open-multi-agent-kit 0.80.5 → 0.80.7

package/dist/core/sandbox/spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../../../src/core/sandbox/spawn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA0B,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EACN,gBAAgB,EAChB,qBAAqB,GAKrB,MAAM,aAAa,CAAC;AAqBrB,SAAS,UAAU,CAAC,GAAsB,EAA0B;IACnE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,QAAQ,CAAC,QAAyB,EAAyB;IACnE,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,CACvC;AAED,SAAS,cAAc,CACtB,QAAyB,EACzB,KAAiC,EACjC,GAA2B,EACH;IACxB,OAAO;QACN,GAAG,QAAQ;QACX,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG;QACH,OAAO,EAAE,KAAK;KACd,CAAC;AAAA,CACF;AAED,SAAS,eAAe,CAAC,KAAiC,EAAE,GAA2B,EAAqB;IAC3G,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG;QACH,UAAU,EAAE;YACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS;YAC5C,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU;YAC9C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS;YAC5C,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS;SAC5C;QACD,OAAO,EAAE;YACR,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI;YAC/B,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc;YACnD,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa;SACjD;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAiC,EAAyB;IACpG,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACjC,OAAO,cAAc,CACpB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,6BAA6B,EAAE,EAC7E,KAAK,EACL,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CACrB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GACb,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,WAAmB,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5G,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACrC,OAAO,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC;QACJ,OAAO;YACN,GAAG,QAAQ;YACX,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAClE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG;YACH,OAAO,EAAE,IAAI;SACb,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC;IACH,CAAC;AAAA,CACD","sourcesContent":["import { buildBackendArgv, type SandboxInvocation } from \"./backend.ts\";\nimport { filterSandboxEnv } from \"./env.ts\";\nimport { resolveSandboxPath } from \"./path-resolver.ts\";\nimport {\n\tdecidePathAccess,\n\tdecideSandboxFallback,\n\ttype SandboxBackendStatus,\n\ttype SandboxDecision,\n\ttype SandboxPathResolver,\n\ttype SandboxPolicy,\n} from \"./policy.ts\";\n\nexport interface SandboxedSpawnRequestInput {\n\treadonly argv: readonly string[];\n\treadonly cwd: string;\n\treadonly env: NodeJS.ProcessEnv;\n\treadonly policy: SandboxPolicy;\n\treadonly backend: SandboxBackendStatus;\n\treadonly resolver?: SandboxPathResolver;\n}\n\nexport type SandboxedSpawnRequest =\n\t| (SandboxDecision & { readonly allowed: false })\n\t| (SandboxDecision & {\n\t\t\treadonly allowed: true;\n\t\t\treadonly argv: readonly string[];\n\t\t\treadonly cwd: string;\n\t\t\treadonly env: Record<string, string>;\n\t\t\treadonly wrapped: boolean;\n\t  });\n\nfunction compactEnv(env: NodeJS.ProcessEnv): Record<string, string> {\n\tconst result: Record<string, string> = {};\n\tfor (const [key, value] of Object.entries(env)) {\n\t\tif (value !== undefined) result[key] = value;\n\t}\n\treturn result;\n}\n\nfunction denyFrom(decision: SandboxDecision): SandboxedSpawnRequest {\n\treturn { ...decision, allowed: false };\n}\n\nfunction allowUnwrapped(\n\tdecision: SandboxDecision,\n\tinput: SandboxedSpawnRequestInput,\n\tenv: Record<string, string>,\n): SandboxedSpawnRequest {\n\treturn {\n\t\t...decision,\n\t\tallowed: true,\n\t\targv: input.argv,\n\t\tcwd: input.cwd,\n\t\tenv,\n\t\twrapped: false,\n\t};\n}\n\nfunction buildInvocation(input: SandboxedSpawnRequestInput, env: Record<string, string>): SandboxInvocation {\n\treturn {\n\t\targv: input.argv,\n\t\tcwd: input.cwd,\n\t\tenv,\n\t\tfilesystem: {\n\t\t\troot: input.policy.filesystem.root,\n\t\t\treadAllow: input.policy.filesystem.readAllow,\n\t\t\twriteAllow: input.policy.filesystem.writeAllow,\n\t\t\ttempWrite: input.policy.filesystem.tempWrite,\n\t\t\tdenyWrite: input.policy.filesystem.denyWrite,\n\t\t},\n\t\tnetwork: {\n\t\t\tmode: input.policy.network.mode,\n\t\t\tallowedDomains: input.policy.network.allowedDomains,\n\t\t\tdeniedDomains: input.policy.network.deniedDomains,\n\t\t},\n\t};\n}\n\nexport function buildSandboxedSpawnRequest(input: SandboxedSpawnRequestInput): SandboxedSpawnRequest {\n\tif (input.policy.mode === \"off\") {\n\t\treturn allowUnwrapped(\n\t\t\t{ allowed: true, rule: \"sandbox.off\", reason: \"Sandbox policy is disabled.\" },\n\t\t\tinput,\n\t\t\tcompactEnv(input.env),\n\t\t);\n\t}\n\n\tconst resolver =\n\t\tinput.resolver ?? ((requestPath: string) => resolveSandboxPath(input.policy.filesystem.root, requestPath));\n\tconst cwdDecision = decidePathAccess(input.policy, { kind: \"read\", path: input.cwd }, resolver);\n\tif (!cwdDecision.allowed) {\n\t\treturn denyFrom(cwdDecision);\n\t}\n\n\tconst env = filterSandboxEnv(input.env);\n\tconst fallback = decideSandboxFallback(input.policy, input.backend);\n\tif (!fallback.allowed || !fallback.allowShell || !fallback.allowExec) {\n\t\treturn denyFrom(fallback);\n\t}\n\tif (!input.backend.backendAvailable) {\n\t\treturn allowUnwrapped(fallback, input, env);\n\t}\n\n\ttry {\n\t\treturn {\n\t\t\t...fallback,\n\t\t\tallowed: true,\n\t\t\targv: buildBackendArgv(input.backend, buildInvocation(input, env)),\n\t\t\tcwd: input.cwd,\n\t\t\tenv,\n\t\t\twrapped: true,\n\t\t};\n\t} catch (error) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\trule: \"sandbox.wrap_failed\",\n\t\t\treason: error instanceof Error ? error.message : String(error),\n\t\t};\n\t}\n}\n"]}

package/dist/core/sdk.d.ts

@@ -1,13 +1,17 @@
-import { type ThinkingLevel } from "@earendil-works/omk-agent-core";
-import { type Model } from "@earendil-works/omk-ai";
+import { type StreamFn, type ThinkingLevel } from "@earendil-works/omk-agent-core";
+import { type BeforeProviderNetworkRequest, type Model, type ProviderNetworkDecision, type ProviderNetworkRequest } from "@earendil-works/omk-ai";
 import { AgentSession } from "./agent-session.ts";
 import { AuthStorage } from "./auth-storage.ts";
 import type { LoadExtensionsResult, SessionStartEvent, ToolDefinition } from "./extensions/index.ts";
+import type { ExtensionExecSandbox } from "./extensions/types.ts";
+import type { LoadoutAccessPolicy } from "./loadout-access-policy.ts";
 import { ModelRegistry } from "./model-registry.ts";
+import type { PackageTrialRuntimeOptions } from "./package-manager.ts";
 import type { ResourceLoader } from "./resource-loader.ts";
+import { type SandboxPolicy } from "./sandbox/policy.ts";
 import { SessionManager } from "./session-manager.ts";
 import { SettingsManager } from "./settings-manager.ts";
-import { createBashTool, createCodingTools, createEditTool, createFindTool, createGrepTool, createLsTool, createReadOnlyTools, createReadTool, createWriteTool, withFileMutationQueue } from "./tools/index.ts";
+import { type BashSandboxPreflight, createBashTool, createCodingTools, createEditTool, createFindTool, createGrepTool, createLsTool, createReadOnlyTools, createReadTool, createWriteTool, withFileMutationQueue } from "./tools/index.ts";
 export interface CreateAgentSessionOptions {
     /** Working directory for project-local discovery. Default: process.cwd() */
     cwd?: string;
@@ -37,7 +41,7 @@ export interface CreateAgentSessionOptions {
     /**
      * Optional allowlist of tool names.
      *
-     * When omitted, pi enables the default built-in tools (read, bash, edit, write)
+     * When omitted, omk enables the default built-in tools (read, bash, edit, write)
      * and leaves extension/custom tools enabled unless `noTools` changes that default.
      * When provided, only the listed tool names are enabled.
      */
@@ -54,6 +58,23 @@ export interface CreateAgentSessionOptions {
     settingsManager?: SettingsManager;
     /** Session start event metadata for extension runtime startup. */
     sessionStartEvent?: SessionStartEvent;
+    /**
+     * Optional provider network policy. When omitted, no provider network
+     * preflight is installed (current behavior preserved). When set, a
+     * sanitized preflight runs before API key/header resolution and is
+     * forwarded to `streamSimple` for deeper provider-derived URL checks.
