zidane 5.5.0 → 5.5.2

package/dist/chat.js

@@ -1,3 +1,203 @@
-import { B as formatTaskStatus, H as previewLine, I as ageString, L as compactPath, R as fmtTokens, U as shortId, V as formatTaskSummary, z as formatDuration } from "./tools-D_icxa-V.js";
-import { $ as useMcpAuthDispatch, $n as tryOpenBrowser, $r as PLAN_MODE_DOCTRINE_NO_PROMPTS, $t as loadState, A as getSafelist, An as DEFAULT_KEYBINDINGS, Ar as resolveAgentId, At as resolveChipColor, B as supportsOAuth, Bn as SKILLS_TRIGGER, Br as isTodoTool, Bt as useDiscoveryOptional, C as resolveSessionExportTarget, Cn as mergeApprovalAndBodyOutcomes, Cr as piIdOf, Ct as SETTINGS_CHOICES, D as useSafeModeQueue, Dn as stripEditOutcomesAnnotation, Dr as DEFAULT_PERSIST_EXCLUDE_TOOLS, Dt as useSettings, E as useSafeModeActions, En as rewriteMultiEditHeader, Er as DEFAULT_AGENT_ID, F as suggestSafelistEntry, Fn as matchesBinding, Fr as TODO_STATUS_GLYPHS, Ft as CATPPUCCIN_MACCHIATO, G as defaultMcpsConfigPaths, Gn as uniqueFilesFromReferences, Gr as useActiveTodos, Gt as createStateStore, H as filterModelCatalog, Hn as uniqueSkillNamesFromReferences, Hr as pruneTodosByRun, Ht as useConfig, I as writeProjects, In as mergeKeybindings, Ir as TODO_WRITE_COUNTS_METADATA_KEY, It as CATPPUCCIN_MOCHA, J as projectUserPaths, Jn as findActiveTrigger, Jr as DOING_TASKS_DOCTRINE, Jt as isEditErrorResult, K as discoverProjectMcps, Kn as applyInsert, Kr as ACTIONS_WITH_CARE_DOCTRINE, Kt as deriveSessionTitle, L as splitPromptSegments, Ln as parseBindingSpec, Lr as createTodoTools, Lt as createDiscoverySlot, M as matchesSafelistEntry, Mn as KEYBINDING_DEF_BY_ACTION, Mr as TODOREAD_TOOL, Mt as VAPORWAVE_THEME, N as projectsFilePath, Nn as ensureKeybindingsFile, Nr as TODOS_METADATA_KEY, Nt as CATPPUCCIN_FRAPPE, O as IMPLICITLY_SAFE_TOOLS, On as summarizeOutcomes, Or as PLAN_AGENT, Ot as BUILTIN_THEMES, P as readProjects, Pn as keybindingsPath, Pr as TODOWRITE_TOOL, Pt as CATPPUCCIN_LATTE, Q as McpAuthProvider, Qn as buildLinearRamp, Qr as PLAN_MODE_DOCTRINE, Qt as listSessionMeta, R as formatPathForCwd, Rn as readKeybindings, Rr as getArchivedTodosForRun, Rt as DiscoveryProvider, S as renderSession, Sn as maskToOutcomeKinds, Sr as openrouterDescriptor, St as DEFAULT_SETTINGS, T as SafeModeProvider, Tn as resolveApprovalForPayload, Tr as BUILTIN_AGENTS, Tt as SettingsProvider, U as indexOfEntry, Un as FILES_TRIGGER, Ur as selectActiveTodos, Ut as resolveConfig, V as buildModelCatalog, Vn as createSkillsCompletionProvider, Vr as pickActiveRunId, Vt as ConfigProvider, W as buildMcpServers, Wn as createFilesCompletionProvider, Wr as setTodosForRun, X as mcpCredentialsPath, Xn as useCompletion, Xr as INTERACTION_GUIDANCE, Xt as isVisible, Y as createFileMcpCredentialStore, Yn as mergeReferences, Yr as IDENTITY_PREFIX, Yt as isTurnHighlighted, Z as patchMcpCredential, Zn as blendHsl, Zr as INTERACTION_GUIDANCE_NO_PROMPTS, Zt as lastContextSizeFromTurns, _ as turnContextSize, _n as previewEditPayload, _r as getContextWindow, _t as truncateTrailing, a as computeTurnAnchors, an as titleFromTurns, ar as credentialsPath, at as InteractionsProvider, b as defaultSkillScanPaths, bn as tokenize, br as modelsForDescriptor, bt as listProjectFiles, c as formatToolCall, cn as turnSelectionOwnership, cr as removeProviderCredential, ct as createInteractionTools, d as useSelectStyle, dn as buildContextualDiff, dr as BUILTIN_PROVIDERS, dt as pendingInteractionsFromTurns, ei as SUBAGENT_GUIDANCE, en as marginTopFor, er as bootProfileEnabled, et as useMcpAuthState, f as useSurfaces, fn as buildUnifiedDiff, fr as OUTPUT_RESERVE_TOKENS, ft as serializeInteractionResponse, g as finalizeStreamingMarkdownForOwner, gn as filetypeFromPath, gr as effectiveContextWindow, gt as hintsLength, h as finalizeStreamingMarkdown, hn as extractEditPayload, hr as credKeyOf, ht as clipHintsToWidth, i as turnAsText, ii as envSection, in as sumRunCosts, ir as applyApiKeyEnv, it as ASK_USER_TOOL, j as isOnSafelist, jn as KEYBINDING_DEFS, jr as singleAgentRegistry, jt as resolveTheme, k as addToSafelist, kn as findGitRoot, kr as accentColor, kt as DEFAULT_THEME, l as ThemeProvider, ln as updateToolEventOutcomes, lr as setProviderCredential, lt as isInteractionTool, m as useTheme, mn as computeLineDiff, mr as cerebrasDescriptor, mt as