openmeld 0.3.231 → 0.3.232

package/dist/{process-channel-DmTb_kO4.js → process-channel-C1wRGUmk.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { t as ExecutionHostError } from "./channel-DppbHxHw.js";
+import { t as ExecutionHostError } from "./channel-tvFZSSVr.js";
 //#region src/local-service/execution-host/process-channel.ts
 function childExecutionHostChannel(child) {
 	return {
@@ -61,4 +61,4 @@ function parentExecutionHostChannel() {
 //#endregion
 export { parentExecutionHostChannel as n, childExecutionHostChannel as t };
 
-//# sourceMappingURL=process-channel-DmTb_kO4.js.map
+//# sourceMappingURL=process-channel-C1wRGUmk.js.map

package/dist/{process-channel-DmTb_kO4.js.map → process-channel-C1wRGUmk.js.map}

@@ -1 +1 @@
-{"version":3,"file":"process-channel-DmTb_kO4.js","names":[],"sources":["../src/local-service/execution-host/process-channel.ts"],"sourcesContent":["import type { ChildProcess } from \"node:child_process\";\nimport type { ExecutionHostChannel } from \"./channel\";\nimport { ExecutionHostError } from \"./channel\";\n\n// Use inherited Node-compatible IPC with JSON serialization. Provider stdout is\n// not a protocol channel; ordinary logs cannot become control messages.\nexport function childExecutionHostChannel(\n  child: ChildProcess\n): ExecutionHostChannel {\n  return {\n    connected: () => child.connected,\n    send: (message, completed) => {\n      child.send(message, (error) => completed(error ?? null));\n    },\n    onMessage: (listener) => {\n      child.on(\"message\", listener);\n      return () => {\n        child.off(\"message\", listener);\n      };\n    },\n    onDisconnect: (listener) => {\n      let observed = false;\n      const finish = (error?: Error) => {\n        if (!observed) {\n          observed = true;\n          listener(error);\n        }\n      };\n      const exited = (code: number | null, signal: NodeJS.Signals | null) => {\n        finish(\n          new Error(`Host process exited (${signal ?? code ?? \"unknown\"})`)\n        );\n      };\n      child.on(\"disconnect\", finish);\n      child.on(\"exit\", exited);\n      // Spawn/send failures must not become unhandled EventEmitter errors.\n      child.on(\"error\", finish);\n      return () => {\n        child.off(\"disconnect\", finish);\n        child.off(\"exit\", exited);\n        child.off(\"error\", finish);\n      };\n    },\n  };\n}\n\nexport function parentExecutionHostChannel(): ExecutionHostChannel {\n  const send = process.send?.bind(process);\n  if (!(send && process.connected)) {\n    throw new ExecutionHostError(\n      \"host.inherited_channel_required\",\n      \"The execution host requires its supervisor's inherited IPC channel.\"\n    );\n  }\n  return {\n    connected: () => process.connected === true,\n    send: (message, completed) => {\n      send(message, undefined, undefined, (error) => completed(error ?? null));\n    },\n    onMessage: (listener) => {\n      process.on(\"message\", listener);\n      return () => {\n        process.off(\"message\", listener);\n      };\n    },\n    onDisconnect: (listener) => {\n      process.on(\"disconnect\", listener);\n      return () => {\n        process.off(\"disconnect\", listener);\n      };\n    },\n  };\n}\n"],"mappings":";;;;AAMA,SAAgB,0BACd,OACsB;CACtB,OAAO;EACL,iBAAiB,MAAM;EACvB,OAAO,SAAS,cAAc;GAC5B,MAAM,KAAK,UAAU,UAAU,UAAU,SAAS,IAAI,CAAC;EACzD;EACA,YAAY,aAAa;GACvB,MAAM,GAAG,WAAW,QAAQ;GAC5B,aAAa;IACX,MAAM,IAAI,WAAW,QAAQ;GAC/B;EACF;EACA,eAAe,aAAa;GAC1B,IAAI,WAAW;GACf,MAAM,UAAU,UAAkB;IAChC,IAAI,CAAC,UAAU;KACb,WAAW;KACX,SAAS,KAAK;IAChB;GACF;GACA,MAAM,UAAU,MAAqB,WAAkC;IACrE,uBACE,IAAI,MAAM,wBAAwB,UAAU,QAAQ,UAAU,EAAE,CAClE;GACF;GACA,MAAM,GAAG,cAAc,MAAM;GAC7B,MAAM,GAAG,QAAQ,MAAM;GAEvB,MAAM,GAAG,SAAS,MAAM;GACxB,aAAa;IACX,MAAM,IAAI,cAAc,MAAM;IAC9B,MAAM,IAAI,QAAQ,MAAM;IACxB,MAAM,IAAI,SAAS,MAAM;GAC3B;EACF;CACF;AACF;AAEA,SAAgB,6BAAmD;CACjE,MAAM,OAAO,QAAQ,MAAM,KAAK,OAAO;CACvC,IAAI,EAAE,QAAQ,QAAQ,YACpB,MAAM,IAAI,mBACR,mCACA,qEACF;CAEF,OAAO;EACL,iBAAiB,QAAQ,cAAc;EACvC,OAAO,SAAS,cAAc;GAC5B,KAAK,SAAS,KAAA,GAAW,KAAA,IAAY,UAAU,UAAU,SAAS,IAAI,CAAC;EACzE;EACA,YAAY,aAAa;GACvB,QAAQ,GAAG,WAAW,QAAQ;GAC9B,aAAa;IACX,QAAQ,IAAI,WAAW,QAAQ;GACjC;EACF;EACA,eAAe,aAAa;GAC1B,QAAQ,GAAG,cAAc,QAAQ;GACjC,aAAa;IACX,QAAQ,IAAI,cAAc,QAAQ;GACpC;EACF;CACF;AACF"}
