privateer-agent 0.2.1 → 0.3.1

package/src/routines/delivery.ts

@@ -1,4 +1,5 @@
 import type { Routine } from "./schema.ts";
+import { webhookName } from "./schema.ts";
 import { writeRoutineOutput, addNotice } from "./store.ts";
 
 // A relay pusher, injected by the daemon. Given the finished result it either
@@ -7,13 +8,39 @@ import { writeRoutineOutput, addNotice } from "./store.ts";
 // result is durably accounted for, so delivery doesn't add a notice backstop for it.
 export type RelayPusher = (routine: Routine, content: string) => "live" | "queued";
 
+// A cloud-outbox pusher, injected by the daemon. Seals the result to the account's
+// outbox public key and POSTs the ciphertext to the server (E2EE store-and-forward),
+// or buffers it durably on failure. Returns "sent" when the server accepted it,
+// "queued" when it was persisted for a later flush — either way the result is
+// durably accounted for. `status` is carried so the sealed envelope can render
+// ok/error without re-parsing the markdown body.
+export type CloudPusher = (routine: Routine, content: string, status: "ok" | "error") => Promise<"sent" | "queued">;
+
+// A named webhook endpoint from config `webhooks`.
+export interface WebhookTarget {
+  url: string;
+  format?: "slack" | "discord" | "json";
+}
+
 export interface DeliveryContext {
   pushRelay?: RelayPusher;
+  // Seals + posts the result to the account's cloud outbox, or buffers it. Absent
+  // (e.g. not signed in) → the `cloud` channel falls back to a notice so the result
+  // isn't silently lost.
+  pushCloud?: CloudPusher;
+  // Named endpoints for "webhook:<name>" delivery entries; results POST here.
+  webhooks?: Record<string, WebhookTarget>;
+  // Scrubs secrets from anything leaving the machine. Webhook bodies always pass
+  // through this when provided (the daemon wires in redactText).
+  redact?: (text: string) => string;
+  // Injectable for tests; defaults to global fetch.
+  fetchImpl?: typeof fetch;
 }
 
 export interface DeliveryReport {
   // Channels that actually delivered (email is handled inside the agent run, so it
-  // never appears here — see the daemon).
+  // never appears here — see the daemon). Failed webhooks show as
+  // "webhook:<name>(failed)" and leave a notice so the result isn't silently lost.
   delivered: string[];
   // Absolute path to latest.md when file delivery ran.
   filePath?: string;
@@ -23,19 +50,65 @@ function previewOf(content: string): string {
   return content.replace(/\s+/g, " ").trim().slice(0, 120) || "(no output)";
 }
 