useInteractionsQueue, n as deleteTurnSafely, ni as buildBuildSystem, nn as selectableTurnIds, nr as shouldAutoCompact, nt as reduceMcpAuth, o as TOOL_DISPLAY, on as toolCallPreview, or as readCredentials, ot as PRESENT_PLAN_TOOL, p as useSyntaxStyles, pn as computeInlineDiff, pr as anthropicDescriptor, pt as useInteractionsActions, q as parseMcpsFile, qn as collectReferences, qr as COMMUNICATION_DOCTRINE, qt as eventsFromTurns, r as truncateTurnsAt, ri as buildPlanSystem, rn as stripSpawnTokensLine, rr as detectAuth, rt as splitMarkdownCodeBlocks, s as displayNameFor, sn as toolResultText, sr as readProviderCredential, st as buildResumedToolResultsTurn, t as countNeighbors, ti as TOKEN_DISCIPLINE_DOCTRINE, tn as saveState, tr as bootTick, tt as getMcpAuthStatus, u as useColors, un as applyEditPayload, ur as writeCredentials, ut as makeRequestInteraction, v as useStreamBuffer, vn as splitLines, vr as getModelInfo, vt as cleanTitle, w as writeSessionExport, wn as parseEditOutcomesFromResult, wr as BUILD_AGENT, wt as SETTINGS_TOGGLES, x as discoverProjectSkills, xn as buildEditOutcomesAnnotation, xr as openaiDescriptor, xt as useEnabledToggleSet, y as buildSkillsConfig, yn as summarizeEditPayload, yr as modelSupportsReasoning, yt as generateSessionTitle, z as runOAuthLogin, zn as stripJsonComments, zr as getTodosForRun, zt as useDiscovery } from "./turn-operations-CtgBlBHn.js";
-export { ACTIONS_WITH_CARE_DOCTRINE, ASK_USER_TOOL, BUILD_AGENT, BUILTIN_AGENTS, BUILTIN_PROVIDERS, BUILTIN_THEMES, CATPPUCCIN_FRAPPE, CATPPUCCIN_LATTE, CATPPUCCIN_MACCHIATO, CATPPUCCIN_MOCHA, COMMUNICATION_DOCTRINE, ConfigProvider, DEFAULT_AGENT_ID, DEFAULT_KEYBINDINGS, DEFAULT_PERSIST_EXCLUDE_TOOLS, DEFAULT_SETTINGS, DEFAULT_THEME, DOING_TASKS_DOCTRINE, DiscoveryProvider, FILES_TRIGGER, IDENTITY_PREFIX, IMPLICITLY_SAFE_TOOLS, INTERACTION_GUIDANCE, INTERACTION_GUIDANCE_NO_PROMPTS, InteractionsProvider, KEYBINDING_DEFS, KEYBINDING_DEF_BY_ACTION, McpAuthProvider, OUTPUT_RESERVE_TOKENS, PLAN_AGENT, PLAN_MODE_DOCTRINE, PLAN_MODE_DOCTRINE_NO_PROMPTS, PRESENT_PLAN_TOOL, SETTINGS_CHOICES, SETTINGS_TOGGLES, SKILLS_TRIGGER, SUBAGENT_GUIDANCE, SafeModeProvider, SettingsProvider, TODOREAD_TOOL, TODOS_METADATA_KEY, TODOWRITE_TOOL, TODO_STATUS_GLYPHS, TODO_WRITE_COUNTS_METADATA_KEY, TOKEN_DISCIPLINE_DOCTRINE, TOOL_DISPLAY, ThemeProvider, VAPORWAVE_THEME, accentColor, addToSafelist, ageString, anthropicDescriptor, applyApiKeyEnv, applyEditPayload, applyInsert, blendHsl, bootProfileEnabled, bootTick, buildBuildSystem, buildContextualDiff, buildEditOutcomesAnnotation, buildLinearRamp, buildMcpServers, buildModelCatalog, buildPlanSystem, buildResumedToolResultsTurn, buildSkillsConfig, buildUnifiedDiff, cerebrasDescriptor, cleanTitle, clipHintsToWidth, collectReferences, compactPath, computeInlineDiff, computeLineDiff, computeTurnAnchors, countNeighbors, createDiscoverySlot, createFileMcpCredentialStore, createFilesCompletionProvider, createInteractionTools, createSkillsCompletionProvider, createStateStore, createTodoTools, credKeyOf, credentialsPath, defaultMcpsConfigPaths, defaultSkillScanPaths, deleteTurnSafely, deriveSessionTitle, detectAuth, discoverProjectMcps, discoverProjectSkills, displayNameFor, effectiveContextWindow, ensureKeybindingsFile, envSection, eventsFromTurns, extractEditPayload, filetypeFromPath, filterModelCatalog, finalizeStreamingMarkdown, finalizeStreamingMarkdownForOwner, findActiveTrigger, findGitRoot, fmtTokens, formatDuration, formatPathForCwd, formatTaskStatus, formatTaskSummary, formatToolCall, generateSessionTitle, getArchivedTodosForRun, getContextWindow, getMcpAuthStatus, getModelInfo, getSafelist, getTodosForRun, hintsLength, indexOfEntry, isEditErrorResult, isInteractionTool, isOnSafelist, isTodoTool, isTurnHighlighted, isVisible, keybindingsPath, lastContextSizeFromTurns, listProjectFiles, listSessionMeta, loadState, makeRequestInteraction, marginTopFor, maskToOutcomeKinds, matchesBinding, matchesSafelistEntry, mcpCredentialsPath, mergeApprovalAndBodyOutcomes, mergeKeybindings, mergeReferences, modelSupportsReasoning, modelsForDescriptor, openaiDescriptor, openrouterDescriptor, parseBindingSpec, parseEditOutcomesFromResult, parseMcpsFile, patchMcpCredential, pendingInteractionsFromTurns, piIdOf, pickActiveRunId, previewEditPayload, previewLine, projectUserPaths, projectsFilePath, pruneTodosByRun, readCredentials, readKeybindings, readProjects, readProviderCredential, reduceMcpAuth, removeProviderCredential, renderSession, resolveAgentId, resolveApprovalForPayload, resolveChipColor, resolveConfig, resolveSessionExportTarget, resolveTheme, rewriteMultiEditHeader, runOAuthLogin, saveState, selectActiveTodos, selectableTurnIds, serializeInteractionResponse, setProviderCredential, setTodosForRun, shortId, shouldAutoCompact, singleAgentRegistry, splitLines, splitMarkdownCodeBlocks, splitPromptSegments, stripEditOutcomesAnnotation, stripJsonComments, stripSpawnTokensLine, suggestSafelistEntry, sumRunCosts, summarizeEditPayload, summarizeOutcomes, supportsOAuth, titleFromTurns, tokenize, toolCallPreview, toolResultText, truncateTrailing, truncateTurnsAt, tryOpenBrowser, turnAsText, turnContextSize, turnSelectionOwnership, uniqueFilesFromReferences, uniqueSkillNamesFromReferences, updateToolEventOutcomes, useActiveTodos, useColors, useCompletion, useConfig, useDiscovery, useDiscoveryOptional, useEnabledToggleSet, useInteractionsActions, useInteractionsQueue, useMcpAuthDispatch, useMcpAuthState, useSafeModeActions, useSafeModeQueue, useSelectStyle, useSettings, useStreamBuffer, useSurfaces, useSyntaxStyles, useTheme, writeCredentials, writeProjects, writeSessionExport };
+import { $ as useMcpAuthDispatch, $n as tryOpenBrowser, $r as selectActiveTodos, $t as loadState, A as getSafelist, An as DEFAULT_KEYBINDINGS, Ar as modelsForDescriptor, At as resolveChipColor, B as supportsOAuth, Bn as SKILLS_TRIGGER, Br as resolveAgentId, Bt as useDiscoveryOptional, C as resolveSessionExportTarget, Cn as mergeApprovalAndBodyOutcomes, Cr as anthropicDescriptor, Ct as SETTINGS_CHOICES, D as useSafeModeQueue, Dn as stripEditOutcomesAnnotation, Dr as getContextWindow, Dt as useSettings, E as useSafeModeActions, En as rewriteMultiEditHeader, Er as effectiveContextWindow, F as suggestSafelistEntry, Fn as matchesBinding, Fr as BUILTIN_AGENTS, Ft as CATPPUCCIN_MACCHIATO, G as defaultMcpsConfigPaths, Gn as uniqueFilesFromReferences, Gr as TODO_STATUS_GLYPHS, Gt as createStateStore, H as filterModelCatalog, Hn as uniqueSkillNamesFromReferences, Hr as TODOREAD_TOOL, Ht as useConfig, I as writeProjects, In as mergeKeybindings, Ir as DEFAULT_AGENT_ID, It as CATPPUCCIN_MOCHA, J as projectUserPaths, Jn as findActiveTrigger, Jr as getArchivedTodosForRun, Jt as isEditErrorResult, K as discoverProjectMcps, Kn as applyInsert, Kr as TODO_WRITE_COUNTS_METADATA_KEY, Kt as deriveSessionTitle, L as splitPromptSegments, Ln as parseBindingSpec, Lr as DEFAULT_PERSIST_EXCLUDE_TOOLS, Lt as createDiscoverySlot, M as matchesSafelistEntry, Mn as KEYBINDING_DEF_BY_ACTION, Mr as openrouterDescriptor, Mt as VAPORWAVE_THEME, N as projectsFilePath, Nn as ensureKeybindingsFile, Nr as piIdOf, Nt as CATPPUCCIN_FRAPPE, O as IMPLICITLY_SAFE_TOOLS, On as summarizeOutcomes, Or as getModelInfo, Ot as BUILTIN_THEMES, P as readProjects, Pn as keybindingsPath, Pr as BUILD_AGENT, Pt as CATPPUCCIN_LATTE, Q as McpAuthProvider, Qn as buildLinearRamp, Qr as pruneTodosByRun, Qt as listSessionMeta, R as formatPathForCwd, Rn as readKeybindings, Rr as PLAN_AGENT, Rt as DiscoveryProvider, S as renderSession, Sn as maskToOutcomeKinds, Sr as OUTPUT_RESERVE_TOKENS, St as DEFAULT_SETTINGS, T as SafeModeProvider, Tn as resolveApprovalForPayload, Tr as credKeyOf, Tt as SettingsProvider, U as indexOfEntry, Un as FILES_TRIGGER, Ur as TODOS_METADATA_KEY, Ut as resolveConfig, V as buildModelCatalog, Vn as createSkillsCompletionProvider, Vr as singleAgentRegistry, Vt as ConfigProvider, W as buildMcpServers, Wn as createFilesCompletionProvider, Wr as TODOWRITE_TOOL, X as mcpCredentialsPath, Xn as useCompletion, Xr as isTodoTool, Xt as isVisible, Y as createFileMcpCredentialStore, Yn as mergeReferences, Yr as getTodosForRun, Yt as isTurnHighlighted, Z as patchMcpCredential, Zn as blendHsl, Zr as pickActiveRunId, Zt as lastContextSizeFromTurns, _ as turnContextSize, _n as previewEditPayload, _r as readProviderCredential, _t as truncateTrailing, a as computeTurnAnchors, ai as IDENTITY_PREFIX, an as titleFromTurns, ar as compareSemver, at as InteractionsProvider, b as defaultSkillScanPaths, bn as tokenize, br as writeCredentials, bt as listProjectFiles, c as