cohorte 2.10.1 → 3.0.0-dev.1

package/dist/chunks/src-CId6kMsY.mjs

@@ -0,0 +1,1689 @@
+import { n as sha256Hex } from "./canonical-C8UxeEmB.mjs";
+import { B as ErrorInfo, O as ToolCallId, S as IsoInstant, T as Sha256, V as JsonValueSchema, d as ModelRef, h as ApprovalId, l as AuthMode, m as AgentId, n as QuotaInfo, p as ThinkingLevel, r as TokenUsage, w as RunId } from "./src-Cu3TxNob.mjs";
+import { c as CommandRule } from "./schema-C9QbUW4H.mjs";
+import { Type } from "typebox";
+import { readFile } from "node:fs/promises";
+import { delimiter, join } from "node:path";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { accessSync, constants, realpathSync } from "node:fs";
+import { StringDecoder } from "node:string_decoder";
+//#region ../../packages/security/src/exec/capabilities.ts
+/**
+* The fixed L0-process report (every OS, the built-in `none` backend). `memory` stays `unavailable`: the ulimit
+* wrapper never attempts `-v` (toolchain.md §8: it fails outright on macOS, and this unit applies only `-t/-f/-n/-u`
+* on every platform alike, per DESIGN 2.6.6's own list of flags). `missing`/`notes` report what `probeSandbox`
+* observed about L1 binaries on this machine; the level stays `L0-process` regardless, since no backend besides
+* `none` is implemented here.
+*
+* `cpuTime` and `processes` say `enforced` because the wrapper FAILS CLOSED (ulimit.ts): a limit the kernel
+* refuses aborts the run instead of letting the program start without it, so the word is never a claim about a
+* limit that was silently dropped.
+*/
+function l0Capabilities(missing = [], notes = []) {
+	return {
+		level: "L0-process",
+		backend: "none",
+		filesystem: "advisory",
+		network: "unenforced",
+		processEscape: "possible",
+		envFiltering: "enforced",
+		timeout: "enforced",
+		outputCap: "enforced",
+		cpuTime: "enforced",
+		memory: "unavailable",
+		processes: "enforced",
+		killTree: "process-group-with-sweep",
+		missing: [...missing],
+		notes: [...notes]
+	};
+}
+function isExecutable(path) {
+	try {
+		accessSync(path, constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Is `name` an executable on the host's PATH? Scanned directly rather than through `which`, which is not part of
+* coreutils and is simply absent from many minimal Linux images and containers: there, a spawned `which` fails,
+* `bwrap` is reported missing although it is installed, and `doctor` — the report ADR-0003 makes load-bearing for
+* the `native` / `best-effort` decision — states a false negative. A `stat` per PATH entry also costs no fork.
+*
+* This is the one place the executor reads `process.env`, and it reads the HOST's PATH to answer a question about
+* the host. Nothing here ever reaches a child: the environment of a spawned command is built from `ExecRequest.env`
+* alone (S-20, executor.ts).
+*/
+function isOnPath(name) {
+	for (const dir of (process.env.PATH ?? "").split(delimiter)) if (dir !== "" && isExecutable(join(dir, name))) return true;
+	return false;
+}
+const settledDetection = /* @__PURE__ */ new Map();
+/**
+* Informational only (DESIGN 2.6.6 `missing` example: `["bwrap"]`): this unit never wraps a command in Seatbelt or
+* bubblewrap (that is U4.07's job), so detecting them changes nothing about the reported `level`/`backend` — it
+* only tells `doctor` what is absent.
+*
+* SYNCHRONOUS, because `Executor.capabilities()` is: DESIGN 2.6.6 marks `SandboxCapabilities` `[S]` and
+* `capabilities()` returns it without awaiting anything. Priming an asynchronous detection at construction was not
+* enough — a `capabilities()` called in the same tick still read an unsettled memo and answered `missing: []` while
+* `probeSandbox()` answered `['bwrap']`, i.e. `doctor` contradicted itself depending on when it was called. A
+* handful of `stat`s is all the answer needs.
+*
+* MEMOISED per platform: DESIGN 2.6.6 says `probe()` is "cached per Cohorte version + OS build", and the answer is
+* a property of the machine, not of the command; without the memo it would be recomputed on every `run()`.
+*/
+function detectMissingL1Binaries(platform) {
+	const settled = settledDetection.get(platform);
+	if (settled !== void 0) return settled;
+	const missing = [];
+	if (platform === "darwin" && !isExecutable("/usr/bin/sandbox-exec")) missing.push("sandbox-exec");
+	if (platform === "linux" && !isOnPath("bwrap")) missing.push("bwrap");
+	settledDetection.set(platform, missing);
+	return missing;
+}
+/**
+* Tries every non-`none` backend in order and returns the FIRST one whose probe reports `L1-os`, together with its
+* report; falls back to the honest L0 report (with L1-binary detection folded into `missing`) when none is usable —
+* which, until U4.07 lands, is always, since no L1 `SandboxBackend` is constructed by this unit.
+*
+* Returning the backend and its report together is what keeps `ExecResult.guarantees` honest: the executor wraps
+* the command with exactly the backend that earned the report, so it can never claim an isolation that the argv it
+* spawned does not carry.
+*/
+async function resolveSandbox(backends, platform) {
+	for (const backend of backends) {
+		if (backend.id === "none") continue;
+		try {
+			const probed = await backend.probe();
+			if (probed.level === "L1-os") return {
+				backend,
+				capabilities: probed
+			};
+		} catch {}
+	}
+	return { capabilities: l0Capabilities(detectMissingL1Binaries(platform)) };
+}
+/** The escape self-test that gates the word `enforced` on this platform (DESIGN 2.6.6, ADR-0003 §2b). */
+function escapeSelfTest(platform) {
+	if (platform === "darwin") return "escape self-test S-28";
+	if (platform === "linux") return "escape self-test S-29";
+	return "the platform escape self-test";
+}
+/**
+* One sentence per axis on which `guarantees` falls short of `require: 'native'`; empty exactly when it satisfies
+* it. DESIGN 2.6.6 requires the refusal to NAME the failing self-test rather than hand the caller a bare enum, so
+* these strings are what the executor appends to `guarantees.notes` on a `sandbox-denied` result and what
+* `sandboxUnavailable()` (exec/index.ts) turns into the catalogued error's message.
+*
+* `level: 'L1-os'` alone is never enough: a backend whose escape self-test has not passed here reports `partial` on
+* the axes that matter, and `native` is satisfied only by `enforced` (ADR-0003 §2b).
+*/
+function nativeShortfalls(guarantees, platform = process.platform) {
+	if (guarantees.level !== "L1-os") return [`sandbox: no OS sandbox backend is active${guarantees.missing.length > 0 ? ` (missing: ${guarantees.missing.join(", ")})` : ""} — level is '${guarantees.level}', backend '${guarantees.backend}', so filesystem isolation is '${guarantees.filesystem}' and network '${guarantees.network}'`];
+	const test = escapeSelfTest(platform);
+	const shortfalls = [];
+	if (guarantees.filesystem !== "enforced") shortfalls.push(`sandbox: filesystem is '${guarantees.filesystem}' (${test} has not passed on this machine)`);
+	if (guarantees.network !== "enforced-off") shortfalls.push(`sandbox: network is '${guarantees.network}' (${test} has not passed on this machine)`);
+	if (guarantees.processEscape !== "denied") shortfalls.push(`sandbox: processEscape is '${guarantees.processEscape}' (${test} has not passed on this machine)`);
+	return shortfalls;
+}
+/** `resolveSandbox`'s report alone, for callers that only want to know what is guaranteed (`probeSandbox`). */
+async function computeCapabilities(backends, platform) {
+	return (await resolveSandbox(backends, platform)).capabilities;
+}
+//#endregion
+//#region ../../packages/security/src/exec/identity.ts
+const execFileAsync = promisify(execFile);
+/**
+* One `ps` fork, four columns. `lstart=` is the last one on purpose: it is the only field with embedded spaces
+* (`Tue Sep 15 09:09:30 2026`), so everything after the third column is its value. A row that cannot produce all
+* four is DROPPED rather than tracked without an identity — a pid with no start time is a bare pid, and this file
+* does not kill those.