+     */
+    providerNetworkPolicy?: ProviderNetworkPolicyConfig;
+    /** Optional sanitized audit sink for provider network policy decisions. */
+    onProviderNetworkAudit?: ProviderNetworkAuditSink;
+    /** Optional loadout enforcement policy for SDK-created sessions. */
+    loadoutAccessPolicy?: LoadoutAccessPolicy;
+    /** Optional bash sandbox preflight policy for SDK-created sessions and RPC bash. */
+    bashSandboxPreflight?: BashSandboxPreflight;
+    /** Optional sandbox policy for extension `omk.exec` loaded through the default resource loader. */
+    extensionExecSandbox?: ExtensionExecSandbox;
+    /** Optional sandboxed temporary package trial runtime for CLI/SDK supplied package sources. */
+    packageTrialRuntime?: PackageTrialRuntimeOptions;
 }
 /** Result from createAgentSession */
 export interface CreateAgentSessionResult {
@@ -105,5 +126,63 @@ export { withFileMutationQueue, createCodingTools, createReadOnlyTools, createRe
  * });
  * ```
  */
+export type ProviderNetworkPolicyMode = "off" | "audit" | "enforce";
+export type ProviderNetworkPolicyNetwork = SandboxPolicy["network"];
+export interface ProviderNetworkPolicyConfig {
+    mode: ProviderNetworkPolicyMode;
+    network: ProviderNetworkPolicyNetwork;
+}
+export interface ProviderNetworkAuditEvent {
+    provider: string;
+    api: string;
+    modelId: string;
+    host?: string;
+    protocol: ProviderNetworkRequest["protocol"];
+    port?: string;
+    transport: ProviderNetworkRequest["transport"];
+    purpose: ProviderNetworkRequest["purpose"];
+    mode: ProviderNetworkPolicyMode;
+    rule: string;
+    allowed: boolean;
+    wouldDeny?: boolean;
+}
+export type ProviderNetworkAuditSink = (event: ProviderNetworkAuditEvent) => void;
+/**
+ * Map a sanitized provider network request to a provider-neutral decision.
+ * Reuses the pure sandbox network decision logic (`decideNetworkAccess`) so
+ * allow/deny/loopback semantics stay consistent with the rest of the sandbox.
+ */
+export declare function decideProviderNetworkAccess(config: ProviderNetworkPolicyConfig, request: ProviderNetworkRequest): ProviderNetworkDecision;
+/**
+ * Create the `beforeNetworkRequest` hook installed on the agent stream
+ * function. The optional audit sink receives only sanitized metadata
+ * (provider, api, model id, host, protocol, port, transport, purpose, mode,
+ * rule, allowed/wouldDeny) and never headers, API keys, or request bodies.
+ */
+export declare function createBeforeProviderNetworkRequest(config: ProviderNetworkPolicyConfig, onAudit?: ProviderNetworkAuditSink): BeforeProviderNetworkRequest;
+/**
+ * Dependencies for the agent stream function factory.
+ */
+export interface AgentStreamFunctionDeps {
+    modelRegistry: ModelRegistry;
+    settingsManager: SettingsManager;
+    /** When set, a sanitized preflight runs before auth resolution and is forwarded to `streamSimple`. */
+    providerNetworkBeforeRequest?: BeforeProviderNetworkRequest;
+}
+/**
+ * Build the Agent `streamFn` used by `createAgentSession`.
+ *
+ * Contract preserved from the previous inline implementation:
+ * - resolves API key/headers via the model registry,
+ * - applies provider retry/timeout settings,
+ * - merges provider attribution headers.
+ *
+ * Added behavior: when `providerNetworkBeforeRequest` is set, a sanitized
+ * preflight runs BEFORE auth resolution. A deny returns a sanitized error
+ * stream (no headers/API keys/bodies/prompts/responses are exposed) and skips
+ * auth + provider invocation entirely. The hook is also forwarded to
+ * `streamSimple` so provider-derived endpoints can be checked deeper.
+ */
+export declare function createAgentStreamFunction(deps: AgentStreamFunctionDeps): StreamFn;
 export declare function createAgentSession(options?: CreateAgentSessionOptions): Promise<CreateAgentSessionResult>;
 //# sourceMappingURL=sdk.d.ts.map

package/dist/core/sdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../src/core/sdk.ts"],"names":[],"mappings":"AACA,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC9F,OAAO,EAAoC,KAAK,KAAK,EAAgB,MAAM,wBAAwB,CAAC;AAGpG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAmB,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEtH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAwB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,eAAe,EAEf,qBAAqB,EACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,yBAAyB;IACzC,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oFAAoF;IACpF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,uFAAuF;IACvF,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B,iEAAiE;IACjE,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,4FAA4F;IAC5F,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,gEAAgE;IAChE,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,aAAa,CAAC,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IAE3E;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAC5B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gEAAgE;IAChE,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;IAE/B,oEAAoE;IACpE,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC,2DAA2D;IAC3D,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC,uEAAuE;IACvE,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACtC;AAED,qCAAqC;AACrC,MAAM,WAAW,wBAAwB;IACxC,0BAA0B;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,mEAAmE;IACnE,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID,cAAc,4BAA4B,CAAC;AAC3C,YAAY,EACX,YAAY,EACZ,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,GACd,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACN,qBAAqB,EAErB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,GACZ,CAAC;AAQF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAuOnH","sourcesContent":["import { join } from \"node:path\";\nimport { Agent, type AgentMessage, type ThinkingLevel } from \"@earendil-works/omk-agent-core\";\nimport { clampThinkingLevel, type Message, type Model, streamSimple } from \"@earendil-works/omk-ai\";\nimport { getAgentDir } from \"../config.ts\";\nimport { resolvePath } from \"../utils/paths.ts\";\nimport { AgentSession } from \"./agent-session.ts\";\nimport { formatNoModelsAvailableMessage } from \"./auth-guidance.ts\";\nimport { AuthStorage } from \"./auth-storage.ts\";\nimport { DEFAULT_THINKING_LEVEL } from \"./defaults.ts\";\nimport type { ExtensionRunner, LoadExtensionsResult, SessionStartEvent, ToolDefinition } from \"./extensions/index.ts\";\nimport { convertToLlm } from \"./messages.ts\";\nimport { ModelRegistry } from \"./model-registry.ts\";\nimport { findInitialModel } from \"./model-resolver.ts\";\nimport { mergeProviderAttributionHeaders } from \"./provider-attribution.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\nimport { DefaultResourceLoader } from \"./resource-loader.ts\";\nimport { getDefaultSessionDir, SessionManager } from \"./session-manager.ts\";\nimport { SettingsManager } from \"./settings-manager.ts\";\nimport { time } from \"./timings.ts\";\nimport {\n\tcreateBashTool,\n\tcreateCodingTools,\n\tcreateEditTool,\n\tcreateFindTool,\n\tcreateGrepTool,\n\tcreateLsTool,\n\tcreateReadOnlyTools,\n\tcreateReadTool,\n\tcreateWriteTool,\n\ttype ToolName,\n\twithFileMutationQueue,\n} from \"./tools/index.ts\";\n\nexport interface CreateAgentSessionOptions {\n\t/** Working directory for project-local discovery. Default: process.cwd() */\n\tcwd?: string;\n\t/** Global config directory. Default: ~/.omk/agent */\n\tagentDir?: string;\n\n\t/** Auth storage for credentials. Default: AuthStorage.create(agentDir/auth.json) */\n\tauthStorage?: AuthStorage;\n\t/** Model registry. Default: ModelRegistry.create(authStorage, agentDir/models.json) */\n\tmodelRegistry?: ModelRegistry;\n\n\t/** Model to use. Default: from settings, else first available */\n\tmodel?: Model<any>;\n\t/** Thinking level. Default: from settings, else 'medium' (clamped to model capabilities) */\n\tthinkingLevel?: ThinkingLevel;\n\t/** Models available for cycling (Ctrl+P in interactive mode) */\n\tscopedModels?: Array<{ model: Model<any>; thinkingLevel?: ThinkingLevel }>;\n\n\t/**\n\t * Optional default tool suppression mode when no explicit allowlist is provided.