formatToolCall, ci as PLAN_MODE_DOCTRINE, cn as turnSelectionOwnership, cr as parseSemver, ct as createInteractionTools, d as useSelectStyle, di as TOKEN_DISCIPLINE_DOCTRINE, dn as buildContextualDiff, dr as resolvePlatformPackage, dt as pendingInteractionsFromTurns, ei as setTodosForRun, en as marginTopFor, er as bootProfileEnabled, et as useMcpAuthState, f as useSurfaces, fi as buildBuildSystem, fn as buildUnifiedDiff, fr as shouldAutoCompact, ft as serializeInteractionResponse, g as finalizeStreamingMarkdownForOwner, gn as filetypeFromPath, gr as readCredentials, gt as hintsLength, h as finalizeStreamingMarkdown, hn as extractEditPayload, hr as credentialsPath, ht as clipHintsToWidth, i as turnAsText, ii as DOING_TASKS_DOCTRINE, in as sumRunCosts, ir as checkForUpdate, it as ASK_USER_TOOL, j as isOnSafelist, jn as KEYBINDING_DEFS, jr as openaiDescriptor, jt as resolveTheme, k as addToSafelist, kn as findGitRoot, kr as modelSupportsReasoning, kt as DEFAULT_THEME, l as ThemeProvider, li as PLAN_MODE_DOCTRINE_NO_PROMPTS, ln as updateToolEventOutcomes, lr as performInPlaceSelfUpdate, lt as isInteractionTool, m as useTheme, mi as envSection, mn as computeLineDiff, mr as applyApiKeyEnv, mt as useInteractionsQueue, n as deleteTurnSafely, ni as ACTIONS_WITH_CARE_DOCTRINE, nn as selectableTurnIds, nr as buildUpdateHint, nt as reduceMcpAuth, o as TOOL_DISPLAY, oi as INTERACTION_GUIDANCE, on as toolCallPreview, or as detectLibc, ot as PRESENT_PLAN_TOOL, p as useSyntaxStyles, pi as buildPlanSystem, pn as computeInlineDiff, pr as detectAuth, pt as useInteractionsActions, q as parseMcpsFile, qn as collectReferences, qr as createTodoTools, qt as eventsFromTurns, r as truncateTurnsAt, ri as COMMUNICATION_DOCTRINE, rn as stripSpawnTokensLine, rr as useUpdateCheck, rt as splitMarkdownCodeBlocks, s as displayNameFor, si as INTERACTION_GUIDANCE_NO_PROMPTS, sn as toolResultText, sr as detectPackageManager, st as buildResumedToolResultsTurn, t as countNeighbors, ti as useActiveTodos, tn as saveState, tr as bootTick, tt as getMcpAuthStatus, u as useColors, ui as SUBAGENT_GUIDANCE, un as applyEditPayload, ur as performSelfUpdate, ut as makeRequestInteraction, v as useStreamBuffer, vn as splitLines, vr as removeProviderCredential, vt as cleanTitle, w as writeSessionExport, wn as parseEditOutcomesFromResult, wr as cerebrasDescriptor, wt as SETTINGS_TOGGLES, x as discoverProjectSkills, xn as buildEditOutcomesAnnotation, xr as BUILTIN_PROVIDERS, xt as useEnabledToggleSet, y as buildSkillsConfig, yn as summarizeEditPayload, yr as setProviderCredential, yt as generateSessionTitle, z as runOAuthLogin, zn as stripJsonComments, zr as accentColor, zt as useDiscovery } from "./turn-operations-DtMApNGT.js";
+import { B as formatTaskStatus, H as previewLine, I as ageString, L as compactPath, R as fmtTokens, U as shortId, V as formatTaskSummary, z as formatDuration } from "./tools-BavL6n7q.js";
+//#region src/chat/auto-update-cli.ts
+const UPGRADE_HELP = `Usage: zidane upgrade [options]
+
+Update the zidane CLI to the latest release.
+
+Options:
+  --check                   Print the latest version and exit (no install).
+  --in-place                Download the platform binary directly from npm
+                            and atomic-rename over the running binary.
+                            Skips the package manager. Refused on Volta.
+  --dry-run                 Resolve everything but don't actually install.
+  --channel <tag>           dist-tag to query (default: latest).
+  --registry <url>          Override the npm registry.
+  --package-manager <pm>    Force npm | pnpm | yarn | bun | volta.
+  --force                   Run the install even if we're already on latest,
+                            or the registry check failed.
+  -h, --help                Print this help.
+
+Environment:
+  NO_UPDATE_NOTIFIER        Silence the background check (set to "1").
+  ZIDANE_NO_UPDATE          Same, project-specific.
+`;
+/**
+* Run the `upgrade` subcommand. Exit code contract:
+*   - `0`  — update succeeded, `--check` reported no update, or `--check`
+*            reported an update (informational only).
+*   - `1`  — update failed (PM exit non-zero, in-place download failed,
+*            registry returned non-2xx).
+*   - `2`  — argv parse error (unknown flag).
