@workerdeck/core 0.6.0

package/build/index.mjs

@@ -0,0 +1,2324 @@
+import { createRequire } from "node:module";
+import { randomUUID } from "node:crypto";
+import { getSessionMessages, query } from "@anthropic-ai/claude-agent-sdk";
+import { ToolLoopAgent, generateText, isStepCount, tool } from "ai";
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import { createVfs, runScript } from "@workerdeck/sandbox";
+import { z } from "zod";
+import { lookup } from "node:dns/promises";
+//#region src/input-queue.ts
+/**
+* Push-based single-consumer AsyncIterable bridging imperative sendMessage() calls
+* into the streaming `prompt` the Agent SDK consumes.
+*/
+var InputQueue = class {
+	#buffer = [];
+	#waiter = null;
+	#done = false;
+	push(message) {
+		if (this.#done) return;
+		if (this.#waiter) {
+			const resolve = this.#waiter;
+			this.#waiter = null;
+			resolve({
+				value: message,
+				done: false
+			});
+		} else this.#buffer.push(message);
+	}
+	end() {
+		if (this.#done) return;
+		this.#done = true;
+		if (this.#waiter) {
+			const resolve = this.#waiter;
+			this.#waiter = null;
+			resolve({
+				value: void 0,
+				done: true
+			});
+		}
+	}
+	[Symbol.asyncIterator]() {
+		return {
+			next: () => {
+				const buffered = this.#buffer.shift();
+				if (buffered !== void 0) return Promise.resolve({
+					value: buffered,
+					done: false
+				});
+				if (this.#done) return Promise.resolve({
+					value: void 0,
+					done: true
+				});
+				return new Promise((resolve) => {
+					this.#waiter = resolve;
+				});
+			},
+			return: () => {
+				this.end();
+				return Promise.resolve({
+					value: void 0,
+					done: true
+				});
+			}
+		};
+	}
+};
+//#endregion
+//#region src/normalize.ts
+function toApiMessage(message) {
+	const m = message;
+	return {
+		role: m.role ?? "assistant",
+		content: m.content,
+		model: m.model,
+		stop_reason: m.stop_reason,
+		usage: m.usage
+	};
+}
+/**
+* Map one SDKMessage to a wire-protocol event body, or null for messages the runner
+* consumes itself (system_init and session-state changes carry runner state and are
+* emitted by the runner with extra context).
+*/
+function normalizeSdkMessage(msg) {
+	switch (msg.type) {
+		case "assistant": return {
+			type: "assistant_message",
+			message: toApiMessage(msg.message),
+			parentToolUseId: msg.parent_tool_use_id,
+			uuid: msg.uuid
+		};
+		case "user": return {
+			type: "user_message",
+			message: toApiMessage(msg.message),
+			parentToolUseId: msg.parent_tool_use_id,
+			replay: "isReplay" in msg && msg.isReplay === true ? true : void 0,
+			synthetic: msg.isSynthetic === true ? true : void 0,
+			uuid: msg.uuid
+		};
+		case "stream_event": return {
+			type: "stream_delta",
+			event: msg.event,
+			parentToolUseId: msg.parent_tool_use_id,
+			uuid: msg.uuid
+		};
+		case "result": return {
+			type: "turn_result",
+			subtype: msg.subtype,
+			isError: msg.is_error,
+			durationMs: msg.duration_ms,
+			numTurns: msg.num_turns,
+			totalCostUsd: msg.total_cost_usd,
+			result: msg.subtype === "success" ? msg.result : void 0,
+			errors: msg.subtype === "success" ? void 0 : msg.errors,
+			usage: msg.usage
+		};
+		case "rate_limit_event": return {
+			type: "rate_limit",
+			info: {
+				status: msg.rate_limit_info.status,
+				rateLimitType: msg.rate_limit_info.rateLimitType,
+				utilization: msg.rate_limit_info.utilization,
+				resetsAt: msg.rate_limit_info.resetsAt,
+				isUsingOverage: msg.rate_limit_info.isUsingOverage
+			}
+		};
+		case "system":
+			if (msg.subtype === "init" || msg.subtype === "session_state_changed") return null;
+			return {
+				type: "sdk_event",
+				payload: msg
+			};
+		default: return {
+			type: "sdk_event",
+			payload: msg
+		};
+	}
+}
+//#endregion
+//#region src/runner.ts
+const DEFAULT_APPROVAL_TIMEOUT_MS = 3e5;
+/**
+* One live Agent SDK session: owns the query() call, the streaming input queue, the
+* pending-approval table, and a seq-numbered event log that subscribers can replay.
+* No transport — the server (or any host) subscribes and bridges to the wire.
+*/
+var SessionRunner = class {
+	id;
+	createdAt;
+	#config;
+	#events = [];
+	#listeners = /* @__PURE__ */ new Set();
+	#seq = 0;
+	#status = "starting";
+	#statusDetail;
+	#sdkSessionId;
+	#model;
+	#apiKeySource;
+	#permissionMode;
+	#pending = /* @__PURE__ */ new Map();
+	#totalCostUsd;
+	#numTurns;
+	#lastActivityAt;
+	#input = new InputQueue();
+	#query;
+	#capabilitiesEmitted = false;
+	#started = false;
+	#closed = false;
+	#runPromise;
+	constructor(config, id = randomUUID()) {
+		this.#config = config;
+		this.#permissionMode = config.permissionMode;
+		this.id = id;
+		this.createdAt = Date.now();
+	}
+	get status() {
+		return this.#status;
+	}
+	get sdkSessionId() {
+		return this.#sdkSessionId;
+	}
+	get lastSeq() {
+		return this.#seq;
+	}
+	/** 'oauth' = claude.ai subscription credentials; other values are API-key provenance. */
+	get apiKeySource() {
+		return this.#apiKeySource;
+	}
+	get pendingApprovals() {
+		return [...this.#pending.values()].map((p) => p.request);
+	}
+	info() {
+		return {
+			id: this.id,
+			sdkSessionId: this.#sdkSessionId,
+			status: this.#status,
+			cwd: this.#config.cwd,
+			profile: this.#config.profile,
+			engine: "claude",
+			model: this.#model ?? this.#config.model,
+			permissionMode: this.#permissionMode,
+			apiKeySource: this.#apiKeySource,
+			createdAt: this.createdAt,
+			lastSeq: this.#seq,
+			pendingPermissionCount: this.#pending.size,
+			meta: this.#config.meta,
+			title: this.#title(),
+			totalCostUsd: this.#totalCostUsd,
+			numTurns: this.#numTurns,
+			lastActivityAt: this.#lastActivityAt
+		};
+	}
+	#title() {
+		const metaTitle = this.#config.meta?.title;
+		if (typeof metaTitle === "string" && metaTitle.length > 0) return metaTitle;
+		const prompt = this.#config.prompt;
+		if (!prompt) return void 0;
+		return prompt.length > 80 ? prompt.slice(0, 77) + "…" : prompt;
+	}
+	/** Begin the session. Idempotent; returns the run promise (resolves when the query ends). */
+	start() {
+		if (this.#started) return this.#runPromise;
+		this.#started = true;
+		if (this.#config.prompt) this.sendMessage(this.#config.prompt);
+		this.#runPromise = this.#run();
+		return this.#runPromise;
+	}
+	/** Queue a user message for the session (starts the next turn when idle). */
+	sendMessage(text) {
+		if (this.#closed) throw new Error("session is closed");
+		this.#input.push({
+			type: "user",
+			message: {
+				role: "user",
+				content: text
+			},
+			parent_tool_use_id: null,
+			session_id: this.#sdkSessionId
+		});
+		this.#emit({
+			type: "user_message",
+			message: {
+				role: "user",
+				content: text
+			},
+			parentToolUseId: null,
+			uuid: randomUUID()
+		});
+	}
+	/** Resolve a pending permission request. Returns false if the id is unknown (e.g. timed out). */
+	resolvePermission(requestId, decision) {
+		const pending = this.#pending.get(requestId);
+		if (!pending) return false;
+		this.#settleApproval(requestId, pending, decision, "client");
+		return true;
+	}
+	async interrupt() {
+		await this.#query?.interrupt();
+	}
+	async setPermissionMode(mode) {
+		await this.#query?.setPermissionMode(mode);
+		this.#permissionMode = mode;
+		this.#emit({
+			type: "permission_mode_changed",
+			mode
+		});
+	}
+	/** Switch the model for subsequent responses; undefined = back to the default. */
+	async setModel(model) {
+		await this.#query?.setModel(model);
+		this.#model = model;
+		this.#emit({
+			type: "model_changed",
+			model
+		});
+	}
+	/** Emit a session_error and terminate. For host-enforced policy (e.g. requireApiKey). */
+	fail(message) {
+		if (this.#closed) return;
+		this.#emit({
+			type: "session_error",
+			message
+		});
+		this.#setStatus("failed");
+		this.close("error");
+	}
+	/** Terminate the session and the underlying CLI subprocess. */
+	close(reason = "client") {
+		if (this.#closed) return;
+		this.#closed = true;
+		for (const [id, pending] of this.#pending) this.#settleApproval(id, pending, {
+			behavior: "deny",
+			message: "Session closed"
+		}, "policy");
+		this.#input.end();
+		this.#query?.close();
+		this.#emit({
+			type: "session_closed",
+			reason
+		});
+		this.#setStatus("closed");
+	}
+	/**
+	* Replay buffered events with seq > afterSeq, then deliver live events.
+	* Returns an unsubscribe function.
+	*/
+	subscribe(listener, afterSeq = 0) {
+		for (const event of this.#events) if (event.seq > afterSeq) listener(event);
+		this.#listeners.add(listener);
+		return () => this.#listeners.delete(listener);
+	}
+	async #run() {
+		const queryFn = this.#config.queryFn ?? query;
+		try {
+			await this.#backfillHistory();
+			if (this.#closed) return;
+			this.#query = queryFn({
+				prompt: this.#input,
+				options: this.#buildOptions()
+			});
+			if (!this.#config.prompt) {
+				this.#setStatus("idle");
+				this.#fetchCapabilities();
+				this.#fetchContextUsage();
+			}
+			for await (const message of this.#query) this.#handleMessage(message);
+			if (!this.#closed) {
+				this.#closed = true;
+				this.#input.end();
+				this.#emit({
+					type: "session_closed",
+					reason: "server"
+				});
+				this.#setStatus("closed");
+			}
+		} catch (error) {
+			if (!this.#closed) {
+				this.#emit({
+					type: "session_error",
+					message: error instanceof Error ? error.message : String(error)
+				});
+				this.#setStatus("failed");
+				this.close("error");
+			}
+		}
+	}
+	/**
+	* On resume, emit the prior session's transcript as replay events (seq'd before any
+	* live event). The SDK only re-streams *user* messages on resume; assistant history
+	* would otherwise be lost to clients attaching after a server restart. Duplicated
+	* user messages are deduped client-side by uuid.
