executor 1.2.1 → 1.2.3

package/bin/executor.mjs

@@ -305367,8 +305367,8 @@ var require_client_interceptors = __commonJS((exports) => {
       this.start = start4;
       return this;
     }
-    withSendMessage(sendMessage) {
-      this.message = sendMessage;
+    withSendMessage(sendMessage2) {
+      this.message = sendMessage2;
       return this;
     }
     withHalfClose(halfClose) {
@@ -320673,8 +320673,8 @@ var require_server_interceptors = __commonJS((exports) => {
       this.metadata = sendMetadata;
       return this;
     }
-    withSendMessage(sendMessage) {
-      this.message = sendMessage;
+    withSendMessage(sendMessage2) {
+      this.message = sendMessage2;
       return this;
     }
     withSendStatus(sendStatus) {
@@ -334088,12 +334088,12 @@ var require_src18 = __commonJS((exports) => {
 });
 
 // apps/executor/src/cli/main.ts
-import { existsSync as existsSync8, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync3 } from "node:fs";
 import { mkdir as mkdir5, open as open3, readFile as readFile6, rm as rm5 } from "node:fs/promises";
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { dirname as dirname10, resolve as resolve11 } from "node:path";
 import { createInterface } from "node:readline/promises";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 
 // node_modules/@effect/cli/dist/esm/Args.js
 var exports_Args = {};
@@ -375146,6 +375146,7 @@ var LocalInstallationSchema = Struct({
 });
 var LocalInstallationUpdateSchema = partial2(LocalInstallationSchema);
 // packages/control-plane/src/schema/models/local-config.ts
+var LocalExecutorRuntimeSchema = exports_Schema.Literal("quickjs", "ses", "deno");
 var LocalConfigSecretProviderSourceSchema = exports_Schema.Literal("env", "file", "exec", "params");
 var LocalConfigEnvSecretProviderSchema = exports_Schema.Struct({
   source: exports_Schema.Literal("env")
@@ -375241,6 +375242,7 @@ var LocalConfigWorkspaceSchema = exports_Schema.Struct({
   name: exports_Schema.optional(exports_Schema.String)
 });
 var LocalExecutorConfigSchema = exports_Schema.Struct({
+  runtime: exports_Schema.optional(LocalExecutorRuntimeSchema),
   workspace: exports_Schema.optional(LocalConfigWorkspaceSchema),
   sources: exports_Schema.optional(exports_Schema.Record({
     key: exports_Schema.String,
@@ -382319,13 +382321,47 @@ var googleDiscoveryCatalogOperationFromDefinition = (input) => {
     providerData: presentation.providerData
   };
 };
+var computeMaximalScopes = (manifest) => {
+  const topLevelScopes = Object.keys(manifest.oauthScopes ?? {});
+  if (topLevelScopes.length === 0)
+    return [];
+  const scopeToMethods = new Map;
+  for (const scope4 of topLevelScopes) {
+    scopeToMethods.set(scope4, new Set);
+  }
+  for (const method of manifest.methods) {
+    for (const scope4 of method.scopes) {
+      scopeToMethods.get(scope4)?.add(method.methodId);
+    }
+  }
+  const maximal = topLevelScopes.filter((scope4) => {
+    const methods = scopeToMethods.get(scope4);
+    if (!methods || methods.size === 0)
+      return true;
+    return !topLevelScopes.some((other) => {
+      if (other === scope4)
+        return false;
+      const otherMethods = scopeToMethods.get(other);
+      if (!otherMethods || otherMethods.size <= methods.size)
+        return false;
+      for (const m of methods) {
+        if (!otherMethods.has(m))
+          return false;
+      }
+      return true;
+    });
+  });
+  return maximal;
+};
 var googleDiscoveryOauth2SetupConfig = (source2) => gen2(function* () {
   const bindingConfig = yield* googleDiscoveryBindingConfigFromSource(source2);
   const configuredScopes = bindingConfig.scopes ?? [];
-  const scopes = configuredScopes.length > 0 ? configuredScopes : yield* fetchGoogleDiscoveryDocumentWithHeaders({
+  const manifest = yield* fetchGoogleDiscoveryDocumentWithHeaders({
     url: bindingConfig.discoveryUrl,
     headers: bindingConfig.defaultHeaders ?? undefined
-  }).pipe(flatMap10((document2) => extractGoogleDiscoveryManifest(source2.name, document2)), map16((manifest) => Object.keys(manifest.oauthScopes ?? {})));
+  }).pipe(flatMap10((document2) => extractGoogleDiscoveryManifest(source2.name, document2)), catchAll2(() => succeed8(null)));
+  const discoveryScopes = manifest ? computeMaximalScopes(manifest) : [];
+  const scopes = discoveryScopes.length > 0 ? [...new Set([...discoveryScopes, ...configuredScopes])] : configuredScopes;
   if (scopes.length === 0) {
     return null;
   }
@@ -408418,6 +408454,280 @@ var asOperationErrors = (errors4) => typeof errors4 === "string" ? operationErro
 class ControlPlaneStore extends Tag2("#runtime/ControlPlaneStore")() {
 }
 
