@yanlinglabs/winter-runtime-sdk 0.0.1 → 0.0.3

package/dist/index.js

@@ -1,421 +1,48 @@
+import {
+  EXECUTION_INDIRECTION_ENV_NAMES,
+  EXECUTION_INDIRECTION_ENV_PREFIXES,
+  NotImplementedYet,
+  OFFICIAL_DISCLOSURES,
+  OfficialConfigurationError,
+  OfficialConnectionError,
+  OfficialContainmentBreachError,
+  OfficialExecutableNotFoundError,
+  OfficialInvalidResumeError,
+  OfficialKilledError,
+  OfficialMcpError,
+  OfficialNonzeroExitError,
+  OfficialStdoutUnterminatedError,
+  PINNED_OFFICIAL_RUNTIME,
+  RuntimeHandoffRequiredError,
+  RuntimeLaunchInputError,
+  RuntimeSdkDisposedError,
+  RuntimeSdkError,
+  RuntimeSdkVersionError,
+  TRAFFIC_OPT_OUT_VARIABLES,
+  TRAFFIC_OPT_OUT_VARIABLE_NAMES,
+  UnaddressableEntryError,
+  VENDOR_HOME_SEGMENT_RE,
+  authVariableSetKey,
+  buildOfficialChildEnv,
+  containmentDecisionFor,
+  containmentDispositions,
+  containmentPaths,
+  fetchAuthCredentials,
+  isExecutionIndirectionVariable,
+  minimalOsEnvironmentFrom,
+  officialBranchLabel,
+  officialDisallowedTools,
+  officialToolAliases,
+  resolveSavedApprovalDisposition,
+  targetsForbiddenPath
+} from "./index-mfd2rg7x.js";
+
 // src/index.ts
 export * from "@yanlinglabs/winter-agent-sdk";
 
-// src/errors.ts
-class RuntimeSdkError extends Error {
-  constructor(message, options) {
-    super(message, options);
-    this.name = new.target.name;
-    const capture = Error.captureStackTrace;
-    if (typeof capture === "function")
-      capture(this, new.target);
-  }
-}
-
-class RuntimeHandoffRequiredError extends RuntimeSdkError {
-  from;
-  to;
-  address;
-  constructor(args) {
-    super(`winter-runtime-sdk: ${args.address} is persisted on the ${args.from} runtime and this query asks for ${args.to}. A runtime change mid-session is \`sdk.handoff(session, "${args.to}")\` — WS-05 §12's certified transfer — or a visible fork (\`forkSession\`); serving the new runtime on the old transcript would be the silent rewrite D13 forbids`);
-    this.from = args.from;
-    this.to = args.to;
-    this.address = args.address;
-  }
-}
-
-class RuntimeLaunchInputError extends RuntimeSdkError {
-  field;
-  constructor(args) {
-    super(`winter-runtime-sdk: the official leg needs \`${args.field}\` — ${args.reason}`);
-    this.field = args.field;
-  }
-}
-
-class UnaddressableEntryError extends RuntimeSdkError {
-  address;
-  constructor(address) {
-    super(`winter-runtime-sdk: ${JSON.stringify(address)} is not a canonical runtime address, so a directory row under it would be listed to the model by ListAgents and refused by every resolution door (WS-15 §6.1). Build it with serializeRuntimeAddress(buildSessionAddress(<winter session id>)) — the canonical forms are "session:<id>" and "agent:<parent>:<child>"`);
-    this.address = address;
-  }
-}
-
-class RuntimeSdkVersionError extends RuntimeSdkError {
-  expected;
-  actual;
-  constructor(args) {
-    super(args.message ?? `winter-runtime-sdk: version matrix refuses this peer set — expected ${args.expected}, got ${args.actual}`);
-    this.expected = args.expected;
-    this.actual = args.actual;
-  }
-}
-
-class NotImplementedYet extends RuntimeSdkError {
-  lane;
-  seam;
-  constructor(lane, seam) {
-    super(`winter-runtime-sdk: ${seam} is not implemented yet — Phase 7b ${lane} owns it (the spine ships the signature, not the behaviour)`);
-    this.lane = lane;
-    this.seam = seam;
-  }
-}
-
-class RuntimeSdkDisposedError extends RuntimeSdkError {
-  constructor(method) {
-    super(`winter-runtime-sdk: ${method}() was called after dispose()`);
-  }
-}
-
 // src/door.ts
 import { buildChildAddress, buildSessionAddress, serializeRuntimeAddress } from "@yanlinglabs/winter-agent-sdk/messaging";
-
-// src/official/branding.ts
-function officialBranchLabel(brand) {
-  return `${brand.processLabel}-claude-agent`;
-}
-
-// src/official/aliases.ts
-import { mcpToolName } from "@yanlinglabs/winter-agent-sdk";
-
-// src/native-args.ts
-import { validateToField } from "@yanlinglabs/winter-agent-sdk/messaging";
-var SEND_MESSAGE_TO_MAX = 300;
-var SEND_MESSAGE_SUMMARY_MAX = 200;
-var LIST_AGENTS_FIELD_MAX = 256;
-var NATIVE_SEND_MESSAGE_SCHEMA = {
-  type: "object",
-  properties: {
-    to: { type: "string", maxLength: SEND_MESSAGE_TO_MAX, description: 'no newline, no "*" broadcast' },
-    message: { type: "string", description: 'required; defaults "" for pure idle subscription' },
-    summary: { type: "string", maxLength: SEND_MESSAGE_SUMMARY_MAX },
-    notify_when_idle: { type: "boolean", description: "one-shot; main conversation -> same-machine session only" }
-  },
-  required: ["to", "message"]
-};
-var NATIVE_LIST_AGENTS_SCHEMA = {
-  type: "object",
-  properties: {
-    channel: { type: "string", maxLength: LIST_AGENTS_FIELD_MAX, description: "reserved" },
-    q: { type: "string", maxLength: LIST_AGENTS_FIELD_MAX, description: "reserved" }
-  }
-};
-var NATIVE_LIST_AGENTS_OUTPUT_SCHEMA = {
-  type: "object",
-  properties: { listing: { type: "string" } },
-  required: ["listing"]
-};
-var SEND_MESSAGE_FIELDS = new Set(Object.keys(NATIVE_SEND_MESSAGE_SCHEMA.properties));
-var LIST_AGENTS_FIELDS = new Set(Object.keys(NATIVE_LIST_AGENTS_SCHEMA.properties));
-function acceptNativeSendMessageArgs(input) {
-  if (typeof input !== "object" || input === null)
-    return { ok: false, reason: "expected an object of SendMessage arguments" };
-  const record = input;
-  const extra = Object.keys(record).filter((key) => !SEND_MESSAGE_FIELDS.has(key));
-  if (extra.length > 0)
-    return { ok: false, reason: `unknown argument(s): ${extra.join(", ")}` };
-  const to = record["to"];
-  const validated = validateToField(to);
-  if (!validated.ok)
-    return { ok: false, reason: validated.message };
-  const message = record["message"];
-  if (typeof message !== "string")
-    return { ok: false, reason: "`message` is required and must be a string (an empty string is a pure idle subscription)" };
-  const summary = record["summary"];
-  if (summary !== undefined && (typeof summary !== "string" || summary.length > SEND_MESSAGE_SUMMARY_MAX)) {
-    return { ok: false, reason: `\`summary\` must be a string of at most ${SEND_MESSAGE_SUMMARY_MAX} characters` };
-  }
-  const notify = record["notify_when_idle"];
-  if (notify !== undefined && typeof notify !== "boolean")
-    return { ok: false, reason: "`notify_when_idle` must be a boolean" };
-  return {
-    ok: true,
-    args: {
-      to,
-      message,
-      ...summary === undefined ? {} : { summary },
-      ...notify === undefined ? {} : { notify_when_idle: notify }
-    }
-  };
-}
-function acceptNativeListAgentsArgs(input) {
-  if (input === undefined || input === null)
-    return { ok: true, args: {} };
-  if (typeof input !== "object")
-    return { ok: false, reason: "expected an object of ListAgents arguments" };
-  const record = input;
-  const extra = Object.keys(record).filter((key) => !LIST_AGENTS_FIELDS.has(key));
-  if (extra.length > 0)
-    return { ok: false, reason: `unknown argument(s): ${extra.join(", ")}` };
-  for (const field of ["channel", "q"]) {
-    const value = record[field];
-    if (value !== undefined && (typeof value !== "string" || value.length > LIST_AGENTS_FIELD_MAX)) {
-      return { ok: false, reason: `\`${field}\` must be a string of at most ${LIST_AGENTS_FIELD_MAX} characters` };
-    }
-  }
-  return {
-    ok: true,
-    args: {
-      ...typeof record["channel"] === "string" ? { channel: record["channel"] } : {},
-      ...typeof record["q"] === "string" ? { q: record["q"] } : {}
-    }
-  };
-}
-
-// src/official/aliases.ts
-var ALIASED_BUILTINS = [
-  { builtin: "SendMessage", tool: "send_message" },
-  { builtin: "ListAgents", tool: "list_agents" }
-];
-function officialToolAliases(brand) {
-  return Object.fromEntries(ALIASED_BUILTINS.map(({ builtin, tool }) => [builtin, mcpToolName(brand, tool)]));
-}
-function aliasTargetFor(builtin, brand) {
-  const entry = ALIASED_BUILTINS.find((candidate) => candidate.builtin === builtin);
-  if (entry === undefined)
-    throw new TypeError(`not an aliased builtin: ${String(builtin)}`);
-  return mcpToolName(brand, entry.tool);
-}
-function aliasDenyNames(builtin, brand) {
-  return [builtin, aliasTargetFor(builtin, brand)];
-}
-
-// src/official/errors.ts
-class OfficialBranchError extends RuntimeSdkError {
-  crashClass;
-  branch;
-  constructor(message, branchLabel, options) {
-    super(message, options);
-    this.branch = branchLabel;
-  }
-}
-
-class OfficialConfigurationError extends OfficialBranchError {
-  code = "official_configuration_invalid";
-  winterClass = "WinterSDKError";
-  option;
-  constructor(args) {
-    super(`${args.branchLabel}: ${args.option} — ${args.reason}`, args.branchLabel);
-    this.option = args.option;
-  }
-}
-
-class OfficialExecutableNotFoundError extends OfficialBranchError {
-  code = "official_executable_not_found";
-  winterClass = "CLIConnectionError";
-  crashClass = "executable-not-found";
-  path;
-  constructor(args) {
-    super(`${args.branchLabel}: the vendored runtime was not found at ${args.path}`, args.branchLabel, args.cause === undefined ? undefined : { cause: args.cause });
-    this.path = args.path;
-  }
-}
-
-class OfficialConnectionError extends OfficialBranchError {
-  code = "official_connection_failure";
-  winterClass = "CLIConnectionError";
-  crashClass = "connection-failure";
-  constructor(args) {
-    super(`${args.branchLabel}: the runtime connection failed — ${args.reason}`, args.branchLabel, args.cause === undefined ? undefined : { cause: args.cause });
-  }
-}
-class OfficialNonzeroExitError extends OfficialBranchError {
-  code = "official_nonzero_exit";
-  winterClass = "ProcessError";
-  crashClass = "nonzero-exit";
-  exitCode;
-  signal;
-  stderrTail;
-  constructor(args) {
-    super(`${args.branchLabel}: the runtime exited with code ${String(args.exitCode)}${args.signal === null ? "" : ` (signal ${args.signal})`}`, args.branchLabel);
-    this.exitCode = args.exitCode;
-    this.signal = args.signal;
-    this.stderrTail = args.stderrTail;
-  }
-}
-
-class OfficialKilledError extends OfficialBranchError {
-  code = "official_killed";
-  winterClass = "ProcessError";
-  crashClass = "killed";
-  signal;
-  constructor(args) {
-    super(`${args.branchLabel}: the runtime was killed with ${args.signal} — ${args.reason}`, args.branchLabel);
-    this.signal = args.signal;
-  }
-}
-
-class OfficialContainmentBreachError extends OfficialBranchError {
-  code = "official_containment_breach";
-  winterClass = "WinterSDKError";
-  tool;
-  created;
-  removed;
-  retained;
-  constructor(args) {
-    super(`${args.branchLabel}: ${args.toolName} created ${args.created.length} vendor-named path(s) that the pre-hoc scan did not see; ${args.removed.length} removed, ${args.retained.length} retained (WS-14 §8)`, args.branchLabel);
-    this.tool = args.toolName;
-    this.created = [...args.created];
-    this.removed = [...args.removed];
-    this.retained = [...args.retained];
-  }
-}
-
-class OfficialStdoutUnterminatedError extends OfficialBranchError {
-  code = "official_stdout_unterminated";
-  winterClass = "ProcessError";
-  crashClass = "stdout-unterminated";
-  graceMs;
-  constructor(args) {
-    super(`${args.branchLabel}: the runtime exited but its stdout did not close within ${args.graceMs}ms; the exit was forwarded on the grace timer`, args.branchLabel);
-    this.graceMs = args.graceMs;
-  }
-}
-class OfficialInvalidResumeError extends OfficialBranchError {
-  code = "official_invalid_resume";
-  winterClass = "WinterSDKError";
-  constructor(args) {
-    super(`${args.branchLabel}: invalid resume/fork — ${args.reason}`, args.branchLabel);
-  }
-}
-
-// src/official/containment.ts
-var FORBIDDEN_TARGETS = {
-  instructionsFile: "CLAUDE.md",
-  projectDir: ".claude",
-  userPlansDir: ".claude/plans"
-};
-function containmentPaths(brand) {
-  return {
-    worktrees: `${brand.projectDirName}/worktrees`,
-    workflows: `${brand.projectDirName}/workflows`,
-    plans: `${brand.projectDirName}/plans`,
-    localSettings: `${brand.projectDirName}/settings.local.json`
-  };
-}
-function resolveSavedApprovalDisposition(policy, branchLabel) {
-  const disposition = policy.savedWebFetchApprovals ?? "disable";
-  if (disposition === "redirect") {
-    throw new OfficialConfigurationError({
-      option: "containment.savedWebFetchApprovals",
-      reason: "`redirect` cannot be honoured on this branch: nothing routes a durable approval anywhere, so passing it through means the RUNTIME writes its own project settings file — measured, with an ordinary broker. §8 denies that write either way, so this branch supports `disable` until a host replacement exists (WS-14 §8/§16 q2)",
-      branchLabel
-    });
-  }
-  return disposition;
-}
-function officialDisallowedTools(policy = {}, brand) {
-  const denied = ["CronCreate"];
-  if (policy.deniedAliasedBuiltins !== undefined && brand !== undefined) {
-    for (const builtin of policy.deniedAliasedBuiltins)
-      denied.push(...aliasDenyNames(builtin, brand));
-  }
-  return denied;
-}
-var norm = (path) => path.replace(/\\/g, "/").replace(/\/+/g, "/");
-var fold = (value) => value.normalize("NFKC").toLowerCase();
-var FORBIDDEN_PROJECT_DIR = fold(FORBIDDEN_TARGETS.projectDir);
-var FORBIDDEN_INSTRUCTIONS_FILE = fold(FORBIDDEN_TARGETS.instructionsFile);
-function targetsForbiddenPath(rawPath) {
-  const segments = norm(rawPath).split("/").filter((segment) => segment.length > 0).map(fold);
-  const index = segments.indexOf(FORBIDDEN_PROJECT_DIR);
-  if (index >= 0) {
-    return { forbidden: true, target: segments[index + 1] === "plans" ? FORBIDDEN_TARGETS.userPlansDir : FORBIDDEN_TARGETS.projectDir };
-  }
-  if (segments[segments.length - 1] === FORBIDDEN_INSTRUCTIONS_FILE)
-    return { forbidden: true, target: FORBIDDEN_TARGETS.instructionsFile };
