open-managed-agents 0.1.0

package/dist/src/control-plane/secrets/envelope.js

@@ -0,0 +1,132 @@
+// Envelope-encryption primitives for the SecretsStore (ADR 0016 §4; shape
+// validated by scratch/45-envelope-encryption-probe.ts, 11/11).
+//
+// Each secret is encrypted under a random per-secret DEK (AES-256-GCM); the
+// DEK is wrapped by a KEK derived HKDF-SHA256(masterKey, info="oma-kek:<kekId>").
+// Both layers bind an AAD (`<version>:<recordId>` on the ciphertext,
+// `<version>:<kekId>:<recordId>` on the wrap) so a ciphertext copied onto
+// another record fails to open. KEK rotation rewraps the DEK only — the
+// ciphertext bytes are never touched.
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, } from "node:crypto";
+export const ENVELOPE_FORMAT_VERSION = "v1";
+export const MASTER_KEY_BYTES = 32;
+// kekId is a fingerprint of the master key (first 12 hex of SHA-256), not a
+// counter: `open` can tell "sealed under a different master key" apart from
+// corruption, and rotation selects rows to rewrap by the old fingerprint.
+export function kekIdFor(masterKey) {
+    assertMasterKey(masterKey);
+    return createHash("sha256").update(masterKey).digest("hex").slice(0, 12);
+}
+export function assertMasterKey(masterKey) {
+    if (!Buffer.isBuffer(masterKey) || masterKey.length !== MASTER_KEY_BYTES) {
+        throw new Error(`master key must be exactly ${MASTER_KEY_BYTES} random bytes ` +
+            "(HKDF is not a password KDF — see ADR 0016 §4)");
+    }
+}
+// KEK = HKDF-SHA256(masterKey, info=`oma-kek:<kekId>`): the raw master bytes
+// are never used directly as a cipher key.
+function deriveKek(masterKey, kekId) {
+    return Buffer.from(hkdfSync("sha256", masterKey, Buffer.alloc(0), `oma-kek:${kekId}`, 32));
+}
+function gcmSeal(key, plaintext, aad) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    cipher.setAAD(aad);
+    const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return { iv, tag: cipher.getAuthTag(), ct };
+}
+function gcmOpen(key, iv, tag, ct, aad) {
+    // Pin authTagLength = 16 AND reject short tags explicitly. Without the pin
+    // node:crypto ACCEPTS a truncated tag (probe 45 (6b): a 4-byte tag decrypts
+    // with only a DEP0182 warning), degrading forgery resistance from 2^128 to
+    // 2^32 — and the tag is an attacker-writable DB column.
+    if (tag.length !== 16) {
+        throw new Error(`bad auth tag length: ${tag.length} (expected 16)`);
+    }
+    const decipher = createDecipheriv("aes-256-gcm", key, iv, {
+        authTagLength: 16,
+    });
+    decipher.setAuthTag(tag);
+    decipher.setAAD(aad);
+    return Buffer.concat([decipher.update(ct), decipher.final()]);
+}
+export function seal(masterKey, recordId, plaintext) {
+    const kekId = kekIdFor(masterKey);
+    const kek = deriveKek(masterKey, kekId);
+    const dek = randomBytes(32);
+    try {
+        const aad = Buffer.from(`${ENVELOPE_FORMAT_VERSION}:${recordId}`);
+        const body = gcmSeal(dek, plaintext, aad);