+// Message-size caps per format (Discord rejects >2000 chars of content; Slack
+// truncates around 40k; plain JSON consumers get a generous bound).
+const FORMAT_CAPS = { slack: 39_000, discord: 1_900, json: 100_000 } as const;
+
+function truncate(text: string, cap: number): string {
+  return text.length <= cap ? text : text.slice(0, cap - 12) + "\n…truncated";
+}
+
+// Wrap the result for the target service. All formats carry plain text — no
+// service-specific rich blocks, so a generic receiver can consume `json` too.
+export function webhookBody(
+  target: WebhookTarget,
+  routine: Pick<Routine, "name">,
+  content: string,
+  status: "ok" | "error",
+): string {
+  const format = target.format ?? "json";
+  const text = truncate(content, FORMAT_CAPS[format]);
+  switch (format) {
+    case "slack":
+      return JSON.stringify({ text: `*${routine.name}* (${status})\n${text}` });
+    case "discord":
+      return JSON.stringify({ content: `**${routine.name}** (${status})\n${text}` });
+    case "json":
+      return JSON.stringify({ routine: routine.name, status, at: new Date().toISOString(), content: text });
+  }
+}
+
+async function postWebhook(
+  target: WebhookTarget,
+  routine: Routine,
+  content: string,
+  status: "ok" | "error",
+  fetchImpl: typeof fetch,
+): Promise<void> {
+  const res = await fetchImpl(target.url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: webhookBody(target, routine, content, status),
+    signal: AbortSignal.timeout(15_000),
+  });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+}
+
 // Deliver a routine's result to its configured channels. `file` and `notice` are
 // deterministic and on-box. `relay` pushes to an attached controller in real time
 // (best-effort — the socket may be up with no controller attached), so we ALSO keep
 // a durable record when the routine has no other on-box channel, guaranteeing the
-// result is never silently lost. `email` is intentionally not handled here: it is
-// fulfilled inside the agent turn (the daemon adds the Gmail tool + an instruction
-// to the prompt) so plaintext egress stays an explicit, gated action.
-export function deliver(
+// result is never silently lost. `webhook:<name>` POSTs the (redacted) result to a
+// named endpoint from config; a failed or unconfigured webhook leaves a notice.
+// `email` is intentionally not handled here: it is fulfilled inside the agent turn
+// (the daemon adds the Gmail tool + an instruction to the prompt) so plaintext
+// egress stays an explicit, gated action.
+export async function deliver(
   routine: Routine,
   content: string,
   status: "ok" | "error",
   ctx: DeliveryContext = {},
-): DeliveryReport {
+): Promise<DeliveryReport> {
   const delivered: string[] = [];
   const wants = new Set(routine.delivery);
   let filePath: string | undefined;
@@ -57,15 +130,51 @@ export function deliver(
   // next attaches (the daemon persists that queue, so it's durable either way). Only
   // when no pusher is wired at all do we fall back to a notice so it isn't lost.
   if (wants.has("relay")) {
-    const status = ctx.pushRelay?.(routine, content);
-    if (status === "live") delivered.push("relay");
-    else if (status === "queued") delivered.push("relay(queued)");
+    const pushed = ctx.pushRelay?.(routine, content);
+    if (pushed === "live") delivered.push("relay");
+    else if (pushed === "queued") delivered.push("relay(queued)");
     else if (!wants.has("file") && !wants.has("notice")) {
       leaveNotice();
       delivered.push("notice(backstop)");
     }
   }
 
+  // Cloud outbox: sealed E2EE store-and-forward. "sent" reached the server; "queued"
+  // was buffered on disk (offline / server down / app hasn't published its outbox key
+  // yet) and flushes later — both are durable. Only when no pusher is wired at all,
+  // and nothing else keeps a durable record, do we fall back to a notice.
+  if (wants.has("cloud")) {
+    const sent = ctx.pushCloud ? await ctx.pushCloud(routine, content, status) : undefined;
+    if (sent === "sent") delivered.push("cloud");
+    else if (sent === "queued") delivered.push("cloud(queued)");
+    else if (!wants.has("file") && !wants.has("notice") && !wants.has("relay")) {
+      leaveNotice();
+      delivered.push("notice(backstop)");
+    }
+  }
+
+  // Webhooks: plaintext leaves the machine, so the body is always redacted when a
+  // scrubber is wired. Any failure (unconfigured name, HTTP error, timeout) leaves
+  // a notice so the user learns the result existed and the push didn't happen.
+  for (const entry of routine.delivery) {
+    const name = webhookName(entry);
+    if (!name) continue;
+    const target = ctx.webhooks?.[name];
+    if (!target) {
+      leaveNotice();
+      delivered.push(`${entry}(unconfigured)`);
+      continue;
+    }
+    try {
+      const body = ctx.redact ? ctx.redact(content) : content;
+      await postWebhook(target, routine, body, status, ctx.fetchImpl ?? fetch);
+      delivered.push(entry);
+    } catch {
+      leaveNotice();
+      delivered.push(`${entry}(failed)`);
+    }
+  }
+
   if (wants.has("notice")) {
     leaveNotice();
     delivered.push("notice");

package/src/routines/schema.ts

@@ -1,11 +1,30 @@
 import { z } from "zod";
 
-// Where a routine's result is delivered after it runs. Everything except `email`
-// stays inside the user's trust boundary; `email` crosses it (hands plaintext to a
-// third-party mail provider via the Gmail MCP tool), so it is opt-in and labeled.
-export const DELIVERY_CHANNELS = ["file", "relay", "notice", "email"] as const;
+// Where a routine's result is delivered after it runs. `file`/`relay`/`notice` stay
+// inside the user's trust boundary. `cloud` stores an END-TO-END-ENCRYPTED copy in
+// the account's server outbox for the app to catch up on when it next opens (the
+// server only ever sees ciphertext — it can't read results — but does learn that a
+// result exists, plus its time and rough size). `email` and `webhook:<name>` cross
+// the boundary in plaintext to a third-party service, so they are opt-in and labeled
+// at approval time.
+export const DELIVERY_CHANNELS = ["file", "relay", "notice", "cloud", "email"] as const;
 export type DeliveryChannel = (typeof DELIVERY_CHANNELS)[number];
 
