open-multi-agent-kit 0.93.0 → 0.94.1

package/dist/core/session-bash-runtime.js

@@ -0,0 +1,167 @@
+/**
+ * Session bash runtime: verified-evidence executor, default sandbox preflight,
+ * and git-aware workspace scope in one cohesive, lazily-initialized unit.
+ *
+ * Extracted from AgentSession so the session class stays a coordinator; every
+ * default-on behavior here keeps its opt-out:
+ * - `OMK_VERIFIED_BASH=0` disables the receipt-bound executor.
+ * - `OMK_BASH_SANDBOX=0` disables the default sandbox preflight.
+ */
+import { join } from "node:path";
+import { EvidenceReceiptStore } from "../guardrails/evidence-receipt-store.js";
+import { VerifiedEvidenceExecutor } from "../guardrails/verified-executor.js";
+import { stripAnsi } from "../utils/ansi.js";
+import { getShellConfig, sanitizeBinaryOutput } from "../utils/shell.js";
+import { detectSandboxBackend } from "./sandbox/backend.js";
+import { createWorkspaceSandboxPolicy, resolveBashSandboxMode } from "./sandbox/default-policy.js";
+import { executeVerifiedBash } from "./verified-bash-adapter.js";
+import { isVerifiedBashEnabled, resolveSessionWorkspaceScope } from "./verified-bash-runtime.js";
+export class SessionBashRuntime {
+    verifiedExecutor;
+    detectedBackend;
+    defaultSandboxPreflight;
+    sandboxModeOverride;
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Interactive promotion: switch the default sandbox mode at runtime
+     * (audit ↔ enforce ↔ off) without restarting the session. `undefined`
+     * restores env-based resolution.
+     */
+    setSandboxMode(mode) {
+        this.sandboxModeOverride = mode;
+        this.defaultSandboxPreflight = undefined;
+    }
+    get sandboxMode() {
+        return this.sandboxModeOverride ?? resolveBashSandboxMode();
+    }
+    /** Lazy receipt executor bound to the session replay ledger (default-on path). */
+    verifiedEvidenceExecutor() {
+        const { replayLedger, replayGoalId, getSessionFile, cwd } = this.options;
+        if (!replayLedger || !replayGoalId || !isVerifiedBashEnabled())
+            return undefined;
+        if (!this.verifiedExecutor) {
+            const sessionFile = getSessionFile();
+            const evidenceRoot = sessionFile
+                ? `${sessionFile}.evidence`
+                : join(cwd, ".omk", "session-evidence", replayGoalId);
+            this.verifiedExecutor = new VerifiedEvidenceExecutor({
+                store: new EvidenceReceiptStore(join(evidenceRoot, "receipts")),
+                ledger: replayLedger,
+            });
+        }
+        return this.verifiedExecutor;
+    }
+    /** Configured preflight wins; otherwise the default audit/enforce preflight. */
+    sandboxPreflight(override) {
+        const preflight = override ?? this.options.configuredSandboxPreflight ?? this.getDefaultSandboxPreflight();
+        if (!preflight || preflight.policy.mode === "off" || preflight.backend) {
+            return preflight;
+        }
+        this.detectedBackend ??= detectSandboxBackend();
+        return { ...preflight, backend: this.detectedBackend };
+    }
+    /**
+     * Default-on sandbox preflight. `audit` (default) keeps the spawn unwrapped
+     * but reports every decision to the replay ledger; `enforce` activates the
+     * real OS backend and fails closed when none is available.
+     */
+    getDefaultSandboxPreflight() {
+        if (this.defaultSandboxPreflight !== undefined) {
+            return this.defaultSandboxPreflight ?? undefined;
+        }
+        const mode = this.sandboxMode;
+        if (mode === "off") {
+            this.defaultSandboxPreflight = null;
+            return undefined;
+        }
+        this.detectedBackend ??= detectSandboxBackend();
+        const detected = this.detectedBackend;
+        const backend = mode === "enforce"
+            ? detected
+            : { platform: detected.platform, backendAvailable: false, domainAllowlistAvailable: false };
+        // Root must cover the actual execution cwd (session manager), not just the
+        // session workspace: in-memory or RPC sessions can legitimately differ.
+        const policy = createWorkspaceSandboxPolicy(this.options.getExecutionCwd() || this.options.cwd, mode);
+        this.defaultSandboxPreflight = {
+            policy,
+            backend,
+            onSpawnDecision: (decision) => {
+                if (decision.rule === "sandbox.off")
+                    return;
+                this.options.appendReplayEvent("sandbox_audit", {
+                    mode,
+                    rule: decision.rule,
+                    reason: decision.reason,
+                    wrapped: "wrapped" in decision ? decision.wrapped : false,
+                    backendAvailable: backend.backendAvailable,
+                    platform: backend.platform,
+                });
+            },
+        };
+        return this.defaultSandboxPreflight;
+    }
+    /** Git-aware workspace scope for verified bash receipts (TTL-cached). */
+    workspaceScope() {
+        return resolveSessionWorkspaceScope(this.options.cwd);
+    }
+    get goalId() {
+        return this.options.replayGoalId;
+    }
+    get laneId() {
+        return this.options.replayLaneId;
+    }
+    /**
+     * Receipt-bound bash execution. Returns `undefined` when the verified path
+     * is unavailable (no ledger / opted out) so the caller falls back to the
+     * legacy executor. Streams sanitized text through `onChunk` while the
+     * adapter owns the raw receipt bytes.
+     */
+    async executeVerified(request) {
+        const evidenceExecutor = this.verifiedEvidenceExecutor();
+        const goalId = this.options.replayGoalId;
+        if (!evidenceExecutor || !goalId)
+            return undefined;
+        const { shell } = getShellConfig(request.shellPath);
+        const command = request.resolvedCommand;
+        const claim = command.length > 200 ? `bash: ${command.slice(0, 197)}...` : `bash: ${command}`;
+        const outputChunks = [];
+        const decoder = new TextDecoder();
+        const execution = await executeVerifiedBash({
+            evidenceExecutor,
+            operations: request.operations,
+            goalId,
+            ...(this.options.replayLaneId !== undefined ? { laneId: this.options.replayLaneId } : {}),
+            claim,
+            shell,
+            script: command,
+            cwd: request.cwd,
+            timeoutMs: null,
+            workspaceScope: this.workspaceScope(),
+            executor: "bash-tool",
+            signal: request.signal,
+            onData: (data) => {
+                const text = sanitizeBinaryOutput(stripAnsi(decoder.decode(data, { stream: true }))).replace(/\r/g, "");
+                if (!text)
+                    return;
+                outputChunks.push(text);
+                request.onChunk(text);
+            },
+        });
+        const status = execution.receipt.core.status;
+        // Preserve pre-adapter timeout throw semantics after the receipt is bound.