\n\t *\n\t * - \"all\": start with no tools enabled\n\t * - \"builtin\": disable the default built-in tools (read, bash, edit, write)\n\t *   but keep extension/custom tools enabled\n\t */\n\tnoTools?: \"all\" | \"builtin\";\n\t/**\n\t * Optional allowlist of tool names.\n\t *\n\t * When omitted, pi enables the default built-in tools (read, bash, edit, write)\n\t * and leaves extension/custom tools enabled unless `noTools` changes that default.\n\t * When provided, only the listed tool names are enabled.\n\t */\n\ttools?: string[];\n\t/** Optional denylist of tool names to disable. Applies after `tools` when both are provided. */\n\texcludeTools?: string[];\n\t/** Custom tools to register (in addition to built-in tools). */\n\tcustomTools?: ToolDefinition[];\n\n\t/** Resource loader. When omitted, DefaultResourceLoader is used. */\n\tresourceLoader?: ResourceLoader;\n\n\t/** Session manager. Default: SessionManager.create(cwd) */\n\tsessionManager?: SessionManager;\n\n\t/** Settings manager. Default: SettingsManager.create(cwd, agentDir) */\n\tsettingsManager?: SettingsManager;\n\t/** Session start event metadata for extension runtime startup. */\n\tsessionStartEvent?: SessionStartEvent;\n}\n\n/** Result from createAgentSession */\nexport interface CreateAgentSessionResult {\n\t/** The created session */\n\tsession: AgentSession;\n\t/** Extensions result (for UI context setup in interactive mode) */\n\textensionsResult: LoadExtensionsResult;\n\t/** Warning if session was restored with a different model than saved */\n\tmodelFallbackMessage?: string;\n}\n\n// Re-exports\n\nexport * from \"./agent-session-runtime.ts\";\nexport type {\n\tExtensionAPI,\n\tExtensionCommandContext,\n\tExtensionContext,\n\tExtensionFactory,\n\tSlashCommandInfo,\n\tSlashCommandSource,\n\tToolDefinition,\n} from \"./extensions/index.ts\";\nexport type { PromptTemplate } from \"./prompt-templates.ts\";\nexport type { Skill } from \"./skills.ts\";\nexport type { Tool } from \"./tools/index.ts\";\n\nexport {\n\twithFileMutationQueue,\n\t// Tool factories (for custom cwd)\n\tcreateCodingTools,\n\tcreateReadOnlyTools,\n\tcreateReadTool,\n\tcreateBashTool,\n\tcreateEditTool,\n\tcreateWriteTool,\n\tcreateGrepTool,\n\tcreateFindTool,\n\tcreateLsTool,\n};\n\n// Helper Functions\n\nfunction getDefaultAgentDir(): string {\n\treturn getAgentDir();\n}\n\n/**\n * Create an AgentSession with the specified options.\n *\n * @example\n * ```typescript\n * // Minimal - uses defaults\n * const { session } = await createAgentSession();\n *\n * // With explicit model\n * import { getModel } from '@earendil-works/omk-ai';\n * const { session } = await createAgentSession({\n *   model: getModel('anthropic', 'claude-opus-4-5'),\n *   thinkingLevel: 'high',\n * });\n *\n * // Continue previous session\n * const { session, modelFallbackMessage } = await createAgentSession({\n *   continueSession: true,\n * });\n *\n * // Full control\n * const loader = new DefaultResourceLoader({\n *   cwd: process.cwd(),\n *   agentDir: getAgentDir(),\n *   settingsManager: SettingsManager.create(),\n * });\n * await loader.reload();\n * const { session } = await createAgentSession({\n *   model: myModel,\n *   tools: [\"read\", \"bash\"],\n *   resourceLoader: loader,\n *   sessionManager: SessionManager.inMemory(),\n * });\n * ```\n */\nexport async function createAgentSession(options: CreateAgentSessionOptions = {}): Promise<CreateAgentSessionResult> {\n\tconst cwd = resolvePath(options.cwd ?? options.sessionManager?.getCwd() ?? process.cwd());\n\tconst agentDir = options.agentDir ? resolvePath(options.agentDir) : getDefaultAgentDir();\n\tlet resourceLoader = options.resourceLoader;\n\n\t// Use provided or create AuthStorage and ModelRegistry\n\tconst authPath = options.agentDir ? join(agentDir, \"auth.json\") : undefined;\n\tconst modelsPath = options.agentDir ? join(agentDir, \"models.json\") : undefined;\n\tconst authStorage = options.authStorage ?? AuthStorage.create(authPath);\n\tconst modelRegistry = options.modelRegistry ?? ModelRegistry.create(authStorage, modelsPath);\n\n\tconst settingsManager = options.settingsManager ?? SettingsManager.create(cwd, agentDir);\n\tconst sessionManager = options.sessionManager ?? SessionManager.create(cwd, getDefaultSessionDir(cwd, agentDir));\n\n\tif (!resourceLoader) {\n\t\tresourceLoader = new DefaultResourceLoader({ cwd, agentDir, settingsManager });\n\t\tawait resourceLoader.reload();\n\t\ttime(\"resourceLoader.reload\");\n\t}\n\n\t// Check if session has existing data to restore\n\tconst existingSession = sessionManager.buildSessionContext();\n\tconst hasExistingSession = existingSession.messages.length > 0;\n\tconst hasThinkingEntry = sessionManager.getBranch().some((entry) => entry.type === \"thinking_level_change\");\n\n\tlet model = options.model;\n\tlet modelFallbackMessage: string | undefined;\n\n\t// If session has data, try to restore model from it\n\tif (!model && hasExistingSession && existingSession.model) {\n\t\tconst restoredModel = modelRegistry.find(existingSession.model.provider, existingSession.model.modelId);\n\t\tif (restoredModel && modelRegistry.hasConfiguredAuth(restoredModel)) {\n\t\t\tmodel = restoredModel;\n\t\t}\n\t\tif (!model) {\n\t\t\tmodelFallbackMessage = `Could not restore model ${existingSession.model.provider}/${existingSession.model.modelId}`;\n\t\t}\n\t}\n\n\t// If still no model, use findInitialModel (checks settings default, then provider defaults)\n\tif (!model) {\n\t\tconst result = await findInitialModel({\n\t\t\tscopedModels: [],\n\t\t\tisContinuing: hasExistingSession,\n\t\t\tdefaultProvider: settingsManager.getDefaultProvider(),\n\t\t\tdefaultModelId: settingsManager.getDefaultModel(),\n\t\t\tdefaultThinkingLevel: settingsManager.getDefaultThinkingLevel(),\n\t\t\tmodelRegistry,\n\t\t});\n\t\tmodel = result.model;\n\t\tif (!model) {\n\t\t\tmodelFallbackMessage = formatNoModelsAvailableMessage();\n\t\t} else if (modelFallbackMessage) {\n\t\t\tmodelFallbackMessage += `. Using ${model.provider}/${model.id}`;\n\t\t}\n\t}\n\n\tlet thinkingLevel = options.thinkingLevel;\n\n\t// If session has data, restore thinking level from it\n\tif (thinkingLevel === undefined && hasExistingSession) {\n\t\tthinkingLevel = hasThinkingEntry\n\t\t\t? (existingSession.thinkingLevel as ThinkingLevel)\n\t\t\t: (settingsManager.getDefaultThinkingLevel() ?? DEFAULT_THINKING_LEVEL);\n\t}\n\n\t// Fall back to settings default\n\tif (thinkingLevel === undefined) {\n\t\tthinkingLevel = settingsManager.getDefaultThinkingLevel() ?? DEFAULT_THINKING_LEVEL;\n\t}\n\n\t// Clamp to model capabilities\n\tif (!model) {\n\t\tthinkingLevel = \"off\";\n\t} else {\n\t\tthinkingLevel = clampThinkingLevel(model, thinkingLevel) as ThinkingLevel;\n\t}\n\n\tconst defaultActiveToolNames: ToolName[] = [\"read\", \"bash\", \"edit\", \"write\"];\n\tconst allowedToolNames = options.tools ?? (options.noTools === \"all\" ? [] : undefined);\n\tconst excludedToolNames = options.excludeTools;\n\tconst excludedToolNameSet = excludedToolNames ? new Set(excludedToolNames) : undefined;\n\tconst initialActiveToolNames: string[] = (\n\t\toptions.tools ? [...options.tools] : options.noTools ? [] : defaultActiveToolNames\n\t).filter((name) => !excludedToolNameSet?.has(name));\n\n\tlet agent: Agent;\n\n\t// Create convertToLlm wrapper that filters images if blockImages is enabled (defense-in-depth)\n\tconst convertToLlmWithBlockImages = (messages: AgentMessage[]): Message[] => {\n\t\tconst converted = convertToLlm(messages);\n\t\t// Check setting dynamically so mid-session changes take effect\n\t\tif (!settingsManager.getBlockImages()) {\n\t\t\treturn converted;\n\t\t}\n\t\t// Filter out ImageContent from all messages, replacing with text placeholder\n\t\treturn converted.map((msg) => {\n\t\t\tif (msg.role === \"user\" || msg.role === \"toolResult\") {\n\t\t\t\tconst content = msg.content;\n\t\t\t\tif (Array.isArray(content)) {\n\t\t\t\t\tconst hasImages = content.some((c) => c.type === \"image\");\n\t\t\t\t\tif (hasImages) {\n\t\t\t\t\t\tconst filteredContent = content\n\t\t\t\t\t\t\t.map((c) =>\n\t\t\t\t\t\t\t\tc.type === \"image\" ? { type: \"text\" as const, text: \"Image reading is disabled.