+// A webhook entry references a named endpoint from config `webhooks` — the routine
+// itself never carries a URL, so all egress targets stay in one reviewable place.
+const WEBHOOK_ENTRY_RE = /^webhook:[a-zA-Z0-9._-]{1,64}$/;
+
+export const DeliveryEntry = z.union([
+  z.enum(DELIVERY_CHANNELS),
+  z.string().regex(WEBHOOK_ENTRY_RE, "webhook entries look like 'webhook:<config-name>'"),
+]);
+export type DeliveryEntry = z.infer<typeof DeliveryEntry>;
+
+// The webhook name of a delivery entry, or null for the builtin channels.
+export function webhookName(entry: string): string | null {
+  return entry.startsWith("webhook:") ? entry.slice("webhook:".length) : null;
+}
+
 // A saved, unattended agent task. Persisted in routines.json and executed by the
 // daemon when its trigger comes due. A routine's trigger is EITHER recurring (a
 // cron expression) or one-off (`at`, a specific datetime) — exactly one is set.
@@ -27,7 +46,7 @@ export const Routine = z
     // Optional "provider:model" override; falls back to config.defaultModel.
     model: z.string().optional(),
     // Where to deliver the result. Defaults to on-box file output.
-    delivery: z.array(z.enum(DELIVERY_CHANNELS)).default(["file"]),
+    delivery: z.array(DeliveryEntry).default(["file"]),
     // Optional tool allow-subset. Unset → the safe read/web set (see daemon). Entries
     // may be builtin names ("read") or MCP selectors — "<server>__<tool>" exact or
     // "<server>__*" for a whole server (see routines/toolSelect.ts). Selected MCP

package/src/routines/store.ts

@@ -1,7 +1,7 @@
 import { mkdirSync, writeFileSync, readFileSync, existsSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-import { globalDir } from "../config/load.ts";
+import { globalDir } from "../config/paths.ts";
 import { Routine, RoutineFile } from "./schema.ts";
 
 // routines.json lives alongside config.json in the global dir. It can carry the
@@ -203,3 +203,46 @@ export function drainPendingRelay(): PendingRelay[] {
   }
   return queue;
 }
+
+// A `cloud`-delivery result that couldn't be sealed+posted to the account outbox
+// yet (offline, server down, or the app hasn't published its outbox key). Held on
+// disk until a later flush succeeds. Unlike PendingRelay this carries `status`, so
+// the sealed envelope the app opens can render ok/error without re-parsing markdown.
+export interface PendingCloud {
+  routine: string;
+  at: string; // ISO timestamp
+  status: "ok" | "error";
+  content: string;
+}
+
+function pendingCloudPath(): string {
+  return join(globalDir(), "routines", "pending-cloud.json");
+}
+
+export function loadPendingCloud(): PendingCloud[] {
+  const path = pendingCloudPath();
+  if (!existsSync(path)) return [];
+  try {
+    const data = JSON.parse(readFileSync(path, "utf8"));
+    return Array.isArray(data) ? (data as PendingCloud[]) : [];
+  } catch {
+    return [];
+  }
+}
+
+export function addPendingCloud(entry: PendingCloud): void {
+  const dir = join(globalDir(), "routines");
+  mkdirSync(dir, { recursive: true });
+  const queue = loadPendingCloud();
+  queue.push(entry);
+  savePendingCloud(queue.slice(-50)); // bound the backlog
+}
+
+// Overwrite the queue wholesale — used by the flush to drop the items it managed
+// to post while keeping the ones that still failed (and their order).
+export function savePendingCloud(entries: PendingCloud[]): void {
+  const dir = join(globalDir(), "routines");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(pendingCloudPath(), JSON.stringify(entries, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+  tryChmod(pendingCloudPath(), 0o600);
+}

package/src/routines/toolSelect.ts

@@ -1,4 +1,6 @@
-import type { ToolSet } from "ai";
+// A record of tool-name → tool definition. Was `ai`'s ToolSet in 0.2; MCP tool
+// wiring is a Phase-5 concern, so a structural type suffices for the filter below.
+type ToolSet = Record<string, unknown>;
 