+        // The wrap layer binds the same record with the kekId added — defense in
+        // depth, and the wrap is exactly the seam a KMS backend plugs into later.
+        const wrapAad = Buffer.from(`${ENVELOPE_FORMAT_VERSION}:${kekId}:${recordId}`);
+        const wrapped = gcmSeal(kek, dek, wrapAad);
+        return {
+            version: ENVELOPE_FORMAT_VERSION,
+            kekId,
+            wrapIv: wrapped.iv,
+            wrapTag: wrapped.tag,
+            wrappedDek: wrapped.ct,
+            ctIv: body.iv,
+            ctTag: body.tag,
+            ct: body.ct,
+        };
+    }
+    finally {
+        dek.fill(0); // best-effort scrub; Node makes no hard guarantee
+        kek.fill(0);
+    }
+}
+export function open(masterKey, recordId, sealed) {
+    const currentKekId = kekIdFor(masterKey);
+    if (sealed.kekId !== currentKekId) {
+        throw new Error(`secret is sealed under a different master key (kekId ${sealed.kekId}, ` +
+            `current key is ${currentKekId}) — rotate or supply the original key`);
+    }
+    const kek = deriveKek(masterKey, sealed.kekId);
+    let dek;
+    try {
+        const wrapAad = Buffer.from(`${sealed.version}:${sealed.kekId}:${recordId}`);
+        dek = gcmOpen(kek, sealed.wrapIv, sealed.wrapTag, sealed.wrappedDek, wrapAad);
+        const aad = Buffer.from(`${sealed.version}:${recordId}`);
+        return gcmOpen(dek, sealed.ctIv, sealed.ctTag, sealed.ct, aad);
+    }
+    finally {
+        dek?.fill(0);
+        kek.fill(0);
+    }
+}
+// Rotation: unwrap the DEK with the old master key, rewrap with the new one.
+// ct / ctIv / ctTag are deliberately untouched — the point of the envelope.
+// Note (ADR 0016 §4): this limits blast radius going forward; it does not
+// revoke a key that leaked alongside a pre-rotation DB copy.
+export function rewrap(oldMasterKey, newMasterKey, recordId, sealed) {
+    const oldKekId = kekIdFor(oldMasterKey);
+    if (sealed.kekId !== oldKekId) {
+        throw new Error(`cannot rewrap: secret is sealed under kekId ${sealed.kekId}, ` +
+            `but the supplied old key is ${oldKekId}`);
+    }
+    const newKekId = kekIdFor(newMasterKey);
+    const oldKek = deriveKek(oldMasterKey, sealed.kekId);
+    const newKek = deriveKek(newMasterKey, newKekId);
+    let dek;
+    try {
+        const oldWrapAad = Buffer.from(`${sealed.version}:${sealed.kekId}:${recordId}`);
+        dek = gcmOpen(oldKek, sealed.wrapIv, sealed.wrapTag, sealed.wrappedDek, oldWrapAad);
+        const newWrapAad = Buffer.from(`${sealed.version}:${newKekId}:${recordId}`);
+        const rewrapped = gcmSeal(newKek, dek, newWrapAad);
+        return {
+            ...sealed,
+            kekId: newKekId,
+            wrapIv: rewrapped.iv,
+            wrapTag: rewrapped.tag,
+            wrappedDek: rewrapped.ct,
+            // ct / ctIv / ctTag deliberately unchanged
+        };
+    }
+    finally {
+        dek?.fill(0);
+        oldKek.fill(0);
+        newKek.fill(0);
+    }
+}

