cohorte 3.0.0-dev.0 → 3.0.0-dev.2

package/dist/agent-host.mjs

@@ -1,9 +1,1555 @@
 #!/usr/bin/env node
 import { findPackageJSON } from "node:module";
-import { readFileSync } from "node:fs";
+import { createReadStream, createWriteStream, readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { Type, Type as Type$1 } from "typebox";
+import { Compile } from "typebox/compile";
+import { ModelsError, lazyStream } from "@earendil-works/pi-ai";
+import { DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager, createAgentSession } from "@earendil-works/pi-coding-agent";
 import "@earendil-works/pi-agent-core";
-import "@earendil-works/pi-ai";
-import "@earendil-works/pi-coding-agent";
+//#region ../../packages/base/src/canonical.ts
+/** A string is hashed as UTF-8, as given: no normalisation here. */
+function sha256Hex(data) {
+	return createHash("sha256").update(data).digest("hex");
+}
+//#endregion
+//#region ../../packages/base/src/json.ts
+const JsonValueCyclic = Type.Cyclic({ JsonValue: Type.Union([
+	Type.Null(),
+	Type.Boolean(),
+	Type.Number(),
+	Type.String(),
+	Type.Array(Type.Ref("JsonValue")),
+	Type.Record(Type.String(), Type.Ref("JsonValue"))
+]) }, "JsonValue");
+/**
+* The schema of {@link JsonValue}. Its static type is the hand-written alias rather than the type derived from
+* the cyclic schema: the two are the same type (the assertion below breaks `tsc` if they drift), but the alias
+* costs the compiler nothing where the derived one is re-expanded inside every schema that embeds a JSON value.
+*
+* NOT named `JsonValue` like its type, on purpose. Biome 2.5.14 (type-aware because of nursery/noFloatingPromises)
+* overflows its stack on a RECURSIVE UNION whose name is shared by a TypeBox const, as soon as a class that extends
+* Error holds a value of that type — `CohorteError.info.details` does. It then exits 0, so the lint looks green
+* while nothing was checked. DESIGN 2.1 lists `JsonValue` as a type only (it is not `[S]`), so no contract moves.
+* KEEP THE EXPLICIT ANNOTATION too: having to INFER this call is the other way into the same overflow (a
+* `typeof JsonValueSchema`, or a namespace import of the barrel, is enough). See docs/v3/requests/U0.02.md R1.
+*/
+const JsonValueSchema = Type.Unsafe(JsonValueCyclic);
+const isPlainObject = (value) => {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+};
+const isJson = (value, ancestors) => {
+	if (value === null) return true;
+	switch (typeof value) {
+		case "boolean":
+		case "string": return true;
+		case "number": return Number.isFinite(value);
+		case "object": break;
+		default: return false;
+	}
+	if (ancestors.has(value)) return false;
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) {
+			for (let index = 0; index < value.length; index += 1) if (!(index in value) || !isJson(value[index], ancestors)) return false;
+			return true;
+		}
+		if (!isPlainObject(value)) return false;
+		return Object.values(value).every((member) => isJson(member, ancestors));
+	} finally {
+		ancestors.delete(value);
+	}
+};
+/** Structural guard: finite numbers only, no `undefined`, no hole, plain objects only, no cycle. Never throws on data. */
+function isJsonValue(value) {
+	try {
+		return isJson(value, /* @__PURE__ */ new Set());
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region ../../packages/base/src/errors.ts
+/** Spec 24, in spec order. Closed: a fourteenth class would be a MAJOR of both frontiers. */
+const ERROR_CLASSES = [
+	"configuration",
+	"validation",
+	"permission",
+	"security",
+	"provider-transient",
+	"provider-terminal",
+	"tool-transient",
+	"tool-terminal",
+	"conflict",
+	"budget",
+	"timeout",
+	"corruption",
+	"human-required"
+];
+const ErrorClass = Type.Union([
+	Type.Literal("configuration"),
+	Type.Literal("validation"),
+	Type.Literal("permission"),
+	Type.Literal("security"),
+	Type.Literal("provider-transient"),
+	Type.Literal("provider-terminal"),
+	Type.Literal("tool-transient"),
+	Type.Literal("tool-terminal"),
+	Type.Literal("conflict"),
+	Type.Literal("budget"),
+	Type.Literal("timeout"),
+	Type.Literal("corruption"),
+	Type.Literal("human-required")
+]);
+const ErrorInfoCyclic = Type.Cyclic({ ErrorInfo: Type.Object({
+	code: Type.String({ pattern: "^[a-z]+(?:-[a-z]+)*/[a-z0-9]+(?:-[a-z0-9]+)*$" }),
+	class: ErrorClass,
+	message: Type.String(),
+	impact: Type.String(),
+	retryable: Type.Boolean(),
+	retryAfterMs: Type.Optional(Type.Number({ minimum: 0 })),
+	remediation: Type.String(),
+	cause: Type.Optional(Type.Ref("ErrorInfo")),
+	details: Type.Optional(Type.Record(Type.String(), JsonValueSchema))
+}, { additionalProperties: false }) }, "ErrorInfo");
+/**
+* The schema of {@link ErrorInfo}, under the name of its type ([S], DESIGN §2). The static type is the DESIGN
+* interface and the assertion below keeps it equal to what the schema derives: an `ErrorInfo` sits in dozens of
+* event payloads, and a derived recursive type would be re-expanded in each of them.
+*
+* KEEP THE EXPLICIT `TUnsafe<ErrorInfo>` ANNOTATION. Biome 2.5.14 is type-aware (nursery/noFloatingPromises) and
+* overflows its stack when it has to INFER this call for a const that shares its name with a recursive type, as
+* soon as a class extending Error holds that type — `CohorteError.info` does. Biome then exits 0: the lint looks
+* green while nothing was checked. With the annotation it has nothing to infer. See docs/v3/requests/U0.02.md R1.
+*/
+const ErrorInfo = Type.Unsafe(ErrorInfoCyclic);
+//#endregion
+//#region ../../packages/base/src/catalogue.ts
+/** DESIGN 2.8, column "CLI exit": the exit code of a process that waited for a run which ended on an error of that class. */
+const EXIT_CODE_BY_CLASS = Object.freeze({
+	configuration: 10,
+	validation: 11,
+	permission: 12,
+	security: 13,
+	"provider-transient": 14,
+	"provider-terminal": 14,
+	"tool-transient": 15,
+	"tool-terminal": 15,
+	conflict: 16,
+	budget: 17,
+	timeout: 18,
+	corruption: 19,
+	"human-required": 20
+});
+const RETRY = true;
+const NO_RETRY = false;
+const row = (code, retryable, impact, remediation) => ({
+	code,
+	retryable,
+	impact,
+	remediation
+});
+/**
+* APPEND-ONLY. A code is a public, stable identifier (spec 24): never rename one, never remove one, never move one
+* to another class; add new rows at the END of their class block. `impact` says what the error means for the run,
+* `remediation` is the imperative next action (spec 21). Every `<class>/unexpected` row is the landing place of a
+* throwable nobody classified (DESIGN 2.8) and is never retried.
+*/
+const ERROR_CATALOGUE_ROWS = [
+	row("configuration/policy-invalid", NO_RETRY, "The security policy is missing or cannot be parsed, so nothing may execute and the run does not start.", "Fix the policy keys named in the message in .cohorte/config.yaml, then run `cohorte doctor`."),
+	row("configuration/phase-not-available", NO_RETRY, "The requested phase or pipeline profile is not part of this version, so the run does not start.", "Choose a profile that `cohorte doctor` lists as available, or upgrade Cohorte."),
+	row("configuration/incompatible-state-schema", NO_RETRY, "The state database was written by an incompatible Cohorte version and is left untouched.", "Run the Cohorte version named in the message, or back up the state and run `cohorte migrate --apply`."),
+	row("configuration/platform-unsupported", NO_RETRY, "This operating system or architecture cannot provide what the configuration requires, so the run does not start.", "Run on a supported platform, or relax the requirement named in the message in your user configuration."),
+	row("configuration/telemetry-remote-unavailable", NO_RETRY, "Remote telemetry is configured but does not exist in this version; nothing was sent.", "Remove the remote telemetry settings; local logs and metrics stay available."),
+	row("configuration/worktree-root-protected", NO_RETRY, "The configured worktree root lies inside a protected directory, so no worktree can be created there.", "Set git.worktreeRoot to a directory outside the protected roots, or remove the setting to use the default."),
+	row("configuration/provision-store-unavailable", NO_RETRY, "Dependencies cannot be provisioned offline because the package manager store is not reachable.", "Populate the package manager store (install once with network access), then start the run again."),
+	row("configuration/engine-init", NO_RETRY, "The agent runtime could not initialise its model engine, so the agent never started.", "Run `cohorte doctor` and fix the provider or model configuration it reports."),
+	row("configuration/fake-script-unmatched", NO_RETRY, "The fake runtime script has no entry for this spawn request, so the scripted run cannot continue.", "Add a matching entry to the fake runtime script, or correct the spawn fields it matches on."),
+	row("configuration/unexpected", NO_RETRY, "An unclassified configuration failure stopped the run before or while it started.", "Read the message, run `cohorte doctor`, and report the error if the configuration looks correct."),
+	row("validation/tool-input", NO_RETRY, "A tool call did not match the input schema of the tool and was not executed.", "Nothing to do if the agent recovers; otherwise inspect the rejected call with `cohorte logs`."),
+	row("validation/agent-output", NO_RETRY, "The final output of the agent does not match the schema of its phase, so it cannot be used.", "Inspect the agent transcript; retry the phase or escalate the model tier."),
+	row("validation/agent-no-result", NO_RETRY, "The agent stopped without delivering a structured result, so its phase has no outcome.", "Retry the phase; if it repeats, inspect the transcript and escalate the model tier."),
+	row("validation/spec", NO_RETRY, "The spec file is invalid, so the run cannot be planned from it.", "Fix the fields named in the message in the spec file, then start the run again."),
+	row("validation/invalid-id", NO_RETRY, "A value is not a well-formed identifier of the expected kind and was refused before reaching a path, a ref or the store.", "Pass an identifier of the shape named in the message, as printed by `cohorte status`."),
+	row("validation/unexpected", NO_RETRY, "An unclassified validation failure made a value unusable.", "Read the message, inspect the offending input with `cohorte logs`, and report the error if the input looks valid."),
+	row("permission/tool-not-granted", NO_RETRY, "The agent called a tool its role was not granted; the call was denied and nothing executed.", "Nothing to do if the agent adapts; grant the tool to the role in the configuration if the call was legitimate."),
+	row("permission/path-outside-grant", NO_RETRY, "The agent addressed a path outside what its grant allows; the call was denied and nothing was read or written.", "Nothing to do if the agent adapts; widen the ownership of the surface if the path legitimately belongs to it."),
+	row("permission/command-not-allowed", NO_RETRY, "The command is not in the allowlist of the command policy; it was denied and nothing executed.", "Add a rule for the command to the command policy if it is legitimate, then resume."),
+	row("permission/network-denied", NO_RETRY, "The call needs network access, which agents never have in this version; it was denied.", "Provide what the agent needed locally, for example through provisioning, then resume."),
+	row("permission/denied-by-human", NO_RETRY, "A human denied the approval request; the call was not executed.", "Nothing to do; approve a new request if the denial was a mistake."),
+	row("permission/unexpected", NO_RETRY, "An unclassified permission failure denied the call; nothing executed.", "Read the message and inspect the denied call with `cohorte logs`."),
+	row("security/symlink-escape", NO_RETRY, "A path resolves through a symbolic link to a location outside its allowed root; the run is blocked and its worktrees are frozen.", "Inspect the link named in the message, remove it if it is hostile, then acknowledge with `cohorte resume --ack`."),
+	row("security/protected-path", NO_RETRY, "The agent targeted a protected path such as .git, .cohorte or a credential file; the run is blocked.", "Inspect the attempted call with `cohorte logs`, then acknowledge with `cohorte resume --ack` or cancel the run."),
+	row("security/write-outside-ownership", NO_RETRY, "Changes were found outside the ownership of the surface that produced them; they are not integrated and the run is blocked.", "Inspect the diff of the frozen worktree, revert or re-assign the files, then acknowledge with `cohorte resume --ack`."),
+	row("security/runtime-pin-mismatch", NO_RETRY, "The installed runtime no longer matches the pin taken when the run started; no agent is spawned.", "Reinstall the pinned Cohorte and runtime versions named in the message, then resume."),
+	row("security/asset-hash-mismatch", NO_RETRY, "An embedded prompt, skill, schema or migration does not match its recorded hash; the installation is not trusted.", "Reinstall Cohorte from the registry and compare with `cohorte doctor`."),
+	row("security/pin-tampered", NO_RETRY, "The recorded runtime pin or run snapshot was modified after the run started; the run is blocked.", "Inspect the run directory for tampering; start a new run if the snapshot cannot be trusted."),
+	row("security/runtime-inside-target", NO_RETRY, "Cohorte is running from inside the repository it would modify, so agents could rewrite their own supervisor; the run does not start.", "Run an installed Cohorte that lives outside the target repository."),
+	row("security/auth-mode-violation", NO_RETRY, "A request was about to use another billing mode than the one the run plan allows; it was stopped before leaving the machine.", "Check the provider authentication with `cohorte auth status`; opt in to metered billing explicitly if that is intended."),
+	row("security/auth-endpoint-mismatch", NO_RETRY, "The provider endpoint differs from the pinned one for this authentication mode; no credential was sent.", "Remove the endpoint override, or pin the endpoint in your user configuration if it is legitimate."),
+	row("security/command-auth-invalid", NO_RETRY, "A control command carried a missing, unknown or wrong authenticator; it was rejected and never applied.", "Send the command again through the `cohorte` CLI as the user who owns the project key."),
+	row("security/event-chain-broken", NO_RETRY, "The event history of the run fails its hash chain or anchor check, so it may have been rewritten; the run is blocked.", "Inspect the state database and its backups; never delete the run, restore a verified backup instead."),
+	row("security/root-refused", NO_RETRY, "Cohorte refuses to run as root; nothing was started.", "Run Cohorte as an unprivileged user."),
+	row("security/sandbox-unavailable", NO_RETRY, "The required operating-system sandbox is not available, so commands would run unconfined; the run does not start.", "Follow the sandbox remediation printed by `cohorte doctor`, or opt in to best-effort isolation in your user configuration."),
