create-walle 0.9.21 → 0.9.23

package/template/wall-e/memory/ctm-session-context.js

@@ -4,7 +4,6 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const crypto = require('node:crypto');
-const Database = requireBetterSqlite3();
 
 const DEFAULT_SEARCH_LIMIT = 10;
 const MAX_SEARCH_LIMIT = 50;
@@ -18,6 +17,7 @@ const CTM_SESSION_TABLES = [
   'ctm_sessions',
   'agent_sessions',
 ];
+let Database = null;
 
 function requireBetterSqlite3() {
   try {
@@ -32,6 +32,21 @@ function requireBetterSqlite3() {
   }
 }
 
+function loadBetterSqlite3() {
+  if (!Database) Database = requireBetterSqlite3();
+  return Database;
+}
+
+function assertDirectReadAllowed(options = {}) {
+  const env = options.env || process.env;
+  if (!env.CTM_PROCESS_ROLE || env.CTM_ALLOW_DIRECT_SESSION_CONTEXT_DB === '1') return;
+  const err = new Error(
+    'CTM session context direct SQLite read is disabled inside CTM_PROCESS_ROLE; pass the CTM-owned db handle instead.'
+  );
+  err.code = 'CTM_DIRECT_DB_READ_BLOCKED';
+  throw err;
+}
+
 function resolveCtmDbPath(env = process.env) {
   if (env.CTM_DB_PATH) return env.CTM_DB_PATH;
   if (env.CTM_DATA_DIR) return path.join(env.CTM_DATA_DIR, 'task-manager.db');
@@ -56,12 +71,14 @@ function resolveCtmDbCandidatePaths(env = process.env) {
   return candidates;
 }
 
-function openCtmDb({ dbPath, readonly = true, busyTimeoutMs = 2500 } = {}) {
-  const resolved = path.resolve(dbPath || resolveCtmDbPath());
+function openCtmDb({ dbPath, readonly = true, busyTimeoutMs = 2500, env = process.env } = {}) {
+  assertDirectReadAllowed({ env });
+  const resolved = path.resolve(dbPath || resolveCtmDbPath(env));
   if (!fs.existsSync(resolved)) {
     return { db: null, dbPath: resolved, close: () => {}, unavailable: true };
   }
-  const db = new Database(resolved, { readonly, fileMustExist: true });
+  const SqliteDatabase = loadBetterSqlite3();
+  const db = new SqliteDatabase(resolved, { readonly, fileMustExist: true });
   const timeout = Number.isFinite(Number(busyTimeoutMs)) ? Math.max(0, Math.trunc(Number(busyTimeoutMs))) : 2500;
   db.pragma(`busy_timeout = ${timeout}`);
   if (readonly) {
@@ -186,6 +203,9 @@ function isDbSourceFailure(result) {
 function classifySqliteFailure(err, fallbackReason) {
   const code = String(err?.code || '');
   const message = String(err?.message || err || '');
+  if (code === 'CTM_DIRECT_DB_READ_BLOCKED') {
+    return { reason: 'ctm_db_direct_read_blocked' };
+  }
   if (/SQLITE_(BUSY|LOCKED)/.test(code) || /database is locked|database table is locked|busy/i.test(message)) {
     return { reason: 'ctm_db_locked' };
   }
@@ -289,11 +309,15 @@ function getCtmSessionContext({
 
     const sessions = [];
     const allMessages = [];
+    let servedFromRows = false;
     for (const bundle of uniqueBundles) {
       const conversations = getConversationRows(conn, bundle);
       const sessionMessages = [];
       for (const row of conversations) {
-        const messages = parseConversationMessages(row);
+        // Phase 5: prefer the faithful per-message rows; fall back to the blob when absent.
+        const rowMessages = readSessionMessageRows(conn, row._conversation_id);
+        const messages = rowMessages || parseConversationMessages(row);
+        if (rowMessages) servedFromRows = true;
         for (let i = 0; i < messages.length; i += 1) {
           const normalized = normalizeMessage(messages[i], {
             row,
@@ -329,7 +353,7 @@ function getCtmSessionContext({
       messages: pagedMessages,
       transfer: {
         full_context_supported: true,
-        served_from: 'session_conversations/session_messages',
+        served_from: servedFromRows ? 'session_message_rows' : 'session_conversations/session_messages',
         jsonl_fallback_used: false,
         deduped: Boolean(dedupe),
       },
@@ -488,67 +512,58 @@ function quoteIdent(value) {
 }
 