-  return { forbidden: false, target: "" };
-}
-var VENDOR_HOME_SEGMENT_RE = /(^|\/)\.claude(\/|$)/i;
-var PATH_FIELDS = [
-  "file_path",
-  "filePath",
-  "path",
-  "notebook_path",
-  "notebookPath",
-  "directory",
-  "dir",
-  "target_file",
-  "targetFile",
-  "file",
-  "plan_file_path",
-  "planFilePath"
-];
-var COMMAND_PROJECT_DIR_RE = /(?:^|[^A-Za-z0-9_.\\-])\.claude(?![A-Za-z0-9_-])/i;
-var COMMAND_INSTRUCTIONS_FILE_RE = /(?:^|[^A-Za-z0-9_\\-])claude\.md(?![A-Za-z0-9_.-])/i;
-function isTruthy(value) {
-  if (value === true)
-    return true;
-  if (typeof value === "number")
-    return value !== 0;
-  if (typeof value !== "string")
-    return false;
-  return ["true", "1", "yes", "on"].includes(value.trim().toLowerCase());
-}
-var WORKTREE_TOOLS = ["EnterWorktree", "ExitWorktree", "WorktreeCreate"];
-var AGENT_TOOLS = ["Task", "Agent"];
-var WORKFLOW_TOOLS = ["Workflow"];
-function containmentDecisionFor(toolName, input, policy = {}) {
-  const deny = (target, what) => ({
-    allow: false,
-    target,
-    reason: `${toolName} may not create or modify ${what}: this session runs on the product's own project layout, and the vendor-named path is redirected (WS-14 §8)`
-  });
-  for (const field of PATH_FIELDS) {
-    const value = input[field];
-    if (typeof value !== "string")
-      continue;
-    const hit = targetsForbiddenPath(value);
-    if (hit.forbidden)
-      return deny(hit.target, value);
-  }
-  for (const field of ["command", "script", "code"]) {
-    const value = input[field];
-    if (typeof value !== "string")
-      continue;
-    const command = value.normalize("NFKC");
-    if (COMMAND_PROJECT_DIR_RE.test(command))
-      return deny(FORBIDDEN_TARGETS.projectDir, value);
-    if (COMMAND_INSTRUCTIONS_FILE_RE.test(command))
-      return deny(FORBIDDEN_TARGETS.instructionsFile, value);
-    const unquoted = command.replace(/[\\'"`]/g, "");
-    if (COMMAND_PROJECT_DIR_RE.test(unquoted))
-      return deny(FORBIDDEN_TARGETS.projectDir, value);
-    if (COMMAND_INSTRUCTIONS_FILE_RE.test(unquoted))
-      return deny(FORBIDDEN_TARGETS.instructionsFile, value);
-  }
-  const paths = containmentPaths({ projectDirName: policy.projectDirName ?? "" });
-  if ((policy.worktrees ?? "deny") === "deny") {
-    if (WORKTREE_TOOLS.includes(toolName)) {
-      return {
-        allow: false,
-        target: `${FORBIDDEN_TARGETS.projectDir}/worktrees/`,
-        reason: `${toolName} writes the vendor's own worktree directory; on this branch worktrees belong under ${paths.worktrees || "the product's project directory"} and the host's schema-compatible replacement owns them (WS-14 §8)`
-      };
-    }
-    if (AGENT_TOOLS.includes(toolName) && String(input["isolation"] ?? "") === "worktree") {
-      return {
-        allow: false,
-        target: `${FORBIDDEN_TARGETS.projectDir}/worktrees/`,
-        reason: `an isolated agent worktree writes the vendor's own worktree directory; on this branch it belongs under ${paths.worktrees || "the product's project directory"} (WS-14 §8)`
-      };
-    }
-  }
-  if ((policy.workflows ?? "deny") === "deny" && WORKFLOW_TOOLS.includes(toolName)) {
-    return {
-      allow: false,
-      target: `${FORBIDDEN_TARGETS.projectDir}/workflows/`,
-      reason: `named workflow resolution reads the vendor's own workflows directory; on this branch workflows resolve under ${paths.workflows || "the product's project directory"} (WS-14 §8, D8)`
-    };
-  }
-  if (toolName === "CronCreate" && isTruthy(input["durable"])) {
-    return {
-      allow: false,
-      target: `${FORBIDDEN_TARGETS.projectDir}/scheduled_tasks.json`,
-      reason: "durable scheduled tasks are unavailable on this branch: the vendor's durable variant persists into its own project directory (WS-14 §8)"
-    };
-  }
-  return { allow: true };
-}
+import { transcriptSourceForSessionKey } from "@yanlinglabs/winter-agent-sdk/tools";
 
 // src/official/callbacks.ts
 var DURABLE_APPROVAL_DESTINATIONS = ["userSettings", "projectSettings", "localSettings"];
@@ -426,14 +53,14 @@ function createApprovalBridge(options) {
     const request = { toolName, input, ...rest };
     const containment = containmentDecisionFor(toolName, input, containmentPolicy);
     if (!containment.allow) {
-      const result = { behavior: "deny", message: containment.reason, toolUseID: request.toolUseID };
-      options.onDecision?.({ request, result, source: "containment-floor" });
-      return result;
+      const result2 = { behavior: "deny", message: containment.reason, toolUseID: request.toolUseID };
+      options.onDecision?.({ request, result: result2, source: "containment-floor" });
+      return result2;
     }
     if (options.mode === "dontAsk") {
-      const result = { behavior: "allow", updatedInput: input, toolUseID: request.toolUseID };
-      options.onDecision?.({ request, result, source: "dont-ask" });
-      return result;
+      const result2 = { behavior: "allow", updatedInput: input, toolUseID: request.toolUseID };
+      options.onDecision?.({ request, result: result2, source: "dont-ask" });
+      return result2;
     }
     const result = await options.broker(request);
     if (savedApprovals === "disable" && result.behavior === "allow" && result.updatedPermissions !== undefined) {
@@ -480,995 +107,8 @@ function createContainmentHooks(options) {
   return { PreToolUse: [{ hooks: [guard] }] };
 }
 
-// src/official/auth.ts
-var AUTH_FAMILY_VARIABLES = {
-  "api-key": ["ANTHROPIC_API_KEY"],
-  "console-oauth": ["ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL"],
-  bedrock: ["CLAUDE_CODE_USE_BEDROCK", "AWS_REGION", "AWS_PROFILE", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_BEARER_TOKEN_BEDROCK", "ANTHROPIC_BEDROCK_BASE_URL"],
-  vertex: ["CLAUDE_CODE_USE_VERTEX", "ANTHROPIC_VERTEX_PROJECT_ID", "CLOUD_ML_REGION", "GOOGLE_APPLICATION_CREDENTIALS", "ANTHROPIC_VERTEX_BASE_URL"],
-  "claude-oauth": [],
-  "local-none": []
-};
-var AUTH_SHAPED_RE = /^(?:ANTHROPIC_|AWS_|GOOGLE_|GCP_|AZURE_|CLOUD_ML_|VERTEX_|BEDROCK_|CLAUDE_(?:CODE_)?(?:USE_|SKIP_|HOST_|OAUTH_|SESSION_|BRIDGE_|LOCAL_|SECURESTORAGE_|IDENTITY_))|_(?:API_KEY|AUTH_TOKEN|TOKEN|SECRET|CREDENTIALS|CREDS|PASSWORD|PASSWD)$/;
-function isAuthShapedVariable(name) {
-  return AUTH_SHAPED_RE.test(name) || /_(?:API_KEY|AUTH_TOKEN|TOKEN|SECRET|CREDENTIALS|CREDS|PASSWORD|PASSWD)$/.test(name);
-}
-var ALL_AUTH_VARIABLES = Object.values(AUTH_FAMILY_VARIABLES).flat().filter((name, index, all) => all.indexOf(name) === index);
-var NEVER_INJECTED_AUTH_VARIABLES = ["CLAUDE_CODE_OAUTH_TOKEN"];
-function authVariableSetKey(selection) {
-  switch (selection.authFamily) {
-    case "cloud-credential-chain":
-      return selection.providerId.toLowerCase().includes("vertex") ? "vertex" : "bedrock";
-    case "custom":
-      return "custom";
-    default:
-      return selection.authFamily;
-  }
-}
-function allowedAuthVariables(selection) {
-  const key = authVariableSetKey(selection);
-  return key === "custom" ? undefined : AUTH_FAMILY_VARIABLES[key];
-}
-function validateAuthEnvironment(args) {
-  const names = Object.keys(args.credentials);
-  for (const name of names) {
-    if (NEVER_INJECTED_AUTH_VARIABLES.includes(name)) {
-      throw new OfficialConfigurationError({
-        option: `env.${name}`,
-        reason: "this credential is never injected on this branch: D14 gates the subscription-OAuth route, and its supported flow stores credentials inside the spool namespace instead (WS-14 §12, WS-01 §2.5)",
-        branchLabel: args.branchLabel
-      });
-    }
-  }
-  if (args.selection.authFamily === "claude-oauth") {
-    if (!args.gate.approved) {
-      throw new OfficialConfigurationError({
-        option: "selection.authFamily",
-        reason: "the Claude OAuth branch is ship-gated pending written approval (D14); the shippable branch uses API-key, cloud-credential-chain or gateway auth only",
-        branchLabel: args.branchLabel
-      });
-    }
-    if (names.length > 0) {
-      throw new OfficialConfigurationError({
-        option: "credentials",
-        reason: `the Claude OAuth family injects NO credential variable — its stored subscription state lives inside the spool namespace — but ${names.join(", ")} was supplied`,
-        branchLabel: args.branchLabel
-      });
-    }
-    return;
-  }
-  const allowed = allowedAuthVariables(args.selection);
-  if (allowed !== undefined) {
-    const stray = names.filter((name) => !allowed.includes(name));
-    if (stray.length > 0) {
-      throw new OfficialConfigurationError({
-        option: "credentials",
-        reason: `${stray.join(", ")} does not belong to the ${args.selection.authFamily} family (${allowed.length === 0 ? "which injects nothing" : allowed.join(", ")}); two families in one child are resolved by the runtime's own precedence order, not by the host's selection`,
-        branchLabel: args.branchLabel
-      });
-    }
-    if (allowed.includes("ANTHROPIC_AUTH_TOKEN") && names.includes("ANTHROPIC_BASE_URL") && !names.includes("ANTHROPIC_AUTH_TOKEN")) {
-      throw new OfficialConfigurationError({
-        option: "credentials.ANTHROPIC_BASE_URL",
-        reason: "a gateway endpoint without its bearer token leaves a stored subscription credential active behind the new endpoint (WS-14 §12's gateway caveat) — set the full pair or neither",
-        branchLabel: args.branchLabel
-      });
-    }
-  }
-}
-async function fetchAuthCredentials(args) {
-  const out = {};
-  for (const entry of args.plan) {
-    const material = await args.keychain.read(entry.ref);
-    if (material === undefined || material.length === 0) {
-      throw new OfficialConfigurationError({
-        option: `credentials.${entry.variable}`,
-        reason: `the host's keychain holds no material for this session's ${entry.ref.kind} credential reference; launching without it would fall through the runtime's precedence order to whatever the spool holds`,
-        branchLabel: args.branchLabel
-      });
-    }
-    out[entry.variable] = material;
-  }
-  return out;
-}
-
-// src/official/env-registry.ts
-var NON_CREDENTIAL_ENV_REGISTRY = [
-  "AI_AGENT",
-  "ALACRITTY_LOG",
-  "ALLOW_ANT_COMPUTER_USE_MCP",
-  "ANTHROPIC_BEDROCK_SERVICE_TIER",
-  "ANTHROPIC_BETAS",
-  "ANTHROPIC_CUSTOM_MODEL_OPTION",
-  "ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION",
-  "ANTHROPIC_CUSTOM_MODEL_OPTION_NAME",
-  "ANTHROPIC_DEFAULT_FABLE_MODEL",
-  "ANTHROPIC_DEFAULT_FABLE_MODEL_DESCRIPTION",
-  "ANTHROPIC_DEFAULT_FABLE_MODEL_NAME",
-  "ANTHROPIC_DEFAULT_HAIKU_MODEL",
-  "ANTHROPIC_DEFAULT_HAIKU_MODEL_DESCRIPTION",
-  "ANTHROPIC_DEFAULT_HAIKU_MODEL_NAME",
-  "ANTHROPIC_DEFAULT_MODEL",
-  "ANTHROPIC_DEFAULT_OPUS_MODEL",
-  "ANTHROPIC_DEFAULT_OPUS_MODEL_DESCRIPTION",
-  "ANTHROPIC_DEFAULT_OPUS_MODEL_NAME",
-  "ANTHROPIC_DEFAULT_SONNET_MODEL",
-  "ANTHROPIC_DEFAULT_SONNET_MODEL_DESCRIPTION",
-  "ANTHROPIC_DEFAULT_SONNET_MODEL_NAME",
-  "ANTHROPIC_FEDERATION_RULE_ID",
-  "ANTHROPIC_FOUNDRY_RESOURCE",
-  "ANTHROPIC_GOOGLE_CLOUD_LOCATION",
-  "ANTHROPIC_MODEL",
-  "ANTHROPIC_SMALL_FAST_MODEL",
-  "ANT_OTEL_EXPORTER_OTLP_PROTOCOL",
-  "ANT_OTEL_LOGS_EXPORTER",
-  "ANT_OTEL_METRICS_EXPORTER",
-  "ANT_OTEL_RESOURCE_ATTRIBUTES",
-  "ANT_OTEL_TRACES_EXPORTER",
-  "API_FORCE_IDLE_TIMEOUT",
-  "API_TIMEOUT_MS",
-  "AWS_CONFIG_FILE",
-  "AWS_EXECUTION_ENV",
-  "AWS_LAMBDA_FUNCTION_NAME",
-  "AWS_ROLE_ARN",
-  "AZURE_FUNCTIONS_ENVIRONMENT",
-  "BASH_ENV",
-  "BASH_MAX_OUTPUT_LENGTH",
-  "BAT_THEME",
-  "BIGINT_FORMAT_RANGES",
-  "BUN_CHROME_PATH",
-  "BUN_CONFIG_FILE",
-  "BUN_INSTALL",
-  "CARGO_HOME",
-  "CCR_ENABLE_BUNDLE",
-  "CCR_FORCE_BUNDLE",
-  "CCR_ON_BRANCH_DEFAULT_GUARD",
-  "CF_PAGES",
-  "CLAUDE_AFK_COUNTDOWN_MS",
-  "CLAUDE_AFK_TIMEOUT_MS",
-  "CLAUDE_AFTER_LAST_COMPACT",
-  "CLAUDE_AGENTS_SELECT",
-  "CLAUDE_AGENT_SDK_CLIENT_APP",
-  "CLAUDE_AGENT_SDK_DISABLE_BUILTIN_AGENTS",
-  "CLAUDE_AGENT_SDK_MCP_NO_PREFIX",
-  "CLAUDE_AGENT_SDK_VERSION",
-  "CLAUDE_ASYNC_AGENT_STALL_TIMEOUT_MS",
-  "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE",
-  "CLAUDE_AUTO_BACKGROUND_TASKS",
-  "CLAUDE_AX_PREPARK_MS",
-  "CLAUDE_AX_SCREEN_READER",
-  "CLAUDE_AX_STARTUP_QUIET_MS",
-  "CLAUDE_BG_BACKEND",
-  "CLAUDE_BG_ISOLATION",
-  "CLAUDE_BG_MEMORY_TOGGLED_OFF",
-  "CLAUDE_BG_POST_CLEAR_RESPAWN",
-  "CLAUDE_BG_RENDEZVOUS_SOCK",
-  "CLAUDE_BG_SOURCE",
-  "CLAUDE_BG_STARTUP_WEDGE_MS",
-  "CLAUDE_BG_TCC_DISCLAIMED",
-  "CLAUDE_BRIDGE_REATTACH_GROUPING",
-  "CLAUDE_BRIDGE_REATTACH_NO_BACKFILL",
-  "CLAUDE_BRIDGE_REATTACH_OUTBOUND_ONLY",
-  "CLAUDE_BRIDGE_REATTACH_OWNER_ACCT",
-  "CLAUDE_BRIDGE_REATTACH_OWNER_ORG",
-  "CLAUDE_BRIDGE_REATTACH_SEQ",
-  "CLAUDE_BYTE_STREAM_IDLE_TIMEOUT_MS",
-  "CLAUDE_CHROME_CLASSIFIER_FLOOR",
-  "CLAUDE_CHROME_PERMISSION_MODE",
-  "CLAUDE_CLIENT_PRESENCE_FILE",
-  "CLAUDE_CODE_3P_PROBE_WROTE_OPUS_DEFAULT",
-  "CLAUDE_CODE_3P_PROBE_WROTE_SONNET_DEFAULT",
-  "CLAUDE_CODE_ACCESSIBILITY",
-  "CLAUDE_CODE_ACTION",
-  "CLAUDE_CODE_ACT_DONT_REDERIVE",
-  "CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD",
-  "CLAUDE_CODE_ADDITIONAL_PROTECTION",
-  "CLAUDE_CODE_ADOPT_UNDERIVABLE_PARKED_PERMISSION",
-  "CLAUDE_CODE_AGENT",
-  "CLAUDE_CODE_ALT_SCREEN_FULL_REPAINT",
-  "CLAUDE_CODE_ALWAYS_ENABLE_EFFORT",
-  "CLAUDE_CODE_AMBER_ASTROLABE",
-  "CLAUDE_CODE_ARTIFACT",
-  "CLAUDE_CODE_ARTIFACT_ASSETS",
-  "CLAUDE_CODE_ARTIFACT_AUTO_OPEN",
-  "CLAUDE_CODE_ARTIFACT_COMMENTS",
-  "CLAUDE_CODE_ARTIFACT_COMMENTS_AUTOREACT",
-  "CLAUDE_CODE_ARTIFACT_COMMENT_FAST_ACK",
-  "CLAUDE_CODE_ARTIFACT_COMMENT_FAST_ACK_FIXED",
-  "CLAUDE_CODE_ARTIFACT_COMMENT_RESPONDER",
-  "CLAUDE_CODE_ARTIFACT_DB",
-  "CLAUDE_CODE_ARTIFACT_DELETE",
-  "CLAUDE_CODE_ARTIFACT_PREVIEW",
-  "CLAUDE_CODE_ARTIFACT_ROOM",
-  "CLAUDE_CODE_ARTIFACT_TYPES",
-  "CLAUDE_CODE_ARTIFACT_TYPE_CATALOG",
-  "CLAUDE_CODE_ARTIFACT_TYPE_CLOUD_CREATE",
-  "CLAUDE_CODE_ARTIFACT_VERIFY",