+{"version":3,"file":"process-channel-C1wRGUmk.js","names":[],"sources":["../src/local-service/execution-host/process-channel.ts"],"sourcesContent":["import type { ChildProcess } from \"node:child_process\";\nimport type { ExecutionHostChannel } from \"./channel\";\nimport { ExecutionHostError } from \"./channel\";\n\n// Use inherited Node-compatible IPC with JSON serialization. Provider stdout is\n// not a protocol channel; ordinary logs cannot become control messages.\nexport function childExecutionHostChannel(\n  child: ChildProcess\n): ExecutionHostChannel {\n  return {\n    connected: () => child.connected,\n    send: (message, completed) => {\n      child.send(message, (error) => completed(error ?? null));\n    },\n    onMessage: (listener) => {\n      child.on(\"message\", listener);\n      return () => {\n        child.off(\"message\", listener);\n      };\n    },\n    onDisconnect: (listener) => {\n      let observed = false;\n      const finish = (error?: Error) => {\n        if (!observed) {\n          observed = true;\n          listener(error);\n        }\n      };\n      const exited = (code: number | null, signal: NodeJS.Signals | null) => {\n        finish(\n          new Error(`Host process exited (${signal ?? code ?? \"unknown\"})`)\n        );\n      };\n      child.on(\"disconnect\", finish);\n      child.on(\"exit\", exited);\n      // Spawn/send failures must not become unhandled EventEmitter errors.\n      child.on(\"error\", finish);\n      return () => {\n        child.off(\"disconnect\", finish);\n        child.off(\"exit\", exited);\n        child.off(\"error\", finish);\n      };\n    },\n  };\n}\n\nexport function parentExecutionHostChannel(): ExecutionHostChannel {\n  const send = process.send?.bind(process);\n  if (!(send && process.connected)) {\n    throw new ExecutionHostError(\n      \"host.inherited_channel_required\",\n      \"The execution host requires its supervisor's inherited IPC channel.\"\n    );\n  }\n  return {\n    connected: () => process.connected === true,\n    send: (message, completed) => {\n      send(message, undefined, undefined, (error) => completed(error ?? null));\n    },\n    onMessage: (listener) => {\n      process.on(\"message\", listener);\n      return () => {\n        process.off(\"message\", listener);\n      };\n    },\n    onDisconnect: (listener) => {\n      process.on(\"disconnect\", listener);\n      return () => {\n        process.off(\"disconnect\", listener);\n      };\n    },\n  };\n}\n"],"mappings":";;;;AAMA,SAAgB,0BACd,OACsB;CACtB,OAAO;EACL,iBAAiB,MAAM;EACvB,OAAO,SAAS,cAAc;GAC5B,MAAM,KAAK,UAAU,UAAU,UAAU,SAAS,IAAI,CAAC;EACzD;EACA,YAAY,aAAa;GACvB,MAAM,GAAG,WAAW,QAAQ;GAC5B,aAAa;IACX,MAAM,IAAI,WAAW,QAAQ;GAC/B;EACF;EACA,eAAe,aAAa;GAC1B,IAAI,WAAW;GACf,MAAM,UAAU,UAAkB;IAChC,IAAI,CAAC,UAAU;KACb,WAAW;KACX,SAAS,KAAK;IAChB;GACF;GACA,MAAM,UAAU,MAAqB,WAAkC;IACrE,uBACE,IAAI,MAAM,wBAAwB,UAAU,QAAQ,UAAU,EAAE,CAClE;GACF;GACA,MAAM,GAAG,cAAc,MAAM;GAC7B,MAAM,GAAG,QAAQ,MAAM;GAEvB,MAAM,GAAG,SAAS,MAAM;GACxB,aAAa;IACX,MAAM,IAAI,cAAc,MAAM;IAC9B,MAAM,IAAI,QAAQ,MAAM;IACxB,MAAM,IAAI,SAAS,MAAM;GAC3B;EACF;CACF;AACF;AAEA,SAAgB,6BAAmD;CACjE,MAAM,OAAO,QAAQ,MAAM,KAAK,OAAO;CACvC,IAAI,EAAE,QAAQ,QAAQ,YACpB,MAAM,IAAI,mBACR,mCACA,qEACF;CAEF,OAAO;EACL,iBAAiB,QAAQ,cAAc;EACvC,OAAO,SAAS,cAAc;GAC5B,KAAK,SAAS,KAAA,GAAW,KAAA,IAAY,UAAU,UAAU,SAAS,IAAI,CAAC;EACzE;EACA,YAAY,aAAa;GACvB,QAAQ,GAAG,WAAW,QAAQ;GAC9B,aAAa;IACX,QAAQ,IAAI,WAAW,QAAQ;GACjC;EACF;EACA,eAAe,aAAa;GAC1B,QAAQ,GAAG,cAAc,QAAQ;GACjC,aAAa;IACX,QAAQ,IAAI,cAAc,QAAQ;GACpC;EACF;CACF;AACF"}

package/dist/{published-production-safety-CgXxtdMK.js → published-production-safety-zANGAGDI.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { F as resolveOpenMeldEnvPreset, I as resolveOpenMeldRootDir, M as resolveDefaultOpenMeldHomeDirname, N as resolveExplicitOpenMeldEnvPreset } from "./paths-DSkUuEu3.js";
+import { F as resolveOpenMeldRootDir, M as resolveDefaultOpenMeldHomeDirname, P as resolveOpenMeldEnvPreset } from "./paths-De9xdA2h.js";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 //#region src/config/published-production-safety.ts
@@ -17,8 +17,8 @@ function assertNoPublishedProductionMutationDuringTests(pathInput, targetName) {
 * a process with an isolated root can still stop, boot out, or uninstall the
 * real published production service. Fail closed before any such mutation:
 * - test processes must never mutate the production registration, and
-* - a non-test process whose effective root left the published production
-*   lane must state its intent with an explicit OPENMELD_ENV_PRESET.
+* - the production service identity may be mutated only from the published
+*   production root. An explicit preset cannot make an isolated root safe.