 function searchSessionMessagesFts(db, query, limit) {
-  if (!hasTable(db, 'session_messages') || !hasTable(db, 'session_messages_fts')) return [];
-  const msgSessionCol = idColumnFor(db, 'session_messages');
-  if (!msgSessionCol) return [];
   const ftsQueries = buildFtsQueries(query);
   if (!ftsQueries.length) return [];
-
-  try {
-    const stmt = db.prepare(`
-      SELECT sm.${quoteIdent(msgSessionCol)} AS conversation_id,
-             sm.id AS message_rowid,
-             sm.role,
-             sm.message_index,
-             sm.content,
-             sm.created_at,
-             fts.rank AS rank
-      FROM session_messages_fts fts
-      JOIN session_messages sm ON sm.id = fts.rowid
-      WHERE session_messages_fts MATCH ?
-      ORDER BY fts.rank
-      LIMIT ?
-    `);
-    let rows = [];
-    for (const ftsQuery of ftsQueries) {
-      rows = stmt.all(ftsQuery, limit);
-      if (rows.length) break;
-    }
-    return rows.map((row, index) => enrichSearchRow(db, row, {
-      source_table: 'session_messages_fts',
-      rank: index,
-      score: row.rank,
-    }));
-  } catch {
-    return [];
-  }
+  // Phase: prefer the faithful per-message FTS (session_message_rows_fts); fall back to the legacy
+  // session_messages_fts only while it still exists (sessions not yet backfilled into rows). Each
+  // index is tried independently so a mid-retirement drop of the legacy table can't blank results.
+  const tryIndex = (cfg) => {
+    if (!hasTable(db, cfg.table) || !hasTable(db, cfg.fts)) return null;
+    const idCol = cfg.idCol || idColumnFor(db, cfg.table);
+    if (!idCol) return null;
+    try {
+      const stmt = db.prepare(`
+        SELECT sm.${quoteIdent(idCol)} AS conversation_id, sm.id AS message_rowid, sm.role,
+               sm.message_index, sm.${cfg.textCol} AS content, sm.${cfg.tsCol} AS created_at, fts.rank AS rank
+        FROM ${cfg.fts} fts JOIN ${cfg.table} sm ON sm.id = fts.rowid
+        WHERE ${cfg.fts} MATCH ? ORDER BY fts.rank LIMIT ?
+      `);
+      for (const ftsQuery of ftsQueries) {
+        const rows = stmt.all(ftsQuery, limit);
+        if (rows.length) return rows.map((row, index) => enrichSearchRow(db, row, { source_table: cfg.fts, rank: index, score: row.rank }));
+      }
+      return [];
+    } catch { return null; }
+  };
+  const rowsRes = tryIndex({ table: 'session_message_rows', fts: 'session_message_rows_fts', idCol: 'ctm_session_id', textCol: 'text', tsCol: 'timestamp' });
+  if (rowsRes && rowsRes.length) return rowsRes;
+  const legacyRes = tryIndex({ table: 'session_messages', fts: 'session_messages_fts', textCol: 'content', tsCol: 'created_at' });
+  return legacyRes || rowsRes || [];
 }
 