+*/
+async function processTable() {
+	const { stdout } = await execFileAsync("ps", ["-Ao", "pid=,ppid=,pgid=,lstart="]);
+	const rows = [];
+	for (const line of stdout.split("\n")) {
+		const fields = line.trim().split(/\s+/);
+		if (fields.length < 4) continue;
+		const [pidText, ppidText, pgidText] = fields;
+		const pid = Number(pidText);
+		const ppid = Number(ppidText);
+		const pgid = Number(pgidText);
+		const start = fields.slice(3).join(" ");
+		if (Number.isInteger(pid) && Number.isInteger(ppid) && Number.isInteger(pgid) && start !== "") rows.push({
+			pid,
+			ppid,
+			pgid,
+			start
+		});
+	}
+	return rows;
+}
+/** Every row transitively parented by `rootPid`, whatever its CURRENT pgid (so a `setsid()` escapee still shows). */
+function descendantsOf(rootPid, table) {
+	const byParent = /* @__PURE__ */ new Map();
+	for (const row of table) {
+		const siblings = byParent.get(row.ppid);
+		if (siblings) siblings.push(row);
+		else byParent.set(row.ppid, [row]);
+	}
+	const found = [];
+	const queue = [...byParent.get(rootPid) ?? []];
+	for (let next = queue.pop(); next !== void 0; next = queue.pop()) {
+		found.push(next);
+		queue.push(...byParent.get(next.pid) ?? []);
+	}
+	return found;
+}
+/**
+* Is `pgid` a real process group we may address? On POSIX `kill(-0, …)` signals the CALLER's own process group —
+* the run host itself — and `kill(-1, …)` every process the user may signal. `ExecResult.pgid` is `0` on every
+* early return (nothing was spawned), so a dependant that feeds a result back into a sweep must find a closed door
+* here rather than one missing guard between it and a TERM of the run host.
+*/
+function isAddressableGroup(pgid) {
+	return Number.isInteger(pgid) && pgid > 1;
+}
+function isAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** `true` when the signal was actually delivered; `false` when the target was gone or refused us. */
+function trySignal(pid, signal) {
+	try {
+		process.kill(pid, signal);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** TERM the pids that are still alive, wait `graceMs`, KILL the survivors. Returns how many were signalled. */
+async function terminatePids(pids, wait, graceMs) {
+	const alive = pids.filter((pid) => isAlive(pid));
+	if (alive.length === 0) return 0;
+	for (const pid of alive) trySignal(pid, "SIGTERM");
+	await wait(graceMs);
+	for (const pid of alive) if (isAlive(pid)) trySignal(pid, "SIGKILL");
+	return alive.length;
+}
+/**
+* Polls the process table until `until` settles, folding every descendant ever seen under `rootPid` into `sink`
+* AS `pid -> start time`. The start time is what makes the record an identity instead of a number: by the end of a
+* long command most of these pids are gone, and the sweep must be able to tell the process it tracked from whatever
+* the OS has since given that number to. It is kept as FIRST SEEN and never overwritten — a differing later reading
+* means the number was recycled, which is exactly what the sweep needs to notice.
+*
+* Run concurrently with the leader's own lifetime (DESIGN 2.6.6 "post-run SWEEP ... also callable on demand by the
+* Resumer"); its own errors (no `ps` on the machine, a transient failure) are swallowed — sweeping is advisory,
+* never a reason to fail the call it is watching.
+*/
+async function trackDescendants(rootPid, sink, until, wait, interval) {
+	let settled = false;
+	const stop = () => {
+		settled = true;
+	};
+	until.then(stop, stop);
+	const poll = async () => {
+		try {
+			for (const row of descendantsOf(rootPid, await processTable())) if (!sink.has(row.pid)) sink.set(row.pid, row.start);
+		} catch {}
+	};
+	let period = interval.initialMs;
+	let polledMs = 0;
+	for (;;) {
+		await poll();
+		if (settled) return;
+		try {
+			await wait(period);
+		} catch {
+			return;
+		}
+		polledMs += period;
+		if (polledMs >= interval.rampAfterMs) period = Math.min(interval.maxMs, period * 2);
+		if (settled) {
+			await poll();
+			return;
+		}
+	}
+}
+/**
+* TERM every tracked descendant that is STILL THAT DESCENDANT, wait `graceMs`, then KILL the survivors (`leaderPid`
+* itself is excluded: the caller already handled the group leader through its own `-pgid` kill).
+*
+* Identity first, always. One process-table snapshot is taken before anything is signalled, and a tracked pid takes
+* part only when its CURRENT start time still equals the one recorded when it was first seen. A `pnpm test` that
+* forks hundreds of short-lived children leaves a set whose pids are mostly dead by the end; without this check the
+* sweep would TERM+KILL whatever unrelated process of the same user the OS had meanwhile given one of those numbers
+* to — a bare-pid kill, which DESIGN 4.4 step 5 forbids here exactly as it does across a restart — and would count
+* it as an escapee on top. A pid that is gone, or whose start time has moved, is neither signalled nor counted.
+*
+* Of the survivors that ARE ours, the KILL is total — every tracked descendant, whatever its group. The COUNT is
+* not: DESIGN 2.6.6 defines `ExecResult.escapees` as "processes that LEFT the group". A tracked pid whose current
+* pgid still equals `leaderPid` is an ordinary grandchild outliving its parent — routine, and counting it would
+* raise a false escapee on DESIGN 4.4's resume diagnostics and on any `escapees > 0` alerting; a pid that
+* `setsid()`ed away has its own pgid and IS one (S-22). When the snapshot cannot be taken at all, nothing is
+* signalled and nothing is claimed: an unverifiable pid is not a target.
+*/
+async function sweepTracked(seen, leaderPid, wait, graceMs) {
+	if (seen.size === 0) return 0;
+	let table;
+	try {
+		table = await processTable();
+	} catch {
+		return 0;
+	}
+	const current = new Map(table.map((row) => [row.pid, row]));
+	let escapees = 0;
+	const targets = [];
+	for (const [pid, start] of seen) {
+		if (pid === leaderPid) continue;
+		const row = current.get(pid);
+		if (row === void 0 || row.start !== start) continue;
+		targets.push(pid);
+		if (row.pgid !== leaderPid) escapees += 1;
+	}
+	await terminatePids(targets, wait, graceMs);
+	return escapees;
+}
+/**
+* The post-exit safety net, and a BEST-EFFORT net, not an identity-verified kill — be precise about what it is:
+* once the leader has been reaped (Node emits `'exit'` AFTER `waitpid`) its pid is free for reuse, and this
+* function keys on that same bare pgid NUMBER. It is narrower than `kill(-pgid)` in one respect only — it signals
+* members one pid at a time, sparing a recycled leader (`row.pid !== pgid`) — and it does NOT verify a start token,
+* so a group that has taken over the recycled number would be signalled with its members. The window is the few
+* milliseconds between the leader's reap and this call, and pids are allocated sequentially, so a recycle inside it
+* is not realistic. The identity-verified path is `sweepGroupByToken`, which is what the Resumer (DESIGN 4.4
+* step 5, "never kills on a bare pid") uses across restarts, where the window is unbounded and the guarantee must
+* be real. Returns how many were signalled.
+*/
+async function killGroupMembers(pgid, wait, graceMs) {
+	if (!isAddressableGroup(pgid)) return 0;
+	let members;
+	try {
+		members = (await processTable()).filter((row) => row.pgid === pgid && row.pid !== pgid).map((row) => row.pid);
+	} catch {
+		return 0;
+	}
+	return terminatePids(members, wait, graceMs);
+}
+/**
+* A string that identifies WHEN `pid` started, not just its number — the "start token" of DESIGN 4.4 step 5.
+* `undefined` when the pid is gone or the platform's process table cannot be read.
+*
+* The token must be EXEC-STABLE: it is minted at the `'spawn'` event, while the leader's process image is still
+* `/bin/sh -c '<ulimit script>'`, and every later reading of it — which is all the Resumer ever has — sees the image
+* the wrapper `exec`ed into. Anything image-dependent in the hash (a command line, an argv) therefore cannot round
+* trip, and `sweepGroupByToken` would never verify a group this executor recorded. Only start TIME qualifies.
+*
+* Resolution differs per platform, and it decides how narrow the pid-reuse window is. Linux reads `starttime` from
+* `/proc/<pid>/stat`, in clock ticks since boot: two processes can share a pid only if one started long after the
+* other died, so the token is effectively unique. macOS has no such counter; `ps -o lstart=` has ONE-SECOND
+* resolution, so the residual risk there is a pid recycled by a process that started in the SAME SECOND. That is
+* why nothing but a kill-tree cleanup is ever driven from this token, and why the program's identity is carried
+* separately, by `PidRegistry.record({ label: req.file })` (contract/exec.ts).
+*/
+async function processStartToken(pid, platform = process.platform) {
+	try {
+		if (platform === "linux") {
+			const stat = await readFile(`/proc/${pid}/stat`, "utf8");
+			const starttime = stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
+			return starttime === void 0 || starttime === "" ? void 0 : `linux:${starttime}`;
+		}
+		const { stdout } = await execFileAsync("ps", [
+			"-o",
+			"lstart=",
+			"-p",
+			String(pid)
+		]);
+		const identity = stdout.trim();
+		return identity === "" ? void 0 : `lstart:${sha256Hex(identity)}`;
+	} catch {
+		return;
+	}
+}
+/**
+* Best-effort TERM -> grace -> KILL of the whole process group, addressed as `-pgid`. Never throws: a dead group
+* is not an error. Only ever called while the group LEADER is known alive (an escalation during the run): once the
+* leader has been reaped its pid can be recycled, and the post-exit cleanup uses `killGroupMembers` instead.