+        if (status === "timeout") {
+            throw new Error("timeout:0");
+        }
+        const cancelled = status === "aborted" || request.signal.aborted;
+        return {
+            output: outputChunks.join(""),
+            exitCode: cancelled ? undefined : (execution.receipt.core.exitCode ?? undefined),
+            cancelled,
+            truncated: false,
+        };
+    }
+}
+//# sourceMappingURL=session-bash-runtime.js.map

package/dist/core/session-bash-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-bash-runtime.js","sourceRoot":"","sources":["../../src/core/session-bash-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAE/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAGnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAejG,MAAM,OAAO,kBAAkB;IACtB,gBAAgB,CAAuC;IACvD,eAAe,CAAmC;IAClD,uBAAuB,CAA0C;IACjE,mBAAmB,CAA0B;IACpC,OAAO,CAA4B;IAEpD,YAAY,OAAkC,EAAE;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAAA,CACvB;IAED;;;;OAIG;IACH,cAAc,CAAC,IAA6B,EAAQ;QACnD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAAA,CACzC;IAED,IAAI,WAAW,GAAgB;QAC9B,OAAO,IAAI,CAAC,mBAAmB,IAAI,sBAAsB,EAAE,CAAC;IAAA,CAC5D;IAED,kFAAkF;IAClF,wBAAwB,GAAyC;QAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACzE,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,IAAI,CAAC,qBAAqB,EAAE;YAAE,OAAO,SAAS,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;YACrC,MAAM,YAAY,GAAG,WAAW;gBAC/B,CAAC,CAAC,GAAG,WAAW,WAAW;gBAC3B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC;YACvD,IAAI,CAAC,gBAAgB,GAAG,IAAI,wBAAwB,CAAC;gBACpD,KAAK,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;gBAC/D,MAAM,EAAE,YAAY;aACpB,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAAA,CAC7B;IAED,gFAAgF;IAChF,gBAAgB,CAAC,QAA+B,EAAoC;QACnF,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,0BAA0B,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAC3G,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACxE,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,eAAe,KAAK,oBAAoB,EAAE,CAAC;QAChD,OAAO,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;IAAA,CACvD;IAED;;;;OAIG;IACK,0BAA0B,GAAqC;QACtE,IAAI,IAAI,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,uBAAuB,IAAI,SAAS,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACpC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,eAAe,KAAK,oBAAoB,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;QACtC,MAAM,OAAO,GACZ,IAAI,KAAK,SAAS;YACjB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC;QAC9F,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtG,IAAI,CAAC,uBAAuB,GAAG;YAC9B,MAAM;YACN,OAAO;YACP,eAAe,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC9B,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa;oBAAE,OAAO;gBAC5C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,eAAe,EAAE;oBAC/C,IAAI;oBACJ,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,OAAO,EAAE,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;oBACzD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;oBAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC1B,CAAC,CAAC;YAAA,CACH;SACD,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC;IAAA,CACpC;IAED,yEAAyE;IACzE,cAAc,GAAG;QAChB,OAAO,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAAA,CACtD;IAED,IAAI,MAAM,GAAuB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IAAA,CACjC;IAED,IAAI,MAAM,GAAuB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;IAAA,CACjC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,OAOrB,EAAmC;QACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,gBAAgB,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACnD,MAAM,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,OAAO,EAAE,CAAC;QAC9F,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;YAC3C,gBAAgB;YAChB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,KAAK;YACL,KAAK;YACL,MAAM,EAAE,OAAO;YACf,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;YACrC,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAA,CACtB;SACD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7C,2EAA2E;QAC3E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QACjE,OAAO;YACN,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;YAChF,SAAS;YACT,SAAS,EAAE,KAAK;SAChB,CAAC;IAAA,CACF;CACD","sourcesContent":["/**\n * Session bash runtime: verified-evidence executor, default sandbox preflight,\n * and git-aware workspace scope in one cohesive, lazily-initialized unit.\n *\n * Extracted from AgentSession so the session class stays a coordinator; every\n * default-on behavior here keeps its opt-out:\n * - `OMK_VERIFIED_BASH=0` disables the receipt-bound executor.\n * - `OMK_BASH_SANDBOX=0` disables the default sandbox preflight.\n */\nimport { join } from \"node:path\";\nimport { EvidenceReceiptStore } from \"../guardrails/evidence-receipt-store.ts\";\nimport type { ReplayLedgerManager } from \"../guardrails/evidence-system.ts\";\nimport { VerifiedEvidenceExecutor } from \"../guardrails/verified-executor.ts\";\nimport type { ReplayEventType } from \"../types/evidence.ts\";\nimport { stripAnsi } from \"../utils/ansi.ts\";\nimport { getShellConfig, sanitizeBinaryOutput } from \"../utils/shell.ts\";\nimport type { BashResult } from \"./bash-executor.ts\";\nimport { detectSandboxBackend } from \"./sandbox/backend.ts\";\nimport { createWorkspaceSandboxPolicy, resolveBashSandboxMode } from \"./sandbox/default-policy.ts\";\nimport type { SandboxBackendStatus, SandboxMode } from \"./sandbox/policy.ts\";\nimport type { BashOperations, BashSandboxPreflight } from \"./tools/bash.ts\";\nimport { executeVerifiedBash } from \"./verified-bash-adapter.ts\";\nimport { isVerifiedBashEnabled, resolveSessionWorkspaceScope } from \"./verified-bash-runtime.ts\";\n\nexport interface SessionBashRuntimeOptions {\n\treadonly cwd: string;\n\t/** Actual execution cwd authority (session manager). */\n\treadonly getExecutionCwd: () => string;\n\t/** Session file anchor for the receipt store; undefined for ephemeral sessions. */\n\treadonly getSessionFile: () => string | undefined;\n\treadonly replayLedger: ReplayLedgerManager | undefined;\n\treadonly replayGoalId: string | undefined;\n\treadonly replayLaneId: string | undefined;\n\treadonly configuredSandboxPreflight: BashSandboxPreflight | undefined;\n\treadonly appendReplayEvent: (type: ReplayEventType, payload: unknown) => void;\n}\n\nexport class SessionBashRuntime {\n\tprivate verifiedExecutor: VerifiedEvidenceExecutor | undefined;\n\tprivate detectedBackend: SandboxBackendStatus | undefined;\n\tprivate defaultSandboxPreflight: BashSandboxPreflight | null | undefined;\n\tprivate sandboxModeOverride: SandboxMode | undefined;\n\tprivate readonly options: SessionBashRuntimeOptions;\n\n\tconstructor(options: SessionBashRuntimeOptions) {\n\t\tthis.options = options;\n\t}\n\n\t/**\n\t * Interactive promotion: switch the default sandbox mode at runtime\n\t * (audit ↔ enforce ↔ off) without restarting the session. `undefined`\n\t * restores env-based resolution.\n\t */\n\tsetSandboxMode(mode: SandboxMode | undefined): void {\n\t\tthis.sandboxModeOverride = mode;\n\t\tthis.defaultSandboxPreflight = undefined;\n\t}\n\n\tget sandboxMode(): SandboxMode {\n\t\treturn this.sandboxModeOverride ?? resolveBashSandboxMode();\n\t}\n\n\t/** Lazy receipt executor bound to the session replay ledger (default-on path). */\n\tverifiedEvidenceExecutor(): VerifiedEvidenceExecutor | undefined {\n\t\tconst { replayLedger, replayGoalId, getSessionFile, cwd } = this.options;\n\t\tif (!replayLedger || !replayGoalId || !isVerifiedBashEnabled()) return undefined;\n\t\tif (!this.verifiedExecutor) {\n\t\t\tconst sessionFile = getSessionFile();\n\t\t\tconst evidenceRoot = sessionFile\n\t\t\t\t? `${sessionFile}.evidence`\n\t\t\t\t: join(cwd, \".omk\", \"session-evidence\", replayGoalId);\n\t\t\tthis.verifiedExecutor = new VerifiedEvidenceExecutor({\n\t\t\t\tstore: new EvidenceReceiptStore(join(evidenceRoot, \"receipts\")),\n\t\t\t\tledger: replayLedger,\n\t\t\t});\n\t\t}\n\t\treturn this.verifiedExecutor;\n\t}\n\n\t/** Configured preflight wins; otherwise the default audit/enforce preflight. */\n\tsandboxPreflight(override?: BashSandboxPreflight): BashSandboxPreflight | undefined {\n\t\tconst preflight = override ?? this.options.configuredSandboxPreflight ?? this.getDefaultSandboxPreflight();\n\t\tif (!preflight || preflight.policy.mode === \"off\" || preflight.backend) {\n\t\t\treturn preflight;\n\t\t}\n\t\tthis.detectedBackend ??= detectSandboxBackend();\n\t\treturn { ...preflight, backend: this.detectedBackend };\n\t}\n\n\t/**\n\t * Default-on sandbox preflight. `audit` (default) keeps the spawn unwrapped\n\t * but reports every decision to the replay ledger; `enforce` activates the\n\t * real OS backend and fails closed when none is available.\n\t */\n\tprivate getDefaultSandboxPreflight(): BashSandboxPreflight | undefined {\n\t\tif (this.defaultSandboxPreflight !== undefined) {\n\t\t\treturn this.defaultSandboxPreflight ?? undefined;\n\t\t}\n\t\tconst mode = this.sandboxMode;\n\t\tif (mode === \"off\") {\n\t\t\tthis.defaultSandboxPreflight = null;\n\t\t\treturn undefined;\n\t\t}\n\t\tthis.detectedBackend ??= detectSandboxBackend();\n\t\tconst detected = this.detectedBackend;\n\t\tconst backend: SandboxBackendStatus =\n\t\t\tmode === \"enforce\"\n\t\t\t\t? detected\n\t\t\t\t: { platform: detected.platform, backendAvailable: false, domainAllowlistAvailable: false };\n\t\t// Root must cover the actual execution cwd (session manager), not just the\n\t\t// session workspace: in-memory or RPC sessions can legitimately differ.\n\t\tconst policy = createWorkspaceSandboxPolicy(this.options.getExecutionCwd() || this.options.cwd, mode);\n\t\tthis.defaultSandboxPreflight = {\n\t\t\tpolicy,\n\t\t\tbackend,\n\t\t\tonSpawnDecision: (decision) => {\n\t\t\t\tif (decision.rule === \"sandbox.off\") return;\n\t\t\t\tthis.options.appendReplayEvent(\"sandbox_audit\", {\n\t\t\t\t\tmode,\n\t\t\t\t\trule: decision.rule,\n\t\t\t\t\treason: decision.reason,\n\t\t\t\t\twrapped: \"wrapped\" in decision ? decision.wrapped : false,\n\t\t\t\t\tbackendAvailable: backend.backendAvailable,\n\t\t\t\t\tplatform: backend.platform,\n\t\t\t\t});\n\t\t\t},\n\t\t};\n\t\treturn this.defaultSandboxPreflight;\n\t}\n\n\t/** Git-aware workspace scope for verified bash receipts (TTL-cached). */\n\tworkspaceScope() {\n\t\treturn resolveSessionWorkspaceScope(this.options.cwd);\n\t}\n\n\tget goalId(): string | undefined {\n\t\treturn this.options.replayGoalId;\n\t}\n\n\tget laneId(): string | undefined {\n\t\treturn this.options.replayLaneId;\n\t}\n\n\t/**\n\t * Receipt-bound bash execution. Returns `undefined` when the verified path\n\t * is unavailable (no ledger / opted out) so the caller falls back to the\n\t * legacy executor. Streams sanitized text through `onChunk` while the\n\t * adapter owns the raw receipt bytes.\n\t */\n\tasync executeVerified(request: {\n\t\tresolvedCommand: string;\n\t\tcwd: string;\n\t\tshellPath: string | undefined;\n\t\toperations: BashOperations;\n\t\tsignal: AbortSignal;\n\t\tonChunk: (delta: string) => void;\n\t}): Promise<BashResult | undefined> {\n\t\tconst evidenceExecutor = this.verifiedEvidenceExecutor();\n\t\tconst goalId = this.options.replayGoalId;\n\t\tif (!evidenceExecutor || !goalId) return undefined;\n\t\tconst { shell } = getShellConfig(request.shellPath);\n\t\tconst command = request.resolvedCommand;\n\t\tconst claim = command.length > 200 ? `bash: ${command.slice(0, 197)}...` : `bash: ${command}`;\n\t\tconst outputChunks: string[] = [];\n\t\tconst decoder = new TextDecoder();\n\t\tconst execution = await executeVerifiedBash({\n\t\t\tevidenceExecutor,\n\t\t\toperations: request.operations,\n\t\t\tgoalId,\n\t\t\t...(this.options.replayLaneId !== undefined ? { laneId: this.options.replayLaneId } : {}),\n\t\t\tclaim,\n\t\t\tshell,\n\t\t\tscript: command,\n\t\t\tcwd: request.cwd,\n\t\t\ttimeoutMs: null,\n\t\t\tworkspaceScope: this.workspaceScope(),\n\t\t\texecutor: \"bash-tool\",\n\t\t\tsignal: request.signal,\n\t\t\tonData: (data) => {\n\t\t\t\tconst text = sanitizeBinaryOutput(stripAnsi(decoder.decode(data, { stream: true }))).replace(/\\r/g, \"\");\n\t\t\t\tif (!text) return;\n\t\t\t\toutputChunks.push(text);\n\t\t\t\trequest.onChunk(text);\n\t\t\t},\n\t\t});\n\t\tconst status = execution.receipt.core.status;\n\t\t// Preserve pre-adapter timeout throw semantics after the receipt is bound.\n\t\tif (status === \"timeout\") {\n\t\t\tthrow new Error(\"timeout:0\");\n\t\t}\n\t\tconst cancelled = status === \"aborted\" || request.signal.aborted;\n\t\treturn {\n\t\t\toutput: outputChunks.join(\"\"),\n\t\t\texitCode: cancelled ? undefined : (execution.receipt.core.exitCode ?? undefined),\n\t\t\tcancelled,\n\t\t\ttruncated: false,\n\t\t};\n\t}\n}\n"]}

package/dist/core/session-bash-service.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Session bash service: command execution, result recording, abort, and the
+ * streaming-deferral queue. Extracted from AgentSession so the session class
+ * coordinates lifecycle while this owns the bash surface end-to-end.