 function searchSessionMessagesLike(db, query, limit) {
-  if (!hasTable(db, 'session_messages')) return [];
-  const msgSessionCol = idColumnFor(db, 'session_messages');
-  if (!msgSessionCol) return [];
   const like = `%${escapeLike(query)}%`;
-  try {
-    const rows = db.prepare(`
-      SELECT ${quoteIdent(msgSessionCol)} AS conversation_id,
-             id AS message_rowid,
-             role,
-             message_index,
-             content,
-             created_at
-      FROM session_messages
-      WHERE content LIKE ? ESCAPE '\\'
-      ORDER BY created_at DESC, id DESC
-      LIMIT ?
-    `).all(like, limit);
-    return rows.map((row, index) => enrichSearchRow(db, row, {
-      source_table: 'session_messages',
-      rank: index + 1000,
-    }));
-  } catch {
-    return [];
-  }
+  // Prefer the faithful rows (text column); fall back to the legacy session_messages (content)
+  // only while it exists. Each is tried independently.
+  const tryLike = (cfg) => {
+    if (!hasTable(db, cfg.table)) return null;
+    const idCol = cfg.idCol || idColumnFor(db, cfg.table);
+    if (!idCol) return null;
+    try {
+      const rows = db.prepare(`
+        SELECT ${quoteIdent(idCol)} AS conversation_id, id AS message_rowid, role, message_index,
+               ${cfg.textCol} AS content, ${cfg.tsCol} AS created_at
+        FROM ${cfg.table}
+        WHERE ${cfg.textCol} LIKE ? ESCAPE '\\'
+        ORDER BY ${cfg.tsCol} DESC, id DESC LIMIT ?
+      `).all(like, limit);
+      return rows.map((row, index) => enrichSearchRow(db, row, { source_table: cfg.table, rank: index + 1000 }));
+    } catch { return null; }
+  };
+  const rowsRes = tryLike({ table: 'session_message_rows', idCol: 'ctm_session_id', textCol: 'text', tsCol: 'timestamp' });
+  if (rowsRes && rowsRes.length) return rowsRes;
+  const legacyRes = tryLike({ table: 'session_messages', textCol: 'content', tsCol: 'created_at' });
+  return legacyRes || rowsRes || [];
 }
 
 function searchSessionConversationMessages(db, query, limit) {
@@ -595,7 +610,9 @@ function searchSessionConversationMessages(db, query, limit) {
         project_path: row.project_path || '',
         title: row.title || row.first_message || '',
       };
-      const messages = parseConversationMessages(row);
+      // Candidates are found via the blob LIKE (still dual-written); reconstruct the messages
+      // from the faithful rows when present so search reads the same source as getCtmSessionContext.
+      const messages = readSessionMessageRows(db, conversationId) || parseConversationMessages(row);
       for (let i = 0; i < messages.length; i += 1) {
         const normalized = normalizeMessage(messages[i], {
           row,
@@ -905,6 +922,36 @@ function parseConversationMessages(row) {
   }
 }
 
+// Phase 5: read the faithful per-message rows (session_message_rows) instead of the blob.
+// The rows ARE the same parsed message objects the blob held (CTM writes them in lockstep),
+// so this returns a byte-identical array — no re-embedding, no parser. Returns null when the
+// table/rows are absent (pre-migration or a half-migrated session) so the caller falls back
+// to parseConversationMessages(row) (the blob). Keyed by the SAME id the blob row uses.
+function readSessionMessageRows(db, conversationId) {
+  if (!conversationId || !hasTable(db, 'session_message_rows')) return null;
+  try {
+    const rows = db.prepare(
+      'SELECT role, text, timestamp, meta FROM session_message_rows WHERE ctm_session_id = ? ORDER BY message_index ASC'
+    ).all(conversationId);
+    if (!rows.length) return null;
+    return rows.map(messageRowFromColumns);
+  } catch {
+    return null;
+  }
+}
+
+// Rebuild the original importer message object: non-standard messages are stored VERBATIM in
+// `meta`; simple ones are pure columns ({role,text,timestamp}). Mirrors db.js _messageRowToObject.
+function messageRowFromColumns(r) {
+  if (r && r.meta) {
+    try {
+      const obj = JSON.parse(r.meta);
+      if (obj && typeof obj === 'object') return obj;
+    } catch { /* fall through to columns */ }
+  }
+  return { role: r.role, text: r.text, timestamp: r.timestamp || '' };
+}
+
 function normalizeMessage(raw, { row, bundle, index, includeRaw }) {
   const role = normalizeRole(raw);
   const content = messageText(raw);
@@ -1280,7 +1327,8 @@ function backfillCtmSessionMessages({ db, dbPath, limit = 100, dry_run = false,
     let inserted_fts = 0;
     const txn = conn.transaction((rows) => {
       for (const row of rows) {
-        const messages = parseConversationMessages(row);
+        // Phase 5: build the index from the faithful rows when present (survives blob retirement).
+        const messages = readSessionMessageRows(conn, row._conversation_id) || parseConversationMessages(row);
         let sessionInserted = 0;
         for (let i = 0; i < messages.length; i += 1) {
           const raw = messages[i];