+*/
+async function killGroup(pgid, wait, graceMs) {
+	if (!isAddressableGroup(pgid)) return;
+	trySignal(-pgid, "SIGTERM");
+	await wait(graceMs);
+	trySignal(-pgid, "SIGKILL");
+}
+//#endregion
+//#region ../../packages/security/src/exec/ulimit.ts
+const ULIMIT_REFUSED_EXIT = 126;
+const ULIMIT_WRAPPER_SCRIPT = `[ -n "$1" ] && { ulimit -t "$1" 2>/dev/null || exit ${ULIMIT_REFUSED_EXIT}; }; [ -n "$2" ] && { ulimit -f "$2" 2>/dev/null || exit ${ULIMIT_REFUSED_EXIT}; }; [ -n "$3" ] && { ulimit -n "$3" 2>/dev/null || exit ${ULIMIT_REFUSED_EXIT}; }; [ -n "$4" ] && { ulimit -u "$4" 2>/dev/null || exit ${ULIMIT_REFUSED_EXIT}; }; shift 4; exec /usr/bin/env -u PWD -u SHLVL "\$0" "\$@"`;
+/** Absolute, not resolved through PATH: the wrapper never depends on what an agent-controlled PATH would find. */
+const ULIMIT_SHELL = "/bin/sh";
+/**
+* Can the wrapper carry this program at all? `false` for a path `/usr/bin/env` would read as a variable assignment
+* (see the header): the executor turns that into `outcome: 'error'` and nothing is spawned. The check is on the
+* path the wrapper's `env` actually receives as its first operand — that is `SandboxBackend.wrap()`'s output, not
+* necessarily `ExecRequest.file`: when a backend prepends its own helper, the original program has become an
+* ARGUMENT of that helper, which `env` never inspects.
+*/
+function isWrappableProgramPath(file) {
+	return !file.includes("=");
+}
+/** Why a run was refused before any spawn, in the words the result carries in `guarantees.notes`. */
+function unwrappableProgramNote(file) {
+	return `exec: refused to run '${file}' under the requested rlimits: a program path containing '=' cannot be carried through the rlimit wrapper — '/usr/bin/env' would read it as a variable assignment and exec the next argument instead. Nothing was spawned. (The same program runs when no rlimit is requested: there is no wrapper then.)`;
+}
+const toIntArg = (value) => value === void 0 ? "" : String(Math.max(0, Math.trunc(value)));
+/**
+* `ulimit -f` uses 1 KiB blocks on macOS and 512-byte blocks on Linux (the POSIX shells expose different units).
+* At least one block once a POSITIVE byte limit was asked for —
+* but `fileSizeBytes: 0` is a request in its own right ("this command may create no file at all"), and rounding it
+* up to one block would hand the caller 1024 writable bytes while `guarantees` still claims the limit applied.
+*/
+const toBlockArg = (bytes) => {
+	if (bytes === void 0) return "";
+	if (bytes <= 0) return "0";
+	const blockSize = process.platform === "linux" ? 512 : 1024;
+	return String(Math.max(1, Math.ceil(bytes / blockSize)));
+};
+/**
+* Wraps `file`/`args` so the process starts under `ulimit -t/-f/-n/-u` before `exec` hands control to it. `limits`
+* become POSITIONAL ARGUMENTS of the constant script (never text baked into it); an omitted limit is passed as an
+* empty string and the script's own `[ -n "$k" ]` guard skips it. A limit that IS asked for and that the kernel
+* refuses aborts with `ULIMIT_REFUSED_EXIT_CODE` instead of running unlimited. `ulimit -v` (address space) is not
+* attempted: toolchain.md §8 measured it failing outright on macOS ("cannot modify limit: Invalid argument"), so
+* `memoryBytes` is not enforced by this wrapper on any platform (SandboxCapabilities.memory stays `unavailable`).
+*/
+function requestsAnyRlimit(limits) {
+	return limits.cpuSeconds !== void 0 || limits.fileSizeBytes !== void 0 || limits.openFiles !== void 0 || limits.processes !== void 0;
+}
+function wrapWithUlimit(file, args, limits) {
+	return {
+		file: ULIMIT_SHELL,
+		args: [
+			"-c",
+			ULIMIT_WRAPPER_SCRIPT,
+			file,
+			toIntArg(limits.cpuSeconds),
+			toBlockArg(limits.fileSizeBytes),
+			toIntArg(limits.openFiles),
+			toIntArg(limits.processes),
+			...args
+		]
+	};
+}
+//#endregion
+//#region ../../packages/security/src/exec/executor.ts
+/** Verified (toolchain.md §8: "detached: true + negative-pid kill... put a timeout on stream draining as well"). */
+const GRACE_MS = 300;
+const STREAM_DRAIN_TIMEOUT_MS = 500;
+/** 40 ms while the leader is young (an escapee must be seen before it is reaped), backing off after one second. */
+const TRACK_INTERVAL = {
+	initialMs: 40,
+	maxMs: 500,
+	rampAfterMs: 1e3
+};
+/** The built-in `none` `SandboxBackend`: wraps nothing, always reports the honest L0 level. */
+function createNoneBackend() {
+	return {
+		id: "none",
+		probe: () => Promise.resolve(l0Capabilities()),
+		wrap: (file, args) => ({
+			file,
+			args: [...args]
+		})
+	};
+}
+/** The identity wrapper used whenever no L1 backend earned the reported guarantees. */
+const NONE_BACKEND = createNoneBackend();
+function backendsFor(backend) {
+	return backend.id === "none" ? [] : [backend];
+}
+/**
+* DESIGN 2.6.6 / ADR-0003 §2b: "`sandbox.require: native` is satisfied only by `enforced`: with a `partial`
+* backend the run refuses to start". `level: 'L1-os'` alone is not enough — a backend whose escape self-test
+* (S-28 on macOS, S-29 on Linux) has not passed here reports `partial` on the axes that matter.
+*/
+function satisfiesNative(guarantees) {
+	return guarantees.level === "L1-os" && guarantees.filesystem === "enforced" && guarantees.network === "enforced-off" && guarantees.processEscape === "denied";
+}
+/**
+* DESIGN 2.6.6 L0 row: "Filesystem and network isolation are advisory." The plan makes that explicit for the roots
+* a caller asked to be protected — `fs.readOnly` (the slot's dependency directories, DESIGN 5.7) and `fs.denyRead`
+* — by RECORDING them on the result rather than silently ignoring them: at L0 nothing enforces them, and U4.07 is
+* where these same roots become real. A request that asks for neither adds no note, so `ExecResult.guarantees`
+* still equals `probeSandbox()` for it.
+*/
+function advisoryFsNotes(req, guarantees) {
+	if (guarantees.filesystem === "enforced") return [];
+	const parts = [];
+	if (req.fs.readOnly.length > 0) parts.push(`readOnly: ${req.fs.readOnly.join(", ")}`);
+	if (req.fs.denyRead.length > 0) parts.push(`denyRead: ${req.fs.denyRead.join(", ")}`);
+	if (parts.length === 0) return [];
+	return [`filesystem is '${guarantees.filesystem}' at this level: the requested roots are recorded but NOT enforced (${parts.join("; ")}) — an OS sandbox backend is what enforces them`];
+}
+/** `guarantees` plus the notes that describe THIS request; never the report cached for `capabilities()`. */
+function withNotes(guarantees, notes) {
+	return notes.length === 0 ? guarantees : {
+		...guarantees,
+		notes: [...guarantees.notes, ...notes]
+	};
+}
+/** `req.cwd` must still refer to exactly what it claims to (defence against a TOCTOU swap between resolve and spawn). */
+function cwdVerifies(cwd) {
+	try {
+		return realpathSync.native(cwd) === cwd;
+	} catch {
+		return false;
+	}
+}
+function createExecutor(options) {
+	const backend = options.backend ?? NONE_BACKEND;
+	const platform = process.platform;
+	let lastGuarantees;
+	return {
+		capabilities() {
+			return lastGuarantees ?? l0Capabilities(detectMissingL1Binaries(platform));
+		},
+		run: async (req, signal) => {
+			const run = await runOnce(options, backend, req, signal);
+			lastGuarantees = run.observed;
+			return run.result;
+		}
+	};
+}
+/**
+* `pgid: 0` is the "nothing was spawned" sentinel of every early return, NOT a process group: on POSIX `kill(-0)`
+* addresses the caller's own group, so `sweepGroupByToken`, `killGroup` and `killGroupMembers` all refuse a pgid
+* of 0 or 1 outright (identity.ts). A dependant must read it as "no group", never as one to sweep.