-  "CLAUDE_CODE_ATTRIBUTION_HEADER",
-  "CLAUDE_CODE_AUTO_BACKGROUND_WORKER_CHECKIN_SECONDS",
-  "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
-  "CLAUDE_CODE_AUTO_CONNECT_IDE",
-  "CLAUDE_CODE_AUTO_MODE_EXTERNAL_PERMISSIONS",
-  "CLAUDE_CODE_AUTO_MODE_MODEL",
-  "CLAUDE_CODE_AWS_CHAIN_RESOLVE_TIMEOUT_MS",
-  "CLAUDE_CODE_BASALT_COVE",
-  "CLAUDE_CODE_BASE_REF",
-  "CLAUDE_CODE_BASE_REFS",
-  "CLAUDE_CODE_BASH_OUTPUT_AUDIENCE_NOTE",
-  "CLAUDE_CODE_BASH_SANDBOX_SHOW_INDICATOR",
-  "CLAUDE_CODE_BENCH_LIVE_COUNTS",
-  "CLAUDE_CODE_BG_CLASSIFIER_MODEL",
-  "CLAUDE_CODE_BG_TASKS_REPORT_RUNNING",
-  "CLAUDE_CODE_BISON_CAIRN",
-  "CLAUDE_CODE_BLOCKING_LIMIT_OVERRIDE",
-  "CLAUDE_CODE_BREEZY_HORIZON",
-  "CLAUDE_CODE_BRIDGE_MCP_CARRIER",
-  "CLAUDE_CODE_BRIDGE_PROMPT_SHA256",
-  "CLAUDE_CODE_BRIEF",
-  "CLAUDE_CODE_BRIEF_UPLOAD",
-  "CLAUDE_CODE_BUBBLEWRAP",
-  "CLAUDE_CODE_BYOC_ENABLE_DATADOG",
-  "CLAUDE_CODE_CCR_LAZY_SUBAGENT_HYDRATE",
-  "CLAUDE_CODE_CLASSIFIER_SUMMARY",
-  "CLAUDE_CODE_COLD_COMPACT",
-  "CLAUDE_CODE_CONTAINER_ID",
-  "CLAUDE_CODE_COORDINATOR_FORCE_WORKER_INHERIT_MODEL",
-  "CLAUDE_CODE_COORDINATOR_WORKER_CHECKIN_SECONDS",
-  "CLAUDE_CODE_COWORK_FRAME_ARTIFACTS",
-  "CLAUDE_CODE_DAEMON_COLD_START",
-  "CLAUDE_CODE_DATADOG_FLUSH_INTERVAL_MS",
-  "CLAUDE_CODE_DD_ERROR_TRACKING_FLUSH_INTERVAL_MS",
-  "CLAUDE_CODE_DEBUG_LOGS_DIR",
-  "CLAUDE_CODE_DEBUG_LOG_LEVEL",
-  "CLAUDE_CODE_DEBUG_REPAINTS",
-  "CLAUDE_CODE_DECSTBM",
-  "CLAUDE_CODE_DIAGNOSTICS_FILE",
-  "CLAUDE_CODE_DIR_SYNC_DISABLE_ANCHORING",
-  "CLAUDE_CODE_DIR_SYNC_ENGINE",
-  "CLAUDE_CODE_DIR_SYNC_FFWD",
-  "CLAUDE_CODE_DIR_SYNC_GIT",
-  "CLAUDE_CODE_DIR_SYNC_STREAM",
-  "CLAUDE_CODE_DISABLE_1M_CONTEXT",
-  "CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING",
-  "CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION",
-  "CLAUDE_CODE_DISABLE_ADVISOR_TOOL",
-  "CLAUDE_CODE_DISABLE_AGENT_VIEW",
-  "CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN",
-  "CLAUDE_CODE_DISABLE_ARTIFACT",
-  "CLAUDE_CODE_DISABLE_ATTACHMENTS",
-  "CLAUDE_CODE_DISABLE_AUTO_MEMORY",
-  "CLAUDE_CODE_DISABLE_BACKGROUND_TASKS",
-  "CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_DEFAULT",
-  "CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_GUARD",
-  "CLAUDE_CODE_DISABLE_BG_EXIT_HANDOFF",
-  "CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP",
-  "CLAUDE_CODE_DISABLE_BUNDLED_SKILLS",
-  "CLAUDE_CODE_DISABLE_CLAUDE_API_SKILL",
-  "CLAUDE_CODE_DISABLE_CLAUDE_CODE_SKILL",
-  "CLAUDE_CODE_DISABLE_CLAUDE_MDS",
-  "CLAUDE_CODE_DISABLE_CRON",
-  "CLAUDE_CODE_DISABLE_DIR_SYNC",
-  "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS",
-  "CLAUDE_CODE_DISABLE_EXPLORE_INHERIT_CAP",
-  "CLAUDE_CODE_DISABLE_EXPLORE_PLAN_AGENTS",
-  "CLAUDE_CODE_DISABLE_FAST_MODE",
-  "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY",
-  "CLAUDE_CODE_DISABLE_FILE_CHECKPOINTING",
-  "CLAUDE_CODE_DISABLE_GIT_INSTRUCTIONS",
-  "CLAUDE_CODE_DISABLE_HOOK_FORWARDING",
-  "CLAUDE_CODE_DISABLE_LAUNCH_COMPOSER",
-  "CLAUDE_CODE_DISABLE_LEGACY_MODEL_REMAP",
-  "CLAUDE_CODE_DISABLE_MEMORY_BULK_INFLATE",
-  "CLAUDE_CODE_DISABLE_MEMORY_MASS_DELETE_HOLD",
-  "CLAUDE_CODE_DISABLE_MEMORY_PERIODIC_RESYNC",
-  "CLAUDE_CODE_DISABLE_MEMORY_RO_UNSAVED_NOTICE",
-  "CLAUDE_CODE_DISABLE_MEMORY_STREAM_LIST",
-  "CLAUDE_CODE_DISABLE_MOUSE",
-  "CLAUDE_CODE_DISABLE_MOUSE_CLICKS",
-  "CLAUDE_CODE_DISABLE_NESTED_CHAIN_IDLE",
-  "CLAUDE_CODE_DISABLE_NESTED_USER_REPAIR",
-  "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC",
-  "CLAUDE_CODE_DISABLE_NONSTREAMING_FALLBACK",
-  "CLAUDE_CODE_DISABLE_NOTIFICATION_PRESENCE_CHECK",
-  "CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL",
-  "CLAUDE_CODE_DISABLE_ORG_MEMORY",
-  "CLAUDE_CODE_DISABLE_PERMISSION_PROMPT_NOTIFY_HOOKS",
-  "CLAUDE_CODE_DISABLE_PLUGIN_FORWARDING",
-  "CLAUDE_CODE_DISABLE_POLICY_SKILLS",
-  "CLAUDE_CODE_DISABLE_PRECOMPACT_SKIP",
-  "CLAUDE_CODE_DISABLE_REFUSAL_FALLBACK",
-  "CLAUDE_CODE_DISABLE_TERMINAL_TITLE",
-  "CLAUDE_CODE_DISABLE_THINKING",
-  "CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT",
-  "CLAUDE_CODE_DISABLE_VIRTUAL_SCROLL",
-  "CLAUDE_CODE_DISABLE_VITALS_EMITTER",
-  "CLAUDE_CODE_DISABLE_WORKFLOWS",
-  "CLAUDE_CODE_DISABLE_WORKING_SYNC",
-  "CLAUDE_CODE_DONT_INHERIT_ENV",
-  "CLAUDE_CODE_DOWNLOAD_DEADLINE_MS_FOR_TESTING",
-  "CLAUDE_CODE_EAGER_FLUSH",
-  "CLAUDE_CODE_EFFORT_LEVEL",
-  "CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES",
-  "CLAUDE_CODE_ENABLE_APPEND_SUBAGENT_PROMPT",
-  "CLAUDE_CODE_ENABLE_AWAY_SUMMARY",
-  "CLAUDE_CODE_ENABLE_BACKGROUND_PLUGIN_REFRESH",
-  "CLAUDE_CODE_ENABLE_CFC",
-  "CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL",
-  "CLAUDE_CODE_ENABLE_FEEDBACK_SURVEY_FOR_OTEL",
-  "CLAUDE_CODE_ENABLE_FINE_GRAINED_TOOL_STREAMING",
-  "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY",
-  "CLAUDE_CODE_ENABLE_LAUNCH_COMPOSER",
-  "CLAUDE_CODE_ENABLE_MENU_KIND_LANES",
-  "CLAUDE_CODE_ENABLE_NARRATION",
-  "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION",
-  "CLAUDE_CODE_ENABLE_REFRESH_MCP_TOOLS",
-  "CLAUDE_CODE_ENABLE_REMOTE_RECAP",
-  "CLAUDE_CODE_ENABLE_SDK_FILE_CHECKPOINTING",
-  "CLAUDE_CODE_ENABLE_TASKS",
-  "CLAUDE_CODE_ENABLE_TODO_TOOLS",
-  "CLAUDE_CODE_ENABLE_XAA",
-  "CLAUDE_CODE_ENHANCED_TELEMETRY_BETA",
-  "CLAUDE_CODE_ENTRYPOINT",
-  "CLAUDE_CODE_ENVIRONMENT_KIND",
-  "CLAUDE_CODE_ENVIRONMENT_RUNNER_VERSION",
-  "CLAUDE_CODE_EXIT_AFTER_FIRST_RENDER",
-  "CLAUDE_CODE_EXIT_AFTER_STOP_DELAY",
-  "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS",
-  "CLAUDE_CODE_EXPERIMENTAL_OBSERVER_AGENTS",
-  "CLAUDE_CODE_EXTRA_BODY",
-  "CLAUDE_CODE_EXTRA_METADATA",
-  "CLAUDE_CODE_FEDERATION_CACHE_DIR",
-  "CLAUDE_CODE_FLEETVIEW_SIMPLE",
-  "CLAUDE_CODE_FORCE_BRIDGE",
-  "CLAUDE_CODE_FORCE_EVALUATE_MEMORY",
-  "CLAUDE_CODE_FORCE_FULLSCREEN_UPSELL",
-  "CLAUDE_CODE_FORCE_MEMORY_SURVEY",
-  "CLAUDE_CODE_FORCE_MID_CONVERSATION_SYSTEM",
-  "CLAUDE_CODE_FORCE_STRIKETHROUGH",
-  "CLAUDE_CODE_FORCE_SYNC_OUTPUT",
-  "CLAUDE_CODE_FORCE_TIP_ID",
-  "CLAUDE_CODE_FORK_SUBAGENT",
-  "CLAUDE_CODE_FORWARD_SUBAGENT_TEXT",
-  "CLAUDE_CODE_FRAME_TIMING_LOG",
-  "CLAUDE_CODE_FRAME_TIMING_SAMPLE_EVERY",
-  "CLAUDE_CODE_GAULT_KESTREL",
-  "CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF",
-  "CLAUDE_CODE_GB_REFRESH_INTERVAL_MS",
-  "CLAUDE_CODE_GIT_BASH_PATH",
-  "CLAUDE_CODE_GLOB_HIDDEN",
-  "CLAUDE_CODE_GLOB_NO_IGNORE",
-  "CLAUDE_CODE_GLOB_TIMEOUT_SECONDS",
-  "CLAUDE_CODE_GOAL_CHECKIN_MINUTES",
-  "CLAUDE_CODE_GORSE_PLOVER",
-  "CLAUDE_CODE_GZIP_CCR_REQUEST_BODIES",
-  "CLAUDE_CODE_GZIP_REQUEST_BODIES",
-  "CLAUDE_CODE_HARBOR_KITE",
-  "CLAUDE_CODE_HARBOR_KITE_CLOUD",
-  "CLAUDE_CODE_HARBOR_KITE_PACING_OFF",
-  "CLAUDE_CODE_HIDE_CWD",
-  "CLAUDE_CODE_HIDE_SETTINGS_HINT",
-  "CLAUDE_CODE_HOLD_REPORT_PARK_AT_INIT",
-  "CLAUDE_CODE_HOLD_UNANSWERED_PARKED_PERMISSION",
-  "CLAUDE_CODE_HOME_SEED_HOLD_TIMEOUT_MS",
-  "CLAUDE_CODE_HOME_SEED_VERDICT_TIMEOUT_MS",
-  "CLAUDE_CODE_HOOKS_SAME_THREAD",
-  "CLAUDE_CODE_HOVER_REST",
-  "CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL",
-  "CLAUDE_CODE_IDE_SKIP_VALID_CHECK",
-  "CLAUDE_CODE_IDLE_THRESHOLD_MINUTES",
-  "CLAUDE_CODE_INCLUDE_PARTIAL_MESSAGES",
-  "CLAUDE_CODE_INTRO_FRAME",
-  "CLAUDE_CODE_IS_COWORK",
-  "CLAUDE_CODE_JUNIPER_SUNDIAL",
-  "CLAUDE_CODE_KB_COHESION_FIXES",
-  "CLAUDE_CODE_LANTERN_PRISM",
-  "CLAUDE_CODE_LARCH_CISTERN",
-  "CLAUDE_CODE_LEGACY_BUNDLE",
-  "CLAUDE_CODE_LOOP_KEEPALIVE",
-  "CLAUDE_CODE_LOOP_PERSISTENT",
-  "CLAUDE_CODE_MANAGED_SETTINGS_PATH",
-  "CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS",
-  "CLAUDE_CODE_MAX_RETRIES",
-  "CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH",
-  "CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY",
-  "CLAUDE_CODE_MAX_TURNS",
-  "CLAUDE_CODE_MCP_ALLOWLIST_ENV",
-  "CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS",
-  "CLAUDE_CODE_MCP_MEMORY_CGROUP",
-  "CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT",
-  "CLAUDE_CODE_MEMORY_PUSH_DELETE_MODE",
-  "CLAUDE_CODE_MOCK_REMOTE_SETTINGS",
-  "CLAUDE_CODE_MOCK_TRIAL",
-  "CLAUDE_CODE_NANKEEN_KESTREL",
-  "CLAUDE_CODE_NATIVE_CURSOR",
-  "CLAUDE_CODE_NEW_INIT",
-  "CLAUDE_CODE_NO_FLICKER",
-  "CLAUDE_CODE_NO_MODEL_FALLBACK",
-  "CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH",
-  "CLAUDE_CODE_OTEL_DIAG_STDERR",
-  "CLAUDE_CODE_OTEL_FLUSH_TIMEOUT_MS",
-  "CLAUDE_CODE_OTEL_SHUTDOWN_TIMEOUT_MS",
-  "CLAUDE_CODE_OVERRIDE_DATE",
-  "CLAUDE_CODE_PACKAGE_MANAGER_AUTO_UPDATE",
-  "CLAUDE_CODE_PARCHMENT_FERN",
-  "CLAUDE_CODE_PARKED_PERMISSION_WAIT_MS",
-  "CLAUDE_CODE_PARKED_STOP_RETIRES",
-  "CLAUDE_CODE_PERFETTO_TRACE",
-  "CLAUDE_CODE_PERFETTO_WRITE_INTERVAL_S",
-  "CLAUDE_CODE_PERFORCE_MODE",
-  "CLAUDE_CODE_PEWTER_OWL",
-  "CLAUDE_CODE_PEWTER_OWL_TOOL",
-  "CLAUDE_CODE_PLAN_MODE_REQUIRED",
-  "CLAUDE_CODE_PLAN_V2_AGENT_COUNT",
-  "CLAUDE_CODE_PLAN_V2_EXPLORE_AGENT_COUNT",
-  "CLAUDE_CODE_PLUGIN_ATTRIBUTION",
-  "CLAUDE_CODE_PLUGIN_BINARY_ASSETS",
-  "CLAUDE_CODE_PLUGIN_CACHE_DIR",
-  "CLAUDE_CODE_PLUGIN_GIT_TIMEOUT_MS",
-  "CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE",
-  "CLAUDE_CODE_PLUGIN_PREFER_HTTPS",
-  "CLAUDE_CODE_PLUGIN_SEED_DIR",
-  "CLAUDE_CODE_PLUGIN_USE_ZIP_CACHE",
-  "CLAUDE_CODE_POLL_EVENTS",
-  "CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY",
-  "CLAUDE_CODE_POWERUP_ONBOARDING",
-  "CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS",
-  "CLAUDE_CODE_PRINT_ENGINE_LOOP",
-  "CLAUDE_CODE_PROACTIVE",
-  "CLAUDE_CODE_PROMPT_CACHE_TTL",
-  "CLAUDE_CODE_PROPAGATE_TRACEPARENT",
-  "CLAUDE_CODE_PWSH_PARSE_TIMEOUT_MS",
-  "CLAUDE_CODE_QUESTION_PREVIEW_FORMAT",
-  "CLAUDE_CODE_RATE_LIMIT_TIER",
-  "CLAUDE_CODE_REFUSAL_FALLBACK_CATCH_ALL",
-  "CLAUDE_CODE_RELAUNCH_TERMINAL_SIZE",
-  "CLAUDE_CODE_REMOTE",
-  "CLAUDE_CODE_REMOTE_ENVIRONMENT_TYPE",
-  "CLAUDE_CODE_REMOTE_HERMETIC_MODE",
-  "CLAUDE_CODE_REMOTE_MEMORY_DIR",
-  "CLAUDE_CODE_REMOTE_RAW_EVENTS_FILE",
-  "CLAUDE_CODE_REMOTE_SEND_KEEPALIVES",
-  "CLAUDE_CODE_REMOTE_SETTINGS_PATH",
-  "CLAUDE_CODE_REMOTE_SETTINGS_POLL_MS",
-  "CLAUDE_CODE_REPL",
-  "CLAUDE_CODE_REPORT_FINDINGS",
-  "CLAUDE_CODE_REPO_CHECKOUTS",
-  "CLAUDE_CODE_RESTRICTED",
-  "CLAUDE_CODE_RESUME_INTERRUPTED_TURN",
-  "CLAUDE_CODE_RESUME_INTERRUPTED_TURN_MAX_AGE_MS",
-  "CLAUDE_CODE_RESUME_PROMPT",
-  "CLAUDE_CODE_RESUME_SOURCE_ALIVE",
-  "CLAUDE_CODE_RESUME_THRESHOLD_MINUTES",
-  "CLAUDE_CODE_RESUME_TOLERATES_CONTEXT_APPENDS",
-  "CLAUDE_CODE_RETIRE_UNANSWERED_PARKED_PERMISSION",
-  "CLAUDE_CODE_RETRY_WATCHDOG",
-  "CLAUDE_CODE_SABLE_THRUSH",
-  "CLAUDE_CODE_SAFE_MODE",
-  "CLAUDE_CODE_SANDBOXED",
-  "CLAUDE_CODE_SCRIPT_CAPS",
-  "CLAUDE_CODE_SCROLL_SPEED",
-  "CLAUDE_CODE_SEND_FEEDBACK",
-  "CLAUDE_CODE_SHELL",
-  "CLAUDE_CODE_SHELL_PREFIX",
-  "CLAUDE_CODE_SILENT_TURN_REMINDER",
-  "CLAUDE_CODE_SILENT_TURN_REMINDER_TEXT",
-  "CLAUDE_CODE_SILENT_TURN_REMINDER_TURNS",
-  "CLAUDE_CODE_SIMPLE",
-  "CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT",
-  "CLAUDE_CODE_SKILL_PROPOSALS",
-  "CLAUDE_CODE_SKIP_FAST_MODE_NETWORK_ERRORS",
-  "CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK",
-  "CLAUDE_CODE_SKIP_HFI_VERSION_CHECK",
-  "CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS",
-  "CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS_EXCEPT",
-  "CLAUDE_CODE_SKIP_PROMPT_HISTORY",
-  "CLAUDE_CODE_SKIP_REPO_UPLOAD",
-  "CLAUDE_CODE_SLOW_OPERATION_THRESHOLD_MS",
-  "CLAUDE_CODE_SPAWN_TIMESTAMP_MS",
-  "CLAUDE_CODE_SSE_PORT",
-  "CLAUDE_CODE_STALL_TIMEOUT_MS_FOR_TESTING",
-  "CLAUDE_CODE_STOP_HOOK_BLOCK_CAP",
-  "CLAUDE_CODE_SUBAGENT_CACHE_EVICT",
-  "CLAUDE_CODE_SUBAGENT_MODEL",
-  "CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL",
-  "CLAUDE_CODE_SUBPROCESS_ENV_SCRUB",
-  "CLAUDE_CODE_SUBSCRIPTION_TYPE",
-  "CLAUDE_CODE_SUPERVISED",
-  "CLAUDE_CODE_SYNC_PLUGINS",
-  "CLAUDE_CODE_SYNC_PLUGINS_BUFFERED_DOWNLOAD",
-  "CLAUDE_CODE_SYNC_PLUGINS_DOWNLOAD_STALL_MS",
-  "CLAUDE_CODE_SYNC_PLUGINS_INSTALL_TIMEOUT_MS",
-  "CLAUDE_CODE_SYNC_PLUGINS_MCP_TIMEOUT_MS",
-  "CLAUDE_CODE_SYNC_PLUGIN_INSTALL",
-  "CLAUDE_CODE_SYNC_PLUGIN_INSTALL_TIMEOUT_MS",
-  "CLAUDE_CODE_SYNC_SKILLS",
-  "CLAUDE_CODE_SYNC_SKILLS_INSTALL_TIMEOUT_MS",
-  "CLAUDE_CODE_SYNC_SKILLS_WAIT_TIMEOUT_MS",
-  "CLAUDE_CODE_SYNTAX_HIGHLIGHT",
-  "CLAUDE_CODE_SYSTEM_PROMPT_GB_FEATURE",
-  "CLAUDE_CODE_TAGS",
-  "CLAUDE_CODE_TAG_ISMETA_MESSAGES",
-  "CLAUDE_CODE_TASK_LIST_ID",
-  "CLAUDE_CODE_TEAM_TEARDOWN_PARK_TIMEOUT_MS",
-  "CLAUDE_CODE_TEE_SDK_STDOUT",
-  "CLAUDE_CODE_TERMINAL_MCP_TOOLS",
-  "CLAUDE_CODE_TERMINAL_RECORDING",
-  "CLAUDE_CODE_TEST_ALLOW_REAL_NETWORK",
-  "CLAUDE_CODE_TEST_FIXTURES_ROOT",
-  "CLAUDE_CODE_TEST_FORCE_DENY",
-  "CLAUDE_CODE_TEST_NO_GIT_BASH",
-  "CLAUDE_CODE_TEST_NO_PWSH",
-  "CLAUDE_CODE_THINKING_DISPLAY_UPDATES",
-  "CLAUDE_CODE_THISTLE_GREBE",
-  "CLAUDE_CODE_THRIFTY_SONIC",
-  "CLAUDE_CODE_TMPDIR",
-  "CLAUDE_CODE_TMUX_PREFIX",
-  "CLAUDE_CODE_TMUX_PREFIX_CONFLICTS",
-  "CLAUDE_CODE_TMUX_TRUECOLOR",
-  "CLAUDE_CODE_TOASTY_THIMBLE",
-  "CLAUDE_CODE_TODO_REMINDER_MODE",
-  "CLAUDE_CODE_TOOL_MEMORY_CGROUP_EXCLUDE",
-  "CLAUDE_CODE_TOOL_MEMORY_LIMIT",
-  "CLAUDE_CODE_TRANSCRIPT_LOCAL_GC",
-  "CLAUDE_CODE_TRIGGER_ID",
-  "CLAUDE_CODE_TUI_JUST_SWITCHED",
-  "CLAUDE_CODE_TUI_TRIAL",
-  "CLAUDE_CODE_TURN_UPDATES",
-  "CLAUDE_CODE_TWO_STAGE_CLASSIFIER",
-  "CLAUDE_CODE_ULTRAREVIEW_PREFLIGHT_FIXTURE",
-  "CLAUDE_CODE_ULTRAREVIEW_QUOTA_FIXTURE",
-  "CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS",
-  "CLAUDE_CODE_USER_EMAIL",
-  "CLAUDE_CODE_USE_ANTHROPIC_AWS",
-  "CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD",
-  "CLAUDE_CODE_USE_BEDROCK",
-  "CLAUDE_CODE_USE_COWORK_PLUGINS",
-  "CLAUDE_CODE_USE_FOUNDRY",
-  "CLAUDE_CODE_USE_GATEWAY",
-  "CLAUDE_CODE_USE_MANTLE",
-  "CLAUDE_CODE_USE_NATIVE_FILE_SEARCH",
-  "CLAUDE_CODE_USE_POWERSHELL_TOOL",
-  "CLAUDE_CODE_USE_VERTEX",