package/template/wall-e/prompts/coding/deepseek.txt

@@ -1 +1,4 @@
 DeepSeek mode reminder: keep tool-loop turns concise and avoid carrying reasoning blocks back into later tool-result requests.
+- Emit tool calls ONLY through the tool-call API — never as DSML/text markup in your reply.
+- Never truncate code with "..." placeholders; provide complete file or hunk content in every write.
+- For multi-hunk or multi-file changes, prefer apply_patch over repeated edit_file calls.

package/template/wall-e/prompts/coding/gemini.txt

@@ -0,0 +1,6 @@
+Gemini-family adaptation:
+- Emit tool calls ONLY through the function-calling API. Never print a function call, JSON blob, or code fence describing a call instead of making it.
+- Do not wrap tool arguments in markdown fences; pass raw values.
+- Re-read a file with read_file before editing if its content may have changed; copy old_string EXACTLY (whitespace included) from the latest read.
+- Make one surgical edit per edit_file call; for sweeping changes use apply_patch.
+- Verify with run_shell before claiming completion; report the actual command output.

package/template/wall-e/prompts/coding/gpt.txt

@@ -0,0 +1,6 @@
+GPT-family adaptation:
+- Emit tool calls ONLY through the tool-call API. Never write a tool call as text, JSON, or XML inside your reply.
+- Never truncate code with placeholders like "// ... rest of file unchanged" or "# existing code here". Every write_file must contain the COMPLETE file; every edit must contain the complete replacement text.
+- For multi-hunk or multi-file changes, prefer apply_patch over repeated edit_file calls.
+- Keep going until the task is fully done: implement, verify, and only then summarize. Do not end your turn with a plan or a promise of future work.
+- Re-read a file with read_file before editing it if you have not seen its current content this session.

package/template/wall-e/prompts/coding/local.txt

@@ -0,0 +1,7 @@
+Local-model adaptation:
+- Make ONE tool call at a time and wait for its result before deciding the next step.
+- Keep responses short; spend tokens on tool calls, not narration.
+- For edit_file, choose an old_string that is unique in the file and includes 2-3 surrounding lines of context; copy it EXACTLY from the latest read_file output.
+- If a command fails or times out, read the error output and inspect the code BEFORE running the same command again.
+- Prefer small files and small diffs; for changes spanning many locations, use apply_patch with complete hunks.
+- Do not restate the task or the system prompt in your replies.