+	*/
+	async #backfillHistory() {
+		const c = this.#config;
+		if (!c.resume || c.backfillHistory === false) return;
+		const historyFn = c.historyFn ?? ((sessionId, options) => getSessionMessages(sessionId, options));
+		let messages;
+		try {
+			messages = await historyFn(c.resume, { dir: c.cwd });
+		} catch {
+			return;
+		}
+		for (const m of messages) {
+			if (this.#closed) return;
+			if (m.type === "user") this.#emit({
+				type: "user_message",
+				message: toApiMessage(m.message),
+				parentToolUseId: m.parent_tool_use_id,
+				replay: true,
+				uuid: m.uuid
+			});
+			else if (m.type === "assistant") this.#emit({
+				type: "assistant_message",
+				message: toApiMessage(m.message),
+				parentToolUseId: m.parent_tool_use_id,
+				replay: true,
+				uuid: m.uuid
+			});
+		}
+	}
+	#buildOptions() {
+		const c = this.#config;
+		return {
+			cwd: c.cwd,
+			permissionMode: c.permissionMode,
+			allowedTools: c.allowedTools,
+			disallowedTools: c.disallowedTools,
+			mcpServers: c.mcpServers,
+			settingSources: c.settingSources,
+			model: c.model,
+			maxTurns: c.maxTurns,
+			maxBudgetUsd: c.maxBudgetUsd,
+			resume: c.resume,
+			forkSession: c.forkSession,
+			includePartialMessages: c.includePartialMessages ?? true,
+			canUseTool: this.#canUseTool,
+			env: c.env,
+			pathToClaudeCodeExecutable: c.pathToClaudeCodeExecutable,
+			...c.permissionMode === "bypassPermissions" || c.allowDangerouslySkipPermissions ? { allowDangerouslySkipPermissions: true } : {},
+			...c.extraOptions
+		};
+	}
+	#handleMessage(msg) {
+		if (msg.type === "system" && msg.subtype === "init") {
+			this.#sdkSessionId = msg.session_id;
+			this.#model = msg.model;
+			this.#permissionMode = msg.permissionMode;
+			this.#apiKeySource = msg.apiKeySource;
+			this.#emit({
+				type: "system_init",
+				sdkSessionId: msg.session_id,
+				model: msg.model,
+				cwd: msg.cwd,
+				apiKeySource: msg.apiKeySource,
+				tools: msg.tools,
+				skills: msg.skills,
+				slashCommands: msg.slash_commands,
+				permissionMode: msg.permissionMode,
+				claudeCodeVersion: msg.claude_code_version,
+				mcpServers: msg.mcp_servers
+			});
+			this.#setStatus("running");
+			this.#fetchCapabilities();
+			this.#fetchContextUsage();
+			return;
+		}
+		if (msg.type === "system" && msg.subtype === "session_state_changed") {
+			if (this.#pending.size > 0) return;
+			if (msg.state === "idle") this.#setStatus("idle");
+			else if (msg.state === "running") this.#setStatus("running");
+			return;
+		}
+		const body = normalizeSdkMessage(msg);
+		if (body) {
+			this.#emit(body);
+			if (body.type === "turn_result") {
+				this.#totalCostUsd = body.totalCostUsd;
+				this.#numTurns = body.numTurns;
+				if (this.#pending.size === 0) this.#setStatus("idle");
+				this.#fetchContextUsage();
+			}
+		}
+	}
+	/** Ask the CLI what models/commands it supports and surface them as an event
+	* (replayed to late attachers). Called eagerly for promptless sessions and again
+	* on init — the flag keeps it a single emit. Optional-chained: injected fake
+	* queries in tests may not implement these, and a failure must not affect the
+	* session. */
+	async #fetchCapabilities() {
+		if (this.#capabilitiesEmitted) return;
+		const query = this.#query;
+		if (typeof query?.supportedModels !== "function" || typeof query.supportedCommands !== "function") return;
+		try {
+			const [models, commands] = await Promise.all([query.supportedModels(), query.supportedCommands()]);
+			if (this.#closed || this.#capabilitiesEmitted) return;
+			this.#capabilitiesEmitted = true;
+			this.#emit({
+				type: "capabilities",
+				models: models.map((m) => ({
+					value: m.value,
+					displayName: m.displayName,
+					description: m.description
+				})),
+				commands: commands.map((c) => ({
+					name: c.name,
+					description: c.description,
+					argumentHint: c.argumentHint,
+					aliases: c.aliases
+				}))
+			});
+		} catch {}
+	}
+	/** Snapshot the context window after a turn and surface it as an event. Optional-chained
+	* and best-effort for the same reasons as #fetchCapabilities. */
+	async #fetchContextUsage() {
+		const query = this.#query;
+		if (typeof query?.getContextUsage !== "function") return;
+		try {
+			const usage = await query.getContextUsage();
+			if (this.#closed) return;
+			this.#emit({
+				type: "context_usage",
+				usage: {
+					categories: usage.categories.map((c) => ({
+						name: c.name,
+						tokens: c.tokens,
+						color: c.color
+					})),
+					totalTokens: usage.totalTokens,
+					maxTokens: usage.maxTokens,
+					percentage: usage.percentage,
+					model: usage.model
+				}
+			});
+		} catch {}
+	}
+	#canUseTool = (toolName, input, options) => {
+		const id = randomUUID();
+		const timeoutMs = this.#config.approvalTimeoutMs ?? this.#config.defaultApprovalTimeoutMs ?? DEFAULT_APPROVAL_TIMEOUT_MS;
+		const request = {
+			id,
+			toolName,
+			input,
+			toolUseId: options.toolUseID,
+			title: options.title,
+			displayName: options.displayName,
+			description: options.description,
+			decisionReason: options.decisionReason,
+			agentId: options.agentID,
+			expiresAt: Date.now() + timeoutMs
+		};
+		const questionBehavior = this.#config.questionBehavior ?? "ask";
+		if (toolName === "AskUserQuestion" && questionBehavior !== "ask") {
+			delete request.expiresAt;
+			return Promise.resolve(this.#resolveQuestionByPolicy(request, questionBehavior));
+		}
+		return new Promise((resolve) => {
+			const timer = setTimeout(() => {
+				const pending = this.#pending.get(id);
+				if (pending) this.#settleApproval(id, pending, {
+					behavior: "deny",
+					message: "Approval timed out"
+				}, "timeout");
+			}, timeoutMs);
+			this.#pending.set(id, {
+				request,
+				resolve,
+				timer
+			});
+			options.signal.addEventListener("abort", () => {
+				const pending = this.#pending.get(id);
+				if (pending) this.#settleApproval(id, pending, {
+					behavior: "deny",
+					message: "Turn aborted"
+				}, "policy");
+			});
+			this.#emit({
+				type: "permission_requested",
+				request
+			});
+			this.#setStatus("awaiting_approval");
+		});
+	};
+	/** 'auto'/'deny' sessions settle AskUserQuestion synchronously instead of pending:
+	* 'auto' picks each question's first (recommended) option, 'deny' sends the model
+	* back to decide for itself. Request/resolved events still fire so transcripts and
+	* job webhooks show what was chosen. */
+	#resolveQuestionByPolicy(request, mode) {
+		this.#emit({
+			type: "permission_requested",
+			request
+		});
+		if (mode === "deny") {
+			const message = "Interactive questions are disabled for this session — choose the most reasonable option yourself and continue.";
+			this.#emit({
+				type: "permission_resolved",
+				requestId: request.id,
+				behavior: "deny",
+				resolvedBy: "policy",
+				message
+			});
+			return {
+				behavior: "deny",
+				message,
+				toolUseID: request.toolUseId
+			};
+		}
+		this.#emit({
+			type: "permission_resolved",
+			requestId: request.id,
+			behavior: "allow",
+			resolvedBy: "policy"
+		});
+		return {
+			behavior: "allow",
+			updatedInput: {
+				...request.input,
+				answers: recommendedAnswers(request.input)
+			},
+			toolUseID: request.toolUseId
+		};
+	}
+	#settleApproval(id, pending, decision, resolvedBy) {
+		clearTimeout(pending.timer);
+		this.#pending.delete(id);
+		if (decision.behavior === "allow") pending.resolve({
+			behavior: "allow",
+			updatedInput: decision.updatedInput ?? pending.request.input,
+			toolUseID: pending.request.toolUseId
+		});
+		else pending.resolve({
+			behavior: "deny",
+			message: decision.message ?? "Denied",
+			interrupt: decision.interrupt,
+			toolUseID: pending.request.toolUseId
+		});
+		this.#emit({
+			type: "permission_resolved",
+			requestId: id,
+			behavior: decision.behavior,
+			resolvedBy,
+			message: decision.behavior === "deny" ? decision.message ?? "Denied" : void 0
+		});
+		if (this.#pending.size === 0 && this.#status === "awaiting_approval") this.#setStatus("running");
+	}
+	#setStatus(status, detail) {
+		if (this.#status === status && this.#statusDetail === detail) return;
+		if (this.#status === "closed" || this.#status === "failed") return;
+		this.#status = status;
+		this.#statusDetail = detail;
+		this.#emit({
+			type: "status_changed",
+			status,
+			detail
+		});
+	}
+	#emit(body) {
+		const event = {
+			...body,
+			seq: ++this.#seq,
+			ts: Date.now()
+		};
+		this.#lastActivityAt = event.ts;
+		this.#events.push(event);
+		for (const listener of this.#listeners) try {
+			listener(event);
+		} catch {}
+	}
+};
+/** Answer each AskUserQuestion question with its first option's label — the tool's
+* convention puts the recommended choice first. Keyed by question text, the shape the
+* CLI expects back in `updatedInput.answers`. */
+function recommendedAnswers(input) {
+	const answers = {};
+	const questions = Array.isArray(input.questions) ? input.questions : [];
+	for (const entry of questions) {
+		const q = entry;
+		if (typeof q.question !== "string" || !Array.isArray(q.options)) continue;
+		const first = q.options[0];
+		if (typeof first?.label === "string") answers[q.question] = first.label;
+	}
+	return answers;
+}
+//#endregion
+//#region src/ai-sdk-runner.ts
+/** Permission modes this engine can honor. The rest of the protocol vocabulary
+* (acceptEdits/plan/auto) is Claude Code CLI semantics with no meaning here —
+* setPermissionMode rejects them, which the server surfaces as protocol_error. */
+const SUPPORTED_PERMISSION_MODES = [
+	"default",
+	"bypassPermissions",
+	"dontAsk"
+];
+/**
+* Model-agnostic runner over the AI SDK v7 ToolLoopAgent. The session's durable
+* state is its ModelMessage history: every turn — including continuation after an
+* externally-executed tool call — is a fresh streamed call over that history
+* (message-state replay; the loop cannot be suspended). Output is emitted as it
+* happens: `stream_delta` per token (unless includePartialMessages is false) and
+* assistant/tool messages per step. Emits the same seq-numbered SessionEvent log
+* as SessionRunner; engine-specific CLI telemetry (system_init, capabilities,
+* rate_limit, ...) is simply never emitted.
