@wix/ditto-codegen-public 1.0.472 → 1.0.474

package/dist/out.js

@@ -10700,6 +10700,41 @@ var require_ProcessExecutionError = __commonJS({
   }
 });
 
+// ../codegen-types/dist/errors/HostValidationError.js
+var require_HostValidationError = __commonJS({
+  "../codegen-types/dist/errors/HostValidationError.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.HostValidationError = void 0;
+    var BaseCodegenError_1 = require_BaseCodegenError();
+    var ErrorTypes_1 = require_ErrorTypes();
+    var HostValidationError = class extends BaseCodegenError_1.BaseCodegenError {
+      constructor(message, options) {
+        super(message);
+        this.name = "HostValidationError";
+        this.errorType = ErrorTypes_1.ErrorType.PROCESS_EXECUTION_ERROR;
+        this.expected = true;
+        this.retryable = false;
+        this.stage = options.stage;
+        this.command = options.command;
+        this.exitCode = options.exitCode;
+        this.timedOut = options.timedOut;
+        this.diagnosticSummary = options.diagnosticSummary;
+      }
+      getAdditionalProperties() {
+        return {
+          stage: this.stage,
+          command: this.command,
+          timedOut: this.timedOut,
+          ...this.exitCode === void 0 ? {} : { exitCode: this.exitCode },
+          ...this.diagnosticSummary ? { diagnosticSummary: this.diagnosticSummary } : {}
+        };
+      }
+    };
+    exports2.HostValidationError = HostValidationError;
+  }
+});
+
 // ../codegen-types/dist/errors/UnexpectedError.js
 var require_UnexpectedError = __commonJS({
   "../codegen-types/dist/errors/UnexpectedError.js"(exports2) {
@@ -10858,6 +10893,7 @@ var require_errors2 = __commonJS({
     __exportStar2(require_enums(), exports2);
     __exportStar2(require_BaseCodegenError(), exports2);
     __exportStar2(require_ProcessExecutionError(), exports2);
+    __exportStar2(require_HostValidationError(), exports2);
     __exportStar2(require_UnexpectedError(), exports2);
     __exportStar2(require_TimeoutError(), exports2);
     __exportStar2(require_MissingJobIdError(), exports2);
@@ -11055,8 +11091,8 @@ var require_CodeGenService = __commonJS({
         retryable: error.retryable,
         expected: error.expected,
         ..."processType" in error && error.processType && { processType: PROCESS_TYPE[error.processType] },
-        ..."exitCode" in error && { exitCode: error.exitCode },
-        ..."stderr" in error && { stderr: error.stderr }
+        ..."exitCode" in error ? { exitCode: error.exitCode } : {},
+        ..."diagnosticSummary" in error ? { stderr: error.diagnosticSummary } : "stderr" in error ? { stderr: error.stderr } : {}
       };
     }
     function toApiExtension(ext) {
@@ -11611,10 +11647,19 @@ RECOVERY STRATEGY:
    or split it across several files and import them.
 3. Prefer many small steps over one big step.`;
     function buildRecoveryPrompt(originalPrompt, filesChanged, error, failureReason) {
+      const isHostValidationFailure = failureReason === "host validation failure";
       const strategy = failureReason === "stall" ? `
 ${INCREMENTAL_WRITE_STRATEGY}
 ` : "";
-      return buildPrompt(`You are continuing a code generation task that was interrupted due to a session error.
+      const introduction = isHostValidationFailure ? "You are continuing a code generation task because the agent finished, but the required project validation failed." : "You are continuing a code generation task that was interrupted due to a session error.";
+      const recoveryInstructions = isHostValidationFailure ? `1. Review the failed validation stage and diagnostics above
+2. Inspect the files already changed and fix only the cause of the validation failure
+3. Run full validation after fixing the reported problem
+4. Complete the original task without adding unrelated features` : `1. Review the files listed above that were already created/modified in the previous session
+2. Continue with any remaining work needed to fulfill the original task
+3. Do NOT recreate files that already exist and are correct - only modify them if needed
+4. Complete any remaining extensions or files that haven't been created yet`;
+      return buildPrompt(`${introduction}
 