 */
 function assertSafePublishedProductionServiceRegistrationMutation(operation, pathInput = {}) {
 	if (resolveOpenMeldEnvPreset(pathInput) !== "prod") return;
@@ -27,12 +27,11 @@ function assertSafePublishedProductionServiceRegistrationMutation(operation, pat
 		"OPENMELD_HOME does not isolate the OS service manager registration.",
 		"Target an isolated lane with OPENMELD_ENV_PRESET=dev-local or OPENMELD_ENV_PRESET=canary, or stub the service manager."
 	].join(" "));
-	if (resolveExplicitOpenMeldEnvPreset(pathInput) === "prod") return;
 	if (isPublishedProductionOpenMeldRoot(pathInput)) return;
 	throw new Error([
 		`Refusing to ${operation} the published production OpenMeld Service registration:`,
 		"the effective OpenMeld root is outside the published production lane, but the service identity resolved to the production label.",
-		"Set OPENMELD_ENV_PRESET explicitly to state which service registration this command must mutate."
+		"Use the published production root, or target an isolated lane with OPENMELD_ENV_PRESET=dev-local or OPENMELD_ENV_PRESET=canary."
 	].join(" "));
 }
 function isPublishedProductionOpenMeldRoot(pathInput) {
@@ -50,4 +49,4 @@ function normalizeComparablePath(path) {
 //#endregion
 export { isTestProcess as i, assertSafePublishedProductionServiceRegistrationMutation as n, isPublishedProductionOpenMeldRoot as r, assertNoPublishedProductionMutationDuringTests as t };
 
-//# sourceMappingURL=published-production-safety-CgXxtdMK.js.map
+//# sourceMappingURL=published-production-safety-zANGAGDI.js.map

package/dist/published-production-safety-zANGAGDI.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"published-production-safety-zANGAGDI.js","names":[],"sources":["../src/config/published-production-safety.ts"],"sourcesContent":["import { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport type { OpenMeldPathResolutionInput } from \"./paths\";\nimport {\n  resolveDefaultOpenMeldHomeDirname,\n  resolveOpenMeldEnvPreset,\n  resolveOpenMeldRootDir,\n} from \"./paths\";\n\nconst PUBLISHED_PRODUCTION_OPENMELD_ROOT = normalizeComparablePath(\n  join(homedir(), resolveDefaultOpenMeldHomeDirname(\"prod\"))\n);\n\nexport function assertNoPublishedProductionMutationDuringTests(\n  pathInput: OpenMeldPathResolutionInput,\n  targetName: string\n): void {\n  if (!isTestProcess(pathInput)) {\n    return;\n  }\n  if (!isPublishedProductionOpenMeldRoot(pathInput)) {\n    return;\n  }\n  throw new Error(\n    [\n      `Refusing to mutate ${targetName} in the published production lane during tests.`,\n      \"Set OPENMELD_HOME to a fresh temporary directory, or run the validation through openmeld-dev or openmeld-canary.\",\n    ].join(\" \")\n  );\n}\n\n/**\n * The OS service manager registration (launchd label / systemd unit / Windows\n * service name) is a per-user global resource keyed only by the env preset.\n * OPENMELD_HOME isolates lane files but does NOT isolate this registration, so\n * a process with an isolated root can still stop, boot out, or uninstall the\n * real published production service. Fail closed before any such mutation:\n * - test processes must never mutate the production registration, and\n * - the production service identity may be mutated only from the published\n *   production root. An explicit preset cannot make an isolated root safe.\n */\nexport function assertSafePublishedProductionServiceRegistrationMutation(\n  operation: string,\n  pathInput: OpenMeldPathResolutionInput = {}\n): void {\n  if (resolveOpenMeldEnvPreset(pathInput) !== \"prod\") {\n    return;\n  }\n  if (isTestProcess(pathInput)) {\n    throw new Error(\n      [\n        `Refusing to ${operation} the published production OpenMeld Service registration during tests.`,\n        \"OPENMELD_HOME does not isolate the OS service manager registration.\",\n        \"Target an isolated lane with OPENMELD_ENV_PRESET=dev-local or OPENMELD_ENV_PRESET=canary, or stub the service manager.\",\n      ].join(\" \")\n    );\n  }\n  if (isPublishedProductionOpenMeldRoot(pathInput)) {\n    return;\n  }\n  throw new Error(\n    [\n      `Refusing to ${operation} the published production OpenMeld Service registration:`,\n      \"the effective OpenMeld root is outside the published production lane, but the service identity resolved to the production label.\",\n      \"Use the published production root, or target an isolated lane with OPENMELD_ENV_PRESET=dev-local or OPENMELD_ENV_PRESET=canary.