talos-code 0.0.1 → 0.2.0

package/dist/runtime/talos-composition.js

@@ -0,0 +1,1011 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { providerLabelText } from "../provider/provider-text.js";
+/* R5a lane R: the runtime facts (S1-S7, owner decisions Q-R5-3…Q-R5-11). */
+import { secretValuesFromEnvironment } from "../diagnostics/redact.js";
+import { isTestProfile } from "../provider/store.js";
+import { compactionEvent, createCliEventHub, createRunObserver, RETRY_AFTER_MAX_MS, summaryRequestedEvent } from "./provider-attempts.js";
+import { createToolOutputStore, pruneToolOutput } from "./output-store.js";
+import { withArchivableCapture } from "./context-archive.js";
+import { CONTEXT_ENGINE_MIN_WINDOW, configureModelProfiles, createModelsDevLoader, modelProfile, modelProfileEvidence, ollamaWindow, rememberOllamaWindow, setModelOverrides } from "./model-profile.js";
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { randomUUID } from 'node:crypto';
+import { rm, rmdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { createSessionFacade } from "./session-facade.js";
+import { CliRuntimeError } from "./types.js";
+import { openCredentialStore } from "../provider/store.js";
+import { missingKeyText, useProviderRegistry } from "../provider/missing-key.js";
+import { loadEffectiveConfig } from "../config/load.js";
+import { configSet } from "../config/commands.js";
+import { createTuiCatalogService, keyBench, unusableKeyRefusal } from "../tui/catalog-service.js";
+import { createGuardedPluginTrustVerifier, pluginReviewFromSnapshot, scanPluginPackage } from "../security/plugin-guard.js";
+import { createTrustAuthority } from "../security/trust-authority.js";
+import { createBrokeredKernelExecutor } from "./brokered-executor.js";
+import { createCheckpointStore } from "../workspace/checkpoint-store.js";
+import { developmentLog, developmentLogError } from "../diagnostics/development-log.js";
+import { attachKeyOrigin, createEnvironmentKeyConsent, describeKeyOrigin, providerOfModel } from "../provider/environment-keys.js";
+import { createProviderControlPlane } from "../provider/control-plane.js";
+function remapService(s) { return s.replace(/^talos-harness-/u, 'talos-cli-'); }
+function contextProfileValue(value) { return Number.isSafeInteger(value) && Number(value) > 0 ? Number(value) : null; }
+export function createCliContextBridge({ repoRoot, paths, registry, providerRegistry, providerStore, ownerRuntime, chatImageStore, separaFonteModello, prepareProfile, onSummaryRequest }) {
+    /*
+     * ⭐ R5a lane R, S2 (owner decision Q-R5-3): the profile — window and reserve — comes from `modelProfile` (model-profile.ts),
+     * which layers the person's override, a local Ollama's own window, the provider's rows, the registry's documented rows and
+     * the models.dev catalogue. Before R5 only a registry or store row carrying BOTH a window and an output limit made a profile
+     * (5 of the registry's 49 rows, all Z.ai), so for every other model the Context Engine stayed off: no 50 % rule, the kernel's
+     * every-8-calls compaction and its silent 8,000-character cut instead (gate finding 2). A model with a known window now gets
+     * the Context Engine. The risks of that switch, and what is done about each, are measured in r5a-r-context-engine.test.ts:
+     * the token counter's preflight (below), the reserve the kernel sends as `max_tokens`, and the switch mid-session when a
+     * window becomes known between two runs.
+     */
+    const profileForSelection = (selected) => {
+        const provider = typeof selected?.provider === 'string' ? selected.provider : null, model = typeof selected?.model === 'string' ? selected.model : null;
+        if (!provider || !model)
+            return null;
+        if (contextProfileValue(selected.windowTokens) && contextProfileValue(selected.responseReserve) && selected.windowTokens > selected.responseReserve)
+            return selected.windowTokens >= CONTEXT_ENGINE_MIN_WINDOW ? selected : null;
+        const profile = modelProfile({ provider, model });
+        /* R5a owner decision: below 64k the Context Engine cannot hold TALOS's own instructions and tools; the simple mode stays. */
+        if (!profile || profile.windowTokens < CONTEXT_ENGINE_MIN_WINDOW || profile.windowTokens <= profile.responseReserve)
+            return null;
+        const evidence = modelProfileEvidence({ provider, model });
+        return { provider, model, windowTokens: profile.windowTokens, responseReserve: profile.responseReserve, profileEvidence: { source: evidence?.source ?? profile.source, date: evidence?.date ?? profile.date } };
+    };
+    const profileForSession = (sessionId, session) => {
+        session ??= registry.leggiSessioneContesto?.(sessionId) ?? null;
+        if (!session)
+            return null;
+        if (session.provider === 'local')
+            return null;
+        let selected = null;
+        try {
+            selected = typeof separaFonteModello === 'function' ? separaFonteModello(String(session.modello ?? '')) : null;
+        }
+        catch {
+            selected = null;
+        }
+        if (!selected?.fonte || !selected?.modelloRemoto)
+            return null;
+        const profile = profileForSelection({ provider: selected.fonte, model: selected.modelloRemoto });
+        if (!profile)
+            return null;
+        return { ...profile, requestOptions: session.reasoning == null ? {} : { reasoning: structuredClone(session.reasoning) } };
+    };
+    /* R5a lane R: the asynchronous sources of a session's model (the override file, a local Ollama, models.dev) are brought up
+       to date before the profile decides, each bounded by its own timeout; a source that does not answer leaves the profile as
+       it was. */
+    const prepareForSession = async (sessionId) => {
+        if (!prepareProfile)
+            return;
+        const session = registry.leggiSessioneContesto?.(sessionId) ?? null;
+        if (!session || session.provider === 'local')
+            return;
+        let selected = null;
+        try {
+            selected = typeof separaFonteModello === 'function' ? separaFonteModello(String(session.modello ?? '')) : null;
+        }
+        catch {
+            selected = null;
+        }
+        if (!selected?.fonte || !selected?.modelloRemoto)
+            return;
+        try {
+            await prepareProfile(selected.fonte, selected.modelloRemoto);
+        }
+        catch { /* a source that fails is no source */ }
+    };
+    let loaded = null;
+    const load = () => loaded ??= (async () => {
+        const contextRoot = join(repoRoot, 'context-engine', 'src'), harnessRoot = join(repoRoot, 'harness-ui', 'src');
+        const [engineModule, storeModule, adapterModule, serviceModule, counterModule] = await Promise.all([
+            import(__rewriteRelativeImportExtension(pathToFileURL(join(contextRoot, 'engine.mjs')).href)),
+            import(__rewriteRelativeImportExtension(pathToFileURL(join(contextRoot, 'node', 'sqlite-store.mjs')).href)),
+            import(__rewriteRelativeImportExtension(pathToFileURL(join(harnessRoot, 'context-provider-adapter.mjs')).href)),
+            import(__rewriteRelativeImportExtension(pathToFileURL(join(harnessRoot, 'context-desktop-service.mjs')).href)),
+            import(__rewriteRelativeImportExtension(pathToFileURL(join(harnessRoot, 'context-token-counters.mjs')).href)),
+        ]);
+        const store = storeModule.createSqliteContextStore({ databasePath: join(paths.dataRoot, 'context', 'context.sqlite') });
+        const tokenCounter = counterModule.createContextTokenCounter({
+            resolveProfile: async (model) => {
+                let runtime = {};
+                try {
+                    runtime = providerStore.getRuntime?.(model.provider) ?? {};
+                }
+                catch {
+                    runtime = {};
+                }
+                let key = null;
+                try {
+                    key = providerStore.getKey?.(model.provider) ?? null;
+                }
+                catch {
+                    key = null;
+                }
+                return {
+                    baseURL: runtime.endpoint ?? providerRegistry[model.provider]?.baseUrl,
+                    apiKey: key,
+                    nativeRequestBuilder: (request) => counterModule.buildPreparedDesktopContextRequest(request, chatImageStore ? { resolveImages: (messages) => chatImageStore.resolveMessages(messages) } : {}),
+                };
+            },
+            /*
+             * ⛔ R5a lane R, S2 risk 1 (measured, r5a-r-context-engine.test.ts): before each model request the counter POSTs the prepared
+             *   request, with the key, to a count endpoint. Only three providers document one (OpenAI `/responses/input_tokens`,
+             *   Anthropic `/messages/count_tokens`, Gemini `:countTokens`); for every other one the kernel guesses
+             *   `/chat/completions/input_tokens`, which no provider in the registry documents — an extra request per turn that at
+             *   best answers 404 (then the counter estimates), and at worst 400/401/403/429, which fails the counter
+             *   (`CTX_TOKEN_HTTP`/`CTX_TOKEN_AUTH`, context-token-counters.mjs:99-101) and with it EVERY turn. So the guessed endpoint is
+             *   never sent (the counter gets the 404 it already treats as "estimate", and the measurement says `heuristic`), and a
+             *   documented one that fails, or cannot be reached, is read the same way: a count that could not be taken is an
+             *   estimate, never a failed turn.
