agy-worker-mcp 0.3.1

package/dist/runner/verify.d.ts

@@ -0,0 +1,24 @@
+import type { VerifyRecord } from '../contract/types.js';
+export interface RunVerifyOptions {
+    command: string;
+    /** Canonical workspace — the same `cwd` agy itself ran in. */
+    cwd: string;
+    /** The same allowlisted child env agy's own process received. */
+    env: Record<string, string>;
+    timeoutMs: number;
+    /** `jobs/<id>/verify.log` — truncated fresh for this run. */
+    logPath: string;
+}
+/**
+ * Spawn `sh -c <command>` detached (its own process group, same technique as
+ * `spawnAgyDetached`), append stdout+stderr to `logPath` capped at 1 MiB, and
+ * wait up to `timeoutMs` — killing the whole group on timeout.
+ *
+ * Unlike agy's own spawn, stdio is genuinely piped rather than fd-redirected:
+ * the runner is alive and actively draining both streams for the entire
+ * lifetime of this call (there is no detached-parent-exits race to guard
+ * against here), which is what makes counting bytes for the 1 MiB cap
+ * possible in the first place.
+ */
+export declare function runVerifyCommand(opts: RunVerifyOptions): Promise<VerifyRecord>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/runner/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/runner/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAkBxD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAA;IACX,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAuFpF"}

package/dist/runner/verify.js

@@ -0,0 +1,108 @@
+import { spawn } from 'node:child_process';
+import { closeSync, openSync, writeSync } from 'node:fs';
+import { killProcessGroup } from './reap.js';
+/**
+ * `verify_command` execution (PR6; see docs/permissions.md).
+ *
+ * Run once by the runner, after agy has exited normally, against the final
+ * workspace state — outside the model's own decisions entirely. Not a
+ * sandboxing feature: this runs as the user, with no isolation, at the same
+ * trust level as the parent agent running the command itself. Its own
+ * `deadline_at`-independent timeout (`timeoutMs`) means it may finish after
+ * the job's `deadline_at` has already passed; that is expected, not a bug —
+ * agy's deadline and the verify timeout are two separate clocks.
+ */
+const MAX_VERIFY_LOG_BYTES = 1024 * 1024;
+const TRUNCATION_MARKER = '\n[agy-worker: verify output truncated at 1 MiB]\n';
+/**
+ * Spawn `sh -c <command>` detached (its own process group, same technique as
+ * `spawnAgyDetached`), append stdout+stderr to `logPath` capped at 1 MiB, and
+ * wait up to `timeoutMs` — killing the whole group on timeout.
+ *
+ * Unlike agy's own spawn, stdio is genuinely piped rather than fd-redirected:
+ * the runner is alive and actively draining both streams for the entire
+ * lifetime of this call (there is no detached-parent-exits race to guard
+ * against here), which is what makes counting bytes for the 1 MiB cap
+ * possible in the first place.
+ */
+export async function runVerifyCommand(opts) {
+    const startedAt = Date.now();
+    const startHr = process.hrtime.bigint();
+    // 'w': each job runs verify_command at most once, so a fresh file is always
+    // correct — there is nothing from a previous run to append to.
+    const logFd = openSync(opts.logPath, 'w', 0o600);
+    let bytesWritten = 0;
+    let truncated = false;
+    const appendChunk = (chunk) => {
+        if (truncated)
+            return;
+        const remaining = MAX_VERIFY_LOG_BYTES - bytesWritten;
+        if (remaining <= 0) {
+            truncated = true;
+            writeSync(logFd, TRUNCATION_MARKER);
+            return;
+        }
+        const slice = chunk.length > remaining ? chunk.subarray(0, remaining) : chunk;
+        writeSync(logFd, slice);
+        bytesWritten += slice.length;
+        if (chunk.length > remaining) {
+            truncated = true;
+            writeSync(logFd, TRUNCATION_MARKER);
+        }
+    };
+    let child;
+    try {
+        child = spawn('sh', ['-c', opts.command], {
+            cwd: opts.cwd,
+            env: opts.env,