+*/
+function emptyResult(outcome, guarantees, redactor, startedMonoMs, clock) {
+	return {
+		exitCode: null,
+		outcome,
+		tail: redactor.sealText("").text,
+		outputSha256: sha256Hex(""),
+		outputBytes: 0,
+		truncated: false,
+		durationMs: clock.monotonicMs() - startedMonoMs,
+		pgid: 0,
+		startToken: "",
+		escapees: 0,
+		guarantees
+	};
+}
+async function runOnce(options, backend, req, signal) {
+	const platform = process.platform;
+	const startedMonoMs = options.clock.monotonicMs();
+	const resolved = await resolveSandbox(backendsFor(backend), platform);
+	const observed = resolved.capabilities;
+	const guarantees = withNotes(observed, advisoryFsNotes(req, observed));
+	const early = (outcome, notes = []) => ({
+		result: emptyResult(outcome, withNotes(guarantees, notes), options.redactor, startedMonoMs, options.clock),
+		observed
+	});
+	if (req.require === "native" && !satisfiesNative(observed)) return early("sandbox-denied", nativeShortfalls(observed, platform));
+	if (signal.aborted) return early("killed");
+	if (!cwdVerifies(req.cwd)) return early("error");
+	const outer = (resolved.backend ?? NONE_BACKEND).wrap(req.file, req.args, req);
+	const wrapping = requestsAnyRlimit(req.limits);
+	if (wrapping && !isWrappableProgramPath(outer.file)) return early("error", [unwrappableProgramNote(outer.file)]);
+	const launch = wrapping ? wrapWithUlimit(outer.file, outer.args, req.limits) : {
+		file: outer.file,
+		args: [...outer.args]
+	};
+	const child = spawn(launch.file, launch.args, {
+		cwd: req.cwd,
+		env: { ...req.env },
+		detached: true,
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	const leaderPid = child.pid;
+	let outcome = "ok";
+	let truncated = false;
+	let totalBytes = 0;
+	let rawTail = "";
+	const chunks = [];
+	const decoders = {
+		stdout: new StringDecoder("utf8"),
+		stderr: new StringDecoder("utf8")
+	};
+	const sealChunk = (stream, bytes) => {
+		const text = decoders[stream].write(bytes);
+		rawTail = (rawTail + text).slice(-65536);
+		req.onChunk?.({
+			stream,
+			bytes: bytes.length,
+			text: options.redactor.sealText(text).text
+		});
+	};
+	let escalation;
+	const escalate = (why) => {
+		if (escalation !== void 0 || leaderPid === void 0) return;
+		outcome = why;
+		escalation = killGroup(leaderPid, (ms) => options.clock.sleep(ms), GRACE_MS);
+	};
+	const onData = (stream) => (chunk) => {
+		if (truncated) return;
+		let bytes = chunk;
+		if (totalBytes + bytes.length > req.maxOutputBytes) {
+			const room = Math.max(0, req.maxOutputBytes - totalBytes);
+			bytes = bytes.subarray(0, room);
+			truncated = true;
+		}
+		if (bytes.length > 0) {
+			totalBytes += bytes.length;
+			chunks.push(Buffer.from(bytes));
+			sealChunk(stream, bytes);
+		}
+		if (truncated) escalate("output-capped");
+	};
+	child.stdout?.on("data", onData("stdout"));
+	child.stderr?.on("data", onData("stderr"));
+	let exitCode = null;
+	let exitSignal;
+	const exited = new Promise((resolve) => {
+		child.once("exit", (code, sig) => {
+			exitCode = code;
+			exitSignal = sig ?? void 0;
+			resolve();
+		});
+	});
+	if (await new Promise((resolve) => {
+		child.once("spawn", () => resolve("spawned"));
+		child.once("error", () => resolve("error"));
+	}) === "error" || leaderPid === void 0) return early("error");
+	child.on("error", () => {});
+	const startToken = await processStartToken(leaderPid, platform) ?? `unknown:${leaderPid}`;
+	options.pids.record({
+		pgid: leaderPid,
+		startToken,
+		label: req.file
+	});
+	const escapeesSeen = /* @__PURE__ */ new Map();
+	const trackingTask = trackDescendants(leaderPid, escapeesSeen, exited, (ms) => options.clock.sleep(ms), TRACK_INTERVAL);
+	let finished = false;
+	const timeoutAbort = new AbortController();
+	const timeoutTask = options.clock.sleep(req.timeoutMs, timeoutAbort.signal).then(() => {
+		if (!finished) escalate("timed-out");
+	}).catch(() => {});
+	const onExternalAbort = () => escalate("killed");
+	if (!signal.aborted) signal.addEventListener("abort", onExternalAbort, { once: true });
+	await exited;
+	finished = true;
+	timeoutAbort.abort();
+	signal.removeEventListener("abort", onExternalAbort);
+	await timeoutTask;
+	await trackingTask;
+	if (escalation) await escalation;
+	await killGroupMembers(leaderPid, (ms) => options.clock.sleep(ms), GRACE_MS);
+	await drainStreams(child, (ms) => options.clock.sleep(ms).catch(() => {}));
+	const flushed = decoders.stdout.end() + decoders.stderr.end();
+	if (flushed !== "") rawTail = (rawTail + flushed).slice(-65536);
+	const escapees = await sweepTracked(escapeesSeen, leaderPid, (ms) => options.clock.sleep(ms), GRACE_MS);
+	options.pids.remove(leaderPid);
+	if (outcome === "ok" && exitCode === 126 && totalBytes === 0 && requestsAnyRlimit(req.limits)) outcome = "error";
+	const output = Buffer.concat(chunks);
+	const sealedTail = options.redactor.sealText(rawTail).text;
+	const durationMs = options.clock.monotonicMs() - startedMonoMs;
+	return {
+		result: {
+			exitCode,
+			outcome,
+			tail: sealedTail,
+			outputSha256: sha256Hex(output),
+			outputBytes: totalBytes,
+			truncated,
+			durationMs,
+			pgid: leaderPid,
+			startToken,
+			escapees,
+			guarantees,
+			...exitSignal !== void 0 ? { signal: exitSignal } : {}
+		},
+		observed
+	};
+}
+async function drainStreams(child, wait) {
+	const closed = Promise.all([child.stdout, child.stderr].map((stream) => new Promise((resolve) => {
+		if (!stream || stream.destroyed) {
+			resolve();
+			return;
+		}
+		stream.once("close", () => resolve());
+	})));
+	let timedOut = false;
+	await Promise.race([closed.then(() => {}), wait(STREAM_DRAIN_TIMEOUT_MS).then(() => {
+		timedOut = true;
+	})]);
+	if (timedOut) {
+		child.stdout?.destroy();
+		child.stderr?.destroy();
+	}
+}
+//#endregion
+//#region ../../packages/security/src/exec/index.ts
+/**
+* `cohorte doctor --json`'s "sandbox" section (spec 9 "garanties réellement actives"). Until U4.07 constructs a
+* real Seatbelt/bubblewrap `SandboxBackend`, this always reports the honest L0 level: the L1 binaries this machine
+* happens to have installed are detected only for `missing`/`notes`, never used to widen the claimed guarantees.
+*/
+function probeSandbox(options = {}) {
+	return computeCapabilities(options.backends ?? [], options.platform ?? process.platform);
+}
+//#endregion
+//#region ../../packages/security/src/redact/seal.ts
+function sealText(text, redactions) {
+	return {
+		text,
+		redactions
+	};
+}
+function sealJson(value, redactions) {
+	return {
+		value,
+		redactions
+	};
+}
+//#endregion
+//#region ../../packages/security/src/redact/index.ts
+const replacement = "[REDACTED]";
+const escapePointerToken = (token) => token.replaceAll("~", "~0").replaceAll("/", "~1");
+function scrub(text, path, secrets, redactions) {
+	let result = text;
+	for (const { value, id } of secrets) if (result.includes(value)) {
+		result = result.split(value).join(replacement);
+		redactions.push({
+			path,
+			reason: "secret-value",
+			detector: `registered:${id}`
+		});
+	}
+	return result;
+}
+function createRedactor(options = {}) {
+	const secrets = [];
+	for (const [id, value] of Object.entries(options.secrets ?? {})) if (value.length >= 8) secrets.push({
+		value,
+		id
+	});
+	secrets.sort((a, b) => b.value.length - a.value.length);
+	const walk = (value, path, redactions) => {
+		if (typeof value === "string") return scrub(value, path, secrets, redactions);
+		if (Array.isArray(value)) return value.map((item, index) => walk(item, `${path}/${index}`, redactions));
+		if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, walk(item, `${path}/${escapePointerToken(key)}`, redactions)]));
+		return value;
+	};
+	return {
+		registerSecret(value, id) {
+			if (value.length < 8) throw new RangeError("registerSecret: a secret value shorter than 8 characters is rejected");
+			secrets.push({
+				value,
+				id
+			});
+			secrets.sort((a, b) => b.value.length - a.value.length);
+		},
+		sealText(text) {
+			const redactions = [];
+			return sealText(scrub(text, "", secrets, redactions), redactions);
+		},
+		sealJson(value) {
+			const redactions = [];
+			return sealJson(walk(value, "", redactions), redactions);
+		}
+	};
+}
+//#endregion
+//#region ../../packages/security/src/contract/builtin.ts
+const frozen = (values) => Object.freeze(values);
+/** Worktree-relative, any depth: `.git` (file OR directory), Cohorte's own directory, Pi's project directory. */
+const PROTECTED_REPO_GLOBS = frozen([
+	"**/.git",
+	"**/.git/**",
+	"**/.cohorte/**",
+	"**/.pi/**"
+]);
+frozen([
+	".cohorte/keys",
+	".cohorte/versions",
+	".cohorte/pi-agent",
+	".cohorte/brains",
+	".cohorte/trust",
+	".cohorte/config.yaml",
+	".pi/agent",
+	".ssh",
+	".aws",
+	".gnupg",
+	".config/gh",
+	".config/gcloud"
+]);
+frozen([
+	".pi/agent",
+	".cohorte/keys",
+	".cohorte/versions",
+	".cohorte/pi-agent",
+	".cohorte/brains",
+	".cohorte/trust",
+	".ssh",
+	".aws",
+	".gnupg",
+	".config/gh",
+	".config/gcloud"
+]);
+/** The default `denyRead` / `denyWrite` of every AgentGrant (DESIGN 2.6.1). Deny sets always win. */
+const DEFAULT_DENY_GLOBS = frozen([
+	"**/.env*",
+	"**/*.pem",
+	"**/*.key",
+	"**/id_rsa*",
+	"**/id_ed25519*",
+	"**/.git",
+	"**/.git/**",
+	"**/.cohorte/**",
+	"**/.pi/**",
+	"**/.npmrc",
+	"**/.netrc"
+]);
+/**
+* Programs that run OTHER programs or reach the network: denied with `overridable: false` (DESIGN 2.6.4 step 2).