+*/
+var AiSdkRunner = class {
+	id;
+	createdAt;
+	#config;
+	#model;
+	#events = [];
+	#listeners = /* @__PURE__ */ new Set();
+	#seq = 0;
+	#status = "starting";
+	#permissionMode;
+	#messages = [];
+	#pendingToolCalls = /* @__PURE__ */ new Map();
+	/** Calls already handed to the executor, so a re-park never double-dispatches. */
+	#dispatched = /* @__PURE__ */ new Set();
+	#turnChain = Promise.resolve();
+	#abort;
+	/** Accumulates across every leg of one turn. A turn that parks on external
+	* tool calls spans several generate() calls; usage and elapsed time must
+	* cover all of them, not just the leg that happens to finish. */
+	#turnAccum;
+	#numTurns = 0;
+	#totalUsage = {
+		input: 0,
+		output: 0,
+		cacheWrite: 0,
+		cacheRead: 0
+	};
+	#lastActivityAt;
+	#started = false;
+	#closed = false;
+	/** Parked: state has been snapshotted and this instance is inert. Not closed —
+	* the session lives on in the snapshot and resumes as a new instance. */
+	#parked = false;
+	/** Model alias as requested (not the resolved provider id) — what set_model was
+	* given, so a rehydrated session can re-resolve the same choice. */
+	#modelAlias;
+	constructor(config, id = randomUUID()) {
+		const mode = config.permissionMode ?? "default";
+		if (!SUPPORTED_PERMISSION_MODES.includes(mode)) throw new Error(`permission mode '${mode}' is not supported by the AI SDK engine`);
+		this.#config = config;
+		this.#model = config.languageModel;
+		this.#permissionMode = mode;
+		this.#modelAlias = config.model;
+		this.id = config.restore?.id ?? id;
+		this.createdAt = config.restore?.createdAt ?? Date.now();
+		if (config.restore) this.#restore(config.restore);
+	}
+	/** Adopt a parked session's state. The event log and seq counter come back
+	* verbatim: a client reattaching with `afterSeq` must see one unbroken stream
+	* across the teardown, not a second session that restarts at 1. */
+	#restore(snapshot) {
+		if (snapshot.engine !== "provider") throw new Error(`cannot restore a '${snapshot.engine}' snapshot into the AI SDK engine`);
+		const state = snapshot.state;
+		if (!state || !Array.isArray(state.messages)) throw new Error("session snapshot is missing its provider-engine state");
+		this.#seq = snapshot.seq;
+		this.#events = [...snapshot.events];
+		this.#messages = [...state.messages];
+		for (const call of state.pendingToolCalls) this.#pendingToolCalls.set(call.toolCallId, call);
+		this.#dispatched = new Set(state.dispatched);
+		this.#numTurns = state.numTurns;
+		this.#totalUsage = { ...state.totalUsage };
+		this.#turnAccum = state.turnAccum ? { ...state.turnAccum } : void 0;
+		if (this.#turnAccum && state.parkedAt !== void 0) this.#turnAccum.startedAt += Date.now() - state.parkedAt;
+		this.#permissionMode = state.permissionMode;
+		this.#lastActivityAt = state.lastActivityAt;
+		this.#status = this.#pendingToolCalls.size > 0 ? "parked" : "idle";
+		if (state.model !== void 0 && state.model !== this.#modelAlias && this.#config.resolveModel) {
+			this.#modelAlias = state.model;
+			this.#model = this.#config.resolveModel(state.model);
+		}
+	}
+	get status() {
+		return this.#status;
+	}
+	get lastSeq() {
+		return this.#seq;
+	}
+	/** The session's durable state — persist to park, replay to rehydrate. */
+	get messages() {
+		return [...this.#messages];
+	}
+	/** External tool calls the loop is currently parked on. */
+	get pendingToolCalls() {
+		return [...this.#pendingToolCalls.values()];
+	}
+	get pendingApprovals() {
+		return [];
+	}
+	/** The session's scratch filesystem (see Runner.vfs) — the server's file
+	* routes serve deliverables straight from it. */
+	get vfs() {
+		return this.#config.vfs;
+	}
+	info() {
+		return {
+			id: this.id,
+			status: this.#status,
+			cwd: this.#config.cwd ?? process.cwd(),
+			profile: this.#config.profile,
+			engine: "provider",
+			model: this.#modelId(),
+			permissionMode: this.#permissionMode,
+			createdAt: this.createdAt,
+			lastSeq: this.#seq,
+			pendingPermissionCount: 0,
+			meta: this.#config.meta,
+			title: this.#title(),
+			numTurns: this.#numTurns || void 0,
+			lastActivityAt: this.#lastActivityAt
+		};
+	}
+	start() {
+		if (this.#started) return this.#turnChain;
+		this.#started = true;
+		if (this.#config.restore) {
+			if (this.#pendingToolCalls.size === 0) this.#scheduleTurn();
+			return this.#turnChain;
+		}
+		this.#setStatus("idle");
+		if (this.#config.prompt) this.sendMessage(this.#config.prompt);
+		return this.#turnChain;
+	}
+	/**
+	* Snapshot durable state, release engine resources, and go inert — the session
+	* continues in the snapshot, not in this object. Returns undefined when parking
+	* would lose work or has nothing to wait for: a turn in flight, no parked call,
+	* or an already-closed/parked runner.
+	*/
+	park() {
+		if (this.#closed || this.#parked) return void 0;
+		if (this.#abort || !this.#restingOnDeferred()) return void 0;
+		this.#setStatus("parked");
+		const parked = [...this.#pendingToolCalls.values()].map((call) => ({
+			executionId: call.toolCallId,
+			toolName: call.toolName,
+			expiresAt: call.expiresAt
+		}));
+		const state = {
+			messages: this.#messages,
+			pendingToolCalls: [...this.#pendingToolCalls.values()],
+			dispatched: [...this.#dispatched],
+			numTurns: this.#numTurns,
+			totalUsage: { ...this.#totalUsage },
+			turnAccum: this.#turnAccum ? { ...this.#turnAccum } : void 0,
+			permissionMode: this.#permissionMode,
+			model: this.#modelAlias,
+			lastActivityAt: this.#lastActivityAt,
+			parkedAt: Date.now()
+		};
+		const snapshot = {
+			engine: "provider",
+			id: this.id,
+			createdAt: this.createdAt,
+			seq: this.#seq,
+			events: [...this.#events],
+			vfs: this.#config.vfs?.snapshot(),
+			parked,
+			state
+		};
+		this.#parked = true;
+		this.#listeners.clear();
+		try {
+			Promise.resolve(this.#config.onClose?.()).catch(() => {});
+		} catch {}
+		return snapshot;
+	}
+	sendMessage(text) {
+		if (this.#parked) throw new Error("session is parked");
+		if (this.#closed) throw new Error("session is closed");
+		this.#messages.push({
+			role: "user",
+			content: text
+		});
+		this.#emit({
+			type: "user_message",
+			message: {
+				role: "user",
+				content: text
+			},
+			parentToolUseId: null,
+			uuid: randomUUID()
+		});
+		this.#scheduleTurn();
+	}
+	/**
+	* Deliver the result of an external (execute-less) tool call. Appends the
+	* tool-result message and, once no calls remain pending, re-enters the loop.
+	* Idempotent per toolCallId: unknown/already-settled ids return false.
+	*/
+	resolveToolCall(toolCallId, output, options) {
+		if (!this.#settlePendingCall(toolCallId, output, options?.isError === true)) return false;
+		if (this.#pendingToolCalls.size === 0) this.#scheduleTurn();
+		return true;
+	}
+	/** Record a parked call's outcome into the message history (so it stays
+	* replayable — a dangling tool call without a result is invalid input for
+	* providers) and the event log. Does NOT re-enter the loop. */
+	#settlePendingCall(toolCallId, output, isError) {
+		const pending = this.#pendingToolCalls.get(toolCallId);
+		if (!pending || this.#closed || this.#parked) return false;
+		this.#pendingToolCalls.delete(toolCallId);
+		let insertAt = this.#messages.length;
+		while (insertAt > 0 && this.#messages[insertAt - 1].role === "user") insertAt--;
+		this.#messages.splice(insertAt, 0, {
+			role: "tool",
+			content: [{
+				type: "tool-result",
+				toolCallId,
+				toolName: pending.toolName,
+				output: isError ? {
+					type: "error-text",
+					value: textValue(output)
+				} : output
+			}]
+		});
+		this.#emit({
+			type: "user_message",
+			message: {
+				role: "user",
+				content: [{
+					type: "tool_result",
+					tool_use_id: toolCallId,
+					content: textValue(output),
+					is_error: isError || void 0
+				}]
+			},
+			parentToolUseId: null,
+			synthetic: true,
+			uuid: randomUUID()
+		});
+		return true;
+	}
+	resolvePermission(_requestId, _decision) {
+		return false;
+	}
+	/** Emit `file_delivered` — the deliver_file tool's hand-over event (wired by
+	* createEngineSession via ToolContextOptions.onFileDelivered). */
+	emitFileDelivered(file) {
+		if (this.#closed || this.#parked) return;
+		this.#emit({
+			type: "file_delivered",
+			...file
+		});
+	}
+	/**
+	* One plain generateText over the session's current model, billed into the
+	* running turn's usage accumulator — the web_fetch digest pass uses this so
+	* its tokens are never lost from the turn's accounting.