+	row("security/secret-staged", NO_RETRY, "A secret was detected in the changes about to be committed; the commit was not created and the run is blocked.", "Remove the secret from the worktree and rotate it, then acknowledge with `cohorte resume --ack`."),
+	row("security/command-trampoline", NO_RETRY, "The command would launch another program on behalf of the agent (a shell, an interpreter flag, an exec wrapper); it was denied.", "Inspect the attempted command with `cohorte logs`; expose the real program through the command policy if it is legitimate."),
+	row("security/project-policy-untrusted", NO_RETRY, "The configuration of the repository loosens security settings that only the local user may loosen; the run does not start.", "Review the keys named in the message, then grant them with `cohorte config trust` or set them in your user configuration."),
+	row("security/deps-tampered", NO_RETRY, "Provisioned dependencies changed after they were installed and sealed; the run is blocked.", "Inspect the slot named in the message, then provision it again from the lockfile."),
+	row("security/review-ref-mutated", NO_RETRY, "The immutable ref under review changed while it was being reviewed; the review result cannot be trusted.", "Inspect who moved the ref, then run the review again on a fresh ref."),
+	row("security/command-global-option", NO_RETRY, "The command carries a global option that redirects the program (for git: -C, -c, --git-dir, --work-tree); it was denied.", "Inspect the attempted command with `cohorte logs`; no configuration allows these options."),
+	row("security/gate-internal-error", NO_RETRY, "A stage of the permission gate failed unexpectedly; the call was denied because the gate fails closed.", "Report the error with the run logs; resume once the cause is understood."),
+	row("security/redaction-failed", NO_RETRY, "The redactor failed on an event; the payload was dropped instead of being stored unredacted.", "Report the error with the run logs; the dropped payload is not recoverable."),
+	row("security/unexpected", NO_RETRY, "An unclassified security failure blocked the run; its worktrees are frozen.", "Inspect the run with `cohorte logs` before acknowledging with `cohorte resume --ack`."),
+	row("provider-transient/rate-limited", RETRY, "The provider is rate limiting requests; the request is retried with a bounded back-off.", "Nothing to do; if it persists, lower the agent concurrency or wait for the limit to reset."),
+	row("provider-transient/overloaded", RETRY, "The provider is overloaded or returned a server error; the request is retried with a bounded back-off.", "Nothing to do; check the status page of the provider if it persists."),
+	row("provider-transient/network", RETRY, "The connection to the provider failed; the request is retried with a bounded back-off.", "Check the network connection and any proxy settings if it persists."),
+	row("provider-transient/credential-store-locked", RETRY, "The credential store is locked by another process; the request is retried shortly.", "Close other programs that use the same login if it persists."),
+	row("provider-transient/unexpected", NO_RETRY, "An unclassified provider failure interrupted a model request; it is not retried because its cause is unknown.", "Read the message, then resume the run; report the error if it repeats."),
+	row("provider-terminal/auth-required", NO_RETRY, "The provider needs a new login; the run is suspended until authentication is restored.", "Run `cohorte auth login`, then `cohorte resume`."),
+	row("provider-terminal/quota-exceeded", NO_RETRY, "The plan limit of the provider is reached; the run is suspended until the quota resets.", "Wait for the reset time shown by `cohorte status`, then resume; automatic resume does it when enabled."),
+	row("provider-terminal/entitlement", NO_RETRY, "The account is not entitled to this model or usage; the request cannot succeed as configured.", "Choose a model your plan includes, or change the plan with the provider."),
+	row("provider-terminal/model-not-found", NO_RETRY, "The configured model does not exist for this provider; the agent cannot start.", "Correct the model in the tier table of the configuration; `cohorte doctor` lists the known models."),
+	row("provider-terminal/policy-refused", NO_RETRY, "The provider refused the request under its usage policies; repeating it unchanged will not help.", "Inspect the refused request in the transcript and rephrase the task or the spec."),
+	row("provider-terminal/unexpected", NO_RETRY, "An unclassified provider failure ended a model request for good.", "Read the message and the transcript; report the error if the request looks valid."),
+	row("tool-transient/spawn-failed", RETRY, "The process of a tool could not be started; the call is retried once.", "Check that the program exists on the pinned PATH reported by `cohorte doctor` if it persists."),
+	row("tool-transient/interrupted", RETRY, "A tool call was interrupted before it finished, for example by a host restart; it is replayed when that is safe.", "Nothing to do; inspect the effect journal with `cohorte inspect` if the call is reported in doubt."),
+	row("tool-transient/agent-process-exit", RETRY, "The process of the agent exited without settling; a fresh incarnation takes over from the file ledger.", "Nothing to do; check the memory and the logs of the machine if it repeats."),
+	row("tool-transient/cancelled", RETRY, "The tool call was cancelled before it finished because its agent or its run was paused or cancelled.", "Nothing to do; resume the run to let the agent issue the call again."),
+	row("tool-transient/unexpected", NO_RETRY, "An unclassified failure interrupted a tool call; it is not retried because its cause is unknown.", "Read the message and inspect the call with `cohorte logs`; report the error if it repeats."),
+	row("tool-terminal/nonzero-exit", NO_RETRY, "The command exited with a non-zero status; the result was handed to the agent.", "Nothing to do; the agent sees the output and decides what to do next."),
+	row("tool-terminal/output-cap", NO_RETRY, "The output of the tool exceeded its cap and was truncated or the process was stopped.", "Nothing to do; narrow the command if the agent keeps hitting the cap."),
+	row("tool-terminal/patch-preimage-mismatch", NO_RETRY, "The file no longer matches the content the patch was written against; nothing was written.", "Nothing to do; the agent must read the file again before patching it."),
+	row("tool-terminal/unexpected", NO_RETRY, "An unclassified failure ended a tool call; an error result was handed to the agent.", "Read the message and inspect the call with `cohorte logs`."),
+	row("conflict/merge", NO_RETRY, "The branch of a surface does not merge cleanly into the integration branch; the conflict goes to a fix round or to a human.", "Let the fix round resolve it, or resolve the conflict on the integration branch and resume."),
+	row("conflict/zone-reserved", NO_RETRY, "Another agent holds the lock on an overlapping zone of files; the writer must wait for it.", "Nothing to do; it clears when the holder finishes. Cancel the holder if it is stuck."),
+	row("conflict/incarnation-exists", NO_RETRY, "An incarnation of this agent is already registered; a second one was refused.", "Nothing to do; if no such process is alive, `cohorte resume` sweeps the stale incarnation."),
+	row("conflict/command-id-reuse", NO_RETRY, "A command identifier was reused with a different body; the second command was rejected.", "Send the command again with a fresh identifier."),
+	row("conflict/run-host-alive", NO_RETRY, "A run host already drives this run; a second one was refused.", "Observe the run with `cohorte tail`; stop the other host first if you mean to replace it."),
+	row("conflict/lease-lost", NO_RETRY, "This run host lost its lease to a newer one and was fenced off; it stopped writing.", "Nothing to do; the newer host owns the run. Observe it with `cohorte status`."),
+	row("conflict/reconcile-human-edit", NO_RETRY, "A generated file was edited by hand since it was rendered; reconcile will not overwrite it.", "Keep your edit and mark the field as overridden, or restore the generated content, then plan the reconcile again."),
+	row("conflict/not-running", NO_RETRY, "The command applies to a running pipeline only and the run is not running; it was rejected.", "Check the state with `cohorte status` and use the command that fits it."),
+	row("conflict/run-terminal", NO_RETRY, "The run has already ended; the command was rejected.", "Start a new run; a completed or cancelled run cannot change."),
+	row("conflict/run-active", NO_RETRY, "The run is active, and this command applies to a halted run only; it was rejected.", "Wait for the run to halt, or pause it, before sending this command."),
+	row("conflict/run-halted", NO_RETRY, "The run is halted (FAILED or BLOCKED) rather than running; the command was rejected. A halted run is not over.", "Resume it the way its state allows — `cohorte retry` out of FAILED, `cohorte resume --ack` out of BLOCKED."),
+	row("conflict/use-retry", NO_RETRY, "The run is FAILED, and this command resumes a suspended run only; it was rejected.", "Use `cohorte retry` to resume a FAILED run."),
+	row("conflict/use-resume", NO_RETRY, "The run is suspended, and this command resumes a FAILED run only; it was rejected.", "Use `cohorte resume` to resume a suspended run."),
+	row("conflict/use-resume-ack", NO_RETRY, "The run is BLOCKED by a security stop, and this command does not acknowledge it; it was rejected.", "Read the stop record, then use `cohorte resume --ack` to acknowledge it and resume."),
+	row("conflict/run-blocked", NO_RETRY, "The run is BLOCKED by a security stop; the command was rejected while the stop stands.", "Read the stop record and resume with `cohorte resume --ack` before sending this command again."),
+	row("conflict/unexpected", NO_RETRY, "An unclassified conflict stopped an operation; the state it competed for was left as it was.", "Check the state with `cohorte status`, then repeat the operation."),
+	row("budget/tokens", NO_RETRY, "A token budget is exhausted; the run waits for a human decision.", "Raise the budget with `cohorte approve`, or cancel the run."),
+	row("budget/tool-calls-exhausted", NO_RETRY, "The tool-call budget of the agent is exhausted; further calls are refused.", "Raise the tool-call budget with `cohorte approve`, or let the agent conclude with what it has."),
+	row("budget/context-window", NO_RETRY, "The conversation no longer fits the context window of the model; a fresh incarnation continues with a smaller context built by Cohorte.", "Nothing to do; split the task or narrow the ownership if it repeats."),
+	row("budget/fix-rounds", NO_RETRY, "The maximum number of fix rounds is reached with findings still open; the run waits for a human decision.", "Review the open findings, then raise the limit with `cohorte approve` or take over by hand."),
+	row("budget/provider", NO_RETRY, "The budget configured for this provider is exhausted; the run waits for a human decision.", "Raise the provider budget with `cohorte approve`, or cancel the run."),
+	row("budget/estimated-quota", NO_RETRY, "The estimated share of the plan quota used by this run reached its limit; the run waits for a human decision.", "Raise the limit with `cohorte approve`, or wait for the quota window to reset."),
+	row("budget/incarnations", NO_RETRY, "The agent was restarted as many times as allowed and is now failed.", "Inspect why the agent keeps dying with `cohorte logs`, then retry the phase."),
+	row("budget/unexpected", NO_RETRY, "An unclassified budget failure stopped the run from spending more.", "Check the counters with `cohorte status`, then approve a higher budget or cancel the run."),
+	row("timeout/tool", RETRY, "A tool call exceeded its time limit and its process tree was killed; the call is retried once.", "Raise the timeout of the command in the configuration if the command is legitimately slow."),
+	row("timeout/model-request", RETRY, "A model request exceeded its time limit; it is retried with a bounded back-off.", "Nothing to do; check the network and the status of the provider if it persists."),
+	row("timeout/agent", RETRY, "The agent exceeded its wall-clock limit and was stopped; the retry policy decides what follows.", "Raise the agent time limit, or split the task, if the work is legitimately long."),
+	row("timeout/run", NO_RETRY, "The run exceeded its wall-clock budget; it waits for a human decision.", "Extend the run with `cohorte approve`, or cancel it."),
+	row("timeout/unexpected", NO_RETRY, "An unclassified timeout stopped an operation; it is not retried because its cause is unknown.", "Read the message, then resume the run; report the error if it repeats."),
+	row("corruption/event-gap", NO_RETRY, "The event sequence of the run has a gap or a duplicate; the store refuses to open it and deletes nothing.", "Restore the state database from a backup; keep the damaged file for inspection."),
+	row("corruption/projection-mismatch", NO_RETRY, "The stored projections disagree with what the events replay to; the run is not resumed from them.", "Run `cohorte doctor --verify-state` to see which projection differs from the event log, and report it; the events are the truth."),
+	row("corruption/snapshot-hash", NO_RETRY, "A state snapshot does not match its recorded hash; it is ignored and an older one is used when available.", "Nothing to do if resume succeeds; otherwise restore the state database from a backup."),
+	row("corruption/incompatible-schema", NO_RETRY, "The schema of the state database is not one this version can read; it refuses to open it and never migrates on its own.", "Run the Cohorte version that wrote the database, or back up the state and run `cohorte migrate --apply`."),
+	row("corruption/unexpected", NO_RETRY, "An unclassified integrity failure made stored state untrustworthy; nothing was deleted.", "Back up the .cohorte/state directory before anything else, then run `cohorte doctor`."),
+	row("human-required/approval", NO_RETRY, "A call needs the approval of a human; the run waits and nothing executes meanwhile.", "Review the request with `cohorte status`, then `cohorte approve` or `cohorte deny`."),
+	row("human-required/approval-timeout", NO_RETRY, "An approval request expired without an answer; the call was not executed.", "Resume the run to let the agent ask again, then answer in time."),
+	row("human-required/blocked-ack", NO_RETRY, "The run is blocked after a security event and needs a human to inspect it.", "Inspect the run with `cohorte logs`, then acknowledge with `cohorte resume --ack` or cancel it."),
+	row("human-required/in-doubt-effect", NO_RETRY, "An effect was interrupted and cannot be proven done or not done; repeating it blindly could apply it twice.", "Inspect the effect with `cohorte inspect`, then resolve it by hand and resume."),
+	row("human-required/unexpected", NO_RETRY, "An unclassified situation needs a human decision; the run waits.", "Check what the run waits for with `cohorte status`, then answer it.")