+// packages/runtime-deno-subprocess/src/index.ts
+import { existsSync } from "node:fs";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// packages/runtime-deno-subprocess/src/deno-worker-process.ts
+import { spawn } from "node:child_process";
+var normalizeError = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
+var buildPermissionArgs = (permissions) => {
+  if (!permissions) {
+    return [
+      "--deny-net",
+      "--deny-read",
+      "--deny-write",
+      "--deny-env",
+      "--deny-run",
+      "--deny-ffi"
+    ];
+  }
+  const args3 = [];
+  const addPermission = (flag, value7) => {
+    if (value7 === true) {
+      args3.push(`--allow-${flag}`);
+    } else if (Array.isArray(value7) && value7.length > 0) {
+      args3.push(`--allow-${flag}=${value7.join(",")}`);
+    } else {
+      args3.push(`--deny-${flag}`);
+    }
+  };
+  addPermission("net", permissions.allowNet);
+  addPermission("read", permissions.allowRead);
+  addPermission("write", permissions.allowWrite);
+  addPermission("env", permissions.allowEnv);
+  addPermission("run", permissions.allowRun);
+  addPermission("ffi", permissions.allowFfi);
+  return args3;
+};
+var spawnDenoWorkerProcess = (input, callbacks) => {
+  const permissionArgs = buildPermissionArgs(input.permissions);
+  const child = spawn(input.executable, [
+    "run",
+    "--quiet",
+    "--no-prompt",
+    "--no-check",
+    ...permissionArgs,
+    input.scriptPath
+  ], {
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  if (!child.stdin || !child.stdout || !child.stderr) {
+    throw new Error("Failed to create piped stdio for Deno worker subprocess");
+  }
+  child.stdout.setEncoding("utf8");
+  child.stderr.setEncoding("utf8");
+  let stdoutBuffer = "";
+  const onStdoutData = (chunk4) => {
+    stdoutBuffer += chunk4;
+    while (true) {
+      const newlineIndex = stdoutBuffer.indexOf(`
+`);
+      if (newlineIndex === -1) {
+        break;
+      }
+      const line4 = stdoutBuffer.slice(0, newlineIndex);
+      stdoutBuffer = stdoutBuffer.slice(newlineIndex + 1);
+      callbacks.onStdoutLine(line4);
+    }
+  };
+  const onStderrData = (chunk4) => {
+    callbacks.onStderr(chunk4);
+  };
+  const onError4 = (cause2) => {
+    callbacks.onError(normalizeError(cause2));
+  };
+  const onExit4 = (code2, signal) => {
+    callbacks.onExit(code2, signal);
+  };
+  child.stdout.on("data", onStdoutData);
+  child.stderr.on("data", onStderrData);
+  child.on("error", onError4);
+  child.on("exit", onExit4);
+  let disposed = false;
+  const dispose = () => {
+    if (disposed) {
+      return;
+    }
+    disposed = true;
+    child.stdout.removeListener("data", onStdoutData);
+    child.stderr.removeListener("data", onStderrData);
+    child.removeListener("error", onError4);
+    child.removeListener("exit", onExit4);
+    if (!child.killed) {
+      child.kill("SIGKILL");
+    }
+  };
+  return {
+    stdin: child.stdin,
+    dispose
+  };
+};
+
+// packages/runtime-deno-subprocess/src/index.ts
+var IPC_PREFIX = "@@executor-ipc@@";
+var DEFAULT_TIMEOUT_MS = 5 * 60000;
+var defaultDenoExecutable = () => {
+  const configured = process.env.DENO_BIN?.trim();
+  if (configured) {
+    return configured;
+  }
+  const home = process.env.HOME?.trim();
+  if (home) {
+    const installedPath = `${home}/.deno/bin/deno`;
+    if (existsSync(installedPath)) {
+      return installedPath;
+    }
+  }
+  return "deno";
+};
+var formatDenoSpawnError = (cause2, executable) => {
+  const code2 = typeof cause2 === "object" && cause2 !== null && "code" in cause2 ? String(cause2.code) : null;
+  if (code2 === "ENOENT") {
+    return `Failed to spawn Deno subprocess: Deno executable "${executable}" was not found. Install Deno or set DENO_BIN.`;
+  }
+  return `Failed to spawn Deno subprocess: ${cause2 instanceof Error ? cause2.message : String(cause2)}`;
+};
+var resolveWorkerScriptPath = () => {
+  const moduleUrl = String(import.meta.url);
+  if (moduleUrl.startsWith("/")) {
+    return moduleUrl;
+  }
+  try {
+    const workerUrl = new URL("./deno-subprocess-worker.mjs", moduleUrl);
+    if (workerUrl.protocol === "file:") {
+      return fileURLToPath2(workerUrl);
+    }
+    return workerUrl.pathname.length > 0 ? workerUrl.pathname : workerUrl.toString();
+  } catch {
+    return moduleUrl;
+  }
+};
+var cachedWorkerScriptPath;
+var workerScriptPath = () => {
+  if (!cachedWorkerScriptPath) {
+    cachedWorkerScriptPath = resolveWorkerScriptPath();
+  }
+  return cachedWorkerScriptPath;
+};
+var writeMessage = (stdin, message) => {
+  stdin.write(`${JSON.stringify(message)}
+`);
+};
+var isWorkerMessage = (value7) => typeof value7 === "object" && value7 !== null && ("type" in value7) && typeof value7.type === "string";
+var executeInDeno = (code2, toolInvoker, options9) => gen2(function* () {
+  const denoExecutable = options9.denoExecutable ?? defaultDenoExecutable();
+  const timeoutMs = Math.max(100, options9.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  const result = yield* async((resume2) => {
+    let settled = false;
+    let stderrBuffer = "";
+    let worker = null;
+    const finish = (executeResult) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timeout3);
+      worker?.dispose();
+      resume2(succeed8(executeResult));
+    };
+    const fail19 = (error51, logs) => {
+      finish({
+        result: null,
+        error: error51,
+        logs
+      });
+    };
+    const timeout3 = setTimeout(() => {
+      fail19(`Deno subprocess execution timed out after ${timeoutMs}ms`);
+    }, timeoutMs);
+    const handleStdoutLine = (rawLine) => {
+      const line4 = rawLine.trim();
+      if (line4.length === 0 || !line4.startsWith(IPC_PREFIX)) {
+        return;
+      }
+      const payload = line4.slice(IPC_PREFIX.length);
+      let message;
+      try {
+        const parsed = JSON.parse(payload);
+        if (!isWorkerMessage(parsed)) {
+          fail19(`Invalid worker message: ${payload}`);
+          return;
+        }
+        message = parsed;
+      } catch (cause2) {
+        fail19(`Failed to decode worker message: ${payload}
+${String(cause2)}`);
+        return;
+      }
+      if (message.type === "tool_call") {
+        if (!worker) {
+          fail19("Deno subprocess unavailable while handling worker tool_call");
+          return;
+        }
+        const currentWorker = worker;
+        runPromise(match12(tryPromise2({
+          try: () => runPromise(toolInvoker.invoke({
+            path: message.toolPath,
+            args: message.args
+          })),
+          catch: (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2))
+        }), {
+          onSuccess: (value7) => {
+            writeMessage(currentWorker.stdin, {
+              type: "tool_result",
+              requestId: message.requestId,
+              ok: true,
+              value: value7
+            });
+          },
+          onFailure: (error51) => {
+            writeMessage(currentWorker.stdin, {
+              type: "tool_result",
+              requestId: message.requestId,
+              ok: false,
+              error: error51.message
+            });
+          }
+        })).catch((cause2) => {
+          fail19(`Failed handling worker tool_call: ${String(cause2)}`);
+        });
+        return;
+      }
+      if (message.type === "completed") {
+        finish({
+          result: message.result,
+          logs: message.logs
+        });
+        return;
+      }
+      fail19(message.error, message.logs);
+    };
+    try {
+      worker = spawnDenoWorkerProcess({
+        executable: denoExecutable,
+        scriptPath: workerScriptPath(),
+        permissions: options9.permissions
+      }, {
+        onStdoutLine: handleStdoutLine,
+        onStderr: (chunk4) => {
+          stderrBuffer += chunk4;
+        },
+        onError: (cause2) => {
+          fail19(formatDenoSpawnError(cause2, denoExecutable));
+        },
+        onExit: (exitCode, signal) => {
+          if (settled) {
+            return;
+          }
+          fail19(`Deno subprocess exited before returning terminal message (code=${String(exitCode)} signal=${String(signal)} stderr=${stderrBuffer})`);
+        }
+      });
+    } catch (cause2) {
+      fail19(formatDenoSpawnError(cause2, denoExecutable));
+      return;
+    }
+    writeMessage(worker.stdin, {
+      type: "start",
+      code: code2
+    });
+  });
+  return result;
+});
+var makeDenoSubprocessExecutor = (options9 = {}) => ({
+  execute: (code2, toolInvoker) => executeInDeno(code2, toolInvoker, options9)
+});
+
 // node_modules/quickjs-emscripten-core/dist/index.mjs
 init_dist();
 async function newQuickJSWASMModuleFromVariant(variantOrPromise) {
@@ -408453,7 +408763,7 @@ async function getQuickJS() {
 }
 
 // packages/runtime-quickjs/src/index.ts
-var DEFAULT_TIMEOUT_MS = 5 * 60000;
+var DEFAULT_TIMEOUT_MS2 = 5 * 60000;
 var EXECUTION_FILENAME = "executor-quickjs-runtime.js";
 var toError2 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
 var toErrorMessage = (cause2) => {
@@ -408628,7 +408938,7 @@ var drainAsync = async (context7, runtime5, pendingDeferreds, deadlineMs, timeou
   drainJobs(context7, runtime5, deadlineMs, timeoutMs);
 };
 var evaluateInQuickJs = async (options9, code2, toolInvoker) => {
-  const timeoutMs = Math.max(100, options9.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  const timeoutMs = Math.max(100, options9.timeoutMs ?? DEFAULT_TIMEOUT_MS2);
   const deadlineMs = Date.now() + timeoutMs;
   const logs = [];
   const pendingDeferreds = new Set;
@@ -408724,6 +409034,151 @@ var makeQuickJsExecutor = (options9 = {}) => ({
   execute: (code2, toolInvoker) => runInQuickJs(options9, code2, toolInvoker)
 });
 