\" } : c,\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t.filter(\n\t\t\t\t\t\t\t\t(c, i, arr) =>\n\t\t\t\t\t\t\t\t\t// Dedupe consecutive \"Image reading is disabled.\" texts\n\t\t\t\t\t\t\t\t\t!(\n\t\t\t\t\t\t\t\t\t\tc.type === \"text\" &&\n\t\t\t\t\t\t\t\t\t\tc.text === \"Image reading is disabled.\" &&\n\t\t\t\t\t\t\t\t\t\ti > 0 &&\n\t\t\t\t\t\t\t\t\t\tarr[i - 1].type === \"text\" &&\n\t\t\t\t\t\t\t\t\t\t(arr[i - 1] as { type: \"text\"; text: string }).text === \"Image reading is disabled.\"\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\treturn { ...msg, content: filteredContent };\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn msg;\n\t\t});\n\t};\n\n\tconst extensionRunnerRef: { current?: ExtensionRunner } = {};\n\n\tagent = new Agent({\n\t\tinitialState: {\n\t\t\tsystemPrompt: \"\",\n\t\t\tmodel,\n\t\t\tthinkingLevel,\n\t\t\ttools: [],\n\t\t},\n\t\tconvertToLlm: convertToLlmWithBlockImages,\n\t\tstreamFn: async (model, context, options) => {\n\t\t\tconst auth = await modelRegistry.getApiKeyAndHeaders(model);\n\t\t\tif (!auth.ok) {\n\t\t\t\tthrow new Error(auth.error);\n\t\t\t}\n\t\t\tconst providerRetrySettings = settingsManager.getProviderRetrySettings();\n\t\t\tconst httpIdleTimeoutMs = settingsManager.getHttpIdleTimeoutMs();\n\t\t\t// SDKs treat timeout=0 as 0ms (immediate timeout), not \"no timeout\".\n\t\t\t// Use max int32 to effectively disable the timeout.\n\t\t\tconst effectiveTimeoutMs = httpIdleTimeoutMs === 0 ? 2147483647 : httpIdleTimeoutMs;\n\t\t\tconst timeoutMs = options?.timeoutMs ?? providerRetrySettings.timeoutMs ?? effectiveTimeoutMs;\n\t\t\tconst websocketConnectTimeoutMs =\n\t\t\t\toptions?.websocketConnectTimeoutMs ?? settingsManager.getWebSocketConnectTimeoutMs();\n\t\t\treturn streamSimple(model, context, {\n\t\t\t\t...options,\n\t\t\t\tapiKey: auth.apiKey,\n\t\t\t\ttimeoutMs,\n\t\t\t\twebsocketConnectTimeoutMs,\n\t\t\t\tmaxRetries: options?.maxRetries ?? providerRetrySettings.maxRetries,\n\t\t\t\tmaxRetryDelayMs: options?.maxRetryDelayMs ?? providerRetrySettings.maxRetryDelayMs,\n\t\t\t\theaders: mergeProviderAttributionHeaders(\n\t\t\t\t\tmodel,\n\t\t\t\t\tsettingsManager,\n\t\t\t\t\toptions?.sessionId,\n\t\t\t\t\tauth.headers,\n\t\t\t\t\toptions?.headers,\n\t\t\t\t),\n\t\t\t});\n\t\t},\n\t\tonPayload: async (payload, _model) => {\n\t\t\tconst runner = extensionRunnerRef.current;\n\t\t\tif (!runner?.hasHandlers(\"before_provider_request\")) {\n\t\t\t\treturn payload;\n\t\t\t}\n\t\t\treturn runner.emitBeforeProviderRequest(payload);\n\t\t},\n\t\tonResponse: async (response, _model) => {\n\t\t\tconst runner = extensionRunnerRef.current;\n\t\t\tif (!runner?.hasHandlers(\"after_provider_response\")) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait runner.emit({\n\t\t\t\ttype: \"after_provider_response\",\n\t\t\t\tstatus: response.status,\n\t\t\t\theaders: response.headers,\n\t\t\t});\n\t\t},\n\t\tsessionId: sessionManager.getSessionId(),\n\t\ttransformContext: async (messages) => {\n\t\t\tconst runner = extensionRunnerRef.current;\n\t\t\tif (!runner) return messages;\n\t\t\treturn runner.emitContext(messages);\n\t\t},\n\t\tsteeringMode: settingsManager.getSteeringMode(),\n\t\tfollowUpMode: settingsManager.getFollowUpMode(),\n\t\ttransport: settingsManager.getTransport(),\n\t\tthinkingBudgets: settingsManager.getThinkingBudgets(),\n\t\tmaxRetryDelayMs: settingsManager.getProviderRetrySettings().maxRetryDelayMs,\n\t});\n\n\t// Restore messages if session has existing data\n\tif (hasExistingSession) {\n\t\tagent.state.messages = existingSession.messages;\n\t\tif (!hasThinkingEntry) {\n\t\t\tsessionManager.appendThinkingLevelChange(thinkingLevel);\n\t\t}\n\t} else {\n\t\t// Save initial model and thinking level for new sessions so they can be restored on resume\n\t\tif (model) {\n\t\t\tsessionManager.appendModelChange(model.provider, model.id);\n\t\t}\n\t\tsessionManager.appendThinkingLevelChange(thinkingLevel);\n\t}\n\n\tconst session = new AgentSession({\n\t\tagent,\n\t\tsessionManager,\n\t\tsettingsManager,\n\t\tcwd,\n\t\tscopedModels: options.scopedModels,\n\t\tresourceLoader,\n\t\tcustomTools: options.customTools,\n\t\tmodelRegistry,\n\t\tinitialActiveToolNames,\n\t\tallowedToolNames,\n\t\texcludedToolNames,\n\t\textensionRunnerRef,\n\t\tsessionStartEvent: options.sessionStartEvent,\n\t});\n\tconst extensionsResult = resourceLoader.getExtensions();\n\n\treturn {\n\t\tsession,\n\t\textensionsResult,\n\t\tmodelFallbackMessage,\n\t};\n}\n"]}
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../src/core/sdk.ts"],"names":[],"mappings":"AACA,OAAO,EAA4B,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC7G,OAAO,EAEN,KAAK,4BAA4B,EAIjC,KAAK,KAAK,EACV,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAE3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAmB,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAwB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EACN,KAAK,oBAAoB,EACzB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,cAAc,EACd,eAAe,EAEf,qBAAqB,EACrB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,yBAAyB;IACzC,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oFAAoF;IACpF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,uFAAuF;IACvF,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B,iEAAiE;IACjE,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,4FAA4F;IAC5F,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,gEAAgE;IAChE,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,aAAa,CAAC,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IAE3E;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAC5B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gEAAgE;IAChE,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;IAE/B,oEAAoE;IACpE,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC,2DAA2D;IAC3D,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC,uEAAuE;IACvE,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IACpD,2EAA2E;IAC3E,sBAAsB,CAAC,EAAE,wBAAwB,CAAC;IAClD,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,oFAAoF;IACpF,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,mGAAmG;IACnG,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,+FAA+F;IAC/F,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;CACjD;AAED,qCAAqC;AACrC,MAAM,WAAW,wBAAwB;IACxC,0BAA0B;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,mEAAmE;IACnE,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID,cAAc,4BAA4B,CAAC;AAC3C,YAAY,EACX,YAAY,EACZ,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,GACd,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,YAAY,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EACN,qBAAqB,EAErB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,YAAY,GACZ,CAAC;AAQF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAYH,MAAM,MAAM,yBAAyB,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,4BAA4B,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAEpE,MAAM,WAAW,2BAA2B;IAC3C,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,yBAAyB;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,EAAE,yBAAyB,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,yBAAyB,KAAK,IAAI,CAAC;AAuBlF;;;;GAIG;AACH,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,2BAA2B,EACnC,OAAO,EAAE,sBAAsB,GAC7B,uBAAuB,CAkCzB;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CACjD,MAAM,EAAE,2BAA2B,EACnC,OAAO,CAAC,EAAE,wBAAwB,GAChC,4BAA4B,CAmB9B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,aAAa,EAAE,aAAa,CAAC;IAC7B,eAAe,EAAE,eAAe,CAAC;IACjC,sGAAsG;IACtG,4BAA4B,CAAC,EAAE,4BAA4B,CAAC;CAC5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,QAAQ,CA0CjF;AAED,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA0NnH","sourcesContent":["import { join } from \"node:path\";\nimport { Agent, type AgentMessage, type StreamFn, type ThinkingLevel } from \"@earendil-works/omk-agent-core\";\nimport {\n\tassertProviderNetworkRequestAllowed,\n\ttype BeforeProviderNetworkRequest,\n\tclampThinkingLevel,\n\tcreateProviderNetworkErrorStream,\n\ttype Message,\n\ttype Model,\n\ttype ProviderNetworkDecision,\n\ttype ProviderNetworkRequest,\n\tstreamSimple,\n} from \"@earendil-works/omk-ai\";\nimport { getAgentDir } from \"../config.ts\";\nimport { resolvePath } from \"../utils/paths.ts\";\nimport { AgentSession } from \"./agent-session.ts\";\nimport { formatNoModelsAvailableMessage } from \"./auth-guidance.ts\";\nimport { AuthStorage } from \"./auth-storage.ts\";\nimport { DEFAULT_THINKING_LEVEL } from \"./defaults.ts\";\nimport type { ExtensionRunner, LoadExtensionsResult, SessionStartEvent, ToolDefinition } from \"./extensions/index.ts\";\nimport type { ExtensionExecSandbox } from \"./extensions/types.ts\";\nimport type { LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport { convertToLlm } from \"./messages.ts\";\nimport { ModelRegistry } from \"./model-registry.ts\";\nimport { findInitialModel } from \"./model-resolver.ts\";\nimport type { PackageTrialRuntimeOptions } from \"./package-manager.ts\";\nimport { mergeProviderAttributionHeaders } from \"./provider-attribution.