+             */
+            fetchFn: async (url, options) => {
+                const notCounted = () => new Response(null, { status: 404 });
+                if (/\/chat\/completions\/input_tokens$/u.test(new URL(url).pathname))
+                    return notCounted();
+                try {
+                    const response = await fetch(url, options);
+                    if (response.ok)
+                        return response;
+                    try {
+                        await response.body?.cancel();
+                    }
+                    catch { /* not read */ }
+                    return notCounted();
+                }
+                catch (error) {
+                    if (options?.signal?.aborted)
+                        throw error;
+                    return notCounted();
+                }
+            },
+        });
+        const adapter = adapterModule.createContextModelAdapter({
+            resolveModel: ({ sessionModel, settings }) => {
+                const selected = settings?.model?.mode === 'explicit' ? settings.model : sessionModel;
+                const profile = profileForSelection(selected);
+                if (!profile)
+                    throw Object.assign(new Error('Context profile unavailable.'), { code: 'CTX_MODEL_NOT_CONFIGURED' });
+                return profile;
+            },
+            /* R5b (R5a open 2): every summary the Context Engine asks for is counted, so a turn can say how many were billed. */
+            callModel: (request) => { try {
+                onSummaryRequest?.();
+            }
+            catch { /* a counter never stops a summary */ } return ownerRuntime.callContextModel(request); },
+        });
+        const engine = engineModule.createContextEngine({ store, model: adapter, tokenCounter });
+        const service = serviceModule.createDesktopContextService({
+            engine, store,
+            readSession: (sessionId) => registry.leggiSessioneContesto?.(sessionId) ?? null,
+            isSessionEnabled: (sessionId) => Boolean(profileForSession(sessionId)),
+            resolveSessionModel: ({ sessionId, session }) => {
+                const profile = profileForSession(sessionId, session);
+                if (!profile)
+                    throw Object.assign(new Error('Context profile unavailable.'), { code: 'CTX_MODEL_NOT_CONFIGURED' });
+                return profile;
+            },
+            onEvent: (input) => registry.pubblicaEventoContesto(input),
+        });
+        await store.health();
+        return { store, service };
+    })();
+    const ensureSettings = async (service, sessionId) => {
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const snapshot = await service.request({ sessionId, method: 'GET', path: '/' });
+            const currentTarget = typeof snapshot?.settings?.targetRatio === 'number' ? snapshot.settings.targetRatio : null;
+            const targetRatio = currentTarget !== null && currentTarget > 0 && currentTarget < 0.5 ? currentTarget : 0.49;
+            if (snapshot?.settings?.auto === true && snapshot?.settings?.triggerRatio === 0.5 && snapshot?.settings?.targetRatio === targetRatio)
+                return snapshot;
+            try {
+                await service.request({ sessionId, method: 'PATCH', path: '/settings', body: { expectedRevision: snapshot.revision, idempotencyKey: 'cli-m6e-' + randomUUID(), patch: { auto: true, triggerRatio: 0.5, targetRatio } } });
+                return service.request({ sessionId, method: 'GET', path: '/' });
+            }
+            catch (error) {
+                if (error?.code !== 'CTX_STALE_REVISION' || attempt === 1)
+                    throw error;
+            }
+        }
+        return service.request({ sessionId, method: 'GET', path: '/' });
+    };
+    return {
+        /* P12: `capture` archives only whole tool exchanges (context-archive.ts), so an interrupted turn cannot leave an
+           unanswered call in the archive that the history then drops (CTX_HISTORY_DIVERGED on every later turn). */
+        async hooks(input) { await prepareForSession(input.sessionId); const profile = profileForSession(input.sessionId); if (!profile)
+            return undefined; const { service } = await load(); await ensureSettings(service, input.sessionId); return withArchivableCapture(await service.createKernelHooks(input)); },
+        async compact(input) { await prepareForSession(input.sessionId); const profile = profileForSession(input.sessionId); if (!profile)
+            return undefined; const { service } = await load(); await ensureSettings(service, input.sessionId); return service.compact(input); },
+        async status(sessionId) {
+            await prepareForSession(sessionId);
+            const profile = profileForSession(sessionId);
+            if (!profile)
+                return { unavailableReason: 'profile-unavailable' };
+            const { store } = await load();
+            const snapshot = await store.readContextSnapshot({ sessionId });
+            const currentTarget = typeof snapshot?.settings?.targetRatio === 'number' ? snapshot.settings.targetRatio : null;
+            const targetRatio = currentTarget !== null && currentTarget > 0 && currentTarget < 0.5 ? currentTarget : 0.49;
+            const effective = snapshot ?? { revision: 0, measurement: null, activeVersion: null };
+            return { ...effective, settings: { ...(snapshot?.settings ?? {}), auto: true, triggerRatio: 0.5, targetRatio }, cliProfileEvidence: profile.profileEvidence ?? null };
+        },
+        async close() { if (!loaded)
+            return; const { service, store } = await loaded; try {
+            await service.close();
+        }
+        finally {
+            await store.close();
+        } },
+    };
+}
+export function scopeCliKeyring(raw) { if (!raw)
+    return null; return { get: (s, a) => raw.get(remapService(s), a), set: (s, a, v) => raw.set(remapService(s), a, v), remove: (s, a) => raw.remove(remapService(s), a) }; }
+/** The kernel modules the product composes with. Exported so a test can observe one of them while every other stays the production one. */
+export async function loadModules(repoRoot) { const src = join(repoRoot, 'harness-ui', 'src'); const [cred, owner, agent, sessions, plugins, search, duck, providerRegistry, probe, destination, readiness, chatImages] = await Promise.all([import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'provider-credential-store.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'runtime-owner-adapter.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'agent-service.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'session-registry.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'plugin-registry.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'search-source-store.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'duckduckgo-search.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'provider-registry.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'provider-probe.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'model-destination.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'sessione-pronta.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'chat-image-attachments.mjs')).href))]); return { createProviderCredentialStore: cred.createProviderCredentialStore, createOwnerRuntimeAdapter: owner.createOwnerRuntimeAdapter, creaFetchMultiProvider: owner.creaFetchMultiProvider, compattaSessione: agent.compattaSessione, chiediAlModelloUnaVolta: agent.chiediAlModelloUnaVolta, avviaSessione: agent.avviaSessione, eseguiComandoDiretto: agent.eseguiComandoDiretto, createSessionRegistry: sessions.createSessionRegistry, verificaTrustPlugin: plugins.verificaTrustPlugin, createSearchSourceStore: search.createSearchSourceStore, creaTrasportoSenzaChiave: duck.creaTrasportoSenzaChiave, ENDPOINT_SENTINELLA_DUCKDUCKGO: duck.ENDPOINT_SENTINELLA_DUCKDUCKGO, REGISTRO_FORNITORI: providerRegistry.REGISTRO_FORNITORI, createProviderProbe: probe.createProviderProbe, separaFonteModello: destination.separaFonteModello, creaProntoFn: readiness.creaProntoFn, createChatImageStore: chatImages.createChatImageStore }; }
+async function loadTrustSupport(repoRoot) {
+    const src = join(repoRoot, 'harness-ui', 'src');
+    const [plugins, hooks, mcp, mcpSession, pluginSession] = await Promise.all([import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'plugin-registry.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'hook-registry.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'mcp-registry.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'mcp-session.mjs')).href)), import(__rewriteRelativeImportExtension(pathToFileURL(join(src, 'plugin-session.mjs')).href))]);
+    return { caricaPlugin: plugins.caricaPlugin, fidaPlugin: plugins.fidaPlugin, caricaHooks: hooks.caricaHooks, fidaHook: hooks.fidaHook, eseguiHook: hooks.eseguiHook, caricaServerMcp: mcp.caricaServerMcp, fidaServerMcp: mcp.fidaServerMcp, preparaToolMcpPerSessione: mcpSession.preparaToolMcpPerSessione, nomeEspostoMcp: mcpSession.nomeEspostoMcp, preparaToolPluginPerSessione: pluginSession.preparaToolPluginPerSessione };
+}
+/**
+ * ⭐ B1 slice 18 — THE ENVIRONMENT THAT REACHES THE CREDENTIAL STORE.
+ *
+ * `environmentKeys:'use'` hands the store the whole environment, as before: a non-interactive run
+ * (`talos -p`, CI) uses a key it finds there and states where it came from.
+ * `environmentKeys:'consent'` hands it the environment WITHOUT any provider-key variable whose current
+ * value has not been approved in `/provider` (`provider/environment-keys.ts`). The default is
+ * `consent`: a caller that forgets to choose gets the closed behaviour, not the open one.
+ * ⛔ The store reads the environment once, when it is built, and the kernel keeps a reference to it.
+ *   An answer given mid-session therefore rebuilds the store behind a forwarder whose identity never
+ *   changes, so the kernel sees the approved key from the next request on.