+	*/
+	async generateDigest(prompt) {
+		const result = await generateText({
+			model: this.#model,
+			prompt,
+			abortSignal: this.#abort?.signal
+		});
+		const accum = this.#turnAccum;
+		if (accum) {
+			accum.input += result.usage.inputTokens ?? 0;
+			accum.output += result.usage.outputTokens ?? 0;
+			accum.cacheWrite += result.usage.inputTokenDetails?.cacheWriteTokens ?? 0;
+			accum.cacheRead += result.usage.inputTokenDetails?.cacheReadTokens ?? 0;
+		}
+		return result.text;
+	}
+	async interrupt() {
+		if (this.#abort) this.#abort.abort();
+		else if (this.#pendingToolCalls.size > 0) {
+			const accum = this.#turnAccum ?? {
+				startedAt: Date.now(),
+				input: 0,
+				output: 0,
+				cacheWrite: 0,
+				cacheRead: 0
+			};
+			for (const call of Array.from(this.#pendingToolCalls.values())) this.#settlePendingCall(call.toolCallId, {
+				type: "text",
+				value: "interrupted"
+			}, true);
+			this.#dispatched.clear();
+			this.#numTurns += 1;
+			this.#emit({
+				type: "turn_result",
+				subtype: "error_during_execution",
+				isError: true,
+				durationMs: Date.now() - accum.startedAt,
+				numTurns: this.#numTurns,
+				totalCostUsd: 0,
+				errors: ["interrupted"],
+				usage: turnUsage(accum)
+			});
+			this.#turnAccum = void 0;
+			this.#setStatus("idle");
+		}
+		await this.#turnChain;
+	}
+	async setPermissionMode(mode) {
+		if (!SUPPORTED_PERMISSION_MODES.includes(mode)) throw new Error(`permission mode '${mode}' is not supported by the AI SDK engine`);
+		this.#permissionMode = mode;
+		this.#emit({
+			type: "permission_mode_changed",
+			mode
+		});
+	}
+	async setModel(model) {
+		const resolve = this.#config.resolveModel;
+		if (!resolve) throw new Error("set_model is not supported by this session");
+		this.#model = resolve(model);
+		this.#modelAlias = model;
+		this.#emit({
+			type: "model_changed",
+			model
+		});
+	}
+	fail(message) {
+		if (this.#closed) return;
+		this.#emit({
+			type: "session_error",
+			message
+		});
+		this.#setStatus("failed");
+		this.close("error");
+	}
+	close(reason = "client") {
+		if (this.#closed || this.#parked) return;
+		this.#closed = true;
+		this.#abort?.abort();
+		this.#pendingToolCalls.clear();
+		this.#dispatched.clear();
+		this.#emit({
+			type: "session_closed",
+			reason
+		});
+		this.#setStatus("closed");
+		try {
+			Promise.resolve(this.#config.onClose?.()).catch(() => {});
+		} catch {}
+	}
+	subscribe(listener, afterSeq = 0) {
+		for (const event of this.#events) if (event.seq > afterSeq) listener(event);
+		this.#listeners.add(listener);
+		return () => this.#listeners.delete(listener);
+	}
+	#scheduleTurn() {
+		this.#turnChain = this.#turnChain.then(() => this.#runTurn());
+	}
+	/**
+	* Deliver the result of an execution this runner dispatched. Used by the host
+	* when a backend settled out-of-band (a browser bridge answering later, a
+	* deferred executor). Idempotent by executionId.
+	*/
+	settleExecution(executionId, result) {
+		if (this.#closed || this.#parked) return false;
+		if (!this.#pendingToolCalls.has(executionId)) return false;
+		this.#applyExecutionResult(executionId, result);
+		return true;
+	}
+	/** Hand every parked call the executor owns to it. */
+	#dispatchPending() {
+		const executor = this.#config.executor;
+		if (!executor) return;
+		const executable = this.#config.executableTools;
+		const inFlight = [];
+		let anyDeferred = false;
+		for (const call of Array.from(this.#pendingToolCalls.values())) {
+			if (executable && !executable.includes(call.toolName)) continue;
+			if (this.#dispatched.has(call.toolCallId)) continue;
+			this.#dispatched.add(call.toolCallId);
+			const toolCall = {
+				executionId: call.toolCallId,
+				sessionId: this.id,
+				tool: call.toolName,
+				input: call.input,
+				vfs: this.#config.vfs,
+				limits: this.#config.executionLimits,
+				signal: this.#abort?.signal
+			};
+			const profile = executor.describe?.(toolCall) ?? {};
+			call.deferred = profile.deferred === true ? true : void 0;
+			call.expiresAt = profile.timeoutMs === void 0 ? void 0 : Date.now() + profile.timeoutMs;
+			anyDeferred ||= call.deferred === true;
+			this.#emit({
+				type: "execution_dispatched",
+				executionId: call.toolCallId,
+				toolName: call.toolName,
+				backend: profile.backend ?? this.#config.executionBackend ?? "server",
+				deferred: call.deferred,
+				expiresAt: call.expiresAt
+			});
+			inFlight.push(executor.dispatch(toolCall).then((dispatch) => {
+				if (dispatch.status === "settled") this.#applyExecutionResult(call.toolCallId, dispatch.result);
+			}).catch((error) => {
+				this.#applyExecutionResult(call.toolCallId, {
+					status: "failed",
+					reason: "dispatch_error",
+					error: error instanceof Error ? error.message : String(error)
+				});
+			}));
+		}
+		if (anyDeferred) Promise.allSettled(inFlight).then(() => this.#announceParked());
+	}
+	/**
+	* The turn has come to rest on deferred executions: nothing is in flight, and
+	* only a host-delivered result can move it. `status_changed: 'parked'` is the
+	* host's cue to snapshot via {@link park} — a single, correctly-timed signal
+	* rather than an inference from individual dispatch events.
+	*/
+	#announceParked() {
+		if (this.#closed || this.#parked || this.#abort) return;
+		if (this.#restingOnDeferred()) this.#setStatus("parked");
+	}
+	/** The loop is waiting, and everything it waits on can only be answered from
+	* outside this process. One still-live in-process execution means a result is
+	* coming back to THIS runner, and tearing it down would strand it. */
+	#restingOnDeferred() {
+		if (this.#pendingToolCalls.size === 0) return false;
+		for (const call of this.#pendingToolCalls.values()) if (call.deferred !== true) return false;
+		return true;
+	}
+	/** Fold an execution's outcome back into the loop, whichever way it went. */
+	#applyExecutionResult(executionId, result) {
+		if (this.#closed || this.#parked) return;
+		this.#dispatched.delete(executionId);
+		if (result.status === "ok") {
+			this.#emit({
+				type: "execution_result",
+				executionId,
+				output: {
+					type: "json",
+					value: result.output
+				},
+				logs: result.logs
+			});
+			this.resolveToolCall(executionId, {
+				type: "json",
+				value: result.output
+			});
+			return;
+		}
+		this.#emit({
+			type: "execution_failed",
+			executionId,
+			reason: result.reason,
+			error: result.error,
+			logs: result.logs
+		});
+		this.resolveToolCall(executionId, {
+			type: "text",
+			value: `${result.reason}: ${result.error}`
+		}, { isError: true });
+	}
+	async #runTurn() {
+		if (this.#closed || this.#parked || this.#pendingToolCalls.size > 0) return;
+		if (this.#messages.at(-1)?.role === "assistant") return;
+		this.#setStatus("running");
+		const agent = new ToolLoopAgent({
+			model: this.#model,
+			tools: this.#config.tools ?? {},
+			instructions: this.#config.instructions,
+			stopWhen: isStepCount(this.#config.maxSteps ?? 20)
+		});
+		const abort = new AbortController();
+		this.#abort = abort;
+		const accum = this.#turnAccum ??= {
+			startedAt: Date.now(),
+			input: 0,
+			output: 0,
+			cacheWrite: 0,
+			cacheRead: 0
+		};
+		try {
+			const result = await agent.stream({
+				messages: [...this.#messages],
+				abortSignal: abort.signal
+			});
+			const partials = this.#config.includePartialMessages !== false;
+			let blocks = [];
+			const textBuf = /* @__PURE__ */ new Map();
+			const reasoningBuf = /* @__PURE__ */ new Map();
+			const flush = () => {
+				if (blocks.length === 0) return;
+				this.#emit({
+					type: "assistant_message",
+					message: {
+						role: "assistant",
+						content: blocks,
+						model: this.#modelId()
+					},
+					parentToolUseId: null,
+					uuid: randomUUID()
+				});
+				blocks = [];
+			};
+			const emitToolResult = (toolCallId, content, isError) => {
+				flush();
+				this.#emit({
+					type: "user_message",
+					message: {
+						role: "user",
+						content: [{
+							type: "tool_result",
+							tool_use_id: toolCallId,
+							content,
+							is_error: isError
+						}]
+					},
+					parentToolUseId: null,
+					synthetic: true,
+					uuid: randomUUID()
+				});
+			};
+			let streamError;
+			for await (const part of result.fullStream) {
+				if (this.#closed) break;
+				switch (part.type) {
+					case "text-delta":
+						textBuf.set(part.id, (textBuf.get(part.id) ?? "") + part.text);
+						if (partials) this.#emit({
+							type: "stream_delta",
+							event: {
+								type: "content_block_delta",
+								delta: {
+									type: "text_delta",
+									text: part.text
+								}
+							},
+							parentToolUseId: null,
+							uuid: randomUUID()
+						});
+						break;
+					case "text-end": {
+						const text = textBuf.get(part.id);
+						textBuf.delete(part.id);
+						if (text) blocks.push({
+							type: "text",
+							text
+						});
+						break;
+					}
+					case "reasoning-delta":
+						reasoningBuf.set(part.id, (reasoningBuf.get(part.id) ?? "") + part.text);
+						if (partials) this.#emit({
+							type: "stream_delta",
+							event: {
+								type: "content_block_delta",
+								delta: {
+									type: "thinking_delta",
+									thinking: part.text
+								}
+							},
+							parentToolUseId: null,
+							uuid: randomUUID()
+						});
+						break;
+					case "reasoning-end": {
+						const thinking = reasoningBuf.get(part.id);
+						reasoningBuf.delete(part.id);
+						if (thinking) blocks.push({
+							type: "thinking",
+							thinking
+						});
+						break;
+					}
+					case "tool-call":
+						blocks.push({
+							type: "tool_use",
+							id: part.toolCallId,
+							name: part.toolName,
+							input: part.input
+						});
+						flush();
+						break;
+					case "tool-result":
+						emitToolResult(part.toolCallId, typeof part.output === "string" ? part.output : JSON.stringify(part.output));
+						break;
+					case "tool-error":
+						emitToolResult(part.toolCallId, errorText(part.error), true);
+						break;
+					case "finish-step":
+						flush();
+						break;
+					case "error":
+						streamError ??= part.error;