+ *
+ * Ordering contract (preserved from the session implementation):
+ * - results recorded while the agent is streaming are queued and flushed on
+ *   turn end (`flushPending`) so tool_use/tool_result ordering never breaks;
+ * - `recordBashResult` is idempotent-safe to call from executeBash and from
+ *   extensions that run bash themselves.
+ */
+import { type BashResult } from "./bash-executor.ts";
+import type { LoadoutAccessPolicy } from "./loadout-access-policy.ts";
+import type { BashExecutionMessage } from "./messages.ts";
+import type { SessionBashRuntime } from "./session-bash-runtime.ts";
+import type { SettingsManager } from "./settings-manager.ts";
+import { type BashOperations, type BashSandboxPreflight } from "./tools/bash.ts";
+export interface ExecuteBashOptions {
+    excludeFromContext?: boolean;
+    /** Optional identifier echoed in `bash_execution_update` events (RPC request correlation). */
+    id?: string;
+    operations?: BashOperations;
+    safetyGate?: "headless";
+    /** Trusted internal/test override for local bash sandboxing. */
+    sandboxPolicy?: BashSandboxPreflight;
+}
+export interface SessionBashServiceDeps {
+    readonly settings: SettingsManager;
+    readonly runtime: SessionBashRuntime;
+    readonly loadoutPolicy: LoadoutAccessPolicy | undefined;
+    readonly getCwd: () => string;
+    readonly emit: (event: {
+        type: "bash_execution_update";
+        id?: string;
+        delta: string;
+    }) => void;
+    readonly isStreaming: () => boolean;
+    readonly pushMessage: (message: BashExecutionMessage) => void;
+    readonly appendMessage: (message: BashExecutionMessage) => void;
+}
+export declare class SessionBashService {
+    private abortController;
+    private pendingBashMessages;
+    private readonly deps;
+    constructor(deps: SessionBashServiceDeps);
+    executeBash(command: string, onChunk?: (chunk: string) => void, options?: ExecuteBashOptions): Promise<BashResult>;
+    /**
+     * Record a bash execution result in session history.
+     * Used by executeBash and by extensions that handle bash execution themselves.
+     */
+    recordBashResult(command: string, result: BashResult, options?: {
+        excludeFromContext?: boolean;
+    }): void;
+    /** Cancel running bash command. */
+    abortBash(): void;
+    get isBashRunning(): boolean;
+    get hasPendingBashMessages(): boolean;
+    /** Flush queued results after the agent turn completes (ordering contract). */
+    flushPending(): void;
+}
+//# sourceMappingURL=session-bash-service.d.ts.map

package/dist/core/session-bash-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-bash-service.d.ts","sourceRoot":"","sources":["../../src/core/session-bash-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,UAAU,EAA6B,MAAM,oBAAoB,CAAC;AAOhF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAA6B,MAAM,iBAAiB,CAAC;AAE5G,MAAM,WAAW,kBAAkB;IAClC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,8FAA8F;IAC9F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,gEAAgE;IAChE,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,uBAAuB,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC9F,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC9D,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,IAAI,CAAC;CAChE;AAUD,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,eAAe,CAA8B;IACrD,OAAO,CAAC,mBAAmB,CAA8B;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAE9C,YAAY,IAAI,EAAE,sBAAsB,EAEvC;IAEK,WAAW,CAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,EACjC,OAAO,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAoFrB;IAED;;;OAGG;IACH,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAoBtG;IAED,mCAAmC;IACnC,SAAS,IAAI,IAAI,CAEhB;IAED,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED,IAAI,sBAAsB,IAAI,OAAO,CAEpC;IAED,+EAA+E;IAC/E,YAAY,IAAI,IAAI,CAOnB;CACD","sourcesContent":["/**\n * Session bash service: command execution, result recording, abort, and the\n * streaming-deferral queue. Extracted from AgentSession so the session class\n * coordinates lifecycle while this owns the bash surface end-to-end.\n *\n * Ordering contract (preserved from the session implementation):\n * - results recorded while the agent is streaming are queued and flushed on\n *   turn end (`flushPending`) so tool_use/tool_result ordering never breaks;\n * - `recordBashResult` is idempotent-safe to call from executeBash and from\n *   extensions that run bash themselves.\n */\nimport { type BashResult, executeBashWithOperations } from \"./bash-executor.ts\";\nimport { classifyShellCommand } from \"./command-safety.ts\";\nimport {\n\tbuildBlockedBashResult,\n\tevaluateCommandGate,\n\tisCommandSafetyAssumeYesEnabled,\n} from \"./extensions/builtin/command-safety-gate.ts\";\nimport type { LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport { assertLoadoutAccess, decideLoadoutAccess } from \"./loadout-access-policy.ts\";\nimport type { BashExecutionMessage } from \"./messages.ts\";\nimport type { SessionBashRuntime } from \"./session-bash-runtime.ts\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { type BashOperations, type BashSandboxPreflight, createLocalBashOperations } from \"./tools/bash.ts\";\n\nexport interface ExecuteBashOptions {\n\texcludeFromContext?: boolean;\n\t/** Optional identifier echoed in `bash_execution_update` events (RPC request correlation). */\n\tid?: string;\n\toperations?: BashOperations;\n\tsafetyGate?: \"headless\";\n\t/** Trusted internal/test override for local bash sandboxing. */\n\tsandboxPolicy?: BashSandboxPreflight;\n}\n\nexport interface SessionBashServiceDeps {\n\treadonly settings: SettingsManager;\n\treadonly runtime: SessionBashRuntime;\n\treadonly loadoutPolicy: LoadoutAccessPolicy | undefined;\n\treadonly getCwd: () => string;\n\treadonly emit: (event: { type: \"bash_execution_update\"; id?: string; delta: string }) => void;\n\treadonly isStreaming: () => boolean;\n\treadonly pushMessage: (message: BashExecutionMessage) => void;\n\treadonly appendMessage: (message: BashExecutionMessage) => void;\n}\n\nfunction isSandboxDeniedError(error: unknown): error is Error {\n\treturn error instanceof Error && error.message.startsWith(\"sandbox: shell denied\");\n}\n\nfunction buildSandboxDeniedBashResult(reason: string): BashResult {\n\treturn { output: reason, exitCode: 1, cancelled: false, truncated: false };\n}\n\nexport class SessionBashService {\n\tprivate abortController: AbortController | undefined;\n\tprivate pendingBashMessages: BashExecutionMessage[] = [];\n\tprivate readonly deps: SessionBashServiceDeps;\n\n\tconstructor(deps: SessionBashServiceDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\tasync executeBash(\n\t\tcommand: string,\n\t\tonChunk?: (chunk: string) => void,\n\t\toptions?: ExecuteBashOptions,\n\t): Promise<BashResult> {\n\t\tconst { settings, runtime, loadoutPolicy } = this.deps;\n\t\tconst prefix = settings.getShellCommandPrefix();\n\t\tconst shellPath = settings.getShellPath();\n\t\tconst resolvedCommand = prefix ? `${prefix}\\n${command}` : command;\n\t\tif (loadoutPolicy) {\n\t\t\tassertLoadoutAccess((request) => decideLoadoutAccess(loadoutPolicy, request), {\n\t\t\t\toperation: \"execute\",\n\t\t\t\ttoolName: \"bash\",\n\t\t\t\tcommand: resolvedCommand,\n\t\t\t});\n\t\t}\n\n\t\t// Non-negotiable safety floor for headless callers (RPC bash): hard-deny\n\t\t// block-tier commands before any shell is spawned.\n\t\tif (options?.safetyGate === \"headless\") {\n\t\t\tconst floorVerdict = classifyShellCommand(command);\n\t\t\tif (floorVerdict.risk === \"block\") {\n\t\t\t\tthrow new Error(`OMK §0.1 safety floor blocked bash: [${floorVerdict.rule}] ${floorVerdict.reason}`);\n\t\t\t}\n\t\t}\n\n\t\t// Command-safety parity for non-interactive callers (RPC bash). Interactive\n\t\t// `!