 // A routine's `tools` field mixes builtin tool names with MCP selectors. MCP tools
 // are namespaced "<server>__<tool>" (see adaptMcpTools), and no builtin name contains

package/src/session.ts

@@ -1,289 +1,97 @@
-import type { LanguageModel, ToolSet } from "ai";
-import type { Config } from "./config/schema.ts";
-import { resolveModel, parseModelSpec } from "./providers/resolve.ts";
-import { modelSupports, modalitiesFor, suggestModelFor } from "./providers/capabilities.ts";
-import type { Route, RouteSet, Modality } from "./engine/router.ts";
-import { createTools, createReadOnlyTools, createToolSubset } from "./tools/index.ts";
-import { buildSystemPrompt, buildSubAgentPrompt, buildAgentPrompt } from "./context/systemPrompt.ts";
-import { findOutputStyle } from "./context/outputStyles.ts";
-import { QueryEngine } from "./engine/QueryEngine.ts";
-import { autoApproveGate, type PermissionGate } from "./permissions/gate.ts";
-import type { SubAgentRunner } from "./tools/context.ts";
-import type { UserAsker } from "./tools/askUser.ts";
-import { TodoStore } from "./tools/todoStore.ts";
-import type { CheckpointStore } from "./memory/checkpoints.ts";
-import type { ProcessRegistry } from "./tools/processRegistry.ts";
-import { AttachmentStore } from "./util/attachmentStore.ts";
-import { HookRunner, loadHooks, wrapToolsWithHooks } from "./hooks/engine.ts";
-import { createLimiter } from "./util/limit.ts";
-
-export interface SessionOptions {
-  config: Config;
-  modelSpec: string;
+// Thin headless session wrapper (Phase 1).
+//
+// Wraps Pi's createAgentSession and exposes the ONE thing the preserved
+// connection layer needs: a subscription that yields privateer EngineEvents
+// (via the adapter) instead of raw Pi events. `createSession()` →
+// `{ session, subscribeAsEngineEvents() }`, per docs/pi-migration-plan.md §2
+// Phase 1. Mirrors the setup proven in ../../ pi-spike/spike-b.mjs.
+//
+// This module is Pi-touching: it is only ever loaded via a DYNAMIC import from
+// an entrypoint that has already run ./boot.ts (env + dispatcher). Never import
+// it statically from boot.ts or anything boot pulls in.
+
+import {
+  createAgentSession,
+  DefaultResourceLoader,
+  SessionManager,
+  SettingsManager,
+  ModelRegistry,
+  AuthStorage,
+} from "@earendil-works/pi-coding-agent";
+
+import { agentDir as defaultAgentDir } from "./config/paths.ts";
+import { createEngineEventAdapter } from "./bridge/engineAdapter.ts";
+import type { EngineEvent } from "./engine/events.ts";
+
+export interface CreateSessionOptions {
   cwd: string;
-  gate?: PermissionGate;
-  // Confine file tools to cwd (default true). False lets the agent read/edit anywhere.
-  confineToCwd?: boolean;
-  // Out-of-cwd directories approved this session; shared with the gate so an approved
-  // location stops re-prompting. Pass the same array instance the gate holds.
-  allowedOutsideRoots?: string[];
-  // Active output style name (persona); resolved against .privateer/output-styles.
-  outputStyle?: string;
-  // When true, the system prompt instructs the model to plan, not implement.
-  planMode?: boolean;
-  // Session checkpoint store; write/edit record mutations into it for /rewind.
-  checkpoints?: CheckpointStore;
-  // Extra tools merged into the toolset (e.g. tools exposed by MCP servers).
-  extraTools?: ToolSet;
-  // When set, restrict the built-in toolset to these tool names (MCP `extraTools`
-  // are always kept). Used for unattended runs (scheduled routines) that must not
-  // have write/bash/edit auto-approved with no human to gate them.
-  allowedTools?: string[];
-  // Background-shell registry for bash run_in_background / bash_output / kill_shell.
-  processes?: ProcessRegistry;
-  // Session attachment store, so dragged/pasted file bytes can be saved via the
-  // save_attachment tool. Created here when the caller doesn't supply one.
-  attachments?: AttachmentStore;
-  // Reports each finished `task` sub-agent's run metrics (tool uses + tokens) by
-  // tool-call id, so the TUI can render the grouped agents view. Best-effort.
-  onSubAgentMetrics?: (toolCallId: string, m: { toolUses: number; tokens: number }) => void;
-  // Surfaces an `ask_user` question to the live TUI and resolves with the choice.
-  // Omitted outside the interactive app, where ask_user reports it couldn't ask.
-  askUser?: UserAsker;
-  // Streams a file to the connected remote controller (Privateer app), for the
-  // send_file_to_client tool. Omitted when remote access isn't available.
-  sendFileToController?: (file: {
-    name: string;
-    mediaType: string;
-    base64: string;
-    size: number;
-  }) => Promise<{ ok: boolean; reason?: string }>;
-}
-
-export interface Session {
-  engine: QueryEngine;
-  modelSpec: string;
   provider: string;
   modelId: string;
-  cwd: string;
-  todos: TodoStore;
-  attachments: AttachmentStore;
+  // Pi extension factories, e.g. [makePermissionGate({ decide })].
+  extensionFactories?: Array<(pi: any) => void>;
+  // Custom tools (defineTool) plus the enabled tool-name allowlist.
+  customTools?: unknown[];
+  tools?: string[];
+  // Override the Pi agent dir; defaults to $PRIVATEER_HOME/agent (pinned by boot).
+  agentDir?: string;
 }
 