 ORIGINAL TASK:
 ${originalPrompt}
@@ -11626,10 +11671,7 @@ PREVIOUS SESSION ERROR:
 ${error}
 ${strategy}
 INSTRUCTIONS:
-1. Review the files listed above that were already created/modified in the previous session
-2. Continue with any remaining work needed to fulfill the original task
-3. Do NOT recreate files that already exist and are correct - only modify them if needed
-4. Complete any remaining extensions or files that haven't been created yet`);
+${recoveryInstructions}`);
     }
   }
 });
@@ -11838,12 +11880,13 @@ var require_subagents = __commonJS({
     exports2.PRIMARY_AGENT_NAME = "codegen";
     exports2.VALIDATOR_SUBAGENT_NAME = "codegen-validator";
     exports2.SUBAGENT_AGENT_NAMES = [exports2.VALIDATOR_SUBAGENT_NAME];
-    var VALIDATOR_DESCRIPTION = `Runs validate (tsc + wix build) and fixes the reported errors, consulting the
-skills or wix-mcp for SDK-shape errors; returns when the build is clean
+    var VALIDATOR_DESCRIPTION = `Runs validate (tsc + wix build + editor-component manifests) and fixes the reported errors, consulting the
+skills or wix-mcp for SDK-shape errors; returns when validation is clean
 or reports what it couldn't fix. Validation step only \u2014 never generates features.`;
     var VALIDATOR_PROMPT = `Run 'validate({ runBuild: true })', fix the errors it reports, and re-run until
 it passes. You are fixing EXISTING code \u2014 do NOT add features or rewrite whole
-files, and do NOT run 'npx wix generate manifest' \u2014 that is the caller's step.
+files, and do NOT run 'npx wix generate manifest' directly \u2014 the validate tool
+does that automatically when editor components exist.
 NEVER force a green build by suppressing types: no 'as any', no
 '@ts-ignore', no NEW '@ts-expect-error', and do NOT switch a correct named import to
 'import * as' just to satisfy tsc \u2014 that ships code that compiles but breaks
@@ -14378,7 +14421,7 @@ var require_site = __commonJS({
   "../codegen-common-logic/dist/tool-policies/site.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.SITE_POLICIES = exports2.SITE_DATA_COLLECTION_GENERATE_POLICY = exports2.STORES_VERSIONING_POLICY = void 0;
+    exports2.SITE_POLICIES = exports2.SITE_PACKAGE_LOCK_POLICY = exports2.SITE_DATA_COLLECTION_GENERATE_POLICY = exports2.STORES_VERSIONING_POLICY = void 0;
     exports2.STORES_VERSIONING_POLICY = {
       type: "read",
       mode: "prepend",
@@ -14391,9 +14434,20 @@ var require_site = __commonJS({
       blockedExtensionTypes: ["DATA_COLLECTION"],
       message: `BLOCKED: DATA_COLLECTION extensions are not scaffolded in this environment. Invoke the wix-site-data-collection skill to create or change collections. Do not retry with wix generate.`
     };
+    exports2.SITE_PACKAGE_LOCK_POLICY = {
+      type: "commandBlock",
+      commandFragments: [
+        "--package-lock=false",
+        "--package-lock false",
+        "--no-package-lock",
+        "npm_config_package_lock=false"
+      ],
+      message: `BLOCKED: do not disable the package lockfile (--package-lock=false, --package-lock false, --no-package-lock). Run the install without it; if the packages are heavy, install them in several smaller commands (the sandbox has a memory limit).`
+    };
     exports2.SITE_POLICIES = [
       exports2.STORES_VERSIONING_POLICY,
-      exports2.SITE_DATA_COLLECTION_GENERATE_POLICY
+      exports2.SITE_DATA_COLLECTION_GENERATE_POLICY,
+      exports2.SITE_PACKAGE_LOCK_POLICY
     ];
   }
 });
@@ -14939,7 +14993,7 @@ ${environmentIdentity}`;
 - List any manual setup the user must still do for the feature to work, as short "next steps" (e.g. installing a dependent app or enabling a dashboard setting).
 - Be honest: if you didn't fully build what was asked (e.g. stored data but didn't send it), say so. Keep it short.`;
     function buildFileOperationsRules(multiEditContextClause) {
-      return `- Package dependencies \u2014 \`npm install <pkg>\` any package not already in \`package.json\` BEFORE the first \`validate\` (do NOT wait for \`TS2307\`); install all needed packages in ONE command. Do NOT hand-edit \`package.json\` for deps unless npm cannot be used.
+      return `- Package dependencies \u2014 \`npm install <pkg>\` any package not already in \`package.json\` BEFORE the first \`validate\` (do NOT wait for \`TS2307\`); install all needed packages in ONE command, except heavy ones: the sandbox has a memory limit and an install that exceeds it kills the machine and loses the whole run, so install those in several smaller commands. Do NOT hand-edit \`package.json\` for deps unless npm cannot be used. Never pass \`--package-lock=false\`.
 - File operations \u2014 pick the BATCH tool whenever you have 2+ files; the single-file variants are 5\u201310\xD7 slower:
   - \`batch-write\` to create N new files in one call. NEVER call \`write\` more than once per turn \u2014 use batch-write instead. \`write\` is reserved for single-file creation.
   - \`batch-read\` to read N files in one call. NEVER call \`read\` more than once per turn \u2014 use batch-read instead.
@@ -14960,12 +15014,12 @@ var require_codegen_rules = __commonJS({
     var shared_rules_1 = require_shared_rules();
     var model_knobs_1 = require_model_knobs();
     var DELEGATED_VALIDATION = {
-      toolRule: "- `validate` (tsc + build) is run by the `codegen-validator` subagent \u2014 do NOT call it directly; delegate via `task` at step 5.",
-      step: `5. **Validate**: Dispatch ONE \`task({ subagent: "codegen-validator", prompt: "Run validate({ runBuild: true }) \u2014 it typechecks AND builds in a single pass (tsc runs first and fails fast before the build). Fix any errors and re-run until it passes. Pass installDeps: true only if package.json changed and npm install was not already run in this session." })\`. Wait for the subagent to return. Do NOT call \`validate\` directly from the primary agent, and do NOT make a separate tsc-only call first \u2014 the single runBuild pass already fails fast on type errors. VERIFY the subagent actually FINISHED with a clean build: read its returned summary and confirm it converged. If it reports remaining/unresolved errors or was cut off before finishing (e.g. "Maximum steps reached"), do NOT treat it as success \u2014 re-dispatch \`codegen-validator\` to finish the remaining errors before moving on. After the validator confirms a clean build, if you created or modified an EDITOR_REACT_COMPONENT extension in this task, run \`npx wix generate manifest\` via bash (the validator is instructed not to run it, so this is the only run).`
+      toolRule: "- `validate` (tsc + build + editor-component manifests) is run by the `codegen-validator` subagent \u2014 do NOT call it directly; delegate via `task` at step 5.",
+      step: `5. **Validate**: Dispatch ONE \`task({ subagent: "codegen-validator", prompt: "Run validate({ runBuild: true }) \u2014 it typechecks, builds, and generates manifests when editor components exist. Fix any errors and re-run until it passes. Pass installDeps: true only if package.json changed and npm install was not already run in this session." })\`. Wait for the subagent to return. Do NOT call \`validate\` directly from the primary agent, and do NOT make a separate tsc-only call first \u2014 the single runBuild pass already fails fast on type errors. VERIFY the subagent actually FINISHED with clean validation: read its returned summary and confirm it converged. If it reports remaining/unresolved errors or was cut off before finishing (e.g. "Maximum steps reached"), do NOT treat it as success \u2014 re-dispatch \`codegen-validator\` to finish the remaining errors before moving on. Do NOT inspect extension types or run \`npx wix generate manifest\` directly; \`validate\` handles manifest generation when editor components exist.`
     };
     var DIRECT_VALIDATION = {
-      toolRule: "- `validate` (tsc + build) \u2014 you call it yourself at step 5. Do NOT delegate it.",
-      step: `5. **Validate**: Call \`validate({ runBuild: true })\` yourself \u2014 it typechecks AND builds in a single pass (tsc runs first and fails fast before the build). Fix any errors and re-run until it passes. Pass installDeps: true only if package.json changed and npm install was not already run in this session. Do NOT delegate this to a subagent, and do NOT make a separate tsc-only call first \u2014 the single runBuild pass already fails fast on type errors. NEVER force a green build: no \`as any\`, no \`@ts-ignore\`, no NEW \`@ts-expect-error\`, no switching a correct named import to \`import * as\`, and no changing runtime behaviour (e.g. unwanted \`defaultProps\` values) or deleting the failing code just to satisfy tsc. Do NOT move on until the build is clean. After the build is clean, if you created or modified an EDITOR_REACT_COMPONENT extension in this task, run \`npx wix generate manifest\` via bash (idempotent).`
+      toolRule: "- `validate` (tsc + build + editor-component manifests) \u2014 you call it yourself at step 5. Do NOT delegate it.",
+      step: `5. **Validate**: Call \`validate({ runBuild: true })\` yourself \u2014 it typechecks, builds, and generates manifests when editor components exist (tsc runs first and fails fast before the build). Fix any errors and re-run until it passes. Pass installDeps: true only if package.json changed and npm install was not already run in this session. Do NOT delegate this to a subagent, and do NOT make a separate tsc-only call first \u2014 the single runBuild pass already fails fast on type errors. NEVER force a green build: no \`as any\`, no \`@ts-ignore\`, no NEW \`@ts-expect-error\`, no switching a correct named import to \`import * as\`, and no changing runtime behaviour (e.g. unwanted \`defaultProps\` values) or deleting the failing code just to satisfy tsc. Do NOT move on until validation is clean. Do NOT inspect extension types or run \`npx wix generate manifest\` directly; \`validate\` handles manifest generation when editor components exist.`
     };
     var buildCoreRules = (validation) => `CORE PRINCIPLES:
 - Do NOT invent or assume new types, modules, functions, props, events, or imports.
@@ -15010,7 +15064,7 @@ FILE CREATION:
 - Do NOT output comments in code unless they explain non-obvious logic.
 
 GENERATED FILES:
-- \`src/extensions/site/components/**/*.generated.ts\` is an auto-generated editor-react-component manifest \u2014 NEVER hand-edit. Change a manifest VALUE in the component's \`*.extension.ts\`; change anything else in the \`*.tsx\` / \`*.module.css\` / \`*.props.ts\` source, then regenerate (workflow step 5). No other \`.generated.ts\` path is affected.
+- \`src/extensions/site/components/**/*.generated.ts\` is an auto-generated editor-react-component manifest \u2014 NEVER hand-edit. Change a manifest VALUE in the component's \`*.extension.ts\`; change anything else in the \`*.tsx\` / \`*.module.css\` / \`*.props.ts\` source. \`validate({ runBuild: true })\` regenerates the manifest when editor components exist. No other \`.generated.ts\` path is affected.
 - A write guard rejects \`write\`/\`edit\`/\`batch-write\`/\`multi-edit\`/\`apply_patch\` there, dropping the ENTIRE call \u2014 never batch that path with real edits (or put it in a patch alongside other hunks), or those are lost too and must be resubmitted.
 
 TYPESCRIPT:
@@ -15114,7 +15168,7 @@ MINIMIZE TEXT OUTPUT \u2014 CRITICAL:
 - Every text token costs money. Use tools, not words.
 
 TOOL USAGE:
-- \`validate\` for all validation (tsc + build). Run it after resolving the conflicts to make sure nothing breaks.
+- \`validate\` for TypeScript, build, and editor-component manifest validation. Run it after resolving the conflicts; it generates manifests when editor components exist.
 ${(0, shared_rules_1.buildFileOperationsRules)("resolving conflicts")}
 - NEVER run preview, dev, release, or promote commands.
 