\",\n    ].join(\" \")\n  );\n}\n\nexport function isPublishedProductionOpenMeldRoot(\n  pathInput: OpenMeldPathResolutionInput\n): boolean {\n  return (\n    normalizeComparablePath(resolveOpenMeldRootDir(pathInput)) ===\n    PUBLISHED_PRODUCTION_OPENMELD_ROOT\n  );\n}\n\nexport function isTestProcess(\n  pathInput: OpenMeldPathResolutionInput = {}\n): boolean {\n  const env = pathInput.env ?? process.env;\n  const argv = pathInput.argv ?? process.argv;\n  return (\n    env.NODE_ENV === \"test\" ||\n    env.VITEST === \"true\" ||\n    typeof env.VITEST_WORKER_ID === \"string\" ||\n    typeof env.JEST_WORKER_ID === \"string\" ||\n    argv.some((arg) => arg.includes(\"vitest\"))\n  );\n}\n\nfunction normalizeComparablePath(path: string): string {\n  const normalized = resolve(path);\n  return process.platform === \"win32\" ? normalized.toLowerCase() : normalized;\n}\n"],"mappings":";;;;;;AASA,MAAM,qCAAqC,wBACzC,KAAK,QAAQ,GAAG,kCAAkC,MAAM,CAAC,CAC3D;AAEA,SAAgB,+CACd,WACA,YACM;CACN,IAAI,CAAC,cAAc,SAAS,GAC1B;CAEF,IAAI,CAAC,kCAAkC,SAAS,GAC9C;CAEF,MAAM,IAAI,MACR,CACE,sBAAsB,WAAW,kDACjC,kHACF,CAAC,CAAC,KAAK,GAAG,CACZ;AACF;;;;;;;;;;;AAYA,SAAgB,yDACd,WACA,YAAyC,CAAC,GACpC;CACN,IAAI,yBAAyB,SAAS,MAAM,QAC1C;CAEF,IAAI,cAAc,SAAS,GACzB,MAAM,IAAI,MACR;EACE,eAAe,UAAU;EACzB;EACA;CACF,CAAC,CAAC,KAAK,GAAG,CACZ;CAEF,IAAI,kCAAkC,SAAS,GAC7C;CAEF,MAAM,IAAI,MACR;EACE,eAAe,UAAU;EACzB;EACA;CACF,CAAC,CAAC,KAAK,GAAG,CACZ;AACF;AAEA,SAAgB,kCACd,WACS;CACT,OACE,wBAAwB,uBAAuB,SAAS,CAAC,MACzD;AAEJ;AAEA,SAAgB,cACd,YAAyC,CAAC,GACjC;CACT,MAAM,MAAM,UAAU,OAAO,QAAQ;CACrC,MAAM,OAAO,UAAU,QAAQ,QAAQ;CACvC,OACE,IAAI,aAAa,UACjB,IAAI,WAAW,UACf,OAAO,IAAI,qBAAqB,YAChC,OAAO,IAAI,mBAAmB,YAC9B,KAAK,MAAM,QAAQ,IAAI,SAAS,QAAQ,CAAC;AAE7C;AAEA,SAAS,wBAAwB,MAAsB;CACrD,MAAM,aAAa,QAAQ,IAAI;CAC/B,OAAO,QAAQ,aAAa,UAAU,WAAW,YAAY,IAAI;AACnE"}

package/dist/{runtime-ZLBVtFFY.js → runtime-DFlEdls4.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 
-import { I as resolveOpenMeldRootDir } from "./paths-DSkUuEu3.js";
-import { At as buildSpaceAttachmentDownloadPath, Or as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Wi as COMPUTER_FILE_ACCESS_OWNER_CANCELLED_REASON_CODE, mn as createSpaceApi, rn as createOrganizationSkillsApi } from "./dist-CAypwFRu.js";
+import { F as resolveOpenMeldRootDir } from "./paths-De9xdA2h.js";
+import { At as buildSpaceAttachmentDownloadPath, Or as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Wi as COMPUTER_FILE_ACCESS_OWNER_CANCELLED_REASON_CODE, mn as createSpaceApi, rn as createOrganizationSkillsApi } from "./dist-Bw6OBFYo.js";
 import { b as normalizeKnownBuiltinAgentControllerId, d as resolveBuiltinAgentControllerConversationKind, l as buildAgentControllerConversationRef } from "./controller-contract-DAOCaefz.js";
-import { $ as canManageRegistryAgentSkillTargets, $n as DISPATCH_SPACE_ACTION_DELIVERY_ONLY_ENV, $t as mergeOpenClawGatewayVisibility, An as runRuntimeTask, Bn as upsertConversationExecutionState, Bt as createMutableRouteCatalogState, Cn as verifyCodexAppServerThread, E as resolveProfileWorkspaceRuntime, Fn as loadLedgerState, Gt as syncRuntimeEventToInflightTaskControlRegistry, In as removeConversationExecutionState, Kt as SPACE_ACTION_CONTEXT_GUIDANCE_LINES, L as manageAgentRegistrationInstallation, Ln as resolveConversationExecutionStateByLookupKey, Nn as appendLedgerHistoryEntry, Pn as commitResolvedAgentContext, Qt as createPendingAgentInteractionRegistry, Rn as seedLegacyAgentContext, Sn as resolveCodexAppServerCompletedTurn, U as setAgentRegistrationEnabled, Un as assertLegacyAgentContextAssociation, Vn as withLedgerStateTransaction, Vt as createRouteCatalogFromMutableState, Wn as buildAgentContextLookupKey, Wt as normalizeDispatchThreadAction, Yt as createSerialAgentInteractionCallback, Zt as normalizeDispatchPostMessageAction, _ as loadDaemonRouteCatalog, a as buildOpenClawSpaceSessionKey, an as resolveDispatchContinuityObservation, b as resolveLocalController, bn as resolveInstalledCodexLaunchCandidates, cn as resolveLatestScopedConversationExecutionState, dn as createLocalAdapterEntries, en as createLocalTaskInterruptSender, ft as listProjectBindings, g as writeDaemonRouteCatalogCache, h as readDaemonRouteCatalogCache, in as resolveDispatchQueueLogMeta, jn as buildRuntimeWorkspaceFingerprint, kn as DaemonServiceRunError, kt as resolveRegistryRuntimeAdapterContractByAgentControllerRef, mn as resolveInstalledOpenCodeLaunchCandidates, nn as createLocalExecutionSlots, o as normalizeOpenClawSpaceIdPrefix, on as resolveCompatibleAgentContextMatch, pn as forkOpenCodeServerSession, qt as SPACE_ACTION_TARGET_GUIDANCE_LINES, rn as createInflightTaskControlRegistry, rt as resolveBuiltinAgentControllerDefinition, s as slugifyOpenClawNamePart, sn as resolveCompatibleConversationExecutionState, t as prepareProviderRuntime, tr as DEFAULT_TASK_LIFECYCLE_HEARTBEAT_INTERVAL_MS, tt as resolveSkillsAgentRegistry, un as createLocalAdapterContainer, v as buildRuntimeRouteTargets, w as resolveCurrentEffectiveProfileWorkingFolderRuntime, x as resolveLocalRuntimeControllerSupport, xn as forkCodexAppServerThread, y as readLocalEnabledControllers, yn as resolveCodexTimeoutMs, z as reconcileNewRunnableBuiltinAgentRegistrations, zn as settleInflightTask } from "./prepare-provider-runtime-DfsSj_N_.js";