-// Assemble a ready-to-run agent session: resolve the model, bind tools to the
-// cwd + permission gate, build the system prompt, and create the engine.
-export function createSession(opts: SessionOptions): Session {
-  const resolved = resolveModel(opts.modelSpec, opts.config);
-  const gate = opts.gate ?? autoApproveGate;
-  const confineToCwd = opts.confineToCwd ?? true;
-  const allowedOutsideRoots = opts.allowedOutsideRoots ?? [];
-  const todos = new TodoStore();
-  const attachments = opts.attachments ?? new AttachmentStore();
-  const cache = isAnthropicFamily(resolved.provider, resolved.modelId);
-
-  // Bound how many sub-agents run at once when the model fans `task` calls out.
-  const subAgentLimit = createLimiter(opts.config.maxSubagents);
+export interface PrivateerSession {
+  session: any;
+  // Subscribe to the turn stream as privateer EngineEvents. Returns an unsubscribe.
+  subscribeAsEngineEvents(onEvent: (ev: EngineEvent) => void): () => void;
+  adapter: ReturnType<typeof createEngineEventAdapter>;
+}
 
-  // A `task` sub-agent: a fresh engine run to completion, returning the text it
-  // produced. Without an agent definition it uses the read-only toolset under an
-  // auto-approve gate; with one it uses that agent's tools (routed through the parent
-  // gate, so any mutations are still user-approved), model override, and instructions.
-  const runSubAgent: SubAgentRunner = ({ description, prompt, agent }) =>
-    subAgentLimit(async () => {
-    let model = resolved.model;
-    let childCache = cache;
-    if (agent?.model) {
-      try {
-        const r = resolveModel(agent.model, opts.config);
-        model = r.model;
-        childCache = isAnthropicFamily(r.provider, r.modelId);
-      } catch {
-        /* fall back to the parent model */
-      }
-    }
-    const system = agent
-      ? buildAgentPrompt({ cwd: opts.cwd, model: opts.modelSpec, description, instructions: agent.prompt })
-      : buildSubAgentPrompt({ cwd: opts.cwd, model: opts.modelSpec, description });
-    const tools = agent
-      ? createToolSubset({ cwd: opts.cwd, gate, confineToCwd, allowedOutsideRoots }, agent.tools)
-      : createReadOnlyTools({ cwd: opts.cwd, gate: autoApproveGate, confineToCwd, allowedOutsideRoots });
+export async function createSession(opts: CreateSessionOptions): Promise<PrivateerSession> {
+  const AGENT_DIR = opts.agentDir ?? process.env.PI_CODING_AGENT_DIR ?? defaultAgentDir();
 