+// packages/runtime-ses/src/index.ts
+import { fork as fork3 } from "node:child_process";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+var DEFAULT_TIMEOUT_MS3 = 5 * 60000;
+var DEFAULT_EVALUATION_ID = "evaluation";
+var WORKER_PATH = fileURLToPath3(new URL("./sandbox-worker.mjs", import.meta.url));
+var toError3 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
+var createSandboxWorker = () => fork3(WORKER_PATH, [], { silent: true });
+var describeWorkerExit = (code2, signal, stderr) => {
+  const stderrSuffix = stderr.trim().length > 0 ? `
+${stderr.trim()}` : "";
+  if (signal) {
+    return new Error(`SES worker exited from signal ${signal}${stderrSuffix}`);
+  }
+  if (typeof code2 === "number") {
+    return new Error(`SES worker exited with code ${code2}${stderrSuffix}`);
+  }
+  return new Error(`SES worker exited before returning a result${stderrSuffix}`);
+};
+var sendMessage = (child, message) => {
+  if (typeof child.send !== "function") {
+    throw new Error("SES worker IPC channel is unavailable");
+  }
+  child.send(message);
+};
+var evaluateInSandbox = async (options9, code2, toolInvoker) => {
+  const child = createSandboxWorker();
+  const timeoutMs = options9.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
+  const stderrChunks = [];
+  if (child.stderr) {
+    child.stderr.on("data", (chunk4) => {
+      stderrChunks.push(chunk4.toString());
+    });
+  }
+  return new Promise((resolve3, reject) => {
+    let settled = false;
+    let timeoutHandle;
+    const cleanup = () => {
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+        timeoutHandle = undefined;
+      }
+      child.off("error", onError4);
+      child.off("exit", onExit4);
+      child.off("message", onMessage);
+      if (!child.killed) {
+        child.kill();
+      }
+    };
+    const settle = (effect3) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      effect3();
+    };
+    const resetTimeout = () => {
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+      }
+      timeoutHandle = setTimeout(() => {
+        settle(() => {
+          reject(new Error(`Execution timed out after ${timeoutMs}ms`));
+        });
+      }, timeoutMs);
+    };
+    const onError4 = (error51) => {
+      settle(() => {
+        reject(error51);
+      });
+    };
+    const onExit4 = (code3, signal) => {
+      settle(() => {
+        reject(describeWorkerExit(code3, signal, stderrChunks.join("")));
+      });
+    };
+    const onMessage = (message) => {
+      if (message.type === "ready") {
+        resetTimeout();
+        sendMessage(child, {
+          type: "evaluate",
+          id: DEFAULT_EVALUATION_ID,
+          code: code2,
+          allowFetch: options9.allowFetch === true
+        });
+        return;
+      }
+      if (message.type === "tool-call") {
+        resetTimeout();
+        runPromise(toolInvoker.invoke({ path: message.path, args: message.args })).then((value7) => {
+          if (settled) {
+            return;
+          }
+          resetTimeout();
+          sendMessage(child, {
+            type: "tool-response",
+            callId: message.callId,
+            value: value7
+          });
+        }).catch((cause2) => {
+          if (settled) {
+            return;
+          }
+          resetTimeout();
+          const error51 = toError3(cause2);
+          sendMessage(child, {
+            type: "tool-response",
+            callId: message.callId,
+            error: error51.stack ?? error51.message
+          });
+        });
+        return;
+      }
+      if (message.type === "result") {
+        settle(() => {
+          if (message.error) {
+            resolve3({
+              result: null,
+              error: message.error,
+              logs: message.logs ?? []
+            });
+            return;
+          }
+          resolve3({
+            result: message.value,
+            logs: message.logs ?? []
+          });
+        });
+      }
+    };
+    child.on("error", onError4);
+    child.on("exit", onExit4);
+    child.on("message", onMessage);
+    resetTimeout();
+  });
+};
+var runInSes = (options9, code2, toolInvoker) => tryPromise2({
+  try: () => evaluateInSandbox(options9, code2, toolInvoker),
+  catch: toError3
+});
+var makeSesExecutor = (options9 = {}) => ({
+  execute: (code2, toolInvoker) => runInSes(options9, code2, toolInvoker)
+});
+
 // packages/control-plane/src/runtime/local-config.ts
 import { homedir } from "node:os";
 import { basename, dirname as dirname2, isAbsolute, join as join5, resolve as resolve3 } from "node:path";
@@ -409721,6 +410176,7 @@ var mergeLocalExecutorConfigs = (base, extra) => {
     return null;
   }
   return decodeLocalExecutorConfig({
+    runtime: extra?.runtime ?? base?.runtime,
     workspace: {
       ...base?.workspace ?? {},
       ...extra?.workspace ?? {}
@@ -411090,7 +411546,7 @@ var createExecutorToolMap = (input) => ({
 });
 
 // packages/control-plane/src/runtime/mcp-oauth.ts
-var toError3 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
+var toError4 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
 var toJsonObject = (value7) => value7 !== null && value7 !== undefined && typeof value7 === "object" && !Array.isArray(value7) ? value7 : null;
 var createClientMetadata = (redirectUrl) => ({
   redirect_uris: [redirectUrl],
@@ -411140,7 +411596,7 @@ var startMcpOAuthAuthorization = (input) => gen2(function* () {
     try: () => auth2(provider, {
       serverUrl: input.endpoint
     }),
-    catch: toError3
+    catch: toError4
   });
   if (result !== "REDIRECT" || !captured.authorizationUrl || !captured.codeVerifier) {
     return yield* fail8(new Error("OAuth flow did not produce an authorization redirect"));
@@ -411199,7 +411655,7 @@ var exchangeMcpOAuthAuthorizationCode = (input) => gen2(function* () {
       serverUrl: input.session.endpoint,
       authorizationCode: input.code
     }),
-    catch: toError3
+    catch: toError4
   });
   if (result !== "AUTHORIZED" || !captured.tokens) {
     return yield* fail8(new Error("OAuth redirect did not complete MCP OAuth setup"));
@@ -411216,7 +411672,7 @@ var exchangeMcpOAuthAuthorizationCode = (input) => gen2(function* () {
 