package/template/wall-e/runtime/decision-hooks.js

@@ -0,0 +1,115 @@
+'use strict';
+
+class RuntimeDecisionHookBus {
+  constructor({ handlers = {}, telemetry = null } = {}) {
+    this.handlers = new Map();
+    this.telemetry = telemetry || null;
+    for (const [event, list] of Object.entries(handlers || {})) {
+      for (const handler of Array.isArray(list) ? list : [list]) {
+        this.use(event, handler);
+      }
+    }
+  }
+
+  use(event, handler) {
+    if (!event || typeof handler !== 'function') return this;
+    const name = String(event);
+    if (!this.handlers.has(name)) this.handlers.set(name, []);
+    this.handlers.get(name).push(handler);
+    return this;
+  }
+
+  async run(event, payload = {}, ctx = {}) {
+    const name = String(event || '');
+    const handlers = this.handlers.get(name) || [];
+    let decision = emptyDecision();
+    for (const handler of handlers) {
+      try {
+        const result = normalizeDecision(await handler({
+          ...payload,
+          decision,
+          event: name,
+          ctx,
+        }));
+        decision = mergeDecision(decision, result);
+        if (decision.stop || decision.denied) break;
+      } catch (error) {
+        const hookError = {
+          event: name,
+          error: error?.message || String(error),
+        };
+        decision.hookErrors.push(hookError);
+        try {
+          this.telemetry?.track?.('runtime_hook_error', {
+            event: name,
+            error_type: error?.name || 'Error',
+          });
+        } catch {}
+      }
+    }
+    return decision;
+  }
+}
+
+function emptyDecision() {
+  return {
+    denied: false,
+    stop: false,
+    reason: '',
+    input: undefined,
+    result: undefined,
+    output: undefined,
+    additionalContext: [],
+    metadata: {},
+    hookErrors: [],
+  };
+}
+
+function normalizeDecision(value) {
+  if (!value) return emptyDecision();
+  if (Array.isArray(value)) {
+    return value.reduce((acc, item) => mergeDecision(acc, normalizeDecision(item)), emptyDecision());
+  }
+  if (typeof value !== 'object') return emptyDecision();
+  const denied = value.denied === true || value.deny === true || value.behavior === 'deny';
+  const stop = value.stop === true || value.preventContinuation === true;
+  const reason = String(value.reason || value.message || value.stopReason || '');
+  return {
+    denied,
+    stop,
+    reason,
+    input: Object.prototype.hasOwnProperty.call(value, 'input') ? value.input
+      : Object.prototype.hasOwnProperty.call(value, 'updatedInput') ? value.updatedInput
+      : undefined,
+    result: Object.prototype.hasOwnProperty.call(value, 'result') ? value.result
+      : Object.prototype.hasOwnProperty.call(value, 'output') ? value.output
+      : undefined,
+    output: Object.prototype.hasOwnProperty.call(value, 'output') ? value.output : undefined,
+    additionalContext: Array.isArray(value.additionalContext) ? value.additionalContext
+      : value.additionalContext ? [value.additionalContext]
+      : [],
+    metadata: value.metadata && typeof value.metadata === 'object' ? { ...value.metadata } : {},
+    hookErrors: Array.isArray(value.hookErrors) ? value.hookErrors : [],
+  };
+}
+
+function mergeDecision(a = emptyDecision(), b = emptyDecision()) {
+  return {
+    denied: a.denied || b.denied,
+    stop: a.stop || b.stop,
+    reason: b.reason || a.reason || '',
+    input: b.input !== undefined ? b.input : a.input,
+    result: b.result !== undefined ? b.result : a.result,
+    output: b.output !== undefined ? b.output : a.output,
+    additionalContext: [...(a.additionalContext || []), ...(b.additionalContext || [])],
+    metadata: { ...(a.metadata || {}), ...(b.metadata || {}) },
+    hookErrors: [...(a.hookErrors || []), ...(b.hookErrors || [])],
+  };
+}
+
+module.exports = {
+  RuntimeDecisionHookBus,
+  emptyDecision,
+  mergeDecision,
+  normalizeDecision,
+};