-    const child = new QueryEngine({
-      routes: singleRouteSet(agent?.model ?? opts.modelSpec, model, childCache),
-      system,
-      tools,
-      maxSteps: Math.min(opts.config.maxSteps, 20),
-    });
-    let out = "";
-    let toolUses = 0;
-    for await (const ev of child.send(prompt)) {
-      if (ev.type === "text") out += ev.text;
-      else if (ev.type === "tool-call") toolUses++;
-      else if (ev.type === "error")
-        return { text: `Sub-agent error: ${ev.error}`, toolUses, tokens: child.usage.totalTokens };
-    }
-    return {
-      text: out.trim() || "(sub-agent returned no output)",
-      toolUses,
-      tokens: child.usage.totalTokens,
-    };
-    });
+  const authStorage = AuthStorage.inMemory();
+  const modelRegistry = ModelRegistry.create(authStorage, `${AGENT_DIR}/models.json`);
+  if (typeof (modelRegistry as any).refresh === "function") await (modelRegistry as any).refresh();
+  else if (typeof (modelRegistry as any).loadModels === "function")
+    await (modelRegistry as any).loadModels();
 
-  const hooks = new HookRunner(loadHooks((opts.config as Record<string, unknown>).hooks), opts.cwd);
-  let builtinTools = createTools({
-    cwd: opts.cwd,
-    gate,
-    confineToCwd,
-    allowedOutsideRoots,
-    todos,
-    runSubAgent,
-    onSubAgentMetrics: opts.onSubAgentMetrics,
-    recordMutation: opts.checkpoints ? (abs) => opts.checkpoints!.recordMutation(abs) : undefined,
-    processes: opts.processes,
-    attachments,
-    askUser: opts.askUser,
-    sendFileToController: opts.sendFileToController,
-  });
-  if (opts.allowedTools) {
-    const allow = new Set(opts.allowedTools);
-    builtinTools = Object.fromEntries(
-      Object.entries(builtinTools).filter(([name]) => allow.has(name)),
+  const model = modelRegistry.find(opts.provider, opts.modelId);
+  if (!model) {
+    const ids = ((modelRegistry as any).getAll?.() ?? []).map(
+      (m: any) => `${m.provider}/${m.id}`,
+    );
+    throw new Error(
+      `model ${opts.provider}/${opts.modelId} not found. Registry has: ${ids.join(", ") || "(none)"}`,
     );
   }
-  const tools = wrapToolsWithHooks(
-    {
-      ...builtinTools,
-      ...(opts.extraTools ?? {}),
-    },
-    hooks,
-  );
-  const outputStyleBody = opts.outputStyle
-    ? findOutputStyle(opts.outputStyle, opts.cwd)?.body
-    : undefined;
-  const system = buildSystemPrompt({
-    cwd: opts.cwd,
-    model: opts.modelSpec,
-    outputStyleBody,
-    planMode: opts.planMode,
-  });
 
-  const engine = new QueryEngine({
-    routes: buildRouteSet(opts.config, opts.modelSpec, resolved.model, cache),
-    system,
-    tools,
-    maxSteps: opts.config.maxSteps,
-    contextBudget: opts.config.contextBudget,
-    compactRatio: opts.config.compactRatio,
+  const settingsManager = SettingsManager.create(opts.cwd, AGENT_DIR);
+  const loader = new DefaultResourceLoader({
+    cwd: opts.cwd,
+    agentDir: AGENT_DIR,
+    settingsManager,
+    extensionFactories: opts.extensionFactories ?? [],
   });
+  await loader.reload();
 