+* `pi` and `cohorte` are in it: Pi has an `auth` subcommand that prints the OAuth token. A project that truly needs one
+* declares an exact-argv rule under `policy.dangerousCommands`, and every use is an `ask`.
+*/
+const TRAMPOLINE_PROGRAMS = frozen([
+	"sh",
+	"bash",
+	"zsh",
+	"dash",
+	"fish",
+	"ksh",
+	"csh",
+	"env",
+	"xargs",
+	"sudo",
+	"su",
+	"doas",
+	"eval",
+	"exec",
+	"nohup",
+	"time",
+	"watch",
+	"npx",
+	"pnpx",
+	"bunx",
+	"corepack",
+	"ssh",
+	"scp",
+	"curl",
+	"wget",
+	"nc",
+	"perl",
+	"ruby",
+	"osascript",
+	"pi",
+	"cohorte"
+]);
+/** `python*`: python, python3, python3.12, pythonw ... */
+const TRAMPOLINE_PREFIXES = frozen(["python"]);
+const TRAMPOLINES = new Set(TRAMPOLINE_PROGRAMS);
+/** `name` is the alias-normalised BARE program name; the comparison is exact-case (the name was resolved on disk first). */
+function isTrampoline(name) {
+	return TRAMPOLINES.has(name) || TRAMPOLINE_PREFIXES.some((prefix) => name.startsWith(prefix));
+}
+/** Agents have no commit capability (D9): commits and merges are Cohorte's. Built-in, non-overridable. */
+const AGENT_GIT_DENIED_SUBCOMMANDS = frozen([
+	"commit",
+	"push",
+	"merge",
+	"rebase",
+	"reset",
+	"checkout",
+	"switch",
+	"worktree",
+	"config",
+	"update-ref",
+	"filter-branch",
+	"gc"
+]);
+frozen([
+	"PATH",
+	"HOME",
+	"LANG",
+	"LC_ALL",
+	"TERM",
+	"CI",
+	"TMPDIR",
+	"NO_COLOR",
+	"GIT_CONFIG_GLOBAL",
+	"GIT_CONFIG_NOSYSTEM",
+	"GIT_TERMINAL_PROMPT"
+]);
+Object.freeze({
+	TERM: "dumb",
+	CI: "1",
+	NO_COLOR: "1",
+	GIT_CONFIG_GLOBAL: "/dev/null",
+	GIT_CONFIG_NOSYSTEM: "1",
+	GIT_TERMINAL_PROMPT: "0"
+});
+Object.freeze({ darwin: Object.freeze(["__CF_USER_TEXT_ENCODING"]) });
+//#endregion
+//#region ../../packages/security/src/contract/decisions.ts
+/**
+* Spec 9, exactly. The pure engine returns allow | deny | ask. allow-once / allow-for-run are APPROVAL RESOLUTIONS:
+* rows in `approvals`, found by grantKey at stage 6, reported in the verdict with the approvalId so the audit trail
+* says WHY. An `ask` nobody can answer becomes `deny`: an unanswerable ask never silently runs.
+*/
+const POLICY_DECISIONS = [
+	"allow",
+	"deny",
+	"ask",
+	"allow-once",
+	"allow-for-run"
+];
+const GATE_STAGE_NAMES = [
+	"liveness",
+	"schema",
+	"capability",
+	"path",
+	"command",
+	"network",
+	"budget",
+	"approval"
+];
+const closed = { additionalProperties: false };
+const oneOf$1 = (values) => Type.Unsafe({
+	type: "string",
+	enum: [...values]
+});
+const count$4 = () => Type.Integer({ minimum: 0 });
+const canonicalPath = () => Type.String({ minLength: 1 });
+const replay = () => oneOf$1(["idempotent", "at-most-once"]);
+const globSet = () => Type.Object({
+	include: Type.Array(Type.String()),
+	exclude: Type.Array(Type.String())
+}, closed);
+const ResolvedPathSchema = Type.Object({
+	canonical: canonicalPath(),
+	relative: Type.String(),
+	root: canonicalPath(),
+	exists: Type.Boolean(),
+	identity: Type.Optional(Type.Object({
+		dev: Type.Number(),
+		ino: Type.Number(),
+		nlink: Type.Number()
+	}, closed)),
+	viaSymlink: Type.Boolean()
+}, closed);
+const NormalizedCallSchema = Type.Object({
+	tool: Type.String(),
+	paths: Type.Array(Type.Object({
+		arg: Type.String(),
+		resolved: ResolvedPathSchema,
+		intent: oneOf$1([
+			"read",
+			"write",
+			"create",
+			"list",
+			"exec-cwd"
+		])
+	}, closed)),
+	command: Type.Optional(Type.Object({
+		file: canonicalPath(),
+		args: Type.Array(Type.String()),
+		cwd: canonicalPath(),
+		ruleId: Type.String(),
+		replay: replay(),
+		network: Type.Boolean(),
+		timeoutMs: count$4()
+	}, closed)),
+	input: JsonValueSchema,
+	grantKeyMaterial: JsonValueSchema
+}, closed);
+const ask = () => Type.Object({
+	stage: oneOf$1(GATE_STAGE_NAMES),
+	ruleId: Type.String(),
+	reason: Type.String()
+}, closed);
+Type.Unsafe(Type.Object({
+	decision: oneOf$1(POLICY_DECISIONS),
+	stage: oneOf$1(GATE_STAGE_NAMES),
+	ruleId: Type.String({ minLength: 1 }),
+	reason: Type.String(),
+	modelFacingReason: Type.String(),
+	overridable: Type.Boolean(),
+	securityViolation: Type.Boolean(),
+	asks: Type.Array(ask()),
+	evaluatedRules: Type.Array(Type.String()),
+	normalized: Type.Union([NormalizedCallSchema, Type.Null()]),
+	approvalId: Type.Optional(ApprovalId),
+	grantId: Type.Optional(Type.String())
+}, closed));
+Type.Unsafe(Type.Object({
+	agentId: AgentId,
+	role: Type.String({ minLength: 1 }),
+	digest: Sha256,
+	tools: Type.Array(Type.String()),
+	roots: Type.Object({
+		workspace: Type.Union([canonicalPath(), Type.Null()]),
+		readOnly: Type.Array(canonicalPath())
+	}, closed),
+	read: globSet(),
+	write: globSet(),
+	denyRead: globSet(),
+	denyWrite: globSet(),
+	commands: Type.Object({
+		default: Type.Literal("deny"),
+		rules: Type.Array(CommandRule)
+	}, closed),
+	secrets: Type.Array(Type.Object({
+		id: Type.String(),
+		exposeAs: Type.Literal("env"),
+		name: Type.String()
+	}, closed)),
+	temporary: Type.Array(Type.Object({
+		grantId: Type.String(),
+		approvalId: ApprovalId,
+		grantKey: Type.String(),
+		expires: oneOf$1(["call", "run"])
+	}, closed)),
+	limits: Type.Object({
+		maxToolCalls: count$4(),
+		maxCallsPerMinute: count$4(),
+		perTool: Type.Record(Type.String(), Type.Object({
+			maxCalls: Type.Optional(count$4()),
+			timeoutMs: count$4(),
+			maxOutputBytes: count$4()
+		}, closed))
+	}, closed)
+}, closed));
+//#endregion
+//#region ../../packages/security/src/contract/exec.ts
+const oneOf = (values) => Type.Unsafe({
+	type: "string",
+	enum: [...values]
+});
+/** [S]. Annotated so that Biome never infers it (docs/v3/requests/U0.02.md R1). */
+const SandboxCapabilities = Type.Unsafe(Type.Object({
+	level: oneOf(["L0-process", "L1-os"]),
+	backend: oneOf([
+		"none",
+		"seatbelt",
+		"bubblewrap"
+	]),
+	filesystem: oneOf([
+		"enforced",
+		"partial",
+		"advisory"
+	]),
+	network: oneOf([
+		"enforced-off",
+		"partial",
+		"unenforced"
+	]),
+	processEscape: oneOf([
+		"denied",
+		"partial",
+		"possible"
+	]),
+	envFiltering: Type.Literal("enforced"),
+	timeout: Type.Literal("enforced"),
+	outputCap: Type.Literal("enforced"),
+	cpuTime: oneOf(["enforced", "unavailable"]),
+	memory: oneOf([
+		"enforced",
+		"node-only",
+		"unavailable"
+	]),
+	processes: oneOf(["enforced", "unavailable"]),
+	killTree: oneOf(["pid-namespace", "process-group-with-sweep"]),
+	missing: Type.Array(Type.String()),
+	notes: Type.Array(Type.String())
+}, { additionalProperties: false }));
+//#endregion
+//#region ../../packages/runtime-contract/src/capabilities.ts
+const strict$5 = { additionalProperties: false };
+const Cap = Type.Union([
+	Type.Object({ value: Type.Literal("yes") }, strict$5),
+	Type.Object({
+		value: Type.Literal("no"),
+		why: Type.String()
+	}, strict$5),
+	Type.Object({
+		value: Type.Literal("partial"),
+		why: Type.String()
+	}, strict$5)
+]);
+const RuntimeCapabilities = Type.Object({