`/`!!` bash is gated earlier through the user_bash extension event, which\n\t\t// keeps its prompt-based approval semantics, so it does not pass safetyGate and\n\t\t// is never double-prompted here. confirm/block-tier verdicts deny headlessly;\n\t\t// the EFFECTIVE command (after the shell command prefix) is classified.\n\t\tif (options?.safetyGate === \"headless\") {\n\t\t\tconst decision = await evaluateCommandGate(resolvedCommand, {\n\t\t\t\thasUI: false,\n\t\t\t\theadlessConfirmPolicy: isCommandSafetyAssumeYesEnabled() ? \"allow\" : \"deny\",\n\t\t\t});\n\t\t\tif (decision?.deny) {\n\t\t\t\tconst blocked = buildBlockedBashResult(decision.reason);\n\t\t\t\tthis.recordBashResult(command, blocked, options);\n\t\t\t\treturn blocked;\n\t\t\t}\n\t\t}\n\n\t\tthis.abortController = new AbortController();\n\n\t\ttry {\n\t\t\ttry {\n\t\t\t\tconst operations =\n\t\t\t\t\toptions?.operations ??\n\t\t\t\t\tcreateLocalBashOperations({\n\t\t\t\t\t\tshellPath,\n\t\t\t\t\t\tsandboxPolicy: runtime.sandboxPreflight(options?.sandboxPolicy),\n\t\t\t\t\t});\n\t\t\t\tconst cwd = this.deps.getCwd();\n\t\t\t\tconst onChunkWrapped = (delta: string) => {\n\t\t\t\t\tonChunk?.(delta);\n\t\t\t\t\tthis.deps.emit({ type: \"bash_execution_update\", id: options?.id, delta });\n\t\t\t\t};\n\n\t\t\t\t// Default-on verified path when a session ledger exists; OMK_VERIFIED_BASH=0 rolls back.\n\t\t\t\tconst verified = await runtime.executeVerified({\n\t\t\t\t\tresolvedCommand,\n\t\t\t\t\tcwd,\n\t\t\t\t\tshellPath,\n\t\t\t\t\toperations,\n\t\t\t\t\tsignal: this.abortController.signal,\n\t\t\t\t\tonChunk: onChunkWrapped,\n\t\t\t\t});\n\t\t\t\tconst result: BashResult =\n\t\t\t\t\tverified ??\n\t\t\t\t\t(await executeBashWithOperations(resolvedCommand, cwd, operations, {\n\t\t\t\t\t\tonChunk: onChunkWrapped,\n\t\t\t\t\t\tsignal: this.abortController.signal,\n\t\t\t\t\t}));\n\n\t\t\t\tthis.recordBashResult(command, result, options);\n\t\t\t\treturn result;\n\t\t\t} catch (error) {\n\t\t\t\tif (!isSandboxDeniedError(error)) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tconst blocked = buildSandboxDeniedBashResult(error.message);\n\t\t\t\tthis.recordBashResult(command, blocked, options);\n\t\t\t\treturn blocked;\n\t\t\t}\n\t\t} finally {\n\t\t\tthis.abortController = undefined;\n\t\t}\n\t}\n\n\t/**\n\t * Record a bash execution result in session history.\n\t * Used by executeBash and by extensions that handle bash execution themselves.\n\t */\n\trecordBashResult(command: string, result: BashResult, options?: { excludeFromContext?: boolean }): void {\n\t\tconst bashMessage: BashExecutionMessage = {\n\t\t\trole: \"bashExecution\",\n\t\t\tcommand,\n\t\t\toutput: result.output,\n\t\t\texitCode: result.exitCode,\n\t\t\tcancelled: result.cancelled,\n\t\t\ttruncated: result.truncated,\n\t\t\tfullOutputPath: result.fullOutputPath,\n\t\t\ttimestamp: Date.now(),\n\t\t\texcludeFromContext: options?.excludeFromContext,\n\t\t};\n\n\t\t// If agent is streaming, defer adding to avoid breaking tool_use/tool_result ordering\n\t\tif (this.deps.isStreaming()) {\n\t\t\tthis.pendingBashMessages.push(bashMessage);\n\t\t} else {\n\t\t\tthis.deps.pushMessage(bashMessage);\n\t\t\tthis.deps.appendMessage(bashMessage);\n\t\t}\n\t}\n\n\t/** Cancel running bash command. */\n\tabortBash(): void {\n\t\tthis.abortController?.abort();\n\t}\n\n\tget isBashRunning(): boolean {\n\t\treturn this.abortController !== undefined;\n\t}\n\n\tget hasPendingBashMessages(): boolean {\n\t\treturn this.pendingBashMessages.length > 0;\n\t}\n\n\t/** Flush queued results after the agent turn completes (ordering contract). */\n\tflushPending(): void {\n\t\tif (this.pendingBashMessages.length === 0) return;\n\t\tfor (const bashMessage of this.pendingBashMessages) {\n\t\t\tthis.deps.pushMessage(bashMessage);\n\t\t\tthis.deps.appendMessage(bashMessage);\n\t\t}\n\t\tthis.pendingBashMessages = [];\n\t}\n}\n"]}

package/dist/core/session-bash-service.js

@@ -0,0 +1,155 @@
+/**
+ * Session bash service: command execution, result recording, abort, and the
+ * streaming-deferral queue. Extracted from AgentSession so the session class
+ * coordinates lifecycle while this owns the bash surface end-to-end.
+ *
+ * Ordering contract (preserved from the session implementation):
+ * - results recorded while the agent is streaming are queued and flushed on
+ *   turn end (`flushPending`) so tool_use/tool_result ordering never breaks;
+ * - `recordBashResult` is idempotent-safe to call from executeBash and from
+ *   extensions that run bash themselves.
+ */
+import { executeBashWithOperations } from "./bash-executor.js";
+import { classifyShellCommand } from "./command-safety.js";
+import { buildBlockedBashResult, evaluateCommandGate, isCommandSafetyAssumeYesEnabled, } from "./extensions/builtin/command-safety-gate.js";
+import { assertLoadoutAccess, decideLoadoutAccess } from "./loadout-access-policy.js";
+import { createLocalBashOperations } from "./tools/bash.js";
+function isSandboxDeniedError(error) {
+    return error instanceof Error && error.message.startsWith("sandbox: shell denied");
+}
+function buildSandboxDeniedBashResult(reason) {
+    return { output: reason, exitCode: 1, cancelled: false, truncated: false };
+}
+export class SessionBashService {
+    abortController;
+    pendingBashMessages = [];
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async executeBash(command, onChunk, options) {
+        const { settings, runtime, loadoutPolicy } = this.deps;
+        const prefix = settings.getShellCommandPrefix();
+        const shellPath = settings.getShellPath();
+        const resolvedCommand = prefix ? `${prefix}\n${command}` : command;
+        if (loadoutPolicy) {
+            assertLoadoutAccess((request) => decideLoadoutAccess(loadoutPolicy, request), {
+                operation: "execute",
+                toolName: "bash",
+                command: resolvedCommand,
+            });
+        }
+        // Non-negotiable safety floor for headless callers (RPC bash): hard-deny
+        // block-tier commands before any shell is spawned.
+        if (options?.safetyGate === "headless") {
+            const floorVerdict = classifyShellCommand(command);
+            if (floorVerdict.risk === "block") {
+                throw new Error(`OMK §0.1 safety floor blocked bash: [${floorVerdict.rule}] ${floorVerdict.reason}`);
+            }
+        }
+        // Command-safety parity for non-interactive callers (RPC bash). Interactive
+        // `!`/`!!` bash is gated earlier through the user_bash extension event, which
+        // keeps its prompt-based approval semantics, so it does not pass safetyGate and
+        // is never double-prompted here. confirm/block-tier verdicts deny headlessly;
+        // the EFFECTIVE command (after the shell command prefix) is classified.
+        if (options?.safetyGate === "headless") {
+            const decision = await evaluateCommandGate(resolvedCommand, {
+                hasUI: false,
+                headlessConfirmPolicy: isCommandSafetyAssumeYesEnabled() ? "allow" : "deny",
+            });
+            if (decision?.deny) {
+                const blocked = buildBlockedBashResult(decision.reason);
+                this.recordBashResult(command, blocked, options);
+                return blocked;
+            }
+        }
+        this.abortController = new AbortController();
+        try {
+            try {
+                const operations = options?.operations ??
