@xopcai/xopc 0.0.103 → 0.0.104

package/dist/src/agent/workflow/catalog.js

@@ -8,8 +8,9 @@ import { join } from "node:path";
 * Catalog for named workflows.
 *
 * Resolution order (built-ins are starting points, user workflows win):
-*   1. `~/.xopc/workflows/<name>.js` (or `<name>.workflow.js`)
-*   2. {@link BUILTIN_WORKFLOWS}
+*   1. `~/.xopc/workflows/<name>/workflow.js` (+ optional `manifest.json`)
+*   2. `~/.xopc/workflows/<name>.js` (or `<name>.workflow.js`)
+*   3. {@link BUILTIN_WORKFLOWS}
 *
 * The user dir is discovered via {@link resolveStateDir}, so `XOPC_STATE_DIR`
 * overrides apply automatically (matches how skills / extensions are wired).
@@ -39,18 +40,18 @@ function createWorkflowCatalog(opts = {}) {
 				estimatedAgents: meta?.estimatedAgents
 			});
 		}
-		for (const file of safeListUserFiles(userDir)) {
-			const name = stripExt(file);
-			if (!isValidName(name)) continue;
-			const full = join(userDir, file);
-			const meta = safeMeta(readScript(full));
-			entries.set(name, {
-				name,
+		for (const entry of safeListUserEntries(userDir)) {
+			const meta = safeMeta(readScript(entry.path));
+			const manifest = readManifest(entry.manifestPath);
+			entries.set(entry.name, {
+				name: entry.name,
 				source: "user",
-				path: full,
-				description: meta?.description ?? "(unparseable)",
-				whenToUse: meta?.whenToUse,
-				tags: meta?.tags,
+				path: entry.path,
+				description: manifest?.description ?? meta?.description ?? "(unparseable)",
+				title: manifest?.title,
+				version: manifest?.version,
+				whenToUse: manifest?.whenToUse ?? meta?.whenToUse,
+				tags: manifest?.tags ?? meta?.tags,
 				estimatedAgents: meta?.estimatedAgents
 			});
 		}
@@ -58,17 +59,18 @@ function createWorkflowCatalog(opts = {}) {
 	};
 	const load = (name) => {
 		requireValidName(name);
-		const userPath = findUserPath(userDir, name);
-		if (userPath) {
-			const script = readScript(userPath);
+		const userEntry = findUserEntry(userDir, name);
+		if (userEntry) {
+			const script = readScript(userEntry.path);
 			const { meta } = parseWorkflowScript(script);
-			ensureMetaNameMatches(meta, name, userPath);
+			ensureMetaNameMatches(meta, name, userEntry.path);
 			return {
 				name,
 				source: "user",
 				script,
 				meta,
-				path: userPath
+				path: userEntry.path,
+				manifest: readManifest(userEntry.manifestPath)
 			};
 		}
 		const builtin = BUILTIN_WORKFLOWS.find((b) => b.name === name);
@@ -96,9 +98,9 @@ function createWorkflowCatalog(opts = {}) {
 	};
 	const remove = (name) => {
 		requireValidName(name);
-		const userPath = findUserPath(userDir, name);
-		if (!userPath) return false;
-		unlinkSync(userPath);
+		const userEntry = findUserEntry(userDir, name);
+		if (!userEntry) return false;
+		unlinkSync(userEntry.path);
 		return true;
 	};
 	return {
@@ -112,25 +114,64 @@ function createWorkflowCatalog(opts = {}) {
 function defaultUserDir() {
 	return join(resolveStateDir(), "workflows");
 }
-function safeListUserFiles(dir) {
+function safeListUserEntries(dir) {
 	try {
 		if (!existsSync(dir)) return [];
 		if (!statSync(dir).isDirectory()) return [];
-		return readdirSync(dir).filter((f) => /\.(js|workflow\.js)$/i.test(f));
+		const entries = [];
+		for (const file of readdirSync(dir)) {
+			const full = join(dir, file);
+			if (statSync(full).isDirectory()) {
+				const workflowPath = join(full, "workflow.js");
+				if (existsSync(workflowPath) && isValidName(file)) entries.push({
+					name: file,
+					path: workflowPath,
+					manifestPath: join(full, "manifest.json")
+				});
+				continue;
+			}
+			if (!/\.(js|workflow\.js)$/i.test(file)) continue;
+			const name = stripExt(file);
+			if (!isValidName(name)) continue;
+			entries.push({
+				name,
+				path: full
+			});
+		}
+		return entries;
 	} catch {
 		return [];
 	}
 }
-function findUserPath(dir, name) {
+function findUserEntry(dir, name) {
+	const dirWorkflowPath = join(dir, name, "workflow.js");
+	if (existsSync(dirWorkflowPath)) return {
+		name,
+		path: dirWorkflowPath,
+		manifestPath: join(dir, name, "manifest.json")
+	};
 	for (const candidate of [`${name}.js`, `${name}.workflow.js`]) {
 		const full = join(dir, candidate);
-		if (existsSync(full)) return full;
+		if (existsSync(full)) return {
+			name,
+			path: full
+		};
 	}
 	return null;
 }
 function readScript(path) {
 	return readFileSync(path, "utf-8");
 }
+function readManifest(path) {
+	if (!path || !existsSync(path)) return void 0;
+	try {
+		const value = JSON.parse(readFileSync(path, "utf-8"));
+		if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+		return value;
+	} catch {
+		return;
+	}
+}
 function safeMeta(script) {
 	try {
 		return parseWorkflowScript(script).meta;