package/dist/src/control-plane/secrets/master-key.js

@@ -0,0 +1,44 @@
+// Master-key loading contract (ADR 0016 §4). The key is exactly 32 random
+// bytes, base64-encoded, supplied via OMA_MASTER_KEY (the value) or
+// OMA_MASTER_KEY_FILE (path to a file holding the value — the docker-compose
+// secrets idiom). Anything else is refused: HKDF is not a password KDF, and a
+// low-entropy passphrase here would make the DB offline-brute-forceable.
+import { readFileSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { MASTER_KEY_BYTES } from "./envelope.js";
+export const MASTER_KEY_ENV = "OMA_MASTER_KEY";
+export const MASTER_KEY_FILE_ENV = "OMA_MASTER_KEY_FILE";
+// Fresh base64 master key, for first-run instructions and docs.
+export function generateMasterKey() {
+    return randomBytes(MASTER_KEY_BYTES).toString("base64");
+}
+// Strict parse: canonical base64 of exactly 32 bytes. Buffer.from(_, "base64")
+// is lenient (ignores junk, tolerates truncation), so we require the decoded
+// bytes to re-encode to the exact input — this rejects passphrases, hex, and
+// mangled keys instead of silently deriving from garbage.
+export function parseMasterKey(value, source) {
+    const trimmed = value.trim();
+    const decoded = Buffer.from(trimmed, "base64");
+    if (decoded.length !== MASTER_KEY_BYTES ||
+        decoded.toString("base64") !== trimmed) {
+        throw new Error(`${source} must be exactly ${MASTER_KEY_BYTES} random bytes, ` +
+            `base64-encoded (generate one with: node -e "console.log(` +
+            `require('crypto').randomBytes(32).toString('base64'))")`);
+    }
+    return decoded;
+}
+export function loadMasterKey(env = process.env) {
+    const direct = env[MASTER_KEY_ENV];
+    const file = env[MASTER_KEY_FILE_ENV];
+    if (direct !== undefined && file !== undefined) {
+        throw new Error(`set exactly one of ${MASTER_KEY_ENV} or ${MASTER_KEY_FILE_ENV}, not both`);
+    }
+    if (direct !== undefined) {
+        return parseMasterKey(direct, MASTER_KEY_ENV);
+    }
+    if (file !== undefined) {
+        return parseMasterKey(readFileSync(file, "utf8"), `${MASTER_KEY_FILE_ENV} (${file})`);
+    }
+    throw new Error(`secrets require a master key: set ${MASTER_KEY_ENV} (base64) or ` +
+        `${MASTER_KEY_FILE_ENV} (path to a file holding the base64 value)`);
+}

package/dist/src/control-plane/secrets/routes.js

@@ -0,0 +1,20 @@
+import { Hono } from "hono";
+import { parseJsonBody } from "../http.js";
+import { workspaceIdFrom } from "../workspace.js";
+// OMA-specific surface (plan 0117e-2): POST upserts { name, value } and
+// returns metadata only — no route ever returns a secret value.
+export function secretsRoutes(service) {
+    const app = new Hono();
+    app.post("/", async (c) => {
+        const body = await parseJsonBody(c.req);
+        return c.json(service.create(workspaceIdFrom(c), body), 201);
+    });
+    app.get("/", (c) => {
+        return c.json(service.list(workspaceIdFrom(c)), 200);
+    });
+    app.delete("/:name", (c) => {
+        service.delete(workspaceIdFrom(c), c.req.param("name"));