package/template/wall-e/runtime/devbox-gateway.js

@@ -2,6 +2,78 @@
 
 const fs = require('fs');
 const path = require('path');
+const { parseCustomHeaders } = require('../llm/portkey');
+
+function readDevboxClaudeAuthHeaders({ home = process.env.HOME, fsImpl = fs } = {}) {
+  if (!home) return null;
+  const authFile = path.join(home, '.devbox', 'secrets', 'claude', 'auth_headers');
+  const raw = fsImpl.readFileSync(authFile, 'utf8').trim();
+  if (!raw) return null;
+  const headers = parseCustomHeaders(raw);
+  if (!Object.keys(headers).length) return null;
+  return { authFile, raw, headers };
+}
+
+function maskSecret(value) {
+  const text = String(value || '');
+  if (!text) return '';
+  if (text.length <= 12) return text.slice(0, 3) + '...';
+  return text.slice(0, 8) + '...' + text.slice(-4);
+}
+
+function normalizeDevboxBaseUrl(value) {
+  const url = String(value || '').trim().replace(/\/+$/, '');
+  if (!/^https?:\/\//i.test(url)) return '';
+  return /\/v\d+$/i.test(url) ? url : `${url}/v1`;
+}
+
+function detectDevboxClaudeBaseUrl({ env = process.env, home = env.HOME, fsImpl = fs } = {}) {
+  const envUrl = normalizeDevboxBaseUrl(env.ANTHROPIC_BASE_URL);
+  if (envUrl) return envUrl;
+
+  if (home) {
+    try {
+      const claudeScript = fsImpl.readFileSync(path.join(home, '.devbox', 'ai', 'claude', 'claude'), 'utf8');
+      const vpnMatch = claudeScript.match(/VPN_CHECK_URL="(https?:\/\/[^"]+)"/);
+      const scriptUrl = normalizeDevboxBaseUrl(vpnMatch && vpnMatch[1]);
+      if (scriptUrl) return scriptUrl;
+    } catch {}
+
+    try {
+      const logFile = path.join(home, '.devbox', 'logs', 'devbox-logs.log');
+      const log = fsImpl.readFileSync(logFile, 'utf8');
+      const matches = Array.from(log.matchAll(/ANTHROPIC_BASE_URL:\s*(https?:\/\/[^\s"}]+)/g));
+      const last = matches.length ? normalizeDevboxBaseUrl(matches[matches.length - 1][1]) : '';
+      if (last) return last;
+    } catch {}
+  }
+
+  return '';
+}
+
+function getDevboxClaudePortkeyGateway({ home = process.env.HOME, fsImpl = fs, env = process.env } = {}) {
+  try {
+    const auth = readDevboxClaudeAuthHeaders({ home, fsImpl });
+    const headers = auth && auth.headers;
+    const apiKey = headers && headers['x-portkey-api-key'];
+    if (!apiKey) return null;
+    return {
+      source: 'devbox-claude-auth-headers',
+      name: 'Portkey gateway',
+      label: 'devbox',
+      apiKey,
+      apiKeyMasked: maskSecret(apiKey),
+      customHeaders: headers,
+      hasProvider: Boolean(headers['x-portkey-provider']),
+      hasVirtualKey: Boolean(headers['x-portkey-virtual-key']),
+      hasConfig: Boolean(headers['x-portkey-config']),
+      hasMetadata: Boolean(headers['x-portkey-metadata']),
+      baseUrl: detectDevboxClaudeBaseUrl({ env, home, fsImpl }),
+    };
+  } catch {
+    return null;
+  }
+}
 
 function configureDevboxGateway({ env = process.env, home = env.HOME, logger = console } = {}) {
   // Auto-detect corporate Claude Code gateway if not already configured. The
@@ -11,8 +83,8 @@ function configureDevboxGateway({ env = process.env, home = env.HOME, logger = c
   if (env.ANTHROPIC_CUSTOM_HEADERS_B64 || hasRealKey || !home) return false;
 
   try {
-    const authFile = path.join(home, '.devbox', 'secrets', 'claude', 'auth_headers');
-    const headers = fs.readFileSync(authFile, 'utf8').trim();
+    const auth = readDevboxClaudeAuthHeaders({ home });
+    const headers = auth && auth.raw;
     if (!headers) return false;
 
     env.ANTHROPIC_CUSTOM_HEADERS_B64 = Buffer.from(headers).toString('base64');
@@ -20,11 +92,8 @@ function configureDevboxGateway({ env = process.env, home = env.HOME, logger = c
     if (!env.ANTHROPIC_AUTH_TOKEN) env.ANTHROPIC_AUTH_TOKEN = 'sk-ant-api03-unused';
 