-  "CLAUDE_CODE_VOICE_FORWARD_INTERIMS_TYPED",
-  "CLAUDE_CODE_WALNUT_SPIRE",
-  "CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS",
-  "CLAUDE_CODE_WEB_FETCH_AGENT",
-  "CLAUDE_CODE_WILLOW_TERN",
-  "CLAUDE_CODE_WORKER_EPOCH",
-  "CLAUDE_CODE_WORKFLOWS",
-  "CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS",
-  "CLAUDE_CODE_WORKFLOW_SIZE_WARNING_AGENTS",
-  "CLAUDE_CONTEXT_COLLAPSE",
-  "CLAUDE_CONTEXT_COLLAPSE_MODEL",
-  "CLAUDE_COWORK_MEMORY_EXTRA_GUIDELINES",
-  "CLAUDE_COWORK_MEMORY_GUIDELINES",
-  "CLAUDE_COWORK_MEMORY_INDEX_CONTENT",
-  "CLAUDE_COWORK_MEMORY_PATH_OVERRIDE",
-  "CLAUDE_DEBUG",
-  "CLAUDE_DISABLE_ADOPT",
-  "CLAUDE_ENABLE_BYTE_WATCHDOG",
-  "CLAUDE_ENABLE_BYTE_WATCHDOG_BEDROCK",
-  "CLAUDE_ENABLE_STREAM_WATCHDOG",
-  "CLAUDE_ENV_FILE",
-  "CLAUDE_FORCE_DISPLAY_SURVEY",
-  "CLAUDE_GATEWAY_ALLOW_LOOPBACK",
-  "CLAUDE_GATEWAY_LOG_LEVEL",
-  "CLAUDE_IMPORT_CONVERSATIONS",
-  "CLAUDE_INTERNAL_ASSISTANT_TEAM_NAME",
-  "CLAUDE_INTERNAL_FC_OVERRIDES",
-  "CLAUDE_JOB_DIR",
-  "CLAUDE_MOCK_HEADERLESS_429",
-  "CLAUDE_PTY_HEARTBEAT_MS",
-  "CLAUDE_PTY_ORPHAN_CHECK_MS",
-  "CLAUDE_PTY_RECORD",
-  "CLAUDE_REMOTE_WORKFLOW_ARGS",
-  "CLAUDE_REMOTE_WORKFLOW_SCRIPT",
-  "CLAUDE_REPL_VARIANT",
-  "CLAUDE_RUNNER_ACTIVITY_FD",
-  "CLAUDE_RUNNER_DISABLE_AWAITING_ACTION_OVERRIDE",
-  "CLAUDE_RUNNER_FETCH_DEPTH",
-  "CLAUDE_SERVE_DRAIN_TIMEOUT_MS",
-  "CLAUDE_SLOW_FIRST_BYTE_MS",
-  "CLAUDE_SNIP",
-  "CLAUDE_SSH_LOCAL_BINARY",
-  "CLAUDE_SSH_VERSION",
-  "CLAUDE_STAGE_FILE_ROOT",
-  "CLAUDE_STREAM_FIRST_BYTE_TIMEOUT_MS",
-  "CLAUDE_STREAM_IDLE_TIMEOUT_MS",
-  "CLAUDE_SUBAGENT_BG_SHELL_MAX_MS",
-  "CLAUDE_TMPDIR",
-  "CLAUDE_WORKFLOW_NAME_ONLY",
-  "CLOUDSDK_CONFIG",
-  "CONTAINER_SANDBOX_MOUNT_POINT",
-  "CURSOR_TRACE_ID",
-  "DAYTONA_WS_ID",
-  "DEBUG_CLAUDE_AGENT_SDK",
-  "DEBUG_SDK",
-  "DEMO_VERSION",
-  "DENO_DEPLOYMENT_ID",
-  "DISABLE_AUTOUPDATER",
-  "DISABLE_AUTO_COMPACT",
-  "DISABLE_BRIEF_MODE_STOP_HOOK",
-  "DISABLE_BUG_COMMAND",
-  "DISABLE_COST_WARNINGS",
-  "DISABLE_DOCTOR_COMMAND",
-  "DISABLE_ERROR_REPORTING",
-  "DISABLE_EXTRA_USAGE_COMMAND",
-  "DISABLE_FEEDBACK_COMMAND",
-  "DISABLE_GROWTHBOOK",
-  "DISABLE_INSTALL_GITHUB_APP_COMMAND",
-  "DISABLE_INTERLEAVED_THINKING",
-  "DISABLE_LOGOUT_COMMAND",
-  "DISABLE_PROMPT_CACHING",
-  "DISABLE_PROMPT_CACHING_FABLE",
-  "DISABLE_PROMPT_CACHING_HAIKU",
-  "DISABLE_PROMPT_CACHING_MYTHOS",
-  "DISABLE_PROMPT_CACHING_OPUS",
-  "DISABLE_PROMPT_CACHING_SONNET",
-  "DISABLE_TELEMETRY",
-  "DISABLE_UPDATES",
-  "DISABLE_UPGRADE_COMMAND",
-  "DOCKER_CONFIG",
-  "DO_NOT_TRACK",
-  "EMBEDDED_SEARCH_TOOLS",
-  "EMPTY_PATH",
-  "ENABLE_BETA_TRACING_DETAILED",
-  "ENABLE_CLAUDEAI_MCP_SERVERS",
-  "ENABLE_ENHANCED_TELEMETRY_BETA",
-  "ENABLE_LOCKLESS_UPDATES",
-  "ENABLE_LSP_TOOL",
-  "ENABLE_MCP_LARGE_OUTPUT_FILES",
-  "ENABLE_PID_BASED_VERSION_LOCKING",
-  "ENABLE_PROMPT_CACHING_1H",
-  "ENABLE_PROMPT_CACHING_1H_BEDROCK",
-  "ENABLE_TOOL_SEARCH",
-  "FALLBACK_FOR_ALL_PRIMARY_MODELS",
-  "FORCE_AUTOUPDATE_PLUGINS",
-  "FORCE_CODE_TERMINAL",
-  "FORCE_COLOR",
-  "FORCE_PROMPT_CACHING_5M",
-  "FORCE_VCR",
-  "GCM_INTERACTIVE",
-  "GITHUB_ACTIONS",
-  "GITHUB_ACTION_INPUTS",
-  "GITHUB_ACTION_PATH",
-  "GITHUB_ACTOR",
-  "GITHUB_ACTOR_ID",
-  "GITHUB_ENV",
-  "GITHUB_EVENT_NAME",
-  "GITHUB_EVENT_PATH",
-  "GITHUB_REPOSITORY",
-  "GITHUB_REPOSITORY_ID",
-  "GITHUB_REPOSITORY_OWNER",
-  "GITHUB_REPOSITORY_OWNER_ID",
-  "GITLAB_CI",
-  "GIT_ASKPASS",
-  "GIT_CONFIG_COUNT",
-  "GIT_CONFIG_GLOBAL",
-  "GIT_CONFIG_SYSTEM",
-  "GIT_SSH_COMMAND",
-  "GIT_TERMINAL_PROMPT",
-  "GNOME_TERMINAL_SERVICE",
-  "GOOGLE_CLOUD_WORKSTATIONS",
-  "GRADLE_USER_HOME",
-  "INK_SCREEN_READER",
-  "INTELLIJ_TERMINAL_COMMAND_BLOCKS",
-  "INTELLIJ_TERMINAL_COMMAND_BLOCKS_REWORKED",
-  "IS_DEMO",
-  "IS_SANDBOX",
-  "JAVA_HOME",
-  "JAVA_TOOL_OPTIONS",
-  "KITTY_WINDOW_ID",
-  "KONSOLE_VERSION",
-  "K_SERVICE",
-  "LC_ALL",
-  "LC_TERMINAL",
-  "LC_TIME",
-  "LOCAL_BRIDGE",
-  "MAX_STRUCTURED_OUTPUT_RETRIES",
-  "MCP_CONNECTION_NONBLOCKING",
-  "MCP_CONNECT_TIMEOUT_MS",
-  "MCP_DISCOVERY_CACHE",
-  "MCP_DISCOVERY_CACHE_MAX_STALE_S",
-  "MCP_DISCOVERY_CACHE_STRIKES",
-  "MCP_DISCOVERY_CACHE_TTL_S",
-  "MCP_PROTOCOL_NEGOTIATION",
-  "MCP_REMOTE_SERVER_CONNECTION_BATCH_SIZE",
-  "MCP_SDK_GENERATION",
-  "MCP_SERVER_CONNECTION_BATCH_SIZE",
-  "MCP_TIMEOUT",
-  "MCP_TOOL_TIMEOUT",
-  "MCP_TRUNCATION_PROMPT_OVERRIDE",
-  "NODE_OPTIONS",
-  "NO_COLOR",
-  "NPM_CONFIG_GLOBALCONFIG",
-  "NPM_CONFIG_USERCONFIG",
-  "NUMBER_FORMAT_RANGES",
-  "OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT",
-  "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL",
-  "OTEL_EXPORTER_OTLP_METRICS_PROTOCOL",
-  "OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE",
-  "OTEL_EXPORTER_OTLP_PROTOCOL",
-  "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL",
-  "OTEL_LOGRECORD_ATTRIBUTE_VALUE_LENGTH_LIMIT",
-  "OTEL_LOGS_EXPORTER",
-  "OTEL_LOGS_EXPORT_INTERVAL",
-  "OTEL_LOG_ASSISTANT_RESPONSES",
-  "OTEL_LOG_RAW_API_BODIES",
-  "OTEL_LOG_TOOL_CONTENT",
-  "OTEL_LOG_TOOL_DETAILS",
-  "OTEL_LOG_USER_PROMPTS",
-  "OTEL_METRICS_EXPORTER",
-  "OTEL_METRIC_EXPORT_INTERVAL",
-  "OTEL_RESOURCE_ATTRIBUTES",
-  "OTEL_SPAN_ATTRIBUTE_VALUE_LENGTH_LIMIT",
-  "OTEL_TRACES_EXPORTER",
-  "OTEL_TRACES_EXPORT_INTERVAL",
-  "PIP_CONFIG_FILE",
-  "PLAYWRIGHT_BROWSERS_PATH",
-  "REPL_ID",
-  "REPL_SLUG",
-  "RUNNER_ENVIRONMENT",
-  "RUNNER_OS",
-  "RUSTUP_HOME",
-  "SDK_NATIVE_BIN",
-  "SLASH_COMMAND_TOOL_CHAR_BUDGET",
-  "SPACE_CREATOR_USER_ID",
-  "SSH_CLIENT",
-  "SSH_CONNECTION",
-  "SSH_TTY",
-  "SUDO_GID",
-  "SUDO_UID",
-  "SUDO_USER",
-  "TASK_MAX_OUTPUT_LENGTH",
-  "TERMINAL_EMULATOR",
-  "TERMINATOR_UUID",
-  "TERMUX_VERSION",
-  "TERM_PROGRAM",
-  "TERM_PROGRAM_VERSION",
-  "TILIX_ID",
-  "TMUX_PANE",
-  "ULTRAPLAN_PROMPT_FILE",
-  "USE_API_CONTEXT_MANAGEMENT",
-  "USE_BUILTIN_RIPGREP",
-  "UV_THREADPOOL_SIZE",
-  "VCR_RECORD",
-  "VITALS_EMITTER_BIN",
-  "VSCODE_GIT_ASKPASS_MAIN",
-  "VTE_VERSION",
-  "WAYLAND_DISPLAY",
-  "WEBSITE_SITE_NAME",
-  "WEBSITE_SKU",
-  "WSL_DISTRO_NAME",
-  "WSL_INTEROP",
-  "XDG_CONFIG_HOME",
-  "XDG_DATA_HOME",
-  "XDG_RUNTIME_DIR",
-  "XTERM_VERSION",
-  "ZED_TERM"
-];
-
-// src/official/env-allowlist.ts
-var MINIMAL_OS_VARIABLES = ["PATH", "HOME", "USER", "SHELL", "TERM", "LANG"];
-var MINIMAL_OS_VARIABLE_PREFIXES = ["LC_"];
-var OFFICIAL_RUNTIME_VARIABLES = {
-  configDir: "CLAUDE_CONFIG_DIR",
-  projectDirName: "CLAUDE_CODE_PROJECT_DIR_NAME",
-  tmpdir: "CLAUDE_CODE_TMPDIR"
-};
-var PROXY_AND_TELEMETRY_VARIABLES = [
-  "HTTP_PROXY",
-  "HTTPS_PROXY",
-  "ALL_PROXY",
-  "NO_PROXY",
-  "http_proxy",
-  "https_proxy",
-  "all_proxy",
-  "no_proxy",
-  "CLAUDE_CODE_ENABLE_TELEMETRY",
-  "DISABLE_TELEMETRY",
-  "DISABLE_ERROR_REPORTING"
-];
-var PROXY_AND_TELEMETRY_PREFIXES = ["OTEL_"];
-var TRAFFIC_OPT_OUT_VARIABLES = {
-  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
-  DISABLE_TELEMETRY: "1",
-  DISABLE_ERROR_REPORTING: "1",
-  DISABLE_AUTOUPDATER: "1"
-};
-var TRAFFIC_OPT_OUT_VARIABLE_NAMES = Object.keys(TRAFFIC_OPT_OUT_VARIABLES);
-var PATH_LIST_VARIABLES = ["PATH"];
-function sanitizePathListValue(value) {
-  return value.split(":").filter((entry) => entry.length > 0 && !VENDOR_HOME_SEGMENT_RE.test(entry)).join(":");
-}
-var EXECUTION_INDIRECTION_ENV_NAMES = [
-  "BASH_ENV",
-  "ENV",
-  "SHELLOPTS",
-  "BASHOPTS",
-  "PS4",
-  "IFS",
-  "CDPATH",
-  "FPATH",
-  "ZDOTDIR",
-  "COMSPEC",
-  "PATH",
-  "PSMODULEPATH",
-  "PROMPT_COMMAND",
-  "NODE_OPTIONS",
-  "NODE_PATH",
-  "NODE_REPL_EXTERNAL_MODULE",
-  "PERLLIB",
-  "GEM_PATH",
-  "GEM_HOME",
-  "JAVA_TOOL_OPTIONS",
-  "_JAVA_OPTIONS",
-  "JDK_JAVA_OPTIONS",
-  "IBM_JAVA_OPTIONS",
-  "OPENJ9_JAVA_OPTIONS",
-  "CLASSPATH",
-  "BUN_OPTIONS",
-  "BUN_INSPECT",
-  "MONO_PATH",
-  "R_PROFILE_USER",
-  "DEVPATH",
-  "GCONV_PATH",
-  "PHPRC",
-  "PHP_INI_SCAN_DIR",
-  "OPENSSL_CONF",
-  "OPENSSL_MODULES",
-  "OPENSSL_ENGINES",
-  "KRB5_CONFIG",
-  "GTK_PATH",
-  "QT_PLUGIN_PATH",
-  "GIO_MODULE_DIR",
-  "SASL_PATH",
-  "XDG_CONFIG_HOME",
-  "SSH_ASKPASS",
-  "SSH_ASKPASS_REQUIRE",
-  "SUDO_ASKPASS",
-  "VSCODE_GIT_ASKPASS_MAIN",
-  "PAGER",
-  "EDITOR",
-  "VISUAL",
-  "CLAUDE_CODE_SHELL",
-  "CLAUDE_CODE_SHELL_PREFIX",
-  "CLAUDE_CODE_GIT_BASH_PATH",
-  "CLAUDE_ENV_FILE",
-  "CLAUDE_CODE_MANAGED_SETTINGS_PATH",
-  "CLAUDE_CODE_REMOTE_SETTINGS_PATH",
-  "CLAUDE_CODE_MOCK_REMOTE_SETTINGS",
-  "CLAUDE_CODE_PLUGIN_SEED_DIR",
-  "CLAUDE_CODE_PLUGIN_CACHE_DIR",
-  "BUN_CONFIG_FILE",
-  "NPM_CONFIG_USERCONFIG",
-  "NPM_CONFIG_GLOBALCONFIG",
-  "PIP_CONFIG_FILE",
-  "CLOUDSDK_CONFIG",
-  "DOCKER_CONFIG",
-  "VITALS_EMITTER_BIN",
-  "CLAUDE_SSH_LOCAL_BINARY",
-  "SDK_NATIVE_BIN",
-  "BUN_CHROME_PATH",
-  "PLAYWRIGHT_BROWSERS_PATH"
-];
-var EXECUTION_INDIRECTION_ENV_PREFIXES = [
-  "LD_",
-  "DYLD_",
-  "BASH_FUNC_",
-  "__BASH_FUNC",
-  "PYTHON",
-  "PERL5",
-  "RUBY",
-  "LUA_",
-  "DOTNET_",
-  "COMPLUS_",
-  "COR_",
-  "CORECLR_",
-  "APPDOMAIN_MANAGER_",
-  "GIT_"
-];
-var EXECUTION_INDIRECTION_FOLDED = new Set(EXECUTION_INDIRECTION_ENV_NAMES.map((name) => name.toUpperCase()));
-function isExecutionIndirectionVariable(name) {
-  const folded = name.toUpperCase();
-  return EXECUTION_INDIRECTION_FOLDED.has(folded) || EXECUTION_INDIRECTION_ENV_PREFIXES.some((prefix) => folded.startsWith(prefix));
-}
-var NON_CREDENTIAL_ENV_REGISTRY_FOLDED = new Set(NON_CREDENTIAL_ENV_REGISTRY.map((name) => name.toUpperCase()));
-function buildOfficialChildEnv(input, policy = {}) {
-  const branchLabel = officialBranchLabel(input.brand);
-  if (input.configDir.length === 0) {
-    throw new OfficialConfigurationError({
-      option: "env.CLAUDE_CONFIG_DIR",
-      reason: "a child with no config dir writes its transcript wherever the SDK parent's own environment points, which on a developer machine is the real vendor home (WS-14 §1/§3)",
-      branchLabel
-    });
-  }
-  validateAuthEnvironment({ selection: input.selection, credentials: input.credentials, gate: policy.claudeOauth ?? { approved: false }, branchLabel });
-  const env = {
-    [OFFICIAL_RUNTIME_VARIABLES.configDir]: input.configDir
-  };
-  if (input.projectKey !== undefined && input.projectKey.length > 0) {
-    if (!new RegExp(PINNED_PROJECT_DIR_NAME_PATTERN).test(input.projectKey)) {
-      throw new OfficialConfigurationError({
-        option: `env.${OFFICIAL_RUNTIME_VARIABLES.projectDirName}`,
-        reason: `${JSON.stringify(input.projectKey)} (${input.projectKey.length} characters) does not match the pinned runtime's own rule ${PINNED_PROJECT_DIR_NAME_PATTERN}, and a key it rejects does not fail — it falls back to the runtime's own cwd-derived name, leaving the directory row, this environment and the auto-memory directory all naming a transcript that is somewhere else (WS-14 §1/§3, R-7b-13). Name a conforming key in \`runtime.official.projectKey\`; the door's own default is the Winter SDK's \`transcriptProjectKey(cwd)\`, which a deep working directory can push past this rule`,
-        branchLabel
-      });
-    }
-    env[OFFICIAL_RUNTIME_VARIABLES.projectDirName] = input.projectKey;
-  }
-  if (input.sharedTempRoot !== undefined && input.sharedTempRoot.length > 0)
-    env[OFFICIAL_RUNTIME_VARIABLES.tmpdir] = input.sharedTempRoot;
-  if ((policy.remoteConfig ?? "deny") === "deny")
-    for (const [name, value] of Object.entries(TRAFFIC_OPT_OUT_VARIABLES))
-      env[name] = value;
-  for (const [name, value] of Object.entries(input.credentials))
-    env[name] = value;
-  for (const [name, value] of Object.entries(input.base ?? {})) {
-    const wanted = MINIMAL_OS_VARIABLES.includes(name) || MINIMAL_OS_VARIABLE_PREFIXES.some((prefix) => name.startsWith(prefix));
-    if (wanted)
-      env[name] = PATH_LIST_VARIABLES.includes(name) ? sanitizePathListValue(value) : value;
-  }
-  for (const [name, value] of Object.entries(policy.configuredExtras ?? {}))
-    env[name] = value;
-  assertNoForbiddenChildVariables(env, { brand: input.brand, selection: input.selection, policy, branchLabel });
-  return Object.fromEntries(Object.entries(env).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
-}
-function assertNoForbiddenChildVariables(env, args) {
-  const branchLabel = args.branchLabel ?? officialBranchLabel(args.brand);
-  const declared = new Set(Object.keys(args.policy?.configuredExtras ?? {}));
-  const reviewedExtras = args.policy?.reviewedCredentialShapedExtras ?? [];
-  const reviewedExecution = args.policy?.reviewedExecutionExtras ?? [];
-  const prefixes = [args.brand.envPrefix, ...args.policy?.hostEnvPrefixes ?? []];
-  const runtimeVariables = Object.values(OFFICIAL_RUNTIME_VARIABLES);
-  const familyVariables = args.selection === undefined ? undefined : allowedAuthVariables(args.selection);
-  for (const [name, value] of Object.entries(env)) {
-    const refuse = (reason) => {
-      throw new OfficialConfigurationError({ option: `env.${name}`, reason, branchLabel });
-    };
-    if (prefixes.some((prefix) => prefix.length > 0 && name.startsWith(prefix))) {
-      refuse("product/daemon variables never reach this child: it is a vendor runtime configured entirely by the allowlist, and Winter itself never reads the vendor's variables either (WS-14 §3, WS-01 §1 principle 4)");
-    }
-    if (NEVER_INJECTED_AUTH_VARIABLES.includes(name)) {
-      refuse("this credential is never injected on this branch (WS-14 §12 / WS-01 §2.5); the supported subscription flow stores its state inside the spool namespace");
-    }
-    if (familyVariables !== undefined && ALL_AUTH_VARIABLES.includes(name) && !familyVariables.includes(name)) {
-      refuse(`it is a credential variable outside this session's ${args.selection?.authFamily} family (${familyVariables.length === 0 ? "which injects nothing" : familyVariables.join(", ")}); the runtime resolves two families by its own precedence order, not by the host's selection (WS-14 §12)`);