+        return c.body(null, 204);
+    });
+    return app;
+}

package/dist/src/control-plane/secrets/service.js

@@ -0,0 +1,71 @@
+// Minimal workspace-scoped secrets management surface (plan 0117e-2, ADR
+// 0016 §4). Values are WRITE-ONLY at this layer: no method ever returns a
+// secret's plaintext — `reveal` stays exclusive to the egress injection
+// boundary (0117c). Authorization is the single workspace tier every other
+// managed-agents route uses (plan 0117e §"Authorization model"): the
+// sandboxed agent never holds the workspace key, so it structurally cannot
+// reach this service.
+import { invalidRequest, notFound } from "../errors.js";
+import { VAULT_SECRET_PREFIX } from "../vaults/store.js";
+export const MAX_SECRET_NAME_LENGTH = 256;
+export class DefaultSecretsService {
+    store;
+    // undefined = no master key configured; every route then fails with a
+    // clear 400 instead of pretending secrets exist.
+    constructor(store) {
+        this.store = store;
+    }
+    create(workspaceId, input) {
+        const store = this.requireStore();
+        const { name, value } = parseCreateSecret(input);
+        if (name.startsWith(VAULT_SECRET_PREFIX)) {
+            throw invalidRequest(`Secret names starting with ${JSON.stringify(VAULT_SECRET_PREFIX)} are reserved`);
+        }
+        return toManagedSecret(store.put(workspaceId, name, value));
+    }
+    list(workspaceId) {
+        return this.requireStore()
+            .list(workspaceId)
+            .filter((row) => !row.name.startsWith(VAULT_SECRET_PREFIX))
+            .map(toManagedSecret);
+    }
+    delete(workspaceId, name) {
+        if (name.startsWith(VAULT_SECRET_PREFIX)) {
+            throw invalidRequest(`Secret names starting with ${JSON.stringify(VAULT_SECRET_PREFIX)} are reserved`);
+        }
+        if (!this.requireStore().delete(workspaceId, name)) {
+            throw notFound(`Secret ${name} not found`);
+        }
+    }
+    requireStore() {
+        if (this.store === undefined) {
+            throw invalidRequest("Secrets require a master key: set OMA_MASTER_KEY or OMA_MASTER_KEY_FILE on the deployment");
+        }
+        return this.store;
+    }
+}
+function parseCreateSecret(input) {
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        throw invalidRequest("Request body must be a JSON object");
+    }
+    const { name, value } = input;
+    if (typeof name !== "string" || name.length === 0) {
+        throw invalidRequest("`name` must be a non-empty string");
+    }
+    if (name.length > MAX_SECRET_NAME_LENGTH) {
+        throw invalidRequest(`\`name\` must be at most ${MAX_SECRET_NAME_LENGTH} characters`);
+    }
+    if (typeof value !== "string" || value.length === 0) {
+        throw invalidRequest("`value` must be a non-empty string");
+    }
+    return { name, value };
+}
+function toManagedSecret(row) {
+    return {
+        id: row.id,
+        type: "secret",
+        name: row.name,
+        created_at: row.created_at,
+        updated_at: row.updated_at,
+    };
+}