+                    createLocalBashOperations({
+                        shellPath,
+                        sandboxPolicy: runtime.sandboxPreflight(options?.sandboxPolicy),
+                    });
+                const cwd = this.deps.getCwd();
+                const onChunkWrapped = (delta) => {
+                    onChunk?.(delta);
+                    this.deps.emit({ type: "bash_execution_update", id: options?.id, delta });
+                };
+                // Default-on verified path when a session ledger exists; OMK_VERIFIED_BASH=0 rolls back.
+                const verified = await runtime.executeVerified({
+                    resolvedCommand,
+                    cwd,
+                    shellPath,
+                    operations,
+                    signal: this.abortController.signal,
+                    onChunk: onChunkWrapped,
+                });
+                const result = verified ??
+                    (await executeBashWithOperations(resolvedCommand, cwd, operations, {
+                        onChunk: onChunkWrapped,
+                        signal: this.abortController.signal,
+                    }));
+                this.recordBashResult(command, result, options);
+                return result;
+            }
+            catch (error) {
+                if (!isSandboxDeniedError(error)) {
+                    throw error;
+                }
+                const blocked = buildSandboxDeniedBashResult(error.message);
+                this.recordBashResult(command, blocked, options);
+                return blocked;
+            }
+        }
+        finally {
+            this.abortController = undefined;
+        }
+    }
+    /**
+     * Record a bash execution result in session history.
+     * Used by executeBash and by extensions that handle bash execution themselves.
+     */
+    recordBashResult(command, result, options) {
+        const bashMessage = {
+            role: "bashExecution",
+            command,
+            output: result.output,
+            exitCode: result.exitCode,
+            cancelled: result.cancelled,
+            truncated: result.truncated,
+            fullOutputPath: result.fullOutputPath,
+            timestamp: Date.now(),
+            excludeFromContext: options?.excludeFromContext,
+        };
+        // If agent is streaming, defer adding to avoid breaking tool_use/tool_result ordering
+        if (this.deps.isStreaming()) {
+            this.pendingBashMessages.push(bashMessage);
+        }
+        else {
+            this.deps.pushMessage(bashMessage);
+            this.deps.appendMessage(bashMessage);
+        }
+    }
+    /** Cancel running bash command. */
+    abortBash() {
+        this.abortController?.abort();
+    }
+    get isBashRunning() {
+        return this.abortController !== undefined;
+    }
+    get hasPendingBashMessages() {
+        return this.pendingBashMessages.length > 0;
+    }
+    /** Flush queued results after the agent turn completes (ordering contract). */
+    flushPending() {
+        if (this.pendingBashMessages.length === 0)
+            return;
+        for (const bashMessage of this.pendingBashMessages) {
+            this.deps.pushMessage(bashMessage);
+            this.deps.appendMessage(bashMessage);
+        }
+        this.pendingBashMessages = [];
+    }
+}
+//# sourceMappingURL=session-bash-service.js.map

package/dist/core/session-bash-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-bash-service.js","sourceRoot":"","sources":["../../src/core/session-bash-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAmB,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,+BAA+B,GAC/B,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAItF,OAAO,EAAkD,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAuB5G,SAAS,oBAAoB,CAAC,KAAc,EAAkB;IAC7D,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;AAAA,CACnF;AAED,SAAS,4BAA4B,CAAC,MAAc,EAAc;IACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAAA,CAC3E;AAED,MAAM,OAAO,kBAAkB;IACtB,eAAe,CAA8B;IAC7C,mBAAmB,GAA2B,EAAE,CAAC;IACxC,IAAI,CAAyB;IAE9C,YAAY,IAA4B,EAAE;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;IAED,KAAK,CAAC,WAAW,CAChB,OAAe,EACf,OAAiC,EACjC,OAA4B,EACN;QACtB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1C,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACnE,IAAI,aAAa,EAAE,CAAC;YACnB,mBAAmB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE;gBAC7E,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,eAAe;aACxB,CAAC,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,mDAAmD;QACnD,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,yCAAwC,YAAY,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YACtG,CAAC;QACF,CAAC;QAED,4EAA4E;QAC5E,8EAA8E;QAC9E,gFAAgF;QAChF,8EAA8E;QAC9E,wEAAwE;QACxE,IAAI,OAAO,EAAE,UAAU,KAAK,UAAU,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,eAAe,EAAE;gBAC3D,KAAK,EAAE,KAAK;gBACZ,qBAAqB,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;aAC3E,CAAC,CAAC;YACH,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACxD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC;YAChB,CAAC;QACF,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAE7C,IAAI,CAAC;YACJ,IAAI,CAAC;gBACJ,MAAM,UAAU,GACf,OAAO,EAAE,UAAU;oBACnB,yBAAyB,CAAC;wBACzB,SAAS;wBACT,aAAa,EAAE,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC;qBAC/D,CAAC,CAAC;gBACJ,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC;oBACzC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;oBACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBAAA,CAC1E,CAAC;gBAEF,yFAAyF;gBACzF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC;oBAC9C,eAAe;oBACf,GAAG;oBACH,SAAS;oBACT,UAAU;oBACV,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM;oBACnC,OAAO,EAAE,cAAc;iBACvB,CAAC,CAAC;gBACH,MAAM,MAAM,GACX,QAAQ;oBACR,CAAC,MAAM,yBAAyB,CAAC,eAAe,EAAE,GAAG,EAAE,UAAU,EAAE;wBAClE,OAAO,EAAE,cAAc;wBACvB,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM;qBACnC,CAAC,CAAC,CAAC;gBAEL,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAChD,OAAO,MAAM,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC;YAChB,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QAClC,CAAC;IAAA,CACD;IAED;;;OAGG;IACH,gBAAgB,CAAC,OAAe,EAAE,MAAkB,EAAE,OAA0C,EAAQ;QACvG,MAAM,WAAW,GAAyB;YACzC,IAAI,EAAE,eAAe;YACrB,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,kBAAkB,EAAE,OAAO,EAAE,kBAAkB;SAC/C,CAAC;QAEF,sFAAsF;QACtF,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;IAAA,CACD;IAED,mCAAmC;IACnC,SAAS,GAAS;QACjB,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC;IAAA,CAC9B;IAED,IAAI,aAAa,GAAY;QAC5B,OAAO,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC;IAAA,CAC1C;IAED,IAAI,sBAAsB,GAAY;QACrC,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC;IAAA,CAC3C;IAED,+EAA+E;IAC/E,YAAY,GAAS;QACpB,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;IAAA,CAC9B;CACD","sourcesContent":["/**\n * Session bash service: command execution, result recording, abort, and the\n * streaming-deferral queue. Extracted from AgentSession so the session class\n * coordinates lifecycle while this owns the bash surface end-to-end.\n *\n * Ordering contract (preserved from the session implementation):\n * - results recorded while the agent is streaming are queued and flushed on\n *   turn end (`flushPending`) so tool_use/tool_result ordering never breaks;\n * - `recordBashResult` is idempotent-safe to call from executeBash and from\n *   extensions that run bash themselves.