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\nimport { DefaultResourceLoader } from \"./resource-loader.ts\";\nimport { decideNetworkAccess, type SandboxPolicy } from \"./sandbox/policy.ts\";\nimport { getDefaultSessionDir, SessionManager } from \"./session-manager.ts\";\nimport { SettingsManager } from \"./settings-manager.ts\";\nimport { time } from \"./timings.ts\";\nimport {\n\ttype BashSandboxPreflight,\n\tcreateBashTool,\n\tcreateCodingTools,\n\tcreateEditTool,\n\tcreateFindTool,\n\tcreateGrepTool,\n\tcreateLsTool,\n\tcreateReadOnlyTools,\n\tcreateReadTool,\n\tcreateWriteTool,\n\ttype ToolName,\n\twithFileMutationQueue,\n} from \"./tools/index.ts\";\n\nexport interface CreateAgentSessionOptions {\n\t/** Working directory for project-local discovery. Default: process.cwd() */\n\tcwd?: string;\n\t/** Global config directory. Default: ~/.omk/agent */\n\tagentDir?: string;\n\n\t/** Auth storage for credentials. Default: AuthStorage.create(agentDir/auth.json) */\n\tauthStorage?: AuthStorage;\n\t/** Model registry. Default: ModelRegistry.create(authStorage, agentDir/models.json) */\n\tmodelRegistry?: ModelRegistry;\n\n\t/** Model to use. Default: from settings, else first available */\n\tmodel?: Model<any>;\n\t/** Thinking level. Default: from settings, else 'medium' (clamped to model capabilities) */\n\tthinkingLevel?: ThinkingLevel;\n\t/** Models available for cycling (Ctrl+P in interactive mode) */\n\tscopedModels?: Array<{ model: Model<any>; thinkingLevel?: ThinkingLevel }>;\n\n\t/**\n\t * Optional default tool suppression mode when no explicit allowlist is provided.\n\t *\n\t * - \"all\": start with no tools enabled\n\t * - \"builtin\": disable the default built-in tools (read, bash, edit, write)\n\t *   but keep extension/custom tools enabled\n\t */\n\tnoTools?: \"all\" | \"builtin\";\n\t/**\n\t * Optional allowlist of tool names.\n\t *\n\t * When omitted, omk enables the default built-in tools (read, bash, edit, write)\n\t * and leaves extension/custom tools enabled unless `noTools` changes that default.\n\t * When provided, only the listed tool names are enabled.\n\t */\n\ttools?: string[];\n\t/** Optional denylist of tool names to disable. Applies after `tools` when both are provided. */\n\texcludeTools?: string[];\n\t/** Custom tools to register (in addition to built-in tools). */\n\tcustomTools?: ToolDefinition[];\n\n\t/** Resource loader. When omitted, DefaultResourceLoader is used. */\n\tresourceLoader?: ResourceLoader;\n\n\t/** Session manager. Default: SessionManager.create(cwd) */\n\tsessionManager?: SessionManager;\n\n\t/** Settings manager. Default: SettingsManager.create(cwd, agentDir) */\n\tsettingsManager?: SettingsManager;\n\t/** Session start event metadata for extension runtime startup. */\n\tsessionStartEvent?: SessionStartEvent;\n\t/**\n\t * Optional provider network policy. When omitted, no provider network\n\t * preflight is installed (current behavior preserved). When set, a\n\t * sanitized preflight runs before API key/header resolution and is\n\t * forwarded to `streamSimple` for deeper provider-derived URL checks.\n\t */\n\tproviderNetworkPolicy?: ProviderNetworkPolicyConfig;\n\t/** Optional sanitized audit sink for provider network policy decisions. */\n\tonProviderNetworkAudit?: ProviderNetworkAuditSink;\n\t/** Optional loadout enforcement policy for SDK-created sessions. */\n\tloadoutAccessPolicy?: LoadoutAccessPolicy;\n\t/** Optional bash sandbox preflight policy for SDK-created sessions and RPC bash. */\n\tbashSandboxPreflight?: BashSandboxPreflight;\n\t/** Optional sandbox policy for extension `omk.exec` loaded through the default resource loader. */\n\textensionExecSandbox?: ExtensionExecSandbox;\n\t/** Optional sandboxed temporary package trial runtime for CLI/SDK supplied package sources. */\n\tpackageTrialRuntime?: PackageTrialRuntimeOptions;\n}\n\n/** Result from createAgentSession */\nexport interface CreateAgentSessionResult {\n\t/** The created session */\n\tsession: AgentSession;\n\t/** Extensions result (for UI context setup in interactive mode) */\n\textensionsResult: LoadExtensionsResult;\n\t/** Warning if session was restored with a different model than saved */\n\tmodelFallbackMessage?: string;\n}\n\n// Re-exports\n\nexport * from \"./agent-session-runtime.ts\";\nexport type {\n\tExtensionAPI,\n\tExtensionCommandContext,\n\tExtensionContext,\n\tExtensionFactory,\n\tSlashCommandInfo,\n\tSlashCommandSource,\n\tToolDefinition,\n} from \"./extensions/index.ts\";\nexport type { PromptTemplate } from \"./prompt-templates.ts\";\nexport type { Skill } from \"./skills.ts\";\nexport type { Tool } from \"./tools/index.ts\";\n\nexport {\n\twithFileMutationQueue,\n\t// Tool factories (for custom cwd)\n\tcreateCodingTools,\n\tcreateReadOnlyTools,\n\tcreateReadTool,\n\tcreateBashTool,\n\tcreateEditTool,\n\tcreateWriteTool,\n\tcreateGrepTool,\n\tcreateFindTool,\n\tcreateLsTool,\n};\n\n// Helper Functions\n\nfunction getDefaultAgentDir(): string {\n\treturn getAgentDir();\n}\n\n/**\n * Create an AgentSession with the specified options.\n *\n * @example\n * ```typescript\n * // Minimal - uses defaults\n * const { session } = await createAgentSession();\n *\n * // With explicit model\n * import { getModel } from '@earendil-works/omk-ai';\n * const { session } = await createAgentSession({\n *   model: getModel('anthropic', 'claude-opus-4-5'),\n *   thinkingLevel: 'high',\n * });\n *\n * // Continue previous session\n * const { session, modelFallbackMessage } = await createAgentSession({\n *   continueSession: true,\n * });\n *\n * // Full control\n * const loader = new DefaultResourceLoader({\n *   cwd: process.cwd(),\n *   agentDir: getAgentDir(),\n *   settingsManager: SettingsManager.create(),\n * });\n * await loader.reload();\n * const { session } = await createAgentSession({\n *   model: myModel,\n *   tools: [\"read\", \"bash\"],\n *   resourceLoader: loader,\n *   sessionManager: SessionManager.inMemory(),\n * });\n * ```\n */\n// ---------------------------------------------------------------------------\n// Provider network policy\n//\n// Sanitized preflight for provider/API network access. The request metadata\n// is origin-only (no credentials, query, fragment, path, headers, API keys,\n// request bodies, prompts, or responses). Enforce mode blocks denied hosts\n// before any provider network I/O and before API key/header resolution; audit\n// mode records `wouldDeny` without blocking; off mode disables the preflight.\n// The pure host/loopback/deny/allow logic reuses `decideNetworkAccess`.