package/dist/src/control-plane/secrets/store.js

@@ -0,0 +1,212 @@
+import { DatabaseSync } from "node:sqlite";
+import { withSqliteTransaction } from "../sqlite-transaction.js";
+import { newSecretId } from "../ids.js";
+import { assertMasterKey, kekIdFor, open, rewrap, seal, } from "./envelope.js";
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS secrets_config (
+  id              INTEGER PRIMARY KEY CHECK (id = 1),
+  current_kek_id  TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS secrets (
+  id            TEXT PRIMARY KEY,
+  workspace_id  TEXT NOT NULL,
+  name          TEXT NOT NULL,
+  version       TEXT NOT NULL,
+  kek_id        TEXT NOT NULL,
+  wrap_iv       BLOB NOT NULL,
+  wrap_tag      BLOB NOT NULL,
+  wrapped_dek   BLOB NOT NULL,
+  ct_iv         BLOB NOT NULL,
+  ct_tag        BLOB NOT NULL,
+  ct            BLOB NOT NULL,
+  created_at    TEXT NOT NULL,
+  updated_at    TEXT NOT NULL,
+  UNIQUE (workspace_id, name)
+);
+`;
+export class SqliteSecretsStore {
+    db;
+    masterKey;
+    kekId;
+    configGetStmt;
+    configSetStmt;
+    insertStmt;
+    resealStmt;
+    selectStmt;
+    listStmt;
+    deleteStmt;
+    selectAllStmt;
+    rewrapStmt;
+    constructor(db, masterKey) {
+        assertMasterKey(masterKey);
+        this.db = db;
+        // Copy: the caller's buffer must not be able to mutate the store's key,
+        // and rotateMasterKey scrubs the old one.
+        this.masterKey = Buffer.from(masterKey);
+        this.kekId = kekIdFor(this.masterKey);
+        this.db.exec(SCHEMA);
+        this.configGetStmt = this.db.prepare(`SELECT current_kek_id FROM secrets_config WHERE id = 1`);
+        this.configSetStmt = this.db.prepare(`INSERT INTO secrets_config (id, current_kek_id) VALUES (1, ?)
+       ON CONFLICT (id) DO UPDATE SET current_kek_id = excluded.current_kek_id`);
+        // Claim or validate the database-wide key epoch (adversarial-review
+        // finding): the first store to open an empty DB records its key
+        // fingerprint; any later store must present the SAME key, so a process
+        // holding a retired key fails fast here instead of writing rows nobody
+        // can read.
+        withSqliteTransaction(this.db, () => {
+            const current = this.currentConfigKekId();
+            if (current === undefined) {
+                this.configSetStmt.run(this.kekId);
+            }
+            else if (current !== this.kekId) {
+                throw new Error(`secrets database is keyed to a different master key (current ` +
+                    `kekId ${current}, supplied key is ${this.kekId}) — supply the ` +
+                    `active key, or rotate from it`);
+            }
+        });
+        this.insertStmt = this.db.prepare(`INSERT INTO secrets (
+        id, workspace_id, name, version, kek_id,
+        wrap_iv, wrap_tag, wrapped_dek, ct_iv, ct_tag, ct,
+        created_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+        this.resealStmt = this.db.prepare(`UPDATE secrets SET
+        version = ?, kek_id = ?,
+        wrap_iv = ?, wrap_tag = ?, wrapped_dek = ?, ct_iv = ?, ct_tag = ?, ct = ?,
+        updated_at = ?
+      WHERE id = ?`);
+        this.selectStmt = this.db.prepare(`SELECT * FROM secrets WHERE workspace_id = ? AND name = ?`);
+        this.listStmt = this.db.prepare(`SELECT id, workspace_id, name, created_at, updated_at FROM secrets
+       WHERE workspace_id = ? ORDER BY name ASC`);
+        this.deleteStmt = this.db.prepare(`DELETE FROM secrets WHERE workspace_id = ? AND name = ?`);
+        this.selectAllStmt = this.db.prepare(`SELECT * FROM secrets`);
+        this.rewrapStmt = this.db.prepare(`UPDATE secrets SET kek_id = ?, wrap_iv = ?, wrap_tag = ?, wrapped_dek = ?
+       WHERE id = ?`);
+    }
+    static open(path, masterKey) {
+        return new SqliteSecretsStore(new DatabaseSync(path), masterKey);
+    }
+    put(workspaceId, name, value) {
+        if (workspaceId === "" || name === "") {
+            throw new Error("workspaceId and name must be non-empty");
+        }
+        const now = new Date().toISOString();
+        // The write transaction re-checks the key epoch: a store constructed
+        // before a rotation must not seal new rows under the retired key — the
+        // rotated store could never read them (adversarial-review finding).
+        return withSqliteTransaction(this.db, () => {
+            this.assertActiveKey();
+            const existing = this.selectStmt.get(workspaceId, name);
+            // An upsert keeps the row id and re-seals under a fresh DEK.
+            const id = existing?.id ?? newSecretId();