+            detached: true,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        writeSync(logFd, `[agy-worker: verify spawn failed: ${message}]\n`);
+        closeSync(logFd);
+        const durationMs = Math.round(Number(process.hrtime.bigint() - startHr) / 1e6);
+        return {
+            command: opts.command,
+            exit_code: null,
+            signal: null,
+            started_at: startedAt,
+            duration_ms: durationMs,
+            timed_out: false,
+        };
+    }
+    const pid = child.pid;
+    if (pid == null) {
+        closeSync(logFd);
+        throw new Error('agy-worker-runner: verify spawn produced no pid');
+    }
+    // detached:true makes the child the leader of its own process group, so
+    // pgid === pid — same as spawnAgyDetached.
+    const pgid = pid;
+    child.stdout?.on('data', appendChunk);
+    child.stderr?.on('data', appendChunk);
+    const exitPromise = new Promise((resolveExit) => {
+        child.once('exit', (code, signal) => resolveExit({ code, signal }));
+        child.once('error', () => resolveExit({ code: null, signal: null }));
+    });
+    let timedOut = false;
+    const timeoutTimer = setTimeout(() => {
+        timedOut = true;
+        void killProcessGroup(pgid);
+    }, opts.timeoutMs);
+    const { code, signal } = await exitPromise;
+    clearTimeout(timeoutTimer);
+    closeSync(logFd);
+    const durationMs = Math.round(Number(process.hrtime.bigint() - startHr) / 1e6);
+    return {
+        command: opts.command,
+        exit_code: code,
+        signal,
+        started_at: startedAt,
+        duration_ms: durationMs,
+        timed_out: timedOut,
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/runner/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/runner/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAGxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;;;;;;GAUG;AAEH,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAA;AACxC,MAAM,iBAAiB,GAAG,oDAAoD,CAAA;AAa9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAsB;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAEvC,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IAChD,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,SAAS,GAAG,KAAK,CAAA;IAErB,MAAM,WAAW,GAAG,CAAC,KAAa,EAAQ,EAAE;QAC1C,IAAI,SAAS;YAAE,OAAM;QACrB,MAAM,SAAS,GAAG,oBAAoB,GAAG,YAAY,CAAA;QACrD,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,SAAS,GAAG,IAAI,CAAA;YAChB,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC7E,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACvB,YAAY,IAAI,KAAK,CAAC,MAAM,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC7B,SAAS,GAAG,IAAI,CAAA;YAChB,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAA;QACrC,CAAC;IACH,CAAC,CAAA;IAED,IAAI,KAAK,CAAA;IACT,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YACxC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC1D,SAAS,CAAC,KAAK,EAAE,qCAAqC,OAAO,KAAK,CAAC,CAAA;QACnE,SAAS,CAAC,KAAK,CAAC,CAAA;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;QAC9E,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,KAAK;SACjB,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IACrB,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,SAAS,CAAC,KAAK,CAAC,CAAA;QAChB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAA;IAEhB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACrC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAErC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAiD,CAAC,WAAW,EAAE,EAAE;QAC9F,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;QACnE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;QACnC,QAAQ,GAAG,IAAI,CAAA;QACf,KAAK,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAElB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,WAAW,CAAA;IAC1C,YAAY,CAAC,YAAY,CAAC,CAAA;IAC1B,SAAS,CAAC,KAAK,CAAC,CAAA;IAEhB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAA;IAE9E,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI;QACf,MAAM;QACN,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,QAAQ;KACpB,CAAA;AACH,CAAC"}

