfileRef, model, destination: parsed.data[model] });\n }\n }\n }\n\n return { destinations, profilesWithoutDestinations };\n}\n\n/\n The ACP tool kinds that WRITE the workspace (#1805) — the one source for \"is this tool call a write?\".\n \n A concurrent coding run claims a file only on evidence it wrote it: a writing tool call's locations, or an\n * ALLOWED permission request for a writing tool. A read or a search reports locations too, and claiming those\n * committed files a run only read under its name.\n \n semantic-literal-boundary: ACP's `ToolKind` is the protocol's open string vocabulary, translated here.\n * spec-cite: ACP v2 schema, `ToolKind` = \"read\" \| \"edit\" \| \"delete\" \| \"move\" \| \"search\" \| \"execute\" \| \"think\" \| \"fetch\" \| \"switch_mode\" \| \"other\" (types.gen.d.ts, @agentclientprotocol/sdk; protocol docs \"Tool Calls — Creating\").\n * `execute` is left out: a shell command may write, but the locations it reports are what it was pointed\n * at, not what it wrote, and a run that wrote through its shell is exactly the case claims cannot see.\n /\nexport const ACP_WRITING_TOOL_KINDS: ReadonlySet<string> = new Set(['edit', 'delete', 'move']);\n\n/* Whether an ACP tool kind writes the workspace; an absent kind is no evidence that it does. /\nexport function isWritingAcpToolKind(kind: string \| undefined): boolean {\n return kind !== undefined && ACP_WRITING_TOOL_KINDS.has(kind);\n}\n\n/\n The file locations ONE ACP `session/update` claims as WRITTEN: the `locations` of a `tool_call` or\n * `tool_call_update` whose kind writes ({@link isWritingAcpToolKind}). An update may omit its kind, so the kind of\n * each call is remembered by its `toolCallId` in `toolCallKinds`, which the caller keeps per session. The ONE rule:\n * the session runner gathers a run's `reportedFileLocations` with it, and the companion keeps a live run's claims on\n * disk with it (#3205), so the two cannot disagree about what a run claimed. Pure apart from that memo.\n */\nexport function writtenLocationsOfAcpSessionUpdate(sessionUpdateKind: string, update: unknown, toolCallKinds: Map<string, string>): string[] {\n if (sessionUpdateKind !== 'tool_call' && sessionUpdateKind !== 'tool_call_update') return [];\n const fields = typeof update === 'object' && update !== null ? update as Record<string, unknown> : {};\n const toolCallId = typeof fields.toolCallId === 'string' ? fields.toolCallId : undefined;\n if (toolCallId !== undefined && typeof fields.kind === 'string') toolCallKinds.set(toolCallId, fields.kind);\n const toolKind = typeof fields.kind === 'string' ? fields.kind : (toolCallId !== undefined ? toolCallKinds.get(toolCallId) : undefined);\n if (!Array.isArray(fields.locations) \|\| !isWritingAcpToolKind(toolKind)) return [];\n return fields.locations\n .filter((entry): entry is { path: string } => typeof entry === 'object' && entry !== null && typeof (entry as { path?: unknown }).path === 'string')\n .map((entry) => entry.path);\n}\n"]}