\n */\nimport { type BashResult, executeBashWithOperations } from \"./bash-executor.ts\";\nimport { classifyShellCommand } from \"./command-safety.ts\";\nimport {\n\tbuildBlockedBashResult,\n\tevaluateCommandGate,\n\tisCommandSafetyAssumeYesEnabled,\n} from \"./extensions/builtin/command-safety-gate.ts\";\nimport type { LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport { assertLoadoutAccess, decideLoadoutAccess } from \"./loadout-access-policy.ts\";\nimport type { BashExecutionMessage } from \"./messages.ts\";\nimport type { SessionBashRuntime } from \"./session-bash-runtime.ts\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { type BashOperations, type BashSandboxPreflight, createLocalBashOperations } from \"./tools/bash.ts\";\n\nexport interface ExecuteBashOptions {\n\texcludeFromContext?: boolean;\n\t/** Optional identifier echoed in `bash_execution_update` events (RPC request correlation). */\n\tid?: string;\n\toperations?: BashOperations;\n\tsafetyGate?: \"headless\";\n\t/** Trusted internal/test override for local bash sandboxing. */\n\tsandboxPolicy?: BashSandboxPreflight;\n}\n\nexport interface SessionBashServiceDeps {\n\treadonly settings: SettingsManager;\n\treadonly runtime: SessionBashRuntime;\n\treadonly loadoutPolicy: LoadoutAccessPolicy | undefined;\n\treadonly getCwd: () => string;\n\treadonly emit: (event: { type: \"bash_execution_update\"; id?: string; delta: string }) => void;\n\treadonly isStreaming: () => boolean;\n\treadonly pushMessage: (message: BashExecutionMessage) => void;\n\treadonly appendMessage: (message: BashExecutionMessage) => void;\n}\n\nfunction isSandboxDeniedError(error: unknown): error is Error {\n\treturn error instanceof Error && error.message.startsWith(\"sandbox: shell denied\");\n}\n\nfunction buildSandboxDeniedBashResult(reason: string): BashResult {\n\treturn { output: reason, exitCode: 1, cancelled: false, truncated: false };\n}\n\nexport class SessionBashService {\n\tprivate abortController: AbortController | undefined;\n\tprivate pendingBashMessages: BashExecutionMessage[] = [];\n\tprivate readonly deps: SessionBashServiceDeps;\n\n\tconstructor(deps: SessionBashServiceDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\tasync executeBash(\n\t\tcommand: string,\n\t\tonChunk?: (chunk: string) => void,\n\t\toptions?: ExecuteBashOptions,\n\t): Promise<BashResult> {\n\t\tconst { settings, runtime, loadoutPolicy } = this.deps;\n\t\tconst prefix = settings.getShellCommandPrefix();\n\t\tconst shellPath = settings.getShellPath();\n\t\tconst resolvedCommand = prefix ? `${prefix}\\n${command}` : command;\n\t\tif (loadoutPolicy) {\n\t\t\tassertLoadoutAccess((request) => decideLoadoutAccess(loadoutPolicy, request), {\n\t\t\t\toperation: \"execute\",\n\t\t\t\ttoolName: \"bash\",\n\t\t\t\tcommand: resolvedCommand,\n\t\t\t});\n\t\t}\n\n\t\t// Non-negotiable safety floor for headless callers (RPC bash): hard-deny\n\t\t// block-tier commands before any shell is spawned.\n\t\tif (options?.safetyGate === \"headless\") {\n\t\t\tconst floorVerdict = classifyShellCommand(command);\n\t\t\tif (floorVerdict.risk === \"block\") {\n\t\t\t\tthrow new Error(`OMK §0.1 safety floor blocked bash: [${floorVerdict.rule}] ${floorVerdict.reason}`);\n\t\t\t}\n\t\t}\n\n\t\t// Command-safety parity for non-interactive callers (RPC bash). Interactive\n\t\t// `!`/`!!` bash is gated earlier through the user_bash extension event, which\n\t\t// keeps its prompt-based approval semantics, so it does not pass safetyGate and\n\t\t// is never double-prompted here. confirm/block-tier verdicts deny headlessly;\n\t\t// the EFFECTIVE command (after the shell command prefix) is classified.\n\t\tif (options?.safetyGate === \"headless\") {\n\t\t\tconst decision = await evaluateCommandGate(resolvedCommand, {\n\t\t\t\thasUI: false,\n\t\t\t\theadlessConfirmPolicy: isCommandSafetyAssumeYesEnabled() ? \"allow\" : \"deny\",\n\t\t\t});\n\t\t\tif (decision?.deny) {\n\t\t\t\tconst blocked = buildBlockedBashResult(decision.reason);\n\t\t\t\tthis.recordBashResult(command, blocked, options);\n\t\t\t\treturn blocked;\n\t\t\t}\n\t\t}\n\n\t\tthis.abortController = new AbortController();\n\n\t\ttry {\n\t\t\ttry {\n\t\t\t\tconst operations =\n\t\t\t\t\toptions?.operations ??\n\t\t\t\t\tcreateLocalBashOperations({\n\t\t\t\t\t\tshellPath,\n\t\t\t\t\t\tsandboxPolicy: runtime.sandboxPreflight(options?.sandboxPolicy),\n\t\t\t\t\t});\n\t\t\t\tconst cwd = this.deps.getCwd();\n\t\t\t\tconst onChunkWrapped = (delta: string) => {\n\t\t\t\t\tonChunk?.(delta);\n\t\t\t\t\tthis.deps.emit({ type: \"bash_execution_update\", id: options?.id, delta });\n\t\t\t\t};\n\n\t\t\t\t// Default-on verified path when a session ledger exists; OMK_VERIFIED_BASH=0 rolls back.\n\t\t\t\tconst verified = await runtime.executeVerified({\n\t\t\t\t\tresolvedCommand,\n\t\t\t\t\tcwd,\n\t\t\t\t\tshellPath,\n\t\t\t\t\toperations,\n\t\t\t\t\tsignal: this.abortController.signal,\n\t\t\t\t\tonChunk: onChunkWrapped,\n\t\t\t\t});\n\t\t\t\tconst result: BashResult =\n\t\t\t\t\tverified ??\n\t\t\t\t\t(await executeBashWithOperations(resolvedCommand, cwd, operations, {\n\t\t\t\t\t\tonChunk: onChunkWrapped,\n\t\t\t\t\t\tsignal: this.abortController.signal,\n\t\t\t\t\t}));\n\n\t\t\t\tthis.recordBashResult(command, result, options);\n\t\t\t\treturn result;\n\t\t\t} catch (error) {\n\t\t\t\tif (!isSandboxDeniedError(error)) {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\tconst blocked = buildSandboxDeniedBashResult(error.message);\n\t\t\t\tthis.recordBashResult(command, blocked, options);\n\t\t\t\treturn blocked;\n\t\t\t}\n\t\t} finally {\n\t\t\tthis.abortController = undefined;\n\t\t}\n\t}\n\n\t/**\n\t * Record a bash execution result in session history.\n\t * Used by executeBash and by extensions that handle bash execution themselves.\n\t */\n\trecordBashResult(command: string, result: BashResult, options?: { excludeFromContext?: boolean }): void {\n\t\tconst bashMessage: BashExecutionMessage = {\n\t\t\trole: \"bashExecution\",\n\t\t\tcommand,\n\t\t\toutput: result.output,\n\t\t\texitCode: result.exitCode,\n\t\t\tcancelled: result.cancelled,\n\t\t\ttruncated: result.truncated,\n\t\t\tfullOutputPath: result.fullOutputPath,\n\t\t\ttimestamp: Date.now(),\n\t\t\texcludeFromContext: options?.excludeFromContext,\n\t\t};\n\n\t\t// If agent is streaming, defer adding to avoid breaking tool_use/tool_result ordering\n\t\tif (this.deps.isStreaming()) {\n\t\t\tthis.pendingBashMessages.push(bashMessage);\n\t\t} else {\n\t\t\tthis.deps.pushMessage(bashMessage);\n\t\t\tthis.deps.appendMessage(bashMessage);\n\t\t}\n\t}\n\n\t/** Cancel running bash command. */\n\tabortBash(): void {\n\t\tthis.abortController?.abort();\n\t}\n\n\tget isBashRunning(): boolean {\n\t\treturn this.abortController !== undefined;\n\t}\n\n\tget hasPendingBashMessages(): boolean {\n\t\treturn this.pendingBashMessages.length > 0;\n\t}\n\n\t/** Flush queued results after the agent turn completes (ordering contract). */\n\tflushPending(): void {\n\t\tif (this.pendingBashMessages.length === 0) return;\n\t\tfor (const bashMessage of this.pendingBashMessages) {\n\t\t\tthis.deps.pushMessage(bashMessage);\n\t\t\tthis.deps.appendMessage(bashMessage);\n\t\t}\n\t\tthis.pendingBashMessages = [];\n\t}\n}\n"]}

package/dist/core/session-compaction-service.d.ts

@@ -0,0 +1,48 @@
+import type { Api, Message, Model } from "omk-ai";
+import type { CompactionResult } from "./compaction/index.ts";
+import { type CompactionBarrierResult, type CompactionEnvelope, type CompactionPreservedProvenanceInput, type CompactionSourceIdentity, type CompactionTransaction } from "./compaction/transaction.ts";
+import type { SessionIntegrityReport } from "./session-integrity.ts";
+import type { CompactionEntry, SessionEntry, SessionManager } from "./session-manager.ts";
+export interface CapturedCompactionState {
+    readonly report: SessionIntegrityReport;
+    readonly branchEntries: readonly SessionEntry[];
+    readonly revision: CompactionTransaction["baseRevision"];
+    readonly source: CompactionSourceIdentity;
+}
+export interface BegunCompaction {
+    readonly capture: CapturedCompactionState;
+    readonly transaction: CompactionTransaction;
+}
+export interface CommittedCompaction {
+    readonly entry: CompactionEntry;
+    readonly envelope: CompactionEnvelope;
+}
+export interface SessionCompactionServiceDeps {
+    readonly sessionManager: SessionManager;
+    readonly pendingToolCallIds: () => ReadonlySet<string>;
+    readonly getUserMessageText: (message: Message) => string;
+    readonly cwd: string;
+    readonly invalidateContextBudget: () => void;
+    /** Refresh agent messages from the session manager after tail repair/commit. */
+    readonly refreshAgentMessages: () => void;
+    /** Hysteresis bookkeeping after a successful commit. */
+    readonly recordCommit: () => void;
+}
+export declare class SessionCompactionService {
+    private readonly deps;
+    constructor(deps: SessionCompactionServiceDeps);
+    captureState(): CapturedCompactionState;
+    private captureStateLocked;
+    barrierError(barrier: CompactionBarrierResult): Error;