@@ -15756,6 +15810,361 @@ export const SubagentToolLogger = async () => {
   }
 });
 
+// dist/extension-reporting/detect.js
+var require_detect = __commonJS({
+  "dist/extension-reporting/detect.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.BUILDER_EXTENSION_TYPES = void 0;
+    exports2.isSpiExtension = isSpiExtension;
+    exports2.isExtensionsFile = isExtensionsFile;
+    exports2.detectExtension = detectExtension;
+    exports2.matchQuotedExtensionConfigProperty = matchQuotedExtensionConfigProperty;
+    exports2.extractExtensionDisplayTitle = extractExtensionDisplayTitle;
+    exports2.injectCreatedBy = injectCreatedBy;
+    var CONTAINER_ROOT_PREFIX = /^\/user-code\//;
+    var EXTENSION_FILE_PATTERN = /\/extensions\.ts$|\.extension\.ts$/;
+    var SPI_EXTENSION_TYPES = [
+      "ecomShippingRates",
+      "ecomAdditionalFees",
+      "ecomValidations",
+      "ecomDiscountTriggers",
+      "ecomGiftCards",
+      "ecomPaymentSettings",
+      "bookingsStaffSortingProvider"
+    ];
+    exports2.BUILDER_EXTENSION_TYPES = [
+      "dashboardPage",
+      "dashboardModal",
+      "dashboardPlugin",
+      "dashboardMenuPlugin",
+      "embeddedScript",
+      "event",
+      "customElement",
+      "siteComponent",
+      "editorReactComponent",
+      "sitePlugin",
+      ...SPI_EXTENSION_TYPES,
+      "contextProvider",
+      "functionLibrary",
+      "dataCollections"
+    ];
+    var SPI_EXTENSION_TYPE_SET = new Set(SPI_EXTENSION_TYPES);
+    function isSpiExtension(extensionType) {
+      return SPI_EXTENSION_TYPE_SET.has(extensionType);
+    }
+    function normalizeFilePath(filePath) {
+      return filePath.replace(CONTAINER_ROOT_PREFIX, "");
+    }
+    function isExtensionsFile(filePath) {
+      return EXTENSION_FILE_PATTERN.test(filePath);
+    }
+    function detectExtension(content) {
+      for (const extensionType of exports2.BUILDER_EXTENSION_TYPES) {
+        if (content.includes(`extensions.${extensionType}(`) || content.includes(`experimentalExtensions.${extensionType}(`)) {
+          return extensionType;
+        }
+      }
+      return null;
+    }
+    function toTitleCase(str) {
+      return str.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+    }
+    function extractExtensionName(filePath) {
+      const parts = normalizeFilePath(filePath).split("/");
+      const folderName = parts[parts.length - 2] || "";
+      return toTitleCase(folderName);
+    }
+    function matchQuotedExtensionConfigProperty(content, propName) {
+      const objectPropertyQuotedStringValuePattern = `\\b${propName}\\s*:\\s*(?:"([^"\\\\]*)"|'([^'\\\\]*)')`;
+      const objectPropertyQuotedStringValueRegex = new RegExp(
+        objectPropertyQuotedStringValuePattern,
+        // `m` = multiline: `^` / `$` match line starts/ends, not only the whole string.
+        "m"
+      );
+      const quotedStringValueMatch = content.match(objectPropertyQuotedStringValueRegex);
+      if (!quotedStringValueMatch)
+        return null;
+      return quotedStringValueMatch[1] ?? quotedStringValueMatch[2] ?? null;
+    }
+    function extractExtensionDisplayTitle(content, filePath) {
+      const title = matchQuotedExtensionConfigProperty(content, "title");
+      if (title)
+        return title;
+      const name = matchQuotedExtensionConfigProperty(content, "name");
+      if (name)
+        return name;
+      const displayName = matchQuotedExtensionConfigProperty(content, "displayName");
+      if (displayName)
+        return displayName;
+      const idSuffix = matchQuotedExtensionConfigProperty(content, "idSuffix");
+      if (idSuffix)
+        return idSuffix;
+      return extractExtensionName(filePath);
+    }
+    function injectCreatedBy(content) {
+      if (content.includes("createdBy"))
+        return content;
+      const isGeneric = content.includes("genericExtension(");
+      const createdByValue = isGeneric ? '  createdBy: "CODE_GEN",' : '  createdBy: {\n    author: "CODE_GEN",\n  },';
+      return content.replace(/(\S)(\n)(}\))(;?\s*)$/, (_match, preChar, newline, closeBrace, tail) => {
+        const needsComma = preChar !== "," && preChar !== "{";
+        const separator = needsComma ? `${preChar},` : preChar;
+        return `${separator}${newline}${createdByValue}
+${closeBrace}${tail}`;
+      });
+    }
+  }
+});
+
+// dist/git/repository-status.js
+var require_repository_status = __commonJS({
+  "dist/git/repository-status.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.isMissingGitRepository = isMissingGitRepository;
+    exports2.hasGitRepository = hasGitRepository;
+    var child_process_1 = require("child_process");
+    var util_1 = require("util");
+    var execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+    function isMissingGitRepository(exitCode, stderr) {
+      return exitCode === 128 && /^fatal: not a git repository\b/m.test(stderr);
+    }
+    async function hasGitRepository(cwd) {
+      try {
+        await execFileAsync("git", ["rev-parse", "--is-inside-work-tree"], {
+          cwd,
+          env: { ...process.env, LC_ALL: "C" }
+        });
+        return true;
+      } catch (error) {
+        if (error instanceof Error && "code" in error && typeof error.code === "number" && "stderr" in error && typeof error.stderr === "string" && isMissingGitRepository(error.code, error.stderr))
+          return false;
+        throw error;
+      }
+    }
+  }
+});
+
+// dist/extension-reporting/prepare-created-by.js
+var require_prepare_created_by = __commonJS({
+  "dist/extension-reporting/prepare-created-by.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.prepareCreatedExtensionFiles = prepareCreatedExtensionFiles;
+    exports2.prepareCreatedByForValidation = prepareCreatedByForValidation;
+    var child_process_1 = require("child_process");
+    var promises_1 = require("fs/promises");
+    var path_12 = require("path");
+    var util_1 = require("util");
+    var detect_1 = require_detect();
+    var repository_status_1 = require_repository_status();
+    var execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+    async function prepareCreatedExtensionFiles(paths, read, write, inject, builders) {
+      for (const path of new Set(paths)) {
+        if (!/(^|\/)extensions\.ts$|\.extension\.ts$/.test(path))
+          continue;
+        const original = await read(path);
+        if (!builders.some((builder) => original.includes(`extensions.${builder}(`) || original.includes(`experimentalExtensions.${builder}(`)))
+          continue;
+        const injected = inject(original);
+        if (injected !== original)
+          await write(path, injected);
+      }
+    }
+    async function prepareCreatedByForValidation(cwd, baseline) {
+      if (!await (0, repository_status_1.hasGitRepository)(cwd))
+        return;
+      const [added, untracked] = await Promise.all([
+        execFileAsync("git", baseline ? [
+          "diff",
+          "--name-only",
+          "--diff-filter=A",
+          "--no-renames",
+          "-z",
+          baseline
+        ] : ["ls-files", "--cached", "-z"], { cwd }),
+        execFileAsync("git", ["ls-files", "--others", "--exclude-standard", "-z"], {
+          cwd
+        })
+      ]);
+      await prepareCreatedExtensionFiles((added.stdout + untracked.stdout).split("\0").filter(Boolean), (path) => (0, promises_1.readFile)((0, path_12.join)(cwd, path), "utf8"), (path, content) => (0, promises_1.writeFile)((0, path_12.join)(cwd, path), content, "utf8"), detect_1.injectCreatedBy, detect_1.BUILDER_EXTENSION_TYPES);
+    }
+  }
+});
+
+// dist/opencode-integration/plugins/validation-state.js
+var require_validation_state = __commonJS({
+  "dist/opencode-integration/plugins/validation-state.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.VALIDATION_NUDGE = exports2.VALIDATION_STATE_PLUGIN_FILENAME = exports2.VALIDATION_LOADED_EVENT_TYPE = exports2.VALIDATION_STATE_EVENT_TYPE = void 0;
+    exports2.isReadOnlyShellCommand = isReadOnlyShellCommand;
+    exports2.buildValidationStateSource = buildValidationStateSource;
+    exports2.writeValidationStatePlugin = writeValidationStatePlugin;
+    var write_plugin_1 = require_write_plugin();
+    var detect_1 = require_detect();
+    var prepare_created_by_1 = require_prepare_created_by();
+    var repository_status_1 = require_repository_status();
+    function isReadOnlyShellCommand(command) {
+      return /^(?:ls|pwd|cat|head|tail|wc|grep)(?:[ \t]+[A-Za-z0-9_./:@%+=,-]+)*[ \t]*$/.test(command);
+    }
+    exports2.VALIDATION_STATE_EVENT_TYPE = "validation_state";
+    exports2.VALIDATION_LOADED_EVENT_TYPE = "validation_loaded";
+    exports2.VALIDATION_STATE_PLUGIN_FILENAME = "validation-state.ts";
+    exports2.VALIDATION_NUDGE = "Project files need validation. Follow your validation workflow (delegate to codegen-validator if your instructions require it), run validate({ runBuild: true }), and fix any errors before finishing.";
+    function buildValidationStateSource() {
+      return String.raw`// Generated by @wix/ditto-codegen (validation-state). Do not edit.
+const EVENT_TYPE = ${JSON.stringify(exports2.VALIDATION_STATE_EVENT_TYPE)};
+const LOADED_EVENT_TYPE = ${JSON.stringify(exports2.VALIDATION_LOADED_EVENT_TYPE)};