-    }
-    const foldedName = name.toUpperCase();
-    const isThisFamilysVariable = (familyVariables ?? []).includes(name);
-    if (declared.has(name) && isExecutionIndirectionVariable(name) && !runtimeVariables.includes(name) && !reviewedExecution.includes(name)) {
-      refuse("it is refused explicitly: this name changes how the child EXECUTES code or authenticates (a shell startup file or command prefix, a loader/runtime hook, or an askpass/credential helper the child runs), " + "which no credential-shape rule can see and which the artifact's own registry legitimately declares — so neither of the extras door's two rules would stop it. " + "A deployment that has REVIEWED this exact name and needs it names it in `reviewedExecutionExtras` (WS-14 §3/§12, item 22)");
-    }
-    if (declared.has(name) && isAuthShapedVariable(foldedName) && !runtimeVariables.includes(name) && !isThisFamilysVariable && !reviewedExtras.includes(name)) {
-      refuse("it is credential-bearing by shape, and the configured-extras door carries non-credential variables only: the runtime resolves credentials by its own precedence order, so one of these re-points billing, rate limits and audit at an account this session's persisted selection does not name (WS-14 §12). " + "A deployment that has REVIEWED a specific auth-shaped variable and needs it names it in `reviewedCredentialShapedExtras` — a reviewed compatibility event under WS-17's drift gate, never a silent addition");
-    }
-    if (declared.has(name) && !runtimeVariables.includes(name) && !isThisFamilysVariable && !reviewedExtras.includes(name) && !NON_CREDENTIAL_ENV_REGISTRY_FOLDED.has(foldedName)) {
-      refuse("the configured-extras door is a positive allowlist: only names the PINNED artifact's own environment registry declares, and that an independent name rule classifies as non-credential, ride it. " + "An unknown name is refused because nothing has classified it — name it in `reviewedCredentialShapedExtras` if this deployment has reviewed it (WS-14 §3/§12, review r3 NEW-10)");
-    }
-    if (declared.has(name) && runtimeVariables.includes(name)) {
-      refuse("a configured extra may not override a variable this branch owns: the config dir, the transcript project key and the shared temp root are §1/§3's own, and the record is written against them");
-    }
-    if (declared.has(name) && TRAFFIC_OPT_OUT_VARIABLE_NAMES.includes(name)) {
-      refuse('this is one of the four traffic opt-outs this branch sets itself (R-7b-11), and setting it through the extras door would leave the session\'s recorded `remoteConfig` describing a surface the child does not have — use `OfficialEnvPolicy.remoteConfig` ("allow" opts back in, and the choice is recorded)');
-    }
-    if (!declared.has(name) && !TRAFFIC_OPT_OUT_VARIABLE_NAMES.includes(name) && (PROXY_AND_TELEMETRY_VARIABLES.includes(name) || PROXY_AND_TELEMETRY_PREFIXES.some((prefix) => name.startsWith(prefix)))) {
-      refuse("proxy and telemetry variables reach this child only when the deployment configures them explicitly (WS-14 §3); an inherited one redirects or duplicates traffic invisibly");
-    }
-    if (VENDOR_HOME_SEGMENT_RE.test(value)) {
-      refuse(`its value (${value}) points into the vendor's user-level home; this branch is isolated from it by construction (WS-14 §3, WS-17 row 4)`);
-    }
-    const known = runtimeVariables.includes(name) || TRAFFIC_OPT_OUT_VARIABLE_NAMES.includes(name) || ALL_AUTH_VARIABLES.includes(name) || MINIMAL_OS_VARIABLES.includes(name) || MINIMAL_OS_VARIABLE_PREFIXES.some((prefix) => name.startsWith(prefix)) || declared.has(name);
-    if (!known) {
-      refuse("it is not a variable this branch owns, an auth variable for this session, a minimal OS variable, or an explicitly configured addition — the child environment is an allowlist, and anything else is a leak from somewhere (WS-14 §3)");
-    }
-  }
-}
-var PINNED_OFFICIAL_RUNTIME = "0.3.250";
-var PINNED_PROJECT_DIR_NAME_PATTERN = "^[A-Za-z0-9_-]{1,64}$";
-
 // src/official/options-template.ts
-import { mcpToolName as mcpToolName2 } from "@yanlinglabs/winter-agent-sdk";
+import { mcpToolName } from "@yanlinglabs/winter-agent-sdk";
 var PINNED_SYSTEM_PROMPT_PRESET = "claude_code";
 var AUTO_MEMORY_LOAD_CAP = { lines: 200, bytes: 25 * 1024 };
 var DEFAULT_EXCLUDE_DYNAMIC_SECTIONS = { code: true, dispatch: true, chat: true };
@@ -1578,6 +218,127 @@ function assertOptionsInvariants(options, branchLabel) {
   }
 }
 
+// src/official/mcp-descriptors.ts
+import { isWinterMcpServerInstance, mcpToolName as mcpToolName2 } from "@yanlinglabs/winter-agent-sdk";
+import {
+  WINTER_DEFAULT_TOOL_DEFINITIONS,
+  createAdvisorToolHandler,
+  createMessagingToolHandlers
+} from "@yanlinglabs/winter-agent-sdk/tools";
+function mcpResult(handler) {
+  return async (args, extra) => {
+    const result = await handler(args, extra);
+    return { content: [{ type: "text", text: result.text }], ...result.isError === undefined ? {} : { isError: result.isError } };
+  };
+}
+function descriptorFor(definition, handler) {
+  return {
+    tool: definition.toolName,
+    description: definition.description,
+    inputSchema: definition.inputSchema,
+    ...definition.outputSchema === undefined ? {} : { outputSchema: definition.outputSchema },
+    ...definition.annotations === undefined ? {} : { annotations: definition.annotations },
+    exposure: "deferred",
+    permissionClass: definition.permissionClass,
+    handler: mcpResult(handler)
+  };
+}
+function winterMcpServerDescriptor(args) {
+  const messaging = createMessagingToolHandlers(args.port, args.caller);
+  const advisor = createAdvisorToolHandler({
+    transcriptSource: args.advisor.transcriptSource,
+    resolveReviewer: args.advisor.resolveReviewer ?? (() => {
+      return;
+    }),
+    ...args.advisor.maxChars === undefined ? {} : { maxChars: args.advisor.maxChars }
+  });
+  const handlers = {
+    send_message: messaging.sendMessage,
+    list_agents: messaging.listAgents,
+    read_notifications: messaging.readNotifications,
+    advisor
+  };
+  const tools = WINTER_DEFAULT_TOOL_DEFINITIONS.map((definition) => {
+    const handler = handlers[definition.toolName];
+    if (handler === undefined)
+      throw new OfficialMcpError({ server: args.brand.mcpServerName, reason: `the SDK declares a default tool this branch has no handler for: \`${definition.toolName}\``, branchLabel: "winter-claude-agent" });
+    return descriptorFor(definition, handler);
+  });
+  return { name: args.brand.mcpServerName, version: args.version ?? "1.0.0", tools: [...tools, ...args.capabilities ?? []] };
+}
+function capabilityServerDescriptor(server, version = "1.0.0") {
+  if (!isWinterMcpServerInstance(server.instance)) {
+    throw new RuntimeLaunchInputError({
+      field: "capabilities",
+      reason: `the capability server \`${server.name}\` carries no in-process instance the router can call (\`listTools\`/\`callTool\`), so its tools could be forwarded to the Winter leg and never registered on the official one`
+    });
+  }
+  const instance = server.instance;
+  const declared = server.tools ?? instance.listTools();
+  const tools = declared.map((tool) => {
+    const meta = tool._meta;
+    const permissionClass = typeof meta?.["permissionClass"] === "string" ? meta["permissionClass"] : server.name;
+    return {
+      tool: tool.name,
+      description: tool.description ?? "",
+      inputSchema: capabilityInputSchema(tool.inputSchema, server.name, tool.name),
+      ...tool.annotations === undefined ? {} : { annotations: tool.annotations },
+      exposure: "eager",
+      permissionClass,
+      handler: async (rawArgs) => {
+        const result = await instance.callTool(tool.name, rawArgs ?? {});
+        return { content: result.content, ...result.isError === undefined ? {} : { isError: result.isError } };
+      }
+    };
+  });
+  return { name: server.name, version, tools };
+}
+function capabilityNameCollisionError(args) {
+  return new RuntimeLaunchInputError({
+    field: args.field,
+    reason: `\`${args.name}\` is the name of a capability server this handle forwards, and the caller's own \`mcpServers\` already carries it — one of the two would silently not be registered, and the other leg would still have the capability, so the door refuses rather than choose for you`
+  });
+}
+function capabilityServerDescriptors(servers) {
+  return servers.map((server) => capabilityServerDescriptor(server));
+}
+function capabilityInputSchema(raw, server, tool) {
+  const properties = raw["properties"];
+  if (raw["type"] !== "object" || properties !== undefined && (typeof properties !== "object" || properties === null)) {
+    throw new RuntimeLaunchInputError({
+      field: "capabilities",
+      reason: `the capability tool \`${tool}\` on \`${server}\` declares an input schema that is not a JSON-Schema object, and the official branch's in-process registration has no conversion for anything else`
+    });
+  }
+  const required = raw["required"];
+  const additionalProperties = raw["additionalProperties"];
+  return {
+    type: "object",
+    ...properties === undefined ? {} : { properties },
+    ...Array.isArray(required) ? { required: required.map(String) } : {},
+    ...typeof additionalProperties === "boolean" ? { additionalProperties } : {}
+  };
+}
+function canonicalToolNames(descriptor, brand) {
+  return descriptor.tools.map((tool) => mcpToolName2(brand, tool.tool));
+}
+function materializeOfficialMcpServer(args) {
+  const { createSdkMcpServer, tool } = args.module;
+  if (typeof createSdkMcpServer !== "function" || typeof tool !== "function") {
+    throw new OfficialMcpError({
+      server: args.descriptor.name,
+      reason: "the injected official SDK module exposes no in-process MCP server constructor, so the standing server cannot be registered and every aliased built-in would resolve to a missing tool",
+      branchLabel: args.branchLabel
+    });
+  }
+  const tools = args.descriptor.tools.map((descriptor) => tool(descriptor.tool, descriptor.description, args.toInputShape(descriptor.inputSchema), async (rawArgs, extra) => descriptor.handler(rawArgs, extra), descriptor.annotations === undefined ? undefined : { annotations: descriptor.annotations }));
+  return createSdkMcpServer({ name: args.descriptor.name, version: args.descriptor.version, tools });
+}
+var OFFICIAL_MATERIALIZATION_DROPS = ["outputSchema", "exposure"];
+function officialMcpServers(args) {
+  return { [args.descriptor.name]: materializeOfficialMcpServer(args) };
+}
+
 // src/vendor-paths.ts
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -1722,10 +483,60 @@ function officialConnectionEnv(args) {
     explicit["ANTHROPIC_BASE_URL"] = baseUrl;
   return explicit;
 }
+function officialCapabilityServers(deps, args) {
+  if (deps.toInputShape === undefined) {
+    if (deps.capabilities === undefined)
+      return;
+    throw new RuntimeLaunchInputError({
+      leg: "official",
+      field: "toInputShape",
+      reason: "this handle was constructed with `capabilities` but no JSON-Schema → validator-shape bridge, and the official runtime registers in-process servers only through its own validator's shape — so those tools would exist on the Winter leg and silently not on this one (WS-14 §11)"
+    });
+  }
+  for (const name of Object.keys(args.hostOwned ?? {})) {
+    if ((deps.capabilities ?? []).some((descriptor) => descriptor.name === name))
+      throw capabilityNameCollisionError({ field: "runtime.official.mcpServers", name });
+  }
+  const toInputShape = deps.toInputShape;
+  const module = deps.mcpModule;
+  if (module === undefined) {
+    throw new RuntimeLaunchInputError({
+      leg: "official",
+      field: "peers.claude",
+      reason: "the official leg cannot register the standing server without the official SDK module the servers are registered into"
+    });
+  }
+  const standing = winterMcpServerDescriptor({
+    brand: deps.brand,
+    port: deps.messaging,
+    caller: args.caller,
+    advisor: { transcriptSource: args.transcriptSource, ...deps.advisor?.resolveReviewer === undefined ? {} : { resolveReviewer: deps.advisor.resolveReviewer }, ...deps.advisor?.maxChars === undefined ? {} : { maxChars: deps.advisor.maxChars } }
+  });
+  const servers = {};
+  for (const descriptor of [standing, ...deps.capabilities ?? []]) {
+    Object.assign(servers, officialMcpServers({ descriptor, module, toInputShape, branchLabel: args.branchLabel }));
+  }
+  return servers;
+}
 function openOfficialLeg(deps, request) {
   const branchLabel = officialBranchLabel(deps.brand);
-  const parsed = request.input.parentSessionId === undefined ? buildSessionAddress(request.input.sessionId) : buildChildAddress(request.input.parentSessionId, request.input.sessionId);
   const address = officialLegAddress(request.input);
+  const advisorTranscriptSource = () => ({
+    async getEntries() {
+      const cwd = request.options.cwd;
+      const projectKey = request.input.projectKey ?? (cwd === undefined || cwd.length === 0 ? undefined : deps.transcriptProjectKey(cwd));
+      if (projectKey === undefined)
+        return [];
+      const row = await deps.directory.get(address);
+      const sessionId = row?.backendSessionId ?? request.options.sessionId;
+      if (sessionId === undefined || sessionId.length === 0)
+        return [];
+      return transcriptSourceForSessionKey({ projectKey, sessionId }, { store: deps.shared().store }).getEntries();
+    }
+  });
+  const messagingCaller = request.input.parentSessionId === undefined ? { sessionId: request.input.sessionId } : { sessionId: request.input.parentSessionId, agentId: request.input.sessionId };
+  const routerBuiltMcpServers = officialCapabilityServers(deps, { caller: messagingCaller, transcriptSource: advisorTranscriptSource(), branchLabel, hostOwned: request.input.mcpServers });