 // packages/control-plane/src/runtime/secret-material-providers.ts
 import { randomUUID } from "node:crypto";
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 import { promises as fs2 } from "node:fs";
 import { lstatSync, realpathSync } from "node:fs";
 import { isAbsolute as isAbsolute2 } from "node:path";
@@ -411294,7 +411750,7 @@ var keychainCommandForPlatform = (platform = process.platform) => {
 };
 var runCommand = (input) => tryPromise2({
   try: () => new Promise((resolve4, reject) => {
-    const child = spawn(input.command, [...input.args], {
+    const child = spawn2(input.command, [...input.args], {
       stdio: "pipe",
       env: input.env
     });
@@ -411361,7 +411817,7 @@ var commandExists = (command) => tryPromise2({
       return cached5;
     }
     const probe = new Promise((resolve4) => {
-      const child = spawn(command, ["--help"], {
+      const child = spawn2(command, ["--help"], {
         stdio: "ignore"
       });
       const timeout3 = setTimeout(() => {
@@ -412227,6 +412683,9 @@ var refreshOAuth2AccessToken = (input) => gen2(function* () {
   if (input.clientAuthentication === "client_secret_post" && input.clientSecret) {
     body2.set("client_secret", input.clientSecret);
   }
+  if (input.scopes && input.scopes.length > 0) {
+    body2.set("scope", input.scopes.join(" "));
+  }
   return yield* postFormToOAuth2TokenEndpoint({
     tokenEndpoint: input.tokenEndpoint,
     body: body2
@@ -412362,7 +412821,8 @@ var refreshProviderGrantRefArtifact = (input) => gen2(function* () {
     clientId: oauthClient.clientId,
     clientAuthentication: grant.clientAuthentication,
     clientSecret,
-    refreshToken
+    refreshToken,
+    scopes: config3.requiredScopes.length > 0 ? config3.requiredScopes : null
   });
   const storeSecretMaterial = createDefaultSecretMaterialStorer({
     rows: input.rows
@@ -417885,9 +418345,9 @@ var removePolicy = (input) => gen2(function* () {
 
 // packages/control-plane/src/runtime/local-tools.ts
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync } from "node:fs";
+import { existsSync as existsSync2 } from "node:fs";
 import { dirname as dirname3, extname, join as join9, relative, resolve as resolve4, sep } from "node:path";
-import { fileURLToPath as fileURLToPath2, pathToFileURL as pathToFileURL2 } from "node:url";
+import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL2 } from "node:url";
 var ts = __toESM(require_typescript(), 1);
 var SUPPORTED_LOCAL_TOOL_EXTENSIONS = new Set([".ts", ".js", ".mjs"]);
 var LOCAL_TOOLS_DIRECTORY = "tools";
@@ -418032,10 +418492,10 @@ var transpileSourceFile = (input) => gen2(function* () {
   return rewriteRelativeImportSpecifiers(transpiled.outputText);
 });
 var resolveExecutorNodeModulesDirectory = () => {
-  let current = dirname3(fileURLToPath2(import.meta.url));
+  let current = dirname3(fileURLToPath4(import.meta.url));
   while (true) {
     const candidate = join9(current, "node_modules");
-    if (existsSync(candidate)) {
+    if (existsSync2(candidate)) {
       return candidate;
     }
     const parent = dirname3(current);
@@ -418209,6 +418669,19 @@ var LocalToolRuntimeLoaderLive = effect(LocalToolRuntimeLoaderService, gen2(func
 