+						break;
+					default: break;
+				}
+			}
+			flush();
+			if (streamError !== void 0) throw streamError;
+			if (abort.signal.aborted) throw new Error("interrupted");
+			const [responseMessages, usage, toolCalls, text] = await Promise.all([
+				result.responseMessages,
+				result.totalUsage,
+				result.toolCalls,
+				result.text
+			]);
+			if (this.#closed) return;
+			accum.input += usage.inputTokens ?? 0;
+			accum.output += usage.outputTokens ?? 0;
+			accum.cacheWrite += usage.inputTokenDetails?.cacheWriteTokens ?? 0;
+			accum.cacheRead += usage.inputTokenDetails?.cacheReadTokens ?? 0;
+			this.#messages.push(...responseMessages);
+			const settled = /* @__PURE__ */ new Set();
+			for (const message of responseMessages) {
+				if (message.role !== "tool" || !Array.isArray(message.content)) continue;
+				for (const part of message.content) if (part.type === "tool-result") settled.add(part.toolCallId);
+			}
+			for (const call of toolCalls) {
+				if (settled.has(call.toolCallId)) continue;
+				this.#pendingToolCalls.set(call.toolCallId, {
+					toolCallId: call.toolCallId,
+					toolName: call.toolName,
+					input: call.input
+				});
+			}
+			if (this.#pendingToolCalls.size > 0) {
+				this.#dispatchPending();
+				return;
+			}
+			this.#finishTurn(text);
+		} catch (error) {
+			if (this.#closed) return;
+			const message = error instanceof Error ? error.message : String(error);
+			this.#numTurns += 1;
+			this.#emit({
+				type: "turn_result",
+				subtype: "error_during_execution",
+				isError: true,
+				durationMs: Date.now() - accum.startedAt,
+				numTurns: this.#numTurns,
+				totalCostUsd: 0,
+				errors: [abort.signal.aborted ? "interrupted" : message],
+				usage: turnUsage(accum)
+			});
+			this.#turnAccum = void 0;
+			this.#setStatus("idle");
+		} finally {
+			if (this.#abort === abort) this.#abort = void 0;
+		}
+	}
+	/** Emit the turn's result from the whole-turn accumulator, so a turn that
+	* parked on external tool calls reports every leg's tokens and the full
+	* elapsed time (including the time spent executing those tools). */
+	#finishTurn(text) {
+		const accum = this.#turnAccum ?? {
+			startedAt: Date.now(),
+			input: 0,
+			output: 0,
+			cacheWrite: 0,
+			cacheRead: 0
+		};
+		this.#numTurns += 1;
+		this.#totalUsage.input += accum.input;
+		this.#totalUsage.output += accum.output;
+		this.#totalUsage.cacheWrite += accum.cacheWrite;
+		this.#totalUsage.cacheRead += accum.cacheRead;
+		this.#emit({
+			type: "turn_result",
+			subtype: "success",
+			isError: false,
+			durationMs: Date.now() - accum.startedAt,
+			numTurns: this.#numTurns,
+			totalCostUsd: 0,
+			result: text,
+			usage: turnUsage(accum)
+		});
+		this.#turnAccum = void 0;
+		this.#setStatus("idle");
+	}
+	#modelId() {
+		const model = this.#model;
+		if (typeof model === "string") return model;
+		return model.modelId;
+	}
+	#title() {
+		const metaTitle = this.#config.meta?.title;
+		if (typeof metaTitle === "string" && metaTitle.length > 0) return metaTitle;
+		const prompt = this.#config.prompt;
+		if (!prompt) return void 0;
+		return prompt.length > 80 ? prompt.slice(0, 77) + "…" : prompt;
+	}
+	#setStatus(status, detail) {
+		if (this.#status === status) return;
+		if (this.#status === "closed" || this.#status === "failed") return;
+		this.#status = status;
+		this.#emit({
+			type: "status_changed",
+			status,
+			detail
+		});
+	}
+	#emit(body) {
+		const event = {
+			...body,
+			seq: ++this.#seq,
+			ts: Date.now()
+		};
+		this.#lastActivityAt = event.ts;
+		this.#events.push(event);
+		for (const listener of this.#listeners) try {
+			listener(event);
+		} catch {}
+	}
+};
+function turnUsage(accum) {
+	return {
+		input_tokens: accum.input,
+		output_tokens: accum.output,
+		cache_creation_input_tokens: accum.cacheWrite,
+		cache_read_input_tokens: accum.cacheRead
+	};
+}
+function textValue(output) {
+	return output.type === "text" ? output.value : JSON.stringify(output.value);
+}
+function errorText(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/claude-auth.ts
+/**
+* The native Claude Code binary the Agent SDK itself spawns, resolved the way
+* the SDK resolves it: the platform-specific optional dependency installed next
+* to the SDK package (`@anthropic-ai/claude-agent-sdk-<platform>-<arch>/claude`).
+* Probing this binary rather than whatever `claude` is on PATH means an auth
+* check answers for the executable sessions will actually run — the two can be
+* different versions logged into different places. Returns undefined when it
+* can't be found (optional dep skipped, unsupported platform); callers degrade
+* to 'unknown', and the SDK surfaces its own error if a session is created.
+*/
+function resolveBundledClaudeExecutable() {
+	try {
+		const fromSdk = createRequire(createRequire(import.meta.url).resolve("@anthropic-ai/claude-agent-sdk"));
+		const suffix = process.platform === "win32" ? ".exe" : "";
+		const platforms = process.platform === "linux" ? [`linux-${process.arch}`, `linux-${process.arch}-musl`] : [`${process.platform}-${process.arch}`];
+		for (const platform of platforms) try {
+			const path = fromSdk.resolve(`@anthropic-ai/claude-agent-sdk-${platform}/claude${suffix}`);
+			if (existsSync(path)) return path;
+		} catch {}
+	} catch {}
+}
+/**
+* Ask the CLI whether `env` holds usable credentials: `claude auth status`
+* prints a JSON verdict covering every source the CLI itself consults for that
+* environment — `<CLAUDE_CONFIG_DIR>/.credentials.json`, the macOS login
+* Keychain, ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, Bedrock/Vertex
+* (verified against 2.1.217). Only the `loggedIn` boolean is ever read; the
+* identity fields in the payload (email, org, subscription) never leave the
+* parse. The exit code is deliberately ignored — 2.1.217 exits 1 on a
+* logged-out verdict where other versions exit 0 — and anything that doesn't
+* parse to a `loggedIn` boolean is 'unknown', because `auth status` is not a
+* stable contract. Never rejects.
+*/
+function checkClaudeAuth(env, options = {}) {
+	const executable = options.executable ?? resolveBundledClaudeExecutable();
+	if (!executable) return Promise.resolve("unknown");
+	return new Promise((resolve) => {
+		execFile(executable, ["auth", "status"], {
+			env,
+			timeout: options.timeoutMs ?? 1e4
+		}, (_error, stdout) => {
+			try {
+				const parsed = JSON.parse(stdout);
+				if (typeof parsed.loggedIn === "boolean") {
+					resolve(parsed.loggedIn ? "logged_in" : "logged_out");
+					return;
+				}
+			} catch {}
+			resolve("unknown");
+		});
+	});
+}
+//#endregion
+//#region src/quickjs-executor.ts
+/**
+* In-process execution backend: runs a tool's untrusted script in the QuickJS
+* WASM guest. Always settles inline — nothing downstream assumes that, which is
+* what lets a deferred backend replace it behind the same seam.
+*/
+var QuickJsExecutor = class {
+	#options;
+	constructor(options) {
+		this.#options = options;
+	}
+	async dispatch(call) {
+		return {
+			executionId: call.executionId,
+			status: "settled",
+			result: await this.#execute(call)
+		};
+	}
+	async #execute(call) {
+		if (call.tool !== "eval_script") return {
+			status: "failed",
+			reason: "unsupported_tool",
+			error: `tool '${call.tool}' is not executable by the QuickJS backend`
+		};
+		const script = call.input?.script;
+		if (typeof script !== "string") return {
+			status: "failed",
+			reason: "invalid_input",
+			error: "eval_script requires a string `script` input"
+		};
+		const result = await runScript(this.#options.engine, {
+			script,
+			vfs: call.vfs,
+			signal: call.signal,
+			timeoutMs: call.limits?.timeoutMs ?? this.#options.defaultTimeoutMs ?? 5e3,
+			memoryLimitBytes: call.limits?.memoryLimitBytes ?? this.#options.defaultMemoryLimitBytes ?? 64 * 1024 * 1024,
+			fetchText: this.#allowsNetwork() ? (url) => this.#fetchText(url, call.signal) : void 0
+		});
+		const logs = result.logs.map((l) => `[${l.level}] ${l.text}`);
+		return result.ok ? {
+			status: "ok",
+			output: result.value,
+			logs
+		} : {
+			status: "failed",
+			reason: result.reason,
+			error: result.error,
+			logs
+		};
+	}
+	#allowsNetwork() {
+		return (this.#options.allowedHosts?.length ?? 0) > 0;
+	}
+	async #fetchText(url, outer) {
+		if (!isHostAllowed(url, this.#options.allowedHosts ?? [])) throw new Error(`host not allowed: ${safeHost(url) ?? url}`);
+		const controller = new AbortController();
+		const onOuterAbort = () => controller.abort();
+		outer?.addEventListener("abort", onOuterAbort);
+		const timer = setTimeout(() => controller.abort(), this.#options.fetchTimeoutMs ?? 1e4);
+		try {
+			return await (this.#options.hostFetch ?? defaultHostFetch)(url, controller.signal);
+		} finally {
+			clearTimeout(timer);
+			outer?.removeEventListener("abort", onOuterAbort);
+		}
+	}
+};
+async function defaultHostFetch(url, signal) {
+	const response = await fetch(url, { signal });
+	if (!response.ok) throw new Error(`request failed: ${response.status}`);
+	return await response.text();
+}
+function safeHost(url) {
+	try {
+		return new URL(url).hostname;
+	} catch {
+		return;
+	}
+}
+/** Exact hostname match, or a single leading `*.` wildcard covering subdomains
+* (not the bare parent). Only http(s) — no file:, data:, or other schemes. */
+function isHostAllowed(url, allowedHosts) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return false;
+	const host = parsed.hostname.toLowerCase();
+	return allowedHosts.some((entry) => {
+		const pattern = entry.trim().toLowerCase();
+		if (!pattern) return false;
+		if (pattern.startsWith("*.")) return host.endsWith(pattern.slice(1));
+		return host === pattern;
+	});
+}
+//#endregion
+//#region src/pending-registry.ts
+var PendingRequestRegistry = class {
+	#slots = /* @__PURE__ */ new Map();
+	get size() {
+		return this.#slots.size;
+	}
+	/**
+	* Register a request and get a promise for its outcome. The promise **never
+	* rejects**: a timeout or cancellation resolves with `ok: false` so callers
+	* feed the failure back into the agent loop instead of unwinding it.