+  const parsed = request.input.parentSessionId === undefined ? buildSessionAddress(request.input.sessionId) : buildChildAddress(request.input.parentSessionId, request.input.sessionId);
   const stream = typeof request.prompt === "string" ? undefined : createOfficialInputStream();
   let detach;
   let sawInit = false;
@@ -1821,7 +632,7 @@ function openOfficialLeg(deps, request) {
       ...request.input.options ?? {},
       advertisesHandoff: request.input.advertisesHandoff ?? true,
       env,
-      ...request.input.mcpServers === undefined ? {} : { mcpServers: request.input.mcpServers },
+      ...routerBuiltMcpServers === undefined && request.input.mcpServers === undefined ? {} : { mcpServers: { ...routerBuiltMcpServers, ...request.input.mcpServers } },
       ...bridge === undefined ? {} : { canUseTool: bridge },
       ...request.options.permissionMode === undefined ? {} : { permissionMode: request.options.permissionMode },
       ...request.options.sessionId === undefined ? {} : { sessionId: request.options.sessionId },
@@ -2123,7 +934,7 @@ function createInMemoryRuntimeDirectoryStore() {
 }
 
 // src/directory/directory.ts
-import { parseRuntimeAddress, resolveTarget, serializeRuntimeAddress as serializeRuntimeAddress3, validateToField as validateToField2 } from "@yanlinglabs/winter-agent-sdk/messaging";
+import { parseRuntimeAddress, resolveTarget, serializeRuntimeAddress as serializeRuntimeAddress3, validateToField } from "@yanlinglabs/winter-agent-sdk/messaging";
 
 // src/directory/entries.ts
 import { buildSessionAddress as buildSessionAddress2, serializeRuntimeAddress as serializeRuntimeAddress2 } from "@yanlinglabs/winter-agent-sdk/messaging";
@@ -2369,7 +1180,7 @@ function createRuntimeDirectory(context, options = {}) {
     return (await store.load()).find((entry) => entry.address === address);
   }
   async function resolveIn(snap, to, ctx) {
-    const valid = validateToField2(to);
+    const valid = validateToField(to);
     if (!valid.ok)
       return { kind: "not-found", reason: valid.message };
     const callerOwner = owningSessionIdOf(ctx.from);
@@ -2452,7 +1263,6 @@ function createRuntimeDirectory(context, options = {}) {
 }
 // src/messaging/router.ts
 import {
-  callerAddress,
   createLoopGuard,
   createMessagingRouter,
   createNotificationQueue,
@@ -3199,32 +2009,32 @@ function selectChildRuntimePairing(parent, child) {
   };
 }
 var CHILD_PROVIDER_UNAVAILABLE = "child-provider-unavailable";
-function resumeChildSelection(record, context) {
-  const input = childInput({ ...context, model: record.modelRef, provider: record.providerId });
-  const rows = resolveCandidateRows({ ...input, requested: { ...input.requested, model: record.modelRef } });
+function resumeChildSelection(record2, context) {
+  const input = childInput({ ...context, model: record2.modelRef, provider: record2.providerId });
+  const rows = resolveCandidateRows({ ...input, requested: { ...input.requested, model: record2.modelRef } });
   if (isRefusal2(rows)) {
     return {
       kind: "unavailable",
       retryable: false,
-      reason: `${CHILD_PROVIDER_UNAVAILABLE}: ${record.modelRef} on provider ${record.providerId} — ${rows.detail}`
+      reason: `${CHILD_PROVIDER_UNAVAILABLE}: ${record2.modelRef} on provider ${record2.providerId} — ${rows.detail}`
     };
   }
-  const recorded = rows.find((candidate) => candidate.row.key === record.modelRef);
+  const recorded = rows.find((candidate) => candidate.row.key === record2.modelRef);
   if (recorded === undefined) {
     return {
       kind: "unavailable",
       retryable: false,
-      reason: `${CHILD_PROVIDER_UNAVAILABLE}: this child is recorded on the row ${record.modelRef} (provider ${record.providerId}), which is no longer among the servable rows for that provider (now: ${rows.map((candidate) => candidate.row.key).join(", ")}); a resumed child re-resolves under its OWN recorded model and provider (WS-10, Phase 6.6 amendment)`
+      reason: `${CHILD_PROVIDER_UNAVAILABLE}: this child is recorded on the row ${record2.modelRef} (provider ${record2.providerId}), which is no longer among the servable rows for that provider (now: ${rows.map((candidate) => candidate.row.key).join(", ")}); a resumed child re-resolves under its OWN recorded model and provider (WS-10, Phase 6.6 amendment)`
     };
   }
-  if (recorded.family !== record.family) {
+  if (recorded.family !== record2.family) {
     return {
       kind: "unavailable",
       retryable: false,
-      reason: `${CHILD_PROVIDER_UNAVAILABLE}: this child is recorded in the ${record.family} family and its recorded row ${record.modelRef} now resolves into ${recorded.family}; never a substitution, never a different family (WS-13c §4)`
+      reason: `${CHILD_PROVIDER_UNAVAILABLE}: this child is recorded in the ${record2.family} family and its recorded row ${record2.modelRef} now resolves into ${recorded.family}; never a substitution, never a different family (WS-13c §4)`
     };
   }
-  return { kind: "resumed", selection: record };
+  return { kind: "resumed", selection: record2 };
 }
 
 // src/messaging/winter-adapter.ts
@@ -3509,8 +2319,8 @@ function createGlobalMessaging(context, options = {}) {
       } catch {
         return;
       }
-      for (const record of drained.notifications) {
-        await handle.noteIdle(address, { notificationId: record.notification_id, content: record.content });
+      for (const record2 of drained.notifications) {
+        await handle.noteIdle(address, { notificationId: record2.notification_id, content: record2.content });
       }
       if (drained.remaining === 0 || drained.notifications.length === 0)
         return;
@@ -3735,58 +2545,6 @@ function createGlobalMessaging(context, options = {}) {
   };
   return handle;
 }
-function callerAddressOf(caller) {
-  return callerAddress(caller);
-}
-// src/messaging/handlers.ts
-var VENDOR_TOOL_USE_ID_META_KEY = "claudecode/toolUseId";
-function toolUseIdFromExtra(extra) {
-  if (typeof extra !== "object" || extra === null)
-    return;
-  const meta = extra._meta;
-  if (typeof meta !== "object" || meta === null)
-    return;
-  const id = meta[VENDOR_TOOL_USE_ID_META_KEY];
-  return typeof id === "string" && id.length > 0 ? id : undefined;
-}
-var MODEL_FACING_FAILURES = new Set(["refused", "ambiguous", "not_found", "unavailable"]);
-function text(body, isError = false) {
-  return { content: [{ type: "text", text: body }], ...isError ? { isError: true } : {} };
-}
-function createMessagingToolHandlers(messaging, caller) {
-  const identity = () => typeof caller === "function" ? caller() : caller;
-  return {
-    async sendMessage(rawArgs, extra) {
-      const accepted = acceptNativeSendMessageArgs(rawArgs);
-      if (!accepted.ok)
-        return text(accepted.reason, true);
-      const bound = identity();
-      const perCall = toolUseIdFromExtra(extra);
-      const who = perCall === undefined ? bound : { ...bound, toolUseId: perCall };
-      const from = callerAddressOf(who);
-      const result = await messaging.sendDetailed({
-        from,
-        to: accepted.args.to,
-        body: accepted.args.message,
-        ...accepted.args.summary === undefined ? {} : { summary: accepted.args.summary },
-        ...accepted.args.notify_when_idle === undefined ? {} : { notifyWhenIdle: accepted.args.notify_when_idle },
-        ...who.toolUseId === undefined ? {} : { originToolCallId: who.toolUseId }
-      });
-      const payload = result.notify === undefined ? result.outcome : { ...result.outcome, notify: result.notify };
-      return text(JSON.stringify(payload), MODEL_FACING_FAILURES.has(result.outcome.status));
-    },
-    async listAgents(rawArgs) {
-      const accepted = acceptNativeListAgentsArgs(rawArgs);
-      if (!accepted.ok)
-        return text(accepted.reason, true);
-      const from = callerAddressOf(identity());
-      const rows = await messaging.listReachable({ from });
-      const listing = rows.length === 0 ? "No agents or sessions are currently reachable." : rows.map((row) => `- ${row.name === undefined ? row.address : `${row.name} (${row.address})`} [${row.objectKind}/${row.runtimeKind}] status=${row.status} mode=${row.mode}`).join(`
-`);
-      return text(JSON.stringify({ listing }));
-    }
-  };
-}
 // src/messaging/index.ts
 function createRuntimeMessaging(context, options = {}) {
   let messaging;
@@ -3928,14 +2686,14 @@ function createSharedSessionStore(input) {
     }
     return state;
   };
-  const recordMirrorError = (key, record) => {
+  const recordMirrorError = (key, record2) => {
     const state = stateFor(key);
     state.health = "repair-required";
     state.errors.push({
       projectKey: key.projectKey,
       sessionId: key.sessionId,
       ...key.subpath === undefined ? {} : { subpath: key.subpath },
-      ...record,
+      ...record2,
       at: now().toISOString()
     });
   };
@@ -4018,12 +2776,12 @@ function createSharedSessionStore(input) {
       for (const batch of [...batches.values()])
         await flush(batch.key);
       await tail;
-      const errors = [...sessions.values()].flatMap((state) => state.errors);
+      const errors = [...sessions.values()].flatMap((state2) => state2.errors);
       return {
         settled: batches.size === 0,
-        batchesCommitted: [...sessions.values()].reduce((sum, state) => sum + state.batchesCommitted, 0),
+        batchesCommitted: [...sessions.values()].reduce((sum, state2) => sum + state2.batchesCommitted, 0),
         errors,
-        transcriptHealth: [...sessions.values()].some((state) => state.health === "repair-required") ? "repair-required" : "ok"
+        transcriptHealth: [...sessions.values()].some((state2) => state2.health === "repair-required") ? "repair-required" : "ok"
       };
     }
     const session = sessionOf(key);
@@ -4639,7 +3397,7 @@ function sidecarPath(home, key) {
 }
 function writeSidecar(path, records) {
   mkdirSync2(dirname(path), { recursive: true, mode: 448 });
-  const lines = records.map((record) => JSON.stringify({ sessionId: PROBE_KEY.sessionId, anchorUuid: record.anchorUuid, provider: "probe", model: "probe", itemIndex: 0, kind: record.kind, payload: "opaque" }));
+  const lines = records.map((record2) => JSON.stringify({ sessionId: PROBE_KEY.sessionId, anchorUuid: record2.anchorUuid, provider: "probe", model: "probe", itemIndex: 0, kind: record2.kind, payload: "opaque" }));
   writeFile(path, Buffer.from(`${lines.join(`
 `)}
 `, "utf8"));
@@ -4734,12 +3492,12 @@ async function probeNoWashBack(context, deps) {
     });
     legs.push(await pinnedLeg("mirror from a decorated copy", deps, async (bed) => {
       const canonicalBeforeResume = readFileSync2(canonicalPath);
-      const before = await entryCount(shared, PROBE_KEY);
+      const before2 = await entryCount(shared, PROBE_KEY);
       await bed.freshProcessResume({ home, stagingRoot, key: PROBE_KEY, shared });
       await shared.settle(PROBE_KEY);
-      const after = await entryCount(shared, PROBE_KEY);
-      if (after <= before) {
-        return { passed: false, evidence: `unexercised: the resume from the decorated copy produced no entries (${before} before, ${after} after), so no mirror write was observed` };
+      const after2 = await entryCount(shared, PROBE_KEY);
+      if (after2 <= before2) {
+        return { passed: false, evidence: `unexercised: the resume from the decorated copy produced no entries (${before2} before, ${after2} after), so no mirror write was observed` };
       }
       const canonicalAfterResume = readFileSync2(canonicalPath);
       const prefixIntact = canonicalAfterResume.subarray(0, canonicalBeforeResume.length).equals(canonicalBeforeResume);
@@ -4748,7 +3506,7 @@ async function probeNoWashBack(context, deps) {
       const duplicateUuids = uuids.length - new Set(uuids).size;
       return {
         passed: prefixIntact && stillNoDecoration && duplicateUuids === 0,
-        evidence: `after a resume from the decorated copy that mirrored ${after - before} entr(y|ies): canonical prefix intact=${prefixIntact}; decoration still absent=${stillNoDecoration}; duplicate uuids=${duplicateUuids}`
+        evidence: `after a resume from the decorated copy that mirrored ${after2 - before2} entr(y|ies): canonical prefix intact=${prefixIntact}; decoration still absent=${stillNoDecoration}; duplicate uuids=${duplicateUuids}`
       };
     }));
     return legs;
@@ -4799,8 +3557,8 @@ async function probeSidecarRoundTrip(context, deps) {
       const seenUuids = new Set;
       let orderIntact = lines.length > 0;
       for (const line of lines) {
-        const parent = parentOf(line);
-        if (typeof parent === "string" && !seenUuids.has(parent)) {
+        const parent2 = parentOf(line);
+        if (typeof parent2 === "string" && !seenUuids.has(parent2)) {
           orderIntact = false;
           break;
         }
@@ -5072,11 +3830,11 @@ function createHandoffBarrier(context, deps = {}) {
   };
   const reviewSelectionFor = async (args) => {
     const { persisted, to } = args;
-    const stamped = { ...persisted, runtimeKind: to };
+    const stamped2 = { ...persisted, runtimeKind: to };
     if (deps.selectionInputFor === undefined) {
       return {
         kind: "unreviewed",
-        selection: stamped,
+        selection: stamped2,
         detail: `no selection input was supplied, so nothing checked whether ${to} can serve ${persisted.providerId}/${persisted.modelRef}; the destination's own init is the first thing that will (supply \`selectionInputFor\` to review it here instead)`
       };
     }
@@ -5112,7 +3870,7 @@ function createHandoffBarrier(context, deps = {}) {
         detail: `the official runtime does not serve ${persisted.providerId}/${persisted.modelRef}`
       };
     }
-    return { kind: "servable", selection: stamped, review };
+    return { kind: "servable", selection: stamped2, review };