+    evaluateBarrier(capture: CapturedCompactionState, includeMissingTailAsPending: boolean, excludedPendingIds?: ReadonlySet<string>): CompactionBarrierResult;
+    repairEmergencyTail(capture: CapturedCompactionState): {
+        readonly capture: CapturedCompactionState;
+        readonly repairedToolCallIds: ReadonlySet<string>;
+    };
+    priorCommittedSourceDigests(): string[];
+    beginTransaction(compactionModel: Model<Api>, emergency: boolean): BegunCompaction;
+    captureProvenance(capture: CapturedCompactionState): CompactionPreservedProvenanceInput;
+    detailsWithEnvelope(details: unknown, envelope: CompactionEnvelope): unknown;
+    commit(begun: BegunCompaction, result: CompactionResult, fromExtension: boolean): CommittedCompaction;
+}
+//# sourceMappingURL=session-compaction-service.d.ts.map

package/dist/core/session-compaction-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-compaction-service.d.ts","sourceRoot":"","sources":["../../src/core/session-compaction-service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAqB,MAAM,QAAQ,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAO1B,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE1F,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;CAC5C;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACtC;AAED,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACvD,QAAQ,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC;IAC1D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,uBAAuB,EAAE,MAAM,IAAI,CAAC;IAC7C,gFAAgF;IAChF,QAAQ,CAAC,oBAAoB,EAAE,MAAM,IAAI,CAAC;IAC1C,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC;CAClC;AAED,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IAEpD,YAAY,IAAI,EAAE,4BAA4B,EAE7C;IAED,YAAY,IAAI,uBAAuB,CAEtC;IAED,OAAO,CAAC,kBAAkB;IAmD1B,YAAY,CAAC,OAAO,EAAE,uBAAuB,GAAG,KAAK,CAOpD;IAED,eAAe,CACd,OAAO,EAAE,uBAAuB,EAChC,2BAA2B,EAAE,OAAO,EACpC,kBAAkB,GAAE,WAAW,CAAC,MAAM,CAAa,GACjD,uBAAuB,CAQzB;IAED,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG;QACtD,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;QAC1C,QAAQ,CAAC,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;KAClD,CA+BA;IAED,2BAA2B,IAAI,MAAM,EAAE,CAYtC;IAED,gBAAgB,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,GAAG,eAAe,CAoBjF;IAED,iBAAiB,CAAC,OAAO,EAAE,uBAAuB,GAAG,kCAAkC,CA0CtF;IAED,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAQ3E;IAED,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,GAAG,mBAAmB,CAgDpG;CACD","sourcesContent":["/**\n * Session compaction service: capture / barrier / repair / transaction / commit.\n *\n * Extracted from AgentSession so the session keeps lifecycle orchestration\n * (abort controllers, extension events, auth, model resolution) while this\n * owns the integrity-critical compaction state machine. Every method preserves\n * the exact semantics of the original session implementation — the\n * compaction-transaction / session-integrity suites pin them.\n */\nimport { createHash, randomUUID } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { repairTranscriptIntegrity } from \"omk-agent-core\";\nimport type { Api, Message, Model, ToolResultMessage } from \"omk-ai\";\nimport { sanitizeBinaryOutput } from \"../utils/shell.ts\";\nimport type { CompactionResult } from \"./compaction/index.ts\";\nimport {\n\ttype CompactionBarrierResult,\n\ttype CompactionEnvelope,\n\ttype CompactionPreservedProvenanceInput,\n\ttype CompactionSourceIdentity,\n\ttype CompactionTransaction,\n\tcreateCompactionEnvelope,\n\tcreateCompactionSourceIdentity,\n\tcreateCompactionTransaction,\n\tdecideCompactionCommit,\n\tevaluateCompactionBarrier,\n\tvalidateCompactionEnvelope,\n} from \"./compaction/transaction.ts\";\nimport { redactSensitiveText } from \"./redaction.ts\";\nimport type { SessionIntegrityReport } from \"./session-integrity.ts\";\nimport { inspectSessionIntegrity } from \"./session-integrity.ts\";\nimport type { CompactionEntry, SessionEntry, SessionManager } from \"./session-manager.ts\";\n\nexport interface CapturedCompactionState {\n\treadonly report: SessionIntegrityReport;\n\treadonly branchEntries: readonly SessionEntry[];\n\treadonly revision: CompactionTransaction[\"baseRevision\"];\n\treadonly source: CompactionSourceIdentity;\n}\n\nexport interface BegunCompaction {\n\treadonly capture: CapturedCompactionState;\n\treadonly transaction: CompactionTransaction;\n}\n\nexport interface CommittedCompaction {\n\treadonly entry: CompactionEntry;\n\treadonly envelope: CompactionEnvelope;\n}\n\nexport interface SessionCompactionServiceDeps {\n\treadonly sessionManager: SessionManager;\n\treadonly pendingToolCallIds: () => ReadonlySet<string>;\n\treadonly getUserMessageText: (message: Message) => string;\n\treadonly cwd: string;\n\treadonly invalidateContextBudget: () => void;\n\t/** Refresh agent messages from the session manager after tail repair/commit. */\n\treadonly refreshAgentMessages: () => void;\n\t/** Hysteresis bookkeeping after a successful commit. */\n\treadonly recordCommit: () => void;\n}\n\nexport class SessionCompactionService {\n\tprivate readonly deps: SessionCompactionServiceDeps;\n\n\tconstructor(deps: SessionCompactionServiceDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\tcaptureState(): CapturedCompactionState {\n\t\treturn this.deps.sessionManager.withCompactionCommitLock(() => this.captureStateLocked());\n\t}\n\n\tprivate captureStateLocked(): CapturedCompactionState {\n\t\tconst { sessionManager } = this.deps;\n\t\tconst sessionFile = sessionManager.getSessionFile();\n\t\tconst bytes =\n\t\t\tsessionFile && existsSync(sessionFile)\n\t\t\t\t? new Uint8Array(readFileSync(sessionFile))\n\t\t\t\t: new TextEncoder().encode(\n\t\t\t\t\t\t`${[sessionManager.getHeader(), ...sessionManager.getEntries()]\n\t\t\t\t\t\t\t.filter((entry) => entry !== null)\n\t\t\t\t\t\t\t.map((entry) => JSON.stringify(entry))\n\t\t\t\t\t\t\t.join(\"\\n\")}\\n`,\n\t\t\t\t\t);\n\t\tconst report = inspectSessionIntegrity(bytes, { activeLeafId: sessionManager.getLeafId() });\n\t\tconst branchEntries = report.activeBranch;\n\t\tlet latestCompactionIndex = -1;\n\t\tfor (let index = branchEntries.length - 1; index >= 0; index -= 1) {\n\t\t\tif (branchEntries[index]?.type === \"compaction\") {\n\t\t\t\tlatestCompactionIndex = index;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t\tconst latestCompaction = branchEntries[latestCompactionIndex];\n\t\tconst firstKeptIndex =\n\t\t\tlatestCompaction?.type === \"compaction\"\n\t\t\t\t? branchEntries.findIndex((entry) => entry.id === latestCompaction.firstKeptEntryId)\n\t\t\t\t: -1;\n\t\tconst sourceEntries = branchEntries.slice(\n\t\t\tlatestCompactionIndex < 0 ? 0 : firstKeptIndex < 0 ? latestCompactionIndex : firstKeptIndex,\n\t\t);\n\t\tconst firstEntry = sourceEntries[0];\n\t\tconst lastEntry = sourceEntries.at(-1);\n\t\tif (!firstEntry || !lastEntry || report.activeLeafId === null) {\n\t\t\tconst barrier = evaluateCompactionBarrier(report, [...this.deps.pendingToolCallIds()]);\n\t\t\tif (barrier.status !== \"ready\") throw this.barrierError(barrier);\n\t\t\tthrow new Error(\"Nothing to compact: the active session branch is empty\");\n\t\t}\n\t\tconst revision = sessionManager.getDurableHeadToken();\n\t\tconst source = createCompactionSourceIdentity({\n\t\t\tsessionId: revision.sessionId,\n\t\t\tentryIds: sourceEntries.map((entry) => entry.id),\n\t\t\tfirstEntryId: firstEntry.id,\n\t\t\tlastEntryId: lastEntry.id,\n\t\t\tsourceSha256: createHash(\"sha256\")\n\t\t\t\t.update(sourceEntries.map((entry) => JSON.stringify(entry)).join(\"\\n\"), \"utf8\")\n\t\t\t\t.digest(\"hex\"),\n\t\t\tactiveLeafId: report.activeLeafId,\n\t\t\tmessageCount: report.activeMessages.length,\n\t\t});\n\t\treturn { report, branchEntries, revision, source };\n\t}\n\n\tbarrierError(barrier: CompactionBarrierResult): Error {\n\t\tif (barrier.status === \"defer\") {\n\t\t\treturn new Error(`Compaction deferred until the transcript closes (${barrier.reason})`);\n\t\t}\n\t\treturn new Error(\n\t\t\t`Compaction failed closed on transcript integrity (${barrier.reason}). Run the session doctor before retrying.