+	*
+	* Re-registering a live id throws — silently replacing it would strand the
+	* first waiter forever.
+	*/
+	register(options) {
+		if (this.#slots.has(options.id)) throw new Error(`pending request '${options.id}' is already registered`);
+		const entry = {
+			id: options.id,
+			kind: options.kind,
+			createdAt: Date.now(),
+			expiresAt: options.timeoutMs === void 0 ? void 0 : Date.now() + options.timeoutMs,
+			meta: options.meta
+		};
+		return new Promise((resolve) => {
+			const slot = {
+				...entry,
+				resolve: (outcome) => {
+					options.onSettle?.(outcome, entry);
+					resolve(outcome);
+				}
+			};
+			if (options.timeoutMs !== void 0) {
+				slot.timer = setTimeout(() => {
+					this.#settle(options.id, {
+						ok: false,
+						reason: "timeout",
+						error: `request timed out after ${options.timeoutMs}ms`,
+						settledBy: "timeout"
+					});
+				}, options.timeoutMs);
+				slot.timer.unref?.();
+			}
+			this.#slots.set(options.id, slot);
+		});
+	}
+	/** Deliver a result. Returns false for unknown or already-settled ids —
+	* duplicate and late deliveries are no-ops, never a second application. */
+	settle(id, value, settledBy = "client") {
+		return this.#settle(id, {
+			ok: true,
+			value,
+			settledBy
+		});
+	}
+	/** Fail a request. Same idempotence guarantee as {@link settle}. */
+	fail(id, reason, error, settledBy = "server") {
+		return this.#settle(id, {
+			ok: false,
+			reason,
+			error,
+			settledBy
+		});
+	}
+	has(id) {
+		return this.#slots.has(id);
+	}
+	get(id) {
+		const slot = this.#slots.get(id);
+		return slot && toEntry(slot);
+	}
+	list(kind) {
+		const entries = [...this.#slots.values()].map(toEntry);
+		return kind ? entries.filter((e) => e.kind === kind) : entries;
+	}
+	/** Fail everything (optionally of one kind) — session close, turn interrupt. */
+	cancelAll(reason, error, kind) {
+		let canceled = 0;
+		for (const slot of Array.from(this.#slots.values())) {
+			if (kind && slot.kind !== kind) continue;
+			if (this.#settle(slot.id, {
+				ok: false,
+				reason,
+				error,
+				settledBy: "server"
+			})) canceled += 1;
+		}
+		return canceled;
+	}
+	#settle(id, outcome) {
+		const slot = this.#slots.get(id);
+		if (!slot) return false;
+		clearTimeout(slot.timer);
+		this.#slots.delete(id);
+		slot.resolve(outcome);
+		return true;
+	}
+};
+function toEntry(slot) {
+	return {
+		id: slot.id,
+		kind: slot.kind,
+		createdAt: slot.createdAt,
+		expiresAt: slot.expiresAt,
+		meta: slot.meta
+	};
+}
+//#endregion
+//#region src/browser-bridge-executor.ts
+/**
+* Executes tool calls in the attached client's own sandbox. The first backend
+* that genuinely returns `pending`: dispatch puts a request on the wire and
+* returns, and the result arrives later through {@link resolve}.
+*
+* Data locality is the point — documents can stay in the browser and never
+* reach the server. The tradeoff is trust: whatever comes back is untrusted
+* input, fine for the user's own data but never a source for authoritative
+* server state (that is why MCP and secret-bearing tools are never bridged).
+*/
+var BrowserBridgeExecutor = class {
+	registry;
+	#options;
+	/** Results that arrive before dispatch registers them (fast client, slow
+	* bookkeeping) would otherwise be dropped — hold them briefly. */
+	#early = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#options = options;
+		this.registry = options.registry ?? new PendingRequestRegistry();
+	}
+	async dispatch(call) {
+		const timeoutMs = call.limits?.timeoutMs ?? this.#options.timeoutMs ?? 6e4;
+		const expiresAt = Date.now() + timeoutMs;
+		const frame = {
+			type: "tool_call_request",
+			executionId: call.executionId,
+			toolName: call.tool,
+			input: call.input,
+			vfsSeed: call.vfs?.snapshot(),
+			limits: call.limits,
+			expiresAt
+		};
+		const settled = this.registry.register({
+			id: call.executionId,
+			kind: "tool_call",
+			timeoutMs,
+			meta: {
+				toolName: call.tool,
+				sessionId: call.sessionId
+			}
+		});
+		if (!this.#options.send(frame)) {
+			this.registry.fail(call.executionId, "no_client", "no client is attached to execute this call");
+			return {
+				executionId: call.executionId,
+				status: "settled",
+				result: toExecutionResult(await settled)
+			};
+		}
+		const early = this.#early.get(call.executionId);
+		if (early) {
+			this.#early.delete(call.executionId);
+			this.#applyAnswer(call.executionId, early);
+		}
+		const onAbort = () => {
+			this.registry.fail(call.executionId, "aborted", "the turn was interrupted");
+		};
+		call.signal?.addEventListener("abort", onAbort, { once: true });
+		settled.then((outcome) => {
+			call.signal?.removeEventListener("abort", onAbort);
+			if (!outcome.ok && outcome.settledBy !== "client") this.#options.cancel?.(call.executionId, outcome.reason);
+			this.#options.onResult?.(call.executionId, toExecutionResult(outcome));
+		});
+		return {
+			executionId: call.executionId,
+			status: "pending"
+		};
+	}
+	/**
+	* Apply a client's answer. Returns false when the id is unknown or already
+	* settled — a late result after a timeout must not re-open a settled call.
+	*/
+	resolve(executionId, answer) {
+		if (!this.registry.has(executionId)) {
+			this.#early.set(executionId, answer);
+			setTimeout(() => this.#early.delete(executionId), 5e3).unref?.();
+			return false;
+		}
+		return this.#applyAnswer(executionId, answer);
+	}
+	#applyAnswer(executionId, answer) {
+		return "output" in answer ? this.registry.settle(executionId, answer, "client") : this.registry.fail(executionId, answer.reason, answer.error, "client");
+	}
+};
+/** Map a registry outcome onto the executor's result contract. */
+function toExecutionResult(outcome) {
+	if (outcome.ok && "output" in outcome.value) {
+		const { output, logs } = outcome.value;
+		return {
+			status: "ok",
+			output: output.type === "text" ? output.value : output.value,
+			logs
+		};
+	}
+	if (outcome.ok) {
+		const failure = outcome.value;
+		return {
+			status: "failed",
+			reason: failure.reason,
+			error: failure.error,
+			logs: failure.logs
+		};
+	}
+	return {
+		status: "failed",
+		reason: outcome.reason,
+		error: outcome.error
+	};
+}
+//#endregion
+//#region src/deferred-executor.ts
+/**
+* The executor for work that outlives the session's process residency: dispatch
+* hands the call off and returns `pending` **without holding a promise**, because
+* the runner it would resolve into is about to be torn down. The result can only
+* come back through the host — the execution-result route → `settleExecution` on a
+* rehydrated runner — which is exactly what makes a park durable rather than a
+* long in-memory await.
+*
+* Contrast {@link BrowserBridgeExecutor}, which is also `pending` but keeps its
+* answer in memory for the ~60s the tab has to reply.
+*/
+var DeferredExecutor = class {
+	backend;
+	timeoutMs;
+	#options;
+	constructor(options) {
+		this.#options = options;
+		this.backend = options.backend ?? "remote";
+		this.timeoutMs = options.timeoutMs;
+	}
+	/** Every call this executor takes is deferred — route only the tools that
+	* belong on the remote side to it. */
+	describe() {
+		return {
+			backend: this.backend,
+			deferred: true,
+			timeoutMs: this.timeoutMs
+		};
+	}
+	async dispatch(call) {
+		await this.#options.onDispatch({
+			executionId: call.executionId,
+			sessionId: call.sessionId,
+			tool: call.tool,
+			input: call.input,
+			vfsSeed: call.vfs?.snapshot(),
+			limits: call.limits,
+			expiresAt: this.timeoutMs === void 0 ? void 0 : Date.now() + this.timeoutMs
+		});
+		return {
+			executionId: call.executionId,
+			status: "pending"
+		};
+	}
+};
+//#endregion
+//#region src/tools.ts
+const MAX_FILE_BYTES = 1024 * 1024;
+/**
+* Build the capability-scoped tool set for a session.
+*
+* The agent's authority is exactly what is granted here — there are no built-in
+* filesystem or shell tools, and nothing reaches the host filesystem: `fs_*`
+* operate on an in-memory scratch VFS. Tools whose backend is not supplied are
+* simply absent rather than present-and-failing, so a model cannot be tempted
+* by a capability the operator did not grant.