     if (!env.ANTHROPIC_BASE_URL) {
-      try {
-        const claudeScript = fs.readFileSync(path.join(home, '.devbox', 'ai', 'claude', 'claude'), 'utf8');
-        const vpnMatch = claudeScript.match(/VPN_CHECK_URL="(https?:\/\/[^"]+)"/);
-        if (vpnMatch) env.ANTHROPIC_BASE_URL = vpnMatch[1] + '/v1';
-      } catch {}
+      const baseUrl = detectDevboxClaudeBaseUrl({ env, home });
+      if (baseUrl) env.ANTHROPIC_BASE_URL = baseUrl;
     }
 
     try { require('../compat').recordCompatUsage('devbox_gateway'); } catch {}
@@ -35,4 +104,9 @@ function configureDevboxGateway({ env = process.env, home = env.HOME, logger = c
   }
 }
 
-module.exports = { configureDevboxGateway };
+module.exports = {
+  configureDevboxGateway,
+  detectDevboxClaudeBaseUrl,
+  getDevboxClaudePortkeyGateway,
+  readDevboxClaudeAuthHeaders,
+};

package/template/wall-e/runtime/prompt-manifest.js

@@ -0,0 +1,86 @@
+'use strict';
+
+const {
+  PromptSectionRegistry,
+  appendPromptManifest,
+  buildPromptManifest,
+  normalizePromptManifestSection,
+  toolCatalogSignature,
+} = require('../coding/prompt-section-registry');
+
+function buildRuntimePromptManifest({
+  runtimeProfile = {},
+  systemPrompt = '',
+  userTask = '',
+  messages = [],
+  tools = [],
+  provider = '',
+  model = '',
+  metadata = {},
+  now = () => new Date().toISOString(),
+} = {}) {
+  const registry = new PromptSectionRegistry({
+    provider: provider || runtimeProfile.provider || '',
+    model: model || runtimeProfile.model || '',
+    now,
+  });
+  registry.add({
+    id: 'stable.system-prompt',
+    kind: 'stable',
+    source: 'runtime.system',
+    content: systemPrompt,
+    cacheable: true,
+    metadata: {
+      runtimeProfile: runtimeProfile.profileId || runtimeProfile.runtimeProfile || '',
+      outputContract: runtimeProfile.outputContract || '',
+    },
+  });
+  if (userTask) {
+    registry.add({
+      id: 'dynamic.user-task',
+      kind: 'dynamic',
+      source: 'user',
+      content: userTask,
+      cacheable: false,
+      redactionPolicy: 'standard',
+    });
+  }
+  if (Array.isArray(messages) && messages.length) {
+    registry.add({
+      id: 'dynamic.message-window',
+      kind: 'dynamic',
+      source: 'runtime.messages',
+      content: JSON.stringify(messages.map((message) => ({
+        role: message.role,
+        contentType: Array.isArray(message.content) ? 'blocks' : typeof message.content,
+      }))),
+      cacheable: false,
+      metadata: { count: messages.length },
+    });
+  }
+  registry.add({
+    id: 'dynamic.tool-catalog',
+    kind: 'dynamic',
+    source: 'tool-registry',
+    content: toolCatalogSignature(tools),
+    cacheable: false,
+    metadata: { count: Array.isArray(tools) ? tools.length : 0 },
+  });
+  return registry.manifest({
+    metadata: {
+      runtimeProfile: runtimeProfile.profileId || runtimeProfile.runtimeProfile || '',
+      permissionProfile: runtimeProfile.permissionProfile || '',
+      persistenceProfile: runtimeProfile.persistenceProfile || '',
+      ...metadata,
+    },
+  });
+}
+
+module.exports = {
+  PromptSectionRegistry,
+  appendPromptManifest,
+  buildPromptManifest,
+  buildRuntimePromptManifest,
+  normalizePromptManifestSection,
+  toolCatalogSignature,
+};