synorch 0.2.0 → 0.4.0-beta.0

package/dist/harness/cli/runtime.js

@@ -0,0 +1,999 @@
+import os from "node:os";
+import path from "node:path";
+import { ASK_USER_HEADLESS_MESSAGE, askUserAnswerValue, askUserChoiceQuestion, createId, credentialRefSchema, deriveProjectId, EVENT_VERSIONS, HarnessError, parseTypedChoice, providerIdSchema, ProviderFailure, } from "../contracts/index.js";
+import { SYNORCH_VERSION } from "../../domain/product.js";
+import { authProviderFor, CLAUDE_BRIDGE_NOTICE, createCredentialStore, ProfileStateStore, } from "../auth/index.js";
+import { createCompactor, createContextBuilder, createSkillContextRegistry, createSkillLoadCallback, createSourceReader, } from "../context/index.js";
+import { createAgentDriver, recoverSession } from "../core/index.js";
+import { buildProposal, createMemoryStore, readGitBranch, resolveMemoryRoot } from "../memory/index.js";
+import { createBudgetGateSlot, createCoordinator, createDelegationSlot, createModelPlanner, createReportSlot, createWorkerFactory, delegationCallbacks, pruneOrphanedAttempts, reportCallbacks, } from "../orchestration/index.js";
+import { classifyCommand, classifyVerificationCommand, createHeadlessApprovalBroker, createPolicyEngine, createWorkspaceTrustStore } from "../policy/index.js";
+import { createAnthropicMessagesAdapter, createClaudeCodeAdapter, createModelRouter, createOpenAIChatGPTAdapter, createOpenAIResponsesAdapter, createScriptedAdapter, buildModelCatalog, bridgeEnvironment, CHATGPT_CODEX_BASE_URL, createWebSearchRunner, fetchCodexModels, findOnPath, pickCrossProviderReviewer, requestedEffort, resolveEffort, SEARCH_KEY_ENV, SYNORCH_ORIGINATOR, } from "../providers/index.js";
+import { createMcpOAuthStore, McpManager } from "../mcp/index.js";
+import { isProjectFolder } from "./project-scope.js";
+import { createBlobStore, createSessionStore } from "../store/index.js";
+import { BackgroundProcessManager, createRedactor, createSandboxRunner, createToolGateway, createToolRegistry, createWebSession, probeSandbox } from "../tools/index.js";
+import { createClaudeNativeApprovals } from "./claude-native-approvals.js";
+import { createCommandGrantStore } from "./command-grants.js";
+import { loadCanonicalStructure } from "./canonical.js";
+import { checkEndpoint, DEFAULT_ADAPTER_FOR_PROVIDER, isSynorchHome, loadRuntimeConfig, resolveHome } from "./config.js";
+import { claudeHome as resolveClaudeHome, createExtensions, gatewayHooks, nativeToolPreHook, personaModelTier, PERSONA_INSTRUCTIONS_LIMIT, renderPersonaHint } from "./extensions/index.js";
+import { withRoleDefinitions } from "./role-policy.js";
+import { plannerHint, renderProfileBlock, startProjectProfile, within } from "./project-profile.js";
+import { createOrchestrateSlot, createOrchestrateTool, createRunControlTools } from "./orchestrate-tool.js";
+import { loadScript } from "./scripted-script.js";
+import { recordTrustDecision } from "./trust.js";
+const SCRIPTED_PROVIDER = "scripted";
+const HOSTED_ALLOW = "Allow for this session";
+/**
+ * K4.1: what each `web_search` backend needs, from the logged-in identities (never a model request
+ * to decide): subscription / API-key headers, the Claude Code bridge, and user search keys from the
+ * credential store or the environment. Every resolved secret joins the gateway's redaction set.
+ */
+function webSearchSources(deps) {
+    const headersFor = async (provider, method, signal) => {
+        const auth = deps.authProvider(provider, method, "default");
+        if (auth === undefined)
+            return undefined;
+        const status = await auth.status(signal).catch(() => undefined);
+        if (status?.state !== "connected" && status?.state !== "expired")
+            return undefined;
+        const credential = await auth.resolve(signal);
+        for (const value of credential.redactionValues())
+            deps.redactionValues.add(value);
+        const headers = new Headers();
+        credential.applyTo(headers);
+        return headers;
+    };
+    return {
+        fetch: deps.fetch ?? ((input, init) => fetch(input, init)),
+        chatgpt: (signal) => headersFor("openai", "oauth-subscription", signal),
+        openaiApi: (signal) => headersFor("openai", "api-key", signal),
+        anthropicApi: (signal) => headersFor("anthropic", "api-key", signal),
+        async claudeCode() {
+            if (!(await bridgeEnabled(deps.home)))
+                return undefined;
+            const found = await findOnPath("claude", bridgeEnvironment(deps.env, {}, deps.platform), deps.platform);
+            return found === undefined ? undefined : { executable: { command: found }, env: deps.env, cwd: deps.workspaceRoot, platform: deps.platform };
+        },
+        async searchKey(backend) {
+            const fromEnv = deps.env[SEARCH_KEY_ENV[backend]]?.trim();
+            let key = fromEnv === undefined || fromEnv === "" ? undefined : fromEnv;
+            if (key === undefined) {
+                const secret = await deps
+                    .credentialStore()
+                    .get({ provider_id: providerIdSchema.parse(backend), method: "api-key", profile: "default" })
+                    .catch(() => undefined);
+                key = secret?.method === "api-key" ? secret.api_key : undefined;
+            }
+            if (key !== undefined)
+                deps.redactionValues.add(key);
+            return key;
+        },
+    };
+}
+function platformName(platform) {
+    return platform === "win32" || platform === "darwin" || platform === "linux" ? platform : "other";
+}
+function configError(message) {
+    return new HarnessError({ code: "config_invalid", message, workspace_effect: "none", retry_safe: false });
+}
+async function bridgeEnabled(home) {
+    const ref = credentialRefSchema.parse({ provider_id: "anthropic", method: "cli-bridge", profile: "default" });
+    return new ProfileStateStore(home).isAcknowledged(CLAUDE_BRIDGE_NOTICE.id, ref).catch(() => false);
+}
+async function buildAdapter(entry, fetch, env, home, claude, web) {
+    if (entry.source !== "user")
+        throw configError(`adapter ${entry.id} comes from the ${entry.source} layer; only the user configuration declares adapters`);
+    if (entry.baseUrl !== undefined && entry.kind === "openai-chatgpt") {
+        const refused = checkEndpoint(entry.kind, entry.baseUrl, false);
+        if (refused !== undefined)
+            throw configError(`adapter ${entry.id}: ${refused}`);
+    }
+    const common = { ...(fetch === undefined ? {} : { fetch }), ...(entry.baseUrl === undefined ? {} : { baseUrl: entry.baseUrl }) };
+    const hosted = web === undefined ? {} : { hostedWebSearch: web.hostedWebSearch, onHostedSearch: web.onHostedSearch };
+    switch (entry.kind) {
+        case "openai-chatgpt":
+            return withId(createOpenAIChatGPTAdapter({ ...common, ...hosted }), entry.id);
+        case "openai-responses":
+            return withId(createOpenAIResponsesAdapter({ ...common, ...hosted }), entry.id);
+        case "anthropic-messages":
+            return withId(createAnthropicMessagesAdapter(common), entry.id);
+        case "claude-code":
+            return createClaudeCodeAdapter({
+                experimental: await bridgeEnabled(home),
+                env,
+                allowNonSubscriptionAuth: entry.allowNonSubscriptionAuth === true,
+                mode: claude.mode,
+                mcpServers: claude.mcpServers,
+                permissionMode: claude.permissionMode,
+                onWebContentRead: claude.onWebContentRead,
+            });
+        case "scripted":
+            return createScriptedAdapter(await loadScript(entry.script ?? ""), {
+                adapterId: entry.id,
+                providerId: entry.provider ?? SCRIPTED_PROVIDER,
+            });
+    }
+}
+/** A configured id for a built-in adapter kind keeps the adapter's behaviour under the chosen id. */
+function withId(adapter, id) {
+    if (adapter.adapterId === id || adapter.kind !== "model")
+        return adapter;
+    return {
+        kind: "model",
+        adapterId: id,
+        providerId: adapter.providerId,
+        authMethod: adapter.authMethod,
+        discoverCapabilities: async (signal) => ({ ...(await adapter.discoverCapabilities(signal)), adapter_id: id }),
+        prepare: (request, capabilities) => adapter.prepare(request, capabilities),
+        stream: (request, credential, signal) => adapter.stream(request, credential, signal),
+        health: (signal) => adapter.health(signal),
+    };
+}
+const IMPLICIT_ADAPTERS = {
+    "openai-chatgpt": "openai-chatgpt",
+    "openai-responses": "openai-responses",
+    "anthropic-messages": "anthropic-messages",
+    "claude-code": "claude-code",
+};
+async function buildAdapters(config, overrides, env, home, claude, web) {
+    const injected = new Map((overrides.adapters ?? []).map((adapter) => [adapter.adapterId, adapter]));
+    const built = new Map();
+    for (const entry of config.adapters) {
+        if (!injected.has(entry.id))
+            built.set(entry.id, await buildAdapter(entry, overrides.fetch, env, home, claude, web));
+    }
+    for (const rule of config.router.rules) {
+        const id = rule.route.adapter_id;
+        if (built.has(id) || injected.has(id))
+            continue;
+        const kind = IMPLICIT_ADAPTERS[id];
+        if (kind === undefined) {
+            const hint = DEFAULT_ADAPTER_FOR_PROVIDER[rule.route.provider_id] === id ? " (declare it under adapters)" : "";
+            throw configError(`route for ${rule.tier} uses adapter ${id}, which is neither built in nor configured${hint}`);
+        }
+        built.set(id, await buildAdapter({ id, kind, script: undefined, provider: undefined, baseUrl: undefined, source: "user" }, overrides.fetch, env, home, claude, web));
+    }
+    return [...built.values(), ...injected.values()];
+}
+/** A non-secret credential for the scripted test provider, which sends nothing anywhere. */
+function scriptedCredential(profile) {
+    const credential = {
+        providerId: providerIdSchema.parse(SCRIPTED_PROVIDER),
+        method: "api-key",
+        profile,
+        expiresAt: undefined,
+        applyTo: () => undefined,
+        redactionValues: () => [],
+        toJSON: () => "[redacted]",
+    };
+    return Object.freeze(credential);
+}
+function observedStore(store, emit, onClose) {
+    return {
+        get sessionId() {
+            return store.sessionId;
+        },
+        get lastSeq() {
+            return store.lastSeq;
+        },
+        get quarantinedTail() {
+            return store.quarantinedTail;
+        },
+        async append(draft) {
+            const event = await store.append(draft);
+            emit(event);
+            return event;
+        },
+        read: (fromSeq, toSeq) => store.read(fromSeq, toSeq),
+        async close() {
+            onClose();
+            await store.close();
+        },
+    };
+}
+export async function createRuntime(options) {
+    const overrides = options.overrides ?? {};
+    const env = options.env;
+    const platform = overrides.platform ?? process.platform;
+    const home = overrides.home ?? resolveHome(env);
+    const workspaceRoot = path.resolve(options.workspaceRoot);
+    const config = await loadRuntimeConfig(home, workspaceRoot, options.routes ?? [], {
+        platform,
+        ...(overrides.configCeiling === undefined ? {} : { ceiling: overrides.configCeiling }),
+    });
+    // K4.1: the OpenAI adapters ask these (filled in below, once the permission mode and logs exist).
+    const webHooksState = {
+        gate: async () => false,
+        observe: () => undefined,
+        contentRead: () => undefined,
+    };
+    const webHooks = { hostedWebSearch: (request, signal) => webHooksState.gate(request, signal), onHostedSearch: (observed) => webHooksState.observe(observed) };
+    // K3: the MCP manager exists once the registry does; Claude Code native mode reads its servers at each process start.
+    const mcpHolder = { current: undefined };
+    // Read at every Claude process start, so a mode change (Shift+Tab, /permissions) applies to the next step.
+    const claude = {
+        mode: config.claudeCodeMode ?? "native",
+        mcpServers: () => mcpHolder.current?.claudeServers() ?? {},
+        permissionMode: () => permission,
+        // K4.1: a native WebSearch/WebFetch result arrived; the prompt-injection shield applies to this turn.
+        onWebContentRead: () => webHooksState.contentRead(),
+    };
+    const adapters = await buildAdapters(config, overrides, env, home, claude, webHooks);
+    // K3 cross-provider review: the best logged-in model on another provider (catalog, no paid call), cached for a few minutes.
+    const crossReviewerCache = new Map();
+    const crossProviderReviewer = async (request, signal) => {
+        const key = `${request.excludeProvider}|${request.tier}`;
+        const cached = crossReviewerCache.get(key);
+        if (cached !== undefined && Date.now() - cached.at < 5 * 60_000)
+            return cached.binding;
+        const pick = pickCrossProviderReviewer(await runtime.modelCatalog(signal), request.excludeProvider, request.tier);
+        let binding;
+        if (pick !== undefined) {
+            const adapter = await implicitAdapter(pick.adapterId).catch(() => undefined);
+            if (adapter !== undefined) {
+                if (!baseRouter.hasAdapter(adapter.adapterId))
+                    baseRouter.addAdapter(adapter);
+                if (!adapters.includes(adapter))
+                    adapters.push(adapter);
+                binding = { provider_id: pick.provider, model_id: pick.model, adapter_id: adapter.adapterId };
+            }
+        }
+        crossReviewerCache.set(key, { at: Date.now(), binding });
+        return binding;
+    };
+    const baseRouter = createModelRouter({
+        rules: config.router.rules,
+        ...(config.preferDifferentProvider === undefined ? {} : { preferDifferentProvider: config.preferDifferentProvider }),
+        ...(config.reviewCrossProvider === undefined ? {} : { reviewCrossProvider: config.reviewCrossProvider }),
+        crossProviderReviewer,
+    }, adapters);
+    /** An adapter for a built-in kind the configuration did not need yet (a provider first picked in `/model`). */
+    const implicitAdapter = async (id) => {
+        const existing = adapters.find((adapter) => adapter.adapterId === id);
+        if (existing !== undefined)
+            return existing;
+        const kind = IMPLICIT_ADAPTERS[id];
+        if (kind === undefined)
+            return undefined;
+        return buildAdapter({ id, kind, script: undefined, provider: undefined, baseUrl: undefined, source: "user" }, overrides.fetch, env, home, claude, webHooks);
+    };
+    const listeners = new Set();
+    const emit = (event) => {
+        for (const listener of listeners) {
+            try {
+                listener(event);
+            }
+            catch {
+                continue;
+            }
+        }
+    };
+    const projectId = deriveProjectId(workspaceRoot, platform);
+    const gitBranch = await readGitBranch(workspaceRoot);
+    const rawSessions = createSessionStore(home);
+    const blobs = createBlobStore(home);
+    const writers = new Map();
+    const wrap = (store) => {
+        const observed = observedStore(store, (event) => emit({ kind: "session-event", event }), () => writers.delete(store.sessionId));
+        writers.set(store.sessionId, observed);
+        return observed;
+    };
+    const configIgnored = config.warnings.slice(0, 32).map((warning) => ({ layer: warning.layer, path: warning.path, key: warning.key }));
+    const opened = async (store, parent, root) => {
+        const observed = wrap(store);
+        await observed.append({
+            type: "session/opened",
+            event_version: EVENT_VERSIONS["session/opened"],
+            actor: { kind: "system" },
+            data: {
+                writer: { name: "synorch", version: SYNORCH_VERSION },
+                project_id: projectId,
+                workspace_root: root,
+                cwd: workspaceRoot,
+                platform: platformName(platform),
+                git: gitBranch === undefined ? null : { branch: gitBranch },
+                policy_mode: options.policyMode,
+                ...(parent === undefined ? {} : { parent }),
+                ...(configIgnored.length === 0 ? {} : { config_ignored: configIgnored }),
+            },
+        });
+        return observed;
+    };
+    const sessions = {
+        create: async (manifest) => opened(await rawSessions.create(manifest), manifest.parent, manifest.workspace_root),
+        openForWrite: async (sessionId) => wrap(await rawSessions.openForWrite(sessionId)),
+        openForRead: (sessionId) => rawSessions.openForRead(sessionId),
+        fork: async (sessionId, upToSeq, forkOptions) => opened(await rawSessions.fork(sessionId, upToSeq, forkOptions), { session_id: sessionId, up_to_seq: upToSeq }, workspaceRoot),
+        list: (id) => rawSessions.list(id),
+    };
+    const wrappedAdapters = new Map();
+    const router = {
+        resolve: (request, signal) => baseRouter.resolve(request, signal),
+        reportFailure: (route, error) => baseRouter.reportFailure(route, error),
+        proposeProviderChange: (failure, context) => baseRouter.proposeProviderChange(failure, context),
+        applyProviderChange: (decision) => baseRouter.applyProviderChange(decision),
+        adapterFor(route) {
+            const adapter = baseRouter.adapterFor(route);
+            if (adapter.kind !== "model")
+                return adapter;
+            const cached = wrappedAdapters.get(adapter.adapterId);
+            if (cached !== undefined)
+                return cached;
+            const observed = {
+                kind: "model",
+                adapterId: adapter.adapterId,
+                providerId: adapter.providerId,
+                authMethod: adapter.authMethod,
+                discoverCapabilities: (signal) => adapter.discoverCapabilities(signal),
+                prepare: (request, capabilities) => adapter.prepare(request, capabilities),
+                health: (signal) => adapter.health(signal),
+                stream: (request, credential, signal) => (async function* () {
+                    for await (const event of adapter.stream(request, credential, signal)) {
+                        if (event.type === "error" && event.error.code === "quota_exhausted")
+                            baseRouter.reportFailure(request.route, event.error);
+                        emit({ kind: "stream", requestId: request.request_id, event });
+                        yield event;
+                    }
+                })(),
+            };
+            wrappedAdapters.set(adapter.adapterId, observed);
+            return observed;
+        },
+    };
+    let store;
+    const credentialStore = () => {
+        store ??= (overrides.credentialStore ?? ((root, variables) => createCredentialStore(root, { env: variables })))(home, env);
+        return store;
+    };
+    const authOptions = {
+        ...(overrides.authOptions ?? {}),
+        ...(overrides.fetch === undefined ? {} : { fetch: overrides.fetch }),
+        env,
+    };
+    const authProviders = new Map();
+    const authProvider = (providerId, method, profile) => {
+        const key = `${providerId}|${method}|${profile}`;
+        if (!authProviders.has(key)) {
+            const ref = credentialRefSchema.parse({ provider_id: providerId, method, profile });
+            authProviders.set(key, authProviderFor(credentialStore(), ref, authOptions));
+        }
+        return authProviders.get(key);
+    };
+    /** Whether an identity is usable, from its auth status only (store / env / opt-in; never a model request). */
+    const identityOf = async (provider, method, profile, signal) => {
+        if (provider === SCRIPTED_PROVIDER)
+            return { connected: true, hint: "" };
+        const scripted = adapters.find((adapter) => adapter.providerId === provider && adapter.authMethod === method && adapter.scripted === true);
+        if (scripted !== undefined)
+            return { connected: true, hint: "" };
+        const auth = authProvider(provider, method, profile);
+        if (auth === undefined)
+            return { connected: false, hint: `${provider} does not support ${method}` };
+        const status = await auth.status(signal).catch(() => undefined);
+        const state = status?.state;
+        const connected = method === "cli-bridge" ? state === "unknown" || state === "connected" : state === "connected" || state === "expired";
+        const login = method === "cli-bridge" ? `syn login ${provider} --method cli-bridge` : method === "api-key" ? `syn login ${provider} --method api-key` : `syn login ${provider}`;
+        return { connected, hint: connected ? "" : `${status?.detail ?? state ?? "not logged in"}; run ${login}` };
+    };
+    const redactionValues = new Set();
+    const credentials = async (route, signal, resolveOptions) => {
+        if (route.provider_id === SCRIPTED_PROVIDER ||
+            adapters.some((adapter) => adapter.adapterId === route.adapter_id && (adapter.providerId === SCRIPTED_PROVIDER || adapter.scripted === true))) {
+            return scriptedCredential(route.profile);
+        }
+        const auth = authProvider(route.provider_id, route.auth_method, route.profile);
+        if (auth === undefined) {
+            throw new ProviderFailure({
+                code: "unauthenticated",
+                message: `no auth provider supports ${route.provider_id} ${route.auth_method} (profile ${route.profile}); run syn login ${route.provider_id}`,
+                retryable: false,
+            });
+        }
+        const credential = await auth.resolve(signal, resolveOptions);
+        for (const value of credential.redactionValues())
+            redactionValues.add(value);
+        return credential;
+    };
+    const canonical = await loadCanonicalStructure(workspaceRoot);
+    // Never awaited here: the first token must not wait for a cold detection (cached profiles load in ms).
+    const profile = startProjectProfile(home, projectId, workspaceRoot);
+    const profileText = async () => {
+        const known = profile.current() ?? (await within(profile.ready, 1_500));
+        return known === undefined ? undefined : renderProfileBlock(known);
+    };
+    const trustStore = createWorkspaceTrustStore(home, { platform });
+    const stored = trustStore.status(workspaceRoot);
+    let trustState = !stored.trusted && options.trustWorkspace === true ? { ...stored, trusted: true, source: "flag", reason: undefined } : stored;
+    let permission = options.permissionMode;
+    let gitPushApproved = false;
+    // Full access and auto (owner revision 3) imply trust for this runtime only, never saved; leaving them returns to the recorded trust.
+    const effectiveTrust = () => trustState.trusted || (permission !== "full" && permission !== "auto") ? trustState : { ...trustState, trusted: true, source: "session", reason: undefined };
+    const trust = {
+        file: trustStore.file,
+        state: effectiveTrust,
+        recorded: () => trustState,
+        async grant(source) {
+            const granted = await trustStore.grant(workspaceRoot, source);
+            if (granted.trusted) {
+                trustState = granted;
+                await recordTrustDecision(home, workspaceRoot, platform, "trust/granted", granted, source);
+            }
+            return granted;
+        },
+        grantSession() {
+            if (!trustState.trusted)
+                trustState = { ...trustState, trusted: true, source: "session", reason: undefined };
+            return trustState;
+        },
+    };
+    // Started in the home folder (or a folder that is no project): the user's own ~/.mcp.json, ~/.claude/skills are not a repository's.
+    const projectScope = isProjectFolder(workspaceRoot, env.HOME ?? env.USERPROFILE ?? os.homedir(), platform);
+    // K7: skills, commands and plugins; repository items follow the live trust state.
+    const extensions = await createExtensions({
+        home,
+        workspaceRoot,
+        env,
+        platform,
+        claudeHome: overrides.claudeHome ?? (overrides.home === undefined ? resolveClaudeHome(env) : undefined),
+        settings: config.extensions,
+        trusted: () => effectiveTrust().trusted,
+        canonicalCatalog: canonical.skills,
+        canonical: { origin: canonical.origin, skills: canonical.skillEntries },
+        skipProjectSynorch: isSynorchHome(path.join(workspaceRoot, ".synorch"), home, platform),
+        skipProjectScope: !projectScope,
+    });
+    const webSession = createWebSession({ home });
+    webHooksState.contentRead = () => webSession.markContentRead();
+    const policy = withRoleDefinitions(createPolicyEngine({
+        synorchHome: home,
+        workspaceTrusted: () => effectiveTrust().trusted,
+        permissionMode: () => permission,
+        webDomains: () => webSession.domains(),
+        webContentRead: () => webSession.contentRead(),
+        gitPushApproved: () => gitPushApproved,
+    }), canonical.roles);
+    const webSearch = createWebSearchRunner({
+        provider: () => config.web.searchProvider,
+        model: () => config.web.searchModel,
+        sources: webSearchSources({ env, home, workspaceRoot, platform, fetch: overrides.fetch, authProvider, credentialStore, redactionValues }),
+    });
+    const sandbox = overrides.sandbox ?? (await probeSandbox({ platform }));
+    const runner = createSandboxRunner(sandbox, { untrustedRoots: [workspaceRoot, home] });
+    const userConfig = config.userPolicy === undefined ? undefined : { policy: config.userPolicy };
+    const workspaceConfig = config.workspacePolicy === undefined ? undefined : { policy: config.workspacePolicy };
+    const memoryRoot = config.memory?.root !== undefined ? resolveMemoryRoot(config.memory, projectId, os.homedir()) : path.join(home, "memory", projectId);
+    const memory = createMemoryStore(memoryRoot, { workspaceRoot });
+    const delegation = createDelegationSlot();
+    const reports = createReportSlot();
+    const skillContext = createSkillContextRegistry();
+    let userPrompt;
+    let userChoice;
+    const askUserQuestions = async (questions, signal) => {
+        const prompt = userPrompt;
+        if (prompt === undefined)
+            return { kind: "unavailable" };
+        const choose = userChoice;
+        const answers = {};
+        for (const question of questions) {
+            const choice = askUserChoiceQuestion(question);
+            let answer;
+            if (choose !== undefined)
+                answer = await choose(choice, signal);
+            else
+                answer = parseTypedChoice(choice, await prompt(question.question, question.options.map((option) => option.label), signal));
+            if (answer === undefined)
+                return { kind: "dismissed" };
+            answers[question.question] = askUserAnswerValue(answer);
+        }
+        return { kind: "answered", answers: { answers } };
+    };
+    const processes = new BackgroundProcessManager();
+    const registry = createToolRegistry({
+        processes,
+        classifyCommand: (argv, scope) => classifyCommand(argv, scope),
+        web: { session: webSession, search: webSearch, transport: { allowPrivate: config.web.allowPrivate } },
+        control: {
+            ...delegationCallbacks(delegation),
+            ...reportCallbacks(reports),
+            // Only catalog skills the caller's role may use (never widening a read scope to .ai/**); a skill
+            // already in the caller's context is not served again (ADR-20). One registry is shared with the
+            // ContextBuilder, which records what each build injected.
+            loadSkill: createSkillLoadCallback({ skills: extensions.skills, registry: skillContext }),
+            async askUser(input, context) {
+                if ((context.role !== "orchestrator" && context.role !== "session") || userPrompt === undefined) {
+                    return { status: "error", text: "", truncated: false, redactions: 0, error: { code: "approval_unavailable", message: ASK_USER_HEADLESS_MESSAGE } };
+                }
+                const outcome = await askUserQuestions(input.questions, context.signal);
+                if (outcome.kind === "unavailable") {
+                    return { status: "error", text: "", truncated: false, redactions: 0, error: { code: "approval_unavailable", message: ASK_USER_HEADLESS_MESSAGE } };
+                }
+                if (outcome.kind === "dismissed") {
+                    return {
+                        status: "error",
+                        text: "",
+                        truncated: false,
+                        redactions: 0,
+                        error: { code: "approval_rejected", message: "the user dismissed the question without answering; do not assume an answer: continue with what you can decide safely, or ask again in plain text" },
+                    };
+                }
+                return { status: "ok", text: `The user answered: ${JSON.stringify(outcome.answers)}`.slice(0, 16 * 1024), truncated: false, redactions: 0 };
+            },
+            async memoryPropose(input, context) {
+                // K2 decision desk: `{ kind, title, body }` is enough; a conversation turn (no run) proposes as `session`.
+                const parsed = buildProposal(input, { projectId, branch: gitBranch, runId: context.runId, taskId: context.taskId, role: context.role, toolCallId: context.toolCallId, now: new Date() });
+                if (!parsed.ok) {
+                    return { status: "error", text: "", truncated: false, redactions: 0, error: { code: "invalid_arguments", message: parsed.message } };
+                }
+                await memory.propose(parsed.proposal);
+                return { status: "ok", text: `proposal ${parsed.proposal.proposal_id} queued for the user's review (/memory review); it is not memory until accepted`, truncated: false, redactions: 0 };
+            },
+        },
+    });
+    const orchestrate = createOrchestrateSlot();
+    registry.register(createOrchestrateTool(orchestrate));
+    for (const tool of createRunControlTools(orchestrate))
+        registry.register(tool);
+    // K3 MCP client: servers are resolved now (no process starts); sessions call startSession().
+    const mcp = new McpManager({
+        home,
+        workspaceRoot,
+        workspaceKey: trustState.root,
+        environment: env,
+        registry,
+        clientVersion: SYNORCH_VERSION,
+        user: { config: config.mcp.user, file: config.mcp.userFile },
+        project: { config: config.mcp.project, file: config.mcp.projectFile },
+        platform,
+        // MCP results are untrusted like web content: the outward-action shield applies for the rest of the turn.
+        onUntrustedContent: () => webSession.markContentRead(),
+        addRedaction: (value) => redactionValues.add(value),
+        plugins: () => extensions.mcpServers(),
+        oauth: createMcpOAuthStore(credentialStore),
+        projectScope,
+    });
+    await mcp.load();
+    mcpHolder.current = mcp;
+    // K4.1 native OpenAI search: on in auto/full/plan, one question per session in ask, headless only with web.openai_hosted: true.
+    let hostedConsent;
+    webHooksState.gate = async (_request, signal) => {
+        const setting = config.web.openaiHosted;
+        if (setting === false)
+            return false;
+        if (permission === undefined)
+            return setting === true;
+        if (permission !== "ask")
+            return true;
+        if (hostedConsent !== undefined)
+            return hostedConsent;
+        const prompt = userPrompt;
+        if (prompt === undefined)
+            return false;
+        const answer = await prompt("Let the OpenAI model search the web natively during this session? (Otherwise Synorch's web_search asks you at every search.)", [HOSTED_ALLOW, "Not now"], signal).catch(() => "");
+        hostedConsent = answer.trim() === HOSTED_ALLOW;
+        return hostedConsent;
+    };
+    const requestSessions = new Map();
+    webHooksState.observe = (observed) => {
+        webSession.markContentRead();
+        const sessionId = requestSessions.get(observed.requestId);
+        const writer = sessionId === undefined ? undefined : writers.get(sessionId);
+        if (writer === undefined)
+            return;
+        for (const query of observed.queries.slice(0, 16)) {
+            void writer
+                .append({
+                type: "web/searched",
+                event_version: EVENT_VERSIONS["web/searched"],
+                actor: { kind: "system" },
+                data: { provider: "openai-hosted", query: query.slice(0, 500), sources: Math.min(1000, observed.sources.length), request_id: observed.requestId },
+            })
+                .catch(() => undefined);
+        }
+    };
+    // K4.1 bookkeeping from the session events: turn boundaries (shield), URLs the user typed (robots.txt), request → log, domain grants.
+    const approvalHosts = new Map();
+    listeners.add((event) => {
+        if (event.kind !== "session-event")
+            return;
+        const recorded = event.event;
+        const conversation = recorded.run_id === undefined && recorded.attempt_id === undefined;
+        if (recorded.type === "turn/started" && conversation)
+            webSession.startTurn();
+        else if (recorded.type === "message/recorded" && conversation && recorded.data.message?.role === "user") {
+            for (const part of recorded.data.message.content)
+                if (part.type === "text")
+                    webSession.noteUserText(part.text);
+        }
+        else if (recorded.type === "model/request_prepared") {
+            requestSessions.set(recorded.data.request_id, recorded.session_id);
+            if (requestSessions.size > 256)
+                requestSessions.delete(requestSessions.keys().next().value ?? "");
+        }
+        else if (recorded.type === "approval/requested" && recorded.data.request.hosts !== undefined) {
+            approvalHosts.set(recorded.data.request.approval_id, recorded.data.request.hosts);
+        }
+        else if (recorded.type === "approval/decided") {
+            const hosts = approvalHosts.get(recorded.data.decision.approval_id);
+            approvalHosts.delete(recorded.data.decision.approval_id);
+            if (hosts === undefined || recorded.data.decision.decided_by !== "user" || recorded.data.decision.outcome !== "allowed-for-scope")
+                return;
+            const writer = writers.get(recorded.session_id);
+            for (const host of hosts) {
+                void webSession
+                    .allowDomain(host)
+                    .then((added) => added && writer !== undefined
+                    ? writer.append({ type: "network/host_allowed", event_version: EVENT_VERSIONS["network/host_allowed"], actor: { kind: "user" }, data: { host, scope: "global" } })
+                    : undefined)
+                    .catch(() => undefined);
+            }
+        }
+    });
+    const budgetGate = createBudgetGateSlot();
+    const context = createContextBuilder({
+        readSession: async (sessionId) => writers.get(sessionId) ?? (await rawSessions.openForRead(sessionId)),
+        blobs,
+        tools: registry,
+        sources: createSourceReader(workspaceRoot),
+        instructions: canonical.instructions,
+        skills: extensions.skills,
+        skillContext,
+        // K7: Claude Code native routes load Claude's own skills themselves.
+        claudeNativeRoute: (route) => route.adapter_kind === "agent-backend" && (config.claudeCodeMode ?? "native") === "native",
+        memory: { store: memory, projectId, branch: gitBranch },
+        budget: budgetGate,
+        compactor: createCompactor({ blobs, writerFor: (sessionId) => writers.get(sessionId) }),
+        platform,
+        projectProfile: profileText,
+    });
+    /**
+     * ADR-18 D1 / review R4: the harness runs a packet's verification commands itself after the
+     * worker's turn, as a system call through the tool gateway into the attempt's session log: the
+     * same pipeline as any `exec` (normalization, the credential-in-arguments check, the policy
+     * engine with the packet's exact verification commands, workspace trust and dependency-link
+     * rules, the sandbox runner, redaction) and the same `tool/*` audit events, with `actor.kind:
+     * system` and no short ref. A command the policy does not allow outright is not run (a system
+     * call never asks): `not-run` + reason. The class (`classifyVerificationCommand`) says whether a
+     * passed run can prove behaviour (review R1/R2).
+     */
+    const verificationGateways = new WeakMap();
+    const verificationBroker = createHeadlessApprovalBroker({ mode: options.policyMode });
+    const verification = async (request) => {
+        const started = Date.now();
+        const commandClass = classifyVerificationCommand(request.argv);
+        const notRun = (reason) => ({ status: "not-run", commandClass, exitCode: null, output: "", durationMs: Date.now() - started, reason: reason.slice(0, 500) });
+        const events = request.events;
+        if (events === undefined)
+            return notRun("no attempt log is open to record the run");
+        let gateway = verificationGateways.get(events);
+        if (gateway === undefined) {
+            gateway = createToolGateway({ events, blobs, registry, policy, approvals: verificationBroker, sandbox: runner, redactionValues: () => [...redactionValues], platform });
+            verificationGateways.set(events, gateway);
+        }
+        try {
+            const toolCallId = createId("toolCall");
+            const outcome = await gateway.invoke({ tool_call_id: toolCallId, provider_call_id: `harness-verification-${toolCallId}`, tool_name: "exec", arguments: { argv: [...request.argv] } }, { runId: request.runId, taskId: request.taskId, attemptId: request.attemptId, role: request.role, policy: request.policy, actor: "system" }, request.signal);
+            const result = outcome.result;
+            if (result.exit_code === undefined && (outcome.state === "denied" || (outcome.state === "cancelled" && outcome.decision?.decision !== "allow"))) {
+                return notRun(`${outcome.state === "denied" ? "refused" : "cancelled"}: ${result.error?.message ?? "the gateway did not run it"}`);
+            }
+            let full = result.text;
+            if (result.blob !== undefined && result.blob.media_type.startsWith("text/")) {
+                full = await blobs.get(result.blob.digest).then((bytes) => Buffer.from(bytes).toString("utf8"), () => result.text);
+            }
+            const output = `${full}${result.error === undefined ? "" : `\n${result.error.message}`}`;
+            const termination = result.exit_code !== undefined ? "exited" : result.error?.code === "timeout" ? "timeout" : result.error?.code === "cancelled" ? "cancelled" : "spawn-failed";
+            const exitCode = result.exit_code ?? null;
+            const passed = termination === "exited" && exitCode === 0;
+            return { status: passed ? "passed" : "failed", commandClass, termination, exitCode, output, durationMs: Date.now() - started };
+        }
+        catch (error) {
+            return notRun(`the harness could not run it: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    // Claude Code native mode: its permission prompts go to the same broker as the gateway's (ADR-08 revision 2026-09-24).
+    const redactText = createRedactor(() => [...redactionValues]);
+    const backendRedact = (text) => redactText(text).text;
+    // K7 hooks: PreToolUse / PostToolUse on the gateway; on Claude native built-ins only Synorch's own hooks (Claude runs its plugins' hooks itself).
+    const hookNotice = (message) => emit({ kind: "notice", level: "warning", message: backendRedact(message) });
+    const toolHooks = gatewayHooks(extensions.hooks, { workspaceRoot, permissionMode: () => permission, notify: hookNotice });
+    const backendApprovals = (broker) => {
+        const native = createClaudeNativeApprovals({
+            broker,
+            permissionMode: () => permission,
+            commandGrants: () => createCommandGrantStore(home, effectiveTrust().root).list(),
+            redact: backendRedact,
+            web: { domains: () => webSession.domains(), environment: env },
+            askUser: (questions, signal) => askUserQuestions(questions, signal),
+        });
+        return async (toolName, input, context, signal) => {
+            const denied = await nativeToolPreHook(extensions.hooks, { toolName, toolInput: input, sessionId: context.runId ?? "session", workspaceRoot, permissionMode: permission, notify: hookNotice }, signal).catch(() => undefined);
+            if (denied !== undefined)
+                return { allow: false, reason: `PreToolUse hook: ${denied}`.slice(0, 1000) };
+            return native(toolName, input, context, signal);
+        };
+    };
+    // K6 reasoning effort: session levels (`/effort`, `--effort <tier>=`) > `--effort <level>` > config role > config tier.
+    const sessionEfforts = new Map();
+    for (const entry of options.efforts ?? [])
+        if (entry.tier !== undefined)
+            sessionEfforts.set(entry.tier, entry.level);
+    const flagEffort = options.efforts?.find((entry) => entry.tier === undefined)?.level;
+    const effortNotices = new Set();
+    const configuredEffort = { ...config.effort };
+    const effortFor = (tier, role, route, hint) => {
+        // The conversation (role session) may run on the orchestrator route: its own `session` level comes first.
+        const conversation = role === "session";
+        const requested = requestedEffort({
+            session: (conversation ? sessionEfforts.get("session") : undefined) ?? sessionEfforts.get(tier),
+            flag: flagEffort,
+            role: role === undefined || role === "orchestrator" ? undefined : configuredEffort[role],
+            tier: configuredEffort[tier],
+            hint,
+        });
+        return resolveEffort(requested, { provider: route.provider_id, model: route.model_id, adapterId: route.adapter_id });
+    };
+    const stepEffort = (input) => {
+        const tier = input.route.tier ?? (input.role === "session" ? "session" : input.role === "orchestrator" ? "orchestrator" : "complex_worker");
+        // K6: the orchestrator's per-task hint fills in only where the user set nothing.
+        const hint = input.packet?.effort;
+        const resolution = effortFor(tier, input.role, input.route, hint);
+        // A clamp is said once per level and model, never silently (a clamped task hint is not the user's setting: no notice).
+        if (resolution.notice !== undefined && resolution.requested !== hint && !effortNotices.has(resolution.notice)) {
+            effortNotices.add(resolution.notice);
+            emit({ kind: "notice", level: "info", message: resolution.notice });
+        }
+        return resolution.effective;
+    };
+    const createDriver = (broker) => (events) => createAgentDriver({
+        events,
+        blobs,
+        router,
+        context,
+        tools: registry,
+        gateway: createToolGateway({ events, blobs, registry, policy, approvals: broker, sandbox: runner, redactionValues: () => [...redactionValues], hooks: toolHooks }),
+        credentials,
+        backendApprovals: backendApprovals(broker),
+        backendRedact,
+        reasoningEffort: stepEffort,
+    });
+    const runtime = {
+        home,
+        workspaceRoot,
+        projectId,
+        platform,
+        policyMode: options.policyMode,
+        config,
+        canonical,
+        profile,
+        sessions,
+        blobs,
+        router,
+        adapters,
+        policy,
+        registry,
+        processes,
+        sandbox,
+        trust,
+        memory,
+        memoryRoot,
+        gitBranch,
+        context,
+        budgetGate,
+        credentials,
+        orchestrate,
+        web: webSession,
+        mcp,
+        extensions,
+        credentialStore,
+        authProvider,
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        bindUserPrompt(prompt, choose) {
+            userPrompt = prompt;
+            userChoice = choose;
+            return () => {
+                if (userPrompt === prompt) {
+                    userPrompt = undefined;
+                    userChoice = undefined;
+                }
+            };
+        },
+        askUserQuestions,
+        brokerFor(interactive) {
+            // Workers follow the session's permission mode (ADR-08 revision 3): what asks in auto/full (outward writes, destructive commands) reaches the user.
+            if ((options.policyMode === "ask" || permission !== undefined) && interactive !== undefined && interactive.availability !== "headless")
+                return interactive;
+            return createHeadlessApprovalBroker({ mode: options.policyMode });
+        },
+        createDriver,
+        createSessionDriver(broker, events, wrap) {
+            return createAgentDriver({
+                events,
+                blobs,
+                router,
+                context,
+                tools: registry,
+                gateway: wrap(createToolGateway({ events, blobs, registry, policy, approvals: broker, sandbox: runner, redactionValues: () => [...redactionValues], platform, hooks: toolHooks })),
+                credentials,
+                backendApprovals: backendApprovals(broker),
+                backendRedact,
+                reasoningEffort: stepEffort,
+            });
+        },
+        sessionPolicy(commandGrants) {
+            return policy.compute({
+                mode: options.policyMode,
+                role: "session",
+                runId: undefined,
+                taskId: undefined,
+                workspaceRoot,
+                taskScope: undefined,
+                userConfig,
+                workspaceConfig,
+                sandbox,
+                grants: [],
+                commandGrants,
+                ...(permission === undefined ? {} : { permissionMode: permission }),
+            });
+        },
+        permissionMode: () => permission,
+        setPermissionMode(mode) {
+            permission = mode;
+        },
+        approveGitPushForSession() {
+            gitPushApproved = true;
+        },
+        createCoordinator(broker) {
+            const driverFor = createDriver(broker);
+            return createCoordinator({
+                sessions,
+                blobs,
+                router,
+                policy,
+                approvals: broker,
+                planner: createModelPlanner({
+                    createDriver: driverFor,
+                    blobs,
+                    projectHint: () => {
+                        const known = profile.current();
+                        return known === undefined ? undefined : plannerHint(known);
+                    },
+                    personaHint: () => renderPersonaHint(extensions.personas.list()),
+                    personaTier: (agent) => personaModelTier(extensions.personas.find(agent)?.model),
+                }),
+                personas: (id) => {
+                    const agent = extensions.personas.find(id);
+                    return agent === undefined ? undefined : { id: agent.id, instructions: agent.body.slice(0, PERSONA_INSTRUCTIONS_LIMIT) };
+                },
+                sandbox,
+                createWorkers: createWorkerFactory({
+                    sessions,
+                    blobs,
+                    router,
+                    policy,
+                    createDriver: driverFor,
+                    sandbox,
+                    worktreesRoot: path.join(home, "worktrees"),
+                    userConfig,
+                    workspaceConfig,
+                    platform,
+                    verification,
+                    reports,
+                }),
+                budgetGate,
+                delegation,
+                userConfig,
+                workspaceConfig,
+                platform,
+                workspaceTrust: effectiveTrust,
+                ...(overrides.limits === undefined ? {} : { limits: overrides.limits }),
+            });
+        },
+        routeRules: () => baseRouter.rules(),
+        async setSessionRoute(tier, role, binding) {
+            const adapter = await implicitAdapter(binding.adapter_id);
+            if (adapter === undefined)
+                throw configError(`adapter ${binding.adapter_id} is neither built in nor configured`);
+            if (adapter.providerId !== binding.provider_id)
+                throw configError(`adapter ${adapter.adapterId} belongs to ${adapter.providerId}, not ${binding.provider_id}`);
+            const identity = await identityOf(adapter.providerId, adapter.authMethod, binding.profile ?? "default", new AbortController().signal);
+            if (!identity.connected)
+                throw configError(`${adapter.providerId} (${adapter.authMethod}) is not logged in: ${identity.hint}`);
+            if (!baseRouter.hasAdapter(adapter.adapterId)) {
+                baseRouter.addAdapter(adapter);
+                if (!adapters.includes(adapter))
+                    adapters.push(adapter);
+            }
+            return baseRouter.setSessionRule(tier, role, binding);
+        },
+        clearSessionRoute: (tier, role) => baseRouter.clearSessionRule(tier, role),
+        effortFor,
+        setSessionEffort(tier, level) {
+            if (level === undefined)
+                sessionEfforts.delete(tier);
+            else
+                sessionEfforts.set(tier, level);
+        },
+        setConfiguredEffort(slot, level) {
+            if (level === undefined)
+                delete configuredEffort[slot];
+            else
+                configuredEffort[slot] = level;
+        },
+        async modelCatalog(signal, catalogOptions = {}) {
+            const pool = [...adapters];
+            for (const id of Object.keys(IMPLICIT_ADAPTERS)) {
+                if (pool.some((adapter) => adapter.adapterId === id))
+                    continue;
+                const built = await implicitAdapter(id).catch(() => undefined);
+                if (built !== undefined)
+                    pool.push(built);
+            }
+            return buildModelCatalog({
+                adapters: pool,
+                rules: baseRouter.rules(),
+                identity: (provider, method) => identityOf(provider, method, "default", signal),
+                ...(catalogOptions.listing === true
+                    ? {
+                        listed: async (adapter) => {
+                            if (adapter.kind !== "model" || adapter.authMethod !== "oauth-subscription" || adapter.providerId !== "openai")
+                                return undefined;
+                            const auth = authProvider("openai", "oauth-subscription", "default");
+                            if (auth === undefined)
+                                return undefined;
+                            const credential = await auth.resolve(signal);
+                            const headers = new Headers({ accept: "application/json", originator: SYNORCH_ORIGINATOR });
+                            credential.applyTo(headers);
+                            return fetchCodexModels(overrides.fetch ?? fetch, headers, signal, CHATGPT_CODEX_BASE_URL);
+                        },
+                    }
+                    : {}),
+            });
+        },
+        async recover(sessionId) {
+            const isIdempotent = (name) => registry.get(name)?.metadata.idempotent ?? false;
+            const reports = [];
+            const log = await sessions.openForWrite(sessionId);
+            const attemptSessions = [];
+            try {
+                reports.push(await recoverSession(log, { isIdempotent }));
+                for await (const item of log.read()) {
+                    if (item.status === "ok" && item.event.type === "attempt/started" && item.event.data.session_id !== undefined) {
+                        attemptSessions.push(item.event.data.session_id);
+                    }
+                }
+            }
+            finally {
+                await log.close();
+            }
+            for (const attempt of attemptSessions) {
+                const events = await sessions.openForWrite(attempt).catch(() => undefined);
+                if (events === undefined)
+                    continue;
+                try {
+                    let last;
+                    for await (const item of events.read())
+                        if (item.status === "ok")
+                            last = item.event;
+                    if (last?.type === "turn/ended" && events.quarantinedTail === undefined)
+                        continue;
+                    if (last?.type === "session/resumed")
+                        continue;
+                    reports.push(await recoverSession(events, { isIdempotent }));
+                }
+                finally {
+                    await events.close();
+                }
+            }
+            // SEC-M3: crashed attempts leave worktrees and scoped-dir writes behind; only orphans whose owner process is gone are touched.
+            await pruneOrphanedAttempts({ worktreesRoot: path.join(home, "worktrees"), projectId, workspaceRoot, platform }).catch(() => undefined);
+            return reports;
+        },
+    };
+    return runtime;
+}
+//# sourceMappingURL=runtime.js.map