   };
   const plan = async (session, to) => {
     const entry = await loadEntry(session);
@@ -5138,30 +3896,30 @@ function createHandoffBarrier(context, deps = {}) {
       selection
     };
   };
-  const execute = async (plan) => {
+  const execute = async (plan2) => {
     const trail = [];
-    const record = (step, ok, detail) => {
+    const record2 = (step, ok, detail) => {
       trail.push({ step, name: HANDOFF_STEPS[step - 1].name, ok, detail });
     };
     const lossy = (step, reason) => {
-      record(step, false, reason);
+      record2(step, false, reason);
       return { kind: "lossy-fork-offered", reason, step, detail: reason, steps: trail };
     };
     const blocked = (step, reason, detail) => {
-      record(step, false, detail);
+      record2(step, false, detail);
       return { kind: "blocked", reason, step, detail, steps: trail };
     };
-    const session = plan.session;
+    const session = plan2.session;
     let shared;
-    let winterHome;
+    let winterHome2;
     try {
       shared = sharedOf();
-      winterHome = homeOf();
+      winterHome2 = homeOf();
     } catch (error) {
       return lossy(1, `the shared session store could not be resolved, so nothing about this session can be read or written: ${error instanceof Error ? error.message : String(error)}`);
     }
-    if (plan.selection.kind === "refused") {
-      return lossy(8, plan.selection.refusal.detail);
+    if (plan2.selection.kind === "refused") {
+      return lossy(8, plan2.selection.refusal.detail);
     }
     let lease;
     let stagedRoot;
@@ -5187,13 +3945,13 @@ function createHandoffBarrier(context, deps = {}) {
     try {
       entry = await loadEntry(session);
       assertOneDecoratorStore();
-      if (entry.runtimeKind !== plan.from) {
-        return lossy(1, `this plan was built when ${plan.from} owned the session and ${entry.runtimeKind} owns it now; re-plan against the current owner`);
+      if (entry.runtimeKind !== plan2.from) {
+        return lossy(1, `this plan was built when ${plan2.from} owned the session and ${entry.runtimeKind} owns it now; re-plan against the current owner`);
       }
-      const owner = await deps.participants?.source?.(session, plan.from) ?? undefined;
+      const owner = await deps.participants?.source?.(session, plan2.from) ?? undefined;
       const healthNow = owner?.health === undefined ? undefined : await owner.health();
-      const markers = new Map([...markersFor({ entry, to: plan.to, session, ...healthNow === undefined ? {} : { health: healthNow } })]);
-      for (const step of plan.steps) {
+      const markers = new Map([...markersFor({ entry, to: plan2.to, session, ...healthNow === undefined ? {} : { health: healthNow } })]);
+      for (const step of plan2.steps) {
         if (step.knownUnprovable !== undefined)
           markers.set(step.step, step.knownUnprovable);
       }
@@ -5208,12 +3966,12 @@ function createHandoffBarrier(context, deps = {}) {
         return blocked(1, "lease-held", error instanceof Error ? error.message : String(error));
       }
       await owner?.stopNewTurns?.();
-      record(1, true, "the handoff lease is held by this process and the source is not taking new turns");
+      record2(1, true, "the handoff lease is held by this process and the source is not taking new turns");
       at = 2;
       const drained = owner === undefined ? { ok: true, detail: "there is no live owner to drain" } : await owner.drainToIdleBoundary();
       if (!drained.ok)
         return lossy(2, drained.reason);
-      record(2, true, drained.detail ?? "the active turn reached an idle terminal boundary");
+      record2(2, true, drained.detail ?? "the active turn reached an idle terminal boundary");
       at = 3;
       const streamed = owner === undefined ? { ok: true, detail: "there is no live stream to drain" } : await owner.drainStream();
       if (!streamed.ok)
@@ -5221,7 +3979,7 @@ function createHandoffBarrier(context, deps = {}) {
       const settled = await shared.settle(session);
       if (!settled.settled)
         return lossy(3, "the pending append barrier did not settle, so the canonical tail is still moving");
-      record(3, true, `${streamed.detail ?? "the stream reached its terminal result"}; ${settled.batchesCommitted} canonical append batch(es) settled`);
+      record2(3, true, `${streamed.detail ?? "the stream reached its terminal result"}; ${settled.batchesCommitted} canonical append batch(es) settled`);
       at = 4;
       const eligibility = owner?.eligibility === undefined ? undefined : await owner.eligibility();
       if (eligibility !== undefined && !eligibility.eligible) {
@@ -5235,11 +3993,11 @@ function createHandoffBarrier(context, deps = {}) {
         if (report.status === "diverged" || report.appended !== comparison.missing) {
           return blocked(4, "repair-required", `the canonical store could not be reconciled against ${localRoot}: ${comparison.missing} entr(y|ies) were missing and ${report.appended} landed (${report.status})`);
         }
-        record(4, true, `the canonical tail was ${comparison.missing} entr(y|ies) behind the recorded local-write root and has been reconciled`);
+        record2(4, true, `the canonical tail was ${comparison.missing} entr(y|ies) behind the recorded local-write root and has been reconciled`);
       } else if (comparison.kind === "diverged" || comparison.kind === "canonical-ahead") {
         return blocked(4, "repair-required", comparison.reason);
       } else {
-        record(4, true, comparison.reason);
+        record2(4, true, comparison.reason);
       }
       const storeHealth = shared.health(session);
       if (storeHealth.transcriptHealth !== "ok") {
@@ -5247,10 +4005,10 @@ function createHandoffBarrier(context, deps = {}) {
         return blocked(4, "mirror-error", `the mirror recorded ${storeHealth.errors.length} failure(s) for this session${cause === undefined ? "" : ` (last: ${cause.cause})`}, and it is not reconciled`);
       }
       at = 5;
-      const validation = await validateSessionTranscript(shared, session, winterHome);
+      const validation = await validateSessionTranscript(shared, session, winterHome2);
       if (!validation.ok)
         return lossy(5, validation.reason);
-      record(5, true, validation.detail);
+      record2(5, true, validation.detail);
       at = 6;
       const closed = await owner?.close() ?? undefined;
       if (closed !== undefined && closed.ok === false)
@@ -5266,18 +4024,18 @@ function createHandoffBarrier(context, deps = {}) {
       let staged;
       pendingWritten = true;
       try {
-        staged = await markHandoffPending({ shared, session, entry, plan, level, now: now() });
+        staged = await markHandoffPending({ shared, session, entry, plan: plan2, level, now: now() });
       } catch (error) {
         await unwind();
         return lossy(6, `the handoff could not be staged: ${error instanceof Error ? error.message : String(error)}`);
       }
-      record(6, true, `the owner is closed, the writer lease was granted to this process, and a pending handoff to ${plan.to} at level ${level} is recorded — ownership has NOT moved`);
+      record2(6, true, `the owner is closed, the writer lease was granted to this process, and a pending handoff to ${plan2.to} at level ${level} is recorded — ownership has NOT moved`);
       at = 7;
       let continuity;
       try {
         const layout = (deps.tempLayoutFor ?? defaultTempLayout(context))(entry, session);
         continuity = materializeTempContinuity({
-          to: plan.to,
+          to: plan2.to,
           layout,
           ...owner?.effectiveTempDir === undefined ? {} : { recordedTempDir: owner.effectiveTempDir }
         });
@@ -5285,25 +4043,25 @@ function createHandoffBarrier(context, deps = {}) {
         await unwind();
         return lossy(7, `temp continuity could not be materialized: ${error instanceof Error ? error.message : String(error)}`);
       }
-      record(7, true, `${continuity.mode}: the session's scratch is at ${continuity.effectiveTempDir}${continuity.supersededDir === undefined ? "" : `, superseding ${continuity.supersededDir} (retained)`}`);
+      record2(7, true, `${continuity.mode}: the session's scratch is at ${continuity.effectiveTempDir}${continuity.supersededDir === undefined ? "" : `, superseding ${continuity.supersededDir} (retained)`}`);
       at = 8;
-      const stagingRoot = plan.to === "claude-agent" ? stagingRootFor(staged.stagingUuid) : undefined;
+      const stagingRoot = plan2.to === "claude-agent" ? stagingRootFor(staged.stagingUuid) : undefined;
       if (stagingRoot !== undefined)
         stagedRoot = stagingRoot;
       const decorated = await decoratorOf().decorate({
         session,
-        to: plan.to,
-        materializedPath: stagingRoot === undefined ? canonicalTranscriptPath(winterHome, session) : materializedTranscriptPath(stagingRoot, session),
+        to: plan2.to,
+        materializedPath: stagingRoot === undefined ? canonicalTranscriptPath(winterHome2, session) : materializedTranscriptPath(stagingRoot, session),
         decoration: {
           kind: "handoff",
-          from: plan.from,
+          from: plan2.from,
           at: now().toISOString(),
-          text: (deps.noteText ?? defaultNoteText)({ from: plan.from, to: plan.to, session })
+          text: (deps.noteText ?? defaultNoteText)({ from: plan2.from, to: plan2.to, session })
         }
       });
       target = {
         address: entry.address,
-        runtimeKind: plan.to,
+        runtimeKind: plan2.to,
         backendSessionId: session.sessionId,
         projectKey: session.projectKey,
         compatibilityLevel: level,
@@ -5311,9 +4069,9 @@ function createHandoffBarrier(context, deps = {}) {
         ...stagingRoot === undefined ? {} : { stagingRoot, profile: "store-backed-resume" },
         effectiveTempDir: continuity.effectiveTempDir,
         door: decorated.door,
-        selection: plan.selection.selection
+        selection: plan2.selection.selection
       };
-      const destination = await deps.participants?.destination?.(session, plan.to) ?? undefined;
+      const destination = await deps.participants?.destination?.(session, plan2.to) ?? undefined;
       if (destination === undefined) {
         await unwind();
         return lossy(8, "no destination runtime confirmed the resumed session and level, and the next user message must not be delivered until one does");
@@ -5334,7 +4092,7 @@ function createHandoffBarrier(context, deps = {}) {
         await unwind();
         const reason = `the destination confirmed init but the producer record could not be written: ${error instanceof Error ? error.message : String(error)}`;
         const enriched = target?.stagingRoot === undefined ? reason : `${reason}. The destination is reading ${target.stagingRoot}; that staging copy is retained deliberately and belongs to the host's retention pass.`;
-        record(8, false, enriched);
+        record2(8, false, enriched);
         return {
           kind: "lossy-fork-offered",
           reason,
@@ -5346,7 +4104,7 @@ function createHandoffBarrier(context, deps = {}) {
       }
       const notes = [];
       try {
-        await syncDirectoryEntry({ context, entry, plan, staged, now: now() });
+        await syncDirectoryEntry({ context, entry, plan: plan2, staged, now: now() });
       } catch (error) {
         notes.push(`the host directory's derived copy is behind and will be repaired on the next plan(): ${error instanceof Error ? error.message : String(error)}`);
       }
@@ -5358,12 +4116,12 @@ function createHandoffBarrier(context, deps = {}) {
           notes.push(`the labelled handoff note could not be appended: ${error instanceof Error ? error.message : String(error)}`);
         }
       }
-      record(8, true, confirmed.detail ?? `the destination confirmed ${session.sessionId} at level ${level}, and ownership moved`);
+      record2(8, true, confirmed.detail ?? `the destination confirmed ${session.sessionId} at level ${level}, and ownership moved`);
       return {
         kind: "resumed",
-        selection: plan.selection.selection,
+        selection: plan2.selection.selection,
         step: 8,
-        detail: `the session resumed on ${plan.to} at level ${level} through the ${decorated.door} decoration door${notes.length === 0 ? "" : ` — ${notes.join("; ")}`}`,
+        detail: `the session resumed on ${plan2.to} at level ${level} through the ${decorated.door} decoration door${notes.length === 0 ? "" : ` — ${notes.join("; ")}`}`,
         target,
         steps: trail
       };
@@ -5372,9 +4130,9 @@ function createHandoffBarrier(context, deps = {}) {
       if (committed && entry !== undefined) {
         return {
           kind: "resumed",
-          selection: plan.selection.selection,
+          selection: plan2.selection.selection,
           step: 8,
-          detail: `the session resumed on ${plan.to}, but the barrier failed afterwards: ${detail}`,
+          detail: `the session resumed on ${plan2.to}, but the barrier failed afterwards: ${detail}`,
           ...target === undefined ? {} : { target },
           steps: trail
         };
@@ -5423,8 +4181,8 @@ async function compareAgainstLocalRoot(args) {
       continue;
     compared += 1;
     const entries = await args.shared.store.load(key) ?? [];
-    const canonicalLines = entries.filter((entry) => entry["type"] !== "agent_metadata").map((entry) => JSON.stringify(entry));
-    const comparison = compareTranscriptTail({ localPath, canonicalLines, isDecoration: (uuid) => args.shared.decorations.has(args.session, uuid) });
+    const canonicalLines2 = entries.filter((entry) => entry["type"] !== "agent_metadata").map((entry) => JSON.stringify(entry));