-import { A as runtimeTransportLocalAgentControlSetEnabledFramePayloadSchema, D as runtimeTransportLocalAgentControlInterruptFramePayloadSchema, Dr as runtimeTransportDeliveryExecutionIdentitySchema, E as runtimeTransportLocalAgentControlForkSessionFramePayloadSchema, Er as runtimeCoordinatorExecutionTokenEnvelopeSchema, Gt as spaceWorkSelectionSchema, O as runtimeTransportLocalAgentControlManageInstallationFramePayloadSchema, R as runtimeTransportResumeControllerConversationFramePayloadSchema, T as runtimeTransportLocalAgentControlCancelFramePayloadSchema, Vr as localAgentReasoningPreferencesSchema, X as openMeldDaemonTaskResultPayloadSchema, f as runtimeTransportDispatchInteractionResponseFramePayloadSchema, hr as agentInteractionRequestSchema, l as runtimeTransportDeliverDispatchRequestSchema, m as runtimeTransportDispatchLifecycleRequestSchema, p as runtimeTransportDispatchLifecycleAcknowledgementSchema, pr as AGENT_INTERACTION_DEFAULT_TIMEOUT_MS, u as runtimeTransportDispatchInteractionDeliveredRequestSchema, x as runtimeTransportForkAgentSessionResultSchema, z as runtimeTransportResumeControllerConversationResultFramePayloadSchema, zr as LOCAL_AGENT_REASONING_MAX_CHARS } from "./runtime-transport-D4x8_AmR.js";
-import { d as getAuthSessionState } from "./auth-session-pLaN5cnC.js";
+import { $ as canManageRegistryAgentSkillTargets, $n as DISPATCH_SPACE_ACTION_DELIVERY_ONLY_ENV, $t as mergeOpenClawGatewayVisibility, An as runRuntimeTask, Bn as upsertConversationExecutionState, Bt as createMutableRouteCatalogState, Cn as verifyCodexAppServerThread, E as resolveProfileWorkspaceRuntime, Fn as loadLedgerState, Gt as syncRuntimeEventToInflightTaskControlRegistry, In as removeConversationExecutionState, Kt as SPACE_ACTION_CONTEXT_GUIDANCE_LINES, L as manageAgentRegistrationInstallation, Ln as resolveConversationExecutionStateByLookupKey, Nn as appendLedgerHistoryEntry, Pn as commitResolvedAgentContext, Qt as createPendingAgentInteractionRegistry, Rn as seedLegacyAgentContext, Sn as resolveCodexAppServerCompletedTurn, U as setAgentRegistrationEnabled, Un as assertLegacyAgentContextAssociation, Vn as withLedgerStateTransaction, Vt as createRouteCatalogFromMutableState, Wn as buildAgentContextLookupKey, Wt as normalizeDispatchThreadAction, Yt as createSerialAgentInteractionCallback, Zt as normalizeDispatchPostMessageAction, _ as loadDaemonRouteCatalog, a as buildOpenClawSpaceSessionKey, an as resolveDispatchContinuityObservation, b as resolveLocalController, bn as resolveInstalledCodexLaunchCandidates, cn as resolveLatestScopedConversationExecutionState, dn as createLocalAdapterEntries, en as createLocalTaskInterruptSender, ft as listProjectBindings, g as writeDaemonRouteCatalogCache, h as readDaemonRouteCatalogCache, in as resolveDispatchQueueLogMeta, jn as buildRuntimeWorkspaceFingerprint, kn as DaemonServiceRunError, kt as resolveRegistryRuntimeAdapterContractByAgentControllerRef, mn as resolveInstalledOpenCodeLaunchCandidates, nn as createLocalExecutionSlots, o as normalizeOpenClawSpaceIdPrefix, on as resolveCompatibleAgentContextMatch, pn as forkOpenCodeServerSession, qt as SPACE_ACTION_TARGET_GUIDANCE_LINES, rn as createInflightTaskControlRegistry, rt as resolveBuiltinAgentControllerDefinition, s as slugifyOpenClawNamePart, sn as resolveCompatibleConversationExecutionState, t as prepareProviderRuntime, tr as DEFAULT_TASK_LIFECYCLE_HEARTBEAT_INTERVAL_MS, tt as resolveSkillsAgentRegistry, un as createLocalAdapterContainer, v as buildRuntimeRouteTargets, w as resolveCurrentEffectiveProfileWorkingFolderRuntime, x as resolveLocalRuntimeControllerSupport, xn as forkCodexAppServerThread, y as readLocalEnabledControllers, yn as resolveCodexTimeoutMs, z as reconcileNewRunnableBuiltinAgentRegistrations, zn as settleInflightTask } from "./prepare-provider-runtime-BGdfbFyZ.js";
+import { Ar as runtimeTransportDeliveryExecutionIdentitySchema, B as runtimeTransportResumeControllerConversationResultFramePayloadSchema, D as runtimeTransportLocalAgentControlForkSessionFramePayloadSchema, E as runtimeTransportLocalAgentControlCancelFramePayloadSchema, Hr as LOCAL_AGENT_REASONING_MAX_CHARS, O as runtimeTransportLocalAgentControlInterruptFramePayloadSchema, S as runtimeTransportForkAgentSessionResultSchema, Wr as localAgentReasoningPreferencesSchema, Z as openMeldDaemonTaskResultPayloadSchema, f as runtimeTransportDispatchInteractionResponseFramePayloadSchema, gr as AGENT_INTERACTION_DEFAULT_TIMEOUT_MS, j as runtimeTransportLocalAgentControlSetEnabledFramePayloadSchema, k as runtimeTransportLocalAgentControlManageInstallationFramePayloadSchema, kr as runtimeCoordinatorExecutionTokenEnvelopeSchema, l as runtimeTransportDeliverDispatchRequestSchema, m as runtimeTransportDispatchLifecycleRequestSchema, p as runtimeTransportDispatchLifecycleAcknowledgementSchema, qt as spaceWorkSelectionSchema, u as runtimeTransportDispatchInteractionDeliveredRequestSchema, vr as agentInteractionRequestSchema, z as runtimeTransportResumeControllerConversationFramePayloadSchema } from "./runtime-transport-DH8Ks-AU.js";