-  return {
-    engine,
-    modelSpec: opts.modelSpec,
-    provider: resolved.provider,
-    modelId: resolved.modelId,
+  const { session } = await createAgentSession({
     cwd: opts.cwd,
-    todos,
-    attachments,
-  };
-}
-
-// Anthropic prompt caching only benefits Anthropic-family models: direct Anthropic,
-// or an OpenRouter route to an Anthropic model. For everything else the cache hints
-// are a harmless no-op, but we skip them to avoid sending unused providerOptions.
-function isAnthropicFamily(provider: string, modelId: string): boolean {
-  if (provider === "anthropic") return true;
-  if (provider === "openrouter") return modelId.startsWith("anthropic/");
-  return false;
-}
-
-// Short display name for UI notices: drop any "vendor/" prefix from the model id.
-function shortLabel(spec: string): string {
-  const modelId = spec.includes(":") ? spec.slice(spec.indexOf(":") + 1) : spec;
-  return modelId.slice(modelId.lastIndexOf("/") + 1);
-}
-
-// Resolve a "provider:model" spec into a Route, deriving its per-model cache /
-// thinking flags and supported input modalities from the model family.
-function buildRoute(spec: string, config: Config): Route {
-  const r = resolveModel(spec, config);
-  const cache = isAnthropicFamily(r.provider, r.modelId);
-  return {
-    spec,
-    model: r.model,
-    cacheControl: cache,
-    thinkingBudget: cache ? config.thinkingBudget : undefined,
-    label: shortLabel(spec),
-    supports: modalitiesFor(r.provider, r.modelId),
-  };
-}
-
-// A trivial RouteSet with only the default route (sub-agents, which run one fixed
-// model). The high `longThreshold` / zero `fastMaxChars` keep the router on default.
-function singleRouteSet(spec: string, model: LanguageModel, cacheControl: boolean): RouteSet {
-  const { provider, modelId } = parseModelSpec(spec);
-  return {
-    default: { spec, model, cacheControl, label: shortLabel(spec), supports: modalitiesFor(provider, modelId) },
-    longThreshold: Number.POSITIVE_INFINITY,
-    fastMaxChars: 0,
-  };
-}
-
-// Pairs of (config key, RouteSet key, modality) for the modality routes.
-const MODALITY_ROUTE_KEYS: { cfg: "vision" | "document" | "audio" | "video"; modality: Modality }[] = [
-  { cfg: "vision", modality: "image" },
-  { cfg: "document", modality: "document" },
-  { cfg: "audio", modality: "audio" },
-  { cfg: "video", modality: "video" },
-];
-
-// Assemble the session's RouteSet: the default route (the already-resolved session
-// model) plus any configured modality/long/fast routes, each tagged with the input
-// modalities its model accepts. Optional routes that fail to resolve are skipped
-// rather than failing the session. For each modality whose route is unset, hybrid
-// auto-detect picks a capable model when the default can't handle that modality.
-function buildRouteSet(
-  config: Config,
-  defaultSpec: string,
-  defaultModel: LanguageModel,
-  defaultCache: boolean,
-): RouteSet {
-  const router = config.router;
-  const tryRoute = (spec?: string): Route | undefined => {
-    if (!spec) return undefined;
-    try {
-      return buildRoute(spec, config);
-    } catch {
-      return undefined; // unconfigured/invalid optional route → ignored
-    }
-  };
-
-  const { provider: defProvider, modelId: defModelId } = parseModelSpec(defaultSpec);
-  const routes: RouteSet = {
-    default: {
-      spec: defaultSpec,
-      model: defaultModel,
-      cacheControl: defaultCache,
-      thinkingBudget: defaultCache ? config.thinkingBudget : undefined,
-      label: shortLabel(defaultSpec),
-      supports: modalitiesFor(defProvider, defModelId),
-    },
-    vision: tryRoute(router?.vision),
-    document: tryRoute(router?.document),
-    audio: tryRoute(router?.audio),
-    video: tryRoute(router?.video),
-    long: tryRoute(router?.long),
-    fast: tryRoute(router?.fast),
-    longThreshold: router?.longThreshold ?? Math.floor((config.contextBudget ?? 120_000) / 2),
-    fastMaxChars: router?.fastMaxChars ?? 280,
-  };
-
-  if (router?.auto ?? true) {
-    for (const { cfg, modality } of MODALITY_ROUTE_KEYS) {
-      if (routes[cfg]) continue; // explicitly configured → leave it
-      if (modelSupports(modality, defProvider, defModelId)) continue; // default handles it
-      const suggestion = suggestModelFor(modality, config);
-      if (suggestion) routes[cfg] = tryRoute(suggestion);
-    }
+    agentDir: AGENT_DIR,
+    model,
+    authStorage,
+    modelRegistry,
+    settingsManager,
+    sessionManager: SessionManager.inMemory(opts.cwd),
+    resourceLoader: loader,
+    ...(opts.customTools ? { customTools: opts.customTools } : {}),
+    ...(opts.tools ? { tools: opts.tools } : {}),
+  } as any);
+
+  const adapter = createEngineEventAdapter();
+
+  function subscribeAsEngineEvents(onEvent: (ev: EngineEvent) => void): () => void {
+    const unsub = session.subscribe((ev: any) => {
+      for (const ee of adapter.toEngineEvents(ev)) onEvent(ee);
+    });
+    return () => unsub?.();
   }
-  return routes;
+
+  return { session, subscribeAsEngineEvents, adapter };
 }