+*/
+async function runUpdateCommand(options) {
+	const out = options.stdout ?? process.stdout;
+	const err = options.stderr ?? process.stderr;
+	const parsed = parseArgs(options.argv);
+	if (parsed.kind === "error") {
+		err.write(`zidane upgrade: ${parsed.message}\n`);
+		err.write(UPGRADE_HELP);
+		return { exitCode: 2 };
+	}
+	if (parsed.help) {
+		out.write(UPGRADE_HELP);
+		return { exitCode: 0 };
+	}
+	const channel = parsed.channel ?? options.defaultChannel ?? "latest";
+	const registry = parsed.registry ?? options.registry;
+	const status = await checkForUpdate({
+		packageName: options.packageName,
+		currentVersion: options.currentVersion,
+		channel,
+		registry,
+		cacheDir: options.cacheDir,
+		force: true,
+		timeoutMs: 8e3
+	});
+	if (parsed.check) {
+		if (status.source === "error") {
+			err.write(`Could not check \`${channel}\` (${status.error ?? "unknown error"}). Current: v${options.currentVersion}.\n`);
+			return { exitCode: 0 };
+		}
+		if (!status.latest) {
+			err.write(`Could not determine latest version on \`${channel}\`. Current: v${options.currentVersion}.\n`);
+			return { exitCode: 0 };
+		}
+		if (compareSemver(status.latest, options.currentVersion) > 0) out.write(`v${status.latest} is available on \`${channel}\` (current: v${options.currentVersion}).\n`);
+		else out.write(`Already on v${options.currentVersion} (latest on \`${channel}\` is v${status.latest}).\n`);
+		return { exitCode: 0 };
+	}
+	if (status.source === "error") {
+		err.write(`zidane upgrade: registry check failed (${status.error ?? "unknown error"})\n`);
+		if (!parsed.force) {
+			err.write("Pass --force to attempt the install anyway.\n");
+			return { exitCode: 1 };
+		}
+	}
+	if (status.latest && !parsed.force) {
+		if (compareSemver(status.latest, options.currentVersion) <= 0) {
+			out.write(`Already on v${options.currentVersion} (latest on \`${channel}\` is v${status.latest}).\n`);
+			return { exitCode: 0 };
+		}
+	}
+	if (parsed.inPlace) {
+		const platformPkg = resolvePlatformPackage({ prefix: options.platformPackagePrefix ?? `${options.packageName}-` });
+		if (!platformPkg) {
+			err.write(`No prebuilt binary for ${process.platform}/${process.arch}. Run \`${options.packageName}-upgrade\` via your package manager instead.\n`);
+			return { exitCode: 1 };
+		}
+		out.write(`Downloading ${platformPkg}@${channel}…\n`);
+		const result = await performInPlaceSelfUpdate({
+			packageName: platformPkg,
+			channel,
+			registry,
+			dryRun: parsed.dryRun
+		});
+		if (result.status === "success") {
+			const verb = parsed.dryRun ? "Would install" : "Installed";
+			out.write(`${verb} v${result.installedVersion} at ${result.binaryPath}.\n`);
+			return { exitCode: 0 };
+		}
+		err.write(`In-place update failed: ${result.reason ?? "unknown error"}\n`);
+		if (result.status === "refused") err.write("Falling back to package-manager path (drop --in-place to retry).\n");
+		return { exitCode: 1 };
+	}
+	const detected = detectPackageManager({
+		packageName: options.packageName,
+		channel
+	});
+	if (detected.note) out.write(`${detected.note}\n`);
+	out.write(`Running: ${detected.argv.join(" ")}\n`);
+	if (parsed.dryRun) return { exitCode: 0 };
+	const result = await performSelfUpdate({
+		packageName: options.packageName,
+		channel,
+		packageManager: parsed.packageManager ?? "auto"
+	});
+	if (result.spawnError) {
+		err.write(`Failed to launch \`${result.command.argv[0]}\`: ${result.spawnError}\n`);
+		err.write("Is the package manager installed and on $PATH?\n");
+		return { exitCode: 1 };
+	}
+	return { exitCode: result.exitCode ?? 1 };
+}
+function parseArgs(argv) {
+	let check = false;
+	let inPlace = false;
+	let dryRun = false;
+	let force = false;
+	let help = false;
+	let channel;
+	let registry;
+	let packageManager;
+	for (let i = 0; i < argv.length; i++) {
+		const a = argv[i];
+		switch (a) {
+			case "--check":
+				check = true;
+				break;
+			case "--in-place":
+			case "--inplace":
+				inPlace = true;
+				break;
+			case "--dry-run":
+			case "--dryrun":
+				dryRun = true;
+				break;
+			case "--force":
+				force = true;
+				break;
+			case "-h":
+			case "--help":
+				help = true;
+				break;
+			case "--channel":
+				channel = argv[++i];
+				if (!channel) return {
+					kind: "error",
+					message: "--channel requires a value"
+				};
+				break;
+			case "--registry":
+				registry = argv[++i];
+				if (!registry) return {
+					kind: "error",
+					message: "--registry requires a value"
+				};
+				break;
+			case "--package-manager":
+			case "--pm": {
+				const v = argv[++i];
+				if (!v) return {
+					kind: "error",
+					message: "--package-manager requires a value"
+				};
+				if (v !== "npm" && v !== "pnpm" && v !== "yarn" && v !== "bun" && v !== "volta") return {
+					kind: "error",
+					message: `unknown package manager: ${v}`
+				};
+				packageManager = v;
+				break;
+			}
+			default: return {
+				kind: "error",
+				message: `unknown argument: ${a}`
+			};
+		}
+	}
+	return {
+		kind: "ok",
+		check,
+		inPlace,
+		dryRun,
+		force,
+		help,
+		channel,
+		registry,
+		packageManager
+	};
+}
+//#endregion