package/dist/src/agent/workflow/catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.js","names":[],"sources":["../../../../src/agent/workflow/catalog.ts"],"sourcesContent":["/**\n * Catalog for named workflows.\n *\n * Resolution order (built-ins are starting points, user workflows win):\n *   1. `~/.xopc/workflows/<name>.js` (or `<name>.workflow.js`)\n *   2. {@link BUILTIN_WORKFLOWS}\n *\n * The user dir is discovered via {@link resolveStateDir}, so `XOPC_STATE_DIR`\n * overrides apply automatically (matches how skills / extensions are wired).\n *\n * Listing is filesystem-cheap (single `readdir`) and runs synchronously — the\n * `/workflows` slash command is interactive and should return immediately.\n *\n * Validation: on load we re-parse the script to make sure `meta.name` matches\n * the filename. This prevents copy-pasted scripts from being silently\n * mis-addressed when invoked by name.\n */\n\nimport {\n  existsSync,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  statSync,\n  unlinkSync,\n  writeFileSync,\n} from 'node:fs';\nimport { join } from 'node:path';\n\nimport { resolveStateDir } from '../../config/paths-state.js';\n\nimport { BUILTIN_WORKFLOWS } from './builtins/index.js';\nimport { parseWorkflowScript } from './parser.js';\nimport type { WorkflowMeta } from './types.js';\n\nexport type WorkflowSource = 'user' | 'builtin';\n\nexport interface CatalogEntry {\n  name: string;\n  source: WorkflowSource;\n  /** Absolute path for user entries; null for built-ins (in-memory). */\n  path: string | null;\n  description: string;\n  whenToUse?: string;\n  tags?: string[];\n  estimatedAgents?: { min: number; max: number };\n}\n\nexport interface LoadedWorkflow {\n  name: string;\n  source: WorkflowSource;\n  script: string;\n  meta: WorkflowMeta;\n  path: string | null;\n}\n\nexport interface WorkflowCatalog {\n  list(): CatalogEntry[];\n  /** Load a named workflow. Throws if missing or meta.name disagrees with filename. */\n  load(name: string): LoadedWorkflow;\n  /** Save a script as a user workflow. Throws if the script fails to parse. */\n  save(name: string, script: string): { path: string };\n  /** Remove a user workflow. No-op if absent. Built-ins are never removed. */\n  remove(name: string): boolean;\n  /** Absolute path to the user workflows directory (created lazily on save). */\n  userDir: string;\n}\n\nconst NAME_RE = /^[a-z][a-z0-9_-]*$/;\n\nexport function createWorkflowCatalog(opts: { userDir?: string } = {}): WorkflowCatalog {\n  const userDir = opts.userDir ?? defaultUserDir();\n\n  const list = (): CatalogEntry[] => {\n    const entries = new Map<string, CatalogEntry>();\n    for (const b of BUILTIN_WORKFLOWS) {\n      const meta = safeMeta(b.script);\n      entries.set(b.name, {\n        name: b.name,\n        source: 'builtin',\n        path: null,\n        description: meta?.description ?? '(unparseable)',\n        whenToUse: meta?.whenToUse,\n        tags: meta?.tags,\n        estimatedAgents: meta?.estimatedAgents,\n      });\n    }\n    for (const file of safeListUserFiles(userDir)) {\n      const name = stripExt(file);\n      if (!isValidName(name)) continue;\n      const full = join(userDir, file);\n      const meta = safeMeta(readScript(full));\n      // User wins on collision.\n      entries.set(name, {\n        name,\n        source: 'user',\n        path: full,\n        description: meta?.description ?? '(unparseable)',\n        whenToUse: meta?.whenToUse,\n        tags: meta?.tags,\n        estimatedAgents: meta?.estimatedAgents,\n      });\n    }\n    return [...entries.values()].sort((a, b) => a.name.localeCompare(b.name));\n  };\n\n  const load = (name: string): LoadedWorkflow => {\n    requireValidName(name);\n    const userPath = findUserPath(userDir, name);\n    if (userPath) {\n      const script = readScript(userPath);\n      const { meta } = parseWorkflowScript(script);\n      ensureMetaNameMatches(meta, name, userPath);\n      return { name, source: 'user', script, meta, path: userPath };\n    }\n    const builtin = BUILTIN_WORKFLOWS.find((b) => b.name === name);\n    if (builtin) {\n      const { meta } = parseWorkflowScript(builtin.script);\n      ensureMetaNameMatches(meta, name, '<builtin>');\n      return { name, source: 'builtin', script: builtin.script, meta, path: null };\n    }\n    throw new Error(\n      `workflow not found: ${name}. Drop a script at ${join(userDir, `${name}.js`)} or pick one of: ${list()\n        .map((e) => e.name)\n        .join(', ')}`,\n    );\n  };\n\n  const save = (name: string, script: string): { path: string } => {\n    requireValidName(name);\n    const { meta } = parseWorkflowScript(script);\n    if (meta.name !== name) {\n      throw new Error(\n        `meta.name \"${meta.name}\" does not match save name \"${name}\". Adjust one to match the other.`,\n      );\n    }\n    if (!existsSync(userDir)) {\n      mkdirSync(userDir, { recursive: true });\n    }\n    const path = join(userDir, `${name}.js`);\n    writeFileSync(path, normalizeNewlines(script), 'utf-8');\n    return { path };\n  };\n\n  const remove = (name: string): boolean => {\n    requireValidName(name);\n    const userPath = findUserPath(userDir, name);\n    if (!userPath) return false;\n    unlinkSync(userPath);\n    return true;\n  };\n\n  return { list, load, save, remove, userDir };\n}\n\n// ---------------------------------------------------------------------------\n\nexport function defaultUserDir(): string {\n  return join(resolveStateDir(), 'workflows');\n}\n\nfunction safeListUserFiles(dir: string): string[] {\n  try {\n    if (!existsSync(dir)) return [];\n    const st = statSync(dir);\n    if (!st.isDirectory()) return [];\n    return readdirSync(dir).filter((f) => /\\.(js|workflow\\.js)$/i.test(f));\n  } catch {\n    return [];\n  }\n}\n\nfunction findUserPath(dir: string, name: string): string | null {\n  for (const candidate of [`${name}.js`, `${name}.workflow.js`]) {\n    const full = join(dir, candidate);\n    if (existsSync(full)) return full;\n  }\n  return null;\n}\n\nfunction readScript(path: string): string {\n  return readFileSync(path, 'utf-8');\n}\n\nfunction safeMeta(script: string): WorkflowMeta | null {\n  try {\n    return parseWorkflowScript(script).meta;\n  } catch {\n    return null;\n  }\n}\n\nfunction stripExt(filename: string): string {\n  return filename.replace(/\\.workflow\\.js$/i, '').replace(/\\.js$/i, '');\n}\n\nfunction isValidName(name: string): boolean {\n  return NAME_RE.test(name);\n}\n\nfunction requireValidName(name: string): void {\n  if (!isValidName(name)) {\n    throw new Error(`invalid workflow name \"${name}\". Use lowercase snake_case, e.g. \"audit_repo\".`);\n  }\n}\n\nfunction ensureMetaNameMatches(meta: WorkflowMeta, name: string, locator: string): void {\n  if (meta.name !== name) {\n    throw new Error(\n      `workflow ${locator}: meta.name \"${meta.name}\" disagrees with addressable name \"${name}\". ` +\n        'Rename the file or the meta.name to match.',\n    );\n  }\n}\n\nfunction normalizeNewlines(s: string): string {\n  return s.endsWith('\\n') ? s : `${s}\\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;kBA6B8D;AAuC9D,MAAM,UAAU;AAEhB,SAAgB,sBAAsB,OAA6B,EAAE,EAAmB;CACtF,MAAM,UAAU,KAAK,WAAW,gBAAgB;CAEhD,MAAM,aAA6B;EACjC,MAAM,0BAAU,IAAI,KAA2B;AAC/C,OAAK,MAAM,KAAK,mBAAmB;GACjC,MAAM,OAAO,SAAS,EAAE,OAAO;AAC/B,WAAQ,IAAI,EAAE,MAAM;IAClB,MAAM,EAAE;IACR,QAAQ;IACR,MAAM;IACN,aAAa,MAAM,eAAe;IAClC,WAAW,MAAM;IACjB,MAAM,MAAM;IACZ,iBAAiB,MAAM;IACxB,CAAC;;AAEJ,OAAK,MAAM,QAAQ,kBAAkB,QAAQ,EAAE;GAC7C,MAAM,OAAO,SAAS,KAAK;AAC3B,OAAI,CAAC,YAAY,KAAK,CAAE;GACxB,MAAM,OAAO,KAAK,SAAS,KAAK;GAChC,MAAM,OAAO,SAAS,WAAW,KAAK,CAAC;AAEvC,WAAQ,IAAI,MAAM;IAChB;IACA,QAAQ;IACR,MAAM;IACN,aAAa,MAAM,eAAe;IAClC,WAAW,MAAM;IACjB,MAAM,MAAM;IACZ,iBAAiB,MAAM;IACxB,CAAC;;AAEJ,SAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,KAAK,CAAC;;CAG3E,MAAM,QAAQ,SAAiC;AAC7C,mBAAiB,KAAK;EACtB,MAAM,WAAW,aAAa,SAAS,KAAK;AAC5C,MAAI,UAAU;GACZ,MAAM,SAAS,WAAW,SAAS;GACnC,MAAM,EAAE,SAAS,oBAAoB,OAAO;AAC5C,yBAAsB,MAAM,MAAM,SAAS;AAC3C,UAAO;IAAE;IAAM,QAAQ;IAAQ;IAAQ;IAAM,MAAM;IAAU;;EAE/D,MAAM,UAAU,kBAAkB,MAAM,MAAM,EAAE,SAAS,KAAK;AAC9D,MAAI,SAAS;GACX,MAAM,EAAE,SAAS,oBAAoB,QAAQ,OAAO;AACpD,yBAAsB,MAAM,MAAM,YAAY;AAC9C,UAAO;IAAE;IAAM,QAAQ;IAAW,QAAQ,QAAQ;IAAQ;IAAM,MAAM;IAAM;;AAE9E,QAAM,IAAI,MACR,uBAAuB,KAAK,qBAAqB,KAAK,SAAS,GAAG,KAAK,KAAK,CAAC,mBAAmB,MAAM,CACnG,KAAK,MAAM,EAAE,KAAK,CAClB,KAAK,KAAK,GACd;;CAGH,MAAM,QAAQ,MAAc,WAAqC;AAC/D,mBAAiB,KAAK;EACtB,MAAM,EAAE,SAAS,oBAAoB,OAAO;AAC5C,MAAI,KAAK,SAAS,KAChB,OAAM,IAAI,MACR,cAAc,KAAK,KAAK,8BAA8B,KAAK,mCAC5D;AAEH,MAAI,CAAC,WAAW,QAAQ,CACtB,WAAU,SAAS,EAAE,WAAW,MAAM,CAAC;EAEzC,MAAM,OAAO,KAAK,SAAS,GAAG,KAAK,KAAK;AACxC,gBAAc,MAAM,kBAAkB,OAAO,EAAE,QAAQ;AACvD,SAAO,EAAE,MAAM;;CAGjB,MAAM,UAAU,SAA0B;AACxC,mBAAiB,KAAK;EACtB,MAAM,WAAW,aAAa,SAAS,KAAK;AAC5C,MAAI,CAAC,SAAU,QAAO;AACtB,aAAW,SAAS;AACpB,SAAO;;AAGT,QAAO;EAAE;EAAM;EAAM;EAAM;EAAQ;EAAS;;AAK9C,SAAgB,iBAAyB;AACvC,QAAO,KAAK,iBAAiB,EAAE,YAAY;;AAG7C,SAAS,kBAAkB,KAAuB;AAChD,KAAI;AACF,MAAI,CAAC,WAAW,IAAI,CAAE,QAAO,EAAE;AAE/B,MAAI,CADO,SAAS,IACb,CAAC,aAAa,CAAE,QAAO,EAAE;AAChC,SAAO,YAAY,IAAI,CAAC,QAAQ,MAAM,wBAAwB,KAAK,EAAE,CAAC;SAChE;AACN,SAAO,EAAE;;;AAIb,SAAS,aAAa,KAAa,MAA6B;AAC9D,MAAK,MAAM,aAAa,CAAC,GAAG,KAAK,MAAM,GAAG,KAAK,cAAc,EAAE;EAC7D,MAAM,OAAO,KAAK,KAAK,UAAU;AACjC,MAAI,WAAW,KAAK,CAAE,QAAO;;AAE/B,QAAO;;AAGT,SAAS,WAAW,MAAsB;AACxC,QAAO,aAAa,MAAM,QAAQ;;AAGpC,SAAS,SAAS,QAAqC;AACrD,KAAI;AACF,SAAO,oBAAoB,OAAO,CAAC;SAC7B;AACN,SAAO;;;AAIX,SAAS,SAAS,UAA0B;AAC1C,QAAO,SAAS,QAAQ,oBAAoB,GAAG,CAAC,QAAQ,UAAU,GAAG;;AAGvE,SAAS,YAAY,MAAuB;AAC1C,QAAO,QAAQ,KAAK,KAAK;;AAG3B,SAAS,iBAAiB,MAAoB;AAC5C,KAAI,CAAC,YAAY,KAAK,CACpB,OAAM,IAAI,MAAM,0BAA0B,KAAK,iDAAiD;;AAIpG,SAAS,sBAAsB,MAAoB,MAAc,SAAuB;AACtF,KAAI,KAAK,SAAS,KAChB,OAAM,IAAI,MACR,YAAY,QAAQ,eAAe,KAAK,KAAK,qCAAqC,KAAK,+CAExF;;AAIL,SAAS,kBAAkB,GAAmB;AAC5C,QAAO,EAAE,SAAS,KAAK,GAAG,IAAI,GAAG,EAAE"}