+*/
+function createToolContext(options) {
+	const vfs = options.vfs ?? createVfs();
+	const definitions = [];
+	definitions.push({
+		name: "fs_list",
+		trust: "authoritative",
+		tool: tool({
+			description: "List files in the scratch filesystem.",
+			inputSchema: z.object({ dir: z.string().default("/").describe("Directory to list") }),
+			execute: async ({ dir }) => ({ files: vfs.list(dir) })
+		})
+	});
+	definitions.push({
+		name: "fs_read",
+		trust: "authoritative",
+		tool: tool({
+			description: "Read a file from the scratch filesystem.",
+			inputSchema: z.object({ path: z.string() }),
+			execute: async ({ path }) => {
+				const content = vfs.read(path);
+				if (content === void 0) return { error: `no such file: ${path}` };
+				return { content: truncate(content) };
+			}
+		})
+	});
+	definitions.push({
+		name: "fs_write",
+		trust: "authoritative",
+		tool: tool({
+			description: "Write a file to the scratch filesystem.",
+			inputSchema: z.object({
+				path: z.string(),
+				content: z.string()
+			}),
+			execute: async ({ path, content }) => {
+				vfs.write(path, content);
+				return {
+					path,
+					bytes: content.length
+				};
+			}
+		})
+	});
+	if (options.onFileDelivered) {
+		const onFileDelivered = options.onFileDelivered;
+		definitions.push({
+			name: "deliver_file",
+			trust: "authoritative",
+			tool: tool({
+				description: "Hand a file from the scratch filesystem over to the user as a deliverable. Write it with fs_write first, then deliver it.",
+				inputSchema: z.object({
+					path: z.string().describe("Path of an existing file in the scratch filesystem"),
+					description: z.string().optional().describe("What this file is, for the recipient")
+				}),
+				execute: async ({ path, description }) => {
+					const content = vfs.read(path);
+					if (content === void 0) return { error: `no such file: ${path}` };
+					const file = {
+						path,
+						bytes: content.length,
+						description
+					};
+					onFileDelivered(file);
+					return {
+						delivered: true,
+						...file
+					};
+				}
+			})
+		});
+	}
+	if (options.search) {
+		const search = options.search;
+		definitions.push({
+			name: "web_search",
+			trust: "authoritative",
+			tool: tool({
+				description: "Search the web for pages relevant to a query.",
+				inputSchema: z.object({
+					query: z.string(),
+					limit: z.number().int().min(1).max(25).default(5)
+				}),
+				execute: async ({ query, limit }) => ({ results: await search(query, limit) })
+			})
+		});
+	}
+	if (options.download) {
+		const download = options.download;
+		definitions.push({
+			name: "download",
+			trust: "authoritative",
+			tool: tool({
+				description: "Fetch a URL and store its text in the scratch filesystem for later evaluation.",
+				inputSchema: z.object({
+					url: z.string().describe("Absolute http(s) URL"),
+					path: z.string().describe("Where to store it in the scratch filesystem")
+				}),
+				execute: async ({ url, path }) => {
+					try {
+						const { text, contentType } = await download(url);
+						const stored = truncate(text);
+						vfs.write(path, stored);
+						return {
+							path,
+							bytes: stored.length,
+							contentType
+						};
+					} catch (error) {
+						return { error: error instanceof Error ? error.message : String(error) };
+					}
+				}
+			})
+		});
+	}
+	if (options.webFetch) {
+		const webFetch = options.webFetch;
+		definitions.push({
+			name: "web_fetch",
+			trust: "authoritative",
+			tool: tool({
+				description: "Fetch a web page and process its content against a prompt. Returns the answer (or the page as markdown). Distinct from download: use web_fetch to answer a question about a page, download to store raw text for eval_script.",
+				inputSchema: z.object({
+					url: z.string().describe("Absolute http(s) URL"),
+					prompt: z.string().describe("What to extract or answer from the page")
+				}),
+				execute: async ({ url, prompt }) => {
+					try {
+						return await webFetch(url, prompt);
+					} catch (error) {
+						return { error: error instanceof Error ? error.message : String(error) };
+					}
+				}
+			})
+		});
+	}
+	definitions.push({
+		name: "eval_script",
+		trust: "sandboxed",
+		tool: tool({
+			description: "Evaluate a JavaScript snippet in a sandbox to parse, score, or extract from files. Globals: vfs.read(path), vfs.write(path, text), vfs.list(dir), console.log. The value of the last expression is returned. No network or host access.",
+			inputSchema: z.object({ script: z.string() })
+		})
+	});
+	const tools = {};
+	for (const definition of definitions) tools[definition.name] = definition.tool;
+	return {
+		vfs,
+		tools,
+		definitions,
+		sandboxedToolNames: definitions.filter((d) => d.trust === "sandboxed").map((d) => d.name)
+	};
+}
+/** Add host-side MCP tools to a context. They are ALWAYS authoritative: they run
+* server-side with server credentials, and must never be handed to a browser. */
+function withMcpTools(context, mcpTools) {
+	const definitions = [...context.definitions];
+	const tools = { ...context.tools };
+	for (const [name, mcpTool] of Object.entries(mcpTools)) {
+		if (context.sandboxedToolNames.includes(name)) throw new Error(`MCP tool '${name}' collides with a sandboxed tool of the same name`);
+		definitions.push({
+			name,
+			trust: "authoritative",
+			tool: mcpTool
+		});
+		tools[name] = mcpTool;
+	}
+	return {
+		...context,
+		tools,
+		definitions
+	};
+}
+function truncate(text) {
+	return text.length > MAX_FILE_BYTES ? text.slice(0, MAX_FILE_BYTES) : text;
+}
+//#endregion
+//#region src/web-fetch.ts
+const MAX_CACHE_ENTRIES = 64;
+const MAX_REDIRECTS = 5;
+function createWebFetch(options = {}) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const maxContentBytes = options.maxContentBytes ?? 1024 * 1024;
+	const maxMarkdownBytes = options.maxMarkdownBytes ?? 50 * 1024;
+	const cacheTtlMs = options.cacheTtlMs ?? 900 * 1e3;
+	const cache = /* @__PURE__ */ new Map();
+	const fetchPage = async (rawUrl) => {
+		const cached = cache.get(rawUrl);
+		if (cached && cached.expiresAt > Date.now()) return cached.page;
+		let url = parseUrl(rawUrl);
+		if (!url) return {
+			url: rawUrl,
+			error: "only absolute http(s) URLs are supported"
+		};
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 3e4);
+		try {
+			let response;
+			for (let hop = 0;; hop++) {
+				const denied = await denyReason(url, options.allowedHosts);
+				if (denied) return {
+					url: url.href,
+					error: denied
+				};
+				response = await fetchImpl(url.href, {
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (response.status < 300 || response.status >= 400) break;
+				const location = response.headers.get("location");
+				if (!location) return {
+					url: url.href,
+					error: `redirect (${response.status}) without a location`
+				};
+				const target = parseUrl(new URL(location, url).href);
+				if (!target) return {
+					url: url.href,
+					error: `redirect to unsupported URL: ${location}`
+				};
+				if (target.host !== url.host) return {
+					url: url.href,
+					redirectUrl: target.href,
+					notice: `redirected to a different host (${target.host}); not followed automatically`
+				};
+				if (hop >= MAX_REDIRECTS) return {
+					url: url.href,
+					error: "too many redirects"
+				};
+				url = target;
+			}
+			if (!response.ok) return {
+				url: url.href,
+				error: `request failed: ${response.status}`
+			};
+			const declared = Number(response.headers.get("content-length") ?? "");
+			if (declared > maxContentBytes) return {
+				url: url.href,
+				error: `response too large (${declared} bytes)`
+			};
+			const body = await readCapped(response, maxContentBytes);
+			if (body === void 0) return {
+				url: url.href,
+				error: `response too large (> ${maxContentBytes} bytes)`
+			};
+			const text = (response.headers.get("content-type") ?? "").includes("html") || looksLikeHtml(body) ? htmlToMarkdown(body) : body;
+			const truncated = text.length > maxMarkdownBytes;
+			const page = {
+				url: url.href,
+				markdown: truncated ? text.slice(0, maxMarkdownBytes) : text,
+				truncated: truncated || void 0
+			};
+			if (cache.size >= MAX_CACHE_ENTRIES) {
+				const oldest = cache.keys().next().value;
+				if (oldest !== void 0) cache.delete(oldest);
+			}
+			cache.set(rawUrl, {
+				expiresAt: Date.now() + cacheTtlMs,
+				page
+			});
+			return page;
+		} catch (error) {
+			const message = controller.signal.aborted ? "request timed out" : error instanceof Error ? error.message : String(error);
+			return {
+				url: url.href,
+				error: message
+			};
+		} finally {
+			clearTimeout(timer);
+		}
+	};
+	return async (rawUrl, prompt) => {
+		const page = await fetchPage(rawUrl);
+		if (page.error || page.notice || !options.digest || page.markdown === void 0) return page;
+		try {
+			const digest = await options.digest(page.markdown, prompt);
+			return {
+				url: page.url,
+				digest,
+				truncated: page.truncated
+			};
+		} catch {
+			return page;
+		}
+	};
+}
+function parseUrl(raw) {
+	try {
+		const url = new URL(raw);
+		return url.protocol === "https:" || url.protocol === "http:" ? url : void 0;
+	} catch {
+		return;
+	}
+}
+/** SSRF guard: resolve the hostname and refuse private, loopback, and link-local
+* destinations. Checked per redirect hop. Resolution happens once here and again
+* inside fetch (a DNS-rebinding TOCTOU); this tier accepts that — operators who
+* need pinning can supply `fetchImpl` with a pinned agent. */
+async function denyReason(url, allowedHosts) {
+	const host = url.hostname.toLowerCase();
+	if (allowedHosts && allowedHosts.length > 0 && !hostMatches(host, allowedHosts)) return `host not allowed: ${host}`;
+	if (host === "localhost" || host.endsWith(".localhost")) return `host not allowed: ${host}`;
+	const literal = host.replace(/^\[|\]$/g, "");
+	if (isPrivateAddress(literal)) return `address not allowed: ${literal}`;
+	if (/^[\d.]+$/.test(literal) || literal.includes(":")) return null;
+	let addresses;
+	try {
+		addresses = await lookup(literal, { all: true });
+	} catch {
+		return `cannot resolve host: ${host}`;
+	}
+	for (const { address } of addresses) if (isPrivateAddress(address)) return `host resolves to a private address: ${host}`;
+	return null;
+}
+function hostMatches(host, allowedHosts) {
+	return allowedHosts.some((entry) => {
+		const pattern = entry.trim().toLowerCase();
+		if (!pattern) return false;
+		if (pattern.startsWith("*.")) return host.endsWith(pattern.slice(1));
+		return host === pattern;
+	});
+}
+/** Private / loopback / link-local / unspecified, IPv4 and IPv6 (incl. v4-mapped). */
+function isPrivateAddress(address) {
+	const ip = address.toLowerCase();
+	if (ip.includes(":")) {
+		if (ip === "::" || ip === "::1") return true;
+		const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(ip);
+		if (mapped) return isPrivateAddress(mapped[1]);
+		return ip.startsWith("fc") || ip.startsWith("fd") || /^fe[89ab]/.test(ip);
+	}
+	const parts = ip.split(".").map(Number);
+	if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) return false;
+	const [a, b] = parts;
+	if (a === 0 || a === 10 || a === 127) return true;
+	if (a === 100 && b >= 64 && b <= 127) return true;
+	if (a === 169 && b === 254) return true;
+	if (a === 172 && b >= 16 && b <= 31) return true;
+	if (a === 192 && b === 168) return true;
+	return a >= 224;
+}
+async function readCapped(response, maxBytes) {
+	if (!response.body) {
+		const text = await response.text();
+		return text.length > maxBytes ? void 0 : text;
+	}
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let out = "";
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		out += decoder.decode(value, { stream: true });
+		if (out.length > maxBytes) {
+			await reader.cancel().catch(() => {});
+			return;
+		}
+	}
+	return out + decoder.decode();
+}
+function looksLikeHtml(body) {
+	return /<(!doctype|html|head|body)[\s>]/i.test(body.slice(0, 1024));
+}
+/**
+* Dependency-free HTML → markdown, tuned for "give the model readable text":
+* drops non-content subtrees, keeps headings/lists/links/emphasis/code, strips
+* everything else. Not a spec-grade converter on purpose — a small predictable
+* transform beats dragging a DOM into core.