+            const sealed = seal(this.masterKey, recordBinding(id, workspaceId, name), Buffer.from(value, "utf8"));
+            if (existing) {
+                this.resealStmt.run(sealed.version, sealed.kekId, sealed.wrapIv, sealed.wrapTag, sealed.wrappedDek, sealed.ctIv, sealed.ctTag, sealed.ct, now, id);
+                return {
+                    id,
+                    workspace_id: workspaceId,
+                    name,
+                    created_at: existing.created_at,
+                    updated_at: now,
+                };
+            }
+            this.insertStmt.run(id, workspaceId, name, sealed.version, sealed.kekId, sealed.wrapIv, sealed.wrapTag, sealed.wrappedDek, sealed.ctIv, sealed.ctTag, sealed.ct, now, now);
+            return {
+                id,
+                workspace_id: workspaceId,
+                name,
+                created_at: now,
+                updated_at: now,
+            };
+        });
+    }
+    reveal(workspaceId, name) {
+        const row = this.selectStmt.get(workspaceId, name);
+        if (!row)
+            return undefined;
+        const plaintext = open(this.masterKey, recordBinding(row.id, workspaceId, name), sealedFromRow(row));
+        const value = plaintext.toString("utf8");
+        plaintext.fill(0);
+        return value;
+    }
+    list(workspaceId) {
+        const rows = this.listStmt.all(workspaceId);
+        return rows.map((row) => ({
+            id: row.id,
+            workspace_id: row.workspace_id,
+            name: row.name,
+            created_at: row.created_at,
+            updated_at: row.updated_at,
+        }));
+    }
+    delete(workspaceId, name) {
+        return this.deleteStmt.run(workspaceId, name).changes > 0;
+    }
+    rotateMasterKey(newMasterKey) {
+        assertMasterKey(newMasterKey);
+        const oldKey = this.masterKey;
+        const next = Buffer.from(newMasterKey);
+        const nextKekId = kekIdFor(next);
+        const count = withSqliteTransaction(this.db, () => {
+            // Only the store holding the ACTIVE key may rotate; the epoch flips in
+            // the same transaction as the rewraps, so writers serialize against it.
+            this.assertActiveKey();
+            const rows = this.selectAllStmt.all();
+            for (const row of rows) {
+                const rotated = rewrap(oldKey, next, recordBinding(row.id, row.workspace_id, row.name), sealedFromRow(row));
+                this.rewrapStmt.run(rotated.kekId, rotated.wrapIv, rotated.wrapTag, rotated.wrappedDek, row.id);
+            }
+            this.configSetStmt.run(nextKekId);
+            return rows.length;
+        });
+        this.masterKey = next;
+        this.kekId = nextKekId;
+        oldKey.fill(0);
+        return count;
+    }
+    currentConfigKekId() {
+        const row = this.configGetStmt.get();
+        return row?.current_kek_id;
+    }
+    assertActiveKey() {
+        const current = this.currentConfigKekId();
+        if (current !== this.kekId) {
+            throw new Error(`this store holds a retired master key (kekId ${this.kekId}, the ` +
+                `database is keyed to ${current}) — reopen with the active key`);
+        }
+    }
+    /** Fingerprint of the store's current master key (for diagnostics/tests). */
+    currentKekId() {
+        return kekIdFor(this.masterKey);
+    }
+    // Zero the in-process master key without closing the db — for durable
+    // deployments where the db is shared and closed once elsewhere, so close()
+    // is skipped but the key must still be scrubbed on shutdown.
+    scrubMasterKey() {
+        this.masterKey.fill(0);
+    }
+    close() {
+        this.scrubMasterKey();
+        this.db.close();
+    }
+}
+// The AAD record binding covers the immutable row id AND the addressing
+// metadata (workspace_id, name): a DB-write attacker can neither copy a
+// ciphertext onto another row (id differs) nor relabel a row into another
+// workspace/name slot (metadata differs) — either way `open` fails. JSON
+// encoding keeps the three components unambiguous regardless of their
+// contents. There is no rename API, so the binding never needs to move.
+function recordBinding(id, workspaceId, name) {
+    return JSON.stringify([id, workspaceId, name]);
+}
+function sealedFromRow(row) {
+    return {
+        version: row.version,
+        kekId: row.kek_id,
+        wrapIv: Buffer.from(row.wrap_iv),
+        wrapTag: Buffer.from(row.wrap_tag),
+        wrappedDek: Buffer.from(row.wrapped_dek),
+        ctIv: Buffer.from(row.ct_iv),
+        ctTag: Buffer.from(row.ct_tag),
+        ct: Buffer.from(row.ct),
+    };
+}