package/dist/runner.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=runner.d.ts.map

package/dist/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":""}

package/dist/runner.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+/**
+ * Entry point for the detached runner. Compiles to `dist/runner.js`.
+ *
+ * Spawned with `detached: true` by whichever server started the job, and expected
+ * to keep running after that server is gone.
+ */
+import { main } from './runner/runner.js';
+main(process.argv.slice(2))
+    .then((code) => process.exit(code))
+    .catch((e) => {
+    process.stderr.write(`agy-worker-runner: ${e instanceof Error ? e.stack ?? e.message : String(e)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=runner.js.map

package/dist/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAEzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAClC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACrG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/server/context.d.ts

@@ -0,0 +1,41 @@
+import type { Capabilities, ClientSnapshot } from '../contract/types.js';
+import type { ProjectPaths } from '../contract/paths.js';
+import { type Store } from '../store/db.js';
+/** Shared state every tool handler receives. One per server process. */
+export interface ToolContext {
+    store: Store;
+    paths: ProjectPaths;
+    version: string;
+    limits: Capabilities['limits'];
+    /**
+     * Set by `createServer` once the transport exists. Left undefined when a test
+     * (or any other caller) drives the handlers directly with no client attached.
+     */
+    getClient?: () => ClientSnapshot | null;
+}
+/**
+ * Standard MCP tool return. The JSON goes out as text content *and* as
+ * `structuredContent`: Codex's structured-output support is uneven, so text is
+ * the safe default while structured stays available for clients that use it
+ * (see docs/tools.md).
+ */
+export interface ToolReply {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    structuredContent?: Record<string, unknown>;
+    isError?: boolean;
+}
+/** Wrap a JSON-serializable payload as text content plus structuredContent. */
+export declare function reply(payload: unknown): ToolReply;
+/**
+ * Turn any throw into a teaching error reply: the structured `detail` from
+ * `contract/errors.ts` plus its `remedy`, so the calling agent can self-correct
+ * without another round trip.
+ */
+export declare function errorReply(e: unknown): ToolReply;
+export declare const DEFAULT_LIMITS: Capabilities['limits'];
+/** Build the context, opening the store for the discovered project root. */
+export declare function createContext(cwd?: string): ToolContext;
+//# sourceMappingURL=context.d.ts.map