+];
+const classOf = (code) => {
+	const prefix = code.slice(0, code.indexOf("/"));
+	const found = ERROR_CLASSES.find((candidate) => candidate === prefix);
+	if (!found) throw new TypeError(`error catalogue: ${code} does not start with an error class`);
+	return found;
+};
+const build = () => {
+	const catalogue = Object.create(null);
+	for (const { code, retryable, impact, remediation } of ERROR_CATALOGUE_ROWS) {
+		if (code in catalogue) throw new TypeError(`error catalogue: ${code} is listed twice`);
+		const errorClass = classOf(code);
+		catalogue[code] = Object.freeze({
+			class: errorClass,
+			retryable,
+			impact,
+			remediation,
+			exit: EXIT_CODE_BY_CLASS[errorClass]
+		});
+	}
+	return Object.freeze(catalogue);
+};
+/** DESIGN 2.8 (PLAN PC-1: the data lives in base so that L2 packages can mint complete `ErrorInfo`s). */
+const ERROR_CATALOGUE = build();
+function isErrorCode(code) {
+	return Object.hasOwn(ERROR_CATALOGUE, code);
+}
+//#endregion
+//#region ../../packages/base/src/taxonomy.ts
+const MAX_MESSAGE_LENGTH = 2e3;
+/** "single paragraph" (DESIGN 2.1): one line, bounded. Redaction is NOT done here: only a Redactor seals. */
+const paragraph = (text) => {
+	const flat = text.replace(/\s+/g, " ").trim();
+	return flat.length > MAX_MESSAGE_LENGTH ? `${flat.slice(0, 1999)}…` : flat;
+};
+/** Returns `info` itself when its chain is already within bounds, a truncated copy otherwise. */
+const capCause = (info, remaining) => {
+	if (!info.cause) return info;
+	if (remaining === 0) {
+		const { cause: _dropped, ...rest } = info;
+		return {
+			...rest,
+			details: {
+				...rest.details,
+				causeChainTruncated: true
+			}
+		};
+	}
+	const capped = capCause(info.cause, remaining - 1);
+	return capped === info.cause ? info : {
+		...info,
+		cause: capped
+	};
+};
+/**
+* Mints a complete `ErrorInfo` from the catalogue: class, retryability, impact and remediation come from the row of
+* `code`, never from the call site (PLAN PC-1).
+*/
+function errorOf(code, message, extra = {}) {
+	const entry = ERROR_CATALOGUE[code];
+	if (!entry || !isErrorCode(code)) throw new TypeError(`errorOf: ${String(code)} is not in ERROR_CATALOGUE`);
+	const { retryAfterMs, cause, details } = extra;
+	const info = {
+		code,
+		class: entry.class,
+		message: paragraph(message),
+		impact: entry.impact,
+		retryable: entry.retryable,
+		...isRetryAfterMs(retryAfterMs) ? { retryAfterMs } : {},
+		remediation: entry.remediation,
+		...cause === void 0 || cause === null ? {} : { cause: isCanonical(cause, 5) ? cause : wireSafe(cause, 4, UNCLASSIFIED) },
+		...details === void 0 ? {} : { details: isDetails(details) ? details : { detailsDropped: true } }
+	};
+	return capCause(info, 5);
+}
+/** Where an error lands when even the caller's fallback class is not one of the thirteen (a JS caller, a cast, a decoded wire value). */
+const UNCLASSIFIED = "validation/unexpected";
+const isClassified = (info) => {
+	try {
+		return isErrorCode(info.code) && ERROR_CATALOGUE[info.code]?.class === info.class;
+	} catch {
+		return false;
+	}
+};
+const INFO_KEYS = /* @__PURE__ */ new Set([
+	"code",
+	"class",
+	"message",
+	"impact",
+	"retryable",
+	"retryAfterMs",
+	"remediation",
+	"cause",
+	"details"
+]);
+const isRetryAfterMs = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0;
+const isDetails = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && isJsonValue(value);
+/**
+* True when `info` is exactly what `errorOf` would mint: strict JSON, a catalogue code under its own class, the
+* catalogue's impact, retryability and remediation, no foreign member, and a cause chain of the same kind no deeper
+* than `remaining`. "Is JSON" alone is not enough: a cast can carry a security code as a retryable tool error.
+*/
+const isCanonical = (info, remaining) => {
+	try {
+		return isJsonValue(info) && isClassified(info) && hasCanonicalMembers(info, remaining);
+	} catch {
+		return false;
+	}
+};
+const hasCanonicalMembers = (info, remaining) => {
+	const raw = info;
+	const entry = isErrorCode(info.code) ? ERROR_CATALOGUE[info.code] : void 0;
+	if (!entry || raw.impact !== entry.impact || raw.retryable !== entry.retryable) return false;
+	if (raw.remediation !== entry.remediation || typeof raw.message !== "string") return false;
+	if (!Object.keys(info).every((key) => INFO_KEYS.has(key))) return false;
+	if ("retryAfterMs" in info && !isRetryAfterMs(raw.retryAfterMs)) return false;
+	if ("details" in info && !isDetails(raw.details)) return false;
+	if (!("cause" in info)) return true;
+	return remaining > 0 && typeof raw.cause === "object" && raw.cause !== null && isCanonical(info.cause, remaining - 1);
+};
+/**
+* Rebuilds an `ErrorInfo` that is not what `errorOf` mints (an `undefined` optional, a Date in `details`, a cast, a
+* call-site `retryable`) WITHOUT reclassifying it: a `security/*` error must stay one across every boundary (I2).
+* The catalogue row of its own code restores class, impact, retryability and remediation; `fallback` is used only
+* when the code is not a catalogue code of the claimed class. Never throws.
+*/
+const wireSafe = (info, remaining, fallback) => {
+	if (isCanonical(info, remaining)) return info;
+	try {
+		const raw = info;
+		const code = isClassified(info) && isErrorCode(info.code) ? info.code : fallback;
+		const extra = {};
+		if (isRetryAfterMs(raw.retryAfterMs)) extra.retryAfterMs = raw.retryAfterMs;
+		let truncated = false;
+		if (typeof raw.cause === "object" && raw.cause !== null) {
+			if (remaining > 0) extra.cause = wireSafe(raw.cause, remaining - 1, fallback);
+			else truncated = true;
+		}
+		if (raw.details !== void 0) extra.details = isDetails(raw.details) ? raw.details : { detailsDropped: true };
+		if (truncated) extra.details = {
+			...extra.details,
+			causeChainTruncated: true
+		};
+		return errorOf(code, typeof raw.message === "string" ? raw.message : "unknown error", extra);
+	} catch {
+		return errorOf(fallback, "unknown error (unreadable)", { details: { thrown: "unreadable" } });
+	}
+};
+//#endregion
+//#region ../../packages/base/src/ids.ts
+/** Token-safe for François' single ${token} slot, for refs and for paths. */
+const ID_PATTERN = "^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$";
+const ISO_INSTANT_PATTERN = "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$";
+/** The shape each kind of DESIGN 2.1 has, as a pattern (for schemas) and as words (for a human). */
+const ID_SHAPES = {
+	RunId: {
+		pattern: "^run_[0-9a-f]{32}$",
+		shape: "run_<32 lowercase hex digits>"
+	},
+	AgentId: {
+		pattern: "^agt_[A-Za-z0-9.-]+_[A-Za-z0-9_.-]+$",
+		shape: "agt_<role>_<surface|main>[_<n>]"
+	},
+	PhaseRunId: {
+		pattern: "^phs_[A-Z][A-Z_]*_[0-9]+$",
+		shape: "phs_<STATE>_<iteration>"
+	},
+	EventId: {
+		pattern: "^evt_[0-9a-f]{32}$",
+		shape: "evt_<32 lowercase hex digits>"
+	},
+	CommandId: {
+		pattern: "^cmd_[0-9a-f]{32}$",
+		shape: "cmd_<32 lowercase hex digits>"
+	},
+	ApprovalId: {
+		pattern: "^apr_[0-9a-f]{32}$",
+		shape: "apr_<32 lowercase hex digits>"
+	},
+	ToolCallId: {
+		pattern: "^tc_[0-9]+_[0-9]+$",
+		shape: "tc_<incarnation>_<ordinal>"
+	},
+	EffectId: {
+		pattern: "^eff_[0-9a-f]{32}$",
+		shape: "eff_<32 lowercase hex digits>"
+	},
+	ArtifactId: {
+		pattern: "^art_[0-9a-f]{32}$",
+		shape: "art_<32 lowercase hex digits>"
+	},
+	FindingId: {
+		pattern: "^fnd_[0-9a-f]{16}$",
+		shape: "fnd_<16 lowercase hex digits>"
+	},
+	SpecId: {
+		pattern: ID_PATTERN,
+		shape: "letters, digits, \"_\", \".\" and \"-\" (at most 128, not starting with \".\" or \"-\")"
+	},
+	SurfaceId: {
+		pattern: ID_PATTERN,
+		shape: "letters, digits, \"_\", \".\" and \"-\" (at most 128, not starting with \".\" or \"-\")"
+	},
+	Sha256: {
+		pattern: "^[0-9a-f]{64}$",
+		shape: "64 lowercase hex digits"
+	},
+	IsoInstant: {
+		pattern: ISO_INSTANT_PATTERN,
+		shape: "an RFC 3339 UTC instant with milliseconds, such as 2026-01-01T00:00:00.000Z"
+	}
+};
+ID_SHAPES.SpecId;
+const compiled = /* @__PURE__ */ new Map();
+const regExpOf = (pattern) => {
+	let found = compiled.get(pattern);
+	if (!found) {
+		found = new RegExp(pattern);
+		compiled.set(pattern, found);
+	}
+	return found;
+};
+/** Renders a date as an IsoInstant. Throws a RangeError on an invalid date or a year outside 0000-9999. */
+function toIsoInstant(value) {
+	const text = new Date(value).toISOString();
+	if (!regExpOf(ISO_INSTANT_PATTERN).test(text)) throw new RangeError(`toIsoInstant: ${text} is outside the years 0000-9999`);
+	return text;
+}
+const idSchema = (kind, options = {}) => Type.Unsafe(Type.String({
+	...options,
+	pattern: ID_SHAPES[kind].pattern
+}));
+const RunId = idSchema("RunId");
+const AgentId = idSchema("AgentId", { maxLength: 128 });
+idSchema("PhaseRunId", { maxLength: 128 });
+idSchema("EventId");
+idSchema("CommandId");
+idSchema("ApprovalId");
+const ToolCallId = idSchema("ToolCallId", { maxLength: 128 });
+idSchema("EffectId");
+idSchema("ArtifactId");
+idSchema("FindingId");
+idSchema("SpecId");
+idSchema("SurfaceId");
+const Sha256 = idSchema("Sha256");
+const IsoInstant = idSchema("IsoInstant", { format: "date-time" });
+//#endregion
+//#region ../../packages/base/src/model.ts
+const ModelCapability = Type.Union([
+	Type.Literal("fast"),
+	Type.Literal("coding"),
+	Type.Literal("reasoning"),
+	Type.Literal("vision"),
+	Type.Literal("cheap")
+]);
+/** Spec 10, VERBATIM. Thinking level is NOT part of ModelRef: it travels next to it (SpawnRequest.thinking, tier table). */
+const ModelRef = Type.Object({
+	provider: Type.String(),
+	model: Type.String(),
+	capability: Type.Optional(ModelCapability)
+}, { additionalProperties: false });
+const ThinkingLevel = Type.Union([
+	Type.Literal("off"),
+	Type.Literal("minimal"),
+	Type.Literal("low"),
+	Type.Literal("medium"),
+	Type.Literal("high"),
+	Type.Literal("xhigh")
+]);
+/** spec 10: exactly these two */
+const AuthMode = Type.Union([Type.Literal("subscription"), Type.Literal("api")]);
+Type.Union([Type.Literal("not_applicable"), Type.Object({
+	currency: Type.Literal("USD"),
+	amount: Type.Number({ minimum: 0 }),
+	basis: Type.Union([Type.Literal("catalogue"), Type.Literal("estimate")]),
+	priceCatalogVersion: Type.String()
+}, { additionalProperties: false })]);
+//#endregion
+//#region ../../packages/base/src/ports.ts
+const ok = (value) => ({
+	ok: true,
+	value
+});
+const err = (error) => ({
+	ok: false,
+	error
+});
+Object.freeze({
+	now: () => toIsoInstant(Date.now()),
+	monotonicMs: () => performance.now(),
+	sleep: (ms, signal) => new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		signal?.addEventListener("abort", onAbort, { once: true });
+	})
+});
+Type.Object({
+	path: Type.String({ pattern: "^(?:/(?:[^/~]|~[01])*)*$" }),
+	reason: Type.Union([
+		Type.Literal("secret-value"),
+		Type.Literal("secret-pattern"),
+		Type.Literal("env-value"),
+		Type.Literal("private-key"),
+		Type.Literal("sensitive-path"),
+		Type.Literal("size")
+	]),
+	detector: Type.String(),
+	sha256: Type.Optional(Sha256)
+}, { additionalProperties: false });
+//#endregion
+//#region ../../packages/base/src/usage.ts
+const count$5 = () => Type.Integer({ minimum: 0 });
+const TokenUsage = Type.Object({
+	input: count$5(),
+	output: count$5(),
+	cacheRead: count$5(),
+	cacheWrite: count$5(),
+	total: count$5()
+}, { additionalProperties: false });
+const QuotaWindow = Type.Object({
+	name: Type.String(),
+	usedPercent: Type.Optional(Type.Number({ minimum: 0 })),
+	resetsAt: Type.Optional(IsoInstant),
+	limitLabel: Type.Optional(Type.String())
+}, { additionalProperties: false });
+const QuotaInfo = Type.Union([Type.Object({ known: Type.Literal(false) }, { additionalProperties: false }), Type.Object({
+	known: Type.Literal(true),
+	source: Type.Union([Type.Literal("response-headers"), Type.Literal("error")]),
+	provider: Type.String(),
+	windows: Type.Array(QuotaWindow),
+	observedAt: IsoInstant
+}, { additionalProperties: false })]);
+Type.Object({
+	tokens: Type.Optional(count$5()),
+	modelRequests: Type.Optional(count$5()),
+	toolCalls: Type.Optional(count$5()),
+	wallClockMs: Type.Optional(Type.Number({ minimum: 0 })),
+	retries: Type.Optional(count$5()),
+	fixRounds: Type.Optional(count$5()),
+	contextTokens: Type.Optional(count$5()),
+	concurrentAgents: Type.Optional(count$5()),
+	estimatedQuotaPercent: Type.Optional(Type.Number({ minimum: 0 }))
+}, { additionalProperties: false });
+//#endregion
+//#region ../../packages/runtime-contract/src/capabilities.ts
+const strict$6 = { additionalProperties: false };
+const Cap = Type.Union([
+	Type.Object({ value: Type.Literal("yes") }, strict$6),
+	Type.Object({
+		value: Type.Literal("no"),
+		why: Type.String()
+	}, strict$6),
+	Type.Object({
+		value: Type.Literal("partial"),
+		why: Type.String()
+	}, strict$6)
+]);
+Type.Object({
+	contractVersion: Type.Literal("1"),
+	/** the only legal value (C1); present so conformance can assert it */
+	toolExecution: Type.Literal("host-delegated"),
+	streaming: Cap,
+	thinkingStream: Cap,
+	send: Type.Object({
+		steer: Cap,
+		followUp: Cap
+	}, strict$6),
+	cancelCooperative: Cap,
+	cancelHard: Cap,
+	pause: Type.Object({
+		toolBoundary: Cap,
+		modelBoundary: Cap
+	}, strict$6),
+	continuationFromTranscript: Cap,
+	processIsolation: Cap,
+	envFiltering: Cap,
+	brainSandbox: Cap,
+	resourceLimits: Cap,
+	budgetEnforcement: Type.Object({
+		turns: Cap,
+		modelRequests: Cap,
+		tokens: Cap,
+		context: Cap,
+		wallClock: Cap,
+		outputTokensPerRequest: Cap
+	}, strict$6),
+	/** 'no' = none possible (compaction and engine retries off) */
+	hiddenModelCalls: Cap,
+	usageReporting: Cap,
+	effectiveModelReporting: Cap,
+	quotaReporting: Cap,
+	authStatusWithoutSecret: Cap,
+	subscriptionModeAssertion: Cap,
+	systemPromptExact: Cap,
+	runtimePinning: Cap,
+	platforms: Type.Object({
+		darwin: Cap,
+		linux: Cap,
+		win32: Cap
+	}, strict$6),
+	hints: Type.Object({
+		memoryPerAgentMb: Type.Number({ minimum: 0 }),
+		coldStartMs: Type.Number({ minimum: 0 }),
+		maxConcurrentAgents: Type.Integer({ minimum: 1 })
+	}, strict$6)
+}, strict$6);
+//#endregion
+//#region ../../packages/runtime-contract/src/session.ts
+const strict$5 = { additionalProperties: false };
+const count$4 = () => Type.Integer({ minimum: 0 });
+const jsonMap = () => Type.Unsafe(Type.Record(Type.String(), JsonValueSchema));
+/** `format` is a label, e.g. 'jsonl-v3' | 'fake-ndjson-v1' — never interpreted by core */
+const TranscriptRef = Type.Object({
+	path: Type.String(),
+	format: Type.String()
+}, strict$5);
+/** R8: opaque to clients */
+const RuntimeSessionRef = Type.Object({
+	runtime: Type.String(),
+	engineVersion: Type.String(),
+	sessionId: Type.String(),
+	transcript: TranscriptRef
+}, strict$5);
+const UsageTotals = Type.Object({
+	tokens: TokenUsage,
+	modelRequests: count$4(),
+	toolCalls: count$4(),
+	turns: count$4(),
+	wallClockMs: Type.Number({ minimum: 0 })
+}, strict$5);
+const EffectiveModel = Type.Object({
+	provider: Type.String(),
+	model: Type.String(),
+	api: Type.Optional(Type.String()),
+	baseUrl: Type.Optional(Type.String())
+}, strict$5);
+/** The ADAPTER's typed cause, recorded by the host BEFORE it acts. The engine's own stop reason is never a discriminator [X]. */
+const AgentStopCause = Type.Union([
+	Type.Literal("host-terminated"),
+	Type.Literal("model-stop"),
+	Type.Literal("output-truncated"),
+	Type.Literal("budget"),
+	Type.Literal("cancelled"),
+	Type.Literal("engine-error"),
+	Type.Literal("process-exit")
+]);
+const AgentExit = Type.Object({
+	outcome: Type.Union([
+		Type.Literal("completed"),
+		Type.Literal("failed"),
+		Type.Literal("cancelled"),
+		Type.Literal("crashed")
+	]),
+	stop: AgentStopCause,
+	error: Type.Optional(ErrorInfo),
+	usage: UsageTotals,
+	lastSeq: count$4()
+}, strict$5);
+const delivery$2 = () => Type.Union([Type.Literal("steer"), Type.Literal("follow-up")]);
+Type.Union([Type.Object({
+	kind: Type.Literal("user"),
+	messageId: Type.String(),
+	text: Type.String(),
+	delivery: delivery$2()
+}, strict$5), Type.Object({
+	kind: Type.Literal("host-note"),
+	messageId: Type.String(),
+	text: Type.String(),
+	delivery: delivery$2()
+}, strict$5)]);
+Type.Object({
+	runId: RunId,
+	agentId: AgentId,
+	incarnation: Type.Integer({ minimum: 1 }),
+	state: Type.Union([
+		Type.Literal("starting"),
+		Type.Literal("running"),
+		Type.Literal("awaiting-tool"),
+		Type.Literal("paused"),
+		Type.Literal("settling"),
+		Type.Literal("exited")
+	]),
+	pausedAt: Type.Optional(Type.Union([Type.Literal("tool-boundary"), Type.Literal("model-boundary")])),
+	turn: count$4(),
+	pendingToolCalls: Type.Array(ToolCallId),
+	requestedModel: ModelRef,
+	effectiveModel: Type.Optional(EffectiveModel),
+	authMode: Type.Optional(AuthMode),
+	usage: UsageTotals,
+	contextTokens: Type.Optional(count$4()),
+	contextWindow: Type.Optional(count$4()),
+	session: RuntimeSessionRef,
+	lastSeq: count$4(),
+	/** pid, rssMb, lastHeartbeatAt, engine flags… never secrets */
+	diagnostics: jsonMap()
+}, strict$5);
+//#endregion
+//#region ../../packages/runtime-contract/src/tools.ts
+const strict$4 = { additionalProperties: false };
+const RuntimeToolCall = Type.Object({
+	runId: RunId,
+	agentId: AgentId,
+	incarnation: Type.Integer({ minimum: 1 }),
+	/** tc_<incarnation>_<ordinal> */
+	toolCallId: ToolCallId,
+	/** the engine's own id, transcript correlation only */
+	engineToolCallId: Type.Optional(Type.String()),
+	/** 1-based, per incarnation, gapless */
+	ordinal: Type.Integer({ minimum: 1 }),
+	tool: Type.String(),
+	/** as produced by the model after engine-side coercion; the host re-validates strictly */
+	input: JsonValueSchema
+}, strict$4);
+const ToolProgress = Type.Object({
+	text: Type.Optional(Type.String()),
+	bytes: Type.Optional(Type.Integer({ minimum: 0 }))
+}, strict$4);
+const ToolContent = Type.Union([Type.Object({
+	type: Type.Literal("text"),
+	text: Type.Unsafe(Type.String())
+}, strict$4), Type.Object({
+	type: Type.Literal("image"),
+	mediaType: Type.String(),
+	dataBase64: Type.String()
+}, strict$4)]);
+Type.Object({
+	isError: Type.Boolean(),
+	content: Type.Array(ToolContent),
+	/** host asks the runtime to end the agent loop after this batch */
+	terminate: Type.Optional(Type.Boolean()),
+	/** opaque audit id, stored in the transcript */
+	resultRef: Type.Optional(Type.String())
+}, strict$4);
+const TOOL_NAME_PATTERN = "^[a-z][a-z0-9_]{1,40}$";
+/** JSON Schema 2020-12, ONE flat top-level object: no $ref/$defs/oneOf at root (provider flattening). */
+const ToolInputSchema = Type.Unsafe(Type.Object({
+	type: Type.Literal("object"),
+	properties: Type.Optional(Type.Record(Type.String(), JsonValueSchema))
+}, {
+	additionalProperties: true,
+	not: { anyOf: [
+		"$ref",
+		"$defs",
+		"definitions",
+		"oneOf",
+		"anyOf",
+		"allOf"
+	].map((key) => ({ required: [key] })) }
+}));
+/** What the BRAIN needs to know. No paths, no commands: what a call may touch is decided host-side. */
+const ToolGrant = Type.Object({
+	/** TOOL_NAME_PATTERN; never differs only by case from another grant (see toolGrantProblems) */
+	tool: Type.String({ pattern: TOOL_NAME_PATTERN }),
+	description: Type.String(),
+	inputSchema: ToolInputSchema,
+	/** ordering hint only */
+	effect: Type.Union([
+		Type.Literal("read"),
+		Type.Literal("write"),
+		Type.Literal("execute"),
+		Type.Literal("network"),
+		Type.Literal("control")
+	]),
+	/** true for the result tool */
+	terminal: Type.Boolean()
+}, strict$4);
+//#endregion
+//#region ../../packages/runtime-contract/src/events.ts
+const strict$3 = { additionalProperties: false };
+const count$3 = () => Type.Integer({ minimum: 0 });
+const boundary = () => Type.Union([Type.Literal("tool-boundary"), Type.Literal("model-boundary")]);
+const delivery$1 = () => Type.Union([Type.Literal("steer"), Type.Literal("follow-up")]);
+const messageRole = () => Type.Union([
+	Type.Literal("assistant"),
+	Type.Literal("user"),
+	Type.Literal("tool-result")
+]);
+/**
+* A CLOSED five-value set on this frontier: an adapter maps any other engine stop reason (Pi 0.85.1 also has
+* 'pending' and 'deferred') to 'error' and emits runtime.warning{code: ENGINE_STOP_REASON_UNMAPPED}.
+*/
+const ModelStop = Type.Union([
+	Type.Literal("stop"),
+	Type.Literal("length"),
+	Type.Literal("tool-use"),
+	Type.Literal("error"),
+	Type.Literal("aborted")
+]);
+const IsolationReport = Type.Object({
+	level: Type.Union([
+		Type.Literal("os"),
+		Type.Literal("process"),
+		Type.Literal("none")
+	]),
+	filesystem: Type.Union([Type.Literal("enforced"), Type.Literal("advisory")]),
+	network: Type.Union([
+		Type.Literal("enforced"),
+		Type.Literal("partial"),
+		Type.Literal("none")
+	]),
+	backend: Type.String()
+}, strict$3);
+const durable = (data) => ({
+	durability: "durable",
+	data
+});
+const ephemeral = (data) => ({
+	durability: "ephemeral",
+	data
+});
+/**
+* One row per event type: its durability and the schema of `data`. EVERY durable type has a named target in the
+* protocol catalogue, or an explicit "not forwarded" rule (DESIGN 2.3.3). `authSource: 'none'` exists only for
+* runtimes that hold no credential (the fake); a fake run reports the authMode its plan requested.
+*/
+const RUNTIME_EVENT_TYPES = {
+	"agent.spawned": durable(Type.Object({
+		session: RuntimeSessionRef,
+		requestedModel: ModelRef,
+		tools: Type.Array(Type.String()),
+		systemPromptSha256: Sha256,
+		effectiveSystemPromptSha256: Sha256,
+		isolation: IsolationReport
+	}, strict$3)),
+	"agent.started": durable(Type.Object({ taskSha256: Sha256 }, strict$3)),
+	"agent.turn.started": ephemeral(Type.Object({ turn: count$3() }, strict$3)),
+	"agent.turn.completed": durable(Type.Object({
+		turn: count$3(),
+		toolCalls: count$3()
+	}, strict$3)),
+	"agent.message.started": ephemeral(Type.Object({
+		messageId: Type.String(),
+		role: messageRole()
+	}, strict$3)),
+	"agent.message.delta": ephemeral(Type.Object({
+		messageId: Type.String(),
+		channel: Type.Union([
+			Type.Literal("text"),
+			Type.Literal("thinking"),
+			Type.Literal("tool-input")
+		]),
+		contentIndex: count$3(),
+		delta: Type.String()
+	}, strict$3)),
+	"agent.message.completed": durable(Type.Object({
+		messageId: Type.String(),
+		role: messageRole(),
+		textSha256: Sha256,
+		textBytes: count$3(),
+		preview: Type.String({ maxLength: 512 }),
+		stop: Type.Optional(ModelStop)
+	}, strict$3)),
+	"model.requested": durable(Type.Object({
+		requestId: Type.String(),
+		model: ModelRef,
+		contextSha256: Type.Optional(Sha256),
+		contextTokensEstimate: Type.Optional(count$3()),
+		attempt: Type.Integer({ minimum: 1 })
+	}, strict$3)),
+	"model.responded": durable(Type.Object({
+		requestId: Type.String(),
+		requestedModel: ModelRef,
+		effectiveModel: EffectiveModel,
+		authMode: AuthMode,
+		authSource: Type.Union([
+			Type.Literal("oauth"),
+			Type.Literal("api-key"),
+			Type.Literal("none")
+		]),
+		durationMs: Type.Number({ minimum: 0 }),
+		usage: TokenUsage,
+		httpStatus: Type.Optional(Type.Integer()),
+		attempt: Type.Integer({ minimum: 1 }),
+		stop: ModelStop,
+		quota: QuotaInfo,
+		error: Type.Optional(ErrorInfo)
+	}, strict$3)),
+	"tool.call.requested": durable(Type.Object({ call: RuntimeToolCall }, strict$3)),
+	"tool.call.rejected": durable(Type.Object({
+		engineToolCallId: Type.Optional(Type.String()),
+		tool: Type.String(),
+		cause: Type.Union([
+			Type.Literal("unknown-tool"),
+			Type.Literal("invalid-input"),
+			Type.Literal("output-truncated")
+		]),
+		message: Type.String()
+	}, strict$3)),
+	"tool.call.progress": ephemeral(Type.Object({
+		toolCallId: ToolCallId,
+		update: ToolProgress
+	}, strict$3)),
+	"tool.call.delivered": durable(Type.Object({
+		toolCallId: ToolCallId,
+		isError: Type.Boolean(),
+		terminate: Type.Boolean(),
+		waitedMs: Type.Number({ minimum: 0 })
+	}, strict$3)),
+	"agent.paused": durable(Type.Object({ at: boundary() }, strict$3)),
+	"agent.resumed": durable(Type.Unsafe(Type.Object({}, strict$3))),
+	"agent.message.accepted": durable(Type.Object({
+		messageId: Type.String(),
+		delivery: delivery$1()
+	}, strict$3)),
+	"agent.exited": durable(AgentExit),
+	"runtime.warning": durable(Type.Object({
+		code: Type.String(),
+		message: Type.String()
+	}, strict$3))
+};
+const RUNTIME_EVENT_TYPE_NAMES = Object.freeze(Object.keys(RUNTIME_EVENT_TYPES));
+const envelope = {
+	runId: RunId,
+	agentId: AgentId,
+	incarnation: Type.Integer({ minimum: 1 }),
+	seq: count$3(),
+	at: IsoInstant
+};
+Type.Unsafe(Type.Union(RUNTIME_EVENT_TYPE_NAMES.map((type) => {
+	const row = RUNTIME_EVENT_TYPES[type];
+	return Type.Object({
+		type: Type.Literal(type),
+		durability: Type.Literal(row.durability),
+		...envelope,
+		data: row.data
+	}, strict$3);
+})));
+//#endregion
+//#region ../../packages/runtime-contract/src/pin.ts
+const strict$2 = { additionalProperties: false };
+const count$2 = () => Type.Integer({ minimum: 0 });
+Type.Object({
+	runtimeId: Type.String(),
+	adapterVersion: Type.String(),
+	engine: Type.Union([Type.Object({
+		name: Type.String(),
+		version: Type.String()
+	}, strict$2), Type.Null()]),
+	node: Type.Object({
+		version: Type.String(),
+		execPath: Type.String()
+	}, strict$2),
+	artifacts: Type.Array(Type.Object({
+		role: Type.Union([
+			Type.Literal("agent-host-bundle"),
+			Type.Literal("engine-package-tree"),
+			Type.Literal("install-lock")
+		]),
+		path: Type.String(),
+		sha256: Sha256,
+		files: Type.Optional(count$2()),
+		bytes: count$2()
+	}, strict$2)),
+	/** sha256(canonicalJson(all of the above)) */
+	digest: Sha256
+}, strict$2);
+/** never contains a token, a refresh token or an account secret */
+const ProviderAuthStatus = Type.Object({
+	provider: Type.String(),
+	/** 'unknown-transient' = credential store locked: NEVER mapped to AUTH_REQUIRED */
+	state: Type.Union([
+		Type.Literal("oauth"),
+		Type.Literal("api-key"),
+		Type.Literal("absent"),
+		Type.Literal("unknown-transient")
+	]),
+	subscription: Type.Boolean(),
+	source: Type.Optional(Type.String()),
+	checkedAt: IsoInstant,
+	/** non-secret account/tenant label WHEN the engine exposes one without a secret; absent otherwise */
+	accountLabel: Type.Optional(Type.String()),
+	/** Cohorte's own table, not the engine's subscription flag (§3.7) */
+	billing: Type.Union([
+		Type.Literal("plan-limits"),
+		Type.Literal("metered"),
+		Type.Literal("unknown")
+	]),
+	caveat: Type.Optional(Type.String())
+}, strict$2);
+//#endregion
+//#region ../../packages/runtime-contract/src/spawn.ts
+const strict$1 = { additionalProperties: false };
+const count$1 = () => Type.Integer({ minimum: 0 });
+const limit = () => Type.Optional(Type.Integer({ minimum: 1 }));
+const ceiling = () => Type.Optional(count$1());
+const stringMap$1 = () => Type.Unsafe(Type.Record(Type.String(), Type.String()));
+/** opaque label; the runtime MUST NOT branch on it */
+const AgentRole = Type.String();
+const AuthRequirement = Type.Object({
+	mode: AuthMode,
+	provider: Type.String(),
+	/** pinned catalogue endpoint; a runtime that would talk to anything else MUST refuse to spawn */
+	baseUrl: Type.String(),
+	/** false unless the run plan carries an explicit api opt-in */
+	allowApiKey: Type.Boolean()
+}, strict$1);
+/** rendered by the host into the run snapshot dir */
+const TaskInput = Type.Object({
+	path: Type.String(),
+	sha256: Sha256,
+	bytes: count$1()
+}, strict$1);
+/** The fixed line that precedes `Continuation.note` when the engine cannot carry two user messages in one prompt. */
+const CONTINUATION_NOTE_SEPARATOR = "\n\n[cohorte] continuation note\n\n";
+/**
+* `note` is delivered by the runtime AFTER `task` and BEFORE the first model request: as a second user message when
+* the engine can carry two in one prompt, otherwise appended to the first user message after
+* CONTINUATION_NOTE_SEPARATOR. Either way each text is a byte-identical contiguous span and `task` comes first
+* (conformance rule 12).
+*/
+const Continuation = Type.Object({
+	fromIncarnation: Type.Integer({ minimum: 1 }),
+	note: TaskInput,
+	/** used only if continuationFromTranscript = yes */
+	transcript: Type.Optional(TranscriptRef)
+}, strict$1);
+/** runtime MUST verify sha256 before use */
+const PromptRef = Type.Object({
+	id: Type.String(),
+	path: Type.String(),
+	sha256: Sha256,
+	bytes: count$1()
+}, strict$1);
+const ContextEntry = Type.Object({
+	id: Type.String(),
+	tier: Type.Union([
+		Type.Literal("system"),
+		Type.Literal("doctrine"),
+		Type.Literal("data"),
+		Type.Literal("task"),
+		Type.Literal("prior-results")
+	]),
+	/** agent-output and untrusted-repository can never sit above 'data' */
+	trust: Type.Union([
+		Type.Literal("cohorte"),
+		Type.Literal("human"),
+		Type.Literal("untrusted-repository"),
+		Type.Literal("agent-output")
+	]),
+	source: Type.Object({
+		kind: Type.Union([
+			Type.Literal("asset"),
+			Type.Literal("project-file"),
+			Type.Literal("artifact"),
+			Type.Literal("event-summary"),
+			Type.Literal("inline")
+		]),
+		ref: Type.String()
+	}, strict$1),
+	sha256: Sha256,
+	bytes: count$1(),
+	tokenEstimate: count$1()
+}, strict$1);
+/**
+* PROVENANCE ONLY. "Installer le contexte" (spec 5.2) is defined as: every byte the model sees is in exactly two
+* host-rendered files — `systemPrompt` (tiers `system` + `doctrine`) and `task` (tiers `data` + `task` +
+* `prior-results`) — plus, for a later incarnation, `continuation.note`. A runtime installs those three and NOTHING
+* else: it never opens `entries[].source`, never re-orders or re-renders tiers. The manifest travels so that the
+* runtime can record `manifestSha256` on `model.requested` and so that a second runtime has nothing to guess.
+* Tiers are trust/priority tiers (spec 7), not orchestration words.
+*/
+const ContextManifest = Type.Object({
+	/** sha256(canonicalJson(entries)) = "hash du contexte" of spec 19 */
+	manifestSha256: Sha256,
+	tokenLimit: count$1(),
+	tokenEstimate: count$1(),
+	/** deterministic order: tier, then id */
+	entries: Type.Array(ContextEntry),
+	reductions: Type.Array(Type.Object({
+		entryId: Type.String(),
+		strategy: Type.Union([
+			Type.Literal("excerpt"),
+			Type.Literal("outline"),
+			Type.Literal("summary-with-refs"),
+			Type.Literal("dropped")
+		]),
+		fromBytes: count$1(),
+		toBytes: count$1()
+	}, strict$1)),
+	exclusions: Type.Array(Type.Object({
+		pattern: Type.String(),
+		reason: Type.Union([
+			Type.Literal("secret"),
+			Type.Literal("outside-scope"),
+			Type.Literal("size"),
+			Type.Literal("binary")
+		])
+	}, strict$1))
+}, strict$1);
+/** Isolation of the RUNTIME'S OWN agent process (the brain). Tool isolation is host-side. */
+const SandboxPolicy = Type.Object({
+	/** spawn fails security/sandbox-unavailable below `os` */
+	require: Type.Union([
+		Type.Literal("os"),
+		Type.Literal("os-if-available"),
+		Type.Literal("process")
+	]),
+	/** absolute canonical roots */
+	filesystem: Type.Object({
+		readOnly: Type.Array(Type.String()),
+		readWrite: Type.Array(Type.String()),
+		denyRead: Type.Array(Type.String())
+	}, strict$1),
+	network: Type.Object({
+		mode: Type.Union([
+			Type.Literal("none"),
+			Type.Literal("provider-only"),
+			Type.Literal("unrestricted")
+		]),
+		allowHosts: Type.Array(Type.String())
+	}, strict$1),
+	/** allowlist; nothing else is inherited (D3) */
+	env: Type.Object({
+		allow: Type.Array(Type.String()),
+		set: stringMap$1()
+	}, strict$1),
+	limits: Type.Object({
+		maxOldSpaceMb: limit(),
+		maxCpuSeconds: limit(),
+		maxOpenFiles: limit()
+	}, strict$1)
+}, strict$1);
+/** hard ceilings for ONE incarnation; absent = unlimited at this level */
+const Budget = Type.Object({
+	maxTurns: ceiling(),
+	maxModelRequests: ceiling(),
+	maxToolCalls: ceiling(),
+	maxInputTokens: ceiling(),
+	maxOutputTokens: ceiling(),
+	maxTotalTokens: ceiling(),
+	/** stop (never auto-compact) when the last request's context exceeds this */
+	maxContextTokens: ceiling(),
+	maxWallClockMs: ceiling(),
+	maxModelRequestMs: ceiling(),
+	/** 0 = every retry is the host's (spec 11.3 "tous les retries sont visibles") */
+	maxEngineRetries: count$1()
+}, strict$1);
+const SpawnRequest = Type.Object({
+	runId: RunId,
+	agentId: AgentId,
+	role: AgentRole,
+	model: ModelRef,
+	systemPrompt: PromptRef,
+	context: ContextManifest,
+	tools: Type.Array(ToolGrant),
+	sandbox: SandboxPolicy,
+	budget: Budget,
+	/** absolute, canonical; the path the MODEL is told about. The engine process MUST NOT use it as its cwd */
+	workingDirectory: Type.String(),
+	/** spec 6: spawn is idempotent on (runId, agentId, incarnation) */
+	incarnation: Type.Integer({ minimum: 1 }),
+	thinking: ThinkingLevel,
+	/** spec 10.1 / D3 */
+	auth: AuthRequirement,
+	/** the first user message, by reference */
+	task: TaskInput,
+	/** a later incarnation of the same attempt */
+	continuation: Type.Union([Continuation, Type.Null()])
+}, strict$1);
+//#endregion
+//#region ../../packages/runtime-pi/src/protocol.ts
+const strict = { additionalProperties: false };
+const count = () => Type.Integer({ minimum: 0 });
+const stringMap = () => Type.Unsafe(Type.Record(Type.String(), Type.String()));
+const delivery = () => Type.Union([Type.Literal("steer"), Type.Literal("follow-up")]);
+/**
+* The spawn request as it crosses the channel. Every member of `SpawnRequest` is JSON already and the child reads
+* the prompt by reference (`readVerified(req.systemPrompt)`, DESIGN 3.4), so the wire shape IS the contract shape.
+*/
+const SpawnRequestWire = SpawnRequest;
+const EngineSettings = Type.Object({
+	authPath: Type.String(),
+	agentDir: Type.String(),
+	sessionFile: Type.String(),
+	loadFrom: Type.Union([Type.Literal("package"), Type.Literal("bundle")]),
+	expectedEngineVersion: Type.String(),
+	responseHeaderAllowlist: Type.Array(Type.String())
+}, strict);
+const AuthEngineSettings = Type.Object({
+	authPath: Type.String(),
+	agentDir: Type.String()
+}, strict);
+/**
+* What the child extracts from a thrown value or an error message, so that the classifier is a PURE, engine-free
+* function in the parent (DESIGN 3.8). Only child code looks at engine classes.
+*/
+const ErrorSignal = Type.Object({
+	/** the engine's own error code */
+	modelsErrorCode: Type.Optional(Type.String()),
+	/** errno-style code of the innermost cause: ELOCKED, EPERM, EACCES, EBUSY, ECONNRESET, ABORT_ERR… */
+	causeCode: Type.Optional(Type.String()),
+	httpStatus: Type.Optional(Type.Integer()),
+	/** sealed by the parent before it goes anywhere */
+	text: Type.String(),
+	origin: Type.Union([
+		Type.Literal("prompt-preflight"),
+		Type.Literal("model-response"),
+		Type.Literal("auth-check"),
+		Type.Literal("login"),
+		Type.Literal("engine")
+	])
+}, strict);
+const attestationShape = {
+	/** the engine's packages MUST all be at the same version */
+	engine: Type.Object({
+		name: Type.String(),
+		version: Type.String(),
+		packageVersions: stringMap()
+	}, strict),
+	/** MUST equal the grant exactly, and so must the registry (allowlist typos vanish silently in the engine) */
+	activeTools: Type.Array(Type.String()),
+	/** sha256 of the system prompt the engine really holds: Cohorte's prompt + the engine's own suffix */
+	effectiveSystemPromptSha256: Sha256,
+	systemPromptPrefixOk: Type.Boolean(),
+	/** from the engine's model runtime, no secret (DESIGN 3.7) */
+	auth: Type.Object({
+		provider: Type.String(),
+		type: Type.Union([Type.Literal("oauth"), Type.Literal("api_key")]),
+		source: Type.String(),
+		subscription: Type.Boolean()
+	}, strict),
+	/** MUST equal AuthRequirement.baseUrl / the requested model */
+	effective: Type.Object({
+		provider: Type.String(),
+		model: Type.String(),
+		api: Type.String(),
+		baseUrl: Type.String()
+	}, strict),
+	hooks: Type.Object({
+		streamWrapperInstalled: Type.Boolean(),
+		guardFetchInstalled: Type.Boolean(),
+		onResponseChained: Type.Boolean(),
+		shouldStopAfterTurn: Type.Boolean()
+	}, strict),
+	sessionFile: Type.String(),
+	sessionId: Type.String({ minLength: 1 }),
+	/** NAMES of env vars visible to the child; checked against allow ∪ OS_INJECTED_ENV[platform] */
+	envKeys: Type.Array(Type.String()),
+	platform: Type.String()
+};
+Type.Object({
+	...attestationShape,
+	hostProtocol: Type.Literal(1),
+	extensionsLoaded: Type.Literal(0),
+	extensionErrors: Type.Literal(0),
+	modelFallback: Type.Literal(false),
+	settings: Type.Object({
+		compaction: Type.Literal(false),
+		agentRetry: Type.Literal(false),
+		providerMaxRetries: Type.Literal(0),
+		transport: Type.Literal("sse")
+	}, strict)
+}, strict);
+/**
+* What a `ready` frame CARRIES: an Attestation whose fixed members are not fixed yet. A child that fell back to
+* another model says `modelFallback: true`; were the frame schema to refuse that, the spawn would fail as a schema
+* violation at a JSON pointer. It fails instead on what `diffAttestation` names. Every Attestation is a claim.
+*/
+const AttestationClaim = Type.Object({
+	...attestationShape,
+	hostProtocol: Type.Integer(),
+	extensionsLoaded: count(),
+	extensionErrors: count(),
+	modelFallback: Type.Boolean(),
+	settings: Type.Object({
+		compaction: Type.Boolean(),
+		agentRetry: Type.Boolean(),
+		providerMaxRetries: count(),
+		transport: Type.String()
+	}, strict)
+}, strict);
+const HostEvent = Type.Unsafe(Type.Union(RUNTIME_EVENT_TYPE_NAMES.map((type) => Type.Object({
+	type: Type.Literal(type),
+	at: IsoInstant,
+	data: RUNTIME_EVENT_TYPES[type].data
+}, strict))));
+const frame = (t, members) => Type.Object({
+	t: Type.Literal(t),
+	...members
+}, strict);
+const init = (mode, members) => frame("init", {
+	v: Type.Literal(1),
+	nonce: Type.String({ minLength: 1 }),
+	mode: Type.Literal(mode),
+	...members
+});
+/** parent -> child */
+const ParentFrame = Type.Union([
+	init("agent", {
+		request: SpawnRequestWire,
+		engine: EngineSettings
+	}),
+	init("auth-status", {
+		providers: Type.Array(Type.String()),
+		engine: AuthEngineSettings
+	}),
+	init("auth-login", {
+		provider: Type.String(),
+		engine: AuthEngineSettings
+	}),
+	init("auth-logout", {
+		provider: Type.String(),
+		engine: AuthEngineSettings
+	}),
+	frame("prompt", {
+		id: Type.String(),
+		text: Type.String(),
+		note: Type.Optional(Type.Object({ text: Type.String() }, strict))
+	}),
+	frame("send", {
+		id: Type.String(),
+		messageId: Type.String(),
+		text: Type.String(),
+		delivery: delivery()
+	}),
+	frame("tool.result", {
+		toolCallId: Type.String(),
+		isError: Type.Boolean(),
+		content: Type.Array(ToolContent),
+		terminate: Type.Boolean(),
+		resultRef: Type.Optional(Type.String())
+	}),
+	frame("pause", {}),
+	frame("resume", {}),
+	frame("stop-after-turn", { reason: Type.String() }),
+	frame("abort", {
+		id: Type.String(),
+		reason: Type.String()
+	}),
+	frame("auth.answer", {
+		id: Type.String(),
+		value: Type.String()
+	}),
+	frame("inspect", { id: Type.String() }),
+	frame("shutdown", {})
+]);
+/** child -> parent. All of it is untrusted input: validated here, sealed by the parent, tool input re-validated by the host. */
+const ChildFrame = Type.Union([
+	frame("hello", {
+		v: Type.Literal(1),
+		pid: Type.Integer({ minimum: 1 }),
+		nonce: Type.String({ minLength: 1 })
+	}),
+	frame("ready", { attestation: AttestationClaim }),
+	frame("event", {
+		seq: count(),
+		event: HostEvent
+	}),
+	frame("tool.call", {
+		seq: count(),
+		ordinal: Type.Integer({ minimum: 1 }),
+		engineToolCallId: Type.String(),
+		tool: Type.String(),
+		input: JsonValueSchema
+	}),
+	frame("tool.call.abandoned", {
+		engineToolCallId: Type.String(),
+		reason: Type.Union([Type.Literal("aborted"), Type.Literal("shutdown")])
+	}),
+	frame("provider.response", {
+		requestId: Type.String(),
+		status: Type.Integer(),
+		headers: stringMap()
+	}),
+	frame("provider.request", {
+		requestId: Type.String(),
+		origin: Type.String(),
+		authScheme: Type.Union([
+			Type.Literal("bearer-jwt"),
+			Type.Literal("bearer-opaque"),
+			Type.Literal("api-key-header"),
+			Type.Literal("none")
+		]),
+		refused: Type.Boolean()
+	}),
+	frame("parked", { at: Type.Literal("model-boundary") }),
+	frame("heartbeat", {
+		rssMb: Type.Number({ minimum: 0 }),
+		state: Type.String()
+	}),
+	frame("auth.status", { statuses: Type.Array(ProviderAuthStatus) }),
+	frame("auth.show", { event: JsonValueSchema }),
+	frame("auth.ask", {
+		id: Type.String(),
+		prompt: JsonValueSchema
+	}),
+	frame("auth.done", { status: ProviderAuthStatus }),
+	frame("settled", {
+		exit: Type.Omit(AgentExit, ["error"], strict),
+		signal: Type.Optional(ErrorSignal)
+	}),
+	frame("response", {
+		id: Type.String(),
+		ok: Type.Boolean(),
+		data: Type.Optional(JsonValueSchema),
+		error: Type.Optional(ErrorInfo)
+	}),
+	frame("fatal", {
+		error: ErrorInfo,
+		signal: Type.Optional(ErrorSignal)
+	})
+]);
+function encodeFrame(frame, wire) {
+	return wire === "lf" ? `${JSON.stringify(frame)}\n` : frame;
+}
+const checksOf = (union) => {
+	const byTag = /* @__PURE__ */ new Map();
+	for (const variant of union.anyOf) {
+		const { t, mode } = variant.properties;
+		const tag = String(t.const);
+		const entry = {
+			mode: mode === void 0 ? void 0 : String(mode.const),
+			check: Compile(variant)
+		};
+		byTag.set(tag, [...byTag.get(tag) ?? [], entry]);
+	}
+	return byTag;
+};
+const CHECKS = {
+	parent: checksOf(ParentFrame),
+	child: checksOf(ChildFrame)
+};
+/** Total: whatever arrives, the answer is a frame or a rejection. It never throws and never echoes a value. */
+function decodeFrame(sender, raw, wire) {
+	let value = raw;
+	if (wire === "lf") {
+		if (typeof raw !== "string") return err({
+			reason: "not-a-frame",
+			detail: `expected a line of text, got ${typeof raw}`
+		});
+		if (raw.length > 16777216) return err({
+			reason: "too-large",
+			detail: `a line of ${raw.length} characters`
+		});
+		const line = raw.endsWith("\n") ? raw.slice(0, -1) : raw;
+		if (line.includes("\n")) return err({
+			reason: "not-a-frame",
+			detail: "more than one line"
+		});
+		try {
+			value = JSON.parse(line);
+		} catch {
+			return err({
+				reason: "not-json",
+				detail: "the line is not JSON"
+			});
+		}
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return err({
+		reason: "not-a-frame",
+		detail: "a frame is a JSON object"
+	});
+	try {
+		const tag = value.t;
+		const variants = typeof tag === "string" ? CHECKS[sender].get(tag) : void 0;
+		if (typeof tag !== "string" || variants === void 0) return err({
+			reason: "unknown-frame",
+			detail: `no ${sender} frame has that "t"`
+		});
+		const mode = value.mode;
+		const variant = variants.length === 1 ? variants[0] : variants.find((candidate) => candidate.mode === mode);
+		if (variant === void 0) return err({
+			reason: "schema-violation",
+			detail: `${tag}: /mode is not a mode of that frame`
+		});
+		if (variant.check.Check(value)) return ok(value);
+		const [first] = variant.check.Errors(value);
+		return err({
+			reason: "schema-violation",
+			detail: `${tag}: ${first?.instancePath || "/"} ${first?.message ?? "is invalid"}`
+		});
+	} catch {
+		return err({
+			reason: "not-a-frame",
+			detail: "the value could not be read"
+		});
+	}
+}
+Object.freeze({ darwin: Object.freeze(["__CF_USER_TEXT_ENCODING"]) });
+//#endregion
 //#region ../../packages/runtime-pi/src/child/entry.ts
 const PI_PACKAGES = [
 	"@earendil-works/pi-ai",
@@ -37,8 +1583,599 @@ async function main() {
 		process.stdout.write(`agent-host selftest ok, pi=${result.version}\n`);
 		return;
 	}
-	process.stderr.write("agent-host: only --selftest is implemented in V3.0 Wave 0 (the RPC child is U4.08)\n");
-	process.exitCode = 1;
+	await runHost();
+}
+function nonceArg() {
+	const value = process.argv.find((arg) => arg.startsWith("--cohorte-nonce="));
+	if (!value) throw new Error("agent-host: missing Cohorte nonce");
+	return value.slice(16);
+}
+function sendTransport() {
+	if (typeof process.send === "function") return {
+		send: (frame) => process.send?.(encodeFrame(frame, "ipc")),
+		on: (listener) => process.on("message", (raw) => {
+			const decoded = decodeFrame("parent", raw, "ipc");
+			if (decoded.ok) listener(decoded.value);
+		})
+	};
+	const input = createReadStream(null, { fd: 3 });
+	const output = createWriteStream(null, { fd: 4 });
+	let buffer = "";
+	return {
+		send: (frame) => output.write(encodeFrame(frame, "lf")),
+		on: (listener) => {
+			input.setEncoding("utf8");
+			input.on("data", (chunk) => {
+				buffer += chunk.toString();
+				for (let end = buffer.indexOf("\n"); end !== -1; end = buffer.indexOf("\n")) {
+					const line = buffer.slice(0, end);
+					buffer = buffer.slice(end + 1);
+					const decoded = decodeFrame("parent", line, "lf");
+					if (decoded.ok) listener(decoded.value);
+				}
+			});
+		}
+	};
+}
+const isoNow = () => (/* @__PURE__ */ new Date()).toISOString();
+function authStatus(runtime, provider) {
+	const status = runtime.getProviderAuthStatus(provider);
+	const configured = status.configured;
+	const oauth = configured && runtime.isUsingOAuth(provider);
+	const subscription = oauth && runtime.isUsingSubscription(provider);
+	return {
+		provider,
+		state: !configured ? "absent" : oauth ? "oauth" : "api-key",
+		subscription,
+		checkedAt: isoNow(),
+		...status.source || status.label ? { source: status.label ?? status.source } : {},
+		billing: subscription ? "plan-limits" : configured ? "metered" : "unknown"
+	};
+}
+function jsonEvent(event) {
+	if (event.type === "auth_url") return {
+		kind: "open-url",
+		url: event.url,
+		...event.instructions ? { instructions: event.instructions } : {}
+	};
+	if (event.type === "device_code") return {
+		kind: "device-code",
+		userCode: event.userCode,
+		verificationUri: event.verificationUri
+	};
+	return {
+		kind: event.type === "progress" ? "progress" : "info",
+		message: event.message
+	};
+}
+function jsonPrompt(prompt) {
+	if (prompt.type === "select") return {
+		kind: "select",
+		message: prompt.message,
+		options: prompt.options.map((item) => ({
+			id: item.id,
+			label: item.label
+		}))
+	};
+	return {
+		kind: prompt.type === "manual_code" ? "manual-code" : prompt.type === "text" ? "text" : "secret",
+		message: prompt.message
+	};
+}
+function signalOf(error, origin) {
+	const value = error;
+	const modelsErrorCode = error instanceof ModelsError ? error.code : typeof value.code === "string" ? value.code : void 0;
+	const status = typeof value.status === "number" ? value.status : typeof value.statusCode === "number" ? value.statusCode : void 0;
+	let cause = value.cause;
+	let causeCode;
+	for (let depth = 0; depth < 8 && cause !== void 0; depth += 1) {
+		const candidate = cause;
+		if (causeCode === void 0 && typeof candidate.code === "string") causeCode = candidate.code;
+		cause = candidate.cause;
+	}
+	const text = error instanceof Error ? error.message : typeof value.message === "string" ? value.message : String(error);
+	return {
+		...modelsErrorCode === void 0 ? {} : { modelsErrorCode },
+		...causeCode === void 0 ? {} : { causeCode },
+		...status === void 0 ? {} : { httpStatus: status },
+		text,
+		origin
+	};
+}
+async function runHost() {
+	const nonce = nonceArg();
+	const transport = sendTransport();
+	const send = (frame) => transport.send(frame);
+	send({
+		t: "hello",
+		v: 1,
+		pid: process.pid,
+		nonce
+	});
+	let runtime;
+	const answerWaiters = /* @__PURE__ */ new Map();
+	const toolWaiters = /* @__PURE__ */ new Map();
+	let agentListener;
+	const shutdownController = new AbortController();
+	transport.on((frame) => {
+		if (frame.t === "auth.answer") {
+			const waiter = answerWaiters.get(frame.id);
+			answerWaiters.delete(frame.id);
+			waiter?.(frame.value);
+		}
+		if (frame.t === "tool.result") toolWaiters.get(frame.toolCallId)?.(frame);
+		if (agentListener && frame.t !== "init" && frame.t !== "auth.answer" && frame.t !== "tool.result") {
+			agentListener(frame);
+			return;
+		}
+		if (frame.t === "shutdown") {
+			shutdownController.abort();
+			process.exitCode = 0;
+		}
+		if (frame.t === "init") handleInit(frame, send, (value) => {
+			runtime = value;
+		}, () => runtime, answerWaiters, toolWaiters, (listener) => {
+			agentListener = listener;
+		}, shutdownController.signal);
+	});
+}
+async function handleInit(frame, send, setRuntime, getRuntime, answerWaiters, toolWaiters, setAgentListener, shutdownSignal) {
+	try {
+		if (frame.mode === "agent") {
+			await runAgent(frame, send, toolWaiters, setAgentListener);
+			return;
+		}
+		const runtime = getRuntime() ?? await ModelRuntime.create({
+			authPath: frame.engine.authPath,
+			modelsPath: null,
+			allowModelNetwork: false,
+			refreshOnCreate: true
+		});
+		setRuntime(runtime);
+		if (frame.mode === "auth-status") {
+			send({
+				t: "auth.status",
+				statuses: frame.providers.map((provider) => authStatus(runtime, provider))
+			});
+			return;
+		}
+		if (frame.mode === "auth-logout") {
+			await runtime.logout(frame.provider);
+			send({
+				t: "auth.done",
+				status: authStatus(runtime, frame.provider)
+			});
+			return;
+		}
+		const provider = frame.provider;
+		const authType = runtime.getProvider(provider)?.auth.oauth ? "oauth" : "api_key";
+		await runtime.login(provider, authType, {
+			signal: shutdownSignal,
+			notify: (event) => send({
+				t: "auth.show",
+				event: jsonEvent(event)
+			}),
+			prompt: (prompt) => new Promise((resolve) => {
+				const id = `auth-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+				answerWaiters.set(id, resolve);
+				send({
+					t: "auth.ask",
+					id,
+					prompt: jsonPrompt(prompt)
+				});
+			})
+		});
+		send({
+			t: "auth.done",
+			status: authStatus(runtime, provider)
+		});
+	} catch (error) {
+		const origin = frame.mode === "agent" ? "auth-check" : frame.mode === "auth-login" ? "login" : "engine";
+		send({
+			t: "fatal",
+			error: errorOf("configuration/engine-init", error instanceof Error ? error.message : String(error)),
+			signal: signalOf(error, origin)
+		});
+	}
+}
+async function runAgent(frame, send, toolWaiters, setAgentListener) {
+	const { request, engine } = frame;
+	const promptBytes = readFileSync(request.systemPrompt.path);
+	if (promptBytes.byteLength !== request.systemPrompt.bytes || sha256Hex(promptBytes) !== request.systemPrompt.sha256) throw new Error("agent-host: system prompt asset verification failed");
+	const effectivePrompt = `${promptBytes.toString("utf8")}\nCurrent working directory: ${request.workingDirectory}\n`;
+	const runtime = await ModelRuntime.create({
+		authPath: engine.authPath,
+		modelsPath: null,
+		allowModelNetwork: false,
+		refreshOnCreate: true
+	});
+	const catalogModel = runtime.getModel(request.model.provider, request.model.model);
+	if (!catalogModel) throw new Error(`agent-host: model ${request.model.provider}/${request.model.model} is unavailable`);
+	const model = {
+		...catalogModel,
+		baseUrl: request.auth.baseUrl
+	};
+	await runtime.refresh({
+		providers: [request.model.provider],
+		allowNetwork: false,
+		signal: AbortSignal.timeout(15e3)
+	});
+	const liveAuth = await runtime.checkAuth(request.model.provider, { signal: AbortSignal.timeout(15e3) });
+	const credentials = await runtime.listCredentials({ signal: AbortSignal.timeout(15e3) });
+	const provider = runtime.getProvider(request.model.provider);
+	const storedOAuth = credentials.some((credential) => credential.providerId === request.model.provider && credential.type === "oauth");
+	const subscriptionAuth = liveAuth?.type === "oauth" && storedOAuth && provider?.auth.apiKey === void 0 && runtime.isUsingSubscription(request.model.provider);
+	const apiAuth = liveAuth?.type === "api_key" && request.auth.allowApiKey;
+	if (request.auth.mode === "subscription" ? !subscriptionAuth : !apiAuth) throw new Error(`agent-host: provider ${request.auth.provider} is not authenticated for the requested mode`);
+	const versions = selfTest().versions;
+	const oauth = liveAuth?.type === "oauth";
+	const subscription = subscriptionAuth;
+	const baseUrl = request.auth.baseUrl;
+	let sequence = 0;
+	let ordinal = 0;
+	let turn = 0;
+	let requestId = "";
+	let responseStatus;
+	let parked = false;
+	let heartbeatState = "running";
+	const usageTotals = {
+		input: 0,
+		output: 0,