\n// ---------------------------------------------------------------------------\n\nexport type ProviderNetworkPolicyMode = \"off\" | \"audit\" | \"enforce\";\n\nexport type ProviderNetworkPolicyNetwork = SandboxPolicy[\"network\"];\n\nexport interface ProviderNetworkPolicyConfig {\n\tmode: ProviderNetworkPolicyMode;\n\tnetwork: ProviderNetworkPolicyNetwork;\n}\n\nexport interface ProviderNetworkAuditEvent {\n\tprovider: string;\n\tapi: string;\n\tmodelId: string;\n\thost?: string;\n\tprotocol: ProviderNetworkRequest[\"protocol\"];\n\tport?: string;\n\ttransport: ProviderNetworkRequest[\"transport\"];\n\tpurpose: ProviderNetworkRequest[\"purpose\"];\n\tmode: ProviderNetworkPolicyMode;\n\trule: string;\n\tallowed: boolean;\n\twouldDeny?: boolean;\n}\n\nexport type ProviderNetworkAuditSink = (event: ProviderNetworkAuditEvent) => void;\n\nfunction syntheticProviderSandboxPolicy(\n\tmode: \"audit\" | \"enforce\",\n\tnetwork: ProviderNetworkPolicyNetwork,\n): SandboxPolicy {\n\treturn {\n\t\tmode,\n\t\tprofile: \"networked\",\n\t\tfilesystem: {\n\t\t\troot: \"/\",\n\t\t\treadAllow: [],\n\t\t\treadDeny: [],\n\t\t\twriteAllow: [],\n\t\t\tdenyWrite: [],\n\t\t\ttempWrite: [],\n\t\t\tfollowSymlinks: false,\n\t\t},\n\t\tnetwork,\n\t\tprocess: { allowExec: true, allowShell: true, allowPrivilege: false },\n\t};\n}\n\n/**\n * Map a sanitized provider network request to a provider-neutral decision.\n * Reuses the pure sandbox network decision logic (`decideNetworkAccess`) so\n * allow/deny/loopback semantics stay consistent with the rest of the sandbox.\n */\nexport function decideProviderNetworkAccess(\n\tconfig: ProviderNetworkPolicyConfig,\n\trequest: ProviderNetworkRequest,\n): ProviderNetworkDecision {\n\tif (config.mode === \"off\") {\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\trule: \"provider-network.off\",\n\t\t\treason: \"Provider network policy is disabled.\",\n\t\t\tmode: \"off\",\n\t\t};\n\t}\n\n\tconst sandboxMode = config.mode === \"audit\" ? \"audit\" : \"enforce\";\n\tconst sandboxDecision = decideNetworkAccess(syntheticProviderSandboxPolicy(sandboxMode, config.network), {\n\t\thost: request.host,\n\t\turl: request.url,\n\t\tloopback: request.loopback,\n\t\tbrowser: false,\n\t});\n\n\tif (config.mode === \"audit\") {\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\twouldDeny: !sandboxDecision.allowed,\n\t\t\trule: sandboxDecision.rule,\n\t\t\treason: sandboxDecision.reason,\n\t\t\tmode: \"audit\",\n\t\t};\n\t}\n\n\treturn {\n\t\tallowed: sandboxDecision.allowed,\n\t\trule: sandboxDecision.rule,\n\t\treason: sandboxDecision.reason,\n\t\tmode: \"enforce\",\n\t};\n}\n\n/**\n * Create the `beforeNetworkRequest` hook installed on the agent stream\n * function. The optional audit sink receives only sanitized metadata\n * (provider, api, model id, host, protocol, port, transport, purpose, mode,\n * rule, allowed/wouldDeny) and never headers, API keys, or request bodies.\n */\nexport function createBeforeProviderNetworkRequest(\n\tconfig: ProviderNetworkPolicyConfig,\n\tonAudit?: ProviderNetworkAuditSink,\n): BeforeProviderNetworkRequest {\n\treturn (request) => {\n\t\tconst decision = decideProviderNetworkAccess(config, request);\n\t\tonAudit?.({\n\t\t\tprovider: request.provider,\n\t\t\tapi: String(request.api),\n\t\t\tmodelId: request.modelId,\n\t\t\thost: request.host,\n\t\t\tprotocol: request.protocol,\n\t\t\tport: request.port,\n\t\t\ttransport: request.transport,\n\t\t\tpurpose: request.purpose,\n\t\t\tmode: decision.mode,\n\t\t\trule: decision.rule,\n\t\t\tallowed: decision.allowed,\n\t\t\twouldDeny: decision.wouldDeny,\n\t\t});\n\t\treturn decision;\n\t};\n}\n\n/**\n * Dependencies for the agent stream function factory.\n */\nexport interface AgentStreamFunctionDeps {\n\tmodelRegistry: ModelRegistry;\n\tsettingsManager: SettingsManager;\n\t/** When set, a sanitized preflight runs before auth resolution and is forwarded to `streamSimple`. */\n\tproviderNetworkBeforeRequest?: BeforeProviderNetworkRequest;\n}\n\n/**\n * Build the Agent `streamFn` used by `createAgentSession`.\n *\n * Contract preserved from the previous inline implementation:\n * - resolves API key/headers via the model registry,\n * - applies provider retry/timeout settings,\n * - merges provider attribution headers.\n *\n * Added behavior: when `providerNetworkBeforeRequest` is set, a sanitized\n * preflight runs BEFORE auth resolution. A deny returns a sanitized error\n * stream (no headers/API keys/bodies/prompts/responses are exposed) and skips\n * auth + provider invocation entirely. The hook is also forwarded to\n * `streamSimple` so provider-derived endpoints can be checked deeper.\n */\nexport function createAgentStreamFunction(deps: AgentStreamFunctionDeps): StreamFn {\n\tconst { modelRegistry, settingsManager, providerNetworkBeforeRequest } = deps;\n\treturn async (model, context, options) => {\n\t\tif (providerNetworkBeforeRequest) {\n\t\t\ttry {\n\t\t\t\tawait assertProviderNetworkRequestAllowed(\n\t\t\t\t\t{ model, purpose: \"chat\", transport: \"http\", source: \"model.baseUrl\" },\n\t\t\t\t\tproviderNetworkBeforeRequest,\n\t\t\t\t);\n\t\t\t} catch (error) {\n\t\t\t\treturn createProviderNetworkErrorStream(model, error);\n\t\t\t}\n\t\t}\n\t\tconst auth = await modelRegistry.getApiKeyAndHeaders(model);\n\t\tif (!auth.ok) {\n\t\t\tthrow new Error(auth.error);\n\t\t}\n\t\tconst providerRetrySettings = settingsManager.getProviderRetrySettings();\n\t\tconst httpIdleTimeoutMs = settingsManager.getHttpIdleTimeoutMs();\n\t\t// SDKs treat timeout=0 as 0ms (immediate timeout), not \"no timeout\".\n\t\t// Use max int32 to effectively disable the timeout.\n\t\tconst effectiveTimeoutMs = httpIdleTimeoutMs === 0 ? 2147483647 : httpIdleTimeoutMs;\n\t\tconst timeoutMs = options?.timeoutMs ?? providerRetrySettings.timeoutMs ?? effectiveTimeoutMs;\n\t\tconst websocketConnectTimeoutMs =\n\t\t\toptions?.websocketConnectTimeoutMs ?? settingsManager.getWebSocketConnectTimeoutMs();\n\t\treturn streamSimple(model, context, {\n\t\t\t...options,\n\t\t\tapiKey: auth.apiKey,\n\t\t\ttimeoutMs,\n\t\t\twebsocketConnectTimeoutMs,\n\t\t\tmaxRetries: options?.maxRetries ?? providerRetrySettings.maxRetries,\n\t\t\tmaxRetryDelayMs: options?.maxRetryDelayMs ?? providerRetrySettings.maxRetryDelayMs,\n\t\t\theaders: mergeProviderAttributionHeaders(\n\t\t\t\tmodel,\n\t\t\t\tsettingsManager,\n\t\t\t\toptions?.sessionId,\n\t\t\t\tauth.headers,\n\t\t\t\toptions?.headers,\n\t\t\t),\n\t\t\t...(providerNetworkBeforeRequest ? { beforeNetworkRequest: providerNetworkBeforeRequest } : {}),\n\t\t});\n\t};\n}\n\nexport async function createAgentSession(options: CreateAgentSessionOptions = {}): Promise<CreateAgentSessionResult> {\n\tconst cwd = resolvePath(options.cwd ?? options.sessionManager?.getCwd() ?? process.cwd());\n\tconst agentDir = options.agentDir ? resolvePath(options.agentDir) : getDefaultAgentDir();\n\tlet resourceLoader = options.resourceLoader;\n\n\t// Use provided or create AuthStorage and ModelRegistry\n\tconst authPath = options.agentDir ? join(agentDir, \"auth.json\") : undefined;\n\tconst modelsPath = options.agentDir ? join(agentDir, \"models.json\") : undefined;\n\tconst authStorage = options.authStorage ?? AuthStorage.create(authPath);\n\tconst modelRegistry = options.modelRegistry ?? ModelRegistry.create(authStorage, modelsPath);\n\n\tconst settingsManager = options.settingsManager ?? SettingsManager.create(cwd, agentDir);\n\tconst sessionManager = options.sessionManager ?? SessionManager.create(cwd, getDefaultSessionDir(cwd, agentDir));\n\n\tif (!resourceLoader) {\n\t\tresourceLoader = new DefaultResourceLoader({\n\t\t\tcwd,\n\t\t\tagentDir,\n\t\t\tsettingsManager,\n\t\t\textensionExecSandbox: options.extensionExecSandbox,\n\t\t\ttrialRuntime: options.packageTrialRuntime,\n\t\t});\n\t\tawait resourceLoader.reload();\n\t\ttime(\"resourceLoader.reload\");\n\t}\n\n\t// Check if session has existing data to restore\n\tconst existingSession = sessionManager.buildSessionContext();\n\tconst hasExistingSession = existingSession.messages.length > 0;\n\tconst hasThinkingEntry = sessionManager.getBranch().some((entry) => entry.type === \"thinking_level_change\");\n\n\tlet model = options.model;\n\tlet modelFallbackMessage: string | undefined;\n\n\t// If session has data, try to restore model from it\n\tif (!model && hasExistingSession && existingSession.model) {\n\t\tconst restoredModel = modelRegistry.find(existingSession.model.provider, existingSession.model.modelId);\n\t\tif (restoredModel && modelRegistry.hasConfiguredAuth(restoredModel)) {\n\t\t\tmodel = restoredModel;\n\t\t}\n\t\tif (!model) {\n\t\t\tmodelFallbackMessage = `Could not restore model ${existingSession.model.provider}/${existingSession.model.modelId}`;\n\t\t}\n\t}\n\n\t// If still no model, use findInitialModel (checks settings default, then provider defaults)\n\tif (!model) {\n\t\tconst result = await findInitialModel({\n\t\t\tscopedModels: [],\n\t\t\tisContinuing: hasExistingSession,\n\t\t\tdefaultProvider: settingsManager.getDefaultProvider(),\n\t\t\tdefaultModelId: settingsManager.getDefaultModel(),\n\t\t\tdefaultThinkingLevel: settingsManager.getDefaultThinkingLevel(),\n\t\t\tmodelRegistry,\n\t\t});\n\t\tmodel = result.model;\n\t\tif (!model) {\n\t\t\tmodelFallbackMessage = formatNoModelsAvailableMessage();\n\t\t} else if (modelFallbackMessage) {\n\t\t\tmodelFallbackMessage += `. Using ${model.provider}/${model.id}`;\n\t\t}\n\t}\n\n\tlet thinkingLevel = options.thinkingLevel;\n\n\t// If session has data, restore thinking level from it\n\tif (thinkingLevel === undefined && hasExistingSession) {\n\t\tthinkingLevel = hasThinkingEntry\n\t\t\t? (existingSession.thinkingLevel as ThinkingLevel)\n\t\t\t: (settingsManager.getDefaultThinkingLevel() ?? DEFAULT_THINKING_LEVEL);\n\t}\n\n\t// Fall back to settings default\n\tif (thinkingLevel === undefined) {\n\t\tthinkingLevel = settingsManager.getDefaultThinkingLevel() ?? DEFAULT_THINKING_LEVEL;\n\t}\n\n\t// Clamp to model capabilities\n\tif (!model) {\n\t\tthinkingLevel = \"off\";\n\t} else {\n\t\tthinkingLevel = clampThinkingLevel(model, thinkingLevel) as ThinkingLevel;\n\t}\n\n\tconst defaultActiveToolNames: ToolName[] = [\"read\", \"bash\", \"edit\", \"write\"];\n\tconst allowedToolNames = options.tools ?? (options.noTools === \"all\" ? [] : undefined);\n\tconst excludedToolNames = options.excludeTools;\n\tconst excludedToolNameSet = excludedToolNames ? new Set(excludedToolNames) : undefined;\n\tconst initialActiveToolNames: string[] = (\n\t\toptions.tools ? [...options.tools] : options.noTools ? [] : defaultActiveToolNames\n\t).filter((name) => !excludedToolNameSet?.has(name));\n\n\tlet agent: Agent;\n\n\t// Create convertToLlm wrapper that filters images if blockImages is enabled (defense-in-depth)\n\tconst convertToLlmWithBlockImages = (messages: AgentMessage[]): Message[] => {\n\t\tconst converted = convertToLlm(messages);\n\t\t// Check setting dynamically so mid-session changes take effect\n\t\tif (!settingsManager.getBlockImages()) {\n\t\t\treturn converted;\n\t\t}\n\t\t// Filter out ImageContent from all messages, replacing with text placeholder\n\t\treturn converted.map((msg) => {\n\t\t\tif (msg.role === \"user\" || msg.role === \"toolResult\") {\n\t\t\t\tconst content = msg.content;\n\t\t\t\tif (Array.isArray(content)) {\n\t\t\t\t\tconst hasImages = content.some((c) => c.type === \"image\");\n\t\t\t\t\tif (hasImages) {\n\t\t\t\t\t\tconst filteredContent = content\n\t\t\t\t\t\t\t.map((c) =>\n\t\t\t\t\t\t\t\tc.type === \"image\" ? { type: \"text\" as const, text: \"Image reading is disabled.\" } : c,\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t.filter(\n\t\t\t\t\t\t\t\t(c, i, arr) =>\n\t\t\t\t\t\t\t\t\t// Dedupe consecutive \"Image reading is disabled.\" texts\n\t\t\t\t\t\t\t\t\t!(\n\t\t\t\t\t\t\t\t\t\tc.type === \"text\" &&\n\t\t\t\t\t\t\t\t\t\tc.text === \"Image reading is disabled.\" &&\n\t\t\t\t\t\t\t\t\t\ti > 0 &&\n\t\t\t\t\t\t\t\t\t\tarr[i - 1].type === \"text\" &&\n\t\t\t\t\t\t\t\t\t\t(arr[i - 1] as { type: \"text\"; text: string }).text === \"Image reading is disabled.\"\n\t\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\treturn { ...msg, content: filteredContent };\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn msg;\n\t\t});\n\t};\n\n\tconst extensionRunnerRef: { current?: ExtensionRunner } = {};\n\tconst providerNetworkBeforeRequest = options.providerNetworkPolicy\n\t\t? createBeforeProviderNetworkRequest(options.providerNetworkPolicy, options.onProviderNetworkAudit)\n\t\t: undefined;\n\n\tagent = new Agent({\n\t\tinitialState: {\n\t\t\tsystemPrompt: \"\",\n\t\t\tmodel,\n\t\t\tthinkingLevel,\n\t\t\ttools: [],\n\t\t},\n\t\tconvertToLlm: convertToLlmWithBlockImages,\n\t\tstreamFn: createAgentStreamFunction({\n\t\t\tmodelRegistry,\n\t\t\tsettingsManager,\n\t\t\tproviderNetworkBeforeRequest,\n\t\t}),\n\t\tonPayload: async (payload, _model) => {\n\t\t\tconst runner = extensionRunnerRef.current;\n\t\t\tif (!runner?.hasHandlers(\"before_provider_request\")) {\n\t\t\t\treturn payload;\n\t\t\t}\n\t\t\treturn runner.emitBeforeProviderRequest(payload);\n\t\t},\n\t\tonResponse: async (response, _model) => {\n\t\t\tconst runner = extensionRunnerRef.current;\n\t\t\tif (!runner?.hasHandlers(\"after_provider_response\")) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tawait runner.emit({\n\t\t\t\ttype: \"after_provider_response\",\n\t\t\t\tstatus: response.status,\n\t\t\t\theaders: response.headers,\n\t\t\t});\n\t\t},\n\t\tsessionId: sessionManager.getSessionId(),\n\t\ttransformContext: async (messages) => {\n\t\t\tconst runner = extensionRunnerRef.current;\n\t\t\tif (!runner) return messages;\n\t\t\treturn runner.emitContext(messages);\n\t\t},\n\t\tsteeringMode: settingsManager.getSteeringMode(),\n\t\tfollowUpMode: settingsManager.getFollowUpMode(),\n\t\ttransport: settingsManager.getTransport(),\n\t\tthinkingBudgets: settingsManager.getThinkingBudgets(),\n\t\tmaxRetryDelayMs: settingsManager.getProviderRetrySettings().maxRetryDelayMs,\n\t});\n\n\t// Restore messages if session has existing data\n\tif (hasExistingSession) {\n\t\tagent.state.messages = existingSession.messages;\n\t\tif (!hasThinkingEntry) {\n\t\t\tsessionManager.appendThinkingLevelChange(thinkingLevel);\n\t\t}\n\t} else {\n\t\t// Save initial model and thinking level for new sessions so they can be restored on resume\n\t\tif (model) {\n\t\t\tsessionManager.appendModelChange(model.provider, model.id);\n\t\t}\n\t\tsessionManager.appendThinkingLevelChange(thinkingLevel);\n\t}\n\n\tconst session = new AgentSession({\n\t\tagent,\n\t\tsessionManager,\n\t\tsettingsManager,\n\t\tcwd,\n\t\tscopedModels: options.scopedModels,\n\t\tresourceLoader,\n\t\tcustomTools: options.customTools,\n\t\tmodelRegistry,\n\t\tinitialActiveToolNames,\n\t\tallowedToolNames,\n\t\texcludedToolNames,\n\t\textensionRunnerRef,\n\t\tloadoutAccessPolicy: options.loadoutAccessPolicy,\n\t\tbashSandboxPreflight: options.bashSandboxPreflight,\n\t\tsessionStartEvent: options.sessionStartEvent,\n\t});\n\tconst extensionsResult = resourceLoader.getExtensions();\n\n\treturn {\n\t\tsession,\n\t\textensionsResult,\n\t\tmodelFallbackMessage,\n\t};\n}\n"]}

package/dist/core/sdk.js

@@ -1,6 +1,6 @@
 import { join } from "node:path";
 import { Agent } from "@earendil-works/omk-agent-core";
-import { clampThinkingLevel, streamSimple } from "@earendil-works/omk-ai";
+import { assertProviderNetworkRequestAllowed, clampThinkingLevel, createProviderNetworkErrorStream, streamSimple, } from "@earendil-works/omk-ai";
 import { getAgentDir } from "../config.js";
 import { resolvePath } from "../utils/paths.js";
 import { AgentSession } from "./agent-session.js";
@@ -12,6 +12,7 @@ import { ModelRegistry } from "./model-registry.js";
 import { findInitialModel } from "./model-resolver.js";
 import { mergeProviderAttributionHeaders } from "./provider-attribution.js";
 import { DefaultResourceLoader } from "./resource-loader.js";
+import { decideNetworkAccess } from "./sandbox/policy.js";
 import { getDefaultSessionDir, SessionManager } from "./session-manager.js";
 import { SettingsManager } from "./settings-manager.js";
 import { time } from "./timings.js";
@@ -25,41 +26,134 @@ createCodingTools, createReadOnlyTools, createReadTool, createBashTool, createEd
 function getDefaultAgentDir() {
     return getAgentDir();
 }
+function syntheticProviderSandboxPolicy(mode, network) {
+    return {
+        mode,
+        profile: "networked",
+        filesystem: {
+            root: "/",
+            readAllow: [],
+            readDeny: [],
+            writeAllow: [],
+            denyWrite: [],
+            tempWrite: [],
+            followSymlinks: false,
+        },
+        network,
+        process: { allowExec: true, allowShell: true, allowPrivilege: false },
+    };
+}
 /**
- * Create an AgentSession with the specified options.