+	contractVersion: Type.Literal("1"),
+	/** the only legal value (C1); present so conformance can assert it */
+	toolExecution: Type.Literal("host-delegated"),
+	streaming: Cap,
+	thinkingStream: Cap,
+	send: Type.Object({
+		steer: Cap,
+		followUp: Cap
+	}, strict$5),
+	cancelCooperative: Cap,
+	cancelHard: Cap,
+	pause: Type.Object({
+		toolBoundary: Cap,
+		modelBoundary: Cap
+	}, strict$5),
+	continuationFromTranscript: Cap,
+	processIsolation: Cap,
+	envFiltering: Cap,
+	brainSandbox: Cap,
+	resourceLimits: Cap,
+	budgetEnforcement: Type.Object({
+		turns: Cap,
+		modelRequests: Cap,
+		tokens: Cap,
+		context: Cap,
+		wallClock: Cap,
+		outputTokensPerRequest: Cap
+	}, strict$5),
+	/** 'no' = none possible (compaction and engine retries off) */
+	hiddenModelCalls: Cap,
+	usageReporting: Cap,
+	effectiveModelReporting: Cap,
+	quotaReporting: Cap,
+	authStatusWithoutSecret: Cap,
+	subscriptionModeAssertion: Cap,
+	systemPromptExact: Cap,
+	runtimePinning: Cap,
+	platforms: Type.Object({
+		darwin: Cap,
+		linux: Cap,
+		win32: Cap
+	}, strict$5),
+	hints: Type.Object({
+		memoryPerAgentMb: Type.Number({ minimum: 0 }),
+		coldStartMs: Type.Number({ minimum: 0 }),
+		maxConcurrentAgents: Type.Integer({ minimum: 1 })
+	}, strict$5)
+}, strict$5);
+//#endregion
+//#region ../../packages/runtime-contract/src/session.ts
+const strict$4 = { additionalProperties: false };
+const count$3 = () => Type.Integer({ minimum: 0 });
+const jsonMap = () => Type.Unsafe(Type.Record(Type.String(), JsonValueSchema));
+/** `format` is a label, e.g. 'jsonl-v3' | 'fake-ndjson-v1' — never interpreted by core */
+const TranscriptRef = Type.Object({
+	path: Type.String(),
+	format: Type.String()
+}, strict$4);
+/** R8: opaque to clients */
+const RuntimeSessionRef = Type.Object({
+	runtime: Type.String(),
+	engineVersion: Type.String(),
+	sessionId: Type.String(),
+	transcript: TranscriptRef
+}, strict$4);
+const UsageTotals = Type.Object({
+	tokens: TokenUsage,
+	modelRequests: count$3(),
+	toolCalls: count$3(),
+	turns: count$3(),
+	wallClockMs: Type.Number({ minimum: 0 })
+}, strict$4);
+const EffectiveModel = Type.Object({
+	provider: Type.String(),
+	model: Type.String(),
+	api: Type.Optional(Type.String()),
+	baseUrl: Type.Optional(Type.String())
+}, strict$4);
+/** The ADAPTER's typed cause, recorded by the host BEFORE it acts. The engine's own stop reason is never a discriminator [X]. */
+const AgentStopCause = Type.Union([
+	Type.Literal("host-terminated"),
+	Type.Literal("model-stop"),
+	Type.Literal("output-truncated"),
+	Type.Literal("budget"),
+	Type.Literal("cancelled"),
+	Type.Literal("engine-error"),
+	Type.Literal("process-exit")
+]);
+const AgentExit = Type.Object({
+	outcome: Type.Union([
+		Type.Literal("completed"),
+		Type.Literal("failed"),
+		Type.Literal("cancelled"),
+		Type.Literal("crashed")
+	]),
+	stop: AgentStopCause,
+	error: Type.Optional(ErrorInfo),
+	usage: UsageTotals,
+	lastSeq: count$3()
+}, strict$4);
+const delivery$1 = () => Type.Union([Type.Literal("steer"), Type.Literal("follow-up")]);
+Type.Union([Type.Object({
+	kind: Type.Literal("user"),
+	messageId: Type.String(),
+	text: Type.String(),
+	delivery: delivery$1()
+}, strict$4), Type.Object({
+	kind: Type.Literal("host-note"),
+	messageId: Type.String(),
+	text: Type.String(),
+	delivery: delivery$1()
+}, strict$4)]);
+Type.Object({
+	runId: RunId,
+	agentId: AgentId,
+	incarnation: Type.Integer({ minimum: 1 }),
+	state: Type.Union([
+		Type.Literal("starting"),
+		Type.Literal("running"),
+		Type.Literal("awaiting-tool"),
+		Type.Literal("paused"),
+		Type.Literal("settling"),
+		Type.Literal("exited")
+	]),
+	pausedAt: Type.Optional(Type.Union([Type.Literal("tool-boundary"), Type.Literal("model-boundary")])),
+	turn: count$3(),
+	pendingToolCalls: Type.Array(ToolCallId),
+	requestedModel: ModelRef,
+	effectiveModel: Type.Optional(EffectiveModel),
+	authMode: Type.Optional(AuthMode),
+	usage: UsageTotals,
+	contextTokens: Type.Optional(count$3()),
+	contextWindow: Type.Optional(count$3()),
+	session: RuntimeSessionRef,
+	lastSeq: count$3(),
+	/** pid, rssMb, lastHeartbeatAt, engine flags… never secrets */
+	diagnostics: jsonMap()
+}, strict$4);
+//#endregion
+//#region ../../packages/runtime-contract/src/tools.ts
+const strict$3 = { additionalProperties: false };
+const RuntimeToolCall = Type.Object({
+	runId: RunId,
+	agentId: AgentId,
+	incarnation: Type.Integer({ minimum: 1 }),
+	/** tc_<incarnation>_<ordinal> */
+	toolCallId: ToolCallId,
+	/** the engine's own id, transcript correlation only */
+	engineToolCallId: Type.Optional(Type.String()),
+	/** 1-based, per incarnation, gapless */
+	ordinal: Type.Integer({ minimum: 1 }),
+	tool: Type.String(),
+	/** as produced by the model after engine-side coercion; the host re-validates strictly */
+	input: JsonValueSchema
+}, strict$3);
+const ToolProgress = Type.Object({
+	text: Type.Optional(Type.String()),
+	bytes: Type.Optional(Type.Integer({ minimum: 0 }))
+}, strict$3);
+const ToolContent = Type.Union([Type.Object({
+	type: Type.Literal("text"),
+	text: Type.Unsafe(Type.String())
+}, strict$3), Type.Object({
+	type: Type.Literal("image"),
+	mediaType: Type.String(),
+	dataBase64: Type.String()
+}, strict$3)]);
+Type.Object({
+	isError: Type.Boolean(),
+	content: Type.Array(ToolContent),
+	/** host asks the runtime to end the agent loop after this batch */
+	terminate: Type.Optional(Type.Boolean()),
+	/** opaque audit id, stored in the transcript */
+	resultRef: Type.Optional(Type.String())
+}, strict$3);
+const TOOL_NAME_PATTERN = "^[a-z][a-z0-9_]{1,40}$";
+/** JSON Schema 2020-12, ONE flat top-level object: no $ref/$defs/oneOf at root (provider flattening). */
+const ToolInputSchema = Type.Unsafe(Type.Object({
+	type: Type.Literal("object"),
+	properties: Type.Optional(Type.Record(Type.String(), JsonValueSchema))
+}, {
+	additionalProperties: true,
+	not: { anyOf: [
+		"$ref",
+		"$defs",
+		"definitions",
+		"oneOf",
+		"anyOf",
+		"allOf"
+	].map((key) => ({ required: [key] })) }
+}));
+/** What the BRAIN needs to know. No paths, no commands: what a call may touch is decided host-side. */
+const ToolGrant = Type.Object({
+	/** TOOL_NAME_PATTERN; never differs only by case from another grant (see toolGrantProblems) */
+	tool: Type.String({ pattern: TOOL_NAME_PATTERN }),
+	description: Type.String(),
+	inputSchema: ToolInputSchema,
+	/** ordering hint only */
+	effect: Type.Union([
+		Type.Literal("read"),
+		Type.Literal("write"),
+		Type.Literal("execute"),
+		Type.Literal("network"),
+		Type.Literal("control")
+	]),
+	/** true for the result tool */
+	terminal: Type.Boolean()
+}, strict$3);
+/**
+* The rule a schema cannot say: inside ONE grant list no two names are equal, or differ only by case (providers
+* fold tool names). Works on unvalidated names too, which is why it re-checks the pattern. Empty = no problem.