+const VALIDATION_NUDGE = ${JSON.stringify(exports2.VALIDATION_NUDGE)};
+const BUILDERS = ${JSON.stringify(detect_1.BUILDER_EXTENSION_TYPES)};
+const injectCreatedBy = ${detect_1.injectCreatedBy.toString()};
+const prepareCreatedExtensionFiles = ${prepare_created_by_1.prepareCreatedExtensionFiles.toString()};
+const isMissingGitRepository = ${repository_status_1.isMissingGitRepository.toString()};
+const isReadOnlyShellCommand = ${isReadOnlyShellCommand.toString()};
+const MUTATING_TOOLS = new Set(["write", "edit", "apply_patch", "batch-write", "multi-edit", "wix-generate", "bash"]);
+
+export const ValidationState = async ({ client, directory, $ }) => {
+  const runGit = async (args) => {
+    const command = Object.assign(["LC_ALL=C git ", ""], { raw: ["LC_ALL=C git ", ""] });
+    return await $(command, args).cwd(directory).nothrow().quiet();
+  };
+  const git = async (args) => {
+    const result = await runGit(args);
+    if (result.exitCode !== 0) throw new Error("Cannot inspect project validation state: " + result.stderr.toString());
+    return result.stdout.toString().split("\0").filter(Boolean);
+  };
+
+  const repository = await runGit(["rev-parse", "--is-inside-work-tree"]);
+  // No loaded marker: the host must run the compatibility gate instead.
+  if (isMissingGitRepository(repository.exitCode, repository.stderr.toString())) return {};
+  if (repository.exitCode !== 0) throw new Error("Cannot inspect Git repository: " + repository.stderr.toString());
+  const snapshot = async () => {
+    const paths = [...new Set(await git(["ls-files", "--cached", "--others", "--exclude-standard", "-z"]))]
+      .filter((path) => !path.startsWith(".agents/")).sort();
+    const hash = new Bun.CryptoHasher("sha256");
+    for (const path of paths) {
+      hash.update(path + "\0");
+      const file = Bun.file(directory + "/" + path);
+      hash.update(await file.exists() ? await file.arrayBuffer() : "<deleted>");
+      hash.update("\0");
+    }
+    return hash.digest("hex");
+  };
+  const prepareMetadata = async () => {
+    if (process.env.CODEGEN_PREPARE_EXTENSION_METADATA !== "1") return;
+    const baseline = process.env.CODEGEN_VALIDATION_BASELINE;
+    const paths = [
+      ...await git(baseline ? ["diff", "--name-only", "--diff-filter=A", "--no-renames", "-z", baseline] : ["ls-files", "--cached", "-z"]),
+      ...await git(["ls-files", "--others", "--exclude-standard", "-z"]),
+    ];
+    await prepareCreatedExtensionFiles(paths,
+      (path) => Bun.file(directory + "/" + path).text(),
+      async (path, content) => { await Bun.write(directory + "/" + path, content); },
+      injectCreatedBy, BUILDERS);
+  };
+
+  let cleanFingerprint = await snapshot();
+  let currentFingerprint = cleanFingerprint;
+  let hasValidationFailure = process.env.CODEGEN_REQUIRE_VALIDATION === "1";
+  let hasUnvalidatedMutation = false;
+  let lastClean;
+  let mutationEpoch = 0;
+  let revisionNudges = 0;
+  let totalNudges = 0;
+  const remindedMessages = new Set();
+  const validations = new Map();
+  const activeMutations = new Set();
+  const key = (input) => input.sessionID + ":" + input.callID;
+  const emit = (sessionID, clean) => {
+    if (lastClean === clean) return;
+    lastClean = clean;
+    process.stdout.write(JSON.stringify({ type: EVENT_TYPE, sessionID, clean }) + "\n");
+  };
+  const refresh = async (sessionID) => {
+    const fingerprint = await snapshot();
+    if (fingerprint !== currentFingerprint) revisionNudges = 0;
+    currentFingerprint = fingerprint;
+    const clean = !hasValidationFailure && !hasUnvalidatedMutation && activeMutations.size === 0 &&
+      validations.size === 0 && fingerprint === cleanFingerprint;
+    emit(sessionID, clean);
+    return clean;
+  };
+  process.stdout.write(JSON.stringify({ type: LOADED_EVENT_TYPE }) + "\n");
+  if (hasValidationFailure) emit("repair", false);
+
+  return {
+    event: async ({ event }) => {
+      const part = event.type === "message.part.updated" ? event.properties?.part : undefined;
+      if (part?.type !== "tool" || part.state?.status !== "error") return;
+      const callKey = part.sessionID + ":" + part.callID;
+      activeMutations.delete(callKey);
+      if (validations.delete(callKey)) hasValidationFailure = true;
+    },
+    "tool.execute.before": async (input, output) => {
+      const args = output.args;
+      if (input.tool === "validate") {
+        if (args.runBuild === true || args.installDeps === true) {
+          emit(input.sessionID, false);
+          hasValidationFailure = true;
+          await prepareMetadata();
+          currentFingerprint = await snapshot();
+          validations.set(key(input), mutationEpoch);
+        }
+      } else if (MUTATING_TOOLS.has(input.tool)) {
+        if (input.tool !== "bash" || typeof args.command !== "string" || !isReadOnlyShellCommand(args.command)) {
+          hasUnvalidatedMutation = true;
+          revisionNudges = 0;
+        }
+        mutationEpoch += 1;
+        activeMutations.add(key(input));
+        emit(input.sessionID, false);
+      }
+    },
+    "tool.execute.after": async (input, output) => {
+      if (input.tool === "validate") {
+        const epoch = validations.get(key(input));
+        validations.delete(key(input));
+        const passed = typeof output.output === "string" && !/^FAILED at/m.test(output.output);
+        if (!passed) hasValidationFailure = true;
+        if (passed && input.args?.runBuild === true) {
+          const fingerprint = await snapshot();
+          if (epoch === mutationEpoch && activeMutations.size === 0 && validations.size === 0) {
+            cleanFingerprint = fingerprint;
+            hasValidationFailure = false;
+            hasUnvalidatedMutation = false;
+          }
+        }
+        await refresh(input.sessionID);
+      } else if (MUTATING_TOOLS.has(input.tool)) {
+        activeMutations.delete(key(input));
+        await refresh(input.sessionID);
+      }
+    },
+    "experimental.text.complete": async (input) => {
+      if (await refresh(input.sessionID)) return;
+      const messageKey = input.sessionID + ":" + input.messageID;
+      if (remindedMessages.has(messageKey) || revisionNudges >= 2 || totalNudges >= 8) return;
+      remindedMessages.add(messageKey);
+      revisionNudges += 1;
+      totalNudges += 1;
+      await client.session.prompt({
+        path: { id: input.sessionID },
+        body: { noReply: true, parts: [{ type: "text", text: VALIDATION_NUDGE }] },
+      });
+    },
+  };
+};
+
+`;
+    }
+    async function writeValidationStatePlugin() {
+      await (0, write_plugin_1.writeGeneratedPlugin)(exports2.VALIDATION_STATE_PLUGIN_FILENAME, buildValidationStateSource());
+    }
+  }
+});
+
 // dist/opencode-integration/apply-patch.js
 var require_apply_patch = __commonJS({
   "dist/opencode-integration/apply-patch.js"(exports2) {
@@ -15775,6 +16184,9 @@ var require_parser = __commonJS({
   "dist/opencode-integration/execution/parser.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.hasValidationPluginLoaded = hasValidationPluginLoaded;
+    exports2.parseLastValidationState = parseLastValidationState;
+    exports2.parseRequiredPermissionsDeclaration = parseRequiredPermissionsDeclaration;
     exports2.parseRequiredPermissions = parseRequiredPermissions;
     exports2.parseAnswerText = parseAnswerText;
     exports2.createEmptyUsageStats = createEmptyUsageStats;
@@ -15784,9 +16196,26 @@ var require_parser = __commonJS({
     exports2.summarizeOpenCodeLine = summarizeOpenCodeLine;
     var types_1 = require_types4();
     var subagent_tool_logger_1 = require_subagent_tool_logger();
+    var validation_state_1 = require_validation_state();
     var apply_patch_1 = require_apply_patch();
-    function parseRequiredPermissions(output) {
-      let permissions = [];
+    function hasValidationPluginLoaded(output) {
+      return output.split("\n").some((line) => (0, types_1.tryParseJson)(line)?.type === validation_state_1.VALIDATION_LOADED_EVENT_TYPE);
+    }
+    function parseLastValidationState(output) {
+      let validationState;
+      for (const line of output.split("\n")) {
+        if (!line.trim())
+          continue;
+        const event = (0, types_1.tryParseJson)(line);
+        if (event?.type !== validation_state_1.VALIDATION_STATE_EVENT_TYPE || typeof event.sessionID !== "string" || typeof event.clean !== "boolean") {
+          continue;
+        }
+        validationState = event;
+      }
+      return validationState;
+    }
+    function parseRequiredPermissionsDeclaration(output) {
+      let permissions;
       const lines = output.split("\n");
       for (const line of lines) {
         if (!line.trim())
@@ -15802,6 +16231,9 @@ var require_parser = __commonJS({
       }
       return permissions;
     }
+    function parseRequiredPermissions(output) {
+      return parseRequiredPermissionsDeclaration(output) ?? [];
+    }
     function parseAnswerText(output) {
       const messages = output.split("\n").map((line) => (0, types_1.tryParseJson)(line)).filter((event) => event?.type === "text").map((event) => event.part?.text ?? "");
       return (messages[messages.length - 1] ?? "").trim();
@@ -16170,113 +16602,6 @@ var require_progress_handler = __commonJS({
   }
 });
 