+ */
+function forwardingStore(current, shape) { const out = {}; for (const name of Object.keys(shape ?? {})) {
+    if (typeof shape[name] === 'function')
+        out[name] = (...args) => current()[name](...args);
+} return Object.freeze(out); }
+export async function composeTalosRuntime({ repoRoot, projectRoot, paths, model, env = process.env, environmentKeys = 'consent', modules, keyring, brokerFactory }) {
+    const m = modules ?? await loadModules(repoRoot);
+    const trustM = modules ? m : { ...m, ...await loadTrustSupport(repoRoot) }; /*
+      * R2 (gate E13, Q-R2-5): the store comes from the ONE resolver (`provider/store.ts`), `system` or `memory`, chosen by
+      * TALOS_CREDENTIAL_STORE or `credentials.store`; a test profile that asks for `system` is refused here, before the native module
+      * is resolved. An injected `keyring` (tests, `create-runtime.ts` input) is used as given. A configuration that cannot be read
+      * leaves the choice to the variable and the default: the config layer reports its own error where the person looks.
+      */
+    let storeConfig = null;
+    if (keyring === undefined) {
+        try {
+            storeConfig = (await loadEffectiveConfig({ paths, projectRoot })).value;
+        }
+        catch {
+            storeConfig = null;
+        }
+    }
+    const opened = keyring === undefined ? openCredentialStore({ repoRoot, scope: paths.dataRoot, env: { ...process.env, ...env }, config: storeConfig }) : null;
+    const credentialStore = opened ? { kind: opened.kind, source: opened.source, testProfile: opened.testProfile } : null;
+    const raw = keyring === undefined ? opened.keyring : keyring;
+    const cliKeyring = scopeCliKeyring(raw);
+    const providerRegistry = m.REGISTRO_FORNITORI ?? {};
+    /* R2 (E8): the missing-key sentence reads the label and the first variable from this registry. */
+    useProviderRegistry(providerRegistry);
+    const consent = createEnvironmentKeyConsent({ dataRoot: paths.dataRoot, registry: providerRegistry, env });
+    const storeEnvironment = () => environmentKeys === 'use' ? env : consent.environmentForStore();
+    const buildStore = () => { const built = m.createProviderCredentialStore({ env: storeEnvironment(), keyring: cliKeyring, runtimeFile: join(paths.dataRoot, 'provider-runtime.json') }); built.loadFromKeyring?.(); return built; };
+    let currentStore = buildStore();
+    const providerStore = environmentKeys === 'use' ? currentStore : forwardingStore(() => currentStore, currentStore);
+    const answerEnvironmentKey = (id, answer) => { consent.answer(id, answer); currentStore = buildStore(); };
+    const kernel = join(repoRoot, 'harness-ui', 'src', 'kernel', 'talosHarness.mjs');
+    const destinazioneModelloDeps = { leggiChiave: (p) => { try {
+            return providerStore.getKey(p);
+        }
+        catch {
+            return null;
+        } }, leggiRuntime: (p) => { try {
+            return providerStore.getRuntime(p);
+        }
+        catch {
+            return {};
+        } }, localePronto: () => false };
+    const chatImageStore = typeof m.createChatImageStore === 'function' ? m.createChatImageStore({ rootDir: join(paths.dataRoot, 'chat-images') }) : null;
+    const ownerRuntime = m.createOwnerRuntimeAdapter({ modulePath: kernel, providerStore, openRouterRuntimeFn: () => { try {
+            return providerStore.getRuntime('openrouter');
+        }
+        catch {
+            return { timeoutSeconds: 60 };
+        } }, destinazioneModelloDeps, ...(chatImageStore ? { resolveImagesFn: (messages) => chatImageStore.resolveMessages(messages) } : {}) });
+    let taskCatalogProvider = null;
+    try {
+        taskCatalogProvider = await ownerRuntime.taskCatalogProvider?.();
+    }
+    catch {
+        taskCatalogProvider = null;
+    }
+    let searchSourceStore = null;
+    let ricercaWebFn = undefined;
+    if (m.createSearchSourceStore) {
+        searchSourceStore = m.createSearchSourceStore({ env, keyring: cliKeyring, file: join(paths.dataRoot, 'search-source.json') });
+        const transport = m.creaTrasportoSenzaChiave?.();
+        ricercaWebFn = () => searchSourceStore.perKernel({ trasportoSenzaChiave: transport, sentinellaDuckDuckGo: m.ENDPOINT_SENTINELLA_DUCKDUCKGO });
+    }
+    const trustAuthority = createTrustAuthority({ projectRoot, trustRoot: paths.trust.projects });
+    const verificaTrustHookFn = async ({ hookId }) => trustAuthority.verifyScope({ kind: 'hook', id: hookId });
+    const verificaTrustMcpFn = async ({ serverId }) => trustAuthority.verifyScope({ kind: 'mcp', id: serverId });
+    const verificaTrustPluginFn = createGuardedPluginTrustVerifier({ projectRoot, inspectReview: () => trustAuthority.inspect(), verifyTrusted: async ({ pluginId }) => trustAuthority.verifyScope({ kind: 'plugin', id: pluginId }) });
+    async function loadedPlugin(pluginId) {
+        if (typeof trustM.caricaPlugin !== 'function')
+            throw Object.assign(new Error('PLUGIN_REGISTRY_UNAVAILABLE'), { code: 'PLUGIN_REGISTRY_UNAVAILABLE' });
+        const loaded = await trustM.caricaPlugin({ cartella: projectRoot });
+        const plugin = loaded.plugin?.find((row) => row.id === pluginId);
+        if (!plugin)
+            throw Object.assign(new Error('PLUGIN_NOT_FOUND'), { code: 'PLUGIN_NOT_FOUND' });
+        return plugin;
+    }
+    async function assertPluginAllowed(pluginId) {
+        const reviewed = await trustAuthority.inspect();
+        const plugin = await loadedPlugin(pluginId);
+        const expectedReview = pluginReviewFromSnapshot(reviewed, pluginId);
+        const guard = await scanPluginPackage({ projectRoot, plugin: { id: plugin.id, tools: plugin.tools ?? [], hooks: plugin.hooks ?? [] }, expectedReview });
+        if (guard.verdict === 'dangerous')
+            throw Object.assign(new Error('PLUGIN_DANGEROUS'), { code: 'PLUGIN_DANGEROUS', guard });
+        return { plugin, reviewed };
+    }
+    async function pluginIdForHook(hookId) {
+        if (typeof trustM.caricaPlugin !== 'function')
+            return null;
+        const loaded = await trustM.caricaPlugin({ cartella: projectRoot });
+        for (const plugin of loaded.plugin ?? [])
+            for (const hook of plugin.hooks ?? [])
+                if (`plugin:${plugin.id}:${hook.id}` === hookId)
+                    return String(plugin.id);
+        return null;
+    }
+    async function executePluginHookWithAuthority(input) {
+        const hookId = String(input?.hook?.id ?? '');
+        const pluginId = await pluginIdForHook(hookId);
+        if (!pluginId)
+            return { consentito: false, motivo: 'TALOS cannot resolve the plugin owner for this hook, so it was not executed.' };
+        try {
+            await assertPluginAllowed(pluginId);
+            if (!await trustAuthority.verifyScope({ kind: 'plugin', id: pluginId }))
+                return { consentito: false, motivo: 'The plugin changed or is no longer trusted, so its hook was not executed.' };
+        }
+        catch {
+            return { consentito: false, motivo: 'TALOS could not verify this plugin package safely, so its hook was not executed.' };
+        }
+        if (typeof trustM.eseguiHook !== 'function')
+            return { consentito: false, motivo: 'The plugin hook executor is unavailable, so the hook was not executed.' };
+        return trustM.eseguiHook(input);
+    }
+    const statoTrustPluginFn = async ({ pluginId, hash }) => {
+        const fidato = await verificaTrustPluginFn({ cartellaTrust: 'authority', pluginId, hash });
+        if (fidato)
+            return { fidato: true, motivo: 'fidato', frase: null };
+        const snapshot = await trustAuthority.inspect();
+        const prefix = `.harness-ui-plugins/${pluginId}/`;
+        const rows = snapshot.resources.filter(row => row.kind === 'plugin' && row.relativePath.startsWith(prefix));
+        const changed = rows.some(row => row.state === 'changed' || row.state === 'removed');
+        return { fidato: false, motivo: changed ? 'contenuto-cambiato' : 'mai-approvato', frase: changed ? 'The plugin content no longer matches the TALOS project trust record.' : 'This plugin is not trusted by the TALOS project authority.' };
+    };
+    /* R4 Q-R4-17: a folder trusted for this session only keeps nothing on disk — no mirror outside a run's own folder. */
+    async function writeMcpMirror(serverId, hash) { if (await trustAuthority.sessionGrant())
+        return; const roots = await trustAuthority.compatibilityRoots(); await rm(join(roots.mcp, `${serverId}.json`), { force: true }); if (typeof trustM.fidaServerMcp === 'function')
+        await trustM.fidaServerMcp({ cartellaTrust: roots.mcp, serverId, hash }); }
+    async function writePluginMirror(pluginId, hash) { if (await trustAuthority.sessionGrant())
+        return; const roots = await trustAuthority.compatibilityRoots(); await rm(join(roots.plugins, `${pluginId}.json`), { force: true }); if (typeof trustM.fidaPlugin === 'function')