+import { d as getAuthSessionState } from "./auth-session-DhSHCYvl.js";
 import { n as OPENMELD_DAEMON_CANCEL_WITHDRAWN_BEFORE_START_REASON_CODE, t as OPENMELD_DAEMON_CANCEL_STOP_REQUESTED_AFTER_START_REASON_CODE } from "./control-plane-rTE2rHZ5.js";
-import { f as withSkillsInstallLock, h as OFFICIAL_CLI_SKILL_URL, r as ensureLocalSkills, t as resolveSkillInstallStateForTarget } from "./state-CdSbKM0J.js";
-import { $ as emitDaemonDispatchJournalEvent, $t as getSpaceAccessRequestContext, B as enqueueDispatchResultOutboxRecord, G as resolveDispatchResultPayload, H as listDispatchResultOutboxPendingAcknowledgementKeys, Ht as buildSpaceRoundSignalPublication, J as sendDispatchPreviewEndFrame, K as sendDispatchInteractionRequestFrame, Kt as createDispatchContinuationSpaceAccessContext, O as consumeArmedAgentControllerInterfaceReprobe, Q as sendDispatchToolActivityFrame, Qt as getSpaceAccessPassword, U as waitForDispatchResultOutboxAcknowledgement, V as flushDispatchResultOutbox, W as buildFailedTaskResultPayload, X as sendDispatchReasoningFrame, Y as sendDispatchPreviewFrame, Z as sendDispatchRuntimeEvidenceFrame, a as resolveRegisterResponseFrame, at as isSameOrDescendantPath, ct as buildDispatchPromptPlan, dt as resolveBootstrapSpaceOwnerProfileId, f as resolveOpenCodeDatabasePath, ft as resolveBootstrapTargetProfileContext, i as resolveHeartbeatResponseFrame, lt as buildDispatchSessionTitle, mn as DISPATCH_SPACE_ACTION_CLI_FALLBACK_COMMAND, nn as isWakeClosingSystemNoticeType, nt as readComputerFileAccessPolicy, o as sendDaemonFrame, ot as buildDispatchBootstrapTemplateFacts, pt as resolveDispatchMentionSourceContext, q as sendDispatchLifecycleFrame, r as parseDaemonFrame, rn as listSpaceMemberDirectorySendTargets, rt as resolveComputerFileAccessStorePath, st as buildDispatchCorrelation, t as emitDaemonErrorFrame, u as readOpenCodeSessionRows, ut as parseDispatchTask, z as acknowledgeDispatchResultOutboxRecord } from "./daemon-frame-transport-xQnNyg6E.js";
-import { C as startLocalAgentActivitySyncLoop, E as recordOpenMeldCreatedLocalAgentSession, I as defaultManagedIntegrationPaths, L as installAgentActivityIntegrations, M as registerAgentActivityRoute, S as prepareClaudeProjectContainer, T as discoverLocalAgentSessionProviders, _ as markExecutionContextWorkspaceInUse, a as fetchSpaceUpdates, b as releaseExecutionContextWorkspace, c as materializeOrganizationSkillRelease, i as recordRuntimeReportingSuccess, l as createDispatchSpaceTools, n as recordRuntimeReportingFailure, o as createSpaceWorkingCopies, r as recordRuntimeReportingNotApplicable, s as downloadWorkingCopyFile, v as prepareExecutionContextWorkspace, x as createLedgerIo, y as readExecutionContextWorkspace } from "./runtime-reporting-health-state-DOg9iwwO.js";
-import { S as CONTROLLED_SHUTDOWN_RESULT_ACK_TIMEOUT_MS, _ as toErrorMessage$2, n as ensureDaemonRuntimePaths, s as emitRunLine, t as buildLedgerPaths, u as normalizeOptionalText$3, v as warnDaemonEvent } from "./daemon-device-id-B6iDyQEs.js";
-import { _ as resolvePublicAgentFailureReason, n as SPACE_COLLABORATION_CONTEXT_RULE, r as SPACE_PERSONAL_CONTRIBUTION_RULE, v as resolveSpacePublicationRequirement } from "./dist-DFhd6JmQ.js";
-import { a as serviceExecutionHostCatalogSchema, i as SERVICE_EXECUTION_HOST_PROTOCOL, t as ExecutionHostError } from "./channel-DppbHxHw.js";
-import { a as resolveBaseUrl, f as getConfiguredDaemonDispatchLimits, g as getConfiguredSkillsConfig } from "./base-url-eck31vC8.js";
-import { t as emitDaemonLifecycleEvent } from "./daemon-lifecycle-journal-DrwEygzu.js";
-import { a as buildOpenMeldProfileIdentityRequestHeadersWithAuth, f as buildOpenMeldRequestContextFromProfileIdentity, n as fetchSpaceRequestWithTimeout, t as createCliApiClientFoundation } from "./api-client-foundation-DgTXf3Gb.js";
-import { a as submitRuntimeProviderConversationProofs, f as recordRuntimeProviderUsageLimits, i as submitRuntimeAgentControllerReports, l as resolveLocalAgentControllerReportDecision, o as collectLocalAgentControllerInventory, t as notifyRuntimeReportingAttemptObserver, u as probeAgentControllerUsageObservationAuth } from "./runtime-agent-controller-reporting-submission-CbaUsNTF.js";
-import { t as installSkillsToTargets } from "./installer-Sc79LhuA.js";
-import { C as supersedeDispatchSpaceActionRecordForReconsideration, S as readDispatchSpaceActionRecord, f as createCliSpaceApi, m as buildDispatchOwnedRuntimeEnv, t as fetchSpaceMeta, v as OPENMELD_SPACE_ACTION_CONTEXT_PATH_ENV, y as createDispatchSpaceActionContext } from "./meta-api-CEw8eOeN.js";
+import { f as withSkillsInstallLock, h as OFFICIAL_CLI_SKILL_URL, r as ensureLocalSkills, t as resolveSkillInstallStateForTarget } from "./state-iJqU2XWw.js";