-// dist/extension-reporting/detect.js
-var require_detect = __commonJS({
-  "dist/extension-reporting/detect.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.BUILDER_EXTENSION_TYPES = void 0;
-    exports2.isSpiExtension = isSpiExtension;
-    exports2.isExtensionsFile = isExtensionsFile;
-    exports2.detectExtension = detectExtension;
-    exports2.matchQuotedExtensionConfigProperty = matchQuotedExtensionConfigProperty;
-    exports2.extractExtensionDisplayTitle = extractExtensionDisplayTitle;
-    exports2.injectCreatedBy = injectCreatedBy;
-    var CONTAINER_ROOT_PREFIX = /^\/user-code\//;
-    var EXTENSION_FILE_PATTERN = /\/extensions\.ts$|\.extension\.ts$/;
-    var SPI_EXTENSION_TYPES = [
-      "ecomShippingRates",
-      "ecomAdditionalFees",
-      "ecomValidations",
-      "ecomDiscountTriggers",
-      "ecomGiftCards",
-      "ecomPaymentSettings",
-      "bookingsStaffSortingProvider"
-    ];
-    exports2.BUILDER_EXTENSION_TYPES = [
-      "dashboardPage",
-      "dashboardModal",
-      "dashboardPlugin",
-      "dashboardMenuPlugin",
-      "embeddedScript",
-      "event",
-      "customElement",
-      "siteComponent",
-      "editorReactComponent",
-      "sitePlugin",
-      ...SPI_EXTENSION_TYPES,
-      "contextProvider",
-      "functionLibrary",
-      "dataCollections"
-    ];
-    var SPI_EXTENSION_TYPE_SET = new Set(SPI_EXTENSION_TYPES);
-    function isSpiExtension(extensionType) {
-      return SPI_EXTENSION_TYPE_SET.has(extensionType);
-    }
-    function normalizeFilePath(filePath) {
-      return filePath.replace(CONTAINER_ROOT_PREFIX, "");
-    }
-    function isExtensionsFile(filePath) {
-      return EXTENSION_FILE_PATTERN.test(filePath);
-    }
-    function detectExtension(content) {
-      for (const extensionType of exports2.BUILDER_EXTENSION_TYPES) {
-        if (content.includes(`extensions.${extensionType}(`) || content.includes(`experimentalExtensions.${extensionType}(`)) {
-          return extensionType;
-        }
-      }
-      return null;
-    }
-    function toTitleCase(str) {
-      return str.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
-    }
-    function extractExtensionName(filePath) {
-      const parts = normalizeFilePath(filePath).split("/");
-      const folderName = parts[parts.length - 2] || "";
-      return toTitleCase(folderName);
-    }
-    function matchQuotedExtensionConfigProperty(content, propName) {
-      const objectPropertyQuotedStringValuePattern = `\\b${propName}\\s*:\\s*(?:"([^"\\\\]*)"|'([^'\\\\]*)')`;
-      const objectPropertyQuotedStringValueRegex = new RegExp(
-        objectPropertyQuotedStringValuePattern,
-        // `m` = multiline: `^` / `$` match line starts/ends, not only the whole string.
-        "m"
-      );
-      const quotedStringValueMatch = content.match(objectPropertyQuotedStringValueRegex);
-      if (!quotedStringValueMatch)
-        return null;
-      return quotedStringValueMatch[1] ?? quotedStringValueMatch[2] ?? null;
-    }
-    function extractExtensionDisplayTitle(content, filePath) {
-      const title = matchQuotedExtensionConfigProperty(content, "title");
-      if (title)
-        return title;
-      const name = matchQuotedExtensionConfigProperty(content, "name");
-      if (name)
-        return name;
-      const displayName = matchQuotedExtensionConfigProperty(content, "displayName");
-      if (displayName)
-        return displayName;
-      const idSuffix = matchQuotedExtensionConfigProperty(content, "idSuffix");
-      if (idSuffix)
-        return idSuffix;
-      return extractExtensionName(filePath);
-    }
-    function injectCreatedBy(content) {
-      if (content.includes("createdBy"))
-        return content;
-      const isGeneric = content.includes("genericExtension(");
-      const createdByValue = isGeneric ? '  createdBy: "CODE_GEN",' : '  createdBy: {\n    author: "CODE_GEN",\n  },';
-      return content.replace(/(\S)(\n)(}\))(;?\s*)$/, (_match, preChar, newline, closeBrace, tail) => {
-        const needsComma = preChar !== "," && preChar !== "{";
-        const separator = needsComma ? `${preChar},` : preChar;
-        return `${separator}${newline}${createdByValue}
-${closeBrace}${tail}`;
-      });
-    }
-  }
-});
-
 // dist/opencode-integration/task-tracker/derived-progress.js
 var require_derived_progress = __commonJS({
   "dist/opencode-integration/task-tracker/derived-progress.js"(exports2) {
@@ -16994,12 +17319,150 @@ var require_process_handlers = __commonJS({
   }
 });
 