`,\n\t\t);\n\t}\n\n\tevaluateBarrier(\n\t\tcapture: CapturedCompactionState,\n\t\tincludeMissingTailAsPending: boolean,\n\t\texcludedPendingIds: ReadonlySet<string> = new Set(),\n\t): CompactionBarrierResult {\n\t\tconst pending = new Set([...this.deps.pendingToolCallIds()].filter((id) => !excludedPendingIds.has(id)));\n\t\tif (includeMissingTailAsPending) {\n\t\t\tfor (const issue of capture.report.transcript?.issues ?? []) {\n\t\t\t\tif (issue.kind === \"missing_result\") pending.add(issue.toolCallId);\n\t\t\t}\n\t\t}\n\t\treturn evaluateCompactionBarrier(capture.report, [...pending]);\n\t}\n\n\trepairEmergencyTail(capture: CapturedCompactionState): {\n\t\treadonly capture: CapturedCompactionState;\n\t\treadonly repairedToolCallIds: ReadonlySet<string>;\n\t} {\n\t\tconst { sessionManager } = this.deps;\n\t\tconst barrier = this.evaluateBarrier(capture, true);\n\t\tif (barrier.status !== \"defer\" || barrier.reason !== \"missing_active_tail_results\") {\n\t\t\tif (barrier.status !== \"ready\") throw this.barrierError(barrier);\n\t\t\treturn { capture, repairedToolCallIds: new Set() };\n\t\t}\n\t\tconst repairedMessages = repairTranscriptIntegrity(\n\t\t\t[...capture.report.activeMessages],\n\t\t\t\"Tool result missing; synthesized to close an emergency compaction barrier\",\n\t\t);\n\t\tconst inserted = repairedMessages.slice(capture.report.activeMessages.length);\n\t\tconst repairedToolCallIds = new Set<string>();\n\t\tfor (const message of inserted) {\n\t\t\tif (message.role !== \"toolResult\") {\n\t\t\t\tthrow new Error(\"Emergency compaction repair produced a non-tool result\");\n\t\t\t}\n\t\t\tconst toolResult: ToolResultMessage = message;\n\t\t\trepairedToolCallIds.add(toolResult.toolCallId);\n\t\t\tsessionManager.appendMessage(toolResult);\n\t\t}\n\t\tsessionManager.appendCustomEntry(\"compaction_transcript_repaired\", {\n\t\t\tinsertedToolCallIds: [...repairedToolCallIds],\n\t\t\treason: \"emergency_compaction\",\n\t\t});\n\t\tthis.deps.invalidateContextBudget();\n\t\tconst closedCapture = this.captureState();\n\t\tconst closedBarrier = this.evaluateBarrier(closedCapture, false, repairedToolCallIds);\n\t\tif (closedBarrier.status !== \"ready\") throw this.barrierError(closedBarrier);\n\t\tthis.deps.refreshAgentMessages();\n\t\treturn { capture: closedCapture, repairedToolCallIds };\n\t}\n\n\tpriorCommittedSourceDigests(): string[] {\n\t\tconst digests: string[] = [];\n\t\tfor (const entry of this.deps.sessionManager.getEntries()) {\n\t\t\tif (entry.type !== \"compaction\" || typeof entry.details !== \"object\" || entry.details === null) continue;\n\t\t\tif (!Object.hasOwn(entry.details, \"compactionEnvelope\")) continue;\n\t\t\tconst envelope = validateCompactionEnvelope(Reflect.get(entry.details, \"compactionEnvelope\"));\n\t\t\tif (envelope.summary !== entry.summary) {\n\t\t\t\tthrow new Error(`Compaction entry ${entry.id} has invalid provenance. Run the session doctor.`);\n\t\t\t}\n\t\t\tdigests.push(envelope.source.sourceSha256);\n\t\t}\n\t\treturn digests;\n\t}\n\n\tbeginTransaction(compactionModel: Model<Api>, emergency: boolean): BegunCompaction {\n\t\tlet capture = this.captureState();\n\t\tif (emergency) {\n\t\t\tcapture = this.repairEmergencyTail(capture).capture;\n\t\t} else {\n\t\t\tconst barrier = this.evaluateBarrier(capture, false);\n\t\t\tif (barrier.status !== \"ready\") throw this.barrierError(barrier);\n\t\t}\n\t\tconst transaction = createCompactionTransaction({\n\t\t\ttransactionId: randomUUID(),\n\t\t\tbaseRevision: capture.revision,\n\t\t\tsource: capture.source,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t\tmodel: { provider: compactionModel.provider, id: compactionModel.id },\n\t\t\tpreserved: this.captureProvenance(capture),\n\t\t});\n\t\tif (this.priorCommittedSourceDigests().includes(transaction.source.sourceSha256)) {\n\t\t\tthrow new Error(\"This exact compaction source was already compacted\");\n\t\t}\n\t\treturn { capture, transaction };\n\t}\n\n\tcaptureProvenance(capture: CapturedCompactionState): CompactionPreservedProvenanceInput {\n\t\tlet latestIntent = \"Continue the current session\";\n\t\tfor (let index = capture.report.activeMessages.length - 1; index >= 0; index -= 1) {\n\t\t\tconst message = capture.report.activeMessages[index];\n\t\t\tif (message?.role !== \"user\") continue;\n\t\t\tconst candidate = sanitizeBinaryOutput(redactSensitiveText(this.deps.getUserMessageText(message)).trim())\n\t\t\t\t.replace(/[\\u0000-\\u0008\\u000b\\u000c\\u000e-\\u001f\\u007f]/gu, \"\")\n\t\t\t\t.slice(0, 16_384);\n\t\t\tif (candidate.length > 0) latestIntent = candidate;\n\t\t\tbreak;\n\t\t}\n\t\tconst modelHistory = capture.branchEntries\n\t\t\t.flatMap((entry) => {\n\t\t\t\tif (entry.type === \"model_change\") {\n\t\t\t\t\treturn [{ entryId: entry.id, provider: entry.provider, modelId: entry.modelId }];\n\t\t\t\t}\n\t\t\t\tif (entry.type === \"message\" && entry.message.role === \"assistant\") {\n\t\t\t\t\treturn [{ entryId: entry.id, provider: entry.message.provider, modelId: entry.message.model }];\n\t\t\t\t}\n\t\t\t\treturn [];\n\t\t\t})\n\t\t\t.slice(-256);\n\t\tconst customEntryIds = (customType: string): string[] =>\n\t\t\tcapture.branchEntries\n\t\t\t\t.filter((entry) => entry.type === \"custom\" && entry.customType === customType)\n\t\t\t\t.map((entry) => entry.id);\n\t\treturn {\n\t\t\tlatestIntent,\n\t\t\topenTasks: [],\n\t\t\tlaneIds: customEntryIds(\"lane\"),\n\t\t\tacceptancePredicateIds: customEntryIds(\"acceptance_predicate\"),\n\t\t\tevidenceReceiptIds: customEntryIds(\"evidence_receipt\"),\n\t\t\tblockerReasons: [],\n\t\t\trepairEventIds: [\n\t\t\t\t...customEntryIds(\"transcript_repaired\"),\n\t\t\t\t...customEntryIds(\"compaction_transcript_repaired\"),\n\t\t\t],\n\t\t\tbranch: null,\n\t\t\tworktree: this.deps.cwd,\n\t\t\tmodelHistory,\n\t\t\tnextAction: latestIntent.slice(0, 4096) || \"Continue the current session\",\n\t\t};\n\t}\n\n\tdetailsWithEnvelope(details: unknown, envelope: CompactionEnvelope): unknown {\n\t\tif (typeof details === \"object\" && details !== null && !Array.isArray(details)) {\n\t\t\treturn { ...details, compactionEnvelope: envelope };\n\t\t}\n\t\treturn {\n\t\t\tcompactionEnvelope: envelope,\n\t\t\t...(details === undefined ? {} : { resultDetails: details }),\n\t\t};\n\t}\n\n\tcommit(begun: BegunCompaction, result: CompactionResult, fromExtension: boolean): CommittedCompaction {\n\t\tif (!begun.transaction.source.entryIds.includes(result.firstKeptEntryId)) {\n\t\t\tthrow new Error(\"Compaction first-kept entry is outside the captured source\");\n\t\t}\n\t\tconst committed = this.deps.sessionManager.withCompactionCommitLock(() => {\n\t\t\tconst current = this.captureState();\n\t\t\tconst barrier = this.evaluateBarrier(current, false);\n\t\t\tconst decision = decideCompactionCommit({\n\t\t\t\ttransaction: begun.transaction,\n\t\t\t\tcurrentRevision: current.revision,\n\t\t\t\tcurrentSource: current.source,\n\t\t\t\tbarrier,\n\t\t\t\tpriorCommittedSourceDigests: this.priorCommittedSourceDigests(),\n\t\t\t});\n\t\t\tswitch (decision.decision) {\n\t\t\t\tcase \"duplicate\":\n\t\t\t\t\tthrow new Error(\"This exact compaction source was already compacted\");\n\t\t\t\tcase \"stale\":\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t`Session changed during compaction (${decision.reason}); generated summary was discarded`,\n\t\t\t\t\t);\n\t\t\t\tcase \"defer\":\n\t\t\t\tcase \"fail_closed\":\n\t\t\t\t\tthrow this.barrierError(barrier);\n\t\t\t\tcase \"commit\": {\n\t\t\t\t\tconst envelope = createCompactionEnvelope({\n\t\t\t\t\t\ttransaction: begun.transaction,\n\t\t\t\t\t\tdecision,\n\t\t\t\t\t\tsummary: result.summary,\n\t\t\t\t\t\tsummarySha256: createHash(\"sha256\").update(result.summary, \"utf8\").digest(\"hex\"),\n\t\t\t\t\t});\n\t\t\t\t\tconst entryId = this.deps.sessionManager.appendCompaction(\n\t\t\t\t\t\tresult.summary,\n\t\t\t\t\t\tresult.firstKeptEntryId,\n\t\t\t\t\t\tresult.tokensBefore,\n\t\t\t\t\t\tthis.detailsWithEnvelope(result.details, envelope),\n\t\t\t\t\t\tfromExtension,\n\t\t\t\t\t);\n\t\t\t\t\tconst entry = this.deps.sessionManager.getEntry(entryId);\n\t\t\t\t\tif (!entry || entry.type !== \"compaction\") {\n\t\t\t\t\t\tthrow new Error(\"Compaction commit did not produce a compaction entry\");\n\t\t\t\t\t}\n\t\t\t\t\treturn { entry, envelope };\n\t\t\t\t}\n\t\t\t}\n\t\t});\n\t\tthis.deps.recordCommit();\n\t\treturn committed;\n\t}\n}\n"]}