+import { $ as enqueueDispatchResultOutboxRecord, C as readOpenCodeSessionRows, Ct as buildDispatchSessionTitle, Dt as resolveDispatchMentionSourceContext, Et as resolveBootstrapTargetProfileContext, On as DISPATCH_SPACE_ACTION_CLI_FALLBACK_COMMAND, Q as acknowledgeDispatchResultOutboxRecord, St as buildDispatchPromptPlan, T as resolveOpenCodeDatabasePath, Tt as resolveBootstrapSpaceOwnerProfileId, V as consumeArmedAgentControllerInterfaceReprobe, _ as resolveHeartbeatResponseFrame, _n as listSpaceMemberDirectorySendTargets, _t as resolveComputerFileAccessStorePath, at as sendDispatchInteractionRequestFrame, bt as buildDispatchBootstrapTemplateFacts, c as createDispatchSpaceActionContext, ct as sendDispatchPreviewFrame, d as readDispatchSpaceActionRecord, dt as sendDispatchRuntimeEvidenceFrame, et as flushDispatchResultOutbox, f as supersedeDispatchSpaceActionRecordForReconsideration, fn as getSpaceAccessPassword, ft as sendDispatchToolActivityFrame, g as parseDaemonFrame, gn as isWakeClosingSystemNoticeType, gt as readComputerFileAccessPolicy, it as resolveDispatchResultPayload, l as readDispatchSpaceActionContextForReceiptFromEnv, lt as sendDispatchProgressFrame, m as emitDaemonErrorFrame, nn as buildSpaceRoundSignalPublication, nt as waitForDispatchResultOutboxAcknowledgement, on as createDispatchContinuationSpaceAccessContext, ot as sendDispatchLifecycleFrame, pn as getSpaceAccessRequestContext, pt as emitDaemonDispatchJournalEvent, r as buildDispatchOwnedRuntimeEnv, rt as buildFailedTaskResultPayload, s as OPENMELD_SPACE_ACTION_CONTEXT_PATH_ENV, st as sendDispatchPreviewEndFrame, tt as listDispatchResultOutboxPendingAcknowledgementKeys, ut as sendDispatchReasoningFrame, v as resolveRegisterResponseFrame, wt as parseDispatchTask, xt as buildDispatchCorrelation, y as sendDaemonFrame, yt as isSameOrDescendantPath } from "./dispatch-owned-runtime-CK2YJ2Oo.js";
+import { C as startDispatchSpaceProgressRelay, D as recordOpenMeldCreatedLocalAgentSession, E as discoverLocalAgentSessionProviders, L as defaultManagedIntegrationPaths, N as registerAgentActivityRoute, R as installAgentActivityIntegrations, S as prepareClaudeProjectContainer, _ as markExecutionContextWorkspaceInUse, a as fetchSpaceUpdates, b as releaseExecutionContextWorkspace, c as materializeOrganizationSkillRelease, i as recordRuntimeReportingSuccess, l as createDispatchSpaceTools, n as recordRuntimeReportingFailure, o as createSpaceWorkingCopies, r as recordRuntimeReportingNotApplicable, s as downloadWorkingCopyFile, v as prepareExecutionContextWorkspace, w as startLocalAgentActivitySyncLoop, x as createLedgerIo, y as readExecutionContextWorkspace } from "./runtime-reporting-health-state-_bvJcV1y.js";
+import { S as CONTROLLED_SHUTDOWN_RESULT_ACK_TIMEOUT_MS, _ as toErrorMessage$2, n as ensureDaemonRuntimePaths, s as emitRunLine, t as buildLedgerPaths, u as normalizeOptionalText$3, v as warnDaemonEvent } from "./daemon-device-id-DDazRZUV.js";
+import { _ as resolvePublicAgentFailureReason, n as SPACE_COLLABORATION_CONTEXT_RULE, r as SPACE_PERSONAL_CONTRIBUTION_RULE, v as resolveSpacePublicationRequirement } from "./dist--TaSMxQz.js";
+import { a as serviceExecutionHostCatalogSchema, i as SERVICE_EXECUTION_HOST_PROTOCOL, t as ExecutionHostError } from "./channel-tvFZSSVr.js";
+import { a as resolveBaseUrl, f as getConfiguredDaemonDispatchLimits, g as getConfiguredSkillsConfig } from "./base-url-0AoeTi3w.js";
+import { t as emitDaemonLifecycleEvent } from "./daemon-lifecycle-journal-CRxQL9m6.js";
+import { a as buildOpenMeldProfileIdentityRequestHeadersWithAuth, f as buildOpenMeldRequestContextFromProfileIdentity, n as fetchSpaceRequestWithTimeout, t as createCliApiClientFoundation } from "./api-client-foundation-EZpFLGVC.js";
+import { a as submitRuntimeProviderConversationProofs, f as recordRuntimeProviderUsageLimits, i as submitRuntimeAgentControllerReports, l as resolveLocalAgentControllerReportDecision, o as collectLocalAgentControllerInventory, t as notifyRuntimeReportingAttemptObserver, u as probeAgentControllerUsageObservationAuth } from "./runtime-agent-controller-reporting-submission-C_xD2A-P.js";
+import { t as installSkillsToTargets } from "./installer-C7iSAOSz.js";
+import { f as createCliSpaceApi, t as fetchSpaceMeta } from "./meta-api-BpwJWE22.js";
 import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { basename, dirname, extname, join } from "node:path";
@@ -2005,6 +2005,21 @@ function buildDispatchPromptTrace(input) {
 	};
 }
 //#endregion
+//#region src/local-service/dispatch/public-progress-stream.ts
+function createDispatchPublicProgressReporter(input) {
+	const acceptedUpdates = [];
+	const acceptedUpdateSet = /* @__PURE__ */ new Set();
+	return (update) => {
+		const normalized = update.trim();
+		if (acceptedUpdateSet.has(normalized)) return { status: "duplicate" };
+		const progressSnapshot = [...acceptedUpdates, normalized].join("\n\n").slice(-8192);
+		if (!input.publish(progressSnapshot)) return { status: "unavailable" };