+// dist/validation/editor-components.js
+var require_editor_components = __commonJS({
+  "dist/validation/editor-components.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.containsTypeScriptFile = containsTypeScriptFile;
+    var promises_1 = require("fs/promises");
+    var path_12 = require("path");
+    async function containsTypeScriptFile(directory) {
+      const entries = await (0, promises_1.readdir)(directory, { withFileTypes: true }).catch((error) => {
+        if (error.code === "ENOENT")
+          return [];
+        throw error;
+      });
+      for (const entry of entries) {
+        if (entry.isFile() && /\.tsx?$/.test(entry.name))
+          return true;
+        if (entry.isDirectory() && await containsTypeScriptFile((0, path_12.join)(directory, entry.name)))
+          return true;
+      }
+      return false;
+    }
+  }
+});
+
+// dist/validation/host-validation.js
+var require_host_validation = __commonJS({
+  "dist/validation/host-validation.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.HostValidationError = exports2.HOST_VALIDATION_STAGE_TIMEOUT_MS = void 0;
+    exports2.runHostValidation = runHostValidation;
+    var child_process_1 = require("child_process");
+    var util_1 = require("util");
+    var ditto_codegen_types_12 = require_dist4();
+    var logger_12 = require_logger();
+    var path_12 = require("path");
+    var editor_components_1 = require_editor_components();
+    var execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+    var MAX_OUTPUT_BUFFER_BYTES = 10 * 1024 * 1024;
+    var MAX_DIAGNOSTIC_CHARS = 2e4;
+    var MAX_DIAGNOSTIC_SUMMARY_CHARS = 2e3;
+    exports2.HOST_VALIDATION_STAGE_TIMEOUT_MS = 5 * 6e4;
+    var VALIDATION_COMMANDS = [
+      {
+        stage: "typescript",
+        executable: "npx",
+        args: ["tsc", "--noEmit", "-p", "."]
+      },
+      {
+        stage: "wix build",
+        executable: "npx",
+        args: ["wix", "build"]
+      },
+      {
+        stage: "wix generate manifest",
+        executable: "npx",
+        args: ["wix", "generate", "manifest"]
+      }
+    ];
+    var HostValidationError = class extends ditto_codegen_types_12.HostValidationError {
+      constructor(stage, command, options) {
+        const diagnostics = [options.stdout, options.stderr].filter((output) => Boolean(output?.trim())).join("\n").trim();
+        const exit = options.timedOut ? `timed out after ${options.timeoutMs}ms` : options.exitCode === void 0 ? "could not start" : `exited ${options.exitCode}`;
+        super(`Project validation failed at ${stage}: ${command} ${exit}`, {
+          stage,
+          command,
+          exitCode: options.exitCode,
+          timedOut: options.timedOut ?? false,
+          diagnosticSummary: outputAsString(diagnostics, MAX_DIAGNOSTIC_SUMMARY_CHARS)
+        });
+        this.stage = stage;
+        this.validationType = stage;
+        this.command = command;
+        this.timedOut = options.timedOut ?? false;
+        Object.defineProperties(this, {
+          stdout: { value: options.stdout, enumerable: false },
+          stderr: { value: options.stderr, enumerable: false },
+          cause: { value: options.cause, enumerable: false }
+        });
+      }
+    };
+    exports2.HostValidationError = HostValidationError;
+    var executeValidationCommand = async (executable, args, cwd, timeoutMs) => {
+      return execFileAsync(executable, args, {
+        cwd,
+        killSignal: "SIGTERM",
+        maxBuffer: MAX_OUTPUT_BUFFER_BYTES,
+        timeout: timeoutMs
+      });
+    };
+    function outputAsString(output, maxChars = MAX_DIAGNOSTIC_CHARS) {
+      const text = typeof output === "string" ? output : output?.toString() ?? "";
+      if (text.length <= maxChars)
+        return text;
+      const omitted = text.length - maxChars;
+      return `[truncated ${omitted} leading characters]
+${text.slice(-maxChars)}`;
+    }
+    function numericExitCode(error) {
+      return typeof error.code === "number" ? error.code : void 0;
+    }
+    async function runHostValidation(cwd, execute = executeValidationCommand) {
+      for (const command of VALIDATION_COMMANDS) {
+        if (command.stage === "wix generate manifest" && !await (0, editor_components_1.containsTypeScriptFile)((0, path_12.join)(cwd, "src/extensions/site/components")))
+          continue;
+        const displayCommand = [command.executable, ...command.args].join(" ");
+        const startTime = Date.now();
+        logger_12.logger.info("[Host Validation] Starting stage", {
+          stage: command.stage,
+          command: displayCommand
+        });
+        try {
+          await execute(command.executable, command.args, cwd, exports2.HOST_VALIDATION_STAGE_TIMEOUT_MS);
+          logger_12.logger.info("[Host Validation] Stage passed", {
+            stage: command.stage,
+            durationMs: Date.now() - startTime
+          });
+        } catch (error) {
+          const failure = error instanceof Error ? error : new Error(String(error));
+          const timedOut = failure.killed === true && failure.signal === "SIGTERM";
+          const stderr = outputAsString(failure.stderr) || (timedOut ? `Command timed out after ${exports2.HOST_VALIDATION_STAGE_TIMEOUT_MS}ms` : failure.message);
+          throw new HostValidationError(command.stage, displayCommand, {
+            exitCode: numericExitCode(failure),
+            stdout: outputAsString(failure.stdout),
+            stderr,
+            timedOut,
+            timeoutMs: exports2.HOST_VALIDATION_STAGE_TIMEOUT_MS
+          });
+        }
+      }
+    }
+  }
+});
+
 // dist/opencode-integration/execution/executor.js
 var require_executor = __commonJS({
   "dist/opencode-integration/execution/executor.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.reserveHostValidationRepairAttempt = reserveHostValidationRepairAttempt;
+    exports2.updateRequiredPermissions = updateRequiredPermissions;
     exports2.classifyAttempt = classifyAttempt;
+    exports2.applyPostRunValidation = applyPostRunValidation;
     exports2.executeOpenCode = executeOpenCode;
     exports2.resolveFinalRunCost = resolveFinalRunCost;
     var child_process_1 = require("child_process");
@@ -17016,11 +17479,16 @@ var require_executor = __commonJS({
     var process_manager_1 = require_process_manager();
     var process_handlers_1 = require_process_handlers();
     var logger_12 = require_logger();
+    var host_validation_1 = require_host_validation();
     var MAX_RETRIES = 5;
+    var MAX_HOST_VALIDATION_FAILURES = 2;
     var MAX_STALL_ATTEMPTS = 2;
     function failureReason(result) {
       if (result.stalled)
         return "stall";
+      if (result.error instanceof host_validation_1.HostValidationError) {
+        return "host validation failure";
+      }
       if ((0, parser_1.hasSessionError)(result.stdout))
         return "session error";
       if (result.error instanceof ditto_codegen_types_12.ProcessExecutionError) {
@@ -17031,13 +17499,50 @@ var require_executor = __commonJS({
       }
       return null;
     }
-    function classifyAttempt(result, stalls) {
+    function reserveHostValidationRepairAttempt(maxAttempts, hostValidationFailures) {
+      return hostValidationFailures === 1 ? maxAttempts + 1 : maxAttempts;
+    }
+    function updateRequiredPermissions(current, result) {
+      if (!result.success || failureReason(result))
+        return current;
+      return (0, parser_1.parseRequiredPermissionsDeclaration)(result.stdout) ?? current;
+    }
+    function classifyAttempt(result, stalls, hostValidationFailures = 0) {
       const reason = failureReason(result);
       if (!reason)
         return { retryable: false, reason: null };
+      if (reason === "host validation failure") {
+        if (result.error instanceof host_validation_1.HostValidationError && result.error.stage === "agent validation state") {
+          return { retryable: false, reason };
+        }
+        return {
+          retryable: hostValidationFailures < MAX_HOST_VALIDATION_FAILURES,
+          reason
+        };
+      }
       return { retryable: stalls < MAX_STALL_ATTEMPTS, reason };
     }
-    async function executeOpenCode(options) {
+    async function applyPostRunValidation(result, postRunValidation) {
+      if (!result.success || !postRunValidation)
+        return result;
+      try {
+        await postRunValidation(result.stdout);
+        return result;
+      } catch (error) {
+        const validationError = error instanceof host_validation_1.HostValidationError ? error : new host_validation_1.HostValidationError("project finalization", "project finalization", {
+          stderr: error instanceof Error ? error.message : String(error),
+          cause: error
+        });
+        return {
+          ...result,
+          success: false,
+          exitCode: validationError.exitCode ?? null,
+          stderr: validationError.stderr ?? result.stderr,
+          error: validationError
+        };
+      }
+    }
+    async function executeOpenCode(options, executeAttempt = executeOpenCodeOnce) {
       let lastResult = null;
       let accumulatedUsage = (0, parser_1.createEmptyUsageStats)();
       const accumulatedSkills = [];
@@ -17045,26 +17550,35 @@ var require_executor = __commonJS({
       let currentPrompt = options.prompt;
       let lastFailureReason = null;
       let stalls = 0;
+      let hostValidationFailures = 0;
+      let requiredPermissions = [];
+      let maxAttempts = MAX_RETRIES;
       const forceFresh = process.env.CODEGEN_FRESH_SESSION === "true";
       let continueSession = forceFresh ? false : options.continueSession ?? false;
       const env = (0, config_12.getOpenCodeEnv)(options.projectId, job_context_storage_12.jobContextStorage.getStore()?.kind);
       const statsBaseline = await (0, cost_tracker_1.fetchOpenCodeStats)(options.outputPath, env);
       const baselineCost = statsBaseline ? (0, cost_tracker_1.parseStatsTotalCost)(statsBaseline) : null;
       logger_12.logger.debug("[OpenCode] Stats baseline before run", { baselineCost });
-      for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+      for (let attempt = 1; attempt <= maxAttempts; attempt++) {
         if (attempt > 1) {
-          const failureDetail = lastResult?.error?.message || lastResult?.stderr || "Process timed out";
-          logger_12.logger.info(`[OpenCode] Retry attempt ${attempt}/${MAX_RETRIES} after ${lastFailureReason} - starting fresh session with recovery context`, { reason: lastFailureReason, detail: failureDetail.slice(0, 500) });
+          const failureDetail = lastResult?.error instanceof host_validation_1.HostValidationError ? [lastResult.error.message, lastResult.error.stderr].filter((value) => Boolean(value)).join("\n") : lastResult?.error?.message || lastResult?.stderr || "Process timed out";
+          logger_12.logger.info(`[OpenCode] Retry attempt ${attempt}/${maxAttempts} after ${lastFailureReason} - starting fresh session with recovery context`, { reason: lastFailureReason, detail: failureDetail.slice(0, 500) });
           const filesChanged = await (0, file_changes_1.collectGitFileChanges)(options.outputPath, options.gitBaseline);
           currentPrompt = (0, prompts_1.buildRecoveryPrompt)(options.prompt, filesChanged, failureDetail, lastFailureReason);
           continueSession = false;
         }
-        const result = await executeOpenCodeOnce({ ...options, prompt: currentPrompt, continueSession }, attempt, toolUsage);
+        let result = await executeAttempt({ ...options, prompt: currentPrompt, continueSession }, attempt, maxAttempts, toolUsage);
         accumulatedUsage = (0, parser_1.mergeUsageStats)(accumulatedUsage, result.usage);
         accumulatedSkills.push(...result.skillsUsed);
+        requiredPermissions = updateRequiredPermissions(requiredPermissions, result);
+        result = await applyPostRunValidation(result, options.postRunValidation);
         if (result.stalled)
           stalls += 1;
-        const { retryable, reason } = classifyAttempt(result, stalls);
+        if (result.error instanceof host_validation_1.HostValidationError && result.error.stage !== "agent validation state") {
+          hostValidationFailures += 1;
+          maxAttempts = reserveHostValidationRepairAttempt(maxAttempts, hostValidationFailures);
+        }
+        const { retryable, reason } = classifyAttempt(result, stalls, hostValidationFailures);
         if (!retryable) {
           if (reason) {
             logger_12.logger.warn(`[OpenCode] Not retrying after ${reason}`, {
@@ -17076,6 +17590,7 @@ var require_executor = __commonJS({
           const finalResult2 = {
             ...result,
             agentMessage: (0, parser_1.parseAnswerText)(result.stdout),
+            requiredPermissions,
             usage: accumulatedUsage,
             skillsUsed: accumulatedSkills,
             toolUsage: toolUsage.toSummary()
@@ -17087,17 +17602,18 @@ var require_executor = __commonJS({
         lastFailureReason = reason;
         logger_12.logger.warn(`[OpenCode] Attempt failed due to ${reason}, will retry`, {
           attempt,
-          maxRetries: MAX_RETRIES,
+          maxRetries: maxAttempts,
           detail: (result.error?.message || result.stderr || "").slice(0, 500)
         });
       }
       logger_12.logger.warn("[OpenCode] All retry attempts exhausted", {
-        maxRetries: MAX_RETRIES
+        maxRetries: maxAttempts
       });
       accumulatedUsage = await resolveFinalRunCost(accumulatedUsage, options, baselineCost);
       const finalResult = {
         ...lastResult,
         agentMessage: (0, parser_1.parseAnswerText)(lastResult.stdout),
+        requiredPermissions,
         usage: accumulatedUsage,
         skillsUsed: Array.from(accumulatedSkills),
         toolUsage: toolUsage.toSummary()
@@ -17129,7 +17645,7 @@ var require_executor = __commonJS({
       const sessionArgs = continueSession ? ["--continue"] : [];
       return ["run", ...sessionArgs, "--format", "json", prompt];
     }
-    async function executeOpenCodeOnce(options, attempt, toolUsage) {
+    async function executeOpenCodeOnce(options, attempt, maxAttempts, toolUsage) {
       const { prompt, outputPath, projectId, onStdout, onStderr, continueSession = false } = options;
       const startTime = Date.now();
       const taskTracker = new task_tracker_1.OpenCodeTaskTracker(outputPath, toolUsage);
@@ -17168,7 +17684,7 @@ var require_executor = __commonJS({
           const args = buildArgs(prompt, continueSession);
           logger_12.logger.info("[OpenCode] Executing opencode run", {
             attempt,
-            maxRetries: MAX_RETRIES,
+            maxRetries: maxAttempts,
             workingDirectory: outputPath,
             continueSession,
             model: (0, model_knobs_1.getModel)(),
@@ -17176,6 +17692,9 @@ var require_executor = __commonJS({
           });
           logger_12.logger.debug("[OpenCode] Full prompt", { prompt });
           const env = (0, config_12.getOpenCodeEnv)(projectId, job_context_storage_12.jobContextStorage.getStore()?.kind);
+          env.CODEGEN_VALIDATION_BASELINE = options.gitBaseline;
+          env.CODEGEN_PREPARE_EXTENSION_METADATA = options.prepareExtensionMetadata ? "1" : "0";
+          env.CODEGEN_REQUIRE_VALIDATION = attempt > 1 ? "1" : "0";
           ctx.child = (0, child_process_1.spawn)("opencode", args, {
             cwd: outputPath,
             env,
@@ -17211,6 +17730,41 @@ var require_executor = __commonJS({
   }
 });
 