package/dist/server/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAGxD,OAAO,EAAa,KAAK,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEtD,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,cAAc,GAAG,IAAI,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3C,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,+EAA+E;AAC/E,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAOjD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,GAAG,SAAS,CAOhD;AAYD,eAAO,MAAM,cAAc,EAAE,YAAY,CAAC,QAAQ,CAWjD,CAAA;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,CAQvD"}

package/dist/server/context.js

@@ -0,0 +1,59 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { packageRoot } from '../contract/paths.js';
+import { toErrorEnvelope } from '../contract/errors.js';
+import { openStore } from '../store/db.js';
+/** Wrap a JSON-serializable payload as text content plus structuredContent. */
+export function reply(payload) {
+    const text = JSON.stringify(payload, null, 2);
+    const structuredContent = payload !== null && typeof payload === 'object' && !Array.isArray(payload)
+        ? payload
+        : { value: payload };
+    return { content: [{ type: 'text', text }], structuredContent };
+}
+/**
+ * Turn any throw into a teaching error reply: the structured `detail` from
+ * `contract/errors.ts` plus its `remedy`, so the calling agent can self-correct
+ * without another round trip.
+ */
+export function errorReply(e) {
+    const envelope = toErrorEnvelope(e);
+    return {
+        content: [{ type: 'text', text: JSON.stringify(envelope, null, 2) }],
+        structuredContent: envelope,
+        isError: true,
+    };
+}
+function readPackageVersion() {
+    try {
+        const raw = readFileSync(join(packageRoot(), 'package.json'), 'utf8');
+        const pkg = JSON.parse(raw);
+        return typeof pkg.version === 'string' ? pkg.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+export const DEFAULT_LIMITS = {
+    max_running_jobs: 3,
+    max_timeout_ms: 60 * 60 * 1000,
+    default_timeout_ms: 15 * 60 * 1000,
+    // See the comment on `Capabilities['limits']` for why
+    // this value is a judgment call, not a measurement.
+    default_idle_timeout_ms: 2 * 60 * 1000,
+    max_idle_timeout_ms: 60 * 60 * 1000,
+    default_verify_timeout_ms: 10 * 60 * 1000,
+    max_response_bytes: 32_000,
+    max_log_tail_lines: 30,
+};
+/** Build the context, opening the store for the discovered project root. */
+export function createContext(cwd) {
+    const store = openStore({ cwd });
+    return {
+        store,
+        paths: store.paths,
+        version: readPackageVersion(),
+        limits: DEFAULT_LIMITS,
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/server/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAc,MAAM,gBAAgB,CAAA;AA2BtD,+EAA+E;AAC/E,MAAM,UAAU,KAAK,CAAC,OAAgB;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC7C,MAAM,iBAAiB,GACrB,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACxE,CAAC,CAAE,OAAmC;QACtC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IACxB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAA;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,CAAU;IACnC,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAA;IACnC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACpE,iBAAiB,EAAE,QAA8C;QACjE,OAAO,EAAE,IAAI;KACd,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAA;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAA;QACnD,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAA;IAChB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,gBAAgB,EAAE,CAAC;IACnB,cAAc,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IAC9B,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IAClC,sDAAsD;IACtD,oDAAoD;IACpD,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;IACtC,mBAAmB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACnC,yBAAyB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACzC,kBAAkB,EAAE,MAAM;IAC1B,kBAAkB,EAAE,EAAE;CACvB,CAAA;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAChC,OAAO;QACL,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,kBAAkB,EAAE;QAC7B,MAAM,EAAE,cAAc;KACvB,CAAA;AACH,CAAC"}

package/dist/server/instructions.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Server instructions — returned in the MCP `initialize` response and injected
+ * into the calling agent's system prompt.
+ *
+ * This is the top layer of the three-layer tool surface:
+ * this file sets orientation and the traps that matter before the first call;
+ * per-tool `description` and per-parameter `.describe()` carry the call-by-call
+ * detail; `contract/errors.ts` carries the in-the-moment repair. Two rules for
+ * whoever edits it: never describe a capability that does not exist, and never
+ * omit a trap that does.
+ */
+export declare const SERVER_INSTRUCTIONS = "agy-worker-mcp runs the Google Antigravity CLI (agy) as an asynchronous worker.\nJobs are detached: they survive this connection, and any client attached to the\nsame project can observe, wait on, or take over any job \u2014 including one another\nclient started.\n\nRecommended flow\n  agy_capabilities  -> profiles, models, limits, discovered project root\n  agy_start         -> returns a job_id immediately; nothing blocks\n  agy_wait          -> loop: call again with the returned cursor until\n                        lifecycle is \"finished\" (wait_ms: 0 = snapshot, no block)\n  agy_result        -> full verdict, denials, artifacts, response text\n  agy_logs          -> only if you need the raw or normalized stream itself,\n                        by cursor or tail\n\nTwo things that will mislead you if you forget them\n  1. Do not trust agy's self-report. Permission denials and sandbox blocks both\n     come back as exit 0 with status SUCCESS. Read outcome and contract_status\n     from the broker instead; agent_report is an unverified claim, never the\n     basis for outcome.\n  2. verified_success means checks actually passed. success_unverified means\n     nothing was checkable. blocked means something was denied (or, on a job\n     that ran sandboxed, silently refused by the OS sandbox). Treat blocked as\n     \"did not do what you asked,\" not as a lesser success.\n\nWhen a job is blocked\n  agy_result -> verification.blockers[] is one list of everything that stood\n  in the way. Read two fields first: \"actionable\" says whether a different\n  agy_start can lift it, and \"remedy\" says what to change (a rule string like\n  \"command(python -m pytest)\" for our gate; a rule the project ceiling lacks\n  needs a human to widen the ceiling file, not agy_start).\n  actionable: false means no agy_start argument will help \u2014 the command tried\n  to leave the workspace, a subagent tool was used (subagents run outside this\n  job's policy and are always denied), the ceiling refused the rule, or the\n  ceiling forces the sandbox on. \"source\" says who refused: policy_ceiling,\n  gate, agy_engine, sandbox, broker, tool_error. Our gate is the sole approval\n  authority for a job (agy's own approval engine is disabled), so an\n  agy_engine entry on a current job means something regressed \u2014 report it.\n  Sandbox: allowed commands run WITHOUT agy's OS sandbox on general_worker\n  (0.2.1) \u2014 the gate's allow list is the boundary, as in Claude Code \u2014 so an\n  \"Operation not permitted\" there is the command's own failure and comes back\n  as a warning, not a blocker. research_readonly is always sandboxed; a project\n  can set sandbox: \"seatbelt\" (our write-only profile: writes stay inside the\n  workspace and the ceiling's write_roots, builds still run) or sandbox: \"agy\"\n  in its ceiling file, and the parent can raise it per job with\n  permissions.sandbox. On agy 1.1.24 an agy-sandboxed job cannot\n  write inside the workspace from a shell (builds, tests, git commit fail),\n  though agy's own file tools still edit files. agy_start reports the same\n  shape before a job runs:\n  its policy_summary and blockers[] tell you if the ceiling rejected your\n  permissions.allow. Note allow_count: 0 \u2014 a fully rejected request drops the\n  profile's own defaults with it, and the fix is to start again with no\n  permissions.allow at all.\n\nWhat is not possible\n  You cannot interrupt or redirect a turn that is already running. agy_send\n  only queues: the current turn finishes first, then the queued one runs, on a\n  job started with session_mode \"session\".\n  Sessions resume losslessly, so a finished oneshot job can be continued at\n  any time with agy_start({ session_id }) \u2014 no need to keep a session-mode job\n  running just to preserve context.\n\nBefore agy_start on general_worker (measured 2026-09-08 across 35 real jobs)\n  - Give it something checkable: verify_command (the build or test command),\n    expected_artifacts, or json_schema. Without one the best possible outcome\n    is success_unverified and you will end up re-running the checks yourself;\n    12 of those 35 jobs went exactly that way.\n  - Every shell command your prompt asks for must match the effective allow\n    list (agy_capabilities: profiles[].allow plus ceiling.allow; a rule on\n    profiles[].deny opens only through ceiling.exceptions). A prompt\n    that says \"run JAVA_HOME=... ./gradlew\" against a list that only allows\n    \"./gradlew\" guarantees a blocked job. Check with agy_start({ dry_run: true, expected_commands: [...] }).\n  - One writing job per cwd at a time (a cwd_write lock; a second agy_start\n    fails with LOCK_CONFLICT). For parallel work, give each job its own git\n    worktree inside the project root as cwd.\n  - When a blocker's remedy needs the ceiling (actionable: false, source\n    policy_ceiling, or a rule the ceiling lacks), report the rule string and\n    the ceiling file path (agy_capabilities -> ceiling.path) to the user\n    verbatim and stop. Do not work around it by telling the next job not to\n    run that command \u2014 that only moves the check back onto you. To propose a\n    ceiling, call agy_ceiling (history + validation of a draft) and show the\n    user the draft; never write policy.json without their explicit approval\n    of that draft in the current conversation.\n  - A warning starting \"no project ceiling at\" (agy_capabilities,\n    agy_start, agy_result) means this project has no ceiling file and jobs\n    get the profile as shipped. Not an error; do not repeat it to the user on\n    every call. Mention it once when a job needs more than the profile\n    allows, or when the user asks why something was denied: they can run\n    /agy-ceiling themselves, or you can draft one via agy_ceiling / the\n    agy-ceiling skill. Either way the user approves before anything is\n    written.\n\nSaving quota\n  agy_start({ dry_run: true }) resolves cwd, profile, policy and argv and\n  returns the effective config without launching agy or spending quota. Use it\n  to settle permissions before a real run, especially after a blocked job.\n\nverify_command\n  agy_start({ verify_command }) runs a command once, after agy exits normally,\n  against the final workspace state \u2014 outside the model's own decisions\n  entirely; it cannot be skipped, reordered, or narrowed from inside the job.\n  It is not a sandboxing feature: it runs as the user, unsandboxed, exactly the\n  way the parent agent running the command itself would. A non-zero exit or a\n  verify_timeout_ms timeout makes outcome \"failed\" \u2014 never a blocker, since\n  nothing was refused. agy_result's verification.verify carries\n  { command, exit_code, signal, duration_ms, timed_out, output_tail }, where\n  output_tail is only the last 2 KiB; the full log is\n  jobs/<job_id>/verify.log on disk. verify: null means no verify_command was\n  configured (or the job's own deadline killed agy first, which skips verify\n  entirely).";
+//# sourceMappingURL=instructions.d.ts.map

package/dist/server/instructions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instructions.d.ts","sourceRoot":"","sources":["../../src/server/instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,y4NA4GnB,CAAA"}

package/dist/server/instructions.js

@@ -0,0 +1,121 @@
+/**
+ * Server instructions — returned in the MCP `initialize` response and injected
+ * into the calling agent's system prompt.
+ *
+ * This is the top layer of the three-layer tool surface:
+ * this file sets orientation and the traps that matter before the first call;
+ * per-tool `description` and per-parameter `.describe()` carry the call-by-call
+ * detail; `contract/errors.ts` carries the in-the-moment repair. Two rules for
+ * whoever edits it: never describe a capability that does not exist, and never
+ * omit a trap that does.
+ */
+export const SERVER_INSTRUCTIONS = `agy-worker-mcp runs the Google Antigravity CLI (agy) as an asynchronous worker.
+Jobs are detached: they survive this connection, and any client attached to the
+same project can observe, wait on, or take over any job — including one another
+client started.
+
+Recommended flow
+  agy_capabilities  -> profiles, models, limits, discovered project root
+  agy_start         -> returns a job_id immediately; nothing blocks
+  agy_wait          -> loop: call again with the returned cursor until
+                        lifecycle is "finished" (wait_ms: 0 = snapshot, no block)
+  agy_result        -> full verdict, denials, artifacts, response text
+  agy_logs          -> only if you need the raw or normalized stream itself,
+                        by cursor or tail
+
+Two things that will mislead you if you forget them
+  1. Do not trust agy's self-report. Permission denials and sandbox blocks both
+     come back as exit 0 with status SUCCESS. Read outcome and contract_status
+     from the broker instead; agent_report is an unverified claim, never the
+     basis for outcome.
+  2. verified_success means checks actually passed. success_unverified means
+     nothing was checkable. blocked means something was denied (or, on a job
+     that ran sandboxed, silently refused by the OS sandbox). Treat blocked as
+     "did not do what you asked," not as a lesser success.
+
+When a job is blocked
+  agy_result -> verification.blockers[] is one list of everything that stood
+  in the way. Read two fields first: "actionable" says whether a different
+  agy_start can lift it, and "remedy" says what to change (a rule string like
+  "command(python -m pytest)" for our gate; a rule the project ceiling lacks
+  needs a human to widen the ceiling file, not agy_start).
+  actionable: false means no agy_start argument will help — the command tried
+  to leave the workspace, a subagent tool was used (subagents run outside this
+  job's policy and are always denied), the ceiling refused the rule, or the
+  ceiling forces the sandbox on. "source" says who refused: policy_ceiling,
+  gate, agy_engine, sandbox, broker, tool_error. Our gate is the sole approval
+  authority for a job (agy's own approval engine is disabled), so an
+  agy_engine entry on a current job means something regressed — report it.
+  Sandbox: allowed commands run WITHOUT agy's OS sandbox on general_worker
+  (0.2.1) — the gate's allow list is the boundary, as in Claude Code — so an
+  "Operation not permitted" there is the command's own failure and comes back
+  as a warning, not a blocker. research_readonly is always sandboxed; a project
+  can set sandbox: "seatbelt" (our write-only profile: writes stay inside the
+  workspace and the ceiling's write_roots, builds still run) or sandbox: "agy"
+  in its ceiling file, and the parent can raise it per job with
+  permissions.sandbox. On agy 1.1.24 an agy-sandboxed job cannot
+  write inside the workspace from a shell (builds, tests, git commit fail),
+  though agy's own file tools still edit files. agy_start reports the same
+  shape before a job runs:
+  its policy_summary and blockers[] tell you if the ceiling rejected your
+  permissions.allow. Note allow_count: 0 — a fully rejected request drops the
+  profile's own defaults with it, and the fix is to start again with no
+  permissions.allow at all.
+
+What is not possible
+  You cannot interrupt or redirect a turn that is already running. agy_send
+  only queues: the current turn finishes first, then the queued one runs, on a
+  job started with session_mode "session".
+  Sessions resume losslessly, so a finished oneshot job can be continued at
+  any time with agy_start({ session_id }) — no need to keep a session-mode job
+  running just to preserve context.
+
+Before agy_start on general_worker (measured 2026-09-08 across 35 real jobs)
+  - Give it something checkable: verify_command (the build or test command),
+    expected_artifacts, or json_schema. Without one the best possible outcome
+    is success_unverified and you will end up re-running the checks yourself;
+    12 of those 35 jobs went exactly that way.
+  - Every shell command your prompt asks for must match the effective allow
+    list (agy_capabilities: profiles[].allow plus ceiling.allow; a rule on
+    profiles[].deny opens only through ceiling.exceptions). A prompt
+    that says "run JAVA_HOME=... ./gradlew" against a list that only allows
+    "./gradlew" guarantees a blocked job. Check with agy_start({ dry_run: true, expected_commands: [...] }).
+  - One writing job per cwd at a time (a cwd_write lock; a second agy_start
+    fails with LOCK_CONFLICT). For parallel work, give each job its own git
+    worktree inside the project root as cwd.
+  - When a blocker's remedy needs the ceiling (actionable: false, source
+    policy_ceiling, or a rule the ceiling lacks), report the rule string and
+    the ceiling file path (agy_capabilities -> ceiling.path) to the user
+    verbatim and stop. Do not work around it by telling the next job not to
+    run that command — that only moves the check back onto you. To propose a
+    ceiling, call agy_ceiling (history + validation of a draft) and show the
+    user the draft; never write policy.json without their explicit approval
+    of that draft in the current conversation.
+  - A warning starting "no project ceiling at" (agy_capabilities,
+    agy_start, agy_result) means this project has no ceiling file and jobs
+    get the profile as shipped. Not an error; do not repeat it to the user on
+    every call. Mention it once when a job needs more than the profile
+    allows, or when the user asks why something was denied: they can run
+    /agy-ceiling themselves, or you can draft one via agy_ceiling / the
+    agy-ceiling skill. Either way the user approves before anything is
+    written.
+
+Saving quota
+  agy_start({ dry_run: true }) resolves cwd, profile, policy and argv and
+  returns the effective config without launching agy or spending quota. Use it
+  to settle permissions before a real run, especially after a blocked job.
+
+verify_command
+  agy_start({ verify_command }) runs a command once, after agy exits normally,
+  against the final workspace state — outside the model's own decisions
+  entirely; it cannot be skipped, reordered, or narrowed from inside the job.
+  It is not a sandboxing feature: it runs as the user, unsandboxed, exactly the
+  way the parent agent running the command itself would. A non-zero exit or a
+  verify_timeout_ms timeout makes outcome "failed" — never a blocker, since
+  nothing was refused. agy_result's verification.verify carries
+  { command, exit_code, signal, duration_ms, timed_out, output_tail }, where
+  output_tail is only the last 2 KiB; the full log is
+  jobs/<job_id>/verify.log on disk. verify: null means no verify_command was
+  configured (or the job's own deadline killed agy first, which skips verify
+  entirely).`;
+//# sourceMappingURL=instructions.js.map