 // packages/control-plane/src/runtime/workspace-execution-environment.ts
 var asToolPath4 = (value7) => value7;
+var DEFAULT_EXECUTION_RUNTIME = "quickjs";
+var resolveConfiguredExecutionRuntime = (config3) => config3?.runtime ?? DEFAULT_EXECUTION_RUNTIME;
+var createCodeExecutorForRuntime = (runtime5) => {
+  switch (runtime5) {
+    case "deno":
+      return makeDenoSubprocessExecutor();
+    case "ses":
+      return makeSesExecutor();
+    case "quickjs":
+    default:
+      return makeQuickJsExecutor();
+  }
+};
 var tokenize2 = (value7) => value7.trim().toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
 var LOW_SIGNAL_QUERY_TOKENS = new Set([
   "a",
@@ -418549,6 +419022,7 @@ var createWorkspaceToolInvoker = (input) => {
 };
 var createWorkspaceExecutionEnvironmentResolver = (input) => ({ workspaceId, accountId, onElicitation }) => gen2(function* () {
   const runtimeLocalWorkspace = yield* getRuntimeLocalWorkspaceOption();
+  const loadedConfig = runtimeLocalWorkspace === null ? null : yield* input.workspaceConfigStore.load(runtimeLocalWorkspace.context);
   const localToolRuntime = runtimeLocalWorkspace === null ? {
     tools: {},
     catalog: createToolCatalogFromTools({ tools: {} }),
@@ -418568,7 +419042,7 @@ var createWorkspaceExecutionEnvironmentResolver = (input) => ({ workspaceId, acc
     localToolRuntime,
     onElicitation
   });
-  const executor = makeQuickJsExecutor();
+  const executor = createCodeExecutorForRuntime(resolveConfiguredExecutionRuntime(loadedConfig?.config));
   return {
     executor,
     toolInvoker,
@@ -419837,7 +420311,7 @@ import { pathToFileURL as pathToFileURL4 } from "url";
 import assert32 from "assert";
 import { statSync, realpathSync as realpathSync2 } from "fs";
 import process4 from "process";
-import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL3 } from "url";
+import { fileURLToPath as fileURLToPath42, pathToFileURL as pathToFileURL3 } from "url";
 import path7 from "path";
 import { builtinModules } from "module";
 import { fileURLToPath as fileURLToPath32 } from "url";
@@ -421083,7 +421557,7 @@ var utils = {
 // node_modules/prettier/index.mjs
 import { equal, ok, strictEqual } from "assert";
 import path11 from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { fileURLToPath as fileURLToPath52 } from "url";
 import path13 from "path";
 import { pathToFileURL as pathToFileURL5 } from "url";
 import path12 from "path";
@@ -433602,9 +434076,9 @@ function emitInvalidSegmentDeprecation(target, request, match18, packageJsonUrl,
   if (process4.noDeprecation) {
     return;
   }
-  const pjsonPath = fileURLToPath4(packageJsonUrl);
+  const pjsonPath = fileURLToPath42(packageJsonUrl);
   const double = doubleSlashRegEx.exec(isTarget ? target : request) !== null;
-  process4.emitWarning(`Use of deprecated ${double ? "double slash" : "leading or trailing slash matching"} resolving "${target}" for module request "${request}" ${request === match18 ? "" : `matched to "${match18}" `}in the "${internal ? "imports" : "exports"}" field module resolution of the package at ${pjsonPath}${base ? ` imported from ${fileURLToPath4(base)}` : ""}.`, "DeprecationWarning", "DEP0166");
+  process4.emitWarning(`Use of deprecated ${double ? "double slash" : "leading or trailing slash matching"} resolving "${target}" for module request "${request}" ${request === match18 ? "" : `matched to "${match18}" `}in the "${internal ? "imports" : "exports"}" field module resolution of the package at ${pjsonPath}${base ? ` imported from ${fileURLToPath42(base)}` : ""}.`, "DeprecationWarning", "DEP0166");
 }
 function emitLegacyIndexDeprecation(url32, packageJsonUrl, base, main) {
   if (process4.noDeprecation) {
@@ -433613,9 +434087,9 @@ function emitLegacyIndexDeprecation(url32, packageJsonUrl, base, main) {
   const format32 = defaultGetFormatWithoutErrors(url32, { parentURL: base.href });
   if (format32 !== "module")
     return;
-  const urlPath = fileURLToPath4(url32.href);
-  const packagePath = fileURLToPath4(new URL(".", packageJsonUrl));
-  const basePath = fileURLToPath4(base);
+  const urlPath = fileURLToPath42(url32.href);
+  const packagePath = fileURLToPath42(new URL(".", packageJsonUrl));
+  const basePath = fileURLToPath42(base);
   if (!main) {
     process4.emitWarning(`No "main" or "exports" field defined in the package.json for ${packagePath} resolving the main entry point "${urlPath.slice(packagePath.length)}", imported from ${basePath}.
 Default "index" lookups for the main are deprecated for ES modules.`, "DeprecationWarning", "DEP0151");
@@ -433672,15 +434146,15 @@ function legacyMainResolve(packageJsonUrl, packageConfig, base) {
     emitLegacyIndexDeprecation(guess, packageJsonUrl, base, packageConfig.main);
     return guess;
   }
-  throw new ERR_MODULE_NOT_FOUND(fileURLToPath4(new URL(".", packageJsonUrl)), fileURLToPath4(base));
+  throw new ERR_MODULE_NOT_FOUND(fileURLToPath42(new URL(".", packageJsonUrl)), fileURLToPath42(base));
 }
 function finalizeResolution(resolved, base, preserveSymlinks) {
   if (encodedSeparatorRegEx.exec(resolved.pathname) !== null) {
-    throw new ERR_INVALID_MODULE_SPECIFIER(resolved.pathname, 'must not include encoded "/" or "\\" characters', fileURLToPath4(base));
+    throw new ERR_INVALID_MODULE_SPECIFIER(resolved.pathname, 'must not include encoded "/" or "\\" characters', fileURLToPath42(base));
   }
   let filePath;
   try {
-    filePath = fileURLToPath4(resolved);
+    filePath = fileURLToPath42(resolved);
   } catch (error51) {
     const cause2 = error51;
     Object.defineProperty(cause2, "input", { value: String(resolved) });
@@ -433689,12 +434163,12 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
   }
   const stats = tryStatSync(filePath.endsWith("/") ? filePath.slice(-1) : filePath);
   if (stats && stats.isDirectory()) {
-    const error51 = new ERR_UNSUPPORTED_DIR_IMPORT(filePath, fileURLToPath4(base));
+    const error51 = new ERR_UNSUPPORTED_DIR_IMPORT(filePath, fileURLToPath42(base));
     error51.url = String(resolved);
     throw error51;
   }
   if (!stats || !stats.isFile()) {
-    const error51 = new ERR_MODULE_NOT_FOUND(filePath || resolved.pathname, base && fileURLToPath4(base), true);
+    const error51 = new ERR_MODULE_NOT_FOUND(filePath || resolved.pathname, base && fileURLToPath42(base), true);
     error51.url = String(resolved);
     throw error51;
   }
@@ -433708,18 +434182,18 @@ function finalizeResolution(resolved, base, preserveSymlinks) {
   return resolved;
 }
 function importNotDefined(specifier, packageJsonUrl, base) {
-  return new ERR_PACKAGE_IMPORT_NOT_DEFINED(specifier, packageJsonUrl && fileURLToPath4(new URL(".", packageJsonUrl)), fileURLToPath4(base));
+  return new ERR_PACKAGE_IMPORT_NOT_DEFINED(specifier, packageJsonUrl && fileURLToPath42(new URL(".", packageJsonUrl)), fileURLToPath42(base));
 }
 function exportsNotFound(subpath, packageJsonUrl, base) {
-  return new ERR_PACKAGE_PATH_NOT_EXPORTED(fileURLToPath4(new URL(".", packageJsonUrl)), subpath, base && fileURLToPath4(base));
+  return new ERR_PACKAGE_PATH_NOT_EXPORTED(fileURLToPath42(new URL(".", packageJsonUrl)), subpath, base && fileURLToPath42(base));
 }
 function throwInvalidSubpath(request, match18, packageJsonUrl, internal, base) {
-  const reason = `request is not a valid match in pattern "${match18}" for the "${internal ? "imports" : "exports"}" resolution of ${fileURLToPath4(packageJsonUrl)}`;
-  throw new ERR_INVALID_MODULE_SPECIFIER(request, reason, base && fileURLToPath4(base));
+  const reason = `request is not a valid match in pattern "${match18}" for the "${internal ? "imports" : "exports"}" resolution of ${fileURLToPath42(packageJsonUrl)}`;
+  throw new ERR_INVALID_MODULE_SPECIFIER(request, reason, base && fileURLToPath42(base));
 }
 function invalidPackageTarget(subpath, target, packageJsonUrl, internal, base) {
   target = typeof target === "object" && target !== null ? JSON.stringify(target, null, "") : `${target}`;
-  return new ERR_INVALID_PACKAGE_TARGET(fileURLToPath4(new URL(".", packageJsonUrl)), subpath, target, internal, base && fileURLToPath4(base));
+  return new ERR_INVALID_PACKAGE_TARGET(fileURLToPath42(new URL(".", packageJsonUrl)), subpath, target, internal, base && fileURLToPath42(base));
 }
 function resolvePackageTargetString(target, subpath, match18, packageJsonUrl, base, pattern2, internal, isPathMap, conditions) {
   if (subpath !== "" && !pattern2 && target[target.length - 1] !== "/")
@@ -433819,7 +434293,7 @@ function resolvePackageTarget(packageJsonUrl, target, subpath, packageSubpath, b
     while (++i5 < keys6.length) {
       const key2 = keys6[i5];
       if (isArrayIndex(key2)) {
-        throw new ERR_INVALID_PACKAGE_CONFIG2(fileURLToPath4(packageJsonUrl), base, '"exports" cannot contain numeric property keys.');
+        throw new ERR_INVALID_PACKAGE_CONFIG2(fileURLToPath42(packageJsonUrl), base, '"exports" cannot contain numeric property keys.');
       }
     }
     i5 = -1;
@@ -433855,7 +434329,7 @@ function isConditionalExportsMainSugar(exports, packageJsonUrl, base) {
     if (i5++ === 0) {
       isConditionalSugar = currentIsConditionalSugar;
     } else if (isConditionalSugar !== currentIsConditionalSugar) {
-      throw new ERR_INVALID_PACKAGE_CONFIG2(fileURLToPath4(packageJsonUrl), base, `"exports" cannot contain some keys starting with '.' and some not. The exports object must either be an object of package subpath keys or an object of main entry condition name keys only.`);
+      throw new ERR_INVALID_PACKAGE_CONFIG2(fileURLToPath42(packageJsonUrl), base, `"exports" cannot contain some keys starting with '.' and some not. The exports object must either be an object of package subpath keys or an object of main entry condition name keys only.`);
     }
   }
   return isConditionalSugar;
@@ -433864,11 +434338,11 @@ function emitTrailingSlashPatternDeprecation(match18, pjsonUrl, base) {
   if (process4.noDeprecation) {
     return;
   }
-  const pjsonPath = fileURLToPath4(pjsonUrl);
+  const pjsonPath = fileURLToPath42(pjsonUrl);
   if (emittedPackageWarnings.has(pjsonPath + "|" + match18))
     return;
   emittedPackageWarnings.add(pjsonPath + "|" + match18);
-  process4.emitWarning(`Use of deprecated trailing slash pattern mapping "${match18}" in the "exports" field module resolution of the package at ${pjsonPath}${base ? ` imported from ${fileURLToPath4(base)}` : ""}. Mapping specifiers ending in "/" is no longer supported.`, "DeprecationWarning", "DEP0155");
+  process4.emitWarning(`Use of deprecated trailing slash pattern mapping "${match18}" in the "exports" field module resolution of the package at ${pjsonPath}${base ? ` imported from ${fileURLToPath42(base)}` : ""}. Mapping specifiers ending in "/" is no longer supported.`, "DeprecationWarning", "DEP0155");
 }
 function packageExportsResolve(packageJsonUrl, packageSubpath, packageConfig, base, conditions) {
   let exports = packageConfig.exports;
@@ -433933,7 +434407,7 @@ function patternKeyCompare(a5, b5) {
 function packageImportsResolve(name2, base, conditions) {
   if (name2 === "#" || name2.startsWith("#/") || name2.endsWith("/")) {
     const reason = "is not a valid internal imports specifier name";
-    throw new ERR_INVALID_MODULE_SPECIFIER(name2, reason, fileURLToPath4(base));
+    throw new ERR_INVALID_MODULE_SPECIFIER(name2, reason, fileURLToPath42(base));
   }
   let packageJsonUrl;
   const packageConfig = getPackageScopeConfig(base);
@@ -433991,7 +434465,7 @@ function parsePackageName(specifier, base) {
     validPackageName = false;
   }
   if (!validPackageName) {
-    throw new ERR_INVALID_MODULE_SPECIFIER(specifier, "is not a valid package name", fileURLToPath4(base));
+    throw new ERR_INVALID_MODULE_SPECIFIER(specifier, "is not a valid package name", fileURLToPath42(base));
   }
   const packageSubpath = "." + (separatorIndex === -1 ? "" : specifier.slice(separatorIndex));
   return { packageName, packageSubpath, isScoped };
@@ -434009,14 +434483,14 @@ function packageResolve(specifier, base, conditions) {
     }
   }
   let packageJsonUrl = new URL("./node_modules/" + packageName + "/package.json", base);
-  let packageJsonPath = fileURLToPath4(packageJsonUrl);
+  let packageJsonPath = fileURLToPath42(packageJsonUrl);
   let lastPath;
   do {
     const stat22 = tryStatSync(packageJsonPath.slice(0, -13));
     if (!stat22 || !stat22.isDirectory()) {
       lastPath = packageJsonPath;
       packageJsonUrl = new URL((isScoped ? "../../../../node_modules/" : "../../../node_modules/") + packageName + "/package.json", packageJsonUrl);
-      packageJsonPath = fileURLToPath4(packageJsonUrl);
+      packageJsonPath = fileURLToPath42(packageJsonUrl);
       continue;
     }
     const packageConfig2 = read22(packageJsonPath, { base, specifier });
@@ -434028,7 +434502,7 @@ function packageResolve(specifier, base, conditions) {
     }
     return new URL(packageSubpath, packageJsonUrl);
   } while (packageJsonPath.length !== lastPath.length);
-  throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath4(base), false);
+  throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath42(base), false);
 }
 function isRelativeSpecifier(specifier) {
   if (specifier[0] === ".") {
@@ -435721,7 +436195,7 @@ function getLanguageByIsSupported(languages2, file10) {
   }
   if (isUrl(file10)) {
     try {
-      file10 = fileURLToPath5(file10);
+      file10 = fileURLToPath52(file10);
     } catch {
       return;
     }
@@ -440147,7 +440621,7 @@ var ControlPlaneApiLive = exports_HttpApiBuilder.api(ControlPlaneApi).pipe(provi
 var createControlPlaneApiLayer = (runtimeLayer) => ControlPlaneApiLive.pipe(provide3(runtimeLayer));
 // packages/control-plane/src/runtime/local-control-plane-store.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 import { mkdir as mkdir2, readFile as readFile4, rename as rename5, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname6, join as join12 } from "node:path";
 var LOCAL_CONTROL_PLANE_STATE_VERSION = 1;
@@ -440213,7 +440687,7 @@ var sortByUpdatedAtAndIdDesc = (values4) => [...values4].sort((left3, right3) =>
 var localControlPlaneStatePath = (context7) => join12(context7.homeStateDirectory, "workspaces", deriveLocalInstallation(context7).workspaceId, LOCAL_CONTROL_PLANE_STATE_BASENAME);
 var readStateFromDisk = async (context7) => {
   const path15 = localControlPlaneStatePath(context7);
-  if (!existsSync2(path15)) {
+  if (!existsSync3(path15)) {
     return defaultLocalControlPlaneState();
   }
   const content = await readFile4(path15, "utf8");
@@ -440674,7 +441148,7 @@ var createLocalControlPlanePersistence = (context7) => ({
 });
 