+// dist/validation/session-validation.js
+var require_session_validation = __commonJS({
+  "dist/validation/session-validation.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.validateSessionOrFallback = validateSessionOrFallback;
+    var parser_1 = require_parser();
+    var prepare_created_by_1 = require_prepare_created_by();
+    var logger_12 = require_logger();
+    var host_validation_1 = require_host_validation();
+    async function validateSessionOrFallback(outputPath, stdout, metadataBaseline) {
+      const validationState = (0, parser_1.parseLastValidationState)(stdout);
+      if (!validationState) {
+        if ((0, parser_1.hasValidationPluginLoaded)(stdout))
+          return;
+        logger_12.logger.info("[Validation State] No plugin state found; running host validation fallback");
+        if (metadataBaseline !== void 0)
+          await (0, prepare_created_by_1.prepareCreatedByForValidation)(outputPath, metadataBaseline);
+        await (0, host_validation_1.runHostValidation)(outputPath);
+        return;
+      }
+      if (validationState.clean) {
+        logger_12.logger.info("[Validation State] Agent session ended clean", {
+          sessionID: validationState.sessionID
+        });
+        return;
+      }
+      throw new host_validation_1.HostValidationError("agent validation state", "validate({ runBuild: true })", {
+        exitCode: 1,
+        stderr: "Project files remain unvalidated after the in-session validation reminders."
+      });
+    }
+  }
+});
+
 // dist/opencode-integration/execution/opencode-runner.js
 var require_opencode_runner = __commonJS({
   "dist/opencode-integration/execution/opencode-runner.js"(exports2) {
@@ -17223,6 +17777,7 @@ var require_opencode_runner = __commonJS({
     var prompts_1 = require_prompts();
     var executor_1 = require_executor();
     var parser_1 = require_parser();
+    var session_validation_1 = require_session_validation();
     async function runOpenCodeInit(options) {
       const { blueprint, outputPath, projectId, chatHistory, gitBaseline, onStdout, onStderr } = options;
       const prompt = (0, prompts_1.buildInitPrompt)(blueprint, chatHistory);
@@ -17231,6 +17786,8 @@ var require_opencode_runner = __commonJS({
         outputPath,
         projectId,
         gitBaseline,
+        prepareExtensionMetadata: true,
+        postRunValidation: (stdout) => (0, session_validation_1.validateSessionOrFallback)(outputPath, stdout, gitBaseline),
         onStdout,
         onStderr
       });
@@ -17244,6 +17801,8 @@ var require_opencode_runner = __commonJS({
         projectId,
         continueSession: true,
         gitBaseline,
+        prepareExtensionMetadata: true,
+        postRunValidation: (stdout) => (0, session_validation_1.validateSessionOrFallback)(outputPath, stdout, gitBaseline),
         onStdout,
         onStderr
       });
@@ -17275,6 +17834,7 @@ var require_opencode_runner = __commonJS({
         outputPath,
         projectId,
         gitBaseline,
+        postRunValidation: (stdout) => (0, session_validation_1.validateSessionOrFallback)(outputPath, stdout),
         onStdout,
         onStderr
       });
@@ -17661,39 +18221,6 @@ var require_codegen_flow_helpers = __commonJS({
   }
 });
 