+export { ACTIONS_WITH_CARE_DOCTRINE, ASK_USER_TOOL, BUILD_AGENT, BUILTIN_AGENTS, BUILTIN_PROVIDERS, BUILTIN_THEMES, CATPPUCCIN_FRAPPE, CATPPUCCIN_LATTE, CATPPUCCIN_MACCHIATO, CATPPUCCIN_MOCHA, COMMUNICATION_DOCTRINE, ConfigProvider, DEFAULT_AGENT_ID, DEFAULT_KEYBINDINGS, DEFAULT_PERSIST_EXCLUDE_TOOLS, DEFAULT_SETTINGS, DEFAULT_THEME, DOING_TASKS_DOCTRINE, DiscoveryProvider, FILES_TRIGGER, IDENTITY_PREFIX, IMPLICITLY_SAFE_TOOLS, INTERACTION_GUIDANCE, INTERACTION_GUIDANCE_NO_PROMPTS, InteractionsProvider, KEYBINDING_DEFS, KEYBINDING_DEF_BY_ACTION, McpAuthProvider, OUTPUT_RESERVE_TOKENS, PLAN_AGENT, PLAN_MODE_DOCTRINE, PLAN_MODE_DOCTRINE_NO_PROMPTS, PRESENT_PLAN_TOOL, SETTINGS_CHOICES, SETTINGS_TOGGLES, SKILLS_TRIGGER, SUBAGENT_GUIDANCE, SafeModeProvider, SettingsProvider, TODOREAD_TOOL, TODOS_METADATA_KEY, TODOWRITE_TOOL, TODO_STATUS_GLYPHS, TODO_WRITE_COUNTS_METADATA_KEY, TOKEN_DISCIPLINE_DOCTRINE, TOOL_DISPLAY, ThemeProvider, VAPORWAVE_THEME, accentColor, addToSafelist, ageString, anthropicDescriptor, applyApiKeyEnv, applyEditPayload, applyInsert, blendHsl, bootProfileEnabled, bootTick, buildBuildSystem, buildContextualDiff, buildEditOutcomesAnnotation, buildLinearRamp, buildMcpServers, buildModelCatalog, buildPlanSystem, buildResumedToolResultsTurn, buildSkillsConfig, buildUnifiedDiff, buildUpdateHint, cerebrasDescriptor, checkForUpdate, cleanTitle, clipHintsToWidth, collectReferences, compactPath, compareSemver, computeInlineDiff, computeLineDiff, computeTurnAnchors, countNeighbors, createDiscoverySlot, createFileMcpCredentialStore, createFilesCompletionProvider, createInteractionTools, createSkillsCompletionProvider, createStateStore, createTodoTools, credKeyOf, credentialsPath, defaultMcpsConfigPaths, defaultSkillScanPaths, deleteTurnSafely, deriveSessionTitle, detectAuth, detectLibc, detectPackageManager, discoverProjectMcps, discoverProjectSkills, displayNameFor, effectiveContextWindow, ensureKeybindingsFile, envSection, eventsFromTurns, extractEditPayload, filetypeFromPath, filterModelCatalog, finalizeStreamingMarkdown, finalizeStreamingMarkdownForOwner, findActiveTrigger, findGitRoot, fmtTokens, formatDuration, formatPathForCwd, formatTaskStatus, formatTaskSummary, formatToolCall, generateSessionTitle, getArchivedTodosForRun, getContextWindow, getMcpAuthStatus, getModelInfo, getSafelist, getTodosForRun, hintsLength, indexOfEntry, isEditErrorResult, isInteractionTool, isOnSafelist, isTodoTool, isTurnHighlighted, isVisible, keybindingsPath, lastContextSizeFromTurns, listProjectFiles, listSessionMeta, loadState, makeRequestInteraction, marginTopFor, maskToOutcomeKinds, matchesBinding, matchesSafelistEntry, mcpCredentialsPath, mergeApprovalAndBodyOutcomes, mergeKeybindings, mergeReferences, modelSupportsReasoning, modelsForDescriptor, openaiDescriptor, openrouterDescriptor, parseBindingSpec, parseEditOutcomesFromResult, parseMcpsFile, parseSemver, patchMcpCredential, pendingInteractionsFromTurns, performInPlaceSelfUpdate, performSelfUpdate, piIdOf, pickActiveRunId, previewEditPayload, previewLine, projectUserPaths, projectsFilePath, pruneTodosByRun, readCredentials, readKeybindings, readProjects, readProviderCredential, reduceMcpAuth, removeProviderCredential, renderSession, resolveAgentId, resolveApprovalForPayload, resolveChipColor, resolveConfig, resolvePlatformPackage, resolveSessionExportTarget, resolveTheme, rewriteMultiEditHeader, runOAuthLogin, runUpdateCommand, saveState, selectActiveTodos, selectableTurnIds, serializeInteractionResponse, setProviderCredential, setTodosForRun, shortId, shouldAutoCompact, singleAgentRegistry, splitLines, splitMarkdownCodeBlocks, splitPromptSegments, stripEditOutcomesAnnotation, stripJsonComments, stripSpawnTokensLine, suggestSafelistEntry, sumRunCosts, summarizeEditPayload, summarizeOutcomes, supportsOAuth, titleFromTurns, tokenize, toolCallPreview, toolResultText, truncateTrailing, truncateTurnsAt, tryOpenBrowser, turnAsText, turnContextSize, turnSelectionOwnership, uniqueFilesFromReferences, uniqueSkillNamesFromReferences, updateToolEventOutcomes, useActiveTodos, useColors, useCompletion, useConfig, useDiscovery, useDiscoveryOptional, useEnabledToggleSet, useInteractionsActions, useInteractionsQueue, useMcpAuthDispatch, useMcpAuthState, useSafeModeActions, useSafeModeQueue, useSelectStyle, useSettings, useStreamBuffer, useSurfaces, useSyntaxStyles, useTheme, useUpdateCheck, writeCredentials, writeProjects, writeSessionExport };
+
+//# sourceMappingURL=chat.js.map