+        await trustM.fidaPlugin({ cartellaTrust: roots.plugins, pluginId, hash }); }
+    const fidaHookFn = async ({ hookId }) => { await trustAuthority.trustScope({ kind: 'hook', id: hookId }); return { fidato: true }; };
+    const fidaServerMcpFn = async ({ serverId, hash }) => { await trustAuthority.trustScope({ kind: 'mcp', id: serverId }); await writeMcpMirror(serverId, hash); return { fidato: true }; };
+    const fidaPluginFn = async ({ pluginId, hash }) => { const review = await assertPluginAllowed(pluginId); await trustAuthority.trustScope({ kind: 'plugin', id: pluginId }, { expected: review.reviewed }); await writePluginMirror(pluginId, hash); return { fidato: true }; };
+    async function sessionCompatibility() {
+        const base = await trustAuthority.compatibilityRoots();
+        const launchId = randomUUID();
+        const roots = { hooks: base.hooks, mcp: join(base.mcp, 'runs', launchId), plugins: join(base.plugins, 'runs', launchId) };
+        if (typeof trustM.caricaServerMcp === 'function' && typeof trustM.fidaServerMcp === 'function') {
+            const loaded = await trustM.caricaServerMcp({ cartella: projectRoot });
+            for (const server of loaded.server ?? [])
+                if (await trustAuthority.verifyScope({ kind: 'mcp', id: server.id }))
+                    await trustM.fidaServerMcp({ cartellaTrust: roots.mcp, serverId: server.id, hash: server.hash });
+        }
+        if (typeof trustM.caricaPlugin === 'function' && typeof trustM.fidaPlugin === 'function') {
+            const reviewed = await trustAuthority.inspect();
+            const loaded = await trustM.caricaPlugin({ cartella: projectRoot });
+            for (const plugin of loaded.plugin ?? []) {
+                const expectedReview = pluginReviewFromSnapshot(reviewed, plugin.id);
+                const guard = await scanPluginPackage({ projectRoot, plugin: { id: plugin.id, tools: plugin.tools ?? [], hooks: plugin.hooks ?? [] }, expectedReview });
+                if (guard.verdict !== 'dangerous' && await trustAuthority.verifyScope({ kind: 'plugin', id: plugin.id }))
+                    await trustM.fidaPlugin({ cartellaTrust: roots.plugins, pluginId: plugin.id, hash: plugin.hash });
+            }
+        }
+        /* After a session-only run the folders this run created go too, emptiest first; a folder another run still uses is not empty and stays. */
+        const leftovers = [join(base.mcp, 'runs'), join(base.plugins, 'runs'), base.mcp, base.plugins, base.hooks, dirname(base.hooks), dirname(dirname(base.hooks))];
+        const cleanup = async () => {
+            await Promise.all([rm(roots.mcp, { recursive: true, force: true }), rm(roots.plugins, { recursive: true, force: true })]);
+            if (await trustAuthority.sessionGrant())
+                for (const folder of leftovers)
+                    await rmdir(folder).catch(() => { });
+        };
+        return { roots, cleanup };
+    }
+    /*
+     * ⭐⭐⭐ B1 slice 8 — IL COMANDO DIGITATO DALLA PERSONA PASSA DAL BROKER.
+     *
+     * `createSessionRegistry` accetta da sempre `eseguiComandoDirettoFn` (session-registry.mjs L1329) e
+     * `eseguiComandoDiretto` accetta da sempre `eseguiComandoSandboxatoFn` (agent-service.mjs L1975):
+     * qui si usano quei due seam gia' esistenti invece di scrivere un secondo esecutore. Cosi' il
+     * vocabolario di eventi, l'accorpamento dei pezzi e la cucitura in cronologia restano UNO SOLO.
+     *
+     * ⛔ `brokerFactory` resta FACOLTATIVO qui e il suo default resta `undefined`, cioe' «nessun
+     *   broker consultato, comportamento di ripiego puro»: questa funzione e' PARAMETRICA e non
+     *   sceglie.
+     * ⭐ B1 fetta 12 — CHI SCEGLIE E' L'INGRESSO. `createCliRuntime`/`createCliRuntimeContext`
+     *   (`create-runtime.ts`) passano ora il broker VERO (`createCliExecutionBroker`) per default,
+     *   costruito UNA volta per runtime; chi compone puo' ancora sovrascriverlo. Chi legge questo
+     *   commento non deve dedurne che il CLI giri senza broker: senza `brokerFactory` e' questa
+     *   COMPOSIZIONE a girare senza, non il prodotto.
+     * ⛔ Il kernel si carica PIGRAMENTE: nessun comando digitato, nessun costo all'avvio.
+     */
+    /*
+     * ⭐ R5a lane R, S6 (owner decision Q-R5-10): a command's full output is kept in a private file of ITS session
+     * (output-store.ts). The session is known where the command starts — a model run (`talosLavoraConBroker`, below) or the
+     * person's `!` command (`shell`, below) — and reaches the executor through this async scope; a command outside any session
+     * keeps no file, and its marker says so. Folders of sessions that no longer exist are removed at start.
+     */
+    const toolOutputScope = new AsyncLocalStorage();
+    const toolOutputStore = createToolOutputStore({ dataRoot: paths.dataRoot, secretValues: secretValuesFromEnvironment({ ...process.env, ...env }) });
+    void pruneToolOutput({ dataRoot: paths.dataRoot, sessionsRoot: paths.sessionsRoot }).catch(() => { });
+    /* R5a lane R, S3/S4: the CLI's own live facts per session (provider-attempts.ts), merged into `subscribe` below. */
+    const cliEvents = createCliEventHub();
+    const brokeredExecutor = createBrokeredKernelExecutor({
+        keepFullOutput: async (text) => { const sessionId = toolOutputScope.getStore()?.sessionId; return sessionId ? toolOutputStore.save({ sessionId, text }) : null; },
+        kernel: async () => (await import(__rewriteRelativeImportExtension(pathToFileURL(kernel).href))),
+        ...(brokerFactory ? {
+            broker: brokerFactory({ paths: { cacheRoot: paths.cacheRoot }, platform: process.platform }),
+            /* F16 hardening, kept: the product asks for the verified AppContainer/BFS sandbox, never a weaker one, network denied.
+               R0 lane S, owner decision 1 (2026-09-23): when no verified sandbox exists the command runs on the host, DECLARED
+               (`⛶ host · not isolated` and why) instead of being refused; `true` here is the strict switch (gate E7). */
+            network: 'deny',
+            requiredEnforcement: 'windows-sandbox',
+            requireVerifiedIsolation: false,
+        } : {}),
+    });
+    /* M1-E: model-owned shell uses the same CLI broker as the direct-command path.
+       Broker assignment is last so runtime input cannot replace the product-selected executor. */
+    const modelCheckpointStore = paths.checkpointsRoot ? createCheckpointStore({ rootDir: paths.checkpointsRoot, projectRoot }) : null;
+    let modelCheckpointBlockedError = null;
+    const talosLavoraConBroker = async (runtimeInput) => {
+        const { checkpointSessionId, checkpointOperation, ...kernelInput } = runtimeInput ?? {};
+        const operation = checkpointOperation === 'resume' || checkpointOperation === 'fork' ? checkpointOperation : 'start';
+        const checkpointState = { promise: null };
+        const beforeMutation = async (azione) => {
+            if (modelCheckpointBlockedError)
+                throw modelCheckpointBlockedError;
+            if (!modelCheckpointStore)
+                return;
+            if (!checkpointState.promise) {
+                const started = performance.now();
+                developmentLog('checkpoint.lazy.begin', { operation, sessionId: checkpointSessionId ?? null, actionType: azione?.tipo ?? null }, 'debug', 'runtime-composition');
+                checkpointState.promise = modelCheckpointStore.begin({ operation, ...(typeof checkpointSessionId === 'string' && checkpointSessionId ? { sessionId: checkpointSessionId } : {}) })
+                    .then(handle => { developmentLog('checkpoint.lazy.ready', { operation, sessionId: checkpointSessionId ?? null, checkpointId: handle.id, durationMs: performance.now() - started }, 'info', 'runtime-composition'); return handle; })
+                    .catch(error => { modelCheckpointBlockedError = error; developmentLogError('checkpoint.lazy.failure', error, { operation, sessionId: checkpointSessionId ?? null, actionType: azione?.tipo ?? null, durationMs: performance.now() - started }, 'runtime-composition'); throw error; });
+            }
+            await checkpointState.promise;
+        };
+        let result;
+        let runError = null;
+        /*
+         * ⭐ R5a lane R, S3/S4/S7 (owner decisions Q-R5-4, Q-R5-6, Q-R5-11): the run's observer wraps the innermost transport the
+         *   owner adapter uses (`input.fetchDiRete`, runtime-owner-adapter.mjs:1193, the global fetch until now) and receives the
+         *   kernel's retry waits (the owner's amendment: `retryAfterMaxMs`, `onRetryWait`); the kernel marks the 8,000-character cut
+         *   of a tool result (`toolResultCutMarker`). Assigned after the runtime input, like the executor, so input cannot remove them.