-// dist/extension-reporting/inject-created-by.js
-var require_inject_created_by = __commonJS({
-  "dist/extension-reporting/inject-created-by.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.injectCreatedByIntoExtensionFiles = injectCreatedByIntoExtensionFiles;
-    var promises_1 = require("fs/promises");
-    var path_12 = require("path");
-    var logger_12 = require_logger();
-    var detect_1 = require_detect();
-    async function injectCreatedByIntoExtensionFiles(cwd, createdExtensions) {
-      for (const { path: filePath } of createdExtensions) {
-        const absolutePath = (0, path_12.join)(cwd, filePath);
-        try {
-          const original = await (0, promises_1.readFile)(absolutePath, "utf-8");
-          const injected = (0, detect_1.injectCreatedBy)(original);
-          if (injected !== original) {
-            await (0, promises_1.writeFile)(absolutePath, injected, "utf-8");
-            logger_12.logger.info("[OpenCode] Injected createdBy into extension file", {
-              filePath
-            });
-          }
-        } catch (error) {
-          logger_12.logger.error("[OpenCode] Failed to inject createdBy", {
-            filePath,
-            error: error instanceof Error ? error.message : String(error)
-          });
-        }
-      }
-    }
-  }
-});
-
 // ../../node_modules/@wix/bi-logger-dev-tools-data/dist/cjs/v2/index.js
 var require_v2 = __commonJS({
   "../../node_modules/@wix/bi-logger-dev-tools-data/dist/cjs/v2/index.js"(exports2) {
@@ -22776,7 +23303,6 @@ var require_opencode_init = __commonJS({
     var logger_12 = require_logger();
     var model_knobs_1 = require_model_knobs();
     var file_changes_1 = require_file_changes();
-    var inject_created_by_1 = require_inject_created_by();
     var job_payload_1 = require_job_payload2();
     var bi_events_1 = require_bi_events();
     var expensive_run_1 = require_expensive_run();
@@ -22842,7 +23368,6 @@ var require_opencode_init = __commonJS({
         filesChanged = files.length > 0;
         const agentOutput = (0, agent_io_1.readAgentOutput)(outputPath);
         const extensions = await (0, job_payload_1.buildExtensionsJobPayload)(outputPath, files);
-        await (0, inject_created_by_1.injectCreatedByIntoExtensionFiles)(outputPath, extensions.created);
         await (0, codegen_flow_helpers_12.updateJobPayload)(localJobContext, {
           requiredPermissions: result.requiredPermissions,
           agentMessage: result.agentMessage,
@@ -22997,7 +23522,6 @@ var require_opencode_iterate = __commonJS({
     var logger_12 = require_logger();
     var model_knobs_1 = require_model_knobs();
     var file_changes_1 = require_file_changes();
-    var inject_created_by_1 = require_inject_created_by();
     var job_payload_1 = require_job_payload2();
     var expensive_run_1 = require_expensive_run();
     var bi_events_1 = require_bi_events();
@@ -23051,7 +23575,6 @@ var require_opencode_iterate = __commonJS({
         filesChanged = files.length > 0;
         const agentOutput = (0, agent_io_1.readAgentOutput)(outputPath);
         const extensions = await (0, job_payload_1.buildExtensionsJobPayload)(outputPath, files);
-        await (0, inject_created_by_1.injectCreatedByIntoExtensionFiles)(outputPath, extensions.created);
         await (0, codegen_flow_helpers_12.updateJobPayload)(localJobContext, {
           requiredPermissions: result.requiredPermissions,
           agentMessage: result.agentMessage,
@@ -23185,6 +23708,42 @@ var require_opencode_ask_orchestrator = __commonJS({
   }
 });
 
+// dist/extension-reporting/inject-created-by.js
+var require_inject_created_by = __commonJS({
+  "dist/extension-reporting/inject-created-by.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.injectCreatedByIntoExtensionFiles = injectCreatedByIntoExtensionFiles;
+    var promises_1 = require("fs/promises");
+    var path_12 = require("path");
+    var logger_12 = require_logger();
+    var detect_1 = require_detect();
+    async function injectCreatedByIntoExtensionFiles(cwd, createdExtensions) {
+      let hasWrittenFiles = false;
+      for (const { path: filePath } of createdExtensions) {
+        const absolutePath = (0, path_12.join)(cwd, filePath);
+        try {
+          const original = await (0, promises_1.readFile)(absolutePath, "utf-8");
+          const injected = (0, detect_1.injectCreatedBy)(original);
+          if (injected !== original) {
+            hasWrittenFiles = true;
+            await (0, promises_1.writeFile)(absolutePath, injected, "utf-8");
+            logger_12.logger.info("[OpenCode] Injected createdBy into extension file", {
+              filePath
+            });
+          }
+        } catch (error) {
+          logger_12.logger.error("[OpenCode] Failed to inject createdBy", {
+            filePath,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      return hasWrittenFiles;
+    }
+  }
+});
+
 // dist/flows/opencode-ask.js
 var require_opencode_ask = __commonJS({
   "dist/flows/opencode-ask.js"(exports2) {
@@ -24082,6 +24641,7 @@ var require_tool_policies3 = __commonJS({
         commandFragments,
         message
       }));
+      const commandBlocks = emitKind("commandBlock", ({ commandFragments, message }) => ({ commandFragments, message }));
       const skillPrepends = emitKind("skillContent", ({ skillNames, message }) => ({
         skillNames,
         message
@@ -24091,6 +24651,7 @@ const BLOCK_READS = ${emitReads("block")};
 const PREPEND_READS = ${emitReads("prepend")};
 const GENERATE_POLICIES = ${generatePolicies};
 const COMMAND_PREPENDS = ${commandPrepends};
+const COMMAND_BLOCKS = ${commandBlocks};
 const SKILL_PREPENDS = ${skillPrepends};
 // Appended once after every prepend banner (see OVERRIDE_AUTHORITY_NOTE):
 // part of the override contract, so no policy can ship without it.
@@ -24131,6 +24692,14 @@ export const ToolPolicies = async () => ({
     )[0];
     if (blocked) throw new Error(blocked.message);
 
+    if (input.tool === "${"bash"}" && typeof args.command === "string") {
+      const command = args.command.replace(/\\s+/g, " ");
+      const blockedCommand = COMMAND_BLOCKS.find((policy) =>
+        policy.commandFragments.some((fragment) => command.includes(fragment)),
+      );
+      if (blockedCommand) throw new Error(blockedCommand.message);
+    }
+
     if (GENERATE_POLICIES.length === 0) return;
     if (input.tool === "${"wix-generate"}" && Array.isArray(args.extensions)) {
       for (const extension of args.extensions) {
@@ -24324,6 +24893,7 @@ var require_plugins3 = __commonJS({
     var generated_files_guard_1 = require_generated_files_guard();
     var subagent_tool_logger_1 = require_subagent_tool_logger();
     var tool_policies_1 = require_tool_policies3();
+    var validation_state_1 = require_validation_state();
     var tool_policies_drift_1 = require_tool_policies_drift();
     Object.defineProperty(exports2, "validateToolPolicies", { enumerable: true, get: function() {
       return tool_policies_drift_1.validateToolPolicies;
@@ -24333,7 +24903,8 @@ var require_plugins3 = __commonJS({
         (0, docs_feedback_nudge_1.writeDocsFeedbackNudgePlugin)(),
         (0, generated_files_guard_1.writeGeneratedFilesGuardPlugin)(),
         (0, subagent_tool_logger_1.writeSubagentToolLoggerPlugin)(),
-        (0, tool_policies_1.writeToolPoliciesPlugin)(toolPolicies)
+        (0, tool_policies_1.writeToolPoliciesPlugin)(toolPolicies),
+        (0, validation_state_1.writeValidationStatePlugin)()
       ]);
     }
   }