 // packages/control-plane/src/runtime/legacy-postgres-migration.ts
-import { existsSync as existsSync4, readFileSync } from "node:fs";
+import { existsSync as existsSync5, readFileSync } from "node:fs";
 import { mkdir as mkdir3, rename as rename6, unlink } from "node:fs/promises";
 import { join as join14, resolve as resolve7 } from "node:path";
 
@@ -448268,7 +448742,7 @@ var trimOrNull8 = (value7) => {
   const trimmed2 = value7.trim();
   return trimmed2.length > 0 ? trimmed2 : null;
 };
-var toError4 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
+var toError5 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
 var asRecord7 = (value7) => value7 !== null && typeof value7 === "object" && !Array.isArray(value7) ? value7 : {};
 var asString8 = (value7) => {
   const trimmed2 = trimOrNull8(value7);
@@ -448492,7 +448966,7 @@ var isPostgresUrl = (value7) => {
 };
 var cleanupStalePGliteLock = async (dataDir) => {
   const lockPath = join14(dataDir, "postmaster.pid");
-  if (!existsSync4(lockPath)) {
+  if (!existsSync5(lockPath)) {
     return;
   }
   try {
@@ -448512,7 +448986,7 @@ var openLegacyPGliteClient = async (localDataDir) => {
     return null;
   }
   const resolvedDataDir = resolve7(localDataDir);
-  if (!existsSync4(resolvedDataDir)) {
+  if (!existsSync5(resolvedDataDir)) {
     return null;
   }
   await mkdir3(resolvedDataDir, { recursive: true });
@@ -448613,7 +449087,7 @@ var backupLegacyPGliteDataDir = async (localDataDir) => {
     return null;
   }
   const resolvedDataDir = resolve7(localDataDir);
-  if (!existsSync4(resolvedDataDir)) {
+  if (!existsSync5(resolvedDataDir)) {
     return null;
   }
   const backupPath = `${resolvedDataDir}.migrated-backup-${Date.now()}`;
@@ -448670,7 +449144,7 @@ var tryLoadLegacyWorkspaceSnapshot = async (input) => {
 };
 var targetControlPlaneStatePath = (context7) => join14(context7.homeStateDirectory, "workspaces", deriveLocalInstallation(context7).workspaceId, LOCAL_CONTROL_PLANE_STATE_BASENAME2);
 var targetWorkspaceStatePath = (context7) => join14(context7.stateDirectory, WORKSPACE_STATE_BASENAME2);
-var workspaceAlreadyInitialized = (context7) => existsSync4(context7.projectConfigPath) || existsSync4(targetWorkspaceStatePath(context7)) || existsSync4(targetControlPlaneStatePath(context7));
+var workspaceAlreadyInitialized = (context7) => existsSync5(context7.projectConfigPath) || existsSync5(targetWorkspaceStatePath(context7)) || existsSync5(targetControlPlaneStatePath(context7));
 var mapLegacySecretRef = (input) => ({
   providerId: input.providerId === LEGACY_POSTGRES_SECRET_PROVIDER_ID ? LOCAL_SECRET_PROVIDER_ID2 : input.providerId,
   handle: input.handle
@@ -449221,7 +449695,7 @@ var migrateLegacyPostgresWorkspaceIfNeeded = (input) => gen2(function* () {
       localDataDir: input.legacyLocalDataDir,
       databaseUrl: input.legacyDatabaseUrl
     }),
-    catch: toError4
+    catch: toError5
   });
   if (loadedSnapshot === null) {
     return;
@@ -449231,7 +449705,7 @@ var migrateLegacyPostgresWorkspaceIfNeeded = (input) => gen2(function* () {
       context: input.context,
       snapshot: loadedSnapshot.snapshot
     }),
-    catch: toError4
+    catch: toError5
   });
   yield* writeProjectLocalExecutorConfig({
     context: input.context,
@@ -449254,7 +449728,7 @@ var migrateLegacyPostgresWorkspaceIfNeeded = (input) => gen2(function* () {
     const legacyLocalDataDir = loadedSnapshot.source.localDataDir;
     const backupExit = yield* exit2(tryPromise2({
       try: () => backupLegacyPGliteDataDir(legacyLocalDataDir),
-      catch: toError4
+      catch: toError5
     }));
     yield* sync3(() => {
       if (backupExit._tag === "Success" && backupExit.value !== null) {
@@ -449359,7 +449833,7 @@ var createControlPlaneClient = (input) => exports_HttpApiClient.make(ControlPlan
   baseUrl: input.baseUrl
 }).pipe(provide2(exports_FetchHttpClient.layer));
 // packages/server/src/index.ts
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { mkdir as mkdir4, readFile as readFile5, rename as rename7, rm as rm4, stat as stat4, writeFile as writeFile4 } from "node:fs/promises";
 import {
   createServer as createNodeServer
@@ -451589,7 +452063,7 @@ import { homedir as homedir2 } from "node:os";
 import { join as join16 } from "node:path";
 