+         */
+        const runSession = typeof checkpointSessionId === 'string' && checkpointSessionId ? checkpointSessionId : null;
+        const observer = runSession ? createRunObserver({ sessionId: runSession, hub: cliEvents, baseFetch: typeof kernelInput.fetchDiRete === 'function' ? kernelInput.fetchDiRete : (input, init) => fetch(input, init) }) : null;
+        try {
+            result = await toolOutputScope.run({ sessionId: runSession }, () => ownerRuntime.talosLavora({ ...kernelInput,
+                ...(observer ? { fetchDiRete: observer.fetchDiRete, onRetryWait: observer.onRetryWait, retryAfterMsFn: observer.retryAfterMsFn } : {}), retryAfterMaxMs: RETRY_AFTER_MAX_MS, toolResultCutMarker: true,
+                primaDiMutazioneFn: beforeMutation, eseguiComandoSandboxatoFn: brokeredExecutor }));
+        }
+        catch (error) {
+            runError = error;
+            observer?.announceFailure(error);
+        }
+        const pendingCheckpoint = checkpointState.promise;
+        if (pendingCheckpoint) {
+            let handle = null;
+            try {
+                handle = await pendingCheckpoint;
+            }
+            catch { /* begin failure was already logged/refused at the action boundary */ }
+            if (handle) {
+                const started = performance.now();
+                try {
+                    await handle.finalize();
+                    developmentLog('checkpoint.lazy.finalized', { operation, sessionId: checkpointSessionId ?? null, checkpointId: handle.id, durationMs: performance.now() - started }, 'info', 'runtime-composition');
+                }
+                catch (error) {
+                    modelCheckpointBlockedError = error;
+                    developmentLogError('checkpoint.lazy.finalize_failure', error, { operation, sessionId: checkpointSessionId ?? null, checkpointId: handle.id, durationMs: performance.now() - started }, 'runtime-composition');
+                    if (!runError)
+                        runError = error;
+                }
+            }
+        }
+        if (runError)
+            throw runError;
+        return result;
+    };
+    /*
+     * ⭐ B1 slice 24 — COMPACTION AND THE RESEARCH JUDGE REACH THE PROVIDER OF THE MODEL THEY NAME.
+     *
+     * ⭐ B1 slice 25 — KEPT, BY MEASUREMENT, AFTER CLI-REQ-05 LANDED. The kernel at e7b3a1b6 (`harness-ui/` from ba420a95) now
+     *   names the session's own model when it compacts (`session-registry.mjs:4502-4514`, `modelloDiSessionePerRete` at `:145`) and
+     *   hands both calls `fetchDiRete: fetchModelloFn()` (`:4513`, and the judge through `creaChiediAlModelloGiudice`, `:224-229`).
+     *   Slice 24's eleven tests (`test/runtime/auxiliary-provider-route.test.ts`), measured on both routes, hermetic:
+     *   - these two functions injected, with `prontoFn` and `fetchModelloFn` wired: 11 of 11 pass;
+     *   - the two functions and the compaction scope removed in favour of the kernel's route (`fetchModelloFn` = the guarded route
+     *     below): 6 of 11. Failing: no key and an unapproved environment key end `{ok:true, compattato:false}` instead of
+     *     `PROVIDER_KEY_MISSING` (the kernel swallows the failed call, `kernel/talosHarness.mjs:260-265`); the kernel is handed the
+     *     OpenRouter key (`chiaveFn`) instead of the placeholder, so a request the route did not rewrite is not refused; a local
+     *     session answers `compattato:false` instead of a refusal, and a compaction outside the session runtime is sent; two
+     *     compactions overlap. ⇒ The injection stays. `fetchModelloFn` is wired to the same guarded route (`registry`, below), so
+     *     no kernel path that asks for it reaches a bare `fetch`; the two functions here keep building their own route, because
+     *     they report the code it raised before the network.
+     *
+     * Kernel lines relied on, read at 5e05de8e:
+     *  - `session-registry.mjs:4217` `compatta()` calls `compattaSessioneFn({messaggiFinali, modello, chiave})`, and `:1712-1716` the
+     *    research judge calls `chiediAlModelloUnaVoltaFn({modello, chiave, prompt})`; the defaults (`:1326`, `:1564`) are
+     *    `agent-service.mjs:1905` `compattaSessione` and `:1946` `chiediAlModelloUnaVolta`, which hand `fetchDiRete` to `chiamaConRitenta`.
+     *  - `kernel/talosHarness.mjs:1249-1253` `chiamaConRitenta` runs the call inside `fetchDiRete.eseguiConFallback` when it exists;
+     *    otherwise `:1308` posts to the fixed `https://openrouter.ai/api/v1/chat/completions` with the key it was given.
+     *  - `runtime-owner-adapter.mjs:654` `creaFetchMultiProvider`: only WITH a `providerStore` does it return `eseguiConFallback`
+     *    (`:660`, and without it an OpenRouter model goes back to the kernel's own address, `:552`); `:669` a request whose JSON body
+     *    has no string `model`, or whose URL is not `/chat/completions`, reaches the network untouched; `:673-675` a provider that
+     *    requires a key and has none throws `PROVIDER_KEY_MISSING` before the network; `:710-712` OpenRouter too goes to its
+     *    configured endpoint, and `:589` the destination's headers replace the kernel's; `:766-770` a failed call is rethrown as
+     *    `PROVIDER_REQUEST_ERROR`, which drops the code raised before the network.
+     *  - `model-destination.mjs:122-189` `risolviDestinazioneModello` takes endpoint and key from the model's prefix.
+     *  - `kernel/talosHarness.mjs:247-256` `compattaConversazione` swallows a failed call and answers `compattato:false`.
+     * Measured with a probe on this tree before writing (recording fetch, no network, dummy keys): the routed DeepSeek judge and
+     *   compaction reached `<configured endpoint>/chat/completions` with the DeepSeek key and model `deepseek-flash`, an OpenRouter
+     *   model reached the configured OpenRouter endpoint with the OpenRouter key; with the DeepSeek key removed nothing was sent, the
+     *   judge failed `PROVIDER_REQUEST_ERROR` and compaction answered `compattato:false`; a body without a model reached the network
+     *   layer at the fixed OpenRouter address carrying the credential the kernel was given.
+     *
+     * Hence four rules:
+     *  1. The kernel never receives the OpenRouter key for these calls, only a per-runtime placeholder; the route replaces it with
+     *     the destination provider's key, and the network layer REFUSES any request that still carries the placeholder, i.e. one
+     *     the route did not rewrite. Nothing reaches the fixed address by falling through.
+     *  2. A missing route (a kernel without `creaFetchMultiProvider`, or one that returns no `eseguiConFallback`) is a refusal,
+     *     never the registry's default.
+     *  3. When the call fails, the code the route raised before the network is the one reported (only for the codes below, whose
+     *     messages the kernel or this file wrote: an upstream error keeps the kernel's public message, P-K).
+     *  4. An explicit compaction whose model call failed FAILS with that error, instead of reporting "already compact".
+     * ⛔ The environment-key consent of slice 18 holds by construction: keys come only from `providerStore`, the consent-filtered
+     *   forwarder above, so an unapproved environment key is not visible to these calls either.
+     */
+    const unroutedCredential = `talos-cli-unrouted-${randomUUID()}`;
+    const PRE_NETWORK_CODES = new Set(['PROVIDER_KEY_MISSING', 'PROVIDER_RUNTIME_INVALID', 'MODEL_DESTINATION_INVALID', 'LOCAL_RUNTIME_NOT_READY', 'AUXILIARY_CALL_NOT_ROUTED']);
+    const auxiliaryNetwork = (input, init = {}) => {
+        let unrouted = true;
+        try {
+            const bearer = `Bearer ${unroutedCredential}`;
+            unrouted = new Headers(init?.headers ?? undefined).get('authorization') === bearer || (typeof input?.headers?.get === 'function' && input.headers.get('authorization') === bearer);
+        }
+        catch {
+            unrouted = true;
+        }
+        if (unrouted)
+            return Promise.reject(new CliRuntimeError('AUXILIARY_CALL_NOT_ROUTED', 'An auxiliary model request was not routed to its provider, so it was not sent.'));
+        return fetch(input, init);
+    };
+    const auxiliaryFailure = (error, modello) => {
+        if (error?.code !== 'PROVIDER_KEY_MISSING')
+            return error;
+        const prefix = providerOfModel(String(modello ?? ''));
+        const provider = prefix && Object.hasOwn(providerRegistry, prefix) ? prefix : 'openrouter';
+        /* R2 (E8 / Q-R2-7): the one missing-key sentence; the code PROVIDER_KEY_MISSING is what the screen maps. */
+        return new CliRuntimeError('PROVIDER_KEY_MISSING', missingKeyText(provider), { provider });
+    };
+    const auxiliaryRoute = () => {
+        const unavailable = () => new CliRuntimeError('AUXILIARY_ROUTE_UNAVAILABLE', 'This TALOS kernel cannot route compaction or the research judge to the session provider, so nothing was sent.');
+        if (typeof m.creaFetchMultiProvider !== 'function')
+            throw unavailable();
+        const route = m.creaFetchMultiProvider(auxiliaryNetwork, { dipendenze: destinazioneModelloDeps, providerStore });
+        if (typeof route?.eseguiConFallback !== 'function')
+            throw unavailable();
+        let failure = null;
+        const fetchDiRete = Object.assign((input, init) => route(input, init), {
+            eseguiConFallback: async (chiama, opzioni = {}) => {
+                let thrown = null;
+                try {
+                    return await route.eseguiConFallback((aggiunte) => chiama({ ...aggiunte, fetchDiRete: async (input, init) => { thrown = null; try {
+                            return await aggiunte.fetchDiRete(input, init);
+                        }
+                        catch (error) {
+                            thrown = error;
+                            throw error;
+                        } } }), opzioni);
+                }
+                catch (error) {
+                    const stopped = error?.name === 'AbortError' || error?.fermatoSuRichiesta === true;
+                    failure = stopped ? error : auxiliaryFailure(PRE_NETWORK_CODES.has(thrown?.code) ? thrown : error, opzioni?.modello);
+                    throw failure;
+                }
+            },
+        });
+        return { fetchDiRete, failure: () => failure };
+    };
+    /*
+     * ⭐ B1 slice 24, condition C1 — COMPACTION NAMES THE SESSION'S MODEL, NOT THE REGISTRY'S.
+     *
+     * `session-registry.mjs:4217` (at 5e05de8e) handed `compattaSessioneFn` the model the registry was BUILT with (its closure `modello`,
+     * i.e. this composition's `model`), not the session's (`voce.modello`); since CLI-REQ-05 the kernel passes the session's own (see
+     * slice 25 above), and the scope below still decides. `main.ts` composes once with the launch model, and `/model`
+     * only changes the model new sessions start with. Measured on this tree before the cure: a DeepSeek session in a runtime
+     * composed with an OpenRouter model compacted on OpenRouter's configured endpoint with the OpenRouter key.
+     * ⇒ The session runtime's `compatta` (`sessionRegistry`, below) reads the session's own row from `registry.elenca()`
+     *   (`session-registry.mjs:5520` `modello`, `:5525` `provider`; a restored session keeps both, `:3559`, `:3564`), runs ONE
+     *   compaction at a time, and binds that session's model to the compaction's async context. `compattaSessioneFn` uses only
+     *   that model and ignores the one the kernel passes.
+     * ⛔ Never a guess, never a fallback. Refused before anything is sent:
+     *   - a compaction that did not come through the session runtime (no bound scope): the model is unknown;
+     *   - a session whose provider is not `cloud` (the registry knows only `cloud` and `local`) or whose model is missing;
+     *   - a `local` session: its stored model is a bare GGUF id, which the route would read as an OpenRouter id
+     *     (`model-destination.mjs:65-75`). Compacting it waits for the kernel fix, CLI-REQ-05.
+     * The research judge is unaffected: it names its own model explicitly.
+     */
+    const compactionScope = new AsyncLocalStorage();
+    const compattaSessioneFn = async ({ messaggiFinali }) => {
+        const scope = compactionScope.getStore();
+        if (!scope)
+            throw new CliRuntimeError('SESSION_MODEL_UNKNOWN', 'This compaction did not come through the session runtime, so the session model is unknown and nothing was sent.');
+        if (scope.refusal)
+            throw scope.refusal;
+        if (typeof m.compattaSessione !== 'function')
+            throw new CliRuntimeError('AUXILIARY_ROUTE_UNAVAILABLE', 'This TALOS kernel does not expose compaction, so nothing was sent.');
+        const route = auxiliaryRoute();
+        const result = await m.compattaSessione({ messaggiFinali, modello: scope.model, chiave: unroutedCredential, fetchDiRete: route.fetchDiRete });
+        const failure = route.failure();
+        if (result?.compattato !== true && failure)
+            throw failure;
+        /* R5a lane R, S3 (Q-R5-4): an explicit /compact of a session without the Context Engine is named like the automatic one: the
+           kernel keeps the system prompt and the task (talosHarness.mjs `compattaConversazione`) and summarises the rest. */
+        if (result?.compattato === true) {
+            const before = Array.isArray(messaggiFinali) ? messaggiFinali.length : null;
+            const tokens = Number(result?.usage?.prompt_tokens);
+            cliEvents.emit(scope.sessionId, compactionEvent({ engine: 'kernel', messagesSummarized: before === null ? null : Math.max(0, before - 2), tokensBefore: Number.isSafeInteger(tokens) && tokens >= 0 ? tokens : null, tokensAfter: null, trigger: 'manual' }));
+        }
+        return result;
+    };
+    const chiediAlModelloUnaVoltaFn = async ({ modello, prompt, segnaleStop }) => {
+        if (typeof m.chiediAlModelloUnaVolta !== 'function')
+            throw new CliRuntimeError('AUXILIARY_ROUTE_UNAVAILABLE', 'This TALOS kernel does not expose the research judge call, so nothing was sent.');
+        return m.chiediAlModelloUnaVolta({ modello, chiave: unroutedCredential, prompt, ...(segnaleStop ? { segnaleStop } : {}), fetchDiRete: auxiliaryRoute().fetchDiRete });
+    };
+    /*
+     * ⭐ B1 slice 25 — READINESS AT START: THE KERNEL DECIDES, THE CLI SAYS IT.
+     *
+     * The rule "ready means a key usable NOW, for every provider" lives in the kernel since the desktop lane's `3cbecf60`, which fixed
+     * the benched-key defect this slice found: `harness-ui/src/sessione-pronta.mjs`, `creaProntoFn`. Kernel lines relied on, read at
+     * 3cbecf60:
+     *  - `sessione-pronta.mjs:48-72`: synchronous; an empty or unparsable model is not ready; a provider that needs a key is ready
+     *    only if `providerStore.getKey` (which skips a benched key) returns one, or, for OpenRouter only, `chiaveApi`.
+     *  - `session-registry.mjs:2859-2877`: a non-local session starts only on `pronto`; `codice`/`messaggio` become the refusal, and a
+     *    throw becomes one too. Without `prontoFn` the registry keeps asking every session for an OpenRouter key.
+     * What the CLI adds around it, and why:
+     *  - ⛔ `chiaveApi: null`. On the desktop server it is the startup `OPENROUTER_API_KEY`; here an environment key reaches the store
+     *    only with the person's consent (slice 18), so no key outside the store may make a session ready.
+     *  - A model whose provider cannot be read, or that the registry does not know, is refused before asking: the kernel answers
+     *    "ready" for a provider it has no record of (`sessione-pronta.mjs:60`), and a guard that cannot evaluate denies.
+     *  - The refusal is the CLI's own, in English, with the codes the screen gives (`unusableKeyRefusal`, `keyBench`), never the
+     *    kernel's Italian sentence. An answer that cannot be read, or a throw, refuses and says TALOS could not tell.
+     */
+    const kernelReady = typeof m.creaProntoFn === 'function' ? m.creaProntoFn({ providerStore, chiaveApi: null }) : null;
+    const prontoFn = (modello) => {
+        let fonte = null;
+        try {
+            fonte = typeof modello === 'string' && typeof m.separaFonteModello === 'function' ? m.separaFonteModello(modello).fonte : null;
+        }
+        catch {
+            fonte = null;
+        }
+        const record = fonte && Object.hasOwn(providerRegistry, fonte) ? providerRegistry[fonte] : null;
+        if (!fonte || !record)
+            return { pronto: false, codice: 'MODEL_DESTINATION_INVALID', messaggio: 'The model of this session cannot be read, so nothing was sent. Choose one with /model.' };
+        const fornitore = providerLabelText(fonte, String(record.etichetta ?? fonte));
+        let verdict = null;
+        try {
+            verdict = kernelReady ? kernelReady(modello) : null;
+        }
+        catch {
+            verdict = null;
+        }
+        if (verdict?.pronto === true)
+            return { pronto: true, fornitore };
+        if (verdict?.pronto !== false)
+            return { pronto: false, fornitore, codice: 'KERNEL_READINESS_UNREADABLE', messaggio: `TALOS could not tell whether ${fornitore} can be used now, so nothing was sent.` };
+        let row = null;
+        try {
+            row = (providerStore.listPublic?.() ?? []).find((entry) => entry?.id === fonte) ?? null;
+        }
+        catch {
+            row = null;
+        }
+        const refusal = unusableKeyRefusal(fonte, keyBench(row));
+        return { pronto: false, fornitore, codice: refusal.code, messaggio: refusal.message };
+    };
+    async function prepareMcpWithAuthority(input) {
+        if (typeof trustM.preparaToolMcpPerSessione !== 'function')
+            return { toolMcp: [], chiamaToolMcpFn: null, falliti: [], chiudiTutti: async () => { } };
+        const loaded = typeof trustM.caricaServerMcp === 'function' ? await trustM.caricaServerMcp({ cartella: projectRoot }) : null;
+        const prepared = await trustM.preparaToolMcpPerSessione(input);
+        if (typeof prepared?.chiamaToolMcpFn !== 'function' || !Array.isArray(prepared?.toolMcp) || !loaded)
+            return prepared;
+        const owners = new Map();
+        const exposed = (serverId, toolName) => typeof trustM.nomeEspostoMcp === 'function' ? trustM.nomeEspostoMcp(serverId, toolName) : `mcp__${serverId}__${toolName}`;
+        for (const server of loaded.server ?? []) {
+            for (const toolName of server.allowlist ?? []) {
+                const serverId = String(server.id);
+                const name = exposed(serverId, String(toolName));
+                const previous = owners.get(name);
+                owners.set(name, previous === undefined || previous === serverId ? serverId : null);
+            }
+        }
+        const routes = new Map();
+        for (const tool of prepared.toolMcp) {
+            const name = String(tool?.name ?? '');
+            const serverId = owners.get(name);
+            if (serverId)
+                routes.set(name, serverId);
+        }
+        const dispatch = prepared.chiamaToolMcpFn;
+        return { ...prepared, chiamaToolMcpFn: async (name, args) => {
+                const serverId = routes.get(name);
+                if (!serverId)
+                    throw Object.assign(new Error('MCP_TOOL_OWNER_UNRESOLVED'), { code: 'MCP_TOOL_OWNER_UNRESOLVED' });
+                if (!await trustAuthority.verifyScope({ kind: 'mcp', id: serverId }))
+                    throw Object.assign(new Error('MCP_TRUST_INVALIDATED'), { code: 'MCP_TRUST_INVALIDATED', serverId });
+                return dispatch(name, args);
+            } };
+    }
+    async function preparePluginWithAuthority(input) {
+        if (typeof trustM.preparaToolPluginPerSessione !== 'function')
+            return { toolPlugin: [], hookPlugin: [], eseguiToolPluginFn: null };
+        const prepared = await trustM.preparaToolPluginPerSessione(input);
+        if (typeof prepared?.eseguiToolPluginFn !== 'function' || typeof prepared?.pluginIdDiTool !== 'function')
+            return prepared;
+        const dispatch = prepared.eseguiToolPluginFn;
+        return { ...prepared, eseguiToolPluginFn: async (name, args) => {
+                const pluginId = prepared.pluginIdDiTool(name);
+                if (typeof pluginId !== 'string' || !pluginId)
+                    throw Object.assign(new Error('PLUGIN_TOOL_OWNER_UNRESOLVED'), { code: 'PLUGIN_TOOL_OWNER_UNRESOLVED' });
+                if (!await trustAuthority.verifyScope({ kind: 'plugin', id: pluginId }))
+                    throw Object.assign(new Error('PLUGIN_TRUST_INVALIDATED'), { code: 'PLUGIN_TRUST_INVALIDATED', pluginId });
+                return dispatch(name, args);
+            } };
+    }
+    const authoritySessionAdapters = typeof trustM.preparaToolMcpPerSessione === 'function' || typeof trustM.preparaToolPluginPerSessione === 'function';
+    let contextBridge = null;
+    const registry = m.createSessionRegistry({
+        prontoFn, fetchModelloFn: () => auxiliaryRoute().fetchDiRete, compattaSessioneFn, chiediAlModelloUnaVoltaFn,
+        contextHooksFn: (input) => contextBridge?.hooks(input), contextCompactFn: (input) => contextBridge?.compact(input),
+        avviaSessioneFn: async (input) => {
+            if (!authoritySessionAdapters)
+                return m.avviaSessione({ ...input, talosLavoraFn: talosLavoraConBroker });
+            const compatibility = await sessionCompatibility();
+            try {
+                return await m.avviaSessione({ ...input, cartellaTrustMcp: compatibility.roots.mcp, cartellaTrustPlugin: compatibility.roots.plugins, ...(trustM.preparaToolMcpPerSessione ? { preparaToolMcpPerSessioneFn: prepareMcpWithAuthority } : {}), ...(trustM.preparaToolPluginPerSessione ? { preparaToolPluginPerSessioneFn: preparePluginWithAuthority } : {}), ...(trustM.eseguiHook ? { eseguiHookFn: executePluginHookWithAuthority } : {}), talosLavoraFn: talosLavoraConBroker });
+            }
+            finally {
+                await compatibility.cleanup();
+            }
+        },
+        modello: model, chiave: providerStore.getKey?.('openrouter') ?? '', chiaveFn: () => providerStore.getKey?.('openrouter') ?? '', cartelleProgetto: [{ id: 'cli', nome: 'CLI', percorso: projectRoot }], taskCatalogProvider, ricercaWebFn, cartellaStore: paths.sessionsRoot,
+        cartellaTrustHook: paths.trust.hooks, cartellaTrustMcp: paths.trust.mcp, cartellaTrustPlugin: paths.trust.plugins,
+        verificaTrustFn: verificaTrustHookFn, verificaTrustMcpFn, fidaHookFn, fidaServerMcpFn, verificaTrustPluginFn, statoTrustPluginFn, fidaPluginFn,
+        cartellaNote: join(paths.dataRoot, 'notes'), cartellaAttivita: join(paths.dataRoot, 'tasks'), cartellaMemoria: join(paths.dataRoot, 'memory'), cartellaForge: join(paths.dataRoot, 'forge'), attrezziKernelFn: () => ownerRuntime.attrezziKernel(),
+        eseguiComandoDirettoFn: (input) => { if (typeof m.eseguiComandoDiretto !== 'function')
+            throw Object.assign(new Error('KERNEL_COMMAND_PATH_UNAVAILABLE'), { code: 'KERNEL_COMMAND_PATH_UNAVAILABLE' }); return m.eseguiComandoDiretto({ ...input, eseguiComandoSandboxatoFn: brokeredExecutor }); }
+    });
+    /*
+     * R5a lane R, S2: the profile's sources (model-profile.ts). The store's and the registry's rows are read live; the person's
+     * override is re-read before each decision (the TUI writes it with `writeConfigScope`); a local Ollama is asked for the
+     * model's real window; models.dev is loaded in the background (never in a test profile, gate E7) and waited for at most 2 s.
+     */
+    configureModelProfiles({ registry: providerRegistry, rowsFor: (provider) => {
+            const record = providerRegistry[provider] ?? {};
+            let runtime = {};
+            try {
+                runtime = providerStore.getRuntime?.(provider) ?? {};
+            }
+            catch {
+                runtime = {};
+            }
+            return { runtime: Array.isArray(runtime.modelli) ? runtime.modelli : [], registry: [...(Array.isArray(record.modelliNoti) ? record.modelliNoti : []), ...(Array.isArray(record.modelliDiRiserva) ? record.modelliDiRiserva : [])] };
+        } });
+    let catalogConfig = null;
+    try {
+        catalogConfig = (await loadEffectiveConfig({ paths, projectRoot })).value;
+    }
+    catch {
+        catalogConfig = null;
+    }
+    const modelsDev = createModelsDevLoader({ repoRoot, dataRoot: paths.dataRoot, env: { ...process.env, ...env }, config: catalogConfig, fetchImpl: (url, init) => fetch(url, init), testProfile: isTestProfile({ ...process.env, ...env }) });
+    const refreshOverrides = async () => { try {
+        setModelOverrides((await loadEffectiveConfig({ paths, projectRoot })).value.models);
+    }
+    catch { /* an unreadable configuration is reported by the config layer */ } };
+    await refreshOverrides();
+    const launch = typeof m.separaFonteModello === 'function' ? (() => { try {
+        return m.separaFonteModello(model);
+    }
+    catch {
+        return null;
+    } })() : null;
+    if (launch?.fonte && modelsDev.enabled)
+        void modelsDev.load(launch.fonte);
+    const withinMs = (work, ms) => new Promise(resolve => { const timer = setTimeout(resolve, ms); timer.unref?.(); work.then(() => { clearTimeout(timer); resolve(); }, () => { clearTimeout(timer); resolve(); }); });
+    const prepareProfile = async (provider, modelId) => {
+        await refreshOverrides();
+        const record = providerRegistry[provider];
+        if (record?.catalogo?.fonte === 'runtime-locale' && record?.catalogo?.forma === 'ollama-tags') {
+            let runtime = {};
+            try {
+                runtime = providerStore.getRuntime?.(provider) ?? {};
+            }
+            catch {
+                runtime = {};
+            }
+            const root = String(runtime.endpoint ?? record.baseUrl ?? '');
+            rememberOllamaWindow(provider, modelId, await ollamaWindow({ root, model: modelId, fetchImpl: (url, init) => fetch(url, init) }));
+        }
+        if (modelsDev.enabled)
+            await withinMs(modelsDev.load(provider), 2_000);
+    };
+    contextBridge = createCliContextBridge({ repoRoot, paths, registry, providerRegistry, providerStore, ownerRuntime, chatImageStore, prepareProfile, onSummaryRequest: () => { const sessionId = toolOutputScope.getStore()?.sessionId; if (sessionId)
+            cliEvents.emit(sessionId, summaryRequestedEvent()); }, ...(m.separaFonteModello ? { separaFonteModello: m.separaFonteModello } : {}) });
+    /* C1 (see `compactionScope` above): the session's own row decides the model; one compaction at a time, in call order. */
+    const compactionOf = (sessionId) => {
+        let rows = null;
+        try {
+            rows = registry.elenca?.();
+        }
+        catch {
+            rows = null;
+        }
+        const row = Array.isArray(rows) ? rows.find((candidate) => candidate?.sessionId === sessionId) ?? null : null;
+        const unknown = (details) => ({ model: null, refusal: new CliRuntimeError('SESSION_MODEL_UNKNOWN', 'The model of this session cannot be determined, so it was not compacted and nothing was sent.', { sessionId, ...details }) });
+        if (!row)
+            return unknown({});
+        if (row.provider === 'local')
+            return { model: null, refusal: new CliRuntimeError('LOCAL_SESSION_COMPACTION_UNAVAILABLE', 'Compacting a local-model session waits for a kernel fix (CLI-REQ-05), so nothing was sent.', { sessionId, provider: 'local' }) };
+        if (row.provider !== 'cloud')
+            return unknown({ provider: typeof row.provider === 'string' ? row.provider : null });
+        if (typeof row.modello !== 'string' || row.modello.trim() === '')
+            return unknown({ provider: 'cloud' });
+        return { model: row.modello, refusal: null };
+    };
+    let compactionTail = Promise.resolve();
+    const compactSession = (sessionId) => {
+        const run = () => compactionScope.run({ sessionId, ...compactionOf(sessionId) }, () => registry.compatta(sessionId));
+        const result = compactionTail.then(run);
+        compactionTail = result.then(() => undefined, () => undefined);
+        return result;
+    };
+    /*
+     * R5a lane R: `iscriviti` also delivers the session's CLI events (provider attempts, a provider failure's facts, a kernel
+     * compaction), live only: they carry no `_sequenza`, so a replay never repeats them and the supervisor's cursor ignores them.
+     * `shell` runs the person's `!` command inside its session's output scope (S6).
+     */
+    const subscribeWithCliEvents = (sessionId, listener, from = 0) => {
+        const offKernel = registry.iscriviti(sessionId, listener, from);
+        const offCli = cliEvents.subscribe(sessionId, listener);
+        return () => { offCli(); if (typeof offKernel === 'function')
+            offKernel(); };
+    };
+    const sessionRegistry = Object.create(registry, { ...(typeof registry?.compatta === 'function' ? { compatta: { value: compactSession, enumerable: true } } : {}), statoContesto: { value: (sessionId) => contextBridge.status(sessionId), enumerable: true }, chiudiContesto: { value: () => contextBridge.close(), enumerable: false },
+        ...(typeof registry?.iscriviti === 'function' ? { iscriviti: { value: subscribeWithCliEvents, enumerable: true } } : {}),
+        ...(typeof registry?.shell === 'function' ? { shell: { value: (sessionId, comando) => toolOutputScope.run({ sessionId }, () => registry.shell(sessionId, comando)), enumerable: true } } : {}) });
+    let tuiCatalog = null;
+    const modelImageCapability = async (runModel) => { const provider = providerOfModel(runModel); if (!provider || !tuiCatalog)
+        return null; try {
+        const rows = await tuiCatalog.listModels({ provider });
+        return rows.find((row) => row.id === runModel)?.images ?? null;
+    }
+    catch {
+        return null;
+    } };
+    const materializeImage = async (attachment) => { if (!chatImageStore)
+        throw new CliRuntimeError('IMAGE_ATTACHMENT_UNAVAILABLE', 'Image attachment storage is unavailable.'); const name = String(attachment.path).split('/').at(-1) || 'image'; return chatImageStore.upload({ nome: name, dataUrl: `data:${attachment.mimeType};base64,${attachment.dataBase64}` }); };
+    const runtime = createSessionFacade(sessionRegistry, { model, origin: 'talos-cli', modelImageCapability, materializeImage });
+    attachKeyOrigin(runtime, (runModel) => { const provider = providerOfModel(runModel); if (!provider)
+        return null; let publicRow = null; try {
+        publicRow = (providerStore.listPublic?.() ?? []).find((row) => row?.id === provider) ?? null;
+    }
+    catch {
+        publicRow = null;
+    } return describeKeyOrigin({ registry: providerRegistry, provider, publicRow, storeEnv: storeEnvironment(), mode: environmentKeys, store: credentialStore?.kind ?? null }); });
+    /* The probe over the saved keys. B1 slice 18: listing, probing and `talos provider test` all build it here, and none of them passes
+       `consentiGenerazione`; only the key test's own probe (`createKeyProbe`) may, for a provider that declares its minimal request. */
+    const storeProbe = (callerSignal) => { if (typeof m.createProviderProbe !== 'function')
+        return { prova: async () => { throw Object.assign(new Error('PROVIDER_PROBE_UNAVAILABLE'), { code: 'PROVIDER_PROBE_UNAVAILABLE' }); }, elencaModelli: async () => { throw Object.assign(new Error('PROVIDER_CATALOG_UNAVAILABLE'), { code: 'PROVIDER_CATALOG_UNAVAILABLE' }); } }; const fetchImpl = (input, init = {}) => { const internal = init?.signal; let signal = callerSignal ?? internal; if (callerSignal && internal)
+        signal = AbortSignal.any([internal, callerSignal]); return fetch(input, { ...init, ...(signal ? { signal } : {}) }); }; return m.createProviderProbe({ leggiChiave: (id) => { try {
+            return providerStore.getKey?.(id) ?? null;
+        }
+        catch {
+            return null;
+        } }, leggiRuntime: (id) => { try {
+            return providerStore.getRuntime?.(id) ?? {};
+        }
+        catch {
+            return {};
+        } }, fetchImpl, env }); };
+    const providerControlPlane = createProviderControlPlane({
+        publicProviders: () => { try {
+            return providerStore.listPublic?.() ?? [];
+        }
+        catch {
+            return [];
+        } }, registry: providerRegistry,
+        runtimeFor: (id) => { try {
+            return providerStore.getRuntime?.(id) ?? {};
+        }
+        catch {
+            return {};
+        } }, keyFor: (id) => { try {
+            return providerStore.getKey?.(id) ?? null;
+        }
+        catch {
+            return null;
+        } },
+        createProbe: storeProbe, environmentKey: (id) => environmentKeys === 'use' ? null : consent.stateFor(id),
+    });
+    tuiCatalog = createTuiCatalogService({
+        /* P21: OpenRouter sign-in with the kernel's PKCE module (the checkout's, or the package's vendor copy). */
+        openRouterLogin: async (input) => { const { loadOpenRouterOAuth, startOpenRouterLogin } = await import("../provider/openrouter-login.js"); return startOpenRouterLogin({ oauth: await loadOpenRouterOAuth(repoRoot), ...(input?.paste ? { paste: true } : {}) }); },
+        publicProviders: () => { try {
+            return providerStore.listPublic?.() ?? [];
+        }
+        catch {
+            return [];
+        } }, registry: m.REGISTRO_FORNITORI ?? {},
+        runtimeFor: (id) => { try {
+            return providerStore.getRuntime?.(id) ?? {};
+        }
+        catch {
+            return {};
+        } }, keyFor: (id) => { try {
+            return providerStore.getKey?.(id) ?? null;
+        }
+        catch {
+            return null;
+        } },
+        setKey: (id, secret) => { if (typeof providerStore.setKey !== 'function')
+            throw Object.assign(new Error('PROVIDER_STORE_UNAVAILABLE'), { code: 'PROVIDER_STORE_UNAVAILABLE' }); providerStore.setKey(id, secret); },
+        clearKey: (id) => { if (typeof providerStore.clearKey !== 'function')
+            throw Object.assign(new Error('PROVIDER_STORE_UNAVAILABLE'), { code: 'PROVIDER_STORE_UNAVAILABLE' }); providerStore.clearKey(id); },
+        createProbe: storeProbe,
+        persistModel: (id) => configSet({ paths, projectRoot, scope: 'project-user', path: 'model', value: id }),
+        /* ⛔ The candidate key is readable ONLY for the provider it is being tested against, and the probe builds
+           the request from that provider's own endpoint: the key cannot reach another provider through this door. */
+        createKeyProbe: (provider, secret, callerSignal) => { if (typeof m.createProviderProbe !== 'function')
+            return { prova: async () => ({ provider, esito: 'non-provabile', motivo: 'probe unavailable' }) }; const fetchImpl = (input, init = {}) => { const internal = init?.signal; let signal = callerSignal ?? internal; if (callerSignal && internal)
+            signal = AbortSignal.any([internal, callerSignal]); return fetch(input, { ...init, ...(signal ? { signal } : {}) }); }; return m.createProviderProbe({ leggiChiave: (id) => id === provider ? secret : null, leggiRuntime: (id) => { try {
+                return providerStore.getRuntime?.(id) ?? {};
+            }
+            catch {
+                return {};
+            } }, fetchImpl, env }); },
+        fetchImpl: (url, init) => fetch(url, init),
+        environmentKey: (id) => environmentKeys === 'use' ? null : consent.stateFor(id),
+        answerEnvironmentKey,
+        chosenProvider: () => consent.chosenProvider(),
+        chooseProvider: (id) => consent.chooseProvider(id),
+        controlPlane: providerControlPlane,
+    });
+    return { runtime, registry: sessionRegistry, providerStore, ownerRuntime, searchSourceStore, tuiCatalog, providerProbe: storeProbe, providerControlPlane, credentialStore };
+}