+		acceptedUpdateSet.add(normalized);
+		acceptedUpdates.push(normalized);
+		return { status: "accepted" };
+	};
+}
+//#endregion
 //#region src/local-service/dispatch/reasoning-stream.ts
 /** Keep private live content outside all lifecycle and journaling observers. */
 function routeReasoningEvents(reasoning, lifecycle) {
@@ -2735,6 +2750,32 @@ async function handleDispatchDeliverFrame(input) {
 	});
 	const runtimeStartedAtMs = Date.now();
 	let agentToolActivitySequence = 0;
+	const reportPublicProgress = createDispatchPublicProgressReporter({ publish: (progressSnapshot) => {
+		const socket = currentSocketRef.socket;
+		if (!socket || (socket.bufferedAmount ?? 0) > 64 * 1024) return false;
+		sendDispatchProgressFrame({
+			socket,
+			progressSnapshot,
+			observedAtMs: Date.now(),
+			sequence: ++agentToolActivitySequence,
+			attemptId: parsedTask.attemptId,
+			dispatchId: parsedTask.dispatchId,
+			daemonSessionId: input.daemonSessionId,
+			connectionGeneration: resolveCurrentConnectionGeneration({
+				currentSocketRef,
+				fallbackConnectionGeneration: input.deliverRequest.connectionGeneration
+			}),
+			executionIdentityEcho: toRuntimeTransportRuntimeEvidenceIdentityEcho(input.deliverRequest),
+			executionTokenEcho: parsedTask.executionTokenEcho,
+			leaseEpoch: input.deliverRequest.leaseEpoch,
+			runtimeCoordinatorExecutionId: parsedTask.runtimeCoordinatorExecutionId,
+			sourceSignalId: parsedTask.sourceEventId,
+			spaceId: parsedTask.spaceId,
+			targetProfileId: parsedTask.targetProfileId,
+			taskId: parsedTask.taskId
+		});
+		return true;
+	} });
 	let firstReasoningMs;
 	const sendReasoning = (thinkingSnapshot, observedAtMs, status = "streaming") => {
 		const socket = currentSocketRef.socket;
@@ -3385,6 +3426,7 @@ async function handleDispatchDeliverFrame(input) {
 			onInteractionRequest,
 			onNativeTurnStarted,
 			onNativeTurnCompleted,
+			onPublicProgress: reportPublicProgress,
 			onRuntimeEvent,
 			onPreview: (preview) => {
 				emitDispatchPreviewFrame({
@@ -4230,14 +4272,15 @@ async function resolveDispatchComputerFileAccess(input) {
 			taskWorkspace: input.taskWorkspace,
 			workingCopyId: input.parsedTask.workingCopyId
 		});
-		if (!(await verifier({
+		const verification = await verifier({
 			boundary,
 			workingDirectory,
 			executionMode: "normal",
 			agentControllerPermissionMode: input.routeConfig?.agentControllerPermissionMode,
 			launchContract: input.routeConfig?.launchContract ?? null,
 			transportMode: input.parsedTask.transportMode
-		})).supported) throw new Error("execution_context.file_access_unverified");
+		});
+		if (!verification.supported) throw new Error(verification.reasonCode === "computer.file_access.controller_unsupported" && input.routeConfig?.agentControllerPermissionMode === "codex:customConfig" ? "execution_context.custom_config_file_access_unverified" : "execution_context.file_access_unverified");
 		return boundary;
 	}
 	const admission = await resolveComputerFileAccessAdmission({
@@ -5379,10 +5422,19 @@ async function runDispatchRuntimeExecution(input) {
 		runtimeControllerSupport: input.runtimeControllerSupport,
 		streamingMode: input.streamingModeOverride ?? input.parsedTask.streamingMode
 	});
-	const spaceActionTools = route.env?.["OPENMELD_SPACE_ACTION_CONTEXT_PATH"] ? createDispatchSpaceTools({ env: {
+	const dispatchRuntimeEnv = {
 		...process.env,
 		...route.env
-	} }) : void 0;
+	};
+	const spaceActionTools = route.env?.["OPENMELD_SPACE_ACTION_CONTEXT_PATH"] ? createDispatchSpaceTools({
+		env: dispatchRuntimeEnv,
+		...input.onPublicProgress ? { reportProgress: input.onPublicProgress } : {}
+	}) : void 0;
+	const progressRelay = input.onPublicProgress && route.env?.["OPENMELD_SPACE_ACTION_CONTEXT_PATH"] ? startDispatchSpaceProgressRelay({
+		context: readDispatchSpaceActionContextForReceiptFromEnv(dispatchRuntimeEnv),
+		contextPath: route.env[OPENMELD_SPACE_ACTION_CONTEXT_PATH_ENV],
+		reportProgress: input.onPublicProgress
+	}) : null;
 	try {
 		await input.onNativeTurnStarted();
 		const result = await runRuntimeTask({
@@ -5409,6 +5461,7 @@ async function runDispatchRuntimeExecution(input) {
 		input.onNativeTurnCompleted(result);
 		return result;
 	} finally {
+		await progressRelay?.close();
 		spaceActionTools?.close();
 	}
 }
@@ -8082,6 +8135,7 @@ async function createExecutionHostResources(input) {
 				await interrupt(signal);
 			},
 			registerRuntimeProcess: (event) => {
+				input.observeOwnedProcess?.(event);
 				const processId = event.phase === "process_exit" ? null : event.processId;
 				const updated = inflightTaskControlRegistry.updateTaskProcess({
 					processId,
@@ -8587,4 +8641,4 @@ function createExecutionHostRuntime(input) {
 //#endregion
 export { createExecutionHostResources, createExecutionHostRuntime };
 
-//# sourceMappingURL=runtime-ZLBVtFFY.js.map
+//# sourceMappingURL=runtime-DFlEdls4.js.map