+*/
+function htmlToMarkdown(html) {
+	let text = html.replace(/<!--[\s\S]*?-->/g, "").replace(/<(script|style|noscript|svg|template|iframe)\b[\s\S]*?<\/\1>/gi, "").replace(/<(head)\b[\s\S]*?<\/\1>/gi, "");
+	text = text.replace(/<h([1-6])[^>]*>([\s\S]*?)<\/h\1>/gi, (_, level, body) => {
+		return `\n\n${"#".repeat(Number(level))} ${stripTags(body).trim()}\n\n`;
+	}).replace(/<pre[^>]*>([\s\S]*?)<\/pre>/gi, (_, body) => {
+		return `\n\n\`\`\`\n${decodeEntities(body.replace(/<[^>]+>/g, ""))}\n\`\`\`\n\n`;
+	}).replace(/<a\s[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi, (_, href, body) => {
+		const label = stripTags(body).trim();
+		if (!label || href.startsWith("#") || href.startsWith("javascript:")) return label;
+		return label === href ? label : `[${label}](${href})`;
+	}).replace(/<li[^>]*>/gi, "\n- ").replace(/<\/(p|div|section|article|tr|table|ul|ol|blockquote|figure)>/gi, "\n\n").replace(/<(br|hr)\s*\/?>/gi, "\n").replace(/<(strong|b)>([\s\S]*?)<\/\1>/gi, "**$2**").replace(/<(em|i)>([\s\S]*?)<\/\1>/gi, "*$2*").replace(/<code[^>]*>([\s\S]*?)<\/code>/gi, "`$1`");
+	text = decodeEntities(text.replace(/<[^>]+>/g, ""));
+	return text.replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n").replace(/[ \t]{2,}/g, " ").trim();
+}
+function stripTags(html) {
+	return decodeEntities(html.replace(/<[^>]+>/g, ""));
+}
+function decodeEntities(text) {
+	return text.replace(/&#(\d+);/g, (_, code) => String.fromCodePoint(Number(code))).replace(/&#x([\da-f]+);/gi, (_, code) => String.fromCodePoint(parseInt(code, 16))).replace(/&nbsp;/g, " ").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&#39;|&apos;/g, "'").replace(/&amp;/g, "&");
+}
+//#endregion
+//#region src/engine.ts
+/** Which capability a wired backend yields, for grant filtering. */
+const CAPABILITY_TOOLS = {
+	search: "web_search",
+	download: "download",
+	webFetch: "web_fetch",
+	deliverFiles: "deliver_file"
+};
+/**
+* Assemble a model-agnostic session: provider model, capability-scoped tools,
+* a scratch VFS, and the executor that runs the sandboxed ones.
+*
+* This is the piece an operator wires into the server's `createEngineRunner`.
+*
+* The host wires the *backends*; the profile and the session request decide which
+* of them are actually granted (`profile.session`, `config.capabilities`). A
+* backend that isn't granted is simply not built into the tool set, so withholding
+* a capability costs the host no branching. No declaration anywhere = everything
+* the host wired, which is what a host that ignores profiles gets.
+*/
+function createEngineSession(options) {
+	const vfs = options.config.vfs ?? createVfs(options.config.restore?.vfs);
+	const executor = options.selectExecutor();
+	const granted = options.config.capabilities ?? options.profile?.session?.capabilities;
+	const isGranted = (key) => granted === void 0 || granted.includes(CAPABILITY_TOOLS[key]);
+	let runner;
+	const webFetchCap = isGranted("webFetch") ? options.capabilities?.webFetch : void 0;
+	const webFetch = typeof webFetchCap === "function" ? webFetchCap : webFetchCap ? createWebFetch({
+		...webFetchCap,
+		digest: webFetchCap.digest === false ? void 0 : webFetchCap.digest ?? ((markdown, prompt) => runner.generateDigest(`Answer the request below using ONLY this web page content.
+
+<page>\n${markdown}\n</page>\n\nRequest: ${prompt}`))
+	}) : void 0;
+	const base = createToolContext({
+		executor,
+		sessionId: "pending",
+		vfs,
+		search: isGranted("search") ? options.capabilities?.search : void 0,
+		download: isGranted("download") ? options.capabilities?.download : void 0,
+		webFetch,
+		onFileDelivered: options.capabilities?.deliverFiles === false || !isGranted("deliverFiles") ? void 0 : (file) => runner?.emitFileDelivered(file)
+	});
+	const mcpTools = selectMcpTools(options.mcpTools, options.profile?.session?.mcpServers);
+	const context = mcpTools ? withMcpTools(base, mcpTools) : base;
+	runner = new AiSdkRunner({
+		...options.config,
+		languageModel: options.resolveModel(options.profile, options.config),
+		instructions: options.profile?.session?.instructions ?? options.instructions ?? options.config.instructions,
+		tools: context.tools,
+		vfs,
+		executor,
+		executableTools: context.sandboxedToolNames,
+		executionBackend: options.backend ?? "server",
+		executionLimits: options.executionLimits
+	});
+	return runner;
+}
+/**
+* Restrict a connected tool set to the MCP servers a profile grants, by the
+* `<server>__<tool>` namespace {@link connectMcpTools} assigns. Undefined `servers`
+* = no declaration, so every connected server passes through.
+*
+* This is how one process-wide MCP connection serves a mixed fleet: the host
+* connects everything once, each profile grants a subset. The transport configs —
+* and any credentials in their headers — never leave the host for a profile.
+*/
+function selectMcpTools(tools, servers) {
+	if (!tools || servers === void 0) return tools;
+	const allowed = new Set(servers);
+	return Object.fromEntries(Object.entries(tools).filter(([name]) => allowed.has(name.split("__")[0])));
+}
+/**
+* Connect to MCP servers and return their tools, ready for {@link withMcpTools}.
+*
+* Server-side only, with server credentials: these tools are authoritative and
+* must never be bridged to a browser. `@ai-sdk/mcp` is imported lazily and is an
+* optional dependency — an operator who wires no MCP servers never needs it.
+*/
+async function connectMcpTools(servers, options = {}) {
+	const entries = Object.entries(servers);
+	if (entries.length === 0) return {
+		tools: {},
+		close: async () => {}
+	};
+	const { createMCPClient } = await import("@ai-sdk/mcp");
+	const clients = [];
+	const tools = {};
+	for (const [name, server] of entries) try {
+		const client = await createMCPClient({
+			transport: toTransport(server),
+			onUncaughtError: (error) => options.onError?.(name, error)
+		});
+		clients.push(client);
+		for (const [toolName, mcpTool] of Object.entries(await client.tools())) tools[`${name}__${toolName}`] = mcpTool;
+	} catch (error) {
+		options.onError?.(name, error);
+	}
+	return {
+		tools,
+		close: async () => {
+			await Promise.allSettled(clients.map((c) => c.close()));
+		}
+	};
+}
+/**
+* Only http/sse: the AI SDK's built-in transports are the remote ones, and its
+* own docs mark stdio local-only and not deployable. A stdio server here is a
+* misconfiguration worth surfacing rather than silently dropping — the Claude
+* engine still supports stdio, since the CLI spawns those itself.
+*/
+function toTransport(server) {
+	if (!("url" in server)) throw new Error("stdio MCP servers are not supported by the model-agnostic engine (use an http or sse server, or run this session under a Claude profile)");
+	return server.type === "sse" ? {
+		type: "sse",
+		url: server.url,
+		headers: server.headers
+	} : {
+		type: "http",
+		url: server.url,
+		headers: server.headers
+	};
+}
+//#endregion
+export { AiSdkRunner, BrowserBridgeExecutor, DeferredExecutor, InputQueue, PendingRequestRegistry, QuickJsExecutor, SessionRunner, checkClaudeAuth, connectMcpTools, createEngineSession, createToolContext, createWebFetch, htmlToMarkdown, isHostAllowed, isPrivateAddress, normalizeSdkMessage, resolveBundledClaudeExecutable, toApiMessage, toExecutionResult, withMcpTools };
+
+//# sourceMappingURL=index.mjs.map