 // packages/server/src/env.ts
-import { existsSync as existsSync5, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync6, readFileSync as readFileSync2 } from "node:fs";
 import { dirname as dirname7, join as join15, resolve as resolve8 } from "node:path";
 var parseEnvFile = (content) => {
   const values5 = {};
@@ -451621,7 +452095,7 @@ var parseEnvFile = (content) => {
 };
 var isWorkspaceRoot = (directory5) => {
   const packageJsonPath = join15(directory5, "package.json");
-  if (!existsSync5(packageJsonPath)) {
+  if (!existsSync6(packageJsonPath)) {
     return false;
   }
   try {
@@ -451658,7 +452132,7 @@ var loadMonorepoRootEnv = (options10 = {}) => {
   const loadedFiles = [];
   for (const fileName of [".env", ".env.local"]) {
     const filePath = join15(rootDir, fileName);
-    if (!existsSync5(filePath)) {
+    if (!existsSync6(filePath)) {
       continue;
     }
     const parsed = parseEnvFile(readFileSync2(filePath, "utf8"));
@@ -452320,7 +452794,7 @@ var createRuntime = (localDataDir, getLocalServerBaseUrl, options10) => createCo
 var moveLegacyLocalDataDir = (legacyLocalDataDir, requestedLocalDataDir) => tryPromise2({
   try: async () => {
     await mkdir4(dirname8(requestedLocalDataDir), { recursive: true });
-    if (existsSync6(requestedLocalDataDir)) {
+    if (existsSync7(requestedLocalDataDir)) {
       const backupPath = `${requestedLocalDataDir}.backup-${Date.now()}`;
       await rename7(requestedLocalDataDir, backupPath);
       console.warn(`[executor] Backed up unreadable local data dir to: ${backupPath}`);
@@ -452331,7 +452805,7 @@ var moveLegacyLocalDataDir = (legacyLocalDataDir, requestedLocalDataDir) => tryP
   catch: (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2))
 });
 var createRuntimeWithLegacyMigration = (requestedLocalDataDir, legacyLocalDataDirs, getLocalServerBaseUrl, options10) => gen2(function* () {
-  if (requestedLocalDataDir !== ":memory:" && !existsSync6(requestedLocalDataDir) && legacyLocalDataDirs.length > 0) {
+  if (requestedLocalDataDir !== ":memory:" && !existsSync7(requestedLocalDataDir) && legacyLocalDataDirs.length > 0) {
     for (const legacyLocalDataDir of legacyLocalDataDirs) {
       const legacyExit = yield* exit2(createRuntime(legacyLocalDataDir, getLocalServerBaseUrl, options10));
       if (isFailure(legacyExit)) {
@@ -452491,7 +452965,7 @@ var isApiRequest = (request) => {
 };
 var createLocalExecutorRequestHandler = (options10 = {}) => gen2(function* () {
   const requestedLocalDataDir = options10.localDataDir ?? DEFAULT_LOCAL_DATA_DIR;
-  const legacyLocalDataDirs = options10.localDataDir === undefined ? DEFAULT_LEGACY_LOCAL_DATA_DIRS.filter((candidate) => existsSync6(candidate)) : [];
+  const legacyLocalDataDirs = options10.localDataDir === undefined ? DEFAULT_LEGACY_LOCAL_DATA_DIRS.filter((candidate) => existsSync7(candidate)) : [];
   if (requestedLocalDataDir !== ":memory:") {
     yield* tryPromise2({
       try: () => mkdir4(dirname8(requestedLocalDataDir), { recursive: true }),
@@ -452763,7 +453237,7 @@ var seedGithubOpenApiSourceInWorkspace = (input) => gen2(function* () {
 });
 
 // apps/executor/src/cli/runtime-paths.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { dirname as dirname9, extname as extname4, resolve as resolve10 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 var sourceDir = dirname9(fileURLToPath6(import.meta.url));
@@ -452777,7 +453251,7 @@ var resolveIfExists = (value7) => {
     return null;
   }
   const resolved = resolve10(candidate);
-  return existsSync7(resolved) ? resolved : null;
+  return existsSync8(resolved) ? resolved : null;
 };
 var getSourceEntrypoint = () => {
   const candidate = trim4(process.argv[1]);
@@ -452790,21 +453264,21 @@ var getSourceEntrypoint = () => {
 };
 var resolveBundledNodeLauncher = () => {
   const candidate = resolve10(sourceDir, "executor.js");
-  return existsSync7(candidate) ? candidate : null;
+  return existsSync8(candidate) ? candidate : null;
 };
 var resolveRuntimeResourcesRoot = () => {
   const compiledCandidate = resolve10(dirname9(process.execPath), "../resources");
-  if (existsSync7(compiledCandidate)) {
+  if (existsSync8(compiledCandidate)) {
     return compiledCandidate;
   }
   const bundledCandidateFromModule = resolve10(sourceDir, "../resources");
-  if (existsSync7(bundledCandidateFromModule)) {
+  if (existsSync8(bundledCandidateFromModule)) {
     return bundledCandidateFromModule;
   }
   const sourceEntrypoint = getSourceEntrypoint();
   if (sourceEntrypoint) {
     const bundledCandidate = resolve10(dirname9(sourceEntrypoint), "../resources");
-    if (existsSync7(bundledCandidate)) {
+    if (existsSync8(bundledCandidate)) {
       return bundledCandidate;
     }
   }
@@ -452923,12 +453397,12 @@ var decideInteractionHandling = (input) => {
 };
 