+    const comparison = compareTranscriptTail({ localPath, canonicalLines: canonicalLines2, isDecoration: (uuid) => args.shared.decorations.has(args.session, uuid) });
     const what = key.subpath === undefined ? "the session's transcript" : `subkey ${key.subpath}`;
     switch (comparison.kind) {
       case "match":
@@ -5605,7 +4363,7 @@ async function markHandoffPending(args) {
   const chainable = entries.filter((entry) => typeof entry["uuid"] === "string");
   const cursor = chainable[chainable.length - 1]?.["uuid"] ?? "";
   const health = args.shared.health(args.session);
-  const record = {
+  const record2 = {
     type: DIALECT_RECORD_ENTRY_TYPE,
     backendSessionId: args.session.sessionId,
     transcriptProjectKey: args.session.projectKey,
@@ -5625,18 +4383,18 @@ async function markHandoffPending(args) {
     }
   ]);
   await args.shared.settle(args.session);
-  return { cursor, stagingUuid: cryptoRandomUuid(), record };
+  return { cursor, stagingUuid: cryptoRandomUuid(), record: record2 };
 }
 async function commitProducerRecord(args) {
-  const record = {
+  const record2 = {
     ...args.staged.record,
     ...args.producer?.sdkVersion === undefined ? {} : { producerSdkVersion: args.producer.sdkVersion },
     ...args.producer?.engineVersion === undefined ? {} : { producerEngineVersion: args.producer.engineVersion }
   };
-  await args.shared.store.append(args.session, [record]);
+  await args.shared.store.append(args.session, [record2]);
   await args.shared.settle(args.session);
   const summary = await args.shared.canonical.readSessionSummary({ projectKey: args.session.projectKey, sessionId: args.session.sessionId });
-  if (summary?.["producerRuntime"] !== record["producerRuntime"]) {
+  if (summary?.["producerRuntime"] !== record2["producerRuntime"]) {
     throw new HandoffCommitError(`the producer record did not land: the summary still names ${String(summary?.["producerRuntime"] ?? "no producer")}`);
   }
 }
@@ -6337,7 +5095,7 @@ class SelectionRefusedError extends RuntimeSdkError {
 import { createRequire as createRequire2 } from "node:module";
 import { dirname as dirname2, join as join7 } from "node:path";
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
-var SUPPORTED = { winterAgentSdk: ">=0.0.2 <0.1.0", claudeAgentSdk: "0.3.250" };
+var SUPPORTED = { winterAgentSdk: ">=0.0.3 <0.1.0", claudeAgentSdk: "0.3.250" };
 var SUPPORTED_PROTOCOL_VERSIONS = ["1.0"];
 function parseVersion(raw) {
   const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(raw.trim());
@@ -6400,18 +5158,17 @@ var VERSION_EXPORT_NAMES = ["SDK_VERSION", "VERSION", "PACKAGE_VERSION", "versio
 function readExportedVersion(namespace) {
   if (typeof namespace !== "object" || namespace === null)
     return;
-  const record = namespace;
+  const record2 = namespace;
   for (const name of VERSION_EXPORT_NAMES) {
-    const value = record[name];
+    const value = record2[name];
     if (typeof value === "string" && parseVersion(value) !== undefined)
       return value;
   }
   return;
 }
-function readResolvedManifestVersion(packageName) {
+function readResolvedManifestVersion(packageName, resolveEntry = (name) => createRequire2(import.meta.url).resolve(name)) {
   try {
-    const require2 = createRequire2(import.meta.url);
-    let dir = dirname2(require2.resolve(packageName));
+    let dir = dirname2(resolveEntry(packageName));
     for (let depth = 0;depth < 10; depth++) {
       const manifest = join7(dir, "package.json");
       if (existsSync4(manifest)) {
@@ -6429,19 +5186,25 @@ function readResolvedManifestVersion(packageName) {
     return;
   }
 }
-function identityFor(packageName, namespace, supported) {
+function identityFor(packageName, namespace, supported, declared, seams) {
+  if (declared !== undefined && parseVersion(declared) !== undefined) {
+    return { packageName, packageVersion: declared, source: "host-declared", supported };
+  }
   const exported = readExportedVersion(namespace);
   if (exported !== undefined)
     return { packageName, packageVersion: exported, source: "peer-export", supported };
-  const resolved = readResolvedManifestVersion(packageName);
+  const resolved = readResolvedManifestVersion(packageName, seams.resolveEntry);
   if (resolved !== undefined)
     return { packageName, packageVersion: resolved, source: "resolved-manifest", supported };
   return;
 }
 var UNKNOWN_ACTUAL = "unknown (the injected module exports no version identity and no installed copy could be resolved)";
-function assertVersionMatrix(peers) {
+function assertVersionMatrix(peers, declared) {
+  return resolveVersionMatrix(peers, declared);
+}
+function resolveVersionMatrix(peers, declared, seams = {}) {
   const winterName = "@yanlinglabs/winter-agent-sdk";
-  const winterIdentity = identityFor(winterName, peers.winter, SUPPORTED.winterAgentSdk);
+  const winterIdentity = identityFor(winterName, peers.winter, SUPPORTED.winterAgentSdk, declared?.winterAgentSdk, seams);
   if (winterIdentity === undefined) {
     throw new RuntimeSdkVersionError({ expected: `${winterName} ${SUPPORTED.winterAgentSdk}`, actual: UNKNOWN_ACTUAL });
   }
@@ -6470,7 +5233,7 @@ function assertVersionMatrix(peers) {
   if (peers.claude === undefined)
     return report;
   const claudeName = "@anthropic-ai/claude-agent-sdk";
-  const claudeIdentity = identityFor(claudeName, peers.claude, SUPPORTED.claudeAgentSdk);
+  const claudeIdentity = identityFor(claudeName, peers.claude, SUPPORTED.claudeAgentSdk, declared?.claudeAgentSdk, seams);
   if (claudeIdentity === undefined) {
     throw new RuntimeSdkVersionError({ expected: `${claudeName} ${SUPPORTED.claudeAgentSdk}`, actual: UNKNOWN_ACTUAL });
   }
@@ -6486,10 +5249,10 @@ function runtimeSdkInternals(sdk) {
   return sdk[INTERNALS];
 }
 var INTERNALS = Symbol.for("winter-runtime-sdk.internals");
-function forwardableOptions(options, brand) {
+function forwardableOptions(options, brand, capabilityServers) {
   const stripKeys = ROUTER_ONLY_OPTION_KEYS.filter((key) => (key in options));
   const injectBrand = brand !== undefined && options.brand === undefined;
-  if (stripKeys.length === 0 && !injectBrand)
+  if (stripKeys.length === 0 && !injectBrand && capabilityServers === undefined)
     return options;
   const forwarded = {};
   for (const key of Object.keys(options)) {
@@ -6499,15 +5262,51 @@ function forwardableOptions(options, brand) {
   }
   if (injectBrand)
     forwarded["brand"] = brand;
+  if (capabilityServers !== undefined)
+    forwarded["mcpServers"] = mergedMcpServers(options.mcpServers, capabilityServers);
   return forwarded;
 }
+function mergedMcpServers(callerOwned, capabilityServers) {
+  if (callerOwned === undefined)
+    return capabilityServers;
+  assertNoCapabilityCollision(callerOwned, capabilityServers);
+  return { ...callerOwned, ...capabilityServers };
+}
+function assertNoCapabilityCollision(callerOwned, capabilityServers) {
+  if (callerOwned === undefined)
+    return;
+  for (const name of Object.keys(capabilityServers)) {
+    if (name in callerOwned)
+      throw capabilityNameCollisionError({ field: "mcpServers", name });
+  }
+}
+function capabilityServerRecord(capabilities, brand) {
+  if (capabilities === undefined || capabilities.length === 0)
+    return;
+  const record2 = {};
+  for (const server of capabilities) {
+    if (server.name === brand.mcpServerName) {
+      throw new RuntimeLaunchInputError({
+        field: "capabilities",
+        reason: `\`${server.name}\` is the brand's own standing-server name, which the router registers the messaging tools under on the official branch — a capability server may not claim it (WS-09 §1.3)`
+      });
+    }
+    if (server.name in record2) {
+      throw new RuntimeLaunchInputError({ field: "capabilities", reason: `two capability servers are named \`${server.name}\`, so one of them would never be registered` });
+    }
+    record2[server.name] = server;
+  }
+  return record2;
+}
 function createRuntimeSdk(opts) {
-  const versions = assertVersionMatrix(opts.peers);
+  const versions = assertVersionMatrix(opts.peers, opts.peerVersions);
   const resolved = opts.peers.winter.resolveBrand(opts.brand);
   if (!resolved.ok)
     throw new opts.peers.winter.InvalidBrandError(resolved.reason);
   const brand = resolved.brand;
   const directoryStore = opts.directoryStore ?? createInMemoryRuntimeDirectoryStore();
+  const capabilityServers = capabilityServerRecord(opts.capabilities, brand);
+  const capabilityDescriptors = opts.capabilities === undefined || opts.capabilities.length === 0 ? undefined : capabilityServerDescriptors(opts.capabilities);
   const base = {
     peers: opts.peers,
     keychain: opts.keychain,
@@ -6554,6 +5353,8 @@ function createRuntimeSdk(opts) {
   const queryImpl = (args) => {
     assertLive("query");
     const options = args.options ?? {};
+    if (capabilityServers !== undefined)
+      assertNoCapabilityCollision(options.mcpServers, capabilityServers);
     const runtime = options.runtime;
     const decided = runtime === undefined ? undefined : runtime.selection ?? (runtime.select === undefined ? undefined : decide(runtime.select));
     const ledgerKey = runtime?.official !== undefined ? officialLegAddress(runtime.official) : runtime?.sessionId === undefined ? undefined : sessionLedgerKey(runtime.sessionId);
@@ -6584,10 +5385,14 @@ function createRuntimeSdk(opts) {
         transcriptProjectKey,
         ...opts.vendoredOfficialRuntime === undefined ? {} : { vendoredOfficialRuntime: opts.vendoredOfficialRuntime },
         ...opts.official === undefined ? {} : { policy: opts.official },
+        ...capabilityDescriptors === undefined ? {} : { capabilities: capabilityDescriptors },
+        ...opts.toInputShape === undefined ? {} : { toInputShape: opts.toInputShape },
+        ...opts.peers.claude === undefined ? {} : { mcpModule: opts.peers.claude },
+        ...opts.advisor === undefined ? {} : { advisor: opts.advisor },
         onOpened: noteOpened
       }, { prompt: args.prompt, options: forwardableOptions(options, opts.brand === undefined ? undefined : brand), input: official, selection: decided });
     }
-    const winterQuery = opts.peers.winter.query({ prompt: args.prompt, options: forwardableOptions(options, opts.brand === undefined ? undefined : brand) });
+    const winterQuery = opts.peers.winter.query({ prompt: args.prompt, options: forwardableOptions(options, opts.brand === undefined ? undefined : brand, capabilityServers) });
     noteOpened("winter-agent");
     return winterQuery;
   };
@@ -6617,63 +5422,68 @@ function createRuntimeSdk(opts) {
   return sdk;
 }
 export {
-  CHILD_PROVIDER_UNAVAILABLE,
-  D14_CLAUDE_OAUTH_APPROVED_DEFAULT,
-  EXECUTION_INDIRECTION_ENV_NAMES,
-  EXECUTION_INDIRECTION_ENV_PREFIXES,
-  LIST_AGENTS_FIELD_MAX,
-  MATERIALIZED_RESUME_PROBE_REPORTS,
-  NATIVE_LIST_AGENTS_OUTPUT_SCHEMA,
-  NATIVE_LIST_AGENTS_SCHEMA,
-  NATIVE_SEND_MESSAGE_SCHEMA,
-  NotImplementedYet,
-  RESUME_STAGING_PREFIX,
-  ROUTER_ONLY_OPTION_KEYS,
-  RuntimeHandoffRequiredError,
-  RuntimeLaunchInputError,
-  RuntimeSdkDisposedError,
-  RuntimeSdkError,
-  RuntimeSdkVersionError,
-  SELECTION_RULES,
-  SEND_MESSAGE_SUMMARY_MAX,
-  SEND_MESSAGE_TO_MAX,
-  SUPPORTED,
-  SUPPORTED_PROTOCOL_VERSIONS,
-  SelectionRefusedError,
-  TRAFFIC_OPT_OUT_VARIABLES,
-  TRAFFIC_OPT_OUT_VARIABLE_NAMES,
-  UNKNOWN_VERSION,
-  UnaddressableEntryError,
-  VERSION_EXPORT_NAMES,
-  acceptNativeListAgentsArgs,
-  acceptNativeSendMessageArgs,
-  assertVersionMatrix,
-  createAttachedSessionRegistry,
-  createInMemoryRuntimeDirectoryStore,
-  createMessagingToolHandlers,
-  createOfficialInputStream,
-  createRuntimeMessaging,
-  createRuntimeSdk,
-  forwardableOptions,
-  isExecutionIndirectionVariable,
-  isOfficialQuery,
-  isResumeStagingRoot,
-  isSelectionRefusal,
-  materializedResumeReportForPin,
-  officialConnectionEnv,
-  officialCredentialPlan,
-  officialUserTurn,
-  parseVersion,
-  readExportedVersion,
-  readResolvedManifestVersion,
-  resumeChildSelection,
-  resumeStagingRoot,
-  reviewPersistedSelection,
-  ruleIdOf,
-  runtimeSdkInternals,
-  satisfiesRange,
-  selectChildRuntime,
-  selectChildRuntimePairing,
+  winterMcpServerDescriptor,
+  selectionVersionsFrom,
   selectRuntime,
-  selectionVersionsFrom
+  selectChildRuntimePairing,
+  selectChildRuntime,
+  satisfiesRange,
+  runtimeSdkInternals,
+  ruleIdOf,
+  reviewPersistedSelection,
+  resumeStagingRoot,
+  resumeChildSelection,
+  renderAttributedTurn,
+  readResolvedManifestVersion,
+  readExportedVersion,
+  parseVersion,
+  officialUserTurn,
+  officialMcpServers,
+  officialDisallowedTools,
+  officialCredentialPlan,
+  officialConnectionEnv,
+  officialBranchLabel,
+  minimalOsEnvironmentFrom,
+  materializedResumeReportForPin,
+  materializeOfficialMcpServer,
+  isSelectionRefusal,
+  isResumeStagingRoot,
+  isOurApprovalBridge,
+  isOfficialQuery,
+  isExecutionIndirectionVariable,
+  forwardableOptions,
+  createRuntimeSdk,
+  createRuntimeMessaging,
+  createOfficialInputStream,
+  createInMemoryRuntimeDirectoryStore,
+  createAttachedSessionRegistry,
+  createApprovalBridge,
+  containmentDispositions,
+  canonicalToolNames,
+  buildOfficialChildEnv,
+  assertVersionMatrix,
+  VERSION_EXPORT_NAMES,
+  UnaddressableEntryError,
+  UNKNOWN_VERSION,
+  TRAFFIC_OPT_OUT_VARIABLE_NAMES,
+  TRAFFIC_OPT_OUT_VARIABLES,
+  SelectionRefusedError,
+  SUPPORTED_PROTOCOL_VERSIONS,
+  SUPPORTED,
+  SELECTION_RULES,
+  RuntimeSdkVersionError,
+  RuntimeSdkError,
+  RuntimeSdkDisposedError,
+  RuntimeLaunchInputError,
+  RuntimeHandoffRequiredError,
+  ROUTER_ONLY_OPTION_KEYS,
+  RESUME_STAGING_PREFIX,
+  OFFICIAL_MATERIALIZATION_DROPS,
+  OFFICIAL_DISCLOSURES,
+  NotImplementedYet,
+  MATERIALIZED_RESUME_PROBE_REPORTS,
+  EXECUTION_INDIRECTION_ENV_PREFIXES,
+  EXECUTION_INDIRECTION_ENV_NAMES,
+  D14_CLAUDE_OAUTH_APPROVED_DEFAULT,
+  CHILD_PROVIDER_UNAVAILABLE
 };