package/dist/chat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat.js","names":[],"sources":["../src/chat/auto-update-cli.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// `zidane upgrade` subcommand — drop-in handler for consumer CLIs.\n//\n// Wraps `checkForUpdate` + `performSelfUpdate` + `performInPlaceSelfUpdate`\n// into a single function the host's `cli.ts` can call. The behavior layers:\n//\n//   - no flags          → check + run the package manager\n//   - `--check`         → check only, print the latest version + bail\n//   - `--in-place`      → skip the PM, download + atomic-rename the binary\n//   - `--dry-run`       → resolve everything but don't actually swap\n//   - `--channel <tag>` → override dist-tag (defaults to `'latest'`)\n//   - `--registry <url>`→ override the npm registry URL\n//\n// Pure I/O — writes to stdout/stderr, returns the exit code the caller\n// should pass to `process.exit`. No React, no OpenTUI; safe to call\n// before / instead of `runTui`.\n// ---------------------------------------------------------------------------\n\nimport {\n  checkForUpdate,\n  compareSemver,\n  detectPackageManager,\n  performInPlaceSelfUpdate,\n  performSelfUpdate,\n  resolvePlatformPackage,\n} from './auto-update'\n\nexport interface RunUpdateCommandOptions {\n  /** Top-level package the user installs (e.g. `'zidane-tui'`). */\n  packageName: string\n  /** Inlined at build time. */\n  currentVersion: string\n  /** Args passed after `upgrade` (typically `process.argv.slice(3)`). */\n  argv: readonly string[]\n  /** Where to persist the TTL cache. Usually `paths.userDir`. */\n  cacheDir?: string\n  /** Default channel when `--channel` isn't passed. Defaults to `'latest'`. */\n  defaultChannel?: string\n  /**\n   * Override the platform-package-name prefix used by `--in-place`.\n   * Defaults to `'<packageName>-'`, matching the `zidane-tui-<key>` layout.\n   */\n  platformPackagePrefix?: string\n  /** Override registry. Defaults to npmjs. */\n  registry?: string\n  /** stdout. Defaults to `process.stdout`. */\n  stdout?: NodeJS.WritableStream\n  /** stderr. Defaults to `process.stderr`. */\n  stderr?: NodeJS.WritableStream\n}\n\nexport interface RunUpdateCommandResult {\n  exitCode: number\n}\n\nconst UPGRADE_HELP = `Usage: zidane upgrade [options]\n\nUpdate the zidane CLI to the latest release.\n\nOptions:\n  --check                   Print the latest version and exit (no install).\n  --in-place                Download the platform binary directly from npm\n                            and atomic-rename over the running binary.\n                            Skips the package manager. Refused on Volta.\n  --dry-run                 Resolve everything but don't actually install.\n  --channel <tag>           dist-tag to query (default: latest).\n  --registry <url>          Override the npm registry.\n  --package-manager <pm>    Force npm | pnpm | yarn | bun | volta.\n  --force                   Run the install even if we're already on latest,\n                            or the registry check failed.\n  -h, --help                Print this help.\n\nEnvironment:\n  NO_UPDATE_NOTIFIER        Silence the background check (set to \"1\").\n  ZIDANE_NO_UPDATE          Same, project-specific.\n`\n\n/**\n * Run the `upgrade` subcommand. Exit code contract:\n *   - `0`  — update succeeded, `--check` reported no update, or `--check`\n *            reported an update (informational only).\n *   - `1`  — update failed (PM exit non-zero, in-place download failed,\n *            registry returned non-2xx).\n *   - `2`  — argv parse error (unknown flag).\n */\nexport async function runUpdateCommand(options: RunUpdateCommandOptions): Promise<RunUpdateCommandResult> {\n  const out = options.stdout ?? process.stdout\n  const err = options.stderr ?? process.stderr\n  const parsed = parseArgs(options.argv)\n  if (parsed.kind === 'error') {\n    err.write(`zidane upgrade: ${parsed.message}\\n`)\n    err.write(UPGRADE_HELP)\n    return { exitCode: 2 }\n  }\n  if (parsed.help) {\n    out.write(UPGRADE_HELP)\n    return { exitCode: 0 }\n  }\n\n  const channel = parsed.channel ?? options.defaultChannel ?? 'latest'\n  const registry = parsed.registry ?? options.registry\n\n  // Always force the check — user typed `upgrade`, env opt-outs shouldn't\n  // get in the way.\n  const status = await checkForUpdate({\n    packageName: options.packageName,\n    currentVersion: options.currentVersion,\n    channel,\n    registry,\n    cacheDir: options.cacheDir,\n    force: true,\n    timeoutMs: 8000,\n  })\n\n  // `--check` is informational — degrade gracefully on registry errors\n  // (offline laptop, restricted proxy) and exit 0 so the user can script\n  // around it without quoting tricks.\n  if (parsed.check) {\n    if (status.source === 'error') {\n      err.write(`Could not check \\`${channel}\\` (${status.error ?? 'unknown error'}). Current: v${options.currentVersion}.\\n`)\n      return { exitCode: 0 }\n    }\n    if (!status.latest) {\n      err.write(`Could not determine latest version on \\`${channel}\\`. Current: v${options.currentVersion}.\\n`)\n      return { exitCode: 0 }\n    }\n    const cmp = compareSemver(status.latest, options.currentVersion)\n    if (cmp > 0)\n      out.write(`v${status.latest} is available on \\`${channel}\\` (current: v${options.currentVersion}).\\n`)\n    else\n      out.write(`Already on v${options.currentVersion} (latest on \\`${channel}\\` is v${status.latest}).\\n`)\n    return { exitCode: 0 }\n  }\n\n  // Install path — a registry error means we don't KNOW if we need an\n  // update. Refuse to spawn the PM blindly unless the user explicitly\n  // asks via `--force`.\n  if (status.source === 'error') {\n    err.write(`zidane upgrade: registry check failed (${status.error ?? 'unknown error'})\\n`)\n    if (!parsed.force) {\n      err.write('Pass --force to attempt the install anyway.