package/dist/src/control-plane/secrets/types.js

@@ -0,0 +1,3 @@
+// SecretsStore contract (plan 0118, ADR 0016 §4). Deliberately small — it
+// grows only when 0117c (credential injection) pulls on it.
+export {};

package/dist/src/control-plane/sessions/pi/custom-tools.js

@@ -0,0 +1,146 @@
+import { defineTool } from "@earendil-works/pi-coding-agent";
+const DEFAULT_CUSTOM_TOOL_TIMEOUT_MS = 5 * 60 * 1000;
+export class PiCustomToolBridge {
+    opts;
+    pending = new Map();
+    timeoutMs;
+    constructor(opts = {}) {
+        this.opts = opts;
+        this.timeoutMs = opts.timeoutMs ?? DEFAULT_CUSTOM_TOOL_TIMEOUT_MS;
+    }
+    customToolNames(workspaceId, sessionId, context) {
+        return new Set((this.opts.customTools?.(workspaceId, sessionId, context) ?? []).map((tool) => tool.name));
+    }
+    createTools(workspaceId, sessionId, getEmitter, context) {
+        return (this.opts.customTools?.(workspaceId, sessionId, context) ?? []).map((tool) => defineTool({
+            name: tool.name,
+            label: tool.name,
+            description: tool.description ?? tool.name,
+            parameters: tool.input_schema,
+            execute: async (piToolCallId, params, signal) => this.awaitResult(workspaceId, sessionId, tool.name, piToolCallId, params, signal, getEmitter),
+        }));
+    }
+    claimResult(workspaceId, sessionId, event) {
+        const pending = this.pending.get(event.custom_tool_use_id);
+        if (!pending)
+            return undefined;
+        if (pending.workspaceId !== workspaceId || pending.sessionId !== sessionId) {
+            return undefined;
+        }
+        return () => {
+            this.pending.delete(event.custom_tool_use_id);
+            pending.cleanup();
+            pending.resolve({
+                content: event.content,
+                is_error: event.is_error,
+            });
+        };
+    }
+    rejectSession(sessionId, error) {
+        for (const [id, pending] of this.pending) {
+            if (pending.sessionId !== sessionId)
+                continue;
+            this.pending.delete(id);
+            pending.cleanup();
+            pending.reject(error);
+        }
+    }
+    async awaitResult(workspaceId, sessionId, name, piToolCallId, params, signal, getEmitter) {
+        const emit = getEmitter();
+        if (!emit) {
+            throw new Error(`No active runtime consumer for custom tool ${name}`);
+        }
+        let customToolUseId;
+        const result = await new Promise((resolve, reject) => {
+            let released = false;
+            let releaseCustomToolUseId;
+            const cleanup = (reason) => {
+                if (released)
+                    return;
+                released = true;
+                signal?.removeEventListener("abort", onAbort);
+                if (timer)
+                    clearTimeout(timer);
+                releaseCustomToolUseId?.(reason);
+            };
+            const onAbort = () => {
+                if (customToolUseId)
+                    this.pending.delete(customToolUseId);
+                cleanup("interrupted");
+                reject(new Error(`Custom tool ${name} aborted`));
+            };
+            signal?.addEventListener("abort", onAbort, { once: true });
+            const timer = this.timeoutMs > 0
+                ? setTimeout(() => {
+                    if (customToolUseId)
+                        this.pending.delete(customToolUseId);
+                    cleanup("timeout");
+                    reject(new Error(`Custom tool ${name} timed out`));
+                }, this.timeoutMs)
+                : undefined;
+            try {
+                emit({
+                    type: "oma.custom_tool_use",
+                    piToolCallId,
+                    name,
+                    input: isRecord(params) ? params : {},
+                    bindCustomToolUseId: (id, release) => {
+                        customToolUseId = id;
+                        releaseCustomToolUseId = release;
+                        this.pending.set(id, {
+                            workspaceId,
+                            sessionId,
+                            resolve,
+                            reject,
+                            cleanup,
+                        });
+                    },
+                    rejectCustomToolUse: (error) => {
+                        if (customToolUseId)
+                            this.pending.delete(customToolUseId);
+                        cleanup();
+                        reject(error);
+                    },
+                });
+            }
+            catch (error) {
+                if (customToolUseId)
+                    this.pending.delete(customToolUseId);
+                cleanup();
+                reject(toError(error));
+            }
+        });
+        if (result.is_error === true) {
+            throw new Error(toolErrorMessage(name, result.content));
+        }
+        return {
+            content: toPiToolContent(result.content),
+            details: {},
+        };
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toPiToolContent(content) {
+    if (!content || content.length === 0)
+        return [];
+    return content.map((block) => {
+        if (block.type === "text" &&
+            "text" in block &&
+            typeof block.text === "string") {
+            return { type: "text", text: block.text };
+        }
+        return { type: "text", text: JSON.stringify(block) };
+    });
+}
+function toolErrorMessage(name, content) {
+    const text = toPiToolContent(content)
+        .map((block) => block.text)
+        .join("\n")
+        .trim();
+    return text.length > 0 ? text : `Custom tool ${name} returned an error`;
+}
+function toError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}