- *
- * @example
- * ```typescript
- * // Minimal - uses defaults
- * const { session } = await createAgentSession();
- *
- * // With explicit model
- * import { getModel } from '@earendil-works/omk-ai';
- * const { session } = await createAgentSession({
- *   model: getModel('anthropic', 'claude-opus-4-5'),
- *   thinkingLevel: 'high',
- * });
+ * Map a sanitized provider network request to a provider-neutral decision.
+ * Reuses the pure sandbox network decision logic (`decideNetworkAccess`) so
+ * allow/deny/loopback semantics stay consistent with the rest of the sandbox.
+ */
+export function decideProviderNetworkAccess(config, request) {
+    if (config.mode === "off") {
+        return {
+            allowed: true,
+            rule: "provider-network.off",
+            reason: "Provider network policy is disabled.",
+            mode: "off",
+        };
+    }
+    const sandboxMode = config.mode === "audit" ? "audit" : "enforce";
+    const sandboxDecision = decideNetworkAccess(syntheticProviderSandboxPolicy(sandboxMode, config.network), {
+        host: request.host,
+        url: request.url,
+        loopback: request.loopback,
+        browser: false,
+    });
+    if (config.mode === "audit") {
+        return {
+            allowed: true,
+            wouldDeny: !sandboxDecision.allowed,
+            rule: sandboxDecision.rule,
+            reason: sandboxDecision.reason,
+            mode: "audit",
+        };
+    }
+    return {
+        allowed: sandboxDecision.allowed,
+        rule: sandboxDecision.rule,
+        reason: sandboxDecision.reason,
+        mode: "enforce",
+    };
+}
+/**
+ * Create the `beforeNetworkRequest` hook installed on the agent stream
+ * function. The optional audit sink receives only sanitized metadata
+ * (provider, api, model id, host, protocol, port, transport, purpose, mode,
+ * rule, allowed/wouldDeny) and never headers, API keys, or request bodies.
+ */
+export function createBeforeProviderNetworkRequest(config, onAudit) {
+    return (request) => {
+        const decision = decideProviderNetworkAccess(config, request);
+        onAudit?.({
+            provider: request.provider,
+            api: String(request.api),
+            modelId: request.modelId,
+            host: request.host,
+            protocol: request.protocol,
+            port: request.port,
+            transport: request.transport,
+            purpose: request.purpose,
+            mode: decision.mode,
+            rule: decision.rule,
+            allowed: decision.allowed,
+            wouldDeny: decision.wouldDeny,
+        });
+        return decision;
+    };
+}
+/**
+ * Build the Agent `streamFn` used by `createAgentSession`.
  *
- * // Continue previous session
- * const { session, modelFallbackMessage } = await createAgentSession({
- *   continueSession: true,
- * });
+ * Contract preserved from the previous inline implementation:
+ * - resolves API key/headers via the model registry,
+ * - applies provider retry/timeout settings,
+ * - merges provider attribution headers.
  *
- * // Full control
- * const loader = new DefaultResourceLoader({
- *   cwd: process.cwd(),
- *   agentDir: getAgentDir(),
- *   settingsManager: SettingsManager.create(),
- * });
- * await loader.reload();
- * const { session } = await createAgentSession({
- *   model: myModel,
- *   tools: ["read", "bash"],
- *   resourceLoader: loader,
- *   sessionManager: SessionManager.inMemory(),
- * });
- * ```
+ * Added behavior: when `providerNetworkBeforeRequest` is set, a sanitized
+ * preflight runs BEFORE auth resolution. A deny returns a sanitized error
+ * stream (no headers/API keys/bodies/prompts/responses are exposed) and skips
+ * auth + provider invocation entirely. The hook is also forwarded to
+ * `streamSimple` so provider-derived endpoints can be checked deeper.
  */
+export function createAgentStreamFunction(deps) {
+    const { modelRegistry, settingsManager, providerNetworkBeforeRequest } = deps;
+    return async (model, context, options) => {
+        if (providerNetworkBeforeRequest) {
+            try {
+                await assertProviderNetworkRequestAllowed({ model, purpose: "chat", transport: "http", source: "model.baseUrl" }, providerNetworkBeforeRequest);
+            }
+            catch (error) {
+                return createProviderNetworkErrorStream(model, error);
+            }
+        }
+        const auth = await modelRegistry.getApiKeyAndHeaders(model);
+        if (!auth.ok) {
+            throw new Error(auth.error);
+        }
+        const providerRetrySettings = settingsManager.getProviderRetrySettings();
+        const httpIdleTimeoutMs = settingsManager.getHttpIdleTimeoutMs();
+        // SDKs treat timeout=0 as 0ms (immediate timeout), not "no timeout".
+        // Use max int32 to effectively disable the timeout.
+        const effectiveTimeoutMs = httpIdleTimeoutMs === 0 ? 2147483647 : httpIdleTimeoutMs;
+        const timeoutMs = options?.timeoutMs ?? providerRetrySettings.timeoutMs ?? effectiveTimeoutMs;
+        const websocketConnectTimeoutMs = options?.websocketConnectTimeoutMs ?? settingsManager.getWebSocketConnectTimeoutMs();
+        return streamSimple(model, context, {
+            ...options,
+            apiKey: auth.apiKey,
+            timeoutMs,
+            websocketConnectTimeoutMs,
+            maxRetries: options?.maxRetries ?? providerRetrySettings.maxRetries,
+            maxRetryDelayMs: options?.maxRetryDelayMs ?? providerRetrySettings.maxRetryDelayMs,
+            headers: mergeProviderAttributionHeaders(model, settingsManager, options?.sessionId, auth.headers, options?.headers),
+            ...(providerNetworkBeforeRequest ? { beforeNetworkRequest: providerNetworkBeforeRequest } : {}),
+        });
+    };
+}
 export async function createAgentSession(options = {}) {
     const cwd = resolvePath(options.cwd ?? options.sessionManager?.getCwd() ?? process.cwd());
     const agentDir = options.agentDir ? resolvePath(options.agentDir) : getDefaultAgentDir();
@@ -72,7 +166,13 @@ export async function createAgentSession(options = {}) {
     const settingsManager = options.settingsManager ?? SettingsManager.create(cwd, agentDir);
     const sessionManager = options.sessionManager ?? SessionManager.create(cwd, getDefaultSessionDir(cwd, agentDir));
     if (!resourceLoader) {
-        resourceLoader = new DefaultResourceLoader({ cwd, agentDir, settingsManager });
+        resourceLoader = new DefaultResourceLoader({
+            cwd,
+            agentDir,
+            settingsManager,
+            extensionExecSandbox: options.extensionExecSandbox,
+            trialRuntime: options.packageTrialRuntime,
+        });
         await resourceLoader.reload();
         time("resourceLoader.reload");
     }
@@ -165,6 +265,9 @@ export async function createAgentSession(options = {}) {
         });
     };
     const extensionRunnerRef = {};
+    const providerNetworkBeforeRequest = options.providerNetworkPolicy
+        ? createBeforeProviderNetworkRequest(options.providerNetworkPolicy, options.onProviderNetworkAudit)
+        : undefined;
     agent = new Agent({
         initialState: {
             systemPrompt: "",
@@ -173,28 +276,11 @@ export async function createAgentSession(options = {}) {
             tools: [],
         },
         convertToLlm: convertToLlmWithBlockImages,
-        streamFn: async (model, context, options) => {
-            const auth = await modelRegistry.getApiKeyAndHeaders(model);
-            if (!auth.ok) {
-                throw new Error(auth.error);
-            }
-            const providerRetrySettings = settingsManager.getProviderRetrySettings();
-            const httpIdleTimeoutMs = settingsManager.getHttpIdleTimeoutMs();
-            // SDKs treat timeout=0 as 0ms (immediate timeout), not "no timeout".
-            // Use max int32 to effectively disable the timeout.
-            const effectiveTimeoutMs = httpIdleTimeoutMs === 0 ? 2147483647 : httpIdleTimeoutMs;
-            const timeoutMs = options?.timeoutMs ?? providerRetrySettings.timeoutMs ?? effectiveTimeoutMs;
-            const websocketConnectTimeoutMs = options?.websocketConnectTimeoutMs ?? settingsManager.getWebSocketConnectTimeoutMs();
-            return streamSimple(model, context, {
-                ...options,
-                apiKey: auth.apiKey,
-                timeoutMs,
-                websocketConnectTimeoutMs,
-                maxRetries: options?.maxRetries ?? providerRetrySettings.maxRetries,
-                maxRetryDelayMs: options?.maxRetryDelayMs ?? providerRetrySettings.maxRetryDelayMs,
-                headers: mergeProviderAttributionHeaders(model, settingsManager, options?.sessionId, auth.headers, options?.headers),
-            });
-        },
+        streamFn: createAgentStreamFunction({
+            modelRegistry,
+            settingsManager,
+            providerNetworkBeforeRequest,
+        }),
         onPayload: async (payload, _model) => {
             const runner = extensionRunnerRef.current;
             if (!runner?.hasHandlers("before_provider_request")) {
@@ -253,6 +339,8 @@ export async function createAgentSession(options = {}) {
         allowedToolNames,
         excludedToolNames,
         extensionRunnerRef,
+        loadoutAccessPolicy: options.loadoutAccessPolicy,
+        bashSandboxPreflight: options.bashSandboxPreflight,
         sessionStartEvent: options.sessionStartEvent,
     });
     const extensionsResult = resourceLoader.getExtensions();