\\n')\n      return { exitCode: 1 }\n    }\n  }\n\n  if (status.latest && !parsed.force) {\n    const cmp = compareSemver(status.latest, options.currentVersion)\n    if (cmp <= 0) {\n      out.write(`Already on v${options.currentVersion} (latest on \\`${channel}\\` is v${status.latest}).\\n`)\n      return { exitCode: 0 }\n    }\n  }\n\n  // ---------------------------------------------------------------------\n  // In-place path\n  // ---------------------------------------------------------------------\n\n  if (parsed.inPlace) {\n    const platformPkg = resolvePlatformPackage({\n      prefix: options.platformPackagePrefix ?? `${options.packageName}-`,\n    })\n    if (!platformPkg) {\n      err.write(`No prebuilt binary for ${process.platform}/${process.arch}. Run \\`${options.packageName}-upgrade\\` via your package manager instead.\\n`)\n      return { exitCode: 1 }\n    }\n    out.write(`Downloading ${platformPkg}@${channel}…\\n`)\n    const result = await performInPlaceSelfUpdate({\n      packageName: platformPkg,\n      channel,\n      registry,\n      dryRun: parsed.dryRun,\n    })\n    if (result.status === 'success') {\n      const verb = parsed.dryRun ? 'Would install' : 'Installed'\n      out.write(`${verb} v${result.installedVersion} at ${result.binaryPath}.\\n`)\n      return { exitCode: 0 }\n    }\n    err.write(`In-place update failed: ${result.reason ?? 'unknown error'}\\n`)\n    if (result.status === 'refused')\n      err.write('Falling back to package-manager path (drop --in-place to retry).\\n')\n    return { exitCode: 1 }\n  }\n\n  // ---------------------------------------------------------------------\n  // Package-manager path\n  // ---------------------------------------------------------------------\n\n  const detected = detectPackageManager({ packageName: options.packageName, channel })\n  if (detected.note)\n    out.write(`${detected.note}\\n`)\n  out.write(`Running: ${detected.argv.join(' ')}\\n`)\n  if (parsed.dryRun)\n    return { exitCode: 0 }\n\n  const result = await performSelfUpdate({\n    packageName: options.packageName,\n    channel,\n    packageManager: parsed.packageManager ?? 'auto',\n  })\n  if (result.spawnError) {\n    err.write(`Failed to launch \\`${result.command.argv[0]}\\`: ${result.spawnError}\\n`)\n    err.write('Is the package manager installed and on $PATH?\\n')\n    return { exitCode: 1 }\n  }\n  return { exitCode: result.exitCode ?? 1 }\n}\n\n// ---------------------------------------------------------------------------\n// Argv parser — minimal, just enough to drop into the consumer's `cli.ts`.\n// We deliberately don't pull in commander/yargs for a 5-flag surface.\n// ---------------------------------------------------------------------------\n\ntype ParseResult\n  = | {\n    kind: 'ok'\n    check: boolean\n    inPlace: boolean\n    dryRun: boolean\n    force: boolean\n    help: boolean\n    channel?: string\n    registry?: string\n    packageManager?: 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta'\n  }\n  | { kind: 'error', message: string }\n\nfunction parseArgs(argv: readonly string[]): ParseResult {\n  let check = false\n  let inPlace = false\n  let dryRun = false\n  let force = false\n  let help = false\n  let channel: string | undefined\n  let registry: string | undefined\n  let packageManager: 'npm' | 'pnpm' | 'yarn' | 'bun' | 'volta' | undefined\n\n  for (let i = 0; i < argv.length; i++) {\n    const a = argv[i]!\n    switch (a) {\n      case '--check': check = true; break\n      case '--in-place':\n      case '--inplace': inPlace = true; break\n      case '--dry-run':\n      case '--dryrun': dryRun = true; break\n      case '--force': force = true; break\n      case '-h':\n      case '--help': help = true; break\n      case '--channel':\n        channel = argv[++i]\n        if (!channel)\n          return { kind: 'error', message: '--channel requires a value' }\n        break\n      case '--registry':\n        registry = argv[++i]\n        if (!registry)\n          return { kind: 'error', message: '--registry requires a value' }\n        break\n      case '--package-manager':\n      case '--pm': {\n        const v = argv[++i]\n        if (!v)\n          return { kind: 'error', message: '--package-manager requires a value' }\n        if (v !== 'npm' && v !== 'pnpm' && v !== 'yarn' && v !== 'bun' && v !== 'volta')\n          return { kind: 'error', message: `unknown package manager: ${v}` }\n        packageManager = v\n        break\n      }\n      default:\n        return { kind: 'error', message: `unknown argument: ${a}` }\n    }\n  }\n\n  return { kind: 'ok', check, inPlace, dryRun, force, help, channel, registry, packageManager }\n}\n"],"mappings":";;;AAuDA,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BrB,eAAsB,iBAAiB,SAAmE;CACxG,MAAM,MAAM,QAAQ,UAAU,QAAQ;CACtC,MAAM,MAAM,QAAQ,UAAU,QAAQ;CACtC,MAAM,SAAS,UAAU,QAAQ,KAAK;CACtC,IAAI,OAAO,SAAS,SAAS;EAC3B,IAAI,MAAM,mBAAmB,OAAO,QAAQ,IAAI;EAChD,IAAI,MAAM,aAAa;EACvB,OAAO,EAAE,UAAU,GAAG;;CAExB,IAAI,OAAO,MAAM;EACf,IAAI,MAAM,aAAa;EACvB,OAAO,EAAE,UAAU,GAAG;;CAGxB,MAAM,UAAU,OAAO,WAAW,QAAQ,kBAAkB;CAC5D,MAAM,WAAW,OAAO,YAAY,QAAQ;CAI5C,MAAM,SAAS,MAAM,eAAe;EAClC,aAAa,QAAQ;EACrB,gBAAgB,QAAQ;EACxB;EACA;EACA,UAAU,QAAQ;EAClB,OAAO;EACP,WAAW;EACