super-dsh 0.1.12 → 0.3.0

package/node_modules/better-dsh/lib/index.js

@@ -0,0 +1,3816 @@
+import { t as Schema } from "./lib-C8_jXvwA.js";
+import { a as RESERVED_ERROR_MEMBERS, i as RESERVED_BINDING_GLOBALS, n as DUNDER_MEMBER, o as ReplRuntime, r as PORTABLE_RESERVED_WORDS, t as isFlatBindableName } from "./py-sdk-D7klhpWb.js";
+import { s as resolveKernelEnv } from "./kernel-env-D8UOWeji.js";
+import { t as captureAllTools } from "./native-capture-BEByDXYM.js";
+import { createRequire } from "node:module";
+import { randomBytes, randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Context } from "@deepseek-ai/cordis";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { createInterface } from "node:readline";
+import { TOOL_RUNTIME_SCHEDULER, defineTool } from "@deepseek-ai/dsh-tools";
+import * as dshLlm from "@deepseek-ai/dsh-llm";
+import { BlockAssembler, HarnessError, createUserMessage } from "@deepseek-ai/dsh-llm";
+import { scopeTarget } from "@deepseek-ai/dsh-scope";
+
+//#region src/snapshot-json.ts
+/** Whether a realm-owned intrinsic prototype is backed by its native constructor. */
+function hasIntrinsicConstructor(prototype, name$1) {
+	const constructor = Object.getOwnPropertyDescriptor(prototype, "constructor")?.value;
+	if (typeof constructor !== "function") return false;
+	try {
+		return constructor.name === name$1 && constructor.prototype === prototype && Function.prototype.toString.call(constructor) === `function ${name$1}() { [native code] }`;
+	} catch {
+		return false;
+	}
+}
+/** Whether a candidate is one realm's intrinsic `Object.prototype`. */
+function isIntrinsicObjectPrototype(value) {
+	return Object.getPrototypeOf(value) === null && hasIntrinsicConstructor(value, "Object");
+}
+/** Whether an array uses one realm's intrinsic `Array.prototype`, not a subclass or forged prototype. */
+function hasPlainArrayPrototype(value) {
+	const prototype = Object.getPrototypeOf(value);
+	if (!Array.isArray(prototype) || !hasIntrinsicConstructor(prototype, "Array")) return false;
+	const objectPrototype = Object.getPrototypeOf(prototype);
+	return typeof objectPrototype === "object" && objectPrototype !== null && isIntrinsicObjectPrototype(objectPrototype);
+}
+/** Whether an object is a plain or null-prototype record from any JavaScript realm. */
+function hasPlainObjectPrototype(value) {
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === null || typeof prototype === "object" && isIntrinsicObjectPrototype(prototype);
+}
+/** Return every JSON-visible object key, or reject own data JSON would discard. */
+function enumerableStringKeys(value) {
+	const keys = Reflect.ownKeys(value);
+	if (keys.some((key) => typeof key !== "string" || !Object.prototype.propertyIsEnumerable.call(value, key))) return void 0;
+	return keys;
+}
+/** Validate lossless JSON iteratively, optionally materializing a detached snapshot. */
+function walkJsonValue(value, detach) {
+	const ancestors = /* @__PURE__ */ new Set();
+	let root;
+	const assign = (destination, item) => {
+		if (destination === void 0) return;
+		if (destination.kind === "root") root = item;
+		else if (destination.kind === "array") destination.target[destination.index] = item;
+		else Object.defineProperty(destination.target, destination.key, {
+			value: item,
+			enumerable: true,
+			configurable: true,
+			writable: true
+		});
+	};
+	const tasks = [{
+		kind: "visit",
+		value,
+		...detach ? { destination: { kind: "root" } } : {}
+	}];
+	for (let task = tasks.pop(); task !== void 0; task = tasks.pop()) {
+		if (task.kind === "leave") {
+			ancestors.delete(task.source);
+			continue;
+		}
+		if (task.kind === "array-item") {
+			if (!Object.prototype.hasOwnProperty.call(task.source, task.index)) return void 0;
+			tasks.push({
+				kind: "visit",
+				value: task.source[task.index],
+				...task.target === void 0 ? {} : { destination: {
+					kind: "array",
+					target: task.target,
+					index: task.index
+				} }
+			});
+			continue;
+		}
+		if (task.kind === "object-property") {
+			tasks.push({
+				kind: "visit",
+				value: task.source[task.key],
+				...task.target === void 0 ? {} : { destination: {
+					kind: "object",
+					target: task.target,
+					key: task.key
+				} }
+			});
+			continue;
+		}
+		const current = task.value;
+		if (current === null) {
+			assign(task.destination, null);
+			continue;
+		}
+		if (typeof current === "boolean" || typeof current === "string") {
+			assign(task.destination, current);
+			continue;
+		}
+		if (typeof current === "number") {
+			if (!Number.isFinite(current) || Object.is(current, -0)) return void 0;
+			assign(task.destination, current);
+			continue;
+		}
+		if (typeof current !== "object") return void 0;
+		if (ancestors.has(current)) return void 0;
+		if (Array.isArray(current)) {
+			if (!hasPlainArrayPrototype(current)) return void 0;
+			const length = current.length;
+			if (Reflect.ownKeys(current).length !== length + 1) return void 0;
+			const target$1 = detach ? [] : void 0;
+			if (target$1 !== void 0) assign(task.destination, target$1);
+			ancestors.add(current);
+			tasks.push({
+				kind: "leave",
+				source: current
+			});
+			for (let index = length - 1; index >= 0; index--) tasks.push({
+				kind: "array-item",
+				source: current,
+				index,
+				...target$1 === void 0 ? {} : { target: target$1 }
+			});
+			continue;
+		}
+		if (!hasPlainObjectPrototype(current)) return void 0;
+		const keys = enumerableStringKeys(current);
+		if (keys === void 0) return void 0;
+		const target = detach ? {} : void 0;
+		if (target !== void 0) assign(task.destination, target);
+		ancestors.add(current);
+		tasks.push({
+			kind: "leave",
+			source: current
+		});
+		for (let index = keys.length - 1; index >= 0; index--) {
+			const key = keys[index];
+			/* v8 ignore next -- the loop is bounded by the captured key count. */
+			if (key === void 0) return void 0;
+			tasks.push({
+				kind: "object-property",
+				source: current,
+				key,
+				...target === void 0 ? {} : { target }
+			});
+		}
+	}
+	return detach ? root : true;
+}
+/**
+* Validate and detach lossless JSON in one read per property, so a stateful
+* getter cannot change between validation and copying. Traversal is iterative,
+* so valid nesting is bounded by available memory rather than the JavaScript
+* call stack. Accepts ordinary arrays, plain or null-prototype objects, and JSON
+* scalars; rejects sparse, cyclic, exotic, negative-zero, and non-finite values.
+* Getter throws propagate.
+*
+* @param value - the candidate value to validate and detach.
+* @returns the detached snapshot, or `undefined` when the value is not
+*   losslessly JSON-serializable.
+*/
+function snapshotJsonValue(value) {
+	return walkJsonValue(value, true);
+}
+
+//#endregion
+//#region src/kernel-transport.ts
+/** The bridge script shipped beside the built entry (`lib/kernel-bridge.py`). */
+const BRIDGE_SCRIPT = fileURLToPath(new URL("./kernel-bridge.py", import.meta.url));
+/**
+* One bridge subprocess speaking JSON lines. Lifecycle is owned by the caller
+* (the kernel bridge registers it as an `ctx.effect`); this type installs no
+* process-level signal handlers.
+*/
+var KernelTransport = class {
+	child;
+	reader;
+	startup = false;
+	closed = false;
+	readySettled = false;
+	readyResolve;
+	readyReject;
+	bridgeStderr = "";
+	handlers = /* @__PURE__ */ new Set();
+	waiters = /* @__PURE__ */ new Set();
+	constructor(options) {
+		this.options = options;
+	}
+	/** Spawn the bridge and resolve once it reports the channels are up. */
+	async start() {
+		if (this.reader !== void 0) return;
+		if (this.closed) throw new Error("kernel transport is closed");
+		const child = spawn(this.options.python, [BRIDGE_SCRIPT, this.options.connectionFile], {
+			...this.options.cwd === void 0 ? {} : { cwd: this.options.cwd },
+			env: {
+				PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin",
+				LANG: "C.UTF-8",
+				HOME: process.env.HOME ?? tmpdir(),
+				PYTHONUNBUFFERED: "1"
+			},
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		this.child = child;
+		this.startup = true;
+		const ready = new Promise((resolve$1, reject) => {
+			this.readyResolve = resolve$1;
+			this.readyReject = reject;
+		});
+		const timer = setTimeout(() => {
+			this.failReady(/* @__PURE__ */ new Error(`kernel bridge did not report ready within ${this.options.readyTimeoutMs}ms; stderr tail:\n${this.stderrTail()}`));
+		}, this.options.readyTimeoutMs);
+		timer.unref?.();
+		child.stderr?.on("data", (buffer) => {
+			this.bridgeStderr += buffer.toString();
+		});
+		child.stdin?.on("error", (error) => {
+			this.bridgeStderr += `stdin error: ${error.code ?? error.message}\n`;
+			this.closed = true;
+			this.failWaiters();
+		});
+		child.stdout?.on("error", (error) => {
+			this.bridgeStderr += `stdout error: ${error.code ?? error.message}\n`;
+		});
+		child.on("error", (error) => {
+			this.bridgeStderr += `spawn error: ${error.message}\n`;
+			this.failReady(/* @__PURE__ */ new Error(`kernel bridge failed to spawn: ${error.message}`));
+			this.failWaiters();
+			this.failExit();
+		});
+		child.on("exit", (code, signal) => {
+			const detail = `kernel bridge exited (code=${String(code)} signal=${String(signal)})`;
+			this.bridgeStderr += `${detail}\n`;
+			this.closed = true;
+			this.failReady(/* @__PURE__ */ new Error(`${detail}; stderr tail:\n${this.stderrTail()}`));
+			this.failWaiters();
+			this.failExit();
+		});
+		if (child.stdout) {
+			this.reader = createInterface({ input: child.stdout });
+			this.reader.on("line", (line) => {
+				this.accept(line);
+			});
+		}
+		try {
+			await ready;
+		} finally {
+			clearTimeout(timer);
+			this.startup = false;
+		}
+	}
+	/** Whether the bridge process is still live. */
+	get alive() {
+		return this.child !== void 0 && this.child.exitCode === null && !this.closed;
+	}
+	/** The bridge's stderr tail, for startup and crash diagnostics. */
+	stderrTail() {
+		return this.bridgeStderr.slice(-1024) || "(empty)";
+	}
+	/** Register a message handler; the returned function removes it. */
+	onMessage(handler) {
+		this.handlers.add(handler);
+		return () => {
+			this.handlers.delete(handler);
+		};
+	}
+	/**
+	* Register a bridge-exit handler; the returned function removes it. A bridge
+	* that dies mid-cell must settle the active execution at once rather than at
+	* the cell budget.
+	*/
+	onExit(handler) {
+		this.exitHandlers.add(handler);
+		return () => {
+			this.exitHandlers.delete(handler);
+		};
+	}
+	exitHandlers = /* @__PURE__ */ new Set();
+	/** Notify exit handlers once per bridge process end. */
+	failExit() {
+		const handlers = [...this.exitHandlers];
+		this.exitHandlers.clear();
+		for (const handler of handlers) handler();
+	}
+	/** Send one message on the shell or control channel. */
+	send(channel, message) {
+		this.writeLine({
+			op: "send",
+			channel,
+			header: message.header,
+			content: message.content
+		});
+	}
+	/** Ask the kernel to interrupt the running cell (control channel). */
+	interrupt() {
+		this.writeLine({ op: "interrupt" });
+	}
+	/** Write one protocol line, refusing instead of throwing when the pipe is gone. */
+	writeLine(payload) {
+		const stdin = this.child?.stdin;
+		if (stdin === null || stdin === void 0 || this.closed || !stdin.writable) throw new Error("kernel bridge is not connected");
+		stdin.write(`${JSON.stringify(payload)}\n`);
+	}
+	/**
+	* Wait for the next message on `channel` matching `match`.
+	* @returns The message, or null when the budget expires or the bridge dies.
+	*/
+	waitFor(channel, match, timeoutMs) {
+		if (this.closed) return Promise.resolve(null);
+		return new Promise((resolve$1) => {
+			const waiter = {
+				channel,
+				match,
+				settle: (message) => {
+					clearTimeout(waiter.timer);
+					this.waiters.delete(waiter);
+					resolve$1(message);
+				},
+				timer: setTimeout(() => {
+					this.waiters.delete(waiter);
+					resolve$1(null);
+				}, timeoutMs)
+			};
+			waiter.timer.unref?.();
+			this.waiters.add(waiter);
+		});
+	}
+	/** Stop the bridge (graceful shutdown note, then kill). */
+	async dispose() {
+		const child = this.child;
+		this.closed = true;
+		this.failWaiters();
+		this.reader?.close();
+		this.reader = void 0;
+		if (child === void 0) return;
+		try {
+			if (child.stdin?.writable === true) child.stdin.write(`${JSON.stringify({ op: "shutdown" })}\n`);
+		} catch {}
+		try {
+			child.stdin?.end();
+		} catch {}
+		if (child.exitCode !== null) return;
+		await new Promise((resolve$1) => {
+			const timer = setTimeout(() => {
+				try {
+					child.kill("SIGKILL");
+				} catch {}
+				resolve$1();
+			}, 500);
+			timer.unref?.();
+			child.once("exit", () => {
+				clearTimeout(timer);
+				resolve$1();
+			});
+		});
+	}
+	failReady(error) {
+		if (this.readySettled) return;
+		this.readySettled = true;
+		this.readyReject?.(error);
+	}
+	failWaiters() {
+		for (const waiter of [...this.waiters]) waiter.settle(null);
+	}
+	/** Route one decoded line; unknown events are ignored. */
+	accept(line) {
+		let event;
+		try {
+			event = JSON.parse(line);
+		} catch {
+			return;
+		}
+		if (event.ev === "ready") {
+			if (!this.readySettled) {
+				this.readySettled = true;
+				this.readyResolve?.();
+			}
+			return;
+		}
+		if (event.ev === "msg") {
+			const channel = event.channel;
+			const raw = event.msg;
+			if (typeof channel !== "string" || raw === void 0 || typeof raw.header !== "object" || raw.header === null) return;
+			const message = {
+				header: raw.header,
+				parent_header: raw.parent_header ?? {},
+				content: raw.content ?? {}
+			};
+			for (const waiter of [...this.waiters]) if (waiter.channel === channel && waiter.match(message)) waiter.settle(message);
+			for (const handler of this.handlers) handler(channel, message);
+			return;
+		}
+		if (event.ev === "fatal") this.bridgeStderr += `fatal: ${String(event.message ?? "unknown")}\n`;
+	}
+};
+
+//#endregion
+//#region src/bootstrap.ts
+/**
+* Python-side bootstrap executed once as an internal cell right after kernel
+* startup. Seeds the user namespace with the host-request comm bridge
+* (`dashr.host` target, the PA `host_request()` pattern), the binding-proxy
+* factories, the typed rejection classes, and the lossless-JSON completion
+* encoder. Names are `_dashr`/`__dashr` prefixed (any case) so they are
+* excluded from namespace snapshots and never leak into user state.
+* @module dashr/bootstrap
+*/
+/** Comm target the kernel-side shim opens for typed host requests. */
+const HOST_COMM_TARGET = "dashr.host";
+/**
+* The bootstrap source. Kept dependency-free apart from `ast`, `asyncio`,
+* `json`, and `comm` (present by construction — it IS the kernel).
+*/
+const KERNEL_BOOTSTRAP = `
+import ast as _dashr_ast
+import json as _dashr_json
+
+
+def _dashr_install_control_comm_handlers():
+    # Host replies arrive as comm_msg on the CONTROL channel while the shell
+    # channel is busy executing our cell; teach the kernel to route them.
+    try:
+        from IPython import get_ipython
+    except Exception:
+        return
+    shell = get_ipython()
+    kernel = getattr(shell, 'kernel', None)
+    comm_manager = getattr(kernel, 'comm_manager', None)
+    control_handlers = getattr(kernel, 'control_handlers', None)
+    if comm_manager is None or not isinstance(control_handlers, dict):
+        return
+    control_handlers.setdefault('comm_msg', comm_manager.comm_msg)
+    control_handlers.setdefault('comm_close', comm_manager.comm_close)
+
+
+def _dashr_install_interrupt():
+    # ipykernel's async-cell SIGINT handling only schedules a callback on the
+    # kernel event loop, and a non-yielding cell ('while True: pass') blocks
+    # that very loop, so the control-channel interrupt can never break it.
+    # SIGALRM is untouched by ipykernel: raising KeyboardInterrupt from its
+    # handler breaks any cell, and the host sends it (after a confirm window,
+    # see the bridge) on timeout/abort. Best effort — where SIGALRM is
+    # unavailable the control-channel interrupt is all there is.
+    #
+    # The busy guard is load-bearing (M3-A, blueprint §5 "SIGALRM-at-idle 双重
+    # 窗口"): a KeyboardInterrupt raised OUTSIDE cell execution — while the
+    # kernel boots, idles between cells, or unwinds a finished one — escapes
+    # the shell's containment and terminates the process cleanly, which used
+    # to kill the kernel deterministically (10/10 same-tick aborts, 40/40
+    # during cold boot; dev/m2a-report.md §5.1). The handler therefore only
+    # raises while a dashr cell is actually executing, tracked by the
+    # module-level _dashr_state dict below and set/cleared by the run/snapshot
+    # cell scaffolds around their whole body. A stray SIGALRM outside that
+    # window is swallowed — the host's force-settle already resolves the run,
+    # and the kernel lives. The dict (not a bare flag) is captured by the
+    # handler closure, so user code rebinding the NAME cannot disarm the
+    # guard; mutating the dict itself stays possible and accepted — this shim
+    # is a capability seam, not a security boundary.
+    try:
+        import signal as _dashr_signal
+
+        def _dashr_on_sigalrm(_signum, _frame):
+            if not _dashr_state['executing']:
+                return
+            raise KeyboardInterrupt
+
+        _dashr_signal.signal(_dashr_signal.SIGALRM, _dashr_on_sigalrm)
+    except (ImportError, AttributeError, OSError, ValueError):
+        pass
+
+
+# The dashr busy-guard flag (see _dashr_install_interrupt): True for the whole
+# duration of a run or snapshot cell — the only window in which a SIGALRM may
+# raise KeyboardInterrupt. Lives at module (user-namespace) level so the cell
+# scaffolds can flip it; excluded from snapshots by the _dashr prefix rule.
+_dashr_state = {'executing': False}
+
+
+_dashr_install_interrupt()
+
+
+class _DashrRejected(Exception):
+    def __init__(self, message):
+        Exception.__init__(self, message)
+
+
+def _dashr_host_request(payload):
+    from comm import create_comm
+    import asyncio
+    _dashr_install_control_comm_handlers()
+    loop = asyncio.get_running_loop()
+    future = loop.create_future()
+    # primary=True publishes comm_open so the host learns this comm_id; the
+    # request itself travels as the first comm_msg.
+    comm = create_comm(target_name=${JSON.stringify(HOST_COMM_TARGET)})
+
+    def _resolve(action):
+        def _apply():
+            if future.done():
+                return
+            action()
+            comm.close()
+        # Replies arrive on the kernel's control channel, which may run off
+        # the event-loop thread; only call_soon_threadsafe may touch the
+        # future from there.
+        loop.call_soon_threadsafe(_apply)
+
+    def _on_msg(msg):
+        content = msg.get('content', {})
+        reply = content.get('data', {}) if isinstance(content, dict) else {}
+        if not isinstance(reply, dict) or future.done():
+            return
+        status = reply.get('status')
+        if status == 'ok':
+            _resolve(lambda: future.set_result(reply.get('result')))
+        elif status == 'error':
+            _resolve(lambda: future.set_exception(_DashrRejected(reply.get('error') or 'host request failed')))
+
+    comm.on_msg(_on_msg)
+    comm.send(dict(payload))
+    return future
+
+
+def _dashr_make_error_class(name, member_property):
+    def _init(self, message, member=None):
+        Exception.__init__(self, message)
+        if member is not None:
+            setattr(self, member_property, member)
+    return type(name, (Exception,), {'__init__': _init})
+
+
+def _dashr_make_proxy(global_name, function_name, error_class_name, member_property):
+    async def _dashr_proxy(*args, **kwargs):
+        if kwargs:
+            raise TypeError('dashr binding calls do not accept keyword arguments')
+        if len(args) == 1:
+            call_args = args[0]
+        elif len(args) == 0:
+            call_args = None
+        else:
+            call_args = list(args)
+        payload = {
+            'type': 'binding.call',
+            'global': global_name,
+            'name': function_name,
+            'args': call_args,
+        }
+        try:
+            return await _dashr_host_request(payload)
+        except _DashrRejected as rejected:
+            cls = globals().get(error_class_name) if error_class_name else None
+            if cls is None:
+                raise
+            raise cls(str(rejected), function_name) from None
+    return _dashr_proxy
+
+
+def _dashr_make_holder(global_name, error_class_name, member_property, members):
+    # Attribute misses travel to the host instead of raising AttributeError
+    # here: the host owns the namespace, so IT rejects an unknown member as an
+    # unknown binding rather than the kernel inventing a local error class.
+    class _DashrBindingHolder:
+        def __dir__(self):
+            # F9 (v0.2.0-a): introspection tells the truth — dir(tool) lists
+            # exactly the bound names. A custom __dir__ fully replaces the
+            # default object.__dir__, so no dunder noise leaks in.
+            return list(members)
+
+        def __getattr__(self, function_name):
+            return _dashr_make_proxy(
+                global_name,
+                function_name,
+                error_class_name,
+                member_property,
+            )
+
+    return _DashrBindingHolder()
+
+
+def _dashr_make_callable(global_name, function_name, error_class_name, member_property):
+    # A BARE callable global (the flat per-tool bindings AND the bridge
+    # tools: 'callable: true' on the namespace) instead of an object
+    # holder. The one-object form is the single convention: every callable
+    # takes exactly one positional arguments object (e.g.
+    # agent_message({'receiver': 'child', ...})), and keyword / multi-positional forms are
+    # rejected HERE, at the Python call boundary, so the introspectable
+    # signature tells the truth and a TypeError names the binding global
+    # (read(...) got an unexpected keyword argument ...). The wire envelope
+    # keeps the historical {'args': [...], 'kwargs': {}} shape so the host's
+    # parseReplCall / flatToolArgs / flatBridgeToolArgs validation layers stay
+    # authoritative and unchanged. The single functions-entry name is
+    # transport-only: the program never sees it, and a typed rejection
+    # carries the GLOBAL name as its member (for a flat tool binding the
+    # global IS the tool name the program knows). __name__/__qualname__ are
+    # pinned to the global name so introspection shows the binding's name,
+    # not the factory-local _dashr_callable.
+    async def _dashr_callable(args=None, /):
+        payload = {
+            'type': 'binding.call',
+            'global': global_name,
+            'name': function_name,
+            'args': {'args': [] if args is None else [args], 'kwargs': {}},
+        }
+        try:
+            return await _dashr_host_request(payload)
+        except _DashrRejected as rejected:
+            cls = globals().get(error_class_name) if error_class_name else None
+            if cls is None:
+                raise
+            raise cls(str(rejected), global_name) from None
+
+    _dashr_callable.__name__ = global_name
+    _dashr_callable.__qualname__ = global_name
+    return _dashr_callable
+
+
+class _DashrNoValue:
+    # Marks 'no completion value': a cell whose last statement is not an
+    # expression, or whose last expression evaluates to None — the REPL
+    # displayhook suppresses None (IPython behavior), so no value crosses.
+    __slots__ = ()
+
+
+_DASHR_NO_VALUE = _DashrNoValue()
+
+
+class _DashrTopLevelReturnChecker(_dashr_ast.NodeVisitor):
+    # A cell runs at module scope, like any native IPython cell: a top-level
+    # 'return'/'yield' is a SyntaxError decided by the kernel itself, exactly
+    # as in a real REPL. Nested scopes (functions, lambdas, classes) keep
+    # their own return semantics.
+    def visit_FunctionDef(self, node):
+        return
+
+    def visit_AsyncFunctionDef(self, node):
+        return
+
+    def visit_ClassDef(self, node):
+        return
+
+    def visit_Lambda(self, node):
+        return
+
+    def visit_Return(self, node):
+        raise SyntaxError("'return' outside function")
+
+    def visit_Yield(self, node):
+        raise SyntaxError("'yield' outside function")
+
+
+async def _dashr_run_program(source):
+    # Run one cell with the user namespace as BOTH globals and locals —
+    # module-scope REPL semantics: state persists across cells, top-level
+    # 'await' is legal (PyCF_ALLOW_TOP_LEVEL_AWAIT, the same mechanism IPython
+    # uses), a top-level 'return'/'yield' is a SyntaxError decided here by the
+    # kernel — exactly as in a native IPython cell — and the last expression's
+    # value is the cell's result (the REPL displayhook handoff).
+    import inspect as _dashr_inspect
+    user_ns = globals()
+    if not source.strip():
+        source = 'pass'
+    parsed = _dashr_ast.parse(source, '<dashr program>', 'exec')
+    _DashrTopLevelReturnChecker().visit(parsed)
+    body = parsed.body
+    if body and isinstance(body[-1], _dashr_ast.Expr):
+        # Capture the last expression the way a REPL's displayhook shows it:
+        # its value feeds the completion envelope instead of being discarded.
+        # The name is distinct from the scaffold's __dashr_completion__ (the
+        # envelope holder) so a statement-ending cell can never pop a stale
+        # envelope left by an earlier run.
+        last = body[-1]
+        body[-1] = _dashr_ast.Assign(
+            targets=[_dashr_ast.Name(id='__dashr_cell_value__', ctx=_dashr_ast.Store())],
+            value=last.value,
+        )
+        _dashr_ast.fix_missing_locations(body[-1])
+    code = compile(
+        parsed,
+        '<dashr program>',
+        'exec',
+        flags=_dashr_ast.PyCF_ALLOW_TOP_LEVEL_AWAIT,
+    )
+    # IPython's own run_code pattern: with PyCF_ALLOW_TOP_LEVEL_AWAIT, plain
+    # exec() DISCARDS the module coroutine silently; eval() under await
+    # returns it and runs the code (IPython InteractiveShell.run_code does
+    # exactly 'await eval(code_obj, user_global_ns, user_ns)').
+    result = eval(code, user_ns, user_ns)
+    if _dashr_inspect.iscoroutine(result):
+        await result
+    value = user_ns.pop('__dashr_cell_value__', _DASHR_NO_VALUE)
+    if value is None:
+        return _DASHR_NO_VALUE
+    return value
+
+
+def _dashr_install_bindings(spec_json):
+    spec = _dashr_json.loads(spec_json)
+    user_ns = globals()
+    injected = user_ns.get('__dashr_injected__', {})
+    for old_name, old_spec in list(injected.items()):
+        if old_name not in spec:
+            user_ns.pop(old_name, None)
+            if old_spec.get('errorClass'):
+                user_ns.pop(old_spec['errorClass']['name'], None)
+    fresh = {}
+    # The flat per-tool shape declares the SAME error class on many
+    # namespaces: materialize each DISTINCT name once, so every proxy's
+    # raise-time globals() lookup finds ONE class and a single
+    # 'except ToolCallError' catches failures from every binding.
+    error_classes = {}
+    for global_name, namespace in spec.items():
+        error_class = namespace.get('errorClass')
+        if namespace.get('callable'):
+            # Exactly one function entry was validated by the host; its key is
+            # the transport name, the bare global itself is the callable.
+            function_name = next(iter(namespace['functions']))
+            user_ns[global_name] = _dashr_make_callable(
+                global_name,
+                function_name,
+                error_class['name'] if error_class else None,
+                error_class['memberNameProperty'] if error_class else None,
+            )
+        else:
+            user_ns[global_name] = _dashr_make_holder(
+                global_name,
+                error_class['name'] if error_class else None,
+                error_class['memberNameProperty'] if error_class else None,
+                sorted(namespace['functions']),
+            )
+        if error_class and error_class['name'] not in error_classes:
+            cls = _dashr_make_error_class(
+                error_class['name'],
+                error_class['memberNameProperty'],
+            )
+            error_classes[error_class['name']] = cls
+            user_ns[error_class['name']] = cls
+        fresh[global_name] = namespace
+    user_ns['__dashr_injected__'] = fresh
+
+
+def _dashr_encode(value):
+    if value is _DASHR_NO_VALUE:
+        return {'ok': True}
+    try:
+        return {'ok': True, 'json': _dashr_json.dumps(value, allow_nan=False)}
+    except (TypeError, ValueError, OverflowError):
+        # Not lossless JSON: pass its repr TEXT through instead of failing
+        # the cell. The upstream renders the tool result as text either way,
+        # so a non-JSON value costs the model nothing; the host keeps a
+        # plain string it forwards untouched. The envelope itself never
+        # fails, so the completion never gate-rejects a return value.
+        return {'ok': True, 'json': _dashr_json.dumps(repr(value))}
+`;
+
+//#endregion
+//#region src/python.ts
+/**
+* Build the single cell for one run.
+* @param program - the model's cell program, executed at module scope.
+* @param specJson - the JSON-encoded {@link NamespaceSpecs} map.
+* @param sentinel - per-run nonce prefix; the envelope line starts with it.
+* @returns the complete cell source.
+*/
+function buildRunCell(program, specJson, sentinel) {
+	return [
+		`_dashr_state['executing'] = True`,
+		`try:`,
+		`    _dashr_install_bindings(${JSON.stringify(specJson)})`,
+		`    __dashr_completion__ = _dashr_encode(await _dashr_run_program(${JSON.stringify(program)}))`,
+		`    print(${JSON.stringify(sentinel)} + _dashr_json.dumps(__dashr_completion__))`,
+		`finally:`,
+		`    _dashr_state['executing'] = False`
+	].join("\n");
+}
+/**
+* Build the internal cell that dumps the user namespace to a dill snapshot and
+* writes a JSON manifest next to it. Only USER state is captured: IPython's
+* own session plumbing (`exit`, `quit`, `get_ipython`, … tracked in the
+* shell's `user_ns_hidden` and still bound to the object IPython installed)
+* reaches unpicklable kernel machinery — e.g. the history manager's
+* sqlite3.Connection — and is never restored as program state anyway. Shim
+* names (any `_dashr`/`__dashr` spelling) are excluded by prefix.
+*
+* Size-cap policy (M3-B, blueprint §8.3): dill cannot report a serialized
+* size before dumping, and a GB-sized `DataFrame` dumped EVERY turn is the IO
+* storm the cap exists to stop. The cell therefore gates in two tiers:
+* first a bounded-depth namespace walk estimates the footprint (counting
+* container lengths and reading `nbytes` / `memory_usage(deep=True)` for
+* numpy/pandas objects — the stated pathological case — so the dump is
+* skipped BEFORE any dill IO), then the actual dump goes to a sibling
+* `.part` file whose true byte size is measured before it replaces the
+* previous good snapshot. Skipped snapshots leave the previous
+* `state.dill` + manifest untouched, so a revive restores the last good turn.
+* @param payloadPath - absolute path for the dill payload.
+* @param manifestPath - absolute path for the JSON manifest.
+* @param spec - turn counter, skills list, and the size cap.
+* @param sentinel - per-cell nonce prefix for the outcome envelope.
+* @returns the complete cell source.
+*/
+function buildSnapshotCell(payloadPath, manifestPath, spec, sentinel) {
+	return [
+		`_dashr_state['executing'] = True`,
+		`try:`,
+		`    import dill as _dashr_dill, json as _dashr_json, platform as _dashr_platform`,
+		`    import os as _dashr_os, sys as _dashr_sys, datetime as _dashr_dt`,
+		`    _dashr_shell = globals().get('get_ipython', lambda: None)()`,
+		`    _dashr_hidden = getattr(_dashr_shell, 'user_ns_hidden', None) or {}`,
+		`    _dashr_user_ns = {`,
+		`        name: value`,
+		`        for name, value in globals().items()`,
+		`        if not name.lower().startswith(('_dashr', '__dashr'))`,
+		`        and (name not in _dashr_hidden or _dashr_hidden[name] is not value)`,
+		`    }`,
+		`    _dashr_cap = ${JSON.stringify(spec.sizeCapBytes)}`,
+		`    def _dashr_estimate(value, depth):`,
+		`        if value is None or isinstance(value, (bool, int, float, complex)):`,
+		`            return 32`,
+		`        if isinstance(value, (str, bytes, bytearray)):`,
+		`            return len(value) + 64`,
+		`        if isinstance(value, (list, tuple, set, frozenset)):`,
+		`            if depth <= 0:`,
+		`                return 4096`,
+		`            return 64 + sum(_dashr_estimate(item, depth - 1) for item in value)`,
+		`        if isinstance(value, dict):`,
+		`            if depth <= 0:`,
+		`                return 4096`,
+		`            total = 64`,
+		`            for key, item in value.items():`,
+		`                total += _dashr_estimate(key, depth - 1)`,
+		`                total += _dashr_estimate(item, depth - 1)`,
+		`                if total > _dashr_cap:`,
+		`                    return total`,
+		`            return total`,
+		`        _dashr_nbytes = getattr(value, 'nbytes', None)`,
+		`        if isinstance(_dashr_nbytes, int) and _dashr_nbytes > 0:`,
+		`            return _dashr_nbytes + 128`,
+		`        _dashr_mem = getattr(value, 'memory_usage', None)`,
+		`        if callable(_dashr_mem):`,
+		`            try:`,
+		`                _dashr_usage = _dashr_mem(deep=True)`,
+		`                _dashr_sum = getattr(_dashr_usage, 'sum', None)`,
+		`                if callable(_dashr_sum):`,
+		`                    # pandas returns a numpy scalar (np.int64), which is`,
+		`                    # not a Python int subclass; coerce, don't isinstance.`,
+		`                    _dashr_n = int(_dashr_sum())`,
+		`                    if _dashr_n > 0:`,
+		`                        return _dashr_n + 128`,
+		`            except Exception:`,
+		`                pass`,
+		`        return 4096`,
+		`    _dashr_estimate_bytes = sum(_dashr_estimate(value, 4) for value in _dashr_user_ns.values())`,
+		`    if _dashr_estimate_bytes > _dashr_cap:`,
+		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({`,
+		`            'ok': False, 'skipped': True, 'reason': 'estimate',`,
+		`            'estimateBytes': _dashr_estimate_bytes, 'capBytes': _dashr_cap,`,
+		`        }))`,
+		`    else:`,
+		`        _dashr_part = ${JSON.stringify(payloadPath)} + '.part'`,
+		`        try:`,
+		`            with open(_dashr_part, 'wb') as _dashr_f:`,
+		`                _dashr_dill.dump(_dashr_user_ns, _dashr_f)`,
+		`            _dashr_size = _dashr_os.path.getsize(_dashr_part)`,
+		`            if _dashr_size > _dashr_cap:`,
+		`                print(${JSON.stringify(sentinel)} + _dashr_json.dumps({`,
+		`                    'ok': False, 'skipped': True, 'reason': 'actual',`,
+		`                    'sizeBytes': _dashr_size, 'capBytes': _dashr_cap,`,
+		`                }))`,
+		`            else:`,
+		`                _dashr_os.replace(_dashr_part, ${JSON.stringify(payloadPath)})`,
+		`                _dashr_manifest = {`,
+		`                    'snapshotFormat': 1,`,
+		`                    'turn': ${JSON.stringify(spec.turn)},`,
+		`                    'pythonVersion': _dashr_platform.python_version(),`,
+		`                    'venvPath': _dashr_sys.executable,`,
+		`                    'skills': ${JSON.stringify(spec.skills)},`,
+		`                    'names': sorted(_dashr_user_ns),`,
+		`                    'sizeBytes': _dashr_size,`,
+		`                    'skipped': False,`,
+		`                    'createdAt': _dashr_dt.datetime.now(_dashr_dt.timezone.utc).isoformat(),`,
+		`                }`,
+		`                with open(${JSON.stringify(manifestPath)}, 'w', encoding='utf-8') as _dashr_f:`,
+		`                    _dashr_json.dump(_dashr_manifest, _dashr_f)`,
+		`                print(${JSON.stringify(sentinel)} + _dashr_json.dumps({`,
+		`                    'ok': True, 'sizeBytes': _dashr_size, 'names': len(_dashr_user_ns),`,
+		`                }))`,
+		`        finally:`,
+		`            if _dashr_os.path.exists(_dashr_part):`,
+		`                try:`,
+		`                    _dashr_os.unlink(_dashr_part)`,
+		`                except OSError:`,
+		`                    pass`,
+		`finally:`,
+		`    _dashr_state['executing'] = False`
+	].join("\n");
+}
+/**
+* Build the internal cell that restores a dill snapshot into the user
+* namespace. The kernel validates the manifest ITSELF (it is the only party
+* that knows its own python version and `sys.executable`): a python-version
+* mismatch, a different interpreter (`venvPath`), a non-empty skills list, or
+* an unreadable/corrupt payload degrades to an empty namespace WITHOUT
+* touching globals, and reports the reason through the envelope so the host
+* can tell the model "snapshot not replayable, started from empty". Shim and
+* IPython-hidden names are re-filtered on the way in — the same exclusion the
+* snapshot applied on the way out, applied again defensively.
+* @param payloadPath - absolute path of the dill payload.
+* @param manifestPath - absolute path of the JSON manifest.
+* @param sentinel - per-cell nonce prefix for the outcome envelope.
+* @returns the complete cell source.
+*/
+function buildRestoreCell(payloadPath, manifestPath, sentinel) {
+	return [
+		`_dashr_state['executing'] = True`,
+		`try:`,
+		`    import dill as _dashr_dill, json as _dashr_json, platform as _dashr_platform`,
+		`    import os as _dashr_os, sys as _dashr_sys`,
+		`    _dashr_manifest = None`,
+		`    _dashr_reason = 'snapshot manifest could not be read'`,
+		`    try:`,
+		`        with open(${JSON.stringify(manifestPath)}, 'r', encoding='utf-8') as _dashr_f:`,
+		`            _dashr_manifest = _dashr_json.load(_dashr_f)`,
+		`    except Exception as _dashr_err:`,
+		`        _dashr_reason = 'snapshot manifest could not be read: ' + repr(_dashr_err)`,
+		`    if _dashr_manifest is None:`,
+		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': _dashr_reason}))`,
+		`    elif _dashr_manifest.get('snapshotFormat') != 1:`,
+		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'snapshot format is not replayable'}))`,
+		`    elif _dashr_manifest.get('skipped'):`,
+		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'snapshot was skipped (namespace exceeded the size cap)'}))`,
+		`    elif _dashr_manifest.get('pythonVersion') != _dashr_platform.python_version():`,
+		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'python version mismatch: snapshot ' + str(_dashr_manifest.get('pythonVersion')) + ' vs kernel ' + _dashr_platform.python_version()}))`,
+		`    elif _dashr_os.path.realpath(_dashr_manifest.get('venvPath') or '') != _dashr_os.path.realpath(_dashr_sys.executable):`,
+		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'kernel interpreter differs from the snapshot venv'}))`,
+		`    elif _dashr_manifest.get('skills'):`,
+		`        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': 'snapshot skills are not replayable in this provider'}))`,
+		`    else:`,
+		`        try:`,
+		`            with open(${JSON.stringify(payloadPath)}, 'rb') as _dashr_f:`,
+		`                _dashr_restored = _dashr_dill.load(_dashr_f)`,
+		`        except Exception as _dashr_err:`,
+		`            _dashr_restored = None`,
+		`            _dashr_reason = 'snapshot payload could not be loaded: ' + repr(_dashr_err)`,
+		`        if not isinstance(_dashr_restored, dict):`,
+		`            print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': False, 'reason': _dashr_reason if _dashr_restored is None else 'snapshot payload is not a namespace dict'}))`,
+		`        else:`,
+		`            _dashr_shell = globals().get('get_ipython', lambda: None)()`,
+		`            _dashr_hidden = getattr(_dashr_shell, 'user_ns_hidden', None) or {}`,
+		`            _dashr_user_ns = globals()`,
+		`            _dashr_restored_count = 0`,
+		`            for _dashr_name, _dashr_value in _dashr_restored.items():`,
+		`                if not isinstance(_dashr_name, str):`,
+		`                    continue`,
+		`                if _dashr_name.lower().startswith(('_dashr', '__dashr')):`,
+		`                    continue`,
+		`                if _dashr_name in _dashr_hidden and _dashr_hidden[_dashr_name] is _dashr_value:`,
+		`                    continue`,
+		`                _dashr_user_ns[_dashr_name] = _dashr_value`,
+		`                _dashr_restored_count += 1`,
+		`            print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'restored': _dashr_restored_count}))`,
+		`finally:`,
+		`    _dashr_state['executing'] = False`
+	].join("\n");
+}
+/**
+* Build the internal cell that reads ONE user-namespace variable by name, or
+* — when `name` is `null` — lists the namespace's user-variable names. The
+* same exclusion the snapshot applies on the way out (any `_dashr`/`__dashr`
+* spelling plus IPython's `user_ns_hidden`) defines what "user variable"
+* means here, so `ctx://` sees exactly the namespace a revive would restore.
+*
+* Serialization boundary (design.md D4): a value that survives
+* `json.dumps(…, allow_nan=False)` crosses as `kind: 'json'` text; anything
+* else falls back to `repr` text (`kind: 'repr'`) so a non-JSON variable
+* (the reason the snapshot uses dill at all) is still readable as text. The
+* host keeps the `kind` so the presentation can annotate a repr as "this is
+* repr text, not a JSON value".
+* @param name - the exact variable name, or `null` to list namespace names.
+* @param sentinel - per-cell nonce prefix for the outcome envelope.
+* @returns the complete cell source.
+*/
+function buildQueryVarCell(name$1, sentinel) {
+	const lines = [
+		`_dashr_state['executing'] = True`,
+		`try:`,
+		`    import json as _dashr_json`,
+		`    _dashr_shell = globals().get('get_ipython', lambda: None)()`,
+		`    _dashr_hidden = getattr(_dashr_shell, 'user_ns_hidden', None) or {}`,
+		`    _dashr_user_ns = {`,
+		`        _name: _value`,
+		`        for _name, _value in globals().items()`,
+		`        if not _name.lower().startswith(('_dashr', '__dashr'))`,
+		`        and (_name not in _dashr_hidden or _dashr_hidden[_name] is not _value)`,
+		`    }`
+	];
+	if (name$1 === null) lines.push(`    print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'kind': 'names', 'names': sorted(_dashr_user_ns)}))`);
+	else lines.push(`    _dashr_name = ${JSON.stringify(name$1)}`, `    if _dashr_name not in _dashr_user_ns:`, `        print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'kind': 'missing'}))`, `    else:`, `        _dashr_value = _dashr_user_ns[_dashr_name]`, `        try:`, `            _dashr_text = _dashr_json.dumps(_dashr_value, allow_nan=False)`, `            print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'kind': 'json', 'text': _dashr_text}))`, `        except (TypeError, ValueError, OverflowError):`, `            print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True, 'kind': 'repr', 'text': repr(_dashr_value)}))`);
+	lines.push(`finally:`, `    _dashr_state['executing'] = False`);
+	return lines.join("\n");
+}
+/**
+* Build the internal cell that assigns one JSON value into the user
+* namespace under `name`. The value is carried as pre-serialized JSON text
+* (the host validated it as lossless JSON and the name as a usable
+* identifier), so the cell only decodes and binds — no arbitrary object can
+* cross the wire. Bracketed by the same SIGALRM busy guard as a run cell.
+* @param name - the validated identifier to assign under.
+* @param valueJson - the lossless-JSON text to decode and bind.
+* @param sentinel - per-cell nonce prefix for the outcome envelope.
+* @returns the complete cell source.
+*/
+function buildSetVarCell(name$1, valueJson, sentinel) {
+	return [
+		`_dashr_state['executing'] = True`,
+		`try:`,
+		`    import json as _dashr_json`,
+		`    _dashr_value = _dashr_json.loads(${JSON.stringify(valueJson)})`,
+		`    globals()[${JSON.stringify(name$1)}] = _dashr_value`,
+		`    print(${JSON.stringify(sentinel)} + _dashr_json.dumps({'ok': True}))`,
+		`finally:`,
+		`    _dashr_state['executing'] = False`
+	].join("\n");
+}
+
+//#endregion
+//#region src/output.ts
+/** ANSI color escapes, which ipykernel embeds in published tracebacks. */
+const ANSI_ESCAPE = /\x1b\[[0-9;]*[A-Za-z]/g;
+/** Smallest cap that can represent an empty logs array plus a quoted message. */
+const MIN_OUTPUT_BYTES = 4;
+/**
+* Split captured stream text into log lines and the completion envelope.
+* Tolerates a sentinel that landed mid-line after an emission without a
+* trailing newline (the prefix stays in the logs).
+* @param streamText - concatenated iopub stream text for one cell.
+* @param sentinel - per-run nonce prefix of the envelope line.
+*/
+function extractStream(streamText, sentinel) {
+	const logs = [];
+	let envelope;
+	for (const line of streamText.split("\n")) {
+		const at = line.indexOf(sentinel);
+		if (at === -1) {
+			logs.push(line);
+			continue;
+		}
+		if (at > 0) logs.push(line.slice(0, at));
+		envelope = line.slice(at + sentinel.length);
+	}
+	if (logs.length > 0 && logs.at(-1) === "") logs.pop();
+	return {
+		logs,
+		envelope: envelope === "" ? void 0 : envelope
+	};
+}
+/** Strip ANSI escapes from an ipykernel traceback for a model-facing message. */
+function plainTraceback(ename, evalue, traceback) {
+	const body = traceback.map((line) => line.replace(ANSI_ESCAPE, "")).join("\n");
+	return body.length > 0 ? `${ename}: ${evalue}\n${body}` : `${ename}: ${evalue}`;
+}
+function byteLength(text) {
+	return Buffer.byteLength(text, "utf8");
+}
+/** Serialized size of the counted payloads: logs array, value, failure message. */
+function payloadBytes(logs, value, errorMessage) {
+	let total = 2;
+	for (const [i, text] of logs.entries()) total += (i > 0 ? 1 : 0) + byteLength(JSON.stringify(text));
+	if (value !== void 0) total += byteLength(JSON.stringify(value));
+	if (errorMessage !== void 0) total += byteLength(JSON.stringify(errorMessage));
+	return total;
+}
+/**
+* Apply the outer-output ledger: admit the result when the combined serialized
+* payloads fit, otherwise retain a fitting log prefix and report an explicit
+* `output-limit` failure. Conservative accounting — it may underuse the cap,
+* never exceed it.
+* @param logs - captured emission lines.
+* @param value - the completion value, when one crossed the JSON boundary.
+* @param error - the failure, when the run failed.
+* @param maxBytes - the configured cap for the combined counted payloads.
+*/
+function finalizeOutput(logs, value, error, maxBytes) {
+	if (payloadBytes(logs, value, error?.message) <= maxBytes) return {
+		logs,
+		...value !== void 0 ? { value } : {},
+		...error ? { error } : {}
+	};
+	const limitMessage = `outer output exceeded ${maxBytes} bytes`;
+	const messageBytes = byteLength(JSON.stringify(limitMessage)) + 4;
+	const budget = Math.max(0, maxBytes - 2 - messageBytes);
+	const retained = [];
+	let used = 0;
+	for (const text of logs) {
+		const serialized = byteLength(JSON.stringify(text));
+		const separator = retained.length > 0 ? 1 : 0;
+		if (used + separator + serialized > budget) break;
+		retained.push(text);
+		used += separator + serialized;
+	}
+	return {
+		logs: retained,
+		error: {
+			kind: "output-limit",
+			message: limitMessage
+		}
+	};
+}
+
+//#endregion
+//#region src/kernel.ts
+const PROTOCOL_VERSION = "5.3";
+/** Loopback PUB/SUB subscription propagation guard before the first execute. */
+const IOPUB_SUBSCRIBE_DELAY_MS = 50;
+const CONNECT_POLL_MS = 25;
+const SHUTDOWN_DRAIN_MS = 200;
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function buildMessage(msgType, content, session, username) {
+	return {
+		header: {
+			msg_id: randomUUID(),
+			session,
+			username,
+			date: (/* @__PURE__ */ new Date()).toISOString(),
+			msg_type: msgType,
+			version: PROTOCOL_VERSION
+		},
+		parent_header: {},
+		content
+	};
+}
+function makeConnection() {
+	const info = {
+		ip: "127.0.0.1",
+		transport: "tcp",
+		shell_port: 0,
+		iopub_port: 0,
+		stdin_port: 0,
+		control_port: 0,
+		hb_port: 0,
+		signature_scheme: "hmac-sha256",
+		key: randomBytes(16).toString("hex"),
+		kernel_name: "python3"
+	};
+	const tempDir = mkdtempSync(join(tmpdir(), "dashr-kernel-"));
+	const path$1 = join(tempDir, "connection.json");
+	writeFileSync(path$1, JSON.stringify(info, null, 2), { mode: 384 });
+	return {
+		path: path$1,
+		tempDir
+	};
+}
+function readResolvedConnection(path$1) {
+	try {
+		const parsed = JSON.parse(readFileSync(path$1, "utf8"));
+		if (!isRecord(parsed) || parsed.ip !== "127.0.0.1" || parsed.transport !== "tcp" || parsed.signature_scheme !== "hmac-sha256" || typeof parsed.key !== "string") return null;
+		for (const port of [
+			"shell_port",
+			"iopub_port",
+			"stdin_port",
+			"control_port",
+			"hb_port"
+		]) {
+			const value = parsed[port];
+			if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) return null;
+		}
+		return parsed;
+	} catch {
+		return null;
+	}
+}
+/**
+* One persistent IPython kernel subprocess with its ZeroMQ channels. Cell
+* execution is serialized on an internal queue (the Jupyter shell channel is
+* request/reply).
+*/
+var IpyKernelBridge = class {
+	session = randomUUID();
+	state = "idle";
+	startPromise;
+	kernel;
+	transport;
+	connection;
+	tempDir;
+	kernelStderr = "";
+	executionQueue = Promise.resolve();
+	activeExec;
+	commTargets = /* @__PURE__ */ new Map();
+	servedComms = /* @__PURE__ */ new Set();
+	constructor(options) {
+		this.options = options;
+	}
+	/** The kernel subprocess pid, for lifecycle assertions; absent before spawn. */
+	get pid() {
+		return this.kernel?.pid;
+	}
+	get isRunning() {
+		return this.state === "running";
+	}
+	/**
+	* Whether the subprocess is gone (crashed or disposed). A dead bridge is
+	* never resurrected — the owning provider replaces it with a fresh one
+	* (respawn, M3-A), because kernel state is unrecoverable in-process.
+	*/
+	get isDead() {
+		return this.state === "shutdown";
+	}
+	/**
+	* Start the kernel (idempotent; concurrent callers share one startup).
+	* @throws when the subprocess cannot spawn, ports never resolve, the
+	*   kernel_info probe times out, or the bootstrap cell fails.
+	*/
+	async start() {
+		if (!this.startPromise) this.startPromise = this.doStart().catch((error) => {
+			this.startPromise = void 0;
+			throw error;
+		});
+		return this.startPromise;
+	}
+	stderrTail() {
+		return this.kernelStderr.slice(-1024) || "(empty)";
+	}
+	async doStart() {
+		if (this.state !== "idle") return;
+		this.state = "starting";
+		const { path: path$1, tempDir } = makeConnection();
+		this.tempDir = tempDir;
+		const kernel = spawn(this.options.python, [
+			"-m",
+			"ipykernel_launcher",
+			"-f",
+			path$1
+		], {
+			cwd: this.options.cwd,
+			env: {
+				PATH: process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin",
+				LANG: "C.UTF-8",
+				HOME: process.env.HOME ?? tmpdir()
+			},
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		this.kernel = kernel;
+		kernel.stderr?.on("data", (buf) => {
+			this.kernelStderr += buf.toString();
+		});
+		kernel.on("error", (error) => {
+			this.kernelStderr += `spawn error: ${error.message}\n`;
+			this.onKernelDeath();
+		});
+		kernel.on("exit", (code, signal) => {
+			if (this.state !== "shutdown") this.kernelStderr += `unexpected exit code=${code} signal=${signal}\n`;
+			this.onKernelDeath();
+		});
+		let conn;
+		try {
+			conn = await this.waitForConnection(path$1);
+			this.connection = conn;
+		} catch (error) {
+			this.cleanupResources();
+			this.state = "idle";
+			throw error;
+		}
+		const transport = new KernelTransport({
+			python: this.options.python,
+			connectionFile: path$1,
+			...this.options.cwd === void 0 ? {} : { cwd: this.options.cwd },
+			readyTimeoutMs: this.options.startupTimeoutMs
+		});
+		this.transport = transport;
+		transport.onMessage((channel, message) => {
+			this.handleTransportMessage(channel, message);
+		});
+		transport.onExit(() => {
+			if (this.state !== "shutdown") this.forceSettleActive({
+				kind: "worker-exit",
+				message: `kernel bridge died. stderr tail:\n${transport.stderrTail()}`
+			});
+		});
+		try {
+			await transport.start();
+		} catch (error) {
+			this.cleanupResources();
+			this.state = "idle";
+			throw error;
+		}
+		await setTimeout$1(IOPUB_SUBSCRIBE_DELAY_MS);
+		try {
+			await this.probeReady();
+		} catch (error) {
+			this.cleanupResources();
+			this.state = "idle";
+			throw error;
+		}
+		const bootstrap = await this.executeCell(KERNEL_BOOTSTRAP, {
+			timeoutMs: this.options.startupTimeoutMs,
+			interruptGraceMs: 1e3,
+			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
+		});
+		if (bootstrap.outcome !== "completed" || bootstrap.status !== "ok") {
+			const detail = bootstrap.outcome === "completed" && bootstrap.cellError ? `${bootstrap.cellError.ename}: ${bootstrap.cellError.evalue}` : "bootstrap cell failed";
+			this.cleanupResources();
+			this.state = "idle";
+			throw new Error(`dashr kernel bootstrap failed: ${detail}`);
+		}
+		this.state = "running";
+	}
+	async waitForConnection(path$1) {
+		const deadline = Date.now() + this.options.startupTimeoutMs;
+		while (Date.now() < deadline) {
+			if (this.state === "shutdown") throw new Error(`kernel exited before resolving ports. stderr:\n${this.stderrTail()}`);
+			const info = readResolvedConnection(path$1);
+			if (info) return info;
+			await setTimeout$1(CONNECT_POLL_MS);
+		}
+		throw new Error(`kernel did not resolve connection ports within ${this.options.startupTimeoutMs}ms. stderr tail:\n${this.stderrTail()}`);
+	}
+	async probeReady() {
+		const transport = this.transport;
+		if (!transport) throw new Error("kernel channels are not connected");
+		const msg = buildMessage("kernel_info_request", {}, this.session, this.options.username);
+		const requestMsgId = msg.header.msg_id;
+		transport.send("shell", msg);
+		if (await transport.waitFor("shell", (incoming) => incoming.header.msg_type === "kernel_info_reply" && incoming.parent_header.msg_id === requestMsgId, this.options.startupTimeoutMs)) return;
+		const bridgeTail = transport.stderrTail();
+		if (this.state === "shutdown") throw new Error(`kernel exited during startup. kernel stderr:\n${this.stderrTail()}\nbridge stderr:\n${bridgeTail}`);
+		throw new Error(`kernel did not answer kernel_info_request within ${this.options.startupTimeoutMs}ms. kernel stderr:\n${this.stderrTail()}\nbridge stderr:\n${bridgeTail}`);
+	}
+	/**
+	* Execute one cell on the persistent kernel, serialized against all other
+	* executions. Resolves with the cell's outcome — never rejects for
+	* cell-level failures (program errors, timeouts, aborts, kernel death).
+	* @param code - complete cell source.
+	* @param opts - budgets, abort signal, and the host-request dispatcher.
+	*/
+	async executeCell(code, opts) {
+		const prev = this.executionQueue;
+		let releaseQueue;
+		this.executionQueue = new Promise((resolve$1) => {
+			releaseQueue = resolve$1;
+		});
+		await prev;
+		try {
+			if (this.state === "shutdown" || this.state === "idle") return {
+				outcome: "forced",
+				failure: {
+					kind: "worker-exit",
+					message: "kernel has been shut down"
+				},
+				streamText: ""
+			};
+			return await this.executeInner(code, opts);
+		} finally {
+			releaseQueue();
+		}
+	}
+	executeInner(code, opts) {
+		const transport = this.transport;
+		if (!transport) return Promise.resolve({
+			outcome: "forced",
+			failure: {
+				kind: "worker-exit",
+				message: "kernel channels are not connected"
+			},
+			streamText: ""
+		});
+		const msg = buildMessage("execute_request", {
+			code,
+			silent: false,
+			store_history: false,
+			user_expressions: {},
+			allow_stdin: false,
+			stop_on_error: true
+		}, this.session, this.options.username);
+		return new Promise((resolve$1) => {
+			const execution = {
+				requestMsgId: msg.header.msg_id,
+				opts,
+				streamText: "",
+				status: "ok",
+				settled: false,
+				resolve: resolve$1
+			};
+			this.activeExec = execution;
+			const settle = (outcome) => {
+				if (execution.settled) return;
+				execution.settled = true;
+				if (execution.forceTimer) clearTimeout(execution.forceTimer);
+				if (execution.timeoutTimer) clearTimeout(execution.timeoutTimer);
+				if (execution.alarmTimer) clearTimeout(execution.alarmTimer);
+				execution.detachSignal?.();
+				if (this.activeExec === execution) this.activeExec = void 0;
+				resolve$1(outcome);
+			};
+			const interruptAndForce = (failure) => {
+				if (this.activeExec !== execution) return;
+				if (execution.pendingForce === void 0) execution.pendingForce = failure;
+				this.sendInterrupt(execution);
+				execution.forceTimer = setTimeout(() => {
+					settle({
+						outcome: "forced",
+						failure,
+						streamText: execution.streamText
+					});
+				}, opts.interruptGraceMs);
+				execution.forceTimer.unref?.();
+			};
+			const onAbort = () => {
+				interruptAndForce({
+					kind: "abort",
+					message: String(opts.signal?.reason)
+				});
+			};
+			execution.timeoutTimer = setTimeout(() => {
+				interruptAndForce({
+					kind: "timeout",
+					message: `cell exceeded ${opts.timeoutMs}ms wall budget`
+				});
+			}, opts.timeoutMs);
+			execution.timeoutTimer.unref?.();
+			opts.signal?.addEventListener("abort", onAbort, { once: true });
+			execution.detachSignal = () => opts.signal?.removeEventListener("abort", onAbort);
+			if (opts.signal?.aborted) onAbort();
+			try {
+				transport.send("shell", msg);
+			} catch {
+				settle({
+					outcome: "forced",
+					failure: {
+						kind: "worker-exit",
+						message: "shell channel send failed"
+					},
+					streamText: execution.streamText
+				});
+			}
+		});
+	}
+	/**
+	* Route one relayed message. Only iopub drives executions and comms; shell
+	* replies serve the startup probe (via `waitFor`), and control is inbound
+	* for host replies.
+	*/
+	handleTransportMessage(channel, incoming) {
+		if (channel !== "iopub") return;
+		const msgType = incoming.header.msg_type;
+		if (msgType === "comm_open" || msgType === "comm_msg" || msgType === "comm_close") {
+			this.handleCommMessage(incoming);
+			return;
+		}
+		this.handleExecutionMessage(incoming);
+	}
+	forceSettleActive(failure) {
+		const execution = this.activeExec;
+		if (!execution || execution.settled) return;
+		execution.settled = true;
+		if (execution.forceTimer) clearTimeout(execution.forceTimer);
+		if (execution.timeoutTimer) clearTimeout(execution.timeoutTimer);
+		if (execution.alarmTimer) clearTimeout(execution.alarmTimer);
+		execution.detachSignal?.();
+		this.activeExec = void 0;
+		execution.resolve({
+			outcome: "forced",
+			failure,
+			streamText: execution.streamText
+		});
+	}
+	handleExecutionMessage(incoming) {
+		const execution = this.activeExec;
+		if (!execution || execution.settled) return;
+		if (incoming.parent_header.msg_id !== execution.requestMsgId) return;
+		const msgType = incoming.header.msg_type;
+		if (msgType === "stream") {
+			const content = incoming.content;
+			if (typeof content.text === "string") execution.streamText += content.text;
+		} else if (msgType === "error") {
+			const content = incoming.content;
+			execution.cellError = {
+				ename: typeof content.ename === "string" ? content.ename : "Error",
+				evalue: typeof content.evalue === "string" ? content.evalue : "",
+				traceback: Array.isArray(content.traceback) ? content.traceback : []
+			};
+			execution.status = "error";
+		} else if (msgType === "status") {
+			if (incoming.content.execution_state === "idle") this.settleCompleted(execution);
+		}
+	}
+	settleCompleted(execution) {
+		if (execution.settled) return;
+		execution.settled = true;
+		if (execution.forceTimer) clearTimeout(execution.forceTimer);
+		if (execution.timeoutTimer) clearTimeout(execution.timeoutTimer);
+		if (execution.alarmTimer) clearTimeout(execution.alarmTimer);
+		execution.detachSignal?.();
+		if (this.activeExec === execution) this.activeExec = void 0;
+		if (execution.pendingForce !== void 0) {
+			execution.resolve({
+				outcome: "forced",
+				failure: execution.pendingForce,
+				streamText: execution.streamText
+			});
+			return;
+		}
+		execution.resolve({
+			outcome: "completed",
+			status: execution.status,
+			streamText: execution.streamText,
+			...execution.cellError ? { cellError: execution.cellError } : {}
+		});
+	}
+	handleCommMessage(incoming) {
+		const content = incoming.content;
+		const commId = content.comm_id;
+		if (typeof commId !== "string") return;
+		const msgType = incoming.header.msg_type;
+		if (msgType === "comm_close") {
+			this.commTargets.delete(commId);
+			this.servedComms.delete(commId);
+			return;
+		}
+		if (msgType === "comm_open") {
+			const targetName = content.target_name;
+			if (typeof targetName === "string") this.commTargets.set(commId, targetName);
+			return;
+		}
+		if (msgType === "comm_msg" && this.commTargets.get(commId) === HOST_COMM_TARGET) this.serveHostRequest(commId, content.data);
+	}
+	serveHostRequest(commId, data) {
+		if (this.servedComms.has(commId)) return;
+		this.servedComms.add(commId);
+		const handler = this.activeExec?.opts.hostRequestHandler;
+		if (!handler) {
+			this.replyComm(commId, {
+				status: "error",
+				error: "no host request handler is active"
+			}).catch(() => void 0);
+			return;
+		}
+		if (!isRecord(data)) {
+			this.replyComm(commId, {
+				status: "error",
+				error: "host request payload must be an object"
+			}).catch(() => void 0);
+			return;
+		}
+		(async () => {
+			try {
+				const outcome = await handler(data);
+				if (outcome.ok) await this.replyComm(commId, {
+					status: "ok",
+					result: outcome.result
+				});
+				else await this.replyComm(commId, {
+					status: "error",
+					error: outcome.message
+				});
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				await this.replyComm(commId, {
+					status: "error",
+					error: message
+				}).catch(() => void 0);
+			}
+		})().catch(() => void 0);
+	}
+	async replyComm(commId, data) {
+		const transport = this.transport;
+		if (!transport) throw new Error("kernel channels are not connected");
+		transport.send("control", buildMessage("comm_msg", {
+			comm_id: commId,
+			data
+		}, this.session, this.options.username));
+	}
+	/**
+	* Phase one NOW, phase two on a timer: send the control-channel interrupt,
+	* then — after the confirm window, and only if the execution has still not
+	* settled — escalate to SIGALRM. The zmq interrupt only lands when the cell
+	* yields to the kernel event loop; a busy sync cell ('while True: pass')
+	* never does, which is why the escalation exists at all. Sending both
+	* channels in the same tick (the M1 design) made SIGALRM the FIRST signal
+	* an idle-or-booting kernel saw on timeout/abort: its handler raised
+	* KeyboardInterrupt at the top level and the process exited cleanly — a
+	* deterministic kill (10/10 same-tick aborts, 8/10 at +1-2ms, 40/40 during
+	* cold boot; dev/m2a-report.md §5.1). Two-phase escalation plus the
+	* kernel-side busy guard closes that window while keeping the hard-abort
+	* contract: a busy loop still breaks, one confirm window later.
+	*/
+	async sendInterrupt(execution) {
+		const transport = this.transport;
+		if (!transport) return;
+		try {
+			transport.interrupt();
+		} catch {}
+		execution.alarmTimer = setTimeout(() => {
+			if (execution.settled) return;
+			if (this.kernel?.exitCode === null) try {
+				this.kernel.kill("SIGALRM");
+			} catch {}
+		}, execution.opts.interruptConfirmMs);
+		execution.alarmTimer.unref?.();
+	}
+	/**
+	* Snapshot the user namespace via an internal dill cell. Requires `dill` in
+	* the kernel environment. The cell reports its outcome through a nonce
+	* envelope (skipped-for-size vs written); a failed/skipped dump NEVER
+	* replaces a previous good snapshot on disk.
+	* @param payloadPath - dill payload destination.
+	* @param manifestPath - JSON manifest destination (turn, names, python
+	*   version, venv path, skills, size).
+	* @param spec - turn counter, skills list, and the size cap.
+	*/
+	async snapshotState(payloadPath, manifestPath, spec) {
+		if (!this.isRunning) return {
+			kind: "failed",
+			reason: "kernel is not running"
+		};
+		const sentinel = `__dashr_snapshot_${randomBytes(9).toString("hex")}__`;
+		const outcome = await this.executeCell(buildSnapshotCell(payloadPath, manifestPath, spec, sentinel), {
+			timeoutMs: this.options.snapshotTimeoutMs,
+			interruptGraceMs: 1e3,
+			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
+		});
+		if (outcome.outcome !== "completed" || outcome.status !== "ok") return {
+			kind: "failed",
+			reason: "snapshot cell failed"
+		};
+		return this.parseSnapshotEnvelope(outcome.streamText, sentinel);
+	}
+	/** Parse one snapshot cell's nonce envelope into its outcome. */
+	parseSnapshotEnvelope(streamText, sentinel) {
+		const capture = extractStream(streamText, sentinel);
+		if (capture.envelope === void 0) return {
+			kind: "failed",
+			reason: "snapshot cell produced no envelope"
+		};
+		let envelope;
+		try {
+			envelope = JSON.parse(capture.envelope);
+		} catch {
+			return {
+				kind: "failed",
+				reason: "snapshot envelope was not valid JSON"
+			};
+		}
+		if (typeof envelope !== "object" || envelope === null) return {
+			kind: "failed",
+			reason: "snapshot envelope was not an object"
+		};
+		const record = envelope;
+		if (record.ok === true) return {
+			kind: "ok",
+			sizeBytes: typeof record.sizeBytes === "number" ? record.sizeBytes : 0,
+			names: typeof record.names === "number" ? record.names : 0
+		};
+		if (record.skipped === true) return {
+			kind: "skipped",
+			reason: typeof record.reason === "string" ? record.reason : "size cap",
+			...typeof record.estimateBytes === "number" ? { estimateBytes: record.estimateBytes } : {},
+			...typeof record.sizeBytes === "number" ? { sizeBytes: record.sizeBytes } : {},
+			capBytes: typeof record.capBytes === "number" ? record.capBytes : 0
+		};
+		return {
+			kind: "failed",
+			reason: typeof record.reason === "string" ? record.reason : "snapshot failed"
+		};
+	}
+	/**
+	* Restore a dill snapshot into the user namespace via an internal cell. The
+	* kernel validates the manifest (python version, interpreter identity,
+	* skills) and reports restored vs degraded through a nonce envelope; a
+	* degraded restore leaves the namespace empty.
+	* @param payloadPath - dill payload source.
+	* @param manifestPath - JSON manifest source.
+	*/
+	async restoreState(payloadPath, manifestPath) {
+		if (!this.isRunning) return {
+			kind: "degraded",
+			reason: "kernel is not running"
+		};
+		const sentinel = `__dashr_restore_${randomBytes(9).toString("hex")}__`;
+		const outcome = await this.executeCell(buildRestoreCell(payloadPath, manifestPath, sentinel), {
+			timeoutMs: this.options.snapshotTimeoutMs,
+			interruptGraceMs: 1e3,
+			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
+		});
+		if (outcome.outcome !== "completed" || outcome.status !== "ok") return {
+			kind: "degraded",
+			reason: "restore cell failed"
+		};
+		const capture = extractStream(outcome.streamText, sentinel);
+		if (capture.envelope === void 0) return {
+			kind: "degraded",
+			reason: "restore cell produced no envelope"
+		};
+		let envelope;
+		try {
+			envelope = JSON.parse(capture.envelope);
+		} catch {
+			return {
+				kind: "degraded",
+				reason: "restore envelope was not valid JSON"
+			};
+		}
+		if (typeof envelope !== "object" || envelope === null) return {
+			kind: "degraded",
+			reason: "restore envelope was not an object"
+		};
+		const record = envelope;
+		if (record.ok === true) return {
+			kind: "restored",
+			count: typeof record.restored === "number" ? record.restored : 0
+		};
+		return {
+			kind: "degraded",
+			reason: typeof record.reason === "string" ? record.reason : "snapshot not replayable"
+		};
+	}
+	/**
+	* Read one user-namespace variable by name (or list the namespace's user
+	* names when `name` is `null`) via an internal cell. JSON-serializable
+	* values cross as `kind: 'json'` text; anything else falls back to `repr`
+	* text (`kind: 'repr'`) so a non-JSON variable is still readable. A missing
+	* name reports `kind: 'missing'` rather than failing the cell.
+	* @param name - the exact variable name, or `null` to list namespace names.
+	*/
+	async queryVar(name$1) {
+		if (!this.isRunning) return {
+			kind: "failed",
+			reason: "kernel is not running"
+		};
+		const sentinel = `__dashr_query_${randomBytes(9).toString("hex")}__`;
+		const outcome = await this.executeCell(buildQueryVarCell(name$1, sentinel), {
+			timeoutMs: this.options.snapshotTimeoutMs,
+			interruptGraceMs: 1e3,
+			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
+		});
+		if (outcome.outcome !== "completed" || outcome.status !== "ok") return {
+			kind: "failed",
+			reason: "query cell failed"
+		};
+		const capture = extractStream(outcome.streamText, sentinel);
+		if (capture.envelope === void 0) return {
+			kind: "failed",
+			reason: "query cell produced no envelope"
+		};
+		let envelope;
+		try {
+			envelope = JSON.parse(capture.envelope);
+		} catch {
+			return {
+				kind: "failed",
+				reason: "query envelope was not valid JSON"
+			};
+		}
+		if (!isRecord(envelope)) return {
+			kind: "failed",
+			reason: "query envelope was not an object"
+		};
+		if (envelope.ok !== true) return {
+			kind: "failed",
+			reason: typeof envelope.reason === "string" ? envelope.reason : "query failed"
+		};
+		const kind = envelope.kind;
+		if (kind === "names") return {
+			kind: "names",
+			names: Array.isArray(envelope.names) ? envelope.names.filter((name$2) => typeof name$2 === "string") : []
+		};
+		if (kind === "missing") return { kind: "missing" };
+		if (kind === "json" || kind === "repr") return typeof envelope.text === "string" ? {
+			kind,
+			text: envelope.text
+		} : {
+			kind: "failed",
+			reason: "query envelope carried no text"
+		};
+		return {
+			kind: "failed",
+			reason: `unknown query kind ${JSON.stringify(kind)}`
+		};
+	}
+	/**
+	* Assign one pre-serialized JSON value into the user namespace under
+	* `name` via an internal cell. The host already validated the name and the
+	* value; the cell only decodes and binds. Uses the same busy guard and
+	* internal-cell budget as the snapshot cells.
+	* @param name - the validated identifier to assign under.
+	* @param valueJson - the lossless-JSON text to decode and bind.
+	*/
+	async setVar(name$1, valueJson) {
+		if (!this.isRunning) return {
+			kind: "failed",
+			reason: "kernel is not running"
+		};
+		const sentinel = `__dashr_set_${randomBytes(9).toString("hex")}__`;
+		const outcome = await this.executeCell(buildSetVarCell(name$1, valueJson, sentinel), {
+			timeoutMs: this.options.snapshotTimeoutMs,
+			interruptGraceMs: 1e3,
+			interruptConfirmMs: Math.min(this.options.interruptConfirmMs, 500)
+		});
+		if (outcome.outcome !== "completed" || outcome.status !== "ok") return {
+			kind: "failed",
+			reason: "set cell failed"
+		};
+		const capture = extractStream(outcome.streamText, sentinel);
+		if (capture.envelope === void 0) return {
+			kind: "failed",
+			reason: "set cell produced no envelope"
+		};
+		let envelope;
+		try {
+			envelope = JSON.parse(capture.envelope);
+		} catch {
+			return {
+				kind: "failed",
+				reason: "set envelope was not valid JSON"
+			};
+		}
+		if (!isRecord(envelope) || envelope.ok !== true) return {
+			kind: "failed",
+			reason: isRecord(envelope) && typeof envelope.reason === "string" ? envelope.reason : "set failed"
+		};
+		return { kind: "ok" };
+	}
+	onKernelDeath() {
+		this.state = "shutdown";
+		this.forceSettleActive({
+			kind: "worker-exit",
+			message: `kernel process died. stderr tail:\n${this.stderrTail()}`
+		});
+		this.cleanupResources();
+	}
+	cleanupResources() {
+		this.transport?.dispose();
+		this.transport = void 0;
+		this.connection = void 0;
+		try {
+			this.kernel?.kill("SIGKILL");
+		} catch {}
+		this.kernel = void 0;
+		if (this.tempDir) try {
+			rmSync(this.tempDir, {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+		this.tempDir = void 0;
+	}
+	/** Graceful teardown: shutdown_request, then SIGKILL after the dispose budget. */
+	async dispose() {
+		if (this.state === "shutdown") {
+			this.cleanupResources();
+			return;
+		}
+		this.state = "shutdown";
+		try {
+			if (this.transport) {
+				this.transport.send("control", buildMessage("shutdown_request", { restart: false }, this.session, this.options.username));
+				await setTimeout$1(SHUTDOWN_DRAIN_MS);
+			}
+		} catch {}
+		const kernel = this.kernel;
+		this.cleanupResources();
+		if (kernel && kernel.exitCode === null && kernel.signalCode === null) await new Promise((resolve$1) => {
+			const timer = setTimeout(() => {
+				kernel.removeListener("exit", onExit);
+				try {
+					kernel.kill("SIGKILL");
+				} catch {}
+				resolve$1();
+			}, this.options.disposeTimeoutMs);
+			timer.unref?.();
+			const onExit = () => {
+				clearTimeout(timer);
+				resolve$1();
+			};
+			kernel.once("exit", onExit);
+		});
+	}
+};
+
+//#endregion
+//#region src/runtime.ts
+const IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+* Names the kernel-side shim owns (`_dashr`/`__dashr` prefixed, any case —
+* bootstrap helpers plus the per-run `__dashr_completion__` and
+* `__dashr_injected__`), refused as binding globals on top of the seam's
+* shared set.
+*/
+const KERNEL_OWNED_NAME = /^_+dashr/i;
+/** Manifest format version; a snapshot written under a different version is not replayable. */
+const SNAPSHOT_FORMAT = 1;
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Key under which the per-session kernel map stores agentless runs. */
+const AGENTLESS_KEY = "(agentless)";
+/**
+* Encode one principal as a single path segment for its per-key snapshot
+* subdirectory: `encodeURIComponent` neutralizes separators and traversal,
+* and a leading run of dots (which would encode to itself, addressing `.` or
+* `..`) is re-escaped so every key lands strictly inside `snapshotDir`.
+*/
+function keyDirectoryName(principal) {
+	return encodeURIComponent(principal).replace(/^\.+/, (dots) => dots.replace(/\./g, "%2E"));
+}
+/**
+* The {@link ReplRuntime} backend this package registers (`ctx.replRuntime`)
+* — the standing-mount layer of the v0.1.5 architecture, the de facto daemon
+* while the profile-level DashrDaemon stays an empty shell. One service
+* instance per mount holds one lazily-spawned kernel per session principal;
+* each kernel's lifecycle — snapshot and shutdown on session end, snapshot
+* and shutdown of every key on plugin disposal — is effect-owned.
+*/
+var DashrRuntime = class extends ReplRuntime {
+	static Config = Schema.object({
+		python: Schema.string().default("python3"),
+		startupTimeoutMs: Schema.number().default(3e4),
+		runTimeoutMs: Schema.number().default(12e4),
+		interruptGraceMs: Schema.number().default(2e3),
+		interruptConfirmMs: Schema.number().default(250),
+		disposeTimeoutMs: Schema.number().default(5e3),
+		snapshotTimeoutMs: Schema.number().default(3e4),
+		maxOutputBytes: Schema.number().default(67108864),
+		snapshotDir: Schema.string(),
+		snapshotSizeCapBytes: Schema.number().default(268435456),
+		kernelEnvDir: Schema.string(),
+		kernelPythonVersion: Schema.string(),
+		kernelAutoInstall: Schema.boolean().default(true),
+		username: Schema.string().default("dashr")
+	});
+	language = "python";
+	isolation = "process";
+	config;
+	logger;
+	/** One entry per session principal that has run code (lazy — never pre-seeded). */
+	kernels = /* @__PURE__ */ new Map();
+	disposed = false;
+	/** Lazily-resolved (and, when managed, provisioned) kernel interpreter. */
+	kernelEnvPromise;
+	constructor(ctx, config) {
+		super(ctx);
+		this.config = config;
+		for (const key of [
+			"startupTimeoutMs",
+			"runTimeoutMs",
+			"interruptGraceMs",
+			"disposeTimeoutMs",
+			"snapshotTimeoutMs"
+		]) {
+			const value = this.config[key];
+			if (!(Number.isFinite(value) && value > 0)) throw new Error(`dashr-repl: config.${key} must be a positive number, got ${String(value)}`);
+		}
+		if (!(this.config.interruptConfirmMs > 0 && this.config.interruptConfirmMs < this.config.interruptGraceMs)) throw new Error(`dashr-repl: config.interruptConfirmMs must be positive and below interruptGraceMs (${this.config.interruptGraceMs}), got ${String(this.config.interruptConfirmMs)}`);
+		if (!Number.isSafeInteger(this.config.maxOutputBytes) || this.config.maxOutputBytes < MIN_OUTPUT_BYTES) throw new Error(`dashr-repl: config.maxOutputBytes must be a safe integer of at least ${MIN_OUTPUT_BYTES}, got ${String(this.config.maxOutputBytes)}`);
+		if (!Number.isSafeInteger(this.config.snapshotSizeCapBytes) || this.config.snapshotSizeCapBytes < 1) throw new Error(`dashr-repl: config.snapshotSizeCapBytes must be a positive safe integer, got ${String(this.config.snapshotSizeCapBytes)}`);
+		this.logger = ctx.logger("dashr-repl");
+		ctx.effect(() => () => this.teardown(), "eval code-runtime teardown");
+		ctx.events.on("agent/disposed", (payload) => {
+			const principal = payload?.agent?.id;
+			if (typeof principal === "string" && principal.length > 0) this.destroyKey(principal).catch(() => void 0);
+		});
+	}
+	/**
+	* The agentless-default kernel's pid, for lifecycle diagnostics; absent
+	* before the first agentless run. Per-session pids: {@link kernelPids}.
+	*/
+	get kernelPid() {
+		return this.kernels.get(AGENTLESS_KEY)?.bridge.pid;
+	}
+	/** Every live kernel subprocess pid, one per session that has run code. */
+	get kernelPids() {
+		return [...this.kernels.values()].map((entry) => entry.bridge.pid).filter((pid) => pid !== void 0);
+	}
+	/**
+	* Execute one program as one cell on the persistent kernel. Program
+	* outcomes — including kernel startup failure — resolve with
+	* `result.error`; the method rejects only for Service Definition contract
+	* misuse (a disposed runtime, an invalid binding namespace).
+	* @param request - the program, its bindings, and the abort signal.
+	* @returns the run's outcome per the seam contract.
+	*/
+	async run(request) {
+		if (this.disposed) throw new Error("dashr-repl: run() after disposal");
+		const bindings = this.validateBindings(request);
+		if (request.signal?.aborted) return {
+			logs: [],
+			error: {
+				kind: "abort",
+				message: String(request.signal.reason)
+			}
+		};
+		const key = request.principal && request.principal.length > 0 ? request.principal : AGENTLESS_KEY;
+		if (request.reset) await this.resetKey(key);
+		const dead = this.kernels.get(key);
+		if (dead?.bridge.isDead) {
+			this.kernels.delete(key);
+			if (dead.ranCells) return await this.reviveAfterDeath(key, dead);
+		}
+		let entry;
+		try {
+			entry = await this.ensureKernel(key, request.cwd);
+		} catch (error) {
+			return finalizeOutput([], void 0, {
+				kind: "worker-exit",
+				message: `kernel failed to start: ${messageOf(error)}`
+			}, this.config.maxOutputBytes);
+		}
+		if (!entry.restoreAttempted) {
+			entry.restoreAttempted = true;
+			const restore = await this.restoreEntry(entry);
+			if (restore.kind === "restored") entry.pendingNotice = `namespace restored from the turn-${restore.turn} snapshot`;
+			else if (restore.kind === "degraded") entry.pendingNotice = `snapshot not replayable (${restore.reason}); started from an EMPTY namespace — re-create any state you need`;
+		}
+		const kernel = entry.bridge;
+		const specs = Object.fromEntries([...bindings.entries()].map(([global, namespace]) => [global, {
+			functions: Object.keys(namespace.functions),
+			...namespace.callable ? { callable: true } : {},
+			...namespace.errorClass ? { errorClass: namespace.errorClass } : {}
+		}]));
+		const sentinel = `__dashr_${randomBytes(9).toString("hex")}__`;
+		const cell = buildRunCell(request.program, JSON.stringify(specs), sentinel);
+		const outcome = await kernel.executeCell(cell, {
+			timeoutMs: request.timeoutMs ?? this.config.runTimeoutMs,
+			interruptGraceMs: this.config.interruptGraceMs,
+			interruptConfirmMs: this.config.interruptConfirmMs,
+			...request.signal ? { signal: request.signal } : {},
+			hostRequestHandler: (data) => this.dispatchHostRequest(data, bindings)
+		});
+		if (outcome.outcome === "completed") {
+			entry.ranCells = true;
+			entry.turn += 1;
+		} else if (outcome.outcome === "forced" && outcome.failure.kind === "worker-exit" && kernel.isDead && !this.disposed) {
+			if (this.kernels.get(key) === entry) this.kernels.delete(key);
+			if (entry.ranCells) return await this.reviveAfterDeath(key, entry);
+		}
+		let result = this.assembleResult(outcome, sentinel);
+		if (outcome.outcome === "completed") {
+			const snapshot = await this.snapshotTurnEnd(entry);
+			const notices = [];
+			if (snapshot.skipped && !entry.warnedSnapshotSkip) {
+				entry.warnedSnapshotSkip = true;
+				const detail = snapshot.estimateBytes !== void 0 ? `estimated ${snapshot.estimateBytes} bytes` : `${snapshot.sizeBytes ?? "unknown"} bytes serialized`;
+				notices.push(`[dashr] namespace snapshot skipped: ${detail} exceeds snapshotSizeCapBytes (${this.config.snapshotSizeCapBytes}) — later turn-end snapshots are skipped while the namespace stays this large`);
+			}
+			if (entry.pendingNotice) {
+				notices.push(`[dashr] ${entry.pendingNotice}`);
+				entry.pendingNotice = void 0;
+			}
+			if (notices.length > 0) result = finalizeOutput([...result.logs, ...notices], result.value, result.error, this.config.maxOutputBytes);
+		}
+		return result;
+	}
+	/**
+	* Read one user-namespace variable by name on the session's kernel. A
+	* bare/empty name lists the namespace's user-variable names; a
+	* JSON-serializable value resolves to its JSON text, any other value to its
+	* `repr` text, and a missing name to `{ kind: 'missing' }`. When no live
+	* kernel holds state for the key the namespace is empty (no spawn — this
+	* channel never creates a kernel). Pure additive: the run/execute/snapshot
+	* lifecycle is untouched.
+	* @param name - the variable name, or empty to list namespace names.
+	* @param principal - the session key (absent → the shared default).
+	*/
+	async queryVar(name$1, principal) {
+		if (this.disposed) throw new Error("dashr-repl: queryVar() after disposal");
+		const key = principal && principal.length > 0 ? principal : AGENTLESS_KEY;
+		const bridge = this.kernels.get(key)?.bridge;
+		if (!bridge || !bridge.isRunning) return name$1.trim().length === 0 ? {
+			kind: "names",
+			names: []
+		} : { kind: "missing" };
+		const outcome = await bridge.queryVar(name$1.trim().length === 0 ? null : name$1);
+		switch (outcome.kind) {
+			case "json": return {
+				kind: "json",
+				text: outcome.text
+			};
+			case "repr": return {
+				kind: "repr",
+				text: outcome.text
+			};
+			case "names": return {
+				kind: "names",
+				names: outcome.names
+			};
+			case "missing": return { kind: "missing" };
+			case "failed": throw new Error(`dashr-repl: queryVar(${JSON.stringify(name$1)}) failed: ${outcome.reason}`);
+		}
+	}
+	/**
+	* Assign one lossless-JSON value into the user namespace under `name` on
+	* the session's kernel. `name` must be a usable identifier (and not a
+	* kernel-shim name); `value` must be lossless JSON. Requires a live kernel
+	* for the key — the channel never spawns one, so a session that has not yet
+	* run a cell must `run` first. Pure additive to the existing lifecycle.
+	* @param name - the identifier to assign under.
+	* @param value - the lossless-JSON value to bind.
+	* @param principal - the session key (absent → the shared default).
+	*/
+	async setVar(name$1, value, principal) {
+		if (this.disposed) throw new Error("dashr-repl: setVar() after disposal");
+		const trimmed = name$1.trim();
+		if (trimmed.length === 0) throw new Error("dashr-repl: setVar() requires a non-empty variable name");
+		if (!IDENTIFIER.test(trimmed)) throw new Error(`dashr-repl: setVar() name ${JSON.stringify(trimmed)} is not a usable identifier`);
+		if (KERNEL_OWNED_NAME.test(trimmed)) throw new Error(`dashr-repl: setVar() name ${JSON.stringify(trimmed)} is reserved by the kernel`);
+		const jsonValue = snapshotJsonValue(value);
+		if (jsonValue === void 0) throw new Error("dashr-repl: setVar() value must be lossless JSON");
+		const key = principal && principal.length > 0 ? principal : AGENTLESS_KEY;
+		const bridge = this.kernels.get(key)?.bridge;
+		if (!bridge || !bridge.isRunning) throw new Error("dashr-repl: setVar() requires a live kernel for this session — run a cell first");
+		const outcome = await bridge.setVar(trimmed, JSON.stringify(jsonValue));
+		if (outcome.kind === "failed") throw new Error(`dashr-repl: setVar(${JSON.stringify(trimmed)}) failed: ${outcome.reason}`);
+	}
+	/** Map one cell outcome onto the seam's result shape under the output ledger. */
+	assembleResult(outcome, sentinel) {
+		const capture = extractStream(outcome.streamText, sentinel);
+		const maxBytes = this.config.maxOutputBytes;
+		if (outcome.outcome === "forced") return finalizeOutput(capture.logs, void 0, outcome.failure, maxBytes);
+		if (outcome.status === "error") {
+			const failure = outcome.cellError ? {
+				kind: "exception",
+				message: plainTraceback(outcome.cellError.ename, outcome.cellError.evalue, outcome.cellError.traceback)
+			} : {
+				kind: "exception",
+				message: "the program failed without a traceback"
+			};
+			return finalizeOutput(capture.logs, void 0, failure, maxBytes);
+		}
+		if (capture.envelope === void 0) return finalizeOutput(capture.logs, void 0, void 0, maxBytes);
+		let envelope;
+		try {
+			envelope = JSON.parse(capture.envelope);
+		} catch {
+			return finalizeOutput(capture.logs, void 0, {
+				kind: "invalid-output",
+				message: "completion envelope was not valid JSON"
+			}, maxBytes);
+		}
+		if (typeof envelope !== "object" || envelope === null || envelope.ok !== true) return finalizeOutput(capture.logs, void 0, {
+			kind: "invalid-output",
+			message: "program completion must be lossless JSON"
+		}, maxBytes);
+		const json = envelope.json;
+		if (typeof json !== "string") return finalizeOutput(capture.logs, void 0, void 0, maxBytes);
+		return finalizeOutput(capture.logs, JSON.parse(json), void 0, maxBytes);
+	}
+	/** Reject malformed binding globals or typed-error declarations as contract misuse. */
+	validateBindings(request) {
+		const bindings = /* @__PURE__ */ new Map();
+		for (const namespace of request.bindings) {
+			if (!IDENTIFIER.test(namespace.global) || PORTABLE_RESERVED_WORDS.has(namespace.global)) throw new Error(`dashr-repl: binding global ${JSON.stringify(namespace.global)} is not a usable identifier`);
+			if (RESERVED_BINDING_GLOBALS.has(namespace.global) || KERNEL_OWNED_NAME.test(namespace.global)) throw new Error(`dashr-repl: reserved binding global ${JSON.stringify(namespace.global)}`);
+			if (bindings.has(namespace.global)) throw new Error(`dashr-repl: duplicate binding global ${JSON.stringify(namespace.global)}`);
+			if (namespace.callable === true && Object.keys(namespace.functions).length !== 1) throw new Error(`dashr-repl: callable binding global ${JSON.stringify(namespace.global)} must declare exactly one function`);
+			bindings.set(namespace.global, namespace);
+		}
+		const errorClasses = /* @__PURE__ */ new Map();
+		for (const namespace of request.bindings) {
+			const descriptor = namespace.errorClass;
+			if (!descriptor) continue;
+			if (!IDENTIFIER.test(descriptor.name) || PORTABLE_RESERVED_WORDS.has(descriptor.name)) throw new Error(`dashr-repl: binding error class ${JSON.stringify(descriptor.name)} is not a usable identifier`);
+			if (RESERVED_BINDING_GLOBALS.has(descriptor.name) || KERNEL_OWNED_NAME.test(descriptor.name)) throw new Error(`dashr-repl: reserved binding global ${JSON.stringify(descriptor.name)}`);
+			if (bindings.has(descriptor.name)) throw new Error(`dashr-repl: duplicate injected global ${JSON.stringify(descriptor.name)}`);
+			const member = descriptor.memberNameProperty;
+			if (member.length === 0 || RESERVED_ERROR_MEMBERS.has(member) || DUNDER_MEMBER.test(member)) throw new Error(`dashr-repl: binding error member property ${JSON.stringify(descriptor.memberNameProperty)} is not usable`);
+			const declared = errorClasses.get(descriptor.name);
+			if (declared !== void 0 && declared !== member) throw new Error(`dashr-repl: error class ${JSON.stringify(descriptor.name)} declared with conflicting member properties ${JSON.stringify(declared)} and ${JSON.stringify(member)}`);
+			errorClasses.set(descriptor.name, member);
+		}
+		return bindings;
+	}
+	/** Dispatch one kernel-side host request; unknown types and bad payloads become error replies. */
+	async dispatchHostRequest(data, bindings) {
+		if (data.type !== "binding.call" || typeof data.global !== "string" || typeof data.name !== "string") return {
+			ok: false,
+			message: "host request must be a binding.call with global and name"
+		};
+		const record = bindings.get(data.global)?.functions;
+		const fn = record && Object.hasOwn(record, data.name) ? record[data.name] : void 0;
+		if (typeof fn !== "function") return {
+			ok: false,
+			message: `unknown binding ${JSON.stringify(`${data.global}.${data.name}`)}`
+		};
+		const args = snapshotJsonValue(data.args);
+		if (args === void 0) return {
+			ok: false,
+			message: "binding arguments must be lossless JSON"
+		};
+		let resolved;
+		try {
+			resolved = await fn(args);
+		} catch (error) {
+			return {
+				ok: false,
+				message: messageOf(error)
+			};
+		}
+		const value = snapshotJsonValue(resolved);
+		if (value === void 0) return {
+			ok: false,
+			message: "binding resolution must be lossless JSON"
+		};
+		return {
+			ok: true,
+			result: value
+		};
+	}
+	/** Resolve (and provision, when managed) the kernel interpreter once per runtime. */
+	resolveKernelPython() {
+		this.kernelEnvPromise ??= resolveKernelEnv({
+			python: this.config.python,
+			venvDir: this.config.kernelEnvDir,
+			pythonVersion: this.config.kernelPythonVersion,
+			autoInstall: this.config.kernelAutoInstall,
+			log: (level, message) => {
+				if (level === "warn") this.logger.warn(message);
+				else this.logger.info(message);
+			}
+		}).catch((error) => {
+			this.kernelEnvPromise = void 0;
+			throw error;
+		});
+		return this.kernelEnvPromise;
+	}
+	/**
+	* Spawn-or-reuse the kernel for one key. The lazy map guarantees one
+	* entry is created here and nowhere else, so a key that never runs never
+	* holds a subprocess — the subagent fan-out guarantee (blueprint §6:
+	* subagent ×N spawns nothing until a child actually executes code).
+	* @param key - the run principal (or the agentless default).
+	*/
+	async ensureKernel(key, cwd) {
+		let entry = this.kernels.get(key);
+		if (!entry) {
+			const kernelCwd = cwd && existsSync(cwd) ? cwd : void 0;
+			entry = {
+				key,
+				cwd: kernelCwd,
+				bridge: new IpyKernelBridge({
+					python: (await this.resolveKernelPython()).python,
+					...kernelCwd ? { cwd: kernelCwd } : {},
+					startupTimeoutMs: this.config.startupTimeoutMs,
+					disposeTimeoutMs: this.config.disposeTimeoutMs,
+					interruptConfirmMs: this.config.interruptConfirmMs,
+					snapshotTimeoutMs: this.config.snapshotTimeoutMs,
+					username: this.config.username
+				}),
+				ranCells: false,
+				turn: 0
+			};
+			this.kernels.set(key, entry);
+		}
+		await entry.bridge.start();
+		return entry;
+	}
+	/**
+	* Restore a key's on-disk snapshot into a freshly booted kernel, when one
+	* exists and its manifest is plausible. Called once per entry boot. The
+	* kernel-side restore cell performs the authoritative environment checks
+	* (python version, interpreter identity, skills); this method only gates on
+	* the manifest the host can read cheaply, then records the turn so the
+	* first-run notice and the revive chain can name it.
+	*/
+	async restoreEntry(entry) {
+		if (!this.config.snapshotDir) return { kind: "none" };
+		const dir = join(this.config.snapshotDir, keyDirectoryName(entry.key));
+		const payloadPath = join(dir, "state.dill");
+		const manifestPath = join(dir, "manifest.json");
+		const manifest = this.readSnapshotManifest(entry.key);
+		if (manifest === void 0) return { kind: "none" };
+		if (manifest.snapshotFormat !== SNAPSHOT_FORMAT) return {
+			kind: "degraded",
+			reason: `snapshot format ${String(manifest.snapshotFormat)} is not replayable`
+		};
+		if (manifest.skipped === true) return { kind: "none" };
+		if (!existsSync(payloadPath)) return {
+			kind: "degraded",
+			reason: "snapshot payload is missing"
+		};
+		const restored = await entry.bridge.restoreState(payloadPath, manifestPath);
+		if (restored.kind === "restored") {
+			entry.turn = typeof manifest.turn === "number" && Number.isSafeInteger(manifest.turn) && manifest.turn >= 0 ? manifest.turn : 0;
+			entry.lastSnapshotTurn = entry.turn;
+			entry.ranCells = true;
+			return {
+				kind: "restored",
+				turn: entry.turn
+			};
+		}
+		return {
+			kind: "degraded",
+			reason: restored.reason
+		};
+	}
+	/** Read the per-key manifest's host-relevant fields; absent when unreadable/missing. */
+	readSnapshotManifest(key) {
+		if (!this.config.snapshotDir) return void 0;
+		try {
+			return JSON.parse(readFileSync(join(this.config.snapshotDir, keyDirectoryName(key), "manifest.json"), "utf8"));
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Revive one session's kernel after death: respawn a fresh kernel, restore
+	* the nearest replayable snapshot onto it (the normal restore path), and
+	* return the death-observing run's explicit error naming the turn. When no
+	* replayable snapshot exists the message falls back to M3-A's fresh-empty
+	* contract. The run itself does NOT execute — an error that lies about a
+	* NameError costs the model more than one dropped cell (blueprint §8.3).
+	* @param key - the run principal.
+	* @param dead - the entry that died (its `turn` is the last completed turn).
+	*/
+	async reviveAfterDeath(key, dead) {
+		let entry;
+		try {
+			entry = await this.ensureKernel(key, dead.cwd);
+		} catch (error) {
+			return finalizeOutput([], void 0, {
+				kind: "worker-exit",
+				message: `kernel died and respawn failed (${messageOf(error)}); the next run will retry a fresh kernel`
+			}, this.config.maxOutputBytes);
+		}
+		entry.restoreAttempted = true;
+		const restore = await this.restoreEntry(entry);
+		const observingTurn = dead.turn + 1;
+		if (restore.kind === "restored") {
+			const lost = observingTurn - restore.turn;
+			const rounds = lost === 1 ? "round" : "rounds";
+			return finalizeOutput([], void 0, {
+				kind: "worker-exit",
+				message: `the kernel for this session died; its namespace was restored from the turn-${restore.turn} snapshot — the last ${lost} ${rounds} of variable operations must be replayed. This run did not execute.`
+			}, this.config.maxOutputBytes);
+		}
+		return finalizeOutput([], void 0, {
+			kind: "worker-exit",
+			message: `the kernel for this session died and no replayable snapshot was available${restore.kind === "degraded" ? ` (${restore.reason})` : ""}; the next run starts a fresh kernel with an EMPTY namespace — re-create any state you still need. This run did not execute.`
+		}, this.config.maxOutputBytes);
+	}
+	/**
+	* Write one key's turn-end snapshot, when a snapshot directory is
+	* configured. A size-cap skip is reported (so the run can warn the model
+	* once); other failures log without disturbing the run.
+	*/
+	async snapshotTurnEnd(entry) {
+		if (!this.config.snapshotDir) return { skipped: false };
+		const kernel = entry.bridge;
+		if (!kernel.isRunning) return { skipped: false };
+		const dir = join(this.config.snapshotDir, keyDirectoryName(entry.key));
+		mkdirSync(dir, { recursive: true });
+		const spec = {
+			turn: entry.turn,
+			skills: [],
+			sizeCapBytes: this.config.snapshotSizeCapBytes
+		};
+		const outcome = await kernel.snapshotState(join(dir, "state.dill"), join(dir, "manifest.json"), spec);
+		if (outcome.kind === "ok") {
+			entry.lastSnapshotTurn = entry.turn;
+			return { skipped: false };
+		}
+		if (outcome.kind === "skipped") return {
+			skipped: true,
+			...outcome.estimateBytes !== void 0 ? { estimateBytes: outcome.estimateBytes } : {},
+			...outcome.sizeBytes !== void 0 ? { sizeBytes: outcome.sizeBytes } : {}
+		};
+		this.logger.warn(`turn-end snapshot for ${JSON.stringify(entry.key)} failed: ${outcome.reason}`);
+		return { skipped: false };
+	}
+	/**
+	* Dispose to quiescence: snapshot every live key's namespace when a
+	* snapshot directory is configured (each under its own per-key
+	* subdirectory), then shut the subprocesses down. Registered as the
+	* plugin's `ctx.effect` disposer.
+	*/
+	async teardown() {
+		this.disposed = true;
+		const entries = [...this.kernels.values()];
+		this.kernels.clear();
+		await Promise.all(entries.map((entry) => this.teardownKernel(entry)));
+	}
+	/**
+	* Tear one session's kernel down (session end via the `agent/disposed`
+	* listener). A no-op for keys that never ran code through this instance —
+	* which is what makes hearing every agent's disposal safe.
+	*/
+	async destroyKey(key) {
+		const entry = this.kernels.get(key);
+		if (!entry) return;
+		this.kernels.delete(key);
+		await this.teardownKernel(entry);
+	}
+	/**
+	* Reset one session's kernel to a fresh, empty namespace: dispose the live
+	* subprocess WITHOUT a turn-end snapshot and clear its on-disk snapshot, so
+	* the next ensureKernel spawns empty (restore finds nothing to replay).
+	*/
+	async resetKey(key) {
+		const entry = this.kernels.get(key);
+		if (entry) {
+			this.kernels.delete(key);
+			await entry.bridge.dispose();
+		}
+		if (this.config.snapshotDir) rmSync(join(this.config.snapshotDir, keyDirectoryName(key)), {
+			recursive: true,
+			force: true
+		});
+	}
+	/** Snapshot (when configured) then dispose one key's kernel; failures log, never throw into a listener. */
+	async teardownKernel(entry) {
+		const kernel = entry.bridge;
+		if (this.config.snapshotDir && kernel.isRunning) try {
+			const dir = join(this.config.snapshotDir, keyDirectoryName(entry.key));
+			mkdirSync(dir, { recursive: true });
+			const spec = {
+				turn: entry.turn,
+				skills: [],
+				sizeCapBytes: this.config.snapshotSizeCapBytes
+			};
+			const saved = await kernel.snapshotState(join(dir, "state.dill"), join(dir, "manifest.json"), spec);
+			if (saved.kind !== "ok" && saved.kind !== "skipped") this.logger.warn(`kernel namespace snapshot for ${JSON.stringify(entry.key)} failed: ${saved.reason}`);
+		} catch (error) {
+			this.logger.warn(`kernel namespace snapshot for ${JSON.stringify(entry.key)} failed: ${messageOf(error)}`);
+		}
+		await kernel.dispose();
+	}
+};
+
+//#endregion
+//#region src/tool-call-id.ts
+/** Brand a string as the host's tool-call id (identity at runtime). */
+const toolCallId = dshLlm.ToolCallId;
+
+//#endregion
+//#region src/bridges/index.ts
+/**
+* Unwrap one bridge-tool {@link parseReplCall} packaging into its single
+* arguments object. Same one-object contract as a registry tool, but bridge
+* tools return a structured `{ error }` value instead of throwing, and a call
+* with no arguments reads as an empty object. Keyword and multi-positional
+* forms are rejected.
+*/
+function flatBridgeToolArgs(rawArgs) {
+	if (rawArgs === void 0 || rawArgs === null) return {
+		ok: true,
+		args: {}
+	};
+	if (Array.isArray(rawArgs)) return {
+		ok: false,
+		error: "tools take exactly one positional arguments object — call e.g. tool.name({\"field\": value})"
+	};
+	if (typeof rawArgs !== "object") return {
+		ok: false,
+		error: "tools take one positional arguments object, not a bare value — call e.g. tool.name({\"field\": value})"
+	};
+	return {
+		ok: true,
+		args: rawArgs
+	};
+}
+/**
+* The wire layer delivers `type:'json'` parameters as JSON STRINGS (the cell
+* path delivers parsed objects); accept either form. An unparseable string
+* falls through untouched — the caller's object check turns it into the
+* structured error.
+*/
+function coerceJsonField(value) {
+	if (typeof value !== "string") return value;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return value;
+	}
+}
+/** Reject unexpected keys on one bridge call's arguments object. */
+function rejectUnknownKeys(tool, args, allowed) {
+	const unknownKeys = Object.keys(args).filter((key) => !allowed.includes(key));
+	if (unknownKeys.length > 0) return { error: `${tool}() got unexpected key(s): ${unknownKeys.join(", ")}` };
+}
+/** Human-readable reason for one non-`completed` subagent stop (native `stopReasonError`). */
+function stopReasonError(reason) {
+	switch (reason) {
+		case "completed": return "subagent run completed";
+		case "aborted": return "subagent run was cancelled";
+		case "error": return "subagent run failed";
+		case "max-tokens": return "subagent run hit its token limit before finishing";
+		case "refusal": return "subagent declined the task";
+		default: return `subagent run ended abnormally (${reason})`;
+	}
+}
+/** The native `dsh-tool-subagent` default delegation-depth cap (Config default `3`). */
+const NATIVE_MAX_DEPTH = 3;
+/** The fixed Ralph orchestration (deployment-owned, copied verbatim from `@deepseek-ai/dsh-tool-ralph`). */
+const RALPH_META = {
+	name: "ralph-loop",
+	description: "Iterate toward one objective with a fresh child and bounded structured handoff per round.",
+	phases: [{
+		title: "Fresh-agent rounds",
+		detail: "One clean child context per Ralph round."
+	}]
+};
+/** Native Ralph defaults (Config defaults). */
+const RALPH_SUBAGENT_PROVIDER = "spawn";
+const RALPH_MAX_ROUNDS = 256;
+const RALPH_MAX_HANDOFF_CHARS = 16384;
+/** The fixed, deployment-owned Ralph script, copied verbatim from `@deepseek-ai/dsh-tool-ralph`. */
+const RALPH_SCRIPT = String.raw`
+const reportSchema = {
+  type: 'object',
+  properties: {
+    status: { type: 'string', enum: ['continue', 'complete', 'blocked'] },
+    summary: { type: 'string' },
+    evidence: { type: 'array', items: { type: 'string' } },
+    nextSteps: { type: 'array', items: { type: 'string' } },
+    blocker: { type: 'string' },
+  },
+  required: ['status', 'summary', 'evidence', 'nextSteps', 'blocker'],
+  additionalProperties: false,
+}
+
+function normalizedText(value) {
+  return typeof value === 'string' && value.length > 0 && value === value.trim()
+}
+
+function normalizedList(value) {
+  return Array.isArray(value) && value.every(normalizedText)
+}
+
+function validateReport(report) {
+  if (report === null || typeof report !== 'object' || Array.isArray(report)) {
+    throw new Error('Ralph child returned no structured round report')
+  }
+  if (!normalizedText(report.summary)) {
+    throw new Error('Ralph round report summary must be non-empty and normalized')
+  }
+  if (!normalizedList(report.evidence) || !normalizedList(report.nextSteps)) {
+    throw new Error('Ralph round report evidence and nextSteps must contain only non-empty normalized strings')
+  }
+  if (typeof report.blocker !== 'string' || report.blocker !== report.blocker.trim()) {
+    throw new Error('Ralph round report blocker must be a normalized string')
+  }
+  switch (report.status) {
+    case 'continue':
+      if (report.nextSteps.length === 0 || report.blocker !== '') {
+        throw new Error('a continuing Ralph report needs nextSteps and an empty blocker')
+      }
+      break
+    case 'complete':
+      if (report.evidence.length === 0 || report.nextSteps.length !== 0 || report.blocker !== '') {
+        throw new Error('a complete Ralph report needs evidence, no nextSteps, and an empty blocker')
+      }
+      break
+    case 'blocked':
+      if (!normalizedText(report.blocker)) {
+        throw new Error('a blocked Ralph report needs a concrete blocker')
+      }
+      break
+    default:
+      throw new Error('Ralph round report status is invalid')
+  }
+  const serialized = JSON.stringify(report)
+  if (serialized.length > args.maxHandoffChars) {
+    throw new Error('Ralph round report exceeds maxHandoffChars (' + serialized.length + ' > ' + args.maxHandoffChars + ')')
+  }
+  return report
+}
+
+let previous
+phase('Fresh-agent rounds')
+for (let round = 1; round <= args.maxRounds; round += 1) {
+  const prior = previous === undefined ? '(none — this is the first round)' : JSON.stringify(previous)
+  const prompt = [
+    'You are one fresh worker in a foreground Ralph loop. You receive no parent conversation and no prior child session. Do not call the ralph tool: this round already is its worker.',
+    'Immutable objective:\n' + args.objective,
+    'Ralph round: ' + round + ' of ' + args.maxRounds + '.',
+    'The shared workspace and its current working tree are the long-term memory and source of truth. Inspect them before acting, preserve existing work, perform concrete in-scope work, and verify what you change. Treat the previous report only as a bounded handoff; confirm it against the workspace.',
+    'Previous structured handoff:\n' + prior,
+    'Return one report with exact normalized strings. Use status continue with at least one nextSteps entry while useful work remains; complete only with concrete evidence and no nextSteps; blocked only when no meaningful progress is possible without human input or an external-state change. blocker must be empty unless blocked.',
+  ].join('\n\n')
+  const rawReport = await agent(prompt, {
+    label: 'Ralph round ' + round,
+    phase: 'Fresh-agent rounds',
+    schema: reportSchema,
+  })
+  if (rawReport === null) {
+    return { status: 'round-failed', roundsStarted: round, lastReport: previous ?? null }
+  }
+  const report = validateReport(rawReport)
+  if (report.status === 'complete') return { status: 'complete', roundsStarted: round, report }
+  if (report.status === 'blocked') return { status: 'blocked', roundsStarted: round, report }
+  previous = report
+}
+return { status: 'budget-limited', roundsStarted: args.maxRounds, report: previous }
+`;
+const agentExecutor = async (rawArgs, exec, deps) => {
+	const parsed = flatBridgeToolArgs(rawArgs);
+	if (!parsed.ok) return { error: parsed.error };
+	const a = parsed.args;
+	const unknown = rejectUnknownKeys("agent", a, [
+		"description",
+		"prompt",
+		"run_in_background",
+		"mode"
+	]);
+	if (unknown !== void 0) return unknown;
+	const description = a["description"];
+	const prompt = a["prompt"];
+	if (typeof description !== "string" || description.length === 0) return { error: "agent() requires {\"description\": \"...\"} — a short (3-5 word) display label" };
+	if (typeof prompt !== "string" || prompt.length === 0) return { error: "agent() requires {\"prompt\": \"...\"} — the task for the child agent" };
+	const mode = a["mode"] ?? "delegate";
+	if (mode !== "delegate" && mode !== "fork") return { error: `agent() unknown mode ${JSON.stringify(mode)}: expected 'delegate' or 'fork'` };
+	const provider = mode === "fork" ? "fork" : "spawn";
+	if (!exec.agent) return { error: "agent() requires a calling agent (this run has no agent to delegate from)" };
+	const subagents = deps.requireSubagents?.();
+	if (!subagents) return { error: "agent() is unavailable: no ctx.subagents service is mounted in this composition" };
+	const delegation = {
+		label: description,
+		prompt: [{
+			type: "text",
+			text: prompt
+		}],
+		parent: exec.agent,
+		maxDepth: NATIVE_MAX_DEPTH
+	};
+	const runInBackground = a["run_in_background"] ?? true;
+	try {
+		if (runInBackground) return {
+			kind: "continuable",
+			subagentId: (await subagents.startContinuable({
+				provider,
+				label: description,
+				request: delegation,
+				signal: exec.signal
+			})).childId
+		};
+		const run = await subagents.start(provider, {
+			...delegation,
+			signal: exec.signal
+		});
+		try {
+			const result = await run.result;
+			if (result.stopReason !== "completed") return { error: `agent() ${stopReasonError(result.stopReason)}` };
+			return {
+				kind: "foreground",
+				runId: run.id,
+				output: result.output
+			};
+		} finally {
+			await run.dispose();
+		}
+	} catch (error) {
+		return { error: `agent() failed: ${error instanceof Error ? error.message : String(error)}` };
+	}
+};
+const agentMessageExecutor = async (rawArgs, exec, deps) => {
+	const parsed = flatBridgeToolArgs(rawArgs);
+	if (!parsed.ok) return { error: parsed.error };
+	const a = parsed.args;
+	const unknown = rejectUnknownKeys("agent_message", a, [
+		"receiver",
+		"message",
+		"subagent_id",
+		"target_session_id"
+	]);
+	if (unknown !== void 0) return unknown;
+	const receiver = a["receiver"];
+	if (typeof receiver !== "string") return { error: "agent_message() requires {\"receiver\": \"child\" | \"parent\" | \"interrupt\"}" };
+	const message = a["message"];
+	if (receiver === "child") {
+		if (typeof message !== "string") return { error: "agent_message() receiver \"child\" requires {\"message\": \"...\"}" };
+		const subagentId = a["subagent_id"];
+		if (typeof subagentId !== "string" || subagentId.length === 0) return { error: "agent_message() receiver \"child\" requires {\"subagent_id\": \"...\"} — the durable subagent id a spawn returned" };
+		if (!exec.agent) return { error: "agent_message(receiver='child') requires an agent session (this run has no agent to deliver from)" };
+		const subagents = deps.requireSubagents?.();
+		if (!subagents) return { error: "agent_message(receiver='child') is unavailable: no ctx.subagents service is mounted in this composition" };
+		try {
+			return { messageId: await subagents.sendMessage(exec.agent, subagentId, [{
+				type: "text",
+				text: message
+			}], { signal: exec.signal }) };
+		} catch (error) {
+			return { error: `agent_message(receiver='child') failed: ${error instanceof Error ? error.message : String(error)}` };
+		}
+	}
+	if (receiver === "parent") {
+		if (typeof message !== "string") return { error: "agent_message() receiver \"parent\" requires {\"message\": \"...\"}" };
+		if (!exec.agent) return { error: "agent_message(receiver='parent') requires an agent session (this run has no agent to report from)" };
+		const subagents = deps.requireSubagents?.();
+		if (!subagents) return { error: "agent_message(receiver='parent') is unavailable: no ctx.subagents service is mounted in this composition" };
+		try {
+			const parentId = exec.agent.session.header.parentSession;
+			if (parentId === void 0) return { error: "agent_message(receiver='parent') rejected: only a live continuable child agent can report to its parent (a root agent has none)" };
+			return {
+				delivered: true,
+				message_id: await subagents.sendMessage(exec.agent, parentId, [{
+					type: "text",
+					text: message
+				}], { signal: exec.signal })
+			};
+		} catch (error) {
+			if (error.code === "UNAUTHORIZED") return { error: `agent_message(receiver='parent') rejected: only a live continuable child agent can report to its parent (a root agent has none) — ${error instanceof Error ? error.message : String(error)}` };
+			return { error: `agent_message(receiver='parent') failed: ${error instanceof Error ? error.message : String(error)}` };
+		}
+	}
+	if (receiver === "interrupt") {
+		const targetSessionId = a["target_session_id"];
+		if (typeof targetSessionId !== "string" || targetSessionId.length === 0) return { error: "agent_message() receiver 'interrupt' requires {\"target_session_id\": \"...\"} — the target agent's session id" };
+		if (!exec.agent) return { error: "agent_message(receiver='interrupt') requires a calling agent (this run has no agent to authorize the interrupt)" };
+		const subagents = deps.requireSubagents?.();
+		if (!subagents) return { error: "agent_message(receiver='interrupt') is unavailable: no ctx.subagents service is mounted in this composition" };
+		try {
+			subagents.interrupt(targetSessionId, {
+				kind: "ancestor",
+				agent: exec.agent
+			});
+			return { accepted: true };
+		} catch (error) {
+			return { error: `agent_message(receiver='interrupt') failed: ${error instanceof Error ? error.message : String(error)}` };
+		}
+	}
+	return { error: `agent_message() unknown receiver ${JSON.stringify(receiver)}: expected 'child', 'parent', or 'interrupt'` };
+};
+const agentWorkflowExecutor = async (rawArgs, exec, deps) => {
+	const parsed = flatBridgeToolArgs(rawArgs);
+	if (!parsed.ok) return { error: parsed.error };
+	const a = parsed.args;
+	const unknown = rejectUnknownKeys("agent_workflow", a, [
+		"mode",
+		"script",
+		"meta",
+		"args",
+		"objective",
+		"maxRounds"
+	]);
+	if (unknown !== void 0) return unknown;
+	const mode = a["mode"] ?? "script";
+	if (mode !== "script" && mode !== "rfc") return { error: `agent_workflow() unknown mode ${JSON.stringify(mode)}: expected 'script' or 'rfc'` };
+	if (!exec.agent) return { error: "agent_workflow() requires a calling agent (this run has no agent to attribute the workflow to)" };
+	const meta = coerceJsonField(a["meta"]);
+	const argsField = coerceJsonField(a["args"]);
+	if (mode === "script") {
+		if (typeof a["script"] !== "string" || a["script"].length === 0) return { error: "agent_workflow() mode \"script\" requires {\"script\": \"...\"} — the plain-JS workflow script body" };
+		if (typeof meta !== "object" || meta === null || Array.isArray(meta)) return { error: "agent_workflow() mode \"script\" requires {\"meta\": {...}} — the workflow identity block" };
+	} else if (typeof a["objective"] !== "string" || a["objective"].trim().length === 0) return { error: "agent_workflow() mode \"rfc\" requires {\"objective\": \"...\"} — the immutable completion objective" };
+	const engine = deps.requireWorkflowEngine?.(exec.agent);
+	if (!engine) return { error: "agent_workflow() is unavailable: no workflowEngine service is mounted for this agent's preset" };
+	const settle = async (run) => {
+		const onAbort = () => {
+			run.cancel("parent step aborted");
+		};
+		exec.signal.addEventListener("abort", onAbort, { once: true });
+		try {
+			const result = await run.result;
+			if (result.stopReason !== "completed") return { error: `agent_workflow() did not finish cleanly: ${result.error ?? result.stopReason}` };
+			return {
+				runId: run.id,
+				agentsStarted: result.agentsStarted,
+				result: result.value
+			};
+		} catch (error) {
+			return { error: `agent_workflow() failed: ${error instanceof Error ? error.message : String(error)}` };
+		} finally {
+			exec.signal.removeEventListener("abort", onAbort);
+			await run.dispose();
+		}
+	};
+	try {
+		if (mode === "script") return await settle(engine.start({
+			script: a["script"],
+			meta,
+			...argsField !== void 0 ? { args: argsField } : {},
+			parent: exec.agent,
+			signal: exec.signal
+		}));
+		const maxRounds = a["maxRounds"] === void 0 ? RALPH_MAX_ROUNDS : a["maxRounds"];
+		if (typeof maxRounds !== "number" || !Number.isSafeInteger(maxRounds) || maxRounds < 1) return { error: "agent_workflow() mode \"rfc\" maxRounds must be a positive safe integer" };
+		if (maxRounds > RALPH_MAX_ROUNDS) return { error: `agent_workflow() mode "rfc" maxRounds ${maxRounds} exceeds the deployment ceiling ${RALPH_MAX_ROUNDS}` };
+		return await settle(engine.start({
+			script: RALPH_SCRIPT,
+			meta: RALPH_META,
+			args: {
+				objective: a["objective"].trim(),
+				maxRounds,
+				maxHandoffChars: RALPH_MAX_HANDOFF_CHARS
+			},
+			subagentProvider: RALPH_SUBAGENT_PROVIDER,
+			maxTotalAgents: maxRounds,
+			parent: exec.agent,
+			signal: exec.signal
+		}));
+	} catch (error) {
+		return { error: `agent_workflow() failed: ${error instanceof Error ? error.message : String(error)}` };
+	}
+};
+/**
+* Build the three delegation bridge TOOLS: real registry registrations whose
+* execute runs the pure executors with the host-level service resolvers.
+* Register once at the same host layer as `eval`; the registry projection is
+* then the single source for the wire tools array, the tool catalog, and the
+* REPL `tool.*` bindings (via the mechanical auto-bridge). Runtime argument
+* validation stays inside the executors; the schemas below are the declared
+* model-facing contract, and a structured `{ error }` value — not a thrown
+* exception — is the failure form.
+*/
+function createAgentBridgeTools(deps) {
+	const jsonRender = (_args, value) => [{
+		type: "text",
+		text: JSON.stringify(value, null, 2)
+	}];
+	const errorVariant = {
+		type: "object",
+		properties: { error: { type: "string" } },
+		additionalProperties: false
+	};
+	return [
+		defineTool({
+			name: "agent",
+			description: "Start a child agent. Runs in the background by default: returns a durable subagent id immediately and keeps the child conversation open for agent_message follow-ups. Set run_in_background false to run a ONE-SHOT child instead — the call waits for the result and the child ends with the run. mode \"delegate\" (default) starts a fresh child; mode \"fork\" seeds the child with this agent's completed conversation turns.",
+			parameters: {
+				description: {
+					type: "string",
+					description: "A short (3-5 word) description of the delegated task, for display."
+				},
+				prompt: {
+					type: "string",
+					description: "The task prompt for the child agent."
+				},
+				run_in_background: {
+					type: "boolean",
+					description: "Default true: return a durable subagent id immediately (continuable, agent_message can follow up). Explicit false: one-shot — wait for the child's result here."
+				},
+				mode: {
+					type: "string",
+					description: "'delegate' (default: a fresh child) or 'fork' (a child seeded with this agent's completed conversation turns)."
+				}
+			},
+			output: {
+				schema: { oneOf: [
+					{
+						type: "object",
+						properties: {
+							kind: {
+								type: "string",
+								enum: ["continuable"]
+							},
+							subagentId: { type: "string" }
+						},
+						additionalProperties: false
+					},
+					{
+						type: "object",
+						properties: {
+							kind: {
+								type: "string",
+								enum: ["foreground"]
+							},
+							runId: { type: "string" },
+							output: { type: "json" }
+						},
+						additionalProperties: false
+					},
+					errorVariant
+				] },
+				render: jsonRender
+			},
+			execute: (args, exec) => agentExecutor(args, exec, deps)
+		}),
+		defineTool({
+			name: "agent_message",
+			description: "The single agent-to-agent channel, three ways: receiver \"child\" delivers a follow-up message down to a child (subagent_id required); receiver \"parent\" reports up to this agent's parent (live continuable children only; a root agent gets a structured UNAUTHORIZED instead); receiver \"interrupt\" stops a child's current turn (target_session_id required).",
+			parameters: {
+				receiver: {
+					type: "string",
+					description: "'child' (deliver down), 'parent' (report up), or 'interrupt' (stop a child's current turn)."
+				},
+				message: {
+					type: "string",
+					description: "The message text (required for receiver 'child' and 'parent')."
+				},
+				subagent_id: {
+					type: "string",
+					description: "The child's durable id (required when receiver is 'child')."
+				},
+				target_session_id: {
+					type: "string",
+					description: "The target agent's session id to interrupt (required when receiver is 'interrupt')."
+				}
+			},
+			output: {
+				schema: { oneOf: [
+					{
+						type: "object",
+						properties: { messageId: { type: "string" } },
+						additionalProperties: false
+					},
+					{
+						type: "object",
+						properties: {
+							delivered: {
+								type: "boolean",
+								enum: [true]
+							},
+							message_id: { type: "string" }
+						},
+						additionalProperties: false
+					},
+					{
+						type: "object",
+						properties: { accepted: {
+							type: "boolean",
+							enum: [true]
+						} },
+						additionalProperties: false
+					},
+					errorVariant
+				] },
+				render: jsonRender
+			},
+			execute: (args, exec) => agentMessageExecutor(args, exec, deps)
+		}),
+		defineTool({
+			name: "agent_workflow",
+			description: "Run a multi-agent orchestration: mode \"script\" runs a plain-JS orchestration script (script/meta required); mode \"rfc\" runs the fixed fresh-agent Ralph loop toward one objective (objective required, maxRounds optional).",
+			parameters: {
+				mode: {
+					type: "string",
+					description: "'script' (default: an orchestration script) or 'rfc' (a fixed fresh-agent Ralph loop)."
+				},
+				script: {
+					type: "string",
+					description: "The plain-JS workflow script body (required when mode is \"script\")."
+				},
+				meta: {
+					type: "json",
+					description: "The workflow identity block (required when mode is \"script\"); must carry non-empty name and description (host invariant)."
+				},
+				args: {
+					type: "json",
+					description: "Optional JSON input exposed to the script as the args global."
+				},
+				objective: {
+					type: "string",
+					description: "The immutable completion objective for the Ralph loop (required when mode is \"rfc\")."
+				},
+				maxRounds: {
+					type: "number",
+					description: "Optional round cap for the Ralph loop, bounded by the deployment ceiling."
+				}
+			},
+			output: {
+				schema: { oneOf: [{
+					type: "object",
+					properties: {
+						runId: { type: "string" },
+						agentsStarted: { type: "number" },
+						result: { type: "json" }
+					},
+					additionalProperties: false
+				}, errorVariant] },
+				render: jsonRender
+			},
+			execute: (args, exec) => agentWorkflowExecutor(args, exec, deps)
+		})
+	];
+}
+
+//#endregion
+//#region src/llm-completion.ts
+/** Default output-token ceiling for one completion (cost guard; the caller may lower it, never raise past this). */
+const MAX_COMPLETION_TOKENS = 4096;
+/** Structured failure text for one non-`stop` finish (mirrors the session-title generator's finishError). */
+function finishError(finish) {
+	switch (finish.kind) {
+		case "stop": return "";
+		case "error":
+		case "aborted": return `llm_completion() call ${finish.kind}: ${String(finish.failure?.message ?? finish.kind)}`;
+		case "max-tokens": return "llm_completion() output reached its maxTokens ceiling";
+		case "tool-calls": return "llm_completion() model unexpectedly requested a tool (a bare call offers none)";
+		default: return `llm_completion() unsupported finish reason ${JSON.stringify(finish.kind)}`;
+	}
+}
+/**
+* Build the `llm_completion` tool. Input: `{ prompt, system?, maxTokens? }`;
+* output: the model's text (a bare string root), or a structured `{ error }`
+* object — never a thrown exception for bad input or a degraded finish.
+*/
+/** Narrow a tool result to the success variant (for the model-facing render). */
+function isTextResult(value) {
+	return typeof value === "object" && value !== null && value.ok === true && typeof value.text === "string";
+}
+function createLlmCompletionTool(deps) {
+	return defineTool({
+		name: "llm_completion",
+		description: "One-shot stateless LLM call — no tools, no history, no agent. Give {prompt} (and optional {system}, {maxTokens}); get a discriminated result back: {ok:true,text} on success or {ok:false,error} on failure, so a programmatic caller can branch without shape guessing (a direct tool call renders just the text on success). For judge steps, extraction, and handoff compression inside one cell, without spawning a subagent.",
+		parameters: {
+			prompt: {
+				type: "string",
+				description: "The prompt for the one-shot call."
+			},
+			system: {
+				type: "string",
+				description: "Optional system prompt for the call."
+			},
+			maxTokens: {
+				type: "integer",
+				description: `Optional output-token ceiling for this call (default ${MAX_COMPLETION_TOKENS}, which is also the cap).`
+			}
+		},
+		output: {
+			schema: { oneOf: [{
+				type: "object",
+				properties: {
+					ok: {
+						type: "boolean",
+						required: true
+					},
+					text: {
+						type: "string",
+						required: true
+					}
+				},
+				additionalProperties: false
+			}, {
+				type: "object",
+				properties: {
+					ok: {
+						type: "boolean",
+						required: true
+					},
+					error: {
+						type: "string",
+						required: true
+					}
+				},
+				additionalProperties: false
+			}] },
+			render: (_args, value) => [{
+				type: "text",
+				text: isTextResult(value) ? value.text : JSON.stringify(value, null, 2)
+			}]
+		},
+		execute: async (args, exec) => {
+			const a = args;
+			const prompt = a["prompt"];
+			if (typeof prompt !== "string" || prompt.length === 0) return {
+				ok: false,
+				error: "llm_completion() requires {\"prompt\": \"...\"} — the one-shot prompt"
+			};
+			const system = a["system"];
+			if (system !== void 0 && typeof system !== "string") return {
+				ok: false,
+				error: "llm_completion() system must be a string"
+			};
+			const maxTokens = a["maxTokens"] === void 0 ? MAX_COMPLETION_TOKENS : a["maxTokens"];
+			if (typeof maxTokens !== "number" || !Number.isSafeInteger(maxTokens) || maxTokens < 1 || maxTokens > MAX_COMPLETION_TOKENS) return {
+				ok: false,
+				error: `llm_completion() maxTokens must be a positive safe integer no greater than ${MAX_COMPLETION_TOKENS}`
+			};
+			const llm = deps.requireLlm();
+			if (llm === void 0) return {
+				ok: false,
+				error: "llm_completion() is unavailable: no ctx.llm service is mounted in this composition"
+			};
+			const agent = exec.agent;
+			const route = agent?.options;
+			const provider = route?.provider;
+			const model = route?.model;
+			if (typeof provider !== "string" || provider.length === 0 || typeof model !== "string" || model.length === 0) return {
+				ok: false,
+				error: "llm_completion() requires a model route: the calling agent has no provider/model selected (a judge call runs on its caller's tier)"
+			};
+			const options = {
+				provider,
+				model,
+				messages: [createUserMessage({
+					content: [{
+						type: "text",
+						text: prompt
+					}],
+					source: { kind: "plugin:better-dsh" }
+				})],
+				maxTokens,
+				...system !== void 0 ? { system } : {},
+				...agent ? { sessionId: agent.session.id } : {},
+				signal: exec.signal
+			};
+			const assembler = new BlockAssembler();
+			try {
+				for await (const chunk of llm.stream(options)) {
+					exec.signal.throwIfAborted();
+					assembler.push(chunk);
+				}
+			} catch (error) {
+				return {
+					ok: false,
+					error: `llm_completion() failed: ${error instanceof Error ? error.message : String(error)}`
+				};
+			}
+			const failure = finishError(assembler.finish);
+			if (failure !== "") return {
+				ok: false,
+				error: failure
+			};
+			const blocks = assembler.blocks();
+			if (blocks.some((block) => block.type === "tool-call")) return {
+				ok: false,
+				error: "llm_completion() output must contain text only"
+			};
+			const text = blocks.filter((block) => block.type === "text").map((block) => block.text).join(" ");
+			if (text.trim().length === 0) return {
+				ok: false,
+				error: "llm_completion() produced no text"
+			};
+			return {
+				ok: true,
+				text
+			};
+		}
+	});
+}
+
+//#endregion
+//#region src/index.ts
+/** Cordis plugin name. */
+const name = "dashr-repl";
+/**
+* Required services. `replRuntime` is NOT listed: see the module doc — the
+* mode-dependent wait is declared inside {@link apply} instead, and the
+* execution path re-reads the service at use time with an actionable error.
+*/
+const inject = ["tools"];
+/** Runtime schema. */
+const Config = Schema.intersect([DashrRuntime.Config, Schema.object({ maxParallelSubCalls: Schema.natural().min(1).default(10) })]);
+/** The model-facing name of the DASHR cell transport. */
+const EVAL_NAME = "eval";
+/**
+* The wire-mask deny list (design D1): the upstream delegation and
+* guidance tools DASHR displaces from the model's surface. The list feeds
+* ONE registry-level mechanism — `tools.restrict({deny})` on the agent's
+* own scope layer at session-start — which removes every name from ALL
+* registry projections at once (wire schemas, catalog, SDK, REPL bindings,
+* by-name dispatch): the restricted-away names are gone for the model on
+* every surface, not hidden per-presentation. Two exemptions are registry
+* facts, not list policy: a name the host never registered is skipped (a
+* restriction may only name inherited tools), and a name registered on the
+* agent's OWN layer (the child-scoped native `report`, this composition's
+* bridges below, never through the masked name. `subagent` is deliberately
+* NOT in this list (v0.2.1b): its standard-preset registration
+* (`modelSelectionSettings: true`) lands on the agent's OWN layer, outside
+* registry restriction reach, so it stays visible on every surface and the
+* control prompt annotates it as an alias of the `agent` delegation tool.
+* `skill` was REMOVED from this list (2026-09-12, user ruling): the native
+* skill tool stays visible and self-surfaces its session catalog
+* (`<available_skills>` is gated on the tool's registry visibility — masking
+* the tool silenced the catalog). dashr's dual pipeline keeps `read
+* skill://<name>` as the addressing form alongside native invocation.
+* own URL wrappers) is exempt from restrictions by construction — the
+* capability it carries stays reachable through the captured-definition
+* bridges below, never through the masked name.
+*/
+const MASKED_TOOL_NAMES = new Set([
+	"send_message",
+	"report",
+	"list_agents",
+	"subagent_fork",
+	"interrupt_agent",
+	"workflow",
+	"ralph"
+]);
+/**
+* The effective deny list the session-start wiring restricts. An alias of
+* {@link MASKED_TOOL_NAMES} today; a config override (a deployment naming
+* its own mask) slots in HERE and nowhere else — the constant is the single
+* source, so the mask never drifts between capture, restrict, and the
+* bridges that read captured definitions.
+*/
+const WIRE_MASKED_NAMES = MASKED_TOOL_NAMES;
+/**
+* The typed-rejection contract declared on EVERY flat tool namespace: a
+* failed tool call raises `ToolCallError` with `.toolName` set to the
+* binding global (= the tool name the model knows). Identical descriptors
+* may repeat across namespaces; the runtime materializes the class once.
+*/
+const TOOL_CALL_ERROR_CLASS = {
+	name: "ToolCallError",
+	memberNameProperty: "toolName"
+};
+/**
+* The `dashr:escalation-guidance` CONTEXT order: sits inside the runtime-context snapshot
+* band between upstream `approval:policy` (115) and `subagent:delegation` (120) — the
+* sandbox policy statement is order 110, the approval policy 115. Re-check if upstream
+* adds context entries in this band (dsh-system-prompt CONTEXT_ORDERS).
+*/
+const ESCALATION_GUIDANCE_ORDER = 116;
+/**
+* The `eval` tool's whole model-facing description, loaded at module time
+* from the sibling markdown file (editable without touching TS). It carries
+* ALL REPL guidance — cell semantics, the direct-vs-cell decision rule, the
+* delegation alias note, and the one-form bridge at the end.
+*/
+const EVAL_DESCRIPTION = readFileSync(new URL("../eval-description.md", import.meta.url), "utf8");
+/** The `cell` parameter's model-facing description. */
+const EVAL_CELL_PARAM_DESCRIPTION = "The cell: one Python program body for the session-persistent scripting pad (top-level `await` works; top-level `return` is a SyntaxError — the cell runs in module scope).";
+/**
+* The `description` parameter's model-facing description: the UI label
+* contract, ported verbatim in shape from upstream `run_code` (the label
+* surfaces on the generic card as the call's always-visible title).
+*/
+const EVAL_DESCRIPTION_PARAM_DESCRIPTION = "Clear, concise description of what this cell does in active voice, 5-10 words (shown in the UI). Examples: \"Load dataframe and summarize columns\"; \"Run test file and capture failures\"; \"Patch config key across cordis.yml files\".";
+/**
+* Thrown by `eval` when the cell itself failed — a program exception, a
+* budget expiry, an abort, or kernel death. Extends {@link HarnessError} with
+* the same `code: 'CODE_RUN_FAILED'` as upstream `CodeRunFailedError`, so
+* registry-side error taxonomy and session-log consumers see the shape they
+* already know; the registry's execution pipeline converts it into a
+* structured `isError` result whose text carries the failure kind plus the
+* captured logs, so the model can self-correct.
+*/
+var DASHRRunFailedError = class extends HarnessError {
+	constructor(message) {
+		super(message, "CODE_RUN_FAILED");
+		this.name = "DASHRRunFailedError";
+	}
+};
+/**
+* Snapshot one binding call's argument as lossless JSON, then snapshot that
+* detached value again so dispatch and logging stay independent without
+* reintroducing structured-clone's platform-specific nesting limit. Ported
+* verbatim from upstream `code-mode.ts` (`jsonNormalizeArgs`).
+*/
+function jsonNormalizeArgs(value) {
+	let snapshot;
+	try {
+		snapshot = snapshotJsonValue(value);
+	} catch (error) {
+		throw new Error(`tool arguments must be lossless JSON: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (snapshot === void 0) throw new Error("tool arguments must be lossless JSON (call the tool with an arguments object, e.g. `{}`)");
+	const logged = snapshotJsonValue(snapshot);
+	if (logged === void 0) throw new Error("tool arguments could not be detached for durable logging");
+	return {
+		dispatched: snapshot,
+		logged
+	};
+}
+/** Resolve the eval overlap cap at the config boundary (schemastery already validated the range; direct construction in tests bypasses it). */
+function resolveMaxParallelSubCalls(value) {
+	const maxParallelSubCalls = value ?? 10;
+	if (!Number.isInteger(maxParallelSubCalls) || maxParallelSubCalls < 1) throw new Error("dashr-repl: maxParallelSubCalls must be a positive integer");
+	return maxParallelSubCalls;
+}
+/** Two-space JSON presentation, matching the shallow `eval` text contract (ported). */
+const JSON_INDENT = "  ";
+/** ECMAScript caps `JSON.stringify`'s `space` string at ten characters; total indentation is capped there so formatted output stays linear (ported). */
+const MAX_JSON_INDENT_CHARS = 10;
+/** Render one non-string JSON root without recursive traversal or unbounded indentation growth (ported from upstream code-mode.ts). */
+function renderJsonValue(value) {
+	const chunks = [];
+	const tasks = [{
+		kind: "value",
+		value,
+		depth: 0,
+		compact: false
+	}];
+	for (let task = tasks.pop(); task !== void 0; task = tasks.pop()) {
+		if (task.kind === "text") {
+			chunks.push(task.text);
+			continue;
+		}
+		const current = task.value;
+		if (current === null || typeof current === "boolean" || typeof current === "number") {
+			chunks.push(String(current));
+			continue;
+		}
+		if (typeof current === "string") {
+			chunks.push(JSON.stringify(current));
+			continue;
+		}
+		const compact = task.compact || (task.depth + 1) * 2 > MAX_JSON_INDENT_CHARS;
+		const childDepth = task.depth + 1;
+		if (Array.isArray(current)) {
+			chunks.push("[");
+			if (current.length === 0) {
+				chunks.push("]");
+				continue;
+			}
+			tasks.push({
+				kind: "text",
+				text: compact ? "]" : `\n${JSON_INDENT.repeat(task.depth)}]`
+			});
+			for (let index = current.length - 1; index >= 0; index--) {
+				const item = current[index];
+				if (item === void 0) throw new Error("dashr-repl: cannot render a sparse JSON array");
+				tasks.push({
+					kind: "value",
+					value: item,
+					depth: childDepth,
+					compact
+				});
+				tasks.push({
+					kind: "text",
+					text: compact ? index === 0 ? "" : "," : `${index === 0 ? "\n" : ",\n"}${JSON_INDENT.repeat(childDepth)}`
+				});
+			}
+			continue;
+		}
+		const keys = Object.keys(current);
+		chunks.push("{");
+		if (keys.length === 0) {
+			chunks.push("}");
+			continue;
+		}
+		tasks.push({
+			kind: "text",
+			text: compact ? "}" : `\n${JSON_INDENT.repeat(task.depth)}}`
+		});
+		for (let index = keys.length - 1; index >= 0; index--) {
+			const key = keys[index];
+			if (key === void 0) throw new Error("dashr-repl: cannot render a missing JSON object key");
+			const item = current[key];
+			if (item === void 0) throw new Error("dashr-repl: cannot render an undefined JSON object property");
+			tasks.push({
+				kind: "value",
+				value: item,
+				depth: childDepth,
+				compact
+			});
+			tasks.push({
+				kind: "text",
+				text: compact ? `${index === 0 ? "" : ","}${JSON.stringify(key)}:` : `${index === 0 ? "\n" : ",\n"}${JSON_INDENT.repeat(childDepth)}${JSON.stringify(key)}: `
+			});
+		}
+	}
+	return chunks.join("");
+}
+/** Render one present cell completion value for the model-facing result text (ported). */
+function renderValue(value) {
+	return typeof value === "string" ? value : renderJsonValue(value);
+}
+/**
+* Build the `eval` {@link ToolDefinition}: required `cell` and
+* `description` parameters, executed through the dispatch bridge described
+* in the module doc. Sub-calls ride the registry's exported staged scheduler
+* (`prepare`/`dispatch`/`finalize`/`finish`) under the native concurrency
+* contract; each sub-dispatch is logged for reconstruction
+* (`tool/ptc-dispatch-start` / `tool/ptc-dispatch`) while only the outer
+* curated result enters model history.
+* @param registry - the host tool registry (sub-calls go through its staged
+*   scheduler, bindings cover its registered tools).
+* @param options - the bridge capabilities described above.
+* @returns the registry-ready definition.
+*/
+function createRunCellTool(registry, options) {
+	const { requireRuntime, maxParallel, shapeDispatchLog, warn } = options;
+	return defineTool({
+		name: EVAL_NAME,
+		description: EVAL_DESCRIPTION,
+		parameters: {
+			cell: {
+				type: "string",
+				required: true,
+				description: EVAL_CELL_PARAM_DESCRIPTION
+			},
+			description: {
+				type: "string",
+				required: true,
+				description: EVAL_DESCRIPTION_PARAM_DESCRIPTION
+			},
+			timeout: {
+				type: "number",
+				description: "Optional wall-clock budget for this cell, in seconds; the cell is interrupted (then force-stopped) if it exceeds the budget. Omit to use the runtime default."
+			},
+			reset: {
+				type: "boolean",
+				description: "Optional: reset the persistent pad namespace to EMPTY before running — variables, imports, and definitions from earlier cells are discarded and the pad restarts fresh. Omit to keep the namespace."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					logs: {
+						type: "array",
+						required: true,
+						items: { type: "string" }
+					},
+					result: { type: "json" }
+				}
+			},
+			render: (_args, value) => {
+				const rendered = value.result === void 0 ? "" : renderValue(value.result);
+				const parts = [value.logs.join("\n"), rendered].filter((part) => part.length > 0);
+				return [{
+					type: "text",
+					text: parts.length > 0 ? parts.join("\n") : `(${EVAL_NAME} completed with no output)`
+				}];
+			}
+		},
+		async execute(args, exec) {
+			if (args.description.trim().length === 0) throw new Error("dashr-repl: invalid description: expected a non-empty string");
+			const runtime = requireRuntime();
+			const runController = new AbortController();
+			const onOuterAbort = () => {
+				runController.abort(exec.signal.reason);
+			};
+			exec.signal.addEventListener("abort", onOuterAbort, { once: true });
+			let dispatches = 0;
+			const pendingQueue = [];
+			const inFlight = /* @__PURE__ */ new Set();
+			/** Tracked settle-event side work (log-content listener + append), drained at run settlement. */
+			const logWork = /* @__PURE__ */ new Set();
+			const commitQueue = [];
+			let exclusiveActive = false;
+			let driving = false;
+			let driverRun = Promise.resolve();
+			let wake;
+			const wakeup = () => {
+				const release = wake;
+				wake = void 0;
+				release?.();
+			};
+			/** The single ordered lane (ported; see the block comment above). */
+			const drive = () => {
+				if (driving) return driverRun;
+				driving = true;
+				driverRun = (async () => {
+					try {
+						for (;;) {
+							const signal = new Promise((resolve$1) => {
+								wake = resolve$1;
+							});
+							const commitHead = commitQueue[0];
+							if (commitHead !== void 0 && commitHead.settled) {
+								commitQueue.shift();
+								await commitHead.commit();
+								if (commitHead.mode === "exclusive") exclusiveActive = false;
+								continue;
+							}
+							const head = pendingQueue[0];
+							if (head !== void 0) {
+								if (runController.signal.aborted) {
+									pendingQueue.shift();
+									head.abandon();
+									continue;
+								}
+								const mode = head.classify();
+								if (!exclusiveActive && (mode === "exclusive" ? inFlight.size === 0 : inFlight.size < maxParallel)) {
+									if (mode === "exclusive") exclusiveActive = true;
+									head.mode = mode;
+									pendingQueue.shift();
+									commitQueue.push(head);
+									await head.start();
+									const flight = head.flight.finally(() => {
+										inFlight.delete(flight);
+										wakeup();
+									});
+									inFlight.add(flight);
+									continue;
+								}
+							}
+							if (pendingQueue.length === 0 && commitQueue.length === 0 && inFlight.size === 0) return;
+							await signal;
+						}
+					} catch (error) {
+						warn(`dashr-repl: dispatch lane failed (${error instanceof Error ? error.message : String(error)}); settling queued dispatches as errors`);
+						for (const entry of [...pendingQueue, ...commitQueue]) if (!entry.settled) entry.fail(error);
+						pendingQueue.length = 0;
+						commitQueue.length = 0;
+						exclusiveActive = false;
+					} finally {
+						driving = false;
+						wake = void 0;
+					}
+				})();
+				return driverRun;
+			};
+			/** Every dispatch settled AND committed; nothing can start (the run is aborted at call time). */
+			const drainDispatches = async () => {
+				await drive();
+				while (logWork.size > 0) await Promise.allSettled([...logWork]);
+			};
+			const runOver = () => runController.signal.aborted;
+			const binding = (name$1) => async (rawArgs) => {
+				if (runOver()) throw new Error(`${EVAL_NAME} run is over (${String(runController.signal.reason)}); ${name$1} not dispatched`);
+				const normalized = jsonNormalizeArgs(rawArgs);
+				const n = ++dispatches;
+				const subCallId = toolCallId(`${String(exec.callId)}:code:${n}`);
+				const input = {
+					callId: subCallId,
+					rootCallId: exec.rootCallId,
+					name: name$1,
+					arguments: normalized.dispatched,
+					...exec.agent ? { agent: exec.agent } : {},
+					parent: exec.token,
+					signal: runController.signal
+				};
+				const scheduler = registry[TOOL_RUNTIME_SCHEDULER];
+				if (scheduler === void 0) {
+					let resolvedFrom;
+					try {
+						resolvedFrom = createRequire(import.meta.url).resolve("@deepseek-ai/dsh-tools");
+					} catch {
+						resolvedFrom = "(unresolvable from the plugin position)";
+					}
+					throw new Error(`${EVAL_NAME}: the tools service mounted by this composition lacks the TOOL_RUNTIME_SCHEDULER symbol as this plugin sees it — REPL sub-dispatch cannot run. Most likely a dual-copy dsh-tools: the symbol keying the mounted ToolRuntime instance is not the symbol this plugin imported (named methods like executionMode keep working across copies; only the symbol-keyed field goes missing). This plugin resolves @deepseek-ai/dsh-tools from: ${resolvedFrom}. Check the deployed plugin's node_modules for stray @deepseek-ai entries (only schemastery and cosmokit belong there)`);
+				}
+				const outcome = await new Promise((resolve$1, reject) => {
+					let parked;
+					const settle = (result) => {
+						resolve$1(result.isError ? {
+							isError: true,
+							message: result.error.message
+						} : {
+							isError: false,
+							value: result.value
+						});
+						const agent = exec.agent;
+						if (agent === void 0) return;
+						const task = (async () => {
+							const logged = await shapeDispatchLog({
+								exec,
+								agent,
+								subCallId,
+								name: name$1,
+								isError: result.isError,
+								content: result.content
+							});
+							agent.session.append("tool/ptc-dispatch", {
+								rootCallId: exec.rootCallId,
+								parentCallId: exec.callId,
+								subCallId,
+								name: name$1,
+								arguments: normalized.logged,
+								isError: result.isError,
+								content: logged
+							});
+						})().finally(() => {
+							logWork.delete(task);
+						});
+						logWork.add(task);
+					};
+					const settleError = (error) => {
+						settle({
+							isError: true,
+							error: { message: error instanceof Error ? error.message : String(error) },
+							content: []
+						});
+					};
+					pendingQueue.push({
+						flight: Promise.resolve(),
+						settled: false,
+						classify: () => registry.executionMode(input).kind,
+						abandon: () => {
+							reject(/* @__PURE__ */ new Error(`${EVAL_NAME} run is over (${String(runController.signal.reason)}); ${name$1} tool call abandoned`));
+						},
+						fail(error) {
+							if (this.settled) return;
+							this.settled = true;
+							settleError(error);
+						},
+						async start() {
+							exec.agent?.session.append("tool/ptc-dispatch-start", {
+								rootCallId: exec.rootCallId,
+								parentCallId: exec.callId,
+								subCallId,
+								name: name$1,
+								arguments: normalized.logged
+							});
+							try {
+								const prepared = await scheduler.prepare(input);
+								if (prepared.kind === "dispatch") {
+									this.flight = scheduler.dispatch(prepared.exec).then((dispatchOutcome) => {
+										parked = {
+											kind: dispatchOutcome.kind,
+											exec: prepared.exec,
+											result: dispatchOutcome.result
+										};
+										this.settled = true;
+									}, (error) => {
+										this.settled = true;
+										settleError(error);
+									});
+									return;
+								}
+								parked = {
+									kind: prepared.kind,
+									exec: prepared.exec,
+									result: prepared.result
+								};
+								this.settled = true;
+							} catch (error) {
+								this.settled = true;
+								settleError(error);
+							}
+						},
+						async commit() {
+							if (parked === void 0) return;
+							try {
+								const result = parked.kind === "post-result" ? await scheduler.finalize(parked.exec, parked.result) : scheduler.finish(parked.exec, parked.result);
+								for (const context of result.additionalContexts ?? []) exec.deferContext(context);
+								if (result.concludesTurn) exec.concludeTurn();
+								settle(result);
+								while (logWork.size > maxParallel) await Promise.race(logWork);
+							} catch (error) {
+								settleError(error);
+							}
+						}
+					});
+					wakeup();
+					drive();
+				});
+				if (runOver()) throw new Error(`${EVAL_NAME} run is over (${String(runController.signal.reason)}); ${name$1} result discarded`);
+				if (outcome.isError) throw new Error(outcome.message);
+				return outcome.value;
+			};
+			const toolFunctions = {};
+			for (const schema of registry.schemas(exec.agent)) {
+				if (schema.name === EVAL_NAME) continue;
+				if (!isFlatBindableName(schema.name)) continue;
+				toolFunctions[schema.name] = async (args$1) => binding(schema.name)(args$1);
+			}
+			try {
+				let result;
+				try {
+					result = await runtime.run({
+						program: args.cell,
+						bindings: [{
+							global: "tool",
+							functions: { ...toolFunctions },
+							errorClass: TOOL_CALL_ERROR_CLASS
+						}],
+						signal: runController.signal,
+						...exec.agent ? { principal: exec.agent.id } : {},
+						...exec.agent ? { cwd: exec.agent.session.header.cwd } : {},
+						...typeof args.timeout === "number" && Number.isFinite(args.timeout) && args.timeout > 0 ? { timeoutMs: Math.max(1, Math.floor(args.timeout * 1e3)) } : {},
+						...args.reset === true ? { reset: true } : {}
+					});
+				} finally {
+					runController.abort(`${EVAL_NAME} settled`);
+					await drainDispatches();
+				}
+				if (result.error) {
+					const logsText = result.logs.length > 0 ? `\nCaptured output:\n${result.logs.join("\n")}` : "";
+					throw new DASHRRunFailedError(`code run failed (${result.error.kind}): ${result.error.message}${logsText}`);
+				}
+				return {
+					logs: result.logs,
+					...result.value !== void 0 ? { result: result.value } : {}
+				};
+			} finally {
+				exec.signal.removeEventListener("abort", onOuterAbort);
+			}
+		},
+		presentCall: (args) => ({
+			card: "generic",
+			title: args.description,
+			kind: "execute",
+			rawInput: args.cell
+		})
+	});
+}
+/**
+* Declare the DASHR cell presentation for every agent this composition
+* covers: the `eval` transport tool, the model-direct collapse guard, and the assembly filter that
+* leaves `eval` the only contributed tool schema.
+*
+* Mount through a preset's standing scope (`agent.cordis.yml` include row);
+* mounting unscoped is legal for a whole-process DASHR deployment and gives
+* the same shape at the global layer.
+* @param ctx - the mounting composition's context (a preset's standing scope).
+* @param config - the plugin config.
+*/
+/** The runtime slice's config keys, mirrored from `DashrRuntime.Config` in `./runtime.ts`. */
+const RUNTIME_CONFIG_KEYS = [
+	"python",
+	"cwd",
+	"startupTimeoutMs",
+	"runTimeoutMs",
+	"interruptGraceMs",
+	"interruptConfirmMs",
+	"disposeTimeoutMs",
+	"snapshotTimeoutMs",
+	"maxOutputBytes",
+	"snapshotDir",
+	"snapshotSizeCapBytes",
+	"username",
+	"kernelEnvDir",
+	"kernelPythonVersion",
+	"kernelAutoInstall"
+];
+/** The runtime slice of the merged config — the keys `DashrRuntime` owns. */
+function pickRuntimeConfig(config) {
+	const out = {};
+	for (const key of RUNTIME_CONFIG_KEYS) out[key] = config[key];
+	return out;
+}
+function apply(ctx, config) {
+	ctx.plugin(DashrRuntime, pickRuntimeConfig(config));
+	const logger = ctx.logger("dashr-repl");
+	const maxParallel = resolveMaxParallelSubCalls(config.maxParallelSubCalls);
+	{
+		const kernelConfig = pickRuntimeConfig(config);
+		resolveKernelEnv({
+			python: kernelConfig.python,
+			venvDir: kernelConfig.kernelEnvDir,
+			pythonVersion: kernelConfig.kernelPythonVersion,
+			autoInstall: kernelConfig.kernelAutoInstall ?? true,
+			log: (level, message) => {
+				logger[level](message);
+			}
+		}).catch((error) => {
+			logger.error(`dashr-repl: spin-up kernel check failed (non-blocking): ${error instanceof Error ? error.message : String(error)}`);
+		});
+	}
+	ctx.inject(["replRuntime"], (runtimeCtx) => {
+		const requireRuntime = () => {
+			const runtime = runtimeCtx.get("replRuntime");
+			if (!runtime) throw new Error("dashr-repl: eval requires an replRuntime service — load a ctx.replRuntime implementation in this composition (dashr-repl mounts one at apply)");
+			if (runtime.language !== "python") throw new Error(`dashr-repl: no cell SDK for runtime language ${JSON.stringify(runtime.language)} (dashr-repl presents Python only; got a ${JSON.stringify(runtime.language)} runtime under ctx.replRuntime)`);
+			return runtime;
+		};
+		const registry = runtimeCtx.tools;
+		const systemPrompt = runtimeCtx.get("systemPrompt");
+		if (!systemPrompt) throw new Error("dashr-repl: ctx.systemPrompt is required beside ctx.tools (the tools service itself depends on it) — this composition mounted tools without a system prompt registry");
+		const shapeDispatchLog = async (dispatch) => {
+			try {
+				const own = await runtimeCtx.waterfall(scopeTarget(registry, dispatch.agent), "dashr/repl-dispatch-log", dispatch, () => Promise.resolve(dispatch.content));
+				return await runtimeCtx.waterfall(scopeTarget(registry, dispatch.agent), "tools/ptc-dispatch-log", dispatch, () => Promise.resolve(own));
+			} catch (error) {
+				logger.warn(`dashr-repl: dispatch-log listener failed for ${dispatch.name}: ${error instanceof Error ? error.message : String(error)}; logging the original settled content`);
+				return dispatch.content;
+			}
+		};
+		const requireSubagents = () => runtimeCtx.get("subagents");
+		let serviceForAgent;
+		import("@deepseek-ai/dsh-agent-presets").then((mod) => {
+			serviceForAgent = mod.serviceForAgent;
+		}, () => {});
+		const requireWorkflowEngine = (agent) => {
+			if (agent !== void 0 && serviceForAgent !== void 0) {
+				const preset = serviceForAgent(runtimeCtx, agent, "workflowEngine");
+				if (preset !== void 0) return preset;
+			}
+			return runtimeCtx.get("workflowEngine");
+		};
+		runtimeCtx.tools.register(createRunCellTool(registry, {
+			requireRuntime,
+			maxParallel,
+			shapeDispatchLog,
+			warn: (message) => logger.warn(message)
+		}));
+		for (const bridgeTool of createAgentBridgeTools({
+			requireSubagents,
+			requireWorkflowEngine
+		})) runtimeCtx.tools.register(bridgeTool);
+		runtimeCtx.tools.register(createLlmCompletionTool({ requireLlm: () => runtimeCtx.get("llm") }));
+		const wireMasked = /* @__PURE__ */ new WeakSet();
+		runtimeCtx.on("agent/created", ({ agent }) => {
+			if (wireMasked.has(agent)) return void 0;
+			wireMasked.add(agent);
+			try {
+				captureAllTools(runtimeCtx, agent);
+				const visible = new Set(agent.ctx.tools.schemas(agent).map((schema) => schema.name));
+				const deny = [...WIRE_MASKED_NAMES].filter((name$1) => visible.has(name$1));
+				if (deny.length === 0) return void 0;
+				try {
+					agent.ctx.tools.restrict({ deny });
+					return;
+				} catch {}
+				for (const name$1 of deny) try {
+					agent.ctx.tools.restrict({ deny: [name$1] });
+				} catch {}
+			} catch (error) {
+				logger.warn(`dashr-repl: wire mask failed for agent ${agent.id}: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		});
+		systemPrompt.context({
+			name: "dashr:escalation-guidance",
+			order: ESCALATION_GUIDANCE_ORDER,
+			text: (context) => {
+				const session = context.agent?.session;
+				if (session === void 0) return "";
+				const sandboxPolicy = runtimeCtx.get("sandboxPolicy");
+				if (!sandboxPolicy) return "";
+				return sandboxPolicy.resolve({ session }).mode === "workspace-write" ? "A sandbox-deniable/denied call may be escalated with `sandbox_permissions=\"danger-full-access\"` and a one-line `justification`; the runtime will prompt for user approval. Escalation and its approval/denial are per-call." : "";
+			}
+		});
+	});
+}
+var src_default = {
+	name,
+	inject,
+	Config,
+	apply
+};
+
+//#endregion
+export { Config, DASHRRunFailedError, DashrRuntime, ESCALATION_GUIDANCE_ORDER, EVAL_NAME, MASKED_TOOL_NAMES, ReplRuntime, WIRE_MASKED_NAMES, apply, createRunCellTool, src_default as default, inject, name, resolveMaxParallelSubCalls };