 // apps/executor/src/cli/main.ts
-var toError5 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
+var toError6 = (cause2) => cause2 instanceof Error ? cause2 : new Error(String(cause2));
 var sleep6 = (ms8) => promise2(() => new Promise((resolve12) => setTimeout(resolve12, ms8)));
 var openUrlInBrowser = (url4) => sync3(() => {
   const cmd = process.platform === "darwin" ? ["open", url4] : process.platform === "win32" ? ["cmd", "/c", "start", "", url4] : ["xdg-open", url4];
   try {
-    const child = spawn2(cmd[0], cmd.slice(1), {
+    const child = spawn3(cmd[0], cmd.slice(1), {
       detached: true,
       stdio: "ignore"
     });
@@ -452950,7 +453424,7 @@ var promptLine = (prompt4) => tryPromise2({
       rl5.close();
     }
   },
-  catch: toError5
+  catch: toError6
 });
 var readStdin = () => tryPromise2({
   try: async () => {
@@ -452961,7 +453435,7 @@ var readStdin = () => tryPromise2({
     }
     return contents;
   },
-  catch: toError5
+  catch: toError6
 });
 var readCode = (input) => gen2(function* () {
   if (input.code && input.code.trim().length > 0) {
@@ -452970,7 +453444,7 @@ var readCode = (input) => gen2(function* () {
   if (input.file && input.file.trim().length > 0) {
     const contents = yield* tryPromise2({
       try: () => readFile6(input.file, "utf8"),
-      catch: toError5
+      catch: toError6
     });
     if (contents.trim().length > 0) {
       return contents;
@@ -452987,7 +453461,7 @@ var readCode = (input) => gen2(function* () {
 });
 var getBootstrapClient = (baseUrl2 = DEFAULT_SERVER_BASE_URL) => createControlPlaneClient({ baseUrl: baseUrl2 });
 var decodeExecutionId = decodeUnknown2(ExecutionIdSchema);
-var cliSourceDir = dirname10(fileURLToPath8(import.meta.url));
+var cliSourceDir = dirname10(fileURLToPath7(import.meta.url));
 var CLI_NAME = "executor";
 var CLI_VERSION = (() => {
   const candidatePaths = [
@@ -452995,7 +453469,7 @@ var CLI_VERSION = (() => {
     resolve11(cliSourceDir, "../../package.json")
   ];
   for (const candidatePath of candidatePaths) {
-    if (!existsSync8(candidatePath)) {
+    if (!existsSync9(candidatePath)) {
       continue;
     }
     try {
@@ -453063,17 +453537,17 @@ var formatCatalogUnavailableMessage = (cause2) => {
 };
 var closeRuntime = (runtime6) => tryPromise2({
   try: () => runtime6.close(),
-  catch: toError5
+  catch: toError6
 }).pipe(catchAll2(() => _void));
 var buildRunWorkflowText = (catalog2) => {
   if (!catalog2) {
     return succeed8(DEFAULT_RUN_WORKFLOW);
   }
-  return catalog2.listNamespaces({ limit: 200 }).pipe(map16((namespaces) => buildWorkflowText(namespaces.length > 0 ? namespaces.map((namespace) => namespace.displayName ?? namespace.namespace) : ["none discovered yet"])), mapError2(toError5));
+  return catalog2.listNamespaces({ limit: 200 }).pipe(map16((namespaces) => buildWorkflowText(namespaces.length > 0 ? namespaces.map((namespace) => namespace.displayName ?? namespace.namespace) : ["none discovered yet"])), mapError2(toError6));
 };
 var loadRunWorkflowText = () => acquireUseRelease2(createControlPlaneRuntime({
   localDataDir: DEFAULT_LOCAL_DATA_DIR
-}).pipe(mapError2(toError5)), (runtime6) => gen2(function* () {
+}).pipe(mapError2(toError6)), (runtime6) => gen2(function* () {
   const environment2 = yield* gen2(function* () {
     const resolveExecutionEnvironment = yield* RuntimeExecutionResolverService;
     return yield* resolveExecutionEnvironment({
@@ -453081,7 +453555,7 @@ var loadRunWorkflowText = () => acquireUseRelease2(createControlPlaneRuntime({
       accountId: runtime6.localInstallation.accountId,
       executionId: ExecutionIdSchema.make("exec_help")
     });
-  }).pipe(provide2(runtime6.runtimeLayer), mapError2(toError5));
+  }).pipe(provide2(runtime6.runtimeLayer), mapError2(toError6));
   return yield* buildRunWorkflowText(environment2.catalog);
 }), closeRuntime).pipe(catchAllCause2((cause2) => succeed8([
   DEFAULT_RUN_WORKFLOW,
@@ -453196,7 +453670,7 @@ var startServerInBackground = (port2) => tryPromise2({
     await mkdir5(dirname10(DEFAULT_SERVER_LOG_FILE), { recursive: true });
     const logHandle = await open3(DEFAULT_SERVER_LOG_FILE, "a");
     try {
-      const child = spawn2(command[0], command.slice(1), {
+      const child = spawn3(command[0], command.slice(1), {
         detached: true,
         stdio: ["ignore", logHandle.fd, logHandle.fd]
       });
@@ -453205,7 +453679,7 @@ var startServerInBackground = (port2) => tryPromise2({
       await logHandle.close();
     }
   },
-  catch: toError5
+  catch: toError6
 });
 var readPidRecord = () => tryPromise2({
   try: async () => {
@@ -453258,7 +453732,7 @@ var waitForReachability = (baseUrl2, expected) => gen2(function* () {
   }
   const error51 = yield* tryPromise2({
     try: () => buildReachabilityTimeoutError(baseUrl2, expected),
-    catch: toError5
+    catch: toError6
   });
   return yield* fail8(error51);
 });
@@ -453691,8 +454165,8 @@ var doctorCommand = exports_Command.make("doctor", {
 `))))).pipe(exports_Command.withDescription("Check local executor install and daemon health"));
 var getDenoVersion = () => tryPromise2({
   try: () => new Promise((resolve12) => {
-    const denoExecutable = process.env.DENO_BIN?.trim() || (process.env.HOME && existsSync8(`${process.env.HOME}/.deno/bin/deno`) ? `${process.env.HOME}/.deno/bin/deno` : "deno");
-    const child = spawn2(denoExecutable, ["--version"], {
+    const denoExecutable = process.env.DENO_BIN?.trim() || (process.env.HOME && existsSync9(`${process.env.HOME}/.deno/bin/deno`) ? `${process.env.HOME}/.deno/bin/deno` : "deno");
+    const child = spawn3(denoExecutable, ["--version"], {
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 5000
     });
@@ -453771,7 +454245,7 @@ var resumeCommand = exports_Command.make("resume", {
 }, ({ executionId, baseUrl: baseUrl2, noOpen }) => gen2(function* () {
   yield* ensureServer(baseUrl2);
   const { installation, client: client2 } = yield* getLocalAuthedClient(baseUrl2);
-  const decodedExecutionId = yield* decodeExecutionId(executionId).pipe(mapError2((cause2) => toError5(cause2)));
+  const decodedExecutionId = yield* decodeExecutionId(executionId).pipe(mapError2((cause2) => toError6(cause2)));
   const execution2 = yield* client2.executions.get({
     path: {
       workspaceId: installation.workspaceId,
@@ -453841,7 +454315,7 @@ var hiddenServer = () => {
     ...getDefaultServerOptions(Number.isInteger(port2) && port2 > 0 ? port2 : DEFAULT_SERVER_PORT)
   });
 };
-var program = (hiddenServer() ?? helpOverride() ?? runCli(toEffectCliArgv(getCliArgs())).pipe(mapError2(toError5))).pipe(provide2(exports_NodeFileSystem.layer)).pipe(provide2(exports_NodePath.layer)).pipe(catchAllCause2((cause2) => sync3(() => {
+var program = (hiddenServer() ?? helpOverride() ?? runCli(toEffectCliArgv(getCliArgs())).pipe(mapError2(toError6))).pipe(provide2(exports_NodeFileSystem.layer)).pipe(provide2(exports_NodePath.layer)).pipe(catchAllCause2((cause2) => sync3(() => {
   console.error(pretty2(cause2));
   process.exitCode = 1;
 })));