+*/
+function toolGrantProblems(grants) {
+	const pattern = new RegExp(TOOL_NAME_PATTERN);
+	const problems = [];
+	const seen = /* @__PURE__ */ new Map();
+	for (const { tool } of grants) {
+		if (!pattern.test(tool)) problems.push(`tool name ${JSON.stringify(tool)} does not match ${TOOL_NAME_PATTERN}`);
+		const folded = tool.toLowerCase();
+		const earlier = seen.get(folded);
+		if (earlier === void 0) seen.set(folded, tool);
+		else if (earlier === tool) problems.push(`tool ${JSON.stringify(tool)} is granted twice`);
+		else problems.push(`tools ${JSON.stringify(earlier)} and ${JSON.stringify(tool)} differ only by case`);
+	}
+	return problems;
+}
+//#endregion
+//#region ../../packages/runtime-contract/src/events.ts
+const strict$2 = { additionalProperties: false };
+const count$2 = () => Type.Integer({ minimum: 0 });
+const boundary = () => Type.Union([Type.Literal("tool-boundary"), Type.Literal("model-boundary")]);
+const delivery = () => Type.Union([Type.Literal("steer"), Type.Literal("follow-up")]);
+const messageRole = () => Type.Union([
+	Type.Literal("assistant"),
+	Type.Literal("user"),
+	Type.Literal("tool-result")
+]);
+/**
+* A CLOSED five-value set on this frontier: an adapter maps any other engine stop reason (Pi 0.85.1 also has
+* 'pending' and 'deferred') to 'error' and emits runtime.warning{code: ENGINE_STOP_REASON_UNMAPPED}.
+*/
+const ModelStop = Type.Union([
+	Type.Literal("stop"),
+	Type.Literal("length"),
+	Type.Literal("tool-use"),
+	Type.Literal("error"),
+	Type.Literal("aborted")
+]);
+const IsolationReport = Type.Object({
+	level: Type.Union([
+		Type.Literal("os"),
+		Type.Literal("process"),
+		Type.Literal("none")
+	]),
+	filesystem: Type.Union([Type.Literal("enforced"), Type.Literal("advisory")]),
+	network: Type.Union([
+		Type.Literal("enforced"),
+		Type.Literal("partial"),
+		Type.Literal("none")
+	]),
+	backend: Type.String()
+}, strict$2);
+const durable = (data) => ({
+	durability: "durable",
+	data
+});
+const ephemeral = (data) => ({
+	durability: "ephemeral",
+	data
+});
+/**
+* One row per event type: its durability and the schema of `data`. EVERY durable type has a named target in the
+* protocol catalogue, or an explicit "not forwarded" rule (DESIGN 2.3.3). `authSource: 'none'` exists only for
+* runtimes that hold no credential (the fake); a fake run reports the authMode its plan requested.
+*/
+const RUNTIME_EVENT_TYPES = {
+	"agent.spawned": durable(Type.Object({
+		session: RuntimeSessionRef,
+		requestedModel: ModelRef,
+		tools: Type.Array(Type.String()),
+		systemPromptSha256: Sha256,
+		effectiveSystemPromptSha256: Sha256,
+		isolation: IsolationReport
+	}, strict$2)),
+	"agent.started": durable(Type.Object({ taskSha256: Sha256 }, strict$2)),
+	"agent.turn.started": ephemeral(Type.Object({ turn: count$2() }, strict$2)),
+	"agent.turn.completed": durable(Type.Object({
+		turn: count$2(),
+		toolCalls: count$2()
+	}, strict$2)),
+	"agent.message.started": ephemeral(Type.Object({
+		messageId: Type.String(),
+		role: messageRole()
+	}, strict$2)),
+	"agent.message.delta": ephemeral(Type.Object({
+		messageId: Type.String(),
+		channel: Type.Union([
+			Type.Literal("text"),
+			Type.Literal("thinking"),
+			Type.Literal("tool-input")
+		]),
+		contentIndex: count$2(),
+		delta: Type.String()
+	}, strict$2)),
+	"agent.message.completed": durable(Type.Object({
+		messageId: Type.String(),
+		role: messageRole(),
+		textSha256: Sha256,
+		textBytes: count$2(),
+		preview: Type.String({ maxLength: 512 }),
+		stop: Type.Optional(ModelStop)
+	}, strict$2)),
+	"model.requested": durable(Type.Object({
+		requestId: Type.String(),
+		model: ModelRef,
+		contextSha256: Type.Optional(Sha256),
+		contextTokensEstimate: Type.Optional(count$2()),
+		attempt: Type.Integer({ minimum: 1 })
+	}, strict$2)),
+	"model.responded": durable(Type.Object({
+		requestId: Type.String(),
+		requestedModel: ModelRef,
+		effectiveModel: EffectiveModel,
+		authMode: AuthMode,
+		authSource: Type.Union([
+			Type.Literal("oauth"),
+			Type.Literal("api-key"),
+			Type.Literal("none")
+		]),
+		durationMs: Type.Number({ minimum: 0 }),
+		usage: TokenUsage,
+		httpStatus: Type.Optional(Type.Integer()),
+		attempt: Type.Integer({ minimum: 1 }),
+		stop: ModelStop,
+		quota: QuotaInfo,
+		error: Type.Optional(ErrorInfo)
+	}, strict$2)),
+	"tool.call.requested": durable(Type.Object({ call: RuntimeToolCall }, strict$2)),
+	"tool.call.rejected": durable(Type.Object({
+		engineToolCallId: Type.Optional(Type.String()),
+		tool: Type.String(),
+		cause: Type.Union([
+			Type.Literal("unknown-tool"),
+			Type.Literal("invalid-input"),
+			Type.Literal("output-truncated")
+		]),
+		message: Type.String()
+	}, strict$2)),
+	"tool.call.progress": ephemeral(Type.Object({
+		toolCallId: ToolCallId,
+		update: ToolProgress
+	}, strict$2)),
+	"tool.call.delivered": durable(Type.Object({
+		toolCallId: ToolCallId,
+		isError: Type.Boolean(),
+		terminate: Type.Boolean(),
+		waitedMs: Type.Number({ minimum: 0 })
+	}, strict$2)),
+	"agent.paused": durable(Type.Object({ at: boundary() }, strict$2)),
+	"agent.resumed": durable(Type.Unsafe(Type.Object({}, strict$2))),
+	"agent.message.accepted": durable(Type.Object({
+		messageId: Type.String(),
+		delivery: delivery()
+	}, strict$2)),
+	"agent.exited": durable(AgentExit),
+	"runtime.warning": durable(Type.Object({
+		code: Type.String(),
+		message: Type.String()
+	}, strict$2))
+};
+const RUNTIME_EVENT_TYPE_NAMES = Object.freeze(Object.keys(RUNTIME_EVENT_TYPES));
+const envelope = {
+	runId: RunId,
+	agentId: AgentId,
+	incarnation: Type.Integer({ minimum: 1 }),
+	seq: count$2(),
+	at: IsoInstant
+};
+Type.Unsafe(Type.Union(RUNTIME_EVENT_TYPE_NAMES.map((type) => {
+	const row = RUNTIME_EVENT_TYPES[type];
+	return Type.Object({
+		type: Type.Literal(type),
+		durability: Type.Literal(row.durability),
+		...envelope,
+		data: row.data
+	}, strict$2);
+})));
+//#endregion
+//#region ../../packages/runtime-contract/src/pin.ts
+const strict$1 = { additionalProperties: false };
+const count$1 = () => Type.Integer({ minimum: 0 });
+/** spec 16 */
+const RuntimePin = Type.Object({
+	runtimeId: Type.String(),
+	adapterVersion: Type.String(),
+	engine: Type.Union([Type.Object({
+		name: Type.String(),
+		version: Type.String()
+	}, strict$1), Type.Null()]),
+	node: Type.Object({
+		version: Type.String(),
+		execPath: Type.String()
+	}, strict$1),
+	artifacts: Type.Array(Type.Object({
+		role: Type.Union([
+			Type.Literal("agent-host-bundle"),
+			Type.Literal("engine-package-tree"),
+			Type.Literal("install-lock")
+		]),
+		path: Type.String(),
+		sha256: Sha256,
+		files: Type.Optional(count$1()),
+		bytes: count$1()
+	}, strict$1)),
+	/** sha256(canonicalJson(all of the above)) */
+	digest: Sha256
+}, strict$1);
+/** never contains a token, a refresh token or an account secret */
+const ProviderAuthStatus = Type.Object({
+	provider: Type.String(),
+	/** 'unknown-transient' = credential store locked: NEVER mapped to AUTH_REQUIRED */
+	state: Type.Union([
+		Type.Literal("oauth"),
+		Type.Literal("api-key"),
+		Type.Literal("absent"),
+		Type.Literal("unknown-transient")
+	]),
+	subscription: Type.Boolean(),
+	source: Type.Optional(Type.String()),
+	checkedAt: IsoInstant,
+	/** non-secret account/tenant label WHEN the engine exposes one without a secret; absent otherwise */
+	accountLabel: Type.Optional(Type.String()),
+	/** Cohorte's own table, not the engine's subscription flag (§3.7) */
+	billing: Type.Union([
+		Type.Literal("plan-limits"),
+		Type.Literal("metered"),
+		Type.Literal("unknown")
+	]),
+	caveat: Type.Optional(Type.String())
+}, strict$1);
+//#endregion
+//#region ../../packages/runtime-contract/src/spawn.ts
+const strict = { additionalProperties: false };
+const count = () => Type.Integer({ minimum: 0 });
+const limit = () => Type.Optional(Type.Integer({ minimum: 1 }));
+const ceiling = () => Type.Optional(count());
+const stringMap = () => Type.Unsafe(Type.Record(Type.String(), Type.String()));
+/** opaque label; the runtime MUST NOT branch on it */
+const AgentRole = Type.String();
+const AuthRequirement = Type.Object({
+	mode: AuthMode,
+	provider: Type.String(),
+	/** pinned catalogue endpoint; a runtime that would talk to anything else MUST refuse to spawn */
+	baseUrl: Type.String(),
+	/** false unless the run plan carries an explicit api opt-in */
+	allowApiKey: Type.Boolean()
+}, strict);
+/** rendered by the host into the run snapshot dir */
+const TaskInput = Type.Object({
+	path: Type.String(),
+	sha256: Sha256,
+	bytes: count()
+}, strict);
+/**
+* `note` is delivered by the runtime AFTER `task` and BEFORE the first model request: as a second user message when
+* the engine can carry two in one prompt, otherwise appended to the first user message after
+* CONTINUATION_NOTE_SEPARATOR. Either way each text is a byte-identical contiguous span and `task` comes first
+* (conformance rule 12).
+*/
+const Continuation = Type.Object({
+	fromIncarnation: Type.Integer({ minimum: 1 }),
+	note: TaskInput,
+	/** used only if continuationFromTranscript = yes */
+	transcript: Type.Optional(TranscriptRef)
+}, strict);
+/** runtime MUST verify sha256 before use */
+const PromptRef = Type.Object({
+	id: Type.String(),
+	path: Type.String(),
+	sha256: Sha256,
+	bytes: count()
+}, strict);
+const ContextEntry = Type.Object({
+	id: Type.String(),
+	tier: Type.Union([
+		Type.Literal("system"),
+		Type.Literal("doctrine"),
+		Type.Literal("data"),
+		Type.Literal("task"),
+		Type.Literal("prior-results")
+	]),
+	/** agent-output and untrusted-repository can never sit above 'data' */
+	trust: Type.Union([
+		Type.Literal("cohorte"),
+		Type.Literal("human"),
+		Type.Literal("untrusted-repository"),
+		Type.Literal("agent-output")
+	]),
+	source: Type.Object({
+		kind: Type.Union([
+			Type.Literal("asset"),
+			Type.Literal("project-file"),
+			Type.Literal("artifact"),
+			Type.Literal("event-summary"),
+			Type.Literal("inline")
+		]),
+		ref: Type.String()
+	}, strict),
+	sha256: Sha256,
+	bytes: count(),
+	tokenEstimate: count()
+}, strict);
+/**
+* PROVENANCE ONLY. "Installer le contexte" (spec 5.2) is defined as: every byte the model sees is in exactly two
+* host-rendered files — `systemPrompt` (tiers `system` + `doctrine`) and `task` (tiers `data` + `task` +
+* `prior-results`) — plus, for a later incarnation, `continuation.note`. A runtime installs those three and NOTHING
+* else: it never opens `entries[].source`, never re-orders or re-renders tiers. The manifest travels so that the
+* runtime can record `manifestSha256` on `model.requested` and so that a second runtime has nothing to guess.
+* Tiers are trust/priority tiers (spec 7), not orchestration words.
+*/
+const ContextManifest = Type.Object({
+	/** sha256(canonicalJson(entries)) = "hash du contexte" of spec 19 */
+	manifestSha256: Sha256,
+	tokenLimit: count(),
+	tokenEstimate: count(),
+	/** deterministic order: tier, then id */
+	entries: Type.Array(ContextEntry),
+	reductions: Type.Array(Type.Object({
+		entryId: Type.String(),
+		strategy: Type.Union([
+			Type.Literal("excerpt"),
+			Type.Literal("outline"),
+			Type.Literal("summary-with-refs"),
+			Type.Literal("dropped")
+		]),
+		fromBytes: count(),
+		toBytes: count()
+	}, strict)),
+	exclusions: Type.Array(Type.Object({
+		pattern: Type.String(),
+		reason: Type.Union([
+			Type.Literal("secret"),
+			Type.Literal("outside-scope"),
+			Type.Literal("size"),
+			Type.Literal("binary")
+		])
+	}, strict))
+}, strict);
+/** Isolation of the RUNTIME'S OWN agent process (the brain). Tool isolation is host-side. */
+const SandboxPolicy = Type.Object({
+	/** spawn fails security/sandbox-unavailable below `os` */
+	require: Type.Union([
+		Type.Literal("os"),
+		Type.Literal("os-if-available"),
+		Type.Literal("process")
+	]),
+	/** absolute canonical roots */
+	filesystem: Type.Object({
+		readOnly: Type.Array(Type.String()),
+		readWrite: Type.Array(Type.String()),
+		denyRead: Type.Array(Type.String())
+	}, strict),
+	network: Type.Object({
+		mode: Type.Union([
+			Type.Literal("none"),
+			Type.Literal("provider-only"),
+			Type.Literal("unrestricted")
+		]),
+		allowHosts: Type.Array(Type.String())
+	}, strict),
+	/** allowlist; nothing else is inherited (D3) */
+	env: Type.Object({
+		allow: Type.Array(Type.String()),
+		set: stringMap()
+	}, strict),
+	limits: Type.Object({
+		maxOldSpaceMb: limit(),
+		maxCpuSeconds: limit(),
+		maxOpenFiles: limit()
+	}, strict)
+}, strict);
+/** hard ceilings for ONE incarnation; absent = unlimited at this level */
+const Budget = Type.Object({
+	maxTurns: ceiling(),
+	maxModelRequests: ceiling(),
+	maxToolCalls: ceiling(),
+	maxInputTokens: ceiling(),
+	maxOutputTokens: ceiling(),
+	maxTotalTokens: ceiling(),
+	/** stop (never auto-compact) when the last request's context exceeds this */
+	maxContextTokens: ceiling(),
+	maxWallClockMs: ceiling(),
+	maxModelRequestMs: ceiling(),
+	/** 0 = every retry is the host's (spec 11.3 "tous les retries sont visibles") */
+	maxEngineRetries: count()
+}, strict);
+const SpawnRequest = Type.Object({
+	runId: RunId,
+	agentId: AgentId,
+	role: AgentRole,
+	model: ModelRef,
+	systemPrompt: PromptRef,
+	context: ContextManifest,
+	tools: Type.Array(ToolGrant),
+	sandbox: SandboxPolicy,
+	budget: Budget,
+	/** absolute, canonical; the path the MODEL is told about. The engine process MUST NOT use it as its cwd */
+	workingDirectory: Type.String(),
+	/** spec 6: spawn is idempotent on (runId, agentId, incarnation) */
+	incarnation: Type.Integer({ minimum: 1 }),
+	thinking: ThinkingLevel,
+	/** spec 10.1 / D3 */
+	auth: AuthRequirement,
+	/** the first user message, by reference */
+	task: TaskInput,
+	/** a later incarnation of the same attempt */
+	continuation: Type.Union([Continuation, Type.Null()])
+}, strict);
+//#endregion
+export { probeSandbox as _, RUNTIME_EVENT_TYPE_NAMES as a, toolGrantProblems as c, SandboxCapabilities as d, AGENT_GIT_DENIED_SUBCOMMANDS as f, createRedactor as g, isTrampoline as h, RUNTIME_EVENT_TYPES as i, AgentExit as l, PROTECTED_REPO_GLOBS as m, ProviderAuthStatus as n, ToolContent as o, DEFAULT_DENY_GLOBS as p, RuntimePin as r, ToolGrant as s, SpawnRequest as t, RuntimeCapabilities as u, createExecutor as v, createNoneBackend as y };
+
+//# sourceMappingURL=src-CId6kMsY.mjs.map