+		cacheRead: 0,
+		cacheWrite: 0,
+		total: 0
+	};
+	const heartbeat = setInterval(() => {
+		send({
+			t: "heartbeat",
+			rssMb: process.memoryUsage().rss / 1024 / 1024,
+			state: heartbeatState
+		});
+	}, 1e3);
+	const originalFetch = globalThis.fetch;
+	if (!originalFetch) throw new Error("agent-host: fetch is unavailable");
+	const guardFetch = async (input, init) => {
+		const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
+		const pinned = new URL(request.auth.baseUrl);
+		const headers = new Headers(input instanceof Request ? input.headers : void 0);
+		new Headers(init?.headers).forEach((value, name) => {
+			headers.set(name, value);
+		});
+		const authorization = headers.get("authorization");
+		const authScheme = oauth ? authorization?.toLowerCase().startsWith("bearer ") ? "bearer-jwt" : "none" : headers.has("x-api-key") || headers.has("api-key") ? "api-key-header" : authorization?.toLowerCase().startsWith("bearer ") ? "bearer-opaque" : "none";
+		const refused = url.origin !== pinned.origin;
+		send({
+			t: "provider.request",
+			requestId,
+			origin: url.origin,
+			authScheme,
+			refused
+		});
+		if (refused) throw new Error("agent-host: provider request left the pinned origin");
+		return originalFetch(input, init);
+	};
+	const streamSimple = runtime.streamSimple.bind(runtime);
+	runtime.streamSimple = ((streamModel, context, options) => lazyStream(streamModel, async () => streamSimple(streamModel, context, {
+		...options,
+		fetch: guardFetch,
+		onResponse: async (response, responseModel) => {
+			responseStatus = response.status;
+			const allowed = Object.fromEntries([...Object.entries(response.headers)].filter(([name]) => engine.responseHeaderAllowlist.some((pattern) => {
+				const normalized = pattern.toLowerCase();
+				return normalized.endsWith("*") ? name.startsWith(normalized.slice(0, -1)) : name === normalized;
+			})));
+			send({
+				t: "provider.response",
+				requestId,
+				status: response.status,
+				headers: allowed
+			});
+			await options?.onResponse?.(response, responseModel);
+		}
+	})));
+	const sendEvent = (event) => send({
+		t: "event",
+		seq: sequence++,
+		event
+	});
+	const tools = request.tools.map((grant) => ({
+		name: grant.tool,
+		label: grant.tool,
+		description: grant.description,
+		executionMode: "sequential",
+		parameters: Type$1.Unsafe(grant.inputSchema),
+		execute: async (engineToolCallId, input, signal) => {
+			const ordinalForCall = ++ordinal;
+			const toolCallId = `tc_${request.incarnation}_${ordinalForCall}`;
+			const resultPromise = new Promise((resolve, reject) => {
+				toolWaiters.set(toolCallId, resolve);
+				signal?.addEventListener("abort", () => reject(/* @__PURE__ */ new Error("tool call aborted")), { once: true });
+			});
+			send({
+				t: "tool.call",
+				seq: sequence++,
+				ordinal: ordinalForCall,
+				engineToolCallId,
+				tool: grant.tool,
+				input
+			});
+			const result = await resultPromise;
+			toolWaiters.delete(toolCallId);
+			return {
+				content: result.content.map((content) => content.type === "text" ? {
+					type: "text",
+					text: content.text
+				} : {
+					type: "image",
+					data: content.dataBase64,
+					mimeType: content.mediaType
+				}),
+				details: {},
+				...result.terminate ? { terminate: true } : {}
+			};
+		}
+	}));
+	const settingsManager = SettingsManager.inMemory({
+		transport: "sse",
+		compaction: { enabled: false },
+		retry: { enabled: false },
+		defaultProjectTrust: "never"
+	}, { projectTrusted: false });
+	const resourceLoader = new DefaultResourceLoader({
+		cwd: request.workingDirectory,
+		agentDir: engine.agentDir,
+		settingsManager,
+		noExtensions: true,
+		noSkills: true,
+		noPromptTemplates: true,
+		noThemes: true,
+		noContextFiles: true,
+		systemPrompt: effectivePrompt
+	});
+	await resourceLoader.reload();
+	const { session } = await createAgentSession({
+		cwd: request.workingDirectory,
+		agentDir: engine.agentDir,
+		modelRuntime: runtime,
+		model,
+		thinkingLevel: request.thinking,
+		noTools: "all",
+		customTools: tools,
+		sessionManager: SessionManager.inMemory(request.workingDirectory),
+		settingsManager,
+		resourceLoader
+	});
+	session._systemPromptOverride = effectivePrompt;
+	session.agent.state.systemPrompt = effectivePrompt;
+	let stopAfterTurn = false;
+	let lastEngineError;
+	let lastEngineErrorOrigin = "model-response";
+	session.agent.shouldStopAfterTurn = () => stopAfterTurn;
+	session.subscribe((event) => {
+		const at = isoNow();
+		if (event.type === "turn_start") {
+			turn += 1;
+			requestId = `mr_${request.incarnation}_${turn}`;
+			responseStatus = void 0;
+			sendEvent({
+				type: "agent.turn.started",
+				at,
+				data: { turn }
+			});
+			sendEvent({
+				type: "model.requested",
+				at,
+				data: {
+					requestId,
+					model: request.model,
+					attempt: 1
+				}
+			});
+		} else if (event.type === "message_start" && event.message.role === "assistant") sendEvent({
+			type: "agent.message.started",
+			at,
+			data: {
+				messageId: requestId,
+				role: "assistant"
+			}
+		});
+		else if (event.type === "message_update" && event.assistantMessageEvent.type === "text_delta") sendEvent({
+			type: "agent.message.delta",
+			at,
+			data: {
+				messageId: requestId,
+				channel: "text",
+				contentIndex: event.assistantMessageEvent.contentIndex,
+				delta: event.assistantMessageEvent.delta
+			}
+		});
+		else if (event.type === "message_end" && event.message.role === "assistant") {
+			const message = event.message;
+			const text = (message.content ?? []).filter((part) => part.type === "text").map((part) => part.text ?? "").join("");
+			const usage = message.usage ?? {
+				input: 0,
+				output: 0,
+				cacheRead: 0,
+				cacheWrite: 0,
+				totalTokens: 0
+			};
+			usageTotals.input += usage.input;
+			usageTotals.output += usage.output;
+			usageTotals.cacheRead += usage.cacheRead;
+			usageTotals.cacheWrite += usage.cacheWrite;
+			usageTotals.total += usage.totalTokens;
+			const rawStop = String(message.stopReason ?? "stop");
+			const stop = rawStop === "pending" || rawStop === "deferred" ? "error" : rawStop === "length" || rawStop === "toolUse" || rawStop === "aborted" || rawStop === "error" ? rawStop === "toolUse" ? "tool-use" : rawStop : "stop";
+			if (rawStop === "pending" || rawStop === "deferred") sendEvent({
+				type: "runtime.warning",
+				at,
+				data: {
+					code: "engine-stop-reason-unmapped",
+					message: `Pi stop reason ${rawStop} was normalized to error`
+				}
+			});
+			sendEvent({
+				type: "agent.message.completed",
+				at,
+				data: {
+					messageId: requestId,
+					role: "assistant",
+					textSha256: sha256Hex(text),
+					textBytes: Buffer.byteLength(text),
+					preview: text.slice(0, 512),
+					stop
+				}
+			});
+			sendEvent({
+				type: "model.responded",
+				at,
+				data: {
+					requestId,
+					requestedModel: request.model,
+					effectiveModel: {
+						provider: model.provider,
+						model: model.id,
+						api: model.api,
+						baseUrl
+					},
+					authMode: request.auth.mode,
+					authSource: oauth ? "oauth" : "api-key",
+					durationMs: 0,
+					...responseStatus === void 0 ? {} : { httpStatus: responseStatus },
+					usage: {
+						input: usage.input,
+						output: usage.output,
+						cacheRead: usage.cacheRead,
+						cacheWrite: usage.cacheWrite,
+						total: usage.totalTokens
+					},
+					attempt: 1,
+					stop,
+					quota: { known: false }
+				}
+			});
+		} else if (event.type === "turn_end") sendEvent({
+			type: "agent.turn.completed",
+			at,
+			data: {
+				turn,
+				toolCalls: ordinal
+			}
+		});
+		else if (event.type === "agent_settled") {
+			if (stopAfterTurn) {
+				stopAfterTurn = false;
+				parked = true;
+				heartbeatState = "parked";
+				send({
+					t: "parked",
+					at: "model-boundary"
+				});
+				return;
+			}
+			clearInterval(heartbeat);
+			const engineError = session.agent.state.errorMessage;
+			const failed = lastEngineError !== void 0 || typeof engineError === "string" && engineError.length > 0;
+			const signal = failed ? signalOf(lastEngineError ?? new Error(engineError ?? "agent session failed"), lastEngineError === void 0 ? "model-response" : lastEngineErrorOrigin) : void 0;
+			send({
+				t: "settled",
+				exit: {
+					outcome: failed ? "failed" : "completed",
+					stop: failed ? "engine-error" : "model-stop",
+					usage: {
+						tokens: usageTotals,
+						modelRequests: turn,
+						toolCalls: ordinal,
+						turns: turn,
+						wallClockMs: 0
+					},
+					lastSeq: sequence
+				},
+				...signal === void 0 ? {} : { signal }
+			});
+		}
+	});
+	send({
+		t: "ready",
+		attestation: {
+			engine: {
+				name: "pi",
+				version: versions["@earendil-works/pi-coding-agent"] ?? engine.expectedEngineVersion,
+				packageVersions: versions
+			},
+			activeTools: request.tools.map((grant) => grant.tool),
+			effectiveSystemPromptSha256: sha256Hex(effectivePrompt),
+			systemPromptPrefixOk: true,
+			auth: {
+				provider: request.auth.provider,
+				type: oauth ? "oauth" : "api_key",
+				source: "stored",
+				subscription
+			},
+			effective: {
+				provider: model.provider,
+				model: model.id,
+				api: model.api,
+				baseUrl
+			},
+			hooks: {
+				streamWrapperInstalled: true,
+				guardFetchInstalled: true,
+				onResponseChained: true,
+				shouldStopAfterTurn: true
+			},
+			sessionFile: engine.sessionFile,
+			sessionId: session.sessionId,
+			envKeys: Object.keys(process.env),
+			platform: process.platform,
+			hostProtocol: 1,
+			extensionsLoaded: 0,
+			extensionErrors: 0,
+			modelFallback: false,
+			settings: {
+				compaction: false,
+				agentRetry: false,
+				providerMaxRetries: 0,
+				transport: "sse"
+			}
+		}
+	});
+	setAgentListener((parent) => {
+		if (parent.t === "prompt") session.prompt(parent.note ? `${parent.text}${CONTINUATION_NOTE_SEPARATOR}${parent.note.text}` : parent.text).catch((error) => {
+			lastEngineError = error;
+			lastEngineErrorOrigin = "prompt-preflight";
+		});
+		else if (parent.t === "send") (parent.delivery === "steer" ? session.steer(parent.text) : session.followUp(parent.text)).then(() => send({
+			t: "response",
+			id: parent.id,
+			ok: true
+		}), (error) => send({
+			t: "response",
+			id: parent.id,
+			ok: false,
+			error: errorOf("tool-transient/agent-process-exit", error instanceof Error ? error.message : String(error))
+		}));
+		else if (parent.t === "abort") session.abort();
+		else if (parent.t === "pause" || parent.t === "stop-after-turn") stopAfterTurn = true;
+		else if (parent.t === "resume" && parked) {
+			parked = false;
+			heartbeatState = "running";
+			session.prompt("[cohorte] continue").catch((error) => {
+				lastEngineError = error;
+				lastEngineErrorOrigin = "prompt-preflight";
+			});
+		} else if (parent.t === "inspect") send({
+			t: "response",
+			id: parent.id,
+			ok: true,
+			data: {
+				state: session.isStreaming ? "running" : "idle",
+				turn,
+				pendingToolCalls: []
+			}
+		});
+		else if (parent.t === "shutdown") session.dispose();
+	});
 }
 if (import.meta.main) main().catch((error) => {
 	process.stderr.write(`agent-host fatal: ${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);