cascade-ai 0.80.0 → 0.81.0

package/dist/desktop-core.cjs

@@ -312562,7 +312562,7 @@ function reconcilePrice(model, live) {
 }
 
 // src/constants.ts
-var CASCADE_VERSION = "0.80.0";
+var CASCADE_VERSION = "0.81.0";
 var CASCADE_CONFIG_DIR = ".cascade";
 var CASCADE_MD_FILE = "CASCADE.md";
 var CASCADE_IGNORE_FILE = ".cascadeignore";
@@ -398034,8 +398034,95 @@ function requiredFieldFor(kind2, input) {
   }
 }
 
+// src/tools/ask-user.ts
+var MAX_QUESTIONS = 5;
+var MAX_OPTIONS = 6;
+var AskUserTool = class extends BaseTool {
+  name = "ask_user";
+  description = "Ask the person a short questionnaire when their request is genuinely ambiguous, instead of guessing. Use it when two readings of the request would produce materially different work \u2014 which account, which date range, whether to include drafts \u2014 and NOT for anything you can settle yourself or from the conversation. Ask everything you need in ONE call: several questions together read as a form, the same questions one per turn read as an interrogation. You may get no answer (nobody is watching, or they did not reply); if so, proceed on your best reading and say which assumption you made.";
+  inputSchema = {
+    type: "object",
+    properties: {
+      questions: {
+        type: "array",
+        minItems: 1,
+        maxItems: MAX_QUESTIONS,
+        description: `The questions to ask together (at most ${MAX_QUESTIONS}).`,
+        items: {
+          type: "object",
+          properties: {
+            prompt: { type: "string", description: "The question, as you would say it to them." },
+            kind: {
+              type: "string",
+              enum: ["choice", "multi", "text"],
+              description: "choice = pick one, multi = pick any that apply, text = free-form answer."
+            },
+            options: {
+              type: "array",
+              items: { type: "string" },
+              description: `The answers to offer, for choice and multi (at most ${MAX_OPTIONS}). Omit for text.`
+            }
+          },
+          required: ["prompt", "kind"]
+        }
+      }
+    },
+    required: ["questions"]
+  };
+  ask;
+  constructor(ask) {
+    super();
+    this.ask = ask;
+  }
+  // Asking a question changes nothing, so it needs no approval gate: a prompt
+  // asking permission to show a prompt is a tax on the behaviour we want.
+  isDangerous() {
+    return false;
+  }
+  async execute(input, options) {
+    const raw = Array.isArray(input["questions"]) ? input["questions"] : [];
+    const questions = [];
+    for (const [i4, q4] of raw.slice(0, MAX_QUESTIONS).entries()) {
+      const item = q4 ?? {};
+      const prompt = typeof item["prompt"] === "string" ? item["prompt"].trim() : "";
+      if (!prompt) continue;
+      const kind2 = item["kind"] === "multi" || item["kind"] === "text" ? item["kind"] : "choice";
+      const options_ = Array.isArray(item["options"]) ? item["options"].filter((o3) => typeof o3 === "string" && o3.trim() !== "").slice(0, MAX_OPTIONS) : [];
+      const resolved = kind2 !== "text" && options_.length < 2 ? "text" : kind2;
+      questions.push({
+        // Positional, and assigned HERE. Letting the model supply ids invites
+        // two questions sharing one, and the second answer would overwrite the
+        // first with nothing to say it had.
+        id: `q${i4 + 1}`,
+        prompt,
+        kind: resolved,
+        ...resolved === "text" ? {} : { options: options_ }
+      });
+    }
+    if (questions.length === 0) {
+      return "Error: ask_user needs at least one question with a prompt.";
+    }
+    const result = await this.ask(questions, options.signal);
+    if (result.outcome !== "answered" || result.answers.length === 0) {
+      const why = result.outcome === "no-listener" ? "There is nobody watching this run to answer" : result.outcome === "aborted" ? "The run was stopped while the question was open" : result.outcome === "answered" ? "They saw the questions and chose not to answer" : "They did not answer in time";
+      return `${why}. Proceed on your best reading of the request, and say plainly which assumption you made.`;
+    }
+    const byId = new Map(result.answers.map((a2) => [a2.id, a2.value]));
+    const lines = questions.map((q4) => {
+      const value = byId.get(q4.id);
+      const said = Array.isArray(value) ? value.join(", ") : value;
+      return `${q4.prompt}
+  \u2192 ${said && said.length > 0 ? said : "(no answer given)"}`;
+    });
+    return `They answered:
+
+${lines.join("\n\n")}`;
+  }
+};
+
 // src/core/cascade.ts
 var ESCALATION_DECISION_TIMEOUT_MS = 5 * 6e4;
+var CLARIFICATION_TIMEOUT_MS = 2 * 6e4;
 function buildContextualPrompt(prompt, history = []) {
   const recent = history.slice(-6);
   if (recent.length === 0) return prompt;
@@ -398314,6 +398401,112 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
   // timeout. Same class of bug as the twelve-failover dead-model race: a wave
   // is concurrent, so per-run singletons are never safe inside it.
   pendingEscalations = /* @__PURE__ */ new Map();
+  /**
+   * Questionnaires waiting on a person, keyed by request id.
+   *
+   * Exactly the shape `pendingEscalations` uses, and for the same reason: the
+   * answer, the timeout and the abort all race, and one settle path guarded by
+   * the map delete is what makes the first of them win.
+   */
+  pendingClarifications = /* @__PURE__ */ new Map();
+  /**
+   * Put a gate's opening question to its listeners, and NOTICE when one fails.
+   *
+   * `emit` cannot do this job. It calls listeners synchronously and discards
+   * what they return, so an `async` listener — the ordinary shape for anything
+   * that has to reach a socket or a UI — does not fail in a way `emit` reports:
+   * it returns a REJECTED PROMISE that nobody is holding. The `try` around the
+   * emit sees nothing, the gate is never told delivery failed, and it parks for
+   * its full timeout while Node raises an unhandled rejection that can take the
+   * process down.
+   *
+   * `onFailed` is called for either shape, and it is safe to call more than
+   * once: both gates route it to `settle`, which is guarded by a map delete, so
+   * the first failure wins and the rest are no-ops.
+   *
+   * PER LISTENER, not around the loop. `emit` stops dispatching at the first
+   * throw, so one broken host used to cost a working one its notification —
+   * the same reason `announceLiveView` delivers its two listeners separately.
+   * A synchronous failure settles the gate once the whole snapshot has been
+   * delivered; an asynchronous one settles it when the rejection arrives, which
+   * is still far better than the window-long park it replaces.
+   *
+   * SETTLED AFTER THE LOOP, not inside it, and that is not tidiness. `onFailed`
+   * settles the gate, and settling emits the gate's CLOSURE — so failing
+   * mid-dispatch announced "this request is over" and then went on handing the
+   * OPENING event to the listeners after it. A host later in the list would
+   * draw a form whose only closure notification had already gone past, and it
+   * would stand there forever. Deliver to everyone, then decide.
+   *
+   * `rawListeners`, NOT `listeners`. Bypassing `emit` means taking on what
+   * `emit` was doing, and `once` is the part that bites: `listeners()` hands
+   * back the UNWRAPPED callback, so calling it never runs the wrapper that
+   * deregisters it. A host that asked to be told once would be told every
+   * time — and told through a transport it had set up for one gate only.
+   * `rawListeners()` returns the wrapper, which removes the registration and
+   * passes the underlying listener's return value straight through, so the
+   * promise below is still the one being observed. Verified against Node.
+   *
+   * `.call(this, …)`, which is the third thing `emit` was doing. EventEmitter
+   * invokes listeners with the emitter as the receiver, so
+   * `function () { this.resolveClarification(...) }` is a legitimate host — and
+   * calling it bare gave it `this === undefined`, which throws, which this
+   * would then have read as the host failing to receive the question and
+   * settled the gate unanswered. A working listener turned into a delivery
+   * failure by the thing delivering it.
+   */
+  deliverGate(event, payload, onFailed) {
+    let delivered = false;
+    let threw = false;
+    const pending = [];
+    for (const listener of this.rawListeners(event)) {
+      try {
+        const out = listener.call(this, payload);
+        if (out && typeof out.then === "function") {
+          pending.push(Promise.resolve(out).then(() => true, () => false));
+        } else {
+          delivered = true;
+        }
+      } catch {
+        threw = true;
+      }
+    }
+    if (delivered) return;
+    if (pending.length === 0) {
+      if (threw) onFailed();
+      return;
+    }
+    void Promise.all(pending).then((results) => {
+      if (!results.some(Boolean)) onFailed();
+    });
+  }
+  /**
+   * Tell listeners something that is over, and let none of them make it worse.
+   *
+   * The closing half of the gate family — `clarification:closed`,
+   * `clarification:timeout`, `escalation:closed`, `escalation:timeout`. Each
+   * was already wrapped in a `try` for the synchronous case, and each had the
+   * same hole `deliverGate` had before last round: `emit` discards what a
+   * listener returns, so an `async` host fails by returning a rejected promise
+   * nobody is holding and Node raises an unhandled rejection.
+   *
+   * There is nothing to settle here — the gate is already closed, which is the
+   * whole message — so unlike `deliverGate` this reports to no one. It exists
+   * so that the four informational emits cannot take the process down, and so
+   * the rule is written once rather than four times.
+   */
+  announceGateClosed(event, payload) {
+    for (const listener of this.rawListeners(event)) {
+      try {
+        const out = listener.call(this, payload);
+        if (out && typeof out.then === "function") {
+          void Promise.resolve(out).catch(() => {
+          });
+        }
+      } catch {
+      }
+    }
+  }
   async requestEscalationDecision(ctx, taskId, signal) {
     if (this.config.autonomy === "auto") return { action: "skip", automatic: true };
     if (this.listenerCount("escalation:decision-required") === 0) return { action: "skip", automatic: true };
@@ -398326,23 +398519,28 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
         if (timeout) clearTimeout(timeout);
         signal?.removeEventListener("abort", onAbort);
         resolve2(decision);
+        this.announceGateClosed("escalation:closed", { taskId, requestId, sectionId: ctx.sectionId });
       };
       const onAbort = () => settle({ action: "skip", automatic: true });
       signal?.addEventListener("abort", onAbort, { once: true });
       timeout = setTimeout(() => {
-        this.emit("escalation:timeout", { taskId, requestId, sectionId: ctx.sectionId });
         settle({ action: "timeout" });
+        this.announceGateClosed("escalation:timeout", { taskId, requestId, sectionId: ctx.sectionId });
       }, ESCALATION_DECISION_TIMEOUT_MS);
       this.pendingEscalations.set(requestId, settle);
-      this.emit("escalation:decision-required", {
-        taskId,
-        requestId,
-        sectionId: ctx.sectionId,
-        sectionTitle: ctx.sectionTitle,
-        issues: ctx.issues,
-        summary: ctx.summary,
-        timeoutMs: ESCALATION_DECISION_TIMEOUT_MS
-      });
+      this.deliverGate(
+        "escalation:decision-required",
+        {
+          taskId,
+          requestId,
+          sectionId: ctx.sectionId,
+          sectionTitle: ctx.sectionTitle,
+          issues: ctx.issues,
+          summary: ctx.summary,
+          timeoutMs: ESCALATION_DECISION_TIMEOUT_MS
+        },
+        () => settle({ action: "skip", automatic: true })
+      );
     });
   }
   /**
@@ -398379,6 +398577,73 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
   releasePendingEscalations(action = "skip") {
     for (const settle of Array.from(this.pendingEscalations.values())) settle({ action, automatic: true });
   }
+  // ── Clarification: asking instead of assuming ───────────────────────
+  // The same gate shape as the escalation above, and for the same reasons. The
+  // difference that matters: an unanswered escalation SKIPS a section, while an
+  // unanswered question just means the model proceeds on its own reading — so
+  // every non-answer here is benign, and none of them may park the run.
+  /**
+   * Put a questionnaire to whoever is watching, if anybody is.
+   *
+   * Returns `no-listener` rather than waiting when there is nothing attached to
+   * answer — a scheduled run, an API caller with no socket, an autonomous run
+   * that has already said it wants no prompts. That check is the whole reason
+   * this can be offered to the model at all: a tool that might hang a headless
+   * run forever is a tool that cannot be registered.
+   */
+  async askUser(questions, signal) {
+    const none = (outcome) => ({ outcome, answers: [] });
+    if (this.unattended) return none("no-listener");
+    if (this.config.autonomy === "auto") return none("no-listener");
+    if (this.listenerCount("clarification:required") === 0) return none("no-listener");
+    if (signal?.aborted) return none("aborted");
+    const requestId = crypto2.randomUUID();
+    return await new Promise((resolve2) => {
+      let timeout;
+      const settle = (result) => {
+        if (!this.pendingClarifications.delete(requestId)) return;
+        if (timeout) clearTimeout(timeout);
+        signal?.removeEventListener("abort", onAbort);
+        resolve2(result);
+        this.announceGateClosed("clarification:closed", { requestId });
+      };
+      const onAbort = () => settle(none("aborted"));
+      signal?.addEventListener("abort", onAbort, { once: true });
+      timeout = setTimeout(() => {
+        settle(none("timeout"));
+        this.announceGateClosed("clarification:timeout", { requestId });
+      }, CLARIFICATION_TIMEOUT_MS);
+      this.pendingClarifications.set(requestId, settle);
+      this.deliverGate(
+        "clarification:required",
+        { requestId, questions, timeoutMs: CLARIFICATION_TIMEOUT_MS },
+        () => settle(none("no-listener"))
+      );
+    });
+  }
+  /**
+   * Answer a questionnaire from a REPL / dashboard / cloud listener.
+   *
+   * `requestId` comes back on the `clarification:required` event and is what
+   * makes an answer land on the question that asked. Optional for a host with
+   * only one in flight, matching `resolveEscalation`: without it the oldest
+   * outstanding request is answered, which is correct whenever there is one.
+   */
+  resolveClarification(answers, requestId) {
+    const result = { outcome: "answered", answers };
+    if (requestId) {
+      this.pendingClarifications.get(requestId)?.(result);
+      return;
+    }
+    const oldest = this.pendingClarifications.keys().next();
+    if (!oldest.done) this.pendingClarifications.get(oldest.value)?.(result);
+  }
+  /** Release every parked questionnaire — run teardown, so none outlive the run. */
+  releasePendingClarifications() {
+    for (const settle of Array.from(this.pendingClarifications.values())) {
+      settle({ outcome: "aborted", answers: [] });
+    }
+  }
   /**
    * Resolve a pending boardroom plan approval from a REPL / dashboard listener.
    * An optional `note` re-plans and re-asks; an optional `editedPlan` is applied
@@ -398403,12 +398668,14 @@ var Cascade = class _Cascade extends EventEmitter__default.default {
       const timeout = setTimeout(() => {
         if (this.pendingContextApproval) {
           this.pendingContextApproval = void 0;
+          this.announceGateClosed("context:approval-closed", {});
           resolve2(true);
         }
       }, 12e4);
       this.pendingContextApproval = (approved) => {
         clearTimeout(timeout);
         this.pendingContextApproval = void 0;
+        this.announceGateClosed("context:approval-closed", {});
         resolve2(approved);
       };
       this.emit("context:approval-required", info);
@@ -398599,6 +398866,34 @@ ${input}` }],
     if ((this.config.tools?.disabledTools ?? []).includes("browser_control")) return;
     this.toolRegistry.register(new BrowserControlTool(controller, release));
   }
+  /**
+   * Declare that this host can put a questionnaire to a person and answer it.
+   *
+   * Explicit, and NOT done at construction, because registering a tool is a
+   * promise the host has to keep. A host that registers `ask_user` without
+   * listening for `clarification:required` gives the model a tool that always
+   * answers "there is nobody watching this run" — while a person sits at the
+   * terminal looking at it. That is worse than not offering the tool at all:
+   * it costs a round trip and then tells the model something false.
+   *
+   * Only `cloud/server` bridges the protocol today. The CLI REPL and the
+   * dashboard do not, so they do not call this, and their models are not shown
+   * a capability nobody can serve. Wiring either of them is a matter of
+   * listening for the event and calling `resolveClarification`, then calling
+   * this.
+   *
+   * Still gated on the same conditions as the call itself, and `askUser`
+   * re-checks them: `setUnattended` can land after this, so the tool can be
+   * registered for a run that later turns out to have nobody on it. Then it
+   * answers `no-listener` and the model proceeds on its own reading, which is
+   * the same defence-in-depth `BrowserControlTool.revoke` provides.
+   */
+  enableClarification() {
+    if (this.unattended) return;
+    if (this.config.autonomy === "auto") return;
+    if ((this.config.tools?.disabledTools ?? []).includes("ask_user")) return;
+    this.toolRegistry.register(new AskUserTool((questions, signal) => this.askUser(questions, signal)));
+  }
   registerMediaTools(workspacePath) {
     const denied = new Set(this.config.tools?.disabledTools ?? []);
     const permitted = (name) => !denied.has(name);
@@ -399544,6 +399839,10 @@ ${finalOutput}` : ""
         this.releasePendingEscalations();
       } catch {
       }
+      try {
+        this.releasePendingClarifications();
+      } catch {
+      }
       this.router.restoreTierModels();
       this.router.setRunSignal(void 0);
       if (this.taskAnalyzer) {
@@ -403402,6 +403701,13 @@ var RESTORE_FRAME_MS = 2e3;
 var MAX_HUMAN_INPUT_QUEUE = 64;
 var MAX_CAPTURE_TRANSITION_QUEUE = 16;
 var MAX_WATCH_LIFECYCLE_QUEUE = 16;
+function notify(deliver) {
+  try {
+    void Promise.resolve(deliver()).catch(() => {
+    });
+  } catch {
+  }
+}
 var RemoteBrowserController = class {
   provider;
   maxSessions;
@@ -403427,6 +403733,36 @@ var RemoteBrowserController = class {
   controlAnnounced = /* @__PURE__ */ new Map();
   /** An embedder that wants every run's live view, told which run each is. */
   onLiveViewAll;
+  /** Told when a provider session could not be handed back. See `disposeRun`. */
+  onReleaseFailed;
+  /**
+   * Tell the observer a session leaked, without letting it become the leak.
+   *
+   * Guarded, because this runs inside a `.catch` on the release: an observer
+   * that throws — a logging or telemetry sink that is momentarily unavailable
+   * is the ordinary case — would turn its own failure into a fresh rejection
+   * from `disposeRun`, so `endRun` would reject before `forgetRun` and the
+   * fire-and-forget `stopRun` path would raise an unhandled rejection.
+   *
+   * That is precisely the guarantee this whole change claims to preserve: a
+   * release that fails must never fail the run. Reporting it cannot be the
+   * thing that breaks it.
+   *
+   * TWO WAYS TO FAIL, not one. The `try` catches a synchronous throw; an
+   * `async` sink — which is what a telemetry or logging callback usually is —
+   * fails by returning a REJECTED PROMISE, which no `try` around a call that is
+   * never awaited can see. Node then raises an unhandled rejection and can take
+   * the process down: the observer would not merely have failed to report the
+   * leak, it would have killed the run, which is the one outcome this function
+   * exists to prevent, reached through the door the guard did not cover.
+   *
+   * Not awaited, though. The caller is a `.catch` on the release and is not
+   * going to wait for a telemetry round trip; attaching a handler is what makes
+   * the rejection observed, which is the whole requirement.
+   */
+  reportReleaseFailure(runId, sessionId, err, expiresInMs) {
+    notify(() => this.onReleaseFailed?.(runId, sessionId, err, expiresInMs));
+  }
   runs = /* @__PURE__ */ new Map();
   /**
    * Runs that have a pool slot but no browser yet.
@@ -403485,6 +403821,7 @@ var RemoteBrowserController = class {
     const asked = Math.max(1, options.maxSessions ?? 1);
     this.maxSessions = options.provider.isolatesSessions ? asked : 1;
     this.onLiveViewAll = options.onLiveView;
+    this.onReleaseFailed = options.onReleaseFailed;
     this.ready = options.ready;
   }
   /**
@@ -403569,7 +403906,7 @@ var RemoteBrowserController = class {
     const key = `${state.human}:${state.capturing}:${state.confirmed}`;
     if (!force && this.controlAnnounced.get(runId) === key) return;
     this.controlAnnounced.set(runId, key);
-    listener(state);
+    notify(() => listener(state));
   }
   /**
    * Tell a run's listener what its browser situation is.
@@ -403580,9 +403917,32 @@ var RemoteBrowserController = class {
    * apart — and would drop the Stop control for the first as if it were the
    * second.
    */
+  /*
+   * Guarded HERE rather than at the call sites, which is the point.
+   *
+   * This is the fifth place in this changeset where a notification could take
+   * down the thing it was notifying about — after the release observer,
+   * `clarification:closed`, `clarification:timeout` and `escalation:timeout`.
+   * The first four were fixed one door at a time, which is how a fifth door
+   * came to exist: the announcement added on the reuse path propagated out of
+   * `open()`, `act()` caught it as an action failure, and every later action
+   * against a perfectly healthy browser was skipped.
+   *
+   * Putting the guard at the source closes all four call sites at once and
+   * leaves no door for a sixth. The worst of them is not the reported one:
+   * `disposeRun` announces `active: false` as its FIRST statement, so a
+   * throwing listener aborted teardown before the screencast was stopped, the
+   * context closed, or the session handed back — leaking the provider session
+   * and never reaching `reportReleaseFailure`. The leak report would have been
+   * skipped by exactly the failure it exists to report.
+   *
+   * Two separate guards, not one around both: these are different listeners —
+   * the per-run panel and the global observer — and one failing must not cost
+   * the other its notification.
+   */
   announceLiveView(runId, liveViewUrl, active) {
-    this.liveViewListeners.get(runId)?.({ active, ...liveViewUrl ? { liveViewUrl } : {} });
-    this.onLiveViewAll?.(runId, liveViewUrl);
+    notify(() => this.liveViewListeners.get(runId)?.({ active, ...liveViewUrl ? { liveViewUrl } : {} }));
+    notify(() => this.onLiveViewAll?.(runId, liveViewUrl));
   }
   /**
    * Hand back a session the run turned out not to want.
@@ -403793,7 +404153,8 @@ var RemoteBrowserController = class {
         ping?.();
         const deliver = held.onFrame;
         if (deliver) {
-          deliver({ data: e3.data, width, height, generation: held.watchGen ?? 0 });
+          const frame = { data: e3.data, width, height, generation: held.watchGen ?? 0 };
+          notify(() => deliver(frame));
         }
       }
       void cdp.send("Page.screencastFrameAck", { sessionId: e3?.sessionId }).catch(() => {
@@ -404322,8 +404683,7 @@ var RemoteBrowserController = class {
     });
     await held.browser.close().catch(() => {
     });
-    await this.provider.endSession(held.session.id).catch(() => {
-    });
+    await this.provider.endSession(held.session.id).catch((err) => this.reportReleaseFailure(runId, held.session.id, err, held.session.expiresInMs));
   }
   /**
    * Run `disposeRun`, with the run id counted in `closing` until it settles.
@@ -404482,11 +404842,17 @@ var RemoteBrowserController = class {
       if (this.ready === settling) this.ready = void 0;
     }
     const existing = this.runs.get(runId);
-    if (existing && !existing.page.isClosed()) return existing;
+    if (existing && !existing.page.isClosed()) {
+      this.announceLiveView(runId, existing.session.liveViewUrl, true);
+      return existing;
+    }
     if (existing && existing.page.isClosed()) {
       const fallback = existing.page.context().pages().filter((p3) => !p3.isClosed()).at(-1);
       if (fallback) {
         await this.adoptPage(runId, existing, fallback);
+        if (this.runs.get(runId) === existing && !existing.abort.signal.aborted) {
+          this.announceLiveView(runId, existing.session.liveViewUrl, true);
+        }
         return existing;
       }
     }
@@ -404535,8 +404901,7 @@ var RemoteBrowserController = class {
       });
       await browser2?.close().catch(() => {
       });
-      await this.provider.endSession(session.id).catch(() => {
-      });
+      await this.provider.endSession(session.id).catch((releaseErr) => this.reportReleaseFailure(runId, session.id, releaseErr, session.expiresInMs));
       throw err;
     }
     this.announceLiveView(runId, session.liveViewUrl, true);
@@ -404746,6 +405111,139 @@ function isCdpEndpoint(url2) {
 
 // src/browser/remote/steel.ts
 var DEFAULT_BASE = "https://api.steel.dev";
+function isHostedSteel(url2) {
+  if (!url2) return true;
+  try {
+    return hostKey(new URL(url2).hostname) === hostKey(new URL(DEFAULT_BASE).hostname);
+  } catch {
+    return false;
+  }
+}
+function isUsableSteelBase(url2) {
+  try {
+    const u2 = new URL(url2);
+    if (u2.protocol !== "http:" && u2.protocol !== "https:") return false;
+    if (u2.username !== "" || u2.password !== "") return false;
+    const built = new URL(withoutTrailingSlashes(url2) + PROBE_PATH);
+    if (FETCH_BLOCKED_PORTS.has(built.port)) return false;
+    if (built.search !== "" || built.hash !== "") return false;
+    if (!built.pathname.endsWith(PROBE_PATH)) return false;
+    if (isHostedSteel(url2)) {
+      if (built.pathname !== PROBE_PATH) return false;
+      if (u2.protocol !== "https:") return false;
+      if (built.port !== "") return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isUsableSteelKey(apiKey) {
+  for (const ch of apiKey) {
+    const c4 = ch.codePointAt(0) ?? 0;
+    if (c4 === 9) continue;
+    if (c4 >= 32 && c4 <= 126) continue;
+    if (c4 >= 128 && c4 <= 255) continue;
+    return false;
+  }
+  return true;
+}
+var API_KEY_HEADER = "steel-api-key";
+var FETCH_BLOCKED_PORTS = /* @__PURE__ */ new Set([
+  "1",
+  "7",
+  "9",
+  "11",
+  "13",
+  "15",
+  "17",
+  "19",
+  "20",
+  "21",
+  "22",
+  "23",
+  "25",
+  "37",
+  "42",
+  "43",
+  "53",
+  "69",
+  "77",
+  "79",
+  "87",
+  "95",
+  "101",
+  "102",
+  "103",
+  "104",
+  "109",
+  "110",
+  "111",
+  "113",
+  "115",
+  "117",
+  "119",
+  "123",
+  "135",
+  "137",
+  "139",
+  "143",
+  "161",
+  "179",
+  "389",
+  "427",
+  "465",
+  "512",
+  "513",
+  "514",
+  "515",
+  "526",
+  "530",
+  "531",
+  "532",
+  "540",
+  "548",
+  "554",
+  "556",
+  "563",
+  "587",
+  "601",
+  "636",
+  "989",
+  "990",
+  "993",
+  "995",
+  "1719",
+  "1720",
+  "1723",
+  "2049",
+  "3659",
+  "4045",
+  "4190",
+  "5060",
+  "5061",
+  "6000",
+  "6566",
+  "6665",
+  "6666",
+  "6667",
+  "6668",
+  "6669",
+  "6679",
+  "6697",
+  "10080"
+]);
+var PROBE_PATH = "/v1/sessions";
+function withoutTrailingSlashes(value) {
+  let out = value;
+  while (out.endsWith("/")) out = out.slice(0, -1);
+  return out;
+}
+function hostKey(hostname2) {
+  let host = hostname2.toLowerCase();
+  while (host.endsWith(".")) host = host.slice(0, -1);
+  return host;
+}
 var CREATE_TIMEOUT_MS = 6e4;
 var SteelProvider = class {
   name = "Steel";
@@ -404755,9 +405253,7 @@ var SteelProvider = class {
   base;
   apiKey;
   constructor(opts = {}) {
-    let base = opts.url || DEFAULT_BASE;
-    while (base.endsWith("/")) base = base.slice(0, -1);
-    this.base = base;
+    this.base = withoutTrailingSlashes(opts.url || DEFAULT_BASE);
     this.apiKey = opts.apiKey;
   }
   async createSession(signal) {
@@ -404768,14 +405264,15 @@ var SteelProvider = class {
     return {
       id: details.id,
       cdpUrl: details.websocketUrl,
-      ...details.debugUrl ? { liveViewUrl: details.debugUrl } : {}
+      ...details.debugUrl ? { liveViewUrl: details.debugUrl } : {},
+      // Carried through because it explains an otherwise mysterious death. A
+      // session nobody released dies at exactly this number, and without it a
+      // leak looks identical to an orderly shutdown.
+      ...typeof details.timeout === "number" ? { expiresInMs: details.timeout } : {}
     };
   }
   async endSession(id) {
-    try {
-      await this.call("POST", `/v1/sessions/${encodeURIComponent(id)}/release`, void 0, {});
-    } catch {
-    }
+    await this.call("POST", `/v1/sessions/${encodeURIComponent(id)}/release`, void 0, {});
   }
   async call(method, path32, signal, body) {
     const timeout = AbortSignal.timeout(CREATE_TIMEOUT_MS);
@@ -404786,7 +405283,7 @@ var SteelProvider = class {
         "content-type": "application/json",
         // Sent only when configured — the self-hosted API takes no key, and an
         // empty header is worse than none.
-        ...this.apiKey ? { "steel-api-key": this.apiKey } : {}
+        ...this.apiKey ? { [API_KEY_HEADER]: this.apiKey } : {}
       },
       body: JSON.stringify(body),
       signal: composed
@@ -405881,6 +406378,7 @@ object-assign/index.js:
 
 exports.AZURE_BASE_MODELS = AZURE_BASE_MODELS;
 exports.AZURE_BASE_URL_TEMPLATE = AZURE_BASE_URL_TEMPLATE;
+exports.AskUserTool = AskUserTool;
 exports.AuditLogger = AuditLogger;
 exports.BrowserControlTool = BrowserControlTool;
 exports.BrowserLease = BrowserLease;
@@ -406012,7 +406510,10 @@ exports.inferAzureBaseModel = inferAzureBaseModel;
 exports.inlineRuns = inlineRuns;
 exports.isCdpEndpoint = isCdpEndpoint;
 exports.isDocumentFormat = isDocumentFormat;
+exports.isHostedSteel = isHostedSteel;
 exports.isMcpToolName = isMcpToolName;
+exports.isUsableSteelBase = isUsableSteelBase;
+exports.isUsableSteelKey = isUsableSteelKey;
 exports.matchImageLine = matchImageLine;
 exports.mcpServerPrefix = mcpServerPrefix;
 exports.mcpToolName = mcpToolName;