package/dist/server/instructions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instructions.js","sourceRoot":"","sources":["../../src/server/instructions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA4GtB,CAAA"}

package/dist/server/server.d.ts

@@ -0,0 +1,20 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ToolContext } from './context.js';
+/**
+ * The stdio MCP server. One process per connected client —
+ * there is no daemon and no shared broker; coordination happens entirely through
+ * the project SQLite database and the job directories.
+ *
+ * Capabilities are `{ tools: {} }` only. No resources, no prompts.
+ */
+export interface CreateServerOptions {
+    ctx: ToolContext;
+    version: string;
+}
+/** Build the server and register the nine tools. */
+export declare function createServer(opts: CreateServerOptions): McpServer;
+/** `dist/server.js` entry point. Connects a `StdioServerTransport` and stays up. */
+export declare function main(): Promise<void>;
+/** Close the store and flush state. Registered on SIGINT/SIGTERM. */
+export declare function shutdown(ctx: ToolContext): void;
+//# sourceMappingURL=server.d.ts.map

package/dist/server/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAK/C;;;;;;GAMG;AAEH,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,WAAW,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,oDAAoD;AACpD,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAwBjE;AAED,oFAAoF;AACpF,wBAAsB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAgB1C;AAED,qEAAqE;AACrE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI,CAM/C"}

package/dist/server/server.js

@@ -0,0 +1,55 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createContext } from './context.js';
+import { registerAllTools } from './tools/index.js';
+import { SERVER_INSTRUCTIONS } from './instructions.js';
+/** Build the server and register the nine tools. */
+export function createServer(opts) {
+    const server = new McpServer({ name: 'agy-worker-mcp', version: opts.version }, {
+        capabilities: { tools: {} },
+        instructions: SERVER_INSTRUCTIONS,
+    });
+    // What the client declared at `initialize`. The SDK only fills these in once
+    // the handshake completed, so read them per call rather than snapshotting at
+    // construction time.
+    opts.ctx.getClient = () => {
+        const impl = server.server.getClientVersion();
+        const caps = server.server.getClientCapabilities();
+        if (!impl && !caps)
+            return null;
+        return {
+            name: impl?.name ?? null,
+            version: impl?.version ?? null,
+            capabilities: caps ? caps : null,
+        };
+    };
+    registerAllTools(server, opts.ctx);
+    return server;
+}
+/** `dist/server.js` entry point. Connects a `StdioServerTransport` and stays up. */
+export async function main() {
+    const ctx = createContext();
+    const server = createServer({ ctx, version: ctx.version });
+    let shuttingDown = false;
+    const handleSignal = () => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        shutdown(ctx);
+        process.exit(0);
+    };
+    process.on('SIGINT', handleSignal);
+    process.on('SIGTERM', handleSignal);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+/** Close the store and flush state. Registered on SIGINT/SIGTERM. */
+export function shutdown(ctx) {
+    try {
+        ctx.store.close();
+    }
+    catch {
+        // best effort — the process is exiting either way
+    }
+}
+//# sourceMappingURL=server.js.map

package/dist/server/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAGhF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAevD,oDAAoD;AACpD,MAAM,UAAU,YAAY,CAAC,IAAyB;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EACjD;QACE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,YAAY,EAAE,mBAAmB;KAClC,CACF,CAAA;IACD,6EAA6E;IAC7E,6EAA6E;IAC7E,qBAAqB;IACrB,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAA;QAClD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAC/B,OAAO;YACL,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;YACxB,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;YAC9B,YAAY,EAAE,IAAI,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,IAAI;SAC9D,CAAA;IACH,CAAC,CAAA;IAED,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IAClC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,IAAI;IACxB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IAE1D,IAAI,YAAY,GAAG,KAAK,CAAA;IACxB,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,IAAI,YAAY;YAAE,OAAM;QACxB,YAAY,GAAG,IAAI,CAAA;QACnB,QAAQ,CAAC,GAAG,CAAC,CAAA;QACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAA;IACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;IAClC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAEnC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,QAAQ,CAAC,GAAgB;IACvC,IAAI,CAAC;QACH,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;AACH,CAAC"}

package/dist/server/tools/cancel.d.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+import { type ToolContext, type ToolReply } from '../context.js';
+/**
+ * `agy_cancel` — kill a running job and everything it spawned.
+ *
+ * Signals the process group, not the pid, so agy's own children die too
+ * (verified by checking `pgrep -g` afterwards).
+ */
+export declare const cancelInput: z.ZodObject<{
+    job_id: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+    grace_ms: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    job_id: string;
+    reason?: string | undefined;
+    grace_ms?: number | undefined;
+}, {
+    job_id: string;
+    reason?: string | undefined;
+    grace_ms?: number | undefined;
+}>;
+export type CancelInput = z.infer<typeof cancelInput>;
+export declare function handleCancel(ctx: ToolContext, input: CancelInput): Promise<ToolReply>;
+//# sourceMappingURL=cancel.d.ts.map

package/dist/server/tools/cancel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel.d.ts","sourceRoot":"","sources":["../../../src/server/tools/cancel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,OAAO,EAAqB,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAEnF;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;EAStB,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AAErD,wBAAsB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAyC3F"}

package/dist/server/tools/cancel.js

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+import { reconcile } from '../../broker/reconcile.js';
+import { isPidAlive, isSameProcess, killProcessGroup } from '../../runner/reap.js';
+import { getJob, updateJob } from '../../store/jobs.js';
+import { errorReply, reply } from '../context.js';
+/**
+ * `agy_cancel` — kill a running job and everything it spawned.
+ *
+ * Signals the process group, not the pid, so agy's own children die too
+ * (verified by checking `pgrep -g` afterwards).
+ */
+export const cancelInput = z.object({
+    job_id: z.string(),
+    reason: z.string().optional(),
+    grace_ms: z
+        .number()
+        .int()
+        .min(0)
+        .optional()
+        .describe('Milliseconds between SIGTERM and SIGKILL.'),
+});
+export async function handleCancel(ctx, input) {
+    try {
+        await reconcile(ctx.store);
+        let job = getJob(ctx.store, input.job_id);
+        if (job.lifecycle === 'finished') {
+            return reply({ job_id: job.job_id, lifecycle: job.lifecycle, killed: false, message: 'already finished' });
+        }
+        // Only signal the recorded pgid when we can confirm it still identifies
+        // *our* process: a null proc_start_time (nothing was ever recorded) or a pid
+        // that no longer matches it means the pgid may have been recycled by an
+        // unrelated process tree since (finding 6) — do not kill in that case.
+        let killed = false;
+        if (job.pgid !== null &&
+            job.pid !== null &&
+            job.proc_start_time !== null &&
+            isPidAlive(job.pid) &&
+            isSameProcess(job.pid, job.proc_start_time)) {
+            killed = await killProcessGroup(job.pgid, { graceMs: input.grace_ms });
+        }
+        job = updateJob(ctx.store, job.job_id, { lifecycle: 'canceling' });
+        // The runner still owns writing exit_code; the next reconcile finalizes
+        // this as `canceled` once it appears.
+        await reconcile(ctx.store);
+        job = getJob(ctx.store, job.job_id);
+        return reply({
+            job_id: job.job_id,
+            lifecycle: job.lifecycle,
+            outcome: job.outcome,
+            killed,
+            pgid: job.pgid,
+            reason: input.reason ?? null,
+        });
+    }
+    catch (e) {
+        return errorReply(e);
+    }
+}
+//# sourceMappingURL=cancel.js.map

package/dist/server/tools/cancel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel.js","sourceRoot":"","sources":["../../../src/server/tools/cancel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAClF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAoC,MAAM,eAAe,CAAA;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,2CAA2C,CAAC;CACzD,CAAC,CAAA;AAIF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAgB,EAAE,KAAkB;IACrE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAEzC,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC5G,CAAC;QAED,wEAAwE;QACxE,6EAA6E;QAC7E,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,MAAM,GAAG,KAAK,CAAA;QAClB,IACE,GAAG,CAAC,IAAI,KAAK,IAAI;YACjB,GAAG,CAAC,GAAG,KAAK,IAAI;YAChB,GAAG,CAAC,eAAe,KAAK,IAAI;YAC5B,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,eAAe,CAAC,EAC3C,CAAC;YACD,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;QAClE,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAEnC,OAAO,KAAK,CAAC;YACX,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM;YACN,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;SAC7B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,CAAC,CAAC,CAAA;IACtB,CAAC;AACH,CAAC"}