+{"version":3,"file":"catalog.js","names":[],"sources":["../../../../src/agent/workflow/catalog.ts"],"sourcesContent":["/**\n * Catalog for named workflows.\n *\n * Resolution order (built-ins are starting points, user workflows win):\n *   1. `~/.xopc/workflows/<name>/workflow.js` (+ optional `manifest.json`)\n *   2. `~/.xopc/workflows/<name>.js` (or `<name>.workflow.js`)\n *   3. {@link BUILTIN_WORKFLOWS}\n *\n * The user dir is discovered via {@link resolveStateDir}, so `XOPC_STATE_DIR`\n * overrides apply automatically (matches how skills / extensions are wired).\n *\n * Listing is filesystem-cheap (single `readdir`) and runs synchronously — the\n * `/workflows` slash command is interactive and should return immediately.\n *\n * Validation: on load we re-parse the script to make sure `meta.name` matches\n * the filename. This prevents copy-pasted scripts from being silently\n * mis-addressed when invoked by name.\n */\n\nimport {\n  existsSync,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  statSync,\n  unlinkSync,\n  writeFileSync,\n} from 'node:fs';\nimport { join } from 'node:path';\n\nimport type { WorkflowDefinitionManifest } from '../../workflows/domain/definition.js';\n\nimport { resolveStateDir } from '../../config/paths-state.js';\n\nimport { BUILTIN_WORKFLOWS } from './builtins/index.js';\nimport { parseWorkflowScript } from './parser.js';\nimport type { WorkflowMeta } from './types.js';\n\nexport type WorkflowSource = 'user' | 'builtin';\n\nexport interface CatalogEntry {\n  name: string;\n  source: WorkflowSource;\n  /** Absolute path for user entries; null for built-ins (in-memory). */\n  path: string | null;\n  description: string;\n  title?: string;\n  version?: string;\n  whenToUse?: string;\n  tags?: string[];\n  estimatedAgents?: { min: number; max: number };\n}\n\nexport interface LoadedWorkflow {\n  name: string;\n  source: WorkflowSource;\n  script: string;\n  meta: WorkflowMeta;\n  path: string | null;\n  manifest?: WorkflowDefinitionManifest;\n}\n\nexport interface WorkflowCatalog {\n  list(): CatalogEntry[];\n  /** Load a named workflow. Throws if missing or meta.name disagrees with filename. */\n  load(name: string): LoadedWorkflow;\n  /** Save a script as a user workflow. Throws if the script fails to parse. */\n  save(name: string, script: string): { path: string };\n  /** Remove a user workflow. No-op if absent. Built-ins are never removed. */\n  remove(name: string): boolean;\n  /** Absolute path to the user workflows directory (created lazily on save). */\n  userDir: string;\n}\n\nconst NAME_RE = /^[a-z][a-z0-9_-]*$/;\n\nexport function createWorkflowCatalog(opts: { userDir?: string } = {}): WorkflowCatalog {\n  const userDir = opts.userDir ?? defaultUserDir();\n\n  const list = (): CatalogEntry[] => {\n    const entries = new Map<string, CatalogEntry>();\n    for (const b of BUILTIN_WORKFLOWS) {\n      const meta = safeMeta(b.script);\n      entries.set(b.name, {\n        name: b.name,\n        source: 'builtin',\n        path: null,\n        description: meta?.description ?? '(unparseable)',\n        whenToUse: meta?.whenToUse,\n        tags: meta?.tags,\n        estimatedAgents: meta?.estimatedAgents,\n      });\n    }\n    for (const entry of safeListUserEntries(userDir)) {\n      const meta = safeMeta(readScript(entry.path));\n      const manifest = readManifest(entry.manifestPath);\n      // User wins on collision.\n      entries.set(entry.name, {\n        name: entry.name,\n        source: 'user',\n        path: entry.path,\n        description: manifest?.description ?? meta?.description ?? '(unparseable)',\n        title: manifest?.title,\n        version: manifest?.version,\n        whenToUse: manifest?.whenToUse ?? meta?.whenToUse,\n        tags: manifest?.tags ?? meta?.tags,\n        estimatedAgents: meta?.estimatedAgents,\n      });\n    }\n    return [...entries.values()].sort((a, b) => a.name.localeCompare(b.name));\n  };\n\n  const load = (name: string): LoadedWorkflow => {\n    requireValidName(name);\n    const userEntry = findUserEntry(userDir, name);\n    if (userEntry) {\n      const script = readScript(userEntry.path);\n      const { meta } = parseWorkflowScript(script);\n      ensureMetaNameMatches(meta, name, userEntry.path);\n      return {\n        name,\n        source: 'user',\n        script,\n        meta,\n        path: userEntry.path,\n        manifest: readManifest(userEntry.manifestPath),\n      };\n    }\n    const builtin = BUILTIN_WORKFLOWS.find((b) => b.name === name);\n    if (builtin) {\n      const { meta } = parseWorkflowScript(builtin.script);\n      ensureMetaNameMatches(meta, name, '<builtin>');\n      return { name, source: 'builtin', script: builtin.script, meta, path: null };\n    }\n    throw new Error(\n      `workflow not found: ${name}. Drop a script at ${join(userDir, `${name}.js`)} or pick one of: ${list()\n        .map((e) => e.name)\n        .join(', ')}`,\n    );\n  };\n\n  const save = (name: string, script: string): { path: string } => {\n    requireValidName(name);\n    const { meta } = parseWorkflowScript(script);\n    if (meta.name !== name) {\n      throw new Error(\n        `meta.name \"${meta.name}\" does not match save name \"${name}\". Adjust one to match the other.`,\n      );\n    }\n    if (!existsSync(userDir)) {\n      mkdirSync(userDir, { recursive: true });\n    }\n    const path = join(userDir, `${name}.js`);\n    writeFileSync(path, normalizeNewlines(script), 'utf-8');\n    return { path };\n  };\n\n  const remove = (name: string): boolean => {\n    requireValidName(name);\n    const userEntry = findUserEntry(userDir, name);\n    if (!userEntry) return false;\n    unlinkSync(userEntry.path);\n    return true;\n  };\n\n  return { list, load, save, remove, userDir };\n}\n\n// ---------------------------------------------------------------------------\n\nexport function defaultUserDir(): string {\n  return join(resolveStateDir(), 'workflows');\n}\n\ninterface UserWorkflowEntry {\n  name: string;\n  path: string;\n  manifestPath?: string;\n}\n\nfunction safeListUserEntries(dir: string): UserWorkflowEntry[] {\n  try {\n    if (!existsSync(dir)) return [];\n    const st = statSync(dir);\n    if (!st.isDirectory()) return [];\n    const entries: UserWorkflowEntry[] = [];\n    for (const file of readdirSync(dir)) {\n      const full = join(dir, file);\n      const fileStat = statSync(full);\n      if (fileStat.isDirectory()) {\n        const workflowPath = join(full, 'workflow.js');\n        if (existsSync(workflowPath) && isValidName(file)) {\n          entries.push({ name: file, path: workflowPath, manifestPath: join(full, 'manifest.json') });\n        }\n        continue;\n      }\n      if (!/\\.(js|workflow\\.js)$/i.test(file)) continue;\n      const name = stripExt(file);\n      if (!isValidName(name)) continue;\n      entries.push({ name, path: full });\n    }\n    return entries;\n  } catch {\n    return [];\n  }\n}\n\nfunction findUserEntry(dir: string, name: string): UserWorkflowEntry | null {\n  const dirWorkflowPath = join(dir, name, 'workflow.js');\n  if (existsSync(dirWorkflowPath)) {\n    return { name, path: dirWorkflowPath, manifestPath: join(dir, name, 'manifest.json') };\n  }\n  for (const candidate of [`${name}.js`, `${name}.workflow.js`]) {\n    const full = join(dir, candidate);\n    if (existsSync(full)) return { name, path: full };\n  }\n  return null;\n}\n\nfunction readScript(path: string): string {\n  return readFileSync(path, 'utf-8');\n}\n\nfunction readManifest(path: string | undefined): WorkflowDefinitionManifest | undefined {\n  if (!path || !existsSync(path)) return undefined;\n  try {\n    const value = JSON.parse(readFileSync(path, 'utf-8')) as WorkflowDefinitionManifest;\n    if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;\n    return value;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction safeMeta(script: string): WorkflowMeta | null {\n  try {\n    return parseWorkflowScript(script).meta;\n  } catch {\n    return null;\n  }\n}\n\nfunction stripExt(filename: string): string {\n  return filename.replace(/\\.workflow\\.js$/i, '').replace(/\\.js$/i, '');\n}\n\nfunction isValidName(name: string): boolean {\n  return NAME_RE.test(name);\n}\n\nfunction requireValidName(name: string): void {\n  if (!isValidName(name)) {\n    throw new Error(`invalid workflow name \"${name}\". Use lowercase snake_case, e.g. \"audit_repo\".`);\n  }\n}\n\nfunction ensureMetaNameMatches(meta: WorkflowMeta, name: string, locator: string): void {\n  if (meta.name !== name) {\n    throw new Error(\n      `workflow ${locator}: meta.name \"${meta.name}\" disagrees with addressable name \"${name}\". ` +\n        'Rename the file or the meta.name to match.',\n    );\n  }\n}\n\nfunction normalizeNewlines(s: string): string {\n  return s.endsWith('\\n') ? s : `${s}\\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;kBAgC8D;AA0C9D,MAAM,UAAU;AAEhB,SAAgB,sBAAsB,OAA6B,EAAE,EAAmB;CACtF,MAAM,UAAU,KAAK,WAAW,gBAAgB;CAEhD,MAAM,aAA6B;EACjC,MAAM,0BAAU,IAAI,KAA2B;AAC/C,OAAK,MAAM,KAAK,mBAAmB;GACjC,MAAM,OAAO,SAAS,EAAE,OAAO;AAC/B,WAAQ,IAAI,EAAE,MAAM;IAClB,MAAM,EAAE;IACR,QAAQ;IACR,MAAM;IACN,aAAa,MAAM,eAAe;IAClC,WAAW,MAAM;IACjB,MAAM,MAAM;IACZ,iBAAiB,MAAM;IACxB,CAAC;;AAEJ,OAAK,MAAM,SAAS,oBAAoB,QAAQ,EAAE;GAChD,MAAM,OAAO,SAAS,WAAW,MAAM,KAAK,CAAC;GAC7C,MAAM,WAAW,aAAa,MAAM,aAAa;AAEjD,WAAQ,IAAI,MAAM,MAAM;IACtB,MAAM,MAAM;IACZ,QAAQ;IACR,MAAM,MAAM;IACZ,aAAa,UAAU,eAAe,MAAM,eAAe;IAC3D,OAAO,UAAU;IACjB,SAAS,UAAU;IACnB,WAAW,UAAU,aAAa,MAAM;IACxC,MAAM,UAAU,QAAQ,MAAM;IAC9B,iBAAiB,MAAM;IACxB,CAAC;;AAEJ,SAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,KAAK,CAAC;;CAG3E,MAAM,QAAQ,SAAiC;AAC7C,mBAAiB,KAAK;EACtB,MAAM,YAAY,cAAc,SAAS,KAAK;AAC9C,MAAI,WAAW;GACb,MAAM,SAAS,WAAW,UAAU,KAAK;GACzC,MAAM,EAAE,SAAS,oBAAoB,OAAO;AAC5C,yBAAsB,MAAM,MAAM,UAAU,KAAK;AACjD,UAAO;IACL;IACA,QAAQ;IACR;IACA;IACA,MAAM,UAAU;IAChB,UAAU,aAAa,UAAU,aAAa;IAC/C;;EAEH,MAAM,UAAU,kBAAkB,MAAM,MAAM,EAAE,SAAS,KAAK;AAC9D,MAAI,SAAS;GACX,MAAM,EAAE,SAAS,oBAAoB,QAAQ,OAAO;AACpD,yBAAsB,MAAM,MAAM,YAAY;AAC9C,UAAO;IAAE;IAAM,QAAQ;IAAW,QAAQ,QAAQ;IAAQ;IAAM,MAAM;IAAM;;AAE9E,QAAM,IAAI,MACR,uBAAuB,KAAK,qBAAqB,KAAK,SAAS,GAAG,KAAK,KAAK,CAAC,mBAAmB,MAAM,CACnG,KAAK,MAAM,EAAE,KAAK,CAClB,KAAK,KAAK,GACd;;CAGH,MAAM,QAAQ,MAAc,WAAqC;AAC/D,mBAAiB,KAAK;EACtB,MAAM,EAAE,SAAS,oBAAoB,OAAO;AAC5C,MAAI,KAAK,SAAS,KAChB,OAAM,IAAI,MACR,cAAc,KAAK,KAAK,8BAA8B,KAAK,mCAC5D;AAEH,MAAI,CAAC,WAAW,QAAQ,CACtB,WAAU,SAAS,EAAE,WAAW,MAAM,CAAC;EAEzC,MAAM,OAAO,KAAK,SAAS,GAAG,KAAK,KAAK;AACxC,gBAAc,MAAM,kBAAkB,OAAO,EAAE,QAAQ;AACvD,SAAO,EAAE,MAAM;;CAGjB,MAAM,UAAU,SAA0B;AACxC,mBAAiB,KAAK;EACtB,MAAM,YAAY,cAAc,SAAS,KAAK;AAC9C,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,UAAU,KAAK;AAC1B,SAAO;;AAGT,QAAO;EAAE;EAAM;EAAM;EAAM;EAAQ;EAAS;;AAK9C,SAAgB,iBAAyB;AACvC,QAAO,KAAK,iBAAiB,EAAE,YAAY;;AAS7C,SAAS,oBAAoB,KAAkC;AAC7D,KAAI;AACF,MAAI,CAAC,WAAW,IAAI,CAAE,QAAO,EAAE;AAE/B,MAAI,CADO,SAAS,IACb,CAAC,aAAa,CAAE,QAAO,EAAE;EAChC,MAAM,UAA+B,EAAE;AACvC,OAAK,MAAM,QAAQ,YAAY,IAAI,EAAE;GACnC,MAAM,OAAO,KAAK,KAAK,KAAK;AAE5B,OADiB,SAAS,KACd,CAAC,aAAa,EAAE;IAC1B,MAAM,eAAe,KAAK,MAAM,cAAc;AAC9C,QAAI,WAAW,aAAa,IAAI,YAAY,KAAK,CAC/C,SAAQ,KAAK;KAAE,MAAM;KAAM,MAAM;KAAc,cAAc,KAAK,MAAM,gBAAgB;KAAE,CAAC;AAE7F;;AAEF,OAAI,CAAC,wBAAwB,KAAK,KAAK,CAAE;GACzC,MAAM,OAAO,SAAS,KAAK;AAC3B,OAAI,CAAC,YAAY,KAAK,CAAE;AACxB,WAAQ,KAAK;IAAE;IAAM,MAAM;IAAM,CAAC;;AAEpC,SAAO;SACD;AACN,SAAO,EAAE;;;AAIb,SAAS,cAAc,KAAa,MAAwC;CAC1E,MAAM,kBAAkB,KAAK,KAAK,MAAM,cAAc;AACtD,KAAI,WAAW,gBAAgB,CAC7B,QAAO;EAAE;EAAM,MAAM;EAAiB,cAAc,KAAK,KAAK,MAAM,gBAAgB;EAAE;AAExF,MAAK,MAAM,aAAa,CAAC,GAAG,KAAK,MAAM,GAAG,KAAK,cAAc,EAAE;EAC7D,MAAM,OAAO,KAAK,KAAK,UAAU;AACjC,MAAI,WAAW,KAAK,CAAE,QAAO;GAAE;GAAM,MAAM;GAAM;;AAEnD,QAAO;;AAGT,SAAS,WAAW,MAAsB;AACxC,QAAO,aAAa,MAAM,QAAQ;;AAGpC,SAAS,aAAa,MAAkE;AACtF,KAAI,CAAC,QAAQ,CAAC,WAAW,KAAK,CAAE,QAAO,KAAA;AACvC,KAAI;EACF,MAAM,QAAQ,KAAK,MAAM,aAAa,MAAM,QAAQ,CAAC;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CAAE,QAAO,KAAA;AACxE,SAAO;SACD;AACN;;;AAIJ,SAAS,SAAS,QAAqC;AACrD,KAAI;AACF,SAAO,oBAAoB,OAAO,CAAC;SAC7B;AACN,SAAO;;;AAIX,SAAS,SAAS,UAA0B;AAC1C,QAAO,SAAS,QAAQ,oBAAoB,GAAG,CAAC,QAAQ,UAAU,GAAG;;AAGvE,SAAS,YAAY,MAAuB;AAC1C,QAAO,QAAQ,KAAK,KAAK;;AAG3B,SAAS,iBAAiB,MAAoB;AAC5C,KAAI,CAAC,YAAY,KAAK,CACpB,OAAM,IAAI,MAAM,0BAA0B,KAAK,iDAAiD;;AAIpG,SAAS,sBAAsB,MAAoB,MAAc,SAAuB;AACtF,KAAI,KAAK,SAAS,KAChB,OAAM,IAAI,MACR,YAAY,QAAQ,eAAe,KAAK,KAAK,qCAAqC,KAAK,+CAExF;;AAIL,SAAS,kBAAkB,GAAmB;AAC5C,QAAO,EAAE,SAAS,KAAK,GAAG,IAAI,GAAG,EAAE"}

package/dist/src/agent/workflow/subagent-runner.d.ts

@@ -17,6 +17,7 @@ import type { AgentTool } from '@earendil-works/pi-agent-core';
 import type { Api, Model } from '@earendil-works/pi-ai';
 import type { Config } from '../../config/schema.js';
 import type { MessageBus } from '../../infra/bus/index.js';
+import type { SessionStore } from '../../session/store.js';
 import { type BuildChildToolsOptions } from '../child-agent-factory.js';
 import type { ToolExecutorConfig } from '../tools/executor.js';
 import type { SubagentRunOptions, SubagentRunner } from './types.js';
@@ -27,6 +28,7 @@ export interface DelegateSubagentRunnerDeps {
     getDefaultModel: () => Model<Api>;
     getConfig: () => Config | undefined;
     toolExecutorConfig?: Partial<ToolExecutorConfig>;
+    sessionStore?: SessionStore;
     /**
      * Provided by the workflow tool from `AgentToolsFactory` — mirrors how
      * `delegate-tool` is wired (avoids importing `tools/factory.ts` here and
@@ -39,4 +41,5 @@ export declare class DelegateSubagentRunner implements SubagentRunner {
     private readonly deps;
     constructor(deps: DelegateSubagentRunnerDeps);
     run<T = string>(prompt: string, opts: SubagentRunOptions<T>): Promise<T | null>;
+    private preparePersistentSubagentSession;
 }

package/dist/src/agent/workflow/subagent-runner.js

@@ -3,6 +3,7 @@ import { init_logger } from "../../utils/logger.js";
 import { createDelegateChildHandle } from "../child-agent-factory.js";
 import { DEFAULT_DELEGATE_TOOLS, DELEGATE_BLOCKED_TOOLS } from "../tools/delegate-tool.js";
 import { STRUCTURED_OUTPUT_TOOL_NAME, createStructuredOutputTool } from "./structured-output-tool.js";
+import { emitSessionTranscriptUpdate } from "../../session/transcript-events.js";
 //#region src/agent/workflow/subagent-runner.ts
 init_logger();
 const log = createLogger("Agent:WorkflowSubagent");
@@ -26,7 +27,25 @@ var DelegateSubagentRunner = class {
 		}
 		const fullPrompt = buildPrompt(prompt, opts, wantStructured);
 		const streamMode = resolveSubagentStreamMode(this.deps.getConfig);
-		const handle = createDelegateChildHandle({
+		let transcriptPersistQueue = Promise.resolve();
+		const persistTranscriptSnapshot = opts.sessionKey && this.deps.sessionStore ? (messages) => {
+			const store = this.deps.sessionStore;
+			const key = opts.sessionKey;
+			if (!store || !key) return;
+			const snapshot = cloneAgentMessages(messages);
+			transcriptPersistQueue = transcriptPersistQueue.then(async () => {
+				await store.saveMessages(key, snapshot);
+				emitSessionTranscriptUpdate({ sessionKey: key });
+			}).catch((err) => {
+				const msg = err instanceof Error ? err.message : String(err);
+				log.warn({
+					err,
+					sessionKey: key,
+					errorMessage: msg
+				}, `Failed to persist workflow subagent transcript snapshot: ${msg}`);
+			});
+		} : void 0;
+		const childOptions = {
 			workspace: this.deps.workspace,
 			goal: fullPrompt,
 			allowedToolNames: allowed,
@@ -48,12 +67,20 @@ var DelegateSubagentRunner = class {
 				onProgress: (event) => {
 					opts.onProgress?.(mapChildProgressEvent(event));
 				}
-			} : void 0
-		});
+			} : void 0,
+			onTranscriptSnapshot: persistTranscriptSnapshot
+		};
+		if (opts.sessionKey && opts.sessionMetadata && this.deps.sessionStore) await this.preparePersistentSubagentSession(opts.sessionKey, opts.sessionMetadata);
+		const handle = createDelegateChildHandle(childOptions);
 		const onAbort = () => handle.abort();
 		opts.signal?.addEventListener("abort", onAbort, { once: true });
 		try {
-			const { summary } = await handle.run();
+			const { summary, messages } = await handle.run();
+			await transcriptPersistQueue;
+			if (opts.sessionKey && this.deps.sessionStore) {
+				await this.deps.sessionStore.saveMessages(opts.sessionKey, messages);
+				emitSessionTranscriptUpdate({ sessionKey: opts.sessionKey });
+			}
 			if (opts.signal?.aborted) return null;
 			if (wantStructured) {
 				if (!capture.called) {
@@ -76,7 +103,26 @@ var DelegateSubagentRunner = class {
 			opts.signal?.removeEventListener("abort", onAbort);
 		}
 	}
+	async preparePersistentSubagentSession(sessionKey, metadata) {
+		const store = this.deps.sessionStore;
+		if (!store) return;
+		await store.resolveTranscriptPath(sessionKey);
+		await store.updateMetadata(sessionKey, {
+			sessionType: "workflow-subagent",
+			hiddenFromSessionList: true,
+			parentSessionKey: metadata.parentSessionKey,
+			workflowRunId: metadata.workflowRunId,
+			workflowDefinitionId: metadata.workflowDefinitionId,
+			workflowAgentId: metadata.workflowAgentId,
+			workflowAgentLabel: metadata.workflowAgentLabel,
+			name: metadata.workflowAgentLabel,
+			tags: ["workflow-subagent", metadata.workflowDefinitionId]
+		});
+	}
 };
+function cloneAgentMessages(messages) {
+	return messages.map((message) => structuredClone(message));
+}
 function resolveAllowedToolNames(requested, wantStructured) {
 	const filtered = (requested && requested.length > 0 ? requested : [...DEFAULT_DELEGATE_TOOLS]).map((s) => String(s).trim()).filter((s) => s.length > 0).filter((s) => !DELEGATE_BLOCKED_TOOLS.has(s));
 	if (wantStructured && !filtered.includes("structured_output")) filtered.push(STRUCTURED_OUTPUT_TOOL_NAME);

package/dist/src/agent/workflow/subagent-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"subagent-runner.js","names":[],"sources":["../../../../src/agent/workflow/subagent-runner.ts"],"sourcesContent":["/**\n * Adapter: spawns one isolated child agent per `agent()` call from a workflow.\n *\n * Wraps the existing `createDelegateChildHandle` so the workflow runtime stays\n * decoupled from the LLM stack (it sees only the `SubagentRunner` interface).\n *\n * Key behaviour:\n * - When `opts.schema` is provided, we inject `structured_output` into the child\n *   tool set and unwrap the captured value on success. If the subagent finishes\n *   without ever calling `structured_output`, we treat it as failure (`null`).\n * - Failures and aborts resolve to `null`. The workflow runtime continues — this\n *   matches the pi-dynamic-workflows contract and keeps fan-out pipelines robust.\n * - We do NOT mutate `createDelegateChildHandle` — we just leverage its\n *   `buildChildTools` injection point.\n */\n\nimport type { AgentTool } from '@earendil-works/pi-agent-core';\nimport type { Api, Model } from '@earendil-works/pi-ai';\n\nimport type { Config } from '../../config/schema.js';\nimport type { MessageBus } from '../../infra/bus/index.js';\nimport { createLogger } from '../../utils/logger.js';\n\nimport {\n  type BuildChildToolsOptions,\n  createDelegateChildHandle,\n  type DelegateChildHandleOptions,\n} from '../child-agent-factory.js';\nimport {\n  DEFAULT_DELEGATE_TOOLS,\n  DELEGATE_BLOCKED_TOOLS,\n} from '../tools/delegate-tool.js';\nimport type { ToolExecutorConfig } from '../tools/executor.js';\n\nimport {\n  createStructuredOutputTool,\n  STRUCTURED_OUTPUT_TOOL_NAME,\n  type StructuredOutputCapture,\n} from './structured-output-tool.js';\nimport type { SubagentRunOptions, SubagentRunner, SubagentProgressEvent } from './types.js';\n\nconst log = createLogger('Agent:WorkflowSubagent');\n\nconst DEFAULT_MAX_ITERATIONS = 30;\n\nexport interface DelegateSubagentRunnerDeps {\n  workspace: string;\n  bus: MessageBus;\n  /** Resolves the default subagent model (typically the parent agent's primary model). */\n  getDefaultModel: () => Model<Api>;\n  getConfig: () => Config | undefined;\n  toolExecutorConfig?: Partial<ToolExecutorConfig>;\n  /**\n   * Provided by the workflow tool from `AgentToolsFactory` — mirrors how\n   * `delegate-tool` is wired (avoids importing `tools/factory.ts` here and\n   * breaking the existing factory ↔ delegate-tool ↔ child-agent-factory\n   * dependency contract).\n   */\n  buildChildTools: (opts: BuildChildToolsOptions) => AgentTool<any, any>[];\n}\n\nexport class DelegateSubagentRunner implements SubagentRunner {\n  constructor(private readonly deps: DelegateSubagentRunnerDeps) {}\n\n  async run<T = string>(prompt: string, opts: SubagentRunOptions<T>): Promise<T | null> {\n    if (opts.signal?.aborted) return null;\n\n    const capture: StructuredOutputCapture<T> = { called: false, value: undefined };\n    const wantStructured = Boolean(opts.schema);\n\n    const allowed = resolveAllowedToolNames(opts.allowedToolNames, wantStructured);\n    const model = opts.model ?? safeResolveDefaultModel(this.deps.getDefaultModel);\n    if (!model) {\n      log.warn({ label: opts.label }, 'subagent run skipped: no primary model resolved');\n      return null;\n    }\n\n    const fullPrompt = buildPrompt(prompt, opts, wantStructured);\n    const streamMode = resolveSubagentStreamMode(this.deps.getConfig);\n\n    const childOptions: DelegateChildHandleOptions = {\n      workspace: this.deps.workspace,\n      goal: fullPrompt,\n      allowedToolNames: allowed,\n      maxIterations: opts.maxIterations ?? DEFAULT_MAX_ITERATIONS,\n      model,\n      bus: this.deps.bus,\n      getConfig: this.deps.getConfig,\n      toolExecutorConfig: this.deps.toolExecutorConfig,\n      buildChildTools: (childOpts) => {\n        const base = this.deps.buildChildTools(childOpts);\n        if (!wantStructured || !opts.schema) return base;\n        // Replace any existing tool with the same name so the per-run capture wins.\n        const filtered = base.filter((t) => t.name !== STRUCTURED_OUTPUT_TOOL_NAME);\n        return [\n          ...filtered,\n          createStructuredOutputTool({ schema: opts.schema, capture }) as unknown as AgentTool<any, any>,\n        ];\n      },\n      progressHooks:\n        opts.onProgress && streamMode !== 'off'\n          ? {\n              mode: streamMode === 'full' ? 'full' : 'steps',\n              onProgress: (event) => {\n                opts.onProgress?.(mapChildProgressEvent(event));\n              },\n            }\n          : undefined,\n    };\n\n    const handle = createDelegateChildHandle(childOptions);\n    const onAbort = () => handle.abort();\n    opts.signal?.addEventListener('abort', onAbort, { once: true });\n\n    try {\n      const { summary } = await handle.run();\n      if (opts.signal?.aborted) return null;\n\n      if (wantStructured) {\n        if (!capture.called) {\n          log.warn({ label: opts.label }, 'subagent finished without calling structured_output');\n          return null;\n        }\n        return capture.value as T;\n      }\n      return summary as unknown as T;\n    } catch (e) {\n      if (opts.rethrow) throw e;\n      const msg = e instanceof Error ? e.message : String(e);\n      log.warn({ err: e, label: opts.label, errorMessage: msg }, `subagent run failed: ${msg}`);\n      return null;\n    } finally {\n      opts.signal?.removeEventListener('abort', onAbort);\n    }\n  }\n}\n\nfunction resolveAllowedToolNames(\n  requested: string[] | undefined,\n  wantStructured: boolean,\n): string[] {\n  const base = requested && requested.length > 0 ? requested : [...DEFAULT_DELEGATE_TOOLS];\n  const filtered = base\n    .map((s) => String(s).trim())\n    .filter((s) => s.length > 0)\n    .filter((s) => !DELEGATE_BLOCKED_TOOLS.has(s));\n  if (wantStructured && !filtered.includes(STRUCTURED_OUTPUT_TOOL_NAME)) {\n    filtered.push(STRUCTURED_OUTPUT_TOOL_NAME);\n  }\n  return [...new Set(filtered)];\n}\n\nfunction buildPrompt(prompt: string, opts: SubagentRunOptions<unknown>, structured: boolean): string {\n  const parts: string[] = [];\n  if (opts.instructions?.trim()) parts.push(opts.instructions.trim());\n  if (opts.label) parts.push(`Task label: ${opts.label}`);\n  if (opts.phase) parts.push(`Workflow phase: ${opts.phase}`);\n  parts.push(prompt);\n  if (structured) {\n    parts.push(\n      [\n        'Final output contract:',\n        '- Your final action MUST be a structured_output tool call.',\n        '- The structured_output arguments are the return value of this subagent.',\n        '- Do not emit a prose final answer instead of structured_output.',\n        '- If you need to inspect files or run commands first, do so, then call structured_output exactly once.',\n      ].join('\\n'),\n    );\n  }\n  return parts.join('\\n\\n');\n}\n\nfunction safeResolveDefaultModel(get: () => Model<Api>): Model<Api> | null {\n  try {\n    return get();\n  } catch (e) {\n    log.warn({ err: e }, 'failed to resolve default subagent model');\n    return null;\n  }\n}\n\nfunction resolveSubagentStreamMode(\n  getConfig: () => Config | undefined,\n): 'off' | 'steps' | 'full' {\n  const mode = getConfig()?.agents?.defaults?.workflow?.subagentStream;\n  if (mode === 'off' || mode === 'steps' || mode === 'full') return mode;\n  return 'steps';\n}\n\nfunction mapChildProgressEvent(event: {\n  type: 'tool_start' | 'tool_end' | 'iteration' | 'text_delta' | 'thinking_delta';\n  toolCallId?: string;\n  toolName?: string;\n  args?: Record<string, unknown>;\n  isError?: boolean;\n  resultPreview?: string;\n  error?: string;\n  count?: number;\n  max?: number;\n  delta?: string;\n}): SubagentProgressEvent {\n  switch (event.type) {\n    case 'tool_start':\n      return {\n        type: 'tool_start',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        args: event.args ?? {},\n      };\n    case 'tool_end':\n      return {\n        type: 'tool_end',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        isError: Boolean(event.isError),\n        resultPreview: event.resultPreview,\n        error: event.error,\n      };\n    case 'iteration':\n      return {\n        type: 'iteration',\n        count: event.count ?? 0,\n        max: event.max ?? 0,\n      };\n    case 'text_delta':\n      return { type: 'text_delta', delta: event.delta ?? '' };\n    case 'thinking_delta':\n      return { type: 'thinking_delta', delta: event.delta ?? '' };\n    default:\n      return { type: 'text_delta', delta: '' };\n  }\n}\n"],"mappings":";;;;;;aAqBqD;AAoBrD,MAAM,MAAM,aAAa,yBAAyB;AAElD,MAAM,yBAAyB;AAkB/B,IAAa,yBAAb,MAA8D;CAC5D,YAAY,MAAmD;AAAlC,OAAA,OAAA;;CAE7B,MAAM,IAAgB,QAAgB,MAAgD;AACpF,MAAI,KAAK,QAAQ,QAAS,QAAO;EAEjC,MAAM,UAAsC;GAAE,QAAQ;GAAO,OAAO,KAAA;GAAW;EAC/E,MAAM,iBAAiB,QAAQ,KAAK,OAAO;EAE3C,MAAM,UAAU,wBAAwB,KAAK,kBAAkB,eAAe;EAC9E,MAAM,QAAQ,KAAK,SAAS,wBAAwB,KAAK,KAAK,gBAAgB;AAC9E,MAAI,CAAC,OAAO;AACV,OAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,kDAAkD;AAClF,UAAO;;EAGT,MAAM,aAAa,YAAY,QAAQ,MAAM,eAAe;EAC5D,MAAM,aAAa,0BAA0B,KAAK,KAAK,UAAU;EAgCjE,MAAM,SAAS,0BAA0B;GA7BvC,WAAW,KAAK,KAAK;GACrB,MAAM;GACN,kBAAkB;GAClB,eAAe,KAAK,iBAAiB;GACrC;GACA,KAAK,KAAK,KAAK;GACf,WAAW,KAAK,KAAK;GACrB,oBAAoB,KAAK,KAAK;GAC9B,kBAAkB,cAAc;IAC9B,MAAM,OAAO,KAAK,KAAK,gBAAgB,UAAU;AACjD,QAAI,CAAC,kBAAkB,CAAC,KAAK,OAAQ,QAAO;AAG5C,WAAO,CACL,GAFe,KAAK,QAAQ,MAAM,EAAE,SAAS,4BAElC,EACX,2BAA2B;KAAE,QAAQ,KAAK;KAAQ;KAAS,CAAC,CAC7D;;GAEH,eACE,KAAK,cAAc,eAAe,QAC9B;IACE,MAAM,eAAe,SAAS,SAAS;IACvC,aAAa,UAAU;AACrB,UAAK,aAAa,sBAAsB,MAAM,CAAC;;IAElD,GACD,KAAA;GAG6C,CAAC;EACtD,MAAM,gBAAgB,OAAO,OAAO;AACpC,OAAK,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;AAE/D,MAAI;GACF,MAAM,EAAE,YAAY,MAAM,OAAO,KAAK;AACtC,OAAI,KAAK,QAAQ,QAAS,QAAO;AAEjC,OAAI,gBAAgB;AAClB,QAAI,CAAC,QAAQ,QAAQ;AACnB,SAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,sDAAsD;AACtF,YAAO;;AAET,WAAO,QAAQ;;AAEjB,UAAO;WACA,GAAG;AACV,OAAI,KAAK,QAAS,OAAM;GACxB,MAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;AACtD,OAAI,KAAK;IAAE,KAAK;IAAG,OAAO,KAAK;IAAO,cAAc;IAAK,EAAE,wBAAwB,MAAM;AACzF,UAAO;YACC;AACR,QAAK,QAAQ,oBAAoB,SAAS,QAAQ;;;;AAKxD,SAAS,wBACP,WACA,gBACU;CAEV,MAAM,YADO,aAAa,UAAU,SAAS,IAAI,YAAY,CAAC,GAAG,uBAAuB,EAErF,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAC5B,QAAQ,MAAM,EAAE,SAAS,EAAE,CAC3B,QAAQ,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;AAChD,KAAI,kBAAkB,CAAC,SAAS,SAAA,oBAAqC,CACnE,UAAS,KAAK,4BAA4B;AAE5C,QAAO,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;;AAG/B,SAAS,YAAY,QAAgB,MAAmC,YAA6B;CACnG,MAAM,QAAkB,EAAE;AAC1B,KAAI,KAAK,cAAc,MAAM,CAAE,OAAM,KAAK,KAAK,aAAa,MAAM,CAAC;AACnE,KAAI,KAAK,MAAO,OAAM,KAAK,eAAe,KAAK,QAAQ;AACvD,KAAI,KAAK,MAAO,OAAM,KAAK,mBAAmB,KAAK,QAAQ;AAC3D,OAAM,KAAK,OAAO;AAClB,KAAI,WACF,OAAM,KACJ;EACE;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK,CACb;AAEH,QAAO,MAAM,KAAK,OAAO;;AAG3B,SAAS,wBAAwB,KAA0C;AACzE,KAAI;AACF,SAAO,KAAK;UACL,GAAG;AACV,MAAI,KAAK,EAAE,KAAK,GAAG,EAAE,2CAA2C;AAChE,SAAO;;;AAIX,SAAS,0BACP,WAC0B;CAC1B,MAAM,OAAO,WAAW,EAAE,QAAQ,UAAU,UAAU;AACtD,KAAI,SAAS,SAAS,SAAS,WAAW,SAAS,OAAQ,QAAO;AAClE,QAAO;;AAGT,SAAS,sBAAsB,OAWL;AACxB,SAAQ,MAAM,MAAd;EACE,KAAK,aACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,MAAM,MAAM,QAAQ,EAAE;GACvB;EACH,KAAK,WACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,SAAS,QAAQ,MAAM,QAAQ;GAC/B,eAAe,MAAM;GACrB,OAAO,MAAM;GACd;EACH,KAAK,YACH,QAAO;GACL,MAAM;GACN,OAAO,MAAM,SAAS;GACtB,KAAK,MAAM,OAAO;GACnB;EACH,KAAK,aACH,QAAO;GAAE,MAAM;GAAc,OAAO,MAAM,SAAS;GAAI;EACzD,KAAK,iBACH,QAAO;GAAE,MAAM;GAAkB,OAAO,MAAM,SAAS;GAAI;EAC7D,QACE,QAAO;GAAE,MAAM;GAAc,OAAO;GAAI"}
+{"version":3,"file":"subagent-runner.js","names":[],"sources":["../../../../src/agent/workflow/subagent-runner.ts"],"sourcesContent":["/**\n * Adapter: spawns one isolated child agent per `agent()` call from a workflow.\n *\n * Wraps the existing `createDelegateChildHandle` so the workflow runtime stays\n * decoupled from the LLM stack (it sees only the `SubagentRunner` interface).\n *\n * Key behaviour:\n * - When `opts.schema` is provided, we inject `structured_output` into the child\n *   tool set and unwrap the captured value on success. If the subagent finishes\n *   without ever calling `structured_output`, we treat it as failure (`null`).\n * - Failures and aborts resolve to `null`. The workflow runtime continues — this\n *   matches the pi-dynamic-workflows contract and keeps fan-out pipelines robust.\n * - We do NOT mutate `createDelegateChildHandle` — we just leverage its\n *   `buildChildTools` injection point.\n */\n\nimport type { AgentTool } from '@earendil-works/pi-agent-core';\nimport type { Api, Model } from '@earendil-works/pi-ai';\n\nimport type { Config } from '../../config/schema.js';\nimport type { MessageBus } from '../../infra/bus/index.js';\nimport type { SessionStore } from '../../session/store.js';\nimport { emitSessionTranscriptUpdate } from '../../session/transcript-events.js';\nimport { createLogger } from '../../utils/logger.js';\n\nimport {\n  type BuildChildToolsOptions,\n  createDelegateChildHandle,\n  type DelegateChildHandleOptions,\n} from '../child-agent-factory.js';\nimport {\n  DEFAULT_DELEGATE_TOOLS,\n  DELEGATE_BLOCKED_TOOLS,\n} from '../tools/delegate-tool.js';\nimport type { ToolExecutorConfig } from '../tools/executor.js';\n\nimport {\n  createStructuredOutputTool,\n  STRUCTURED_OUTPUT_TOOL_NAME,\n  type StructuredOutputCapture,\n} from './structured-output-tool.js';\nimport type { SubagentRunOptions, SubagentRunner, SubagentProgressEvent } from './types.js';\n\nconst log = createLogger('Agent:WorkflowSubagent');\n\nconst DEFAULT_MAX_ITERATIONS = 30;\n\nexport interface DelegateSubagentRunnerDeps {\n  workspace: string;\n  bus: MessageBus;\n  /** Resolves the default subagent model (typically the parent agent's primary model). */\n  getDefaultModel: () => Model<Api>;\n  getConfig: () => Config | undefined;\n  toolExecutorConfig?: Partial<ToolExecutorConfig>;\n  sessionStore?: SessionStore;\n  /**\n   * Provided by the workflow tool from `AgentToolsFactory` — mirrors how\n   * `delegate-tool` is wired (avoids importing `tools/factory.ts` here and\n   * breaking the existing factory ↔ delegate-tool ↔ child-agent-factory\n   * dependency contract).\n   */\n  buildChildTools: (opts: BuildChildToolsOptions) => AgentTool<any, any>[];\n}\n\nexport class DelegateSubagentRunner implements SubagentRunner {\n  constructor(private readonly deps: DelegateSubagentRunnerDeps) {}\n\n  async run<T = string>(prompt: string, opts: SubagentRunOptions<T>): Promise<T | null> {\n    if (opts.signal?.aborted) return null;\n\n    const capture: StructuredOutputCapture<T> = { called: false, value: undefined };\n    const wantStructured = Boolean(opts.schema);\n\n    const allowed = resolveAllowedToolNames(opts.allowedToolNames, wantStructured);\n    const model = opts.model ?? safeResolveDefaultModel(this.deps.getDefaultModel);\n    if (!model) {\n      log.warn({ label: opts.label }, 'subagent run skipped: no primary model resolved');\n      return null;\n    }\n\n    const fullPrompt = buildPrompt(prompt, opts, wantStructured);\n    const streamMode = resolveSubagentStreamMode(this.deps.getConfig);\n\n    let transcriptPersistQueue: Promise<void> = Promise.resolve();\n    const persistTranscriptSnapshot = opts.sessionKey && this.deps.sessionStore\n      ? (messages: Parameters<SessionStore['saveMessages']>[1]) => {\n          const store = this.deps.sessionStore;\n          const key = opts.sessionKey;\n          if (!store || !key) return;\n          const snapshot = cloneAgentMessages(messages);\n          transcriptPersistQueue = transcriptPersistQueue\n            .then(async () => {\n              await store.saveMessages(key, snapshot);\n              emitSessionTranscriptUpdate({ sessionKey: key });\n            })\n            .catch((err) => {\n              const msg = err instanceof Error ? err.message : String(err);\n              log.warn(\n                { err, sessionKey: key, errorMessage: msg },\n                `Failed to persist workflow subagent transcript snapshot: ${msg}`,\n              );\n            });\n        }\n      : undefined;\n\n    const childOptions: DelegateChildHandleOptions = {\n      workspace: this.deps.workspace,\n      goal: fullPrompt,\n      allowedToolNames: allowed,\n      maxIterations: opts.maxIterations ?? DEFAULT_MAX_ITERATIONS,\n      model,\n      bus: this.deps.bus,\n      getConfig: this.deps.getConfig,\n      toolExecutorConfig: this.deps.toolExecutorConfig,\n      buildChildTools: (childOpts) => {\n        const base = this.deps.buildChildTools(childOpts);\n        if (!wantStructured || !opts.schema) return base;\n        // Replace any existing tool with the same name so the per-run capture wins.\n        const filtered = base.filter((t) => t.name !== STRUCTURED_OUTPUT_TOOL_NAME);\n        return [\n          ...filtered,\n          createStructuredOutputTool({ schema: opts.schema, capture }) as unknown as AgentTool<any, any>,\n        ];\n      },\n      progressHooks:\n        opts.onProgress && streamMode !== 'off'\n          ? {\n              mode: streamMode === 'full' ? 'full' : 'steps',\n              onProgress: (event) => {\n                opts.onProgress?.(mapChildProgressEvent(event));\n              },\n            }\n          : undefined,\n      onTranscriptSnapshot: persistTranscriptSnapshot,\n    };\n\n    if (opts.sessionKey && opts.sessionMetadata && this.deps.sessionStore) {\n      await this.preparePersistentSubagentSession(opts.sessionKey, opts.sessionMetadata);\n    }\n\n    const handle = createDelegateChildHandle(childOptions);\n    const onAbort = () => handle.abort();\n    opts.signal?.addEventListener('abort', onAbort, { once: true });\n\n    try {\n      const { summary, messages } = await handle.run();\n      await transcriptPersistQueue;\n      if (opts.sessionKey && this.deps.sessionStore) {\n        await this.deps.sessionStore.saveMessages(opts.sessionKey, messages);\n        emitSessionTranscriptUpdate({ sessionKey: opts.sessionKey });\n      }\n      if (opts.signal?.aborted) return null;\n\n      if (wantStructured) {\n        if (!capture.called) {\n          log.warn({ label: opts.label }, 'subagent finished without calling structured_output');\n          return null;\n        }\n        return capture.value as T;\n      }\n      return summary as unknown as T;\n    } catch (e) {\n      if (opts.rethrow) throw e;\n      const msg = e instanceof Error ? e.message : String(e);\n      log.warn({ err: e, label: opts.label, errorMessage: msg }, `subagent run failed: ${msg}`);\n      return null;\n    } finally {\n      opts.signal?.removeEventListener('abort', onAbort);\n    }\n  }\n\n  private async preparePersistentSubagentSession(\n    sessionKey: string,\n    metadata: NonNullable<SubagentRunOptions['sessionMetadata']>,\n  ): Promise<void> {\n    const store = this.deps.sessionStore;\n    if (!store) return;\n    await store.resolveTranscriptPath(sessionKey);\n    await store.updateMetadata(sessionKey, {\n      sessionType: 'workflow-subagent',\n      hiddenFromSessionList: true,\n      parentSessionKey: metadata.parentSessionKey,\n      workflowRunId: metadata.workflowRunId,\n      workflowDefinitionId: metadata.workflowDefinitionId,\n      workflowAgentId: metadata.workflowAgentId,\n      workflowAgentLabel: metadata.workflowAgentLabel,\n      name: metadata.workflowAgentLabel,\n      tags: ['workflow-subagent', metadata.workflowDefinitionId],\n    });\n  }\n}\n\nfunction cloneAgentMessages(messages: Parameters<SessionStore['saveMessages']>[1]): Parameters<SessionStore['saveMessages']>[1] {\n  return messages.map((message) => structuredClone(message));\n}\n\nfunction resolveAllowedToolNames(\n  requested: string[] | undefined,\n  wantStructured: boolean,\n): string[] {\n  const base = requested && requested.length > 0 ? requested : [...DEFAULT_DELEGATE_TOOLS];\n  const filtered = base\n    .map((s) => String(s).trim())\n    .filter((s) => s.length > 0)\n    .filter((s) => !DELEGATE_BLOCKED_TOOLS.has(s));\n  if (wantStructured && !filtered.includes(STRUCTURED_OUTPUT_TOOL_NAME)) {\n    filtered.push(STRUCTURED_OUTPUT_TOOL_NAME);\n  }\n  return [...new Set(filtered)];\n}\n\nfunction buildPrompt(prompt: string, opts: SubagentRunOptions<unknown>, structured: boolean): string {\n  const parts: string[] = [];\n  if (opts.instructions?.trim()) parts.push(opts.instructions.trim());\n  if (opts.label) parts.push(`Task label: ${opts.label}`);\n  if (opts.phase) parts.push(`Workflow phase: ${opts.phase}`);\n  parts.push(prompt);\n  if (structured) {\n    parts.push(\n      [\n        'Final output contract:',\n        '- Your final action MUST be a structured_output tool call.',\n        '- The structured_output arguments are the return value of this subagent.',\n        '- Do not emit a prose final answer instead of structured_output.',\n        '- If you need to inspect files or run commands first, do so, then call structured_output exactly once.',\n      ].join('\\n'),\n    );\n  }\n  return parts.join('\\n\\n');\n}\n\nfunction safeResolveDefaultModel(get: () => Model<Api>): Model<Api> | null {\n  try {\n    return get();\n  } catch (e) {\n    log.warn({ err: e }, 'failed to resolve default subagent model');\n    return null;\n  }\n}\n\nfunction resolveSubagentStreamMode(\n  getConfig: () => Config | undefined,\n): 'off' | 'steps' | 'full' {\n  const mode = getConfig()?.agents?.defaults?.workflow?.subagentStream;\n  if (mode === 'off' || mode === 'steps' || mode === 'full') return mode;\n  return 'steps';\n}\n\nfunction mapChildProgressEvent(event: {\n  type: 'tool_start' | 'tool_end' | 'iteration' | 'text_delta' | 'thinking_delta';\n  toolCallId?: string;\n  toolName?: string;\n  args?: Record<string, unknown>;\n  isError?: boolean;\n  resultPreview?: string;\n  error?: string;\n  count?: number;\n  max?: number;\n  delta?: string;\n}): SubagentProgressEvent {\n  switch (event.type) {\n    case 'tool_start':\n      return {\n        type: 'tool_start',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        args: event.args ?? {},\n      };\n    case 'tool_end':\n      return {\n        type: 'tool_end',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        isError: Boolean(event.isError),\n        resultPreview: event.resultPreview,\n        error: event.error,\n      };\n    case 'iteration':\n      return {\n        type: 'iteration',\n        count: event.count ?? 0,\n        max: event.max ?? 0,\n      };\n    case 'text_delta':\n      return { type: 'text_delta', delta: event.delta ?? '' };\n    case 'thinking_delta':\n      return { type: 'thinking_delta', delta: event.delta ?? '' };\n    default:\n      return { type: 'text_delta', delta: '' };\n  }\n}\n"],"mappings":";;;;;;;aAuBqD;AAoBrD,MAAM,MAAM,aAAa,yBAAyB;AAElD,MAAM,yBAAyB;AAmB/B,IAAa,yBAAb,MAA8D;CAC5D,YAAY,MAAmD;AAAlC,OAAA,OAAA;;CAE7B,MAAM,IAAgB,QAAgB,MAAgD;AACpF,MAAI,KAAK,QAAQ,QAAS,QAAO;EAEjC,MAAM,UAAsC;GAAE,QAAQ;GAAO,OAAO,KAAA;GAAW;EAC/E,MAAM,iBAAiB,QAAQ,KAAK,OAAO;EAE3C,MAAM,UAAU,wBAAwB,KAAK,kBAAkB,eAAe;EAC9E,MAAM,QAAQ,KAAK,SAAS,wBAAwB,KAAK,KAAK,gBAAgB;AAC9E,MAAI,CAAC,OAAO;AACV,OAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,kDAAkD;AAClF,UAAO;;EAGT,MAAM,aAAa,YAAY,QAAQ,MAAM,eAAe;EAC5D,MAAM,aAAa,0BAA0B,KAAK,KAAK,UAAU;EAEjE,IAAI,yBAAwC,QAAQ,SAAS;EAC7D,MAAM,4BAA4B,KAAK,cAAc,KAAK,KAAK,gBAC1D,aAA0D;GACzD,MAAM,QAAQ,KAAK,KAAK;GACxB,MAAM,MAAM,KAAK;AACjB,OAAI,CAAC,SAAS,CAAC,IAAK;GACpB,MAAM,WAAW,mBAAmB,SAAS;AAC7C,4BAAyB,uBACtB,KAAK,YAAY;AAChB,UAAM,MAAM,aAAa,KAAK,SAAS;AACvC,gCAA4B,EAAE,YAAY,KAAK,CAAC;KAChD,CACD,OAAO,QAAQ;IACd,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAC5D,QAAI,KACF;KAAE;KAAK,YAAY;KAAK,cAAc;KAAK,EAC3C,4DAA4D,MAC7D;KACD;MAEN,KAAA;EAEJ,MAAM,eAA2C;GAC/C,WAAW,KAAK,KAAK;GACrB,MAAM;GACN,kBAAkB;GAClB,eAAe,KAAK,iBAAiB;GACrC;GACA,KAAK,KAAK,KAAK;GACf,WAAW,KAAK,KAAK;GACrB,oBAAoB,KAAK,KAAK;GAC9B,kBAAkB,cAAc;IAC9B,MAAM,OAAO,KAAK,KAAK,gBAAgB,UAAU;AACjD,QAAI,CAAC,kBAAkB,CAAC,KAAK,OAAQ,QAAO;AAG5C,WAAO,CACL,GAFe,KAAK,QAAQ,MAAM,EAAE,SAAS,4BAElC,EACX,2BAA2B;KAAE,QAAQ,KAAK;KAAQ;KAAS,CAAC,CAC7D;;GAEH,eACE,KAAK,cAAc,eAAe,QAC9B;IACE,MAAM,eAAe,SAAS,SAAS;IACvC,aAAa,UAAU;AACrB,UAAK,aAAa,sBAAsB,MAAM,CAAC;;IAElD,GACD,KAAA;GACN,sBAAsB;GACvB;AAED,MAAI,KAAK,cAAc,KAAK,mBAAmB,KAAK,KAAK,aACvD,OAAM,KAAK,iCAAiC,KAAK,YAAY,KAAK,gBAAgB;EAGpF,MAAM,SAAS,0BAA0B,aAAa;EACtD,MAAM,gBAAgB,OAAO,OAAO;AACpC,OAAK,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;AAE/D,MAAI;GACF,MAAM,EAAE,SAAS,aAAa,MAAM,OAAO,KAAK;AAChD,SAAM;AACN,OAAI,KAAK,cAAc,KAAK,KAAK,cAAc;AAC7C,UAAM,KAAK,KAAK,aAAa,aAAa,KAAK,YAAY,SAAS;AACpE,gCAA4B,EAAE,YAAY,KAAK,YAAY,CAAC;;AAE9D,OAAI,KAAK,QAAQ,QAAS,QAAO;AAEjC,OAAI,gBAAgB;AAClB,QAAI,CAAC,QAAQ,QAAQ;AACnB,SAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,sDAAsD;AACtF,YAAO;;AAET,WAAO,QAAQ;;AAEjB,UAAO;WACA,GAAG;AACV,OAAI,KAAK,QAAS,OAAM;GACxB,MAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;AACtD,OAAI,KAAK;IAAE,KAAK;IAAG,OAAO,KAAK;IAAO,cAAc;IAAK,EAAE,wBAAwB,MAAM;AACzF,UAAO;YACC;AACR,QAAK,QAAQ,oBAAoB,SAAS,QAAQ;;;CAItD,MAAc,iCACZ,YACA,UACe;EACf,MAAM,QAAQ,KAAK,KAAK;AACxB,MAAI,CAAC,MAAO;AACZ,QAAM,MAAM,sBAAsB,WAAW;AAC7C,QAAM,MAAM,eAAe,YAAY;GACrC,aAAa;GACb,uBAAuB;GACvB,kBAAkB,SAAS;GAC3B,eAAe,SAAS;GACxB,sBAAsB,SAAS;GAC/B,iBAAiB,SAAS;GAC1B,oBAAoB,SAAS;GAC7B,MAAM,SAAS;GACf,MAAM,CAAC,qBAAqB,SAAS,qBAAqB;GAC3D,CAAC;;;AAIN,SAAS,mBAAmB,UAAoG;AAC9H,QAAO,SAAS,KAAK,YAAY,gBAAgB,QAAQ,CAAC;;AAG5D,SAAS,wBACP,WACA,gBACU;CAEV,MAAM,YADO,aAAa,UAAU,SAAS,IAAI,YAAY,CAAC,GAAG,uBAAuB,EAErF,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAC5B,QAAQ,MAAM,EAAE,SAAS,EAAE,CAC3B,QAAQ,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;AAChD,KAAI,kBAAkB,CAAC,SAAS,SAAA,oBAAqC,CACnE,UAAS,KAAK,4BAA4B;AAE5C,QAAO,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;;AAG/B,SAAS,YAAY,QAAgB,MAAmC,YAA6B;CACnG,MAAM,QAAkB,EAAE;AAC1B,KAAI,KAAK,cAAc,MAAM,CAAE,OAAM,KAAK,KAAK,aAAa,MAAM,CAAC;AACnE,KAAI,KAAK,MAAO,OAAM,KAAK,eAAe,KAAK,QAAQ;AACvD,KAAI,KAAK,MAAO,OAAM,KAAK,mBAAmB,KAAK,QAAQ;AAC3D,OAAM,KAAK,OAAO;AAClB,KAAI,WACF,OAAM,KACJ;EACE;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK,CACb;AAEH,QAAO,MAAM,KAAK,OAAO;;AAG3B,SAAS,wBAAwB,KAA0C;AACzE,KAAI;AACF,SAAO,KAAK;UACL,GAAG;AACV,MAAI,KAAK,EAAE,KAAK,GAAG,EAAE,2CAA2C;AAChE,SAAO;;;AAIX,SAAS,0BACP,WAC0B;CAC1B,MAAM,OAAO,WAAW,EAAE,QAAQ,UAAU,UAAU;AACtD,KAAI,SAAS,SAAS,SAAS,WAAW,SAAS,OAAQ,QAAO;AAClE,QAAO;;AAGT,SAAS,sBAAsB,OAWL;AACxB,SAAQ,MAAM,MAAd;EACE,KAAK,aACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,MAAM,MAAM,QAAQ,EAAE;GACvB;EACH,KAAK,WACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,SAAS,QAAQ,MAAM,QAAQ;GAC/B,eAAe,MAAM;GACrB,OAAO,MAAM;GACd;EACH,KAAK,YACH,QAAO;GACL,MAAM;GACN,OAAO,MAAM,SAAS;GACtB,KAAK,MAAM,OAAO;GACnB;EACH,KAAK,aACH,QAAO;GAAE,MAAM;GAAc,OAAO,MAAM,SAAS;GAAI;EACzD,KAAK,iBACH,QAAO;GAAE,MAAM;GAAkB,OAAO,MAAM,SAAS;GAAI;EAC7D,QACE,QAAO;GAAE,MAAM;GAAc,OAAO;GAAI"}

package/dist/src/agent/workflow/types.d.ts

@@ -88,6 +88,7 @@ export interface WorkflowAgentSnapshot {
     streamText?: string;
 }
 export interface WorkflowSnapshot {
+    runId?: string;
     name: string;
     description?: string;
     phases: string[];
@@ -118,6 +119,15 @@ export interface SubagentRunOptions<T = unknown> {
     rethrow?: boolean;
     /** Hint about which phase this agent belongs to (passed through for logging). */
     phase?: string;
+    /** Persistent hidden session for this workflow subagent. */
+    sessionKey?: string;
+    sessionMetadata?: {
+        parentSessionKey?: string;
+        workflowRunId: string;
+        workflowDefinitionId: string;
+        workflowAgentId: string;
+        workflowAgentLabel: string;
+    };
     /** Live progress from the child agent loop (workflow tool binds per agent id). */
     onProgress?: (event: SubagentProgressEvent) => void;
     /** Pre-bound capture for structured output (internal: created by the adapter when schema present). */

package/dist/src/auth/credentials.js

@@ -16,13 +16,14 @@ async function resolveApiKey(provider, options) {
 async function hasCredentials(provider, options) {
 	return getCredentialResolver(options).hasCredentials(provider);
 }
-var log, CredentialResolver;
+var log, warnedExpiredOAuthTokens, CredentialResolver;
 var init_credentials = __esmMin((() => {
 	init_write_file_atomic();
 	init_logger();
 	init_env_keys();
 	init_paths();
 	log = createLogger("Credentials");
+	warnedExpiredOAuthTokens = /* @__PURE__ */ new Set();
 	CredentialResolver = class {
 		credentialsDir;
 		agentId;
@@ -163,10 +164,14 @@ var init_credentials = __esmMin((() => {
 			const token = await this.loadOAuthTokenRecord(provider);
 			if (!token) return null;
 			if (token.expiresAt && token.expiresAt < Date.now()) {
-				log.warn({
-					provider,
-					expiresAt: token.expiresAt
-				}, "OAuth token is expired");
+				const warnKey = `${provider}:${token.expiresAt}`;
+				if (!warnedExpiredOAuthTokens.has(warnKey)) {
+					warnedExpiredOAuthTokens.add(warnKey);
+					log.warn({
+						provider,
+						expiresAt: token.expiresAt
+					}, "OAuth token is expired");
+				}
 				return null;
 			}
 			return token;

package/dist/src/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm, readdir } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * List persisted OAuth tokens without exposing access/refresh values.\n   */\n  async listOAuthTokens(): Promise<Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }>> {\n    const oauthDir = join(this.credentialsDir, 'oauth');\n    let files: string[];\n    try {\n      files = await readdir(oauthDir);\n    } catch {\n      return [];\n    }\n\n    const tokens: Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }> = [];\n    for (const file of files) {\n      if (!file.endsWith('.json')) continue;\n      try {\n        const content = await readFile(join(oauthDir, file), 'utf-8');\n        const token = JSON.parse(content) as OAuthToken;\n        if (token.type !== 'oauth' || !token.provider) continue;\n        const { access, refresh, ...safe } = token;\n        tokens.push({ ...safe, hasAccess: Boolean(access?.trim()), hasRefresh: Boolean(refresh?.trim()) });\n      } catch {\n        continue;\n      }\n    }\n    return tokens.sort((a, b) => a.provider.localeCompare(b.provider));\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const file = await this.loadAuthProfilesFile();\n    await mkdir(dirname(resolveAuthProfilesPath()), { recursive: true });\n    for (const [profileId, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        delete file.profiles[profileId];\n      }\n    }\n    await writeTextAtomic(resolveAuthProfilesPath(), JSON.stringify(file, null, 2));\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AA2cA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBAxdsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,QAAI,KAAK;KAAE;KAAU,WAAW,MAAM;KAAW,EAAE,yBAAyB;AAC5E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,kBAAwH;GAC5H,MAAM,WAAW,KAAK,KAAK,gBAAgB,QAAQ;GACnD,IAAI;AACJ,OAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;WACzB;AACN,WAAO,EAAE;;GAGX,MAAM,SAAsG,EAAE;AAC9G,QAAK,MAAM,QAAQ,OAAO;AACxB,QAAI,CAAC,KAAK,SAAS,QAAQ,CAAE;AAC7B,QAAI;KACF,MAAM,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,EAAE,QAAQ;KAC7D,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,SAAI,MAAM,SAAS,WAAW,CAAC,MAAM,SAAU;KAC/C,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;AACrC,YAAO,KAAK;MAAE,GAAG;MAAM,WAAW,QAAQ,QAAQ,MAAM,CAAC;MAAE,YAAY,QAAQ,SAAS,MAAM,CAAC;MAAE,CAAC;YAC5F;AACN;;;AAGJ,UAAO,OAAO,MAAM,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,SAAS,CAAC;;;;;EAMpE,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,SAAM,MAAM,QAAQ,yBAAyB,CAAC,EAAE,EAAE,WAAW,MAAM,CAAC;AACpE,QAAK,MAAM,CAAC,WAAW,YAAY,OAAO,QAAQ,KAAK,SAAS,CAC9D,KAAI,QAAQ,aAAa,mBACvB,QAAO,KAAK,SAAS;AAGzB,SAAM,gBAAgB,yBAAyB,EAAE,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC/E,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm, readdir } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\nconst warnedExpiredOAuthTokens = new Set<string>();\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      const warnKey = `${provider}:${token.expiresAt}`;\n      if (!warnedExpiredOAuthTokens.has(warnKey)) {\n        warnedExpiredOAuthTokens.add(warnKey);\n        log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      }\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * List persisted OAuth tokens without exposing access/refresh values.\n   */\n  async listOAuthTokens(): Promise<Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }>> {\n    const oauthDir = join(this.credentialsDir, 'oauth');\n    let files: string[];\n    try {\n      files = await readdir(oauthDir);\n    } catch {\n      return [];\n    }\n\n    const tokens: Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }> = [];\n    for (const file of files) {\n      if (!file.endsWith('.json')) continue;\n      try {\n        const content = await readFile(join(oauthDir, file), 'utf-8');\n        const token = JSON.parse(content) as OAuthToken;\n        if (token.type !== 'oauth' || !token.provider) continue;\n        const { access, refresh, ...safe } = token;\n        tokens.push({ ...safe, hasAccess: Boolean(access?.trim()), hasRefresh: Boolean(refresh?.trim()) });\n      } catch {\n        continue;\n      }\n    }\n    return tokens.sort((a, b) => a.provider.localeCompare(b.provider));\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const file = await this.loadAuthProfilesFile();\n    await mkdir(dirname(resolveAuthProfilesPath()), { recursive: true });\n    for (const [profileId, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        delete file.profiles[profileId];\n      }\n    }\n    await writeTextAtomic(resolveAuthProfilesPath(), JSON.stringify(file, null, 2));\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAgdA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBA7dsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AACjC,4CAA2B,IAAI,KAAa;AA8CrC,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;IACnD,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM;AACrC,QAAI,CAAC,yBAAyB,IAAI,QAAQ,EAAE;AAC1C,8BAAyB,IAAI,QAAQ;AACrC,SAAI,KAAK;MAAE;MAAU,WAAW,MAAM;MAAW,EAAE,yBAAyB;;AAE9E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,kBAAwH;GAC5H,MAAM,WAAW,KAAK,KAAK,gBAAgB,QAAQ;GACnD,IAAI;AACJ,OAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;WACzB;AACN,WAAO,EAAE;;GAGX,MAAM,SAAsG,EAAE;AAC9G,QAAK,MAAM,QAAQ,OAAO;AACxB,QAAI,CAAC,KAAK,SAAS,QAAQ,CAAE;AAC7B,QAAI;KACF,MAAM,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,EAAE,QAAQ;KAC7D,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,SAAI,MAAM,SAAS,WAAW,CAAC,MAAM,SAAU;KAC/C,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;AACrC,YAAO,KAAK;MAAE,GAAG;MAAM,WAAW,QAAQ,QAAQ,MAAM,CAAC;MAAE,YAAY,QAAQ,SAAS,MAAM,CAAC;MAAE,CAAC;YAC5F;AACN;;;AAGJ,UAAO,OAAO,MAAM,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,SAAS,CAAC;;;;;EAMpE,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,SAAM,MAAM,QAAQ,yBAAyB,CAAC,EAAE,EAAE,WAAW,MAAM,CAAC;AACpE,QAAK,MAAM,CAAC,WAAW,YAAY,OAAO,QAAQ,KAAK,SAAS,CAC9D,KAAI,QAAQ,aAAa,mBACvB,QAAO,KAAK,SAAS;AAGzB,SAAM,gBAAgB,yBAAyB,EAAE,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC/E,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}

package/dist/src/browser/actions/extension-registry-bridge.js

@@ -1,7 +1,7 @@
-import { checkWebsiteBlocklist } from "../../agent/tools/url-safety.js";
 import { resolveBrowserCommandTimeoutMs } from "../browser-command-timeout.js";
 import { assertBrowserUrlAllowed, checkPostRedirectUrl, containsApiKeyPattern } from "../url-policy.js";
 import { truncateSnapshotAtBoundary } from "../snapshot-helpers.js";
+import { checkWebsiteBlocklist } from "../../agent/tools/url-safety.js";
 //#region src/browser/actions/extension-registry-bridge.ts
 /**
 * Runs browser registry actions against the Chrome Extension bridge (no Playwright page).

package/dist/src/browser/actions/registry.js

@@ -1,10 +1,10 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { checkWebsiteBlocklist } from "../../agent/tools/url-safety.js";
 import { resolveBrowserCommandTimeoutMs } from "../browser-command-timeout.js";
+import { humanizedClick, humanizedFill, humanizedScroll } from "../humanize.js";
 import { assertBrowserUrlAllowed, checkPostRedirectUrl, containsApiKeyPattern } from "../url-policy.js";
 import { truncateSnapshotAtBoundary } from "../snapshot-helpers.js";
-import { humanizedClick, humanizedFill, humanizedScroll } from "../humanize.js";
+import { checkWebsiteBlocklist } from "../../agent/tools/url-safety.js";
 //#region src/browser/actions/registry.ts
 init_logger();
 const log = createLogger("BrowserActionRegistry");

package/dist/src/browser/cdp-local-launcher.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { loadPlaywrightCoreModule } from "./providers/playwright-doctor.js";
 import { pickFreePort } from "./free-port.js";
+import { loadPlaywrightCoreModule } from "./providers/playwright-doctor.js";
 import { existsSync } from "node:fs";
 import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";

package/dist/src/browser/index.js

@@ -1,13 +1,13 @@
-import { BrowserManager } from "./manager.js";
 import { resolveBrowserBackendFromConfig } from "./backend-from-config.js";
 import { resolveBrowserCommandTimeoutMs } from "./browser-command-timeout.js";
+import { CdpSupervisor } from "./cdp-supervisor.js";
+import { generateMousePath, generateScrollPlan, generateTypingPlan, humanizedClick, humanizedFill, humanizedPress, humanizedScroll, resolveHumanConfig } from "./humanize.js";
+import { BrowserManager } from "./manager.js";
 import { BrowserNotReadyError, buildBrowserSetupDeepLink, checkBrowserReadiness } from "./readiness.js";
 import { assertBrowserUrlAllowed, checkPostRedirectUrl, containsApiKeyPattern, isAlwaysBlockedUrl } from "./url-policy.js";
-import { CdpSupervisor } from "./cdp-supervisor.js";
 import { snapshotSummaryHeader, truncateSnapshotAtBoundary } from "./snapshot-helpers.js";
 import { checkBotDetection, cleanupOrphanProcesses, startTracing, stopTracing } from "./session-lifecycle.js";
 import { BrowserBackSchema, BrowserCdpSchema, BrowserClickSchema, BrowserCloseSchema, BrowserConsoleSchema, BrowserDialogSchema, BrowserGetImagesSchema, BrowserNavigateSchema, BrowserPressSchema, BrowserScreenshotSchema, BrowserScrollSchema, BrowserSnapshotSchema, BrowserTypeSchema, BrowserVisionSchema } from "./schemas.js";
-import { generateMousePath, generateScrollPlan, generateTypingPlan, humanizedClick, humanizedFill, humanizedPress, humanizedScroll, resolveHumanConfig } from "./humanize.js";
 import { WEBDRIVER_OVERRIDE_SCRIPT, buildLocalStealthArgs, buildStealthArgs, generateFingerprintSeed, makeExecutable, removeQuarantineAttr } from "./stealth.js";
 import { createBrowserActionRegistry } from "./actions/registry.js";
 import { parseBrowserPipeline } from "./pipeline/schema.js";

package/dist/src/browser/providers/browser-ext-install.js

@@ -8,8 +8,8 @@ import { resolvePackageRoot } from "../../infra/update-check.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { readFile, readdir, rm } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
 //#region src/browser/providers/browser-ext-install.ts
 /**
 * Install bundled Chrome extension artifacts into {resolveBinDir()}/browser-ext/.

package/dist/src/browser/providers/cloakbrowser.js

@@ -2,9 +2,9 @@ import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_paths, resolveBinDir } from "../../config/paths.js";
 import { assertCacheDir, expandHome, init_cache_dir_policy } from "../cache-dir-policy.js";
+import { pickFreePort } from "../free-port.js";
 import { loadPlaywrightCoreModule } from "./playwright-doctor.js";
 import { WEBDRIVER_OVERRIDE_SCRIPT, buildStealthArgs, filterCloakBrowserExtraArgs, generateFingerprintSeed, makeExecutable, removeQuarantineAttr } from "../stealth.js";
-import { pickFreePort } from "../free-port.js";
 import { createHash } from "node:crypto";
 import { createReadStream, createWriteStream } from "node:fs";
 import { mkdir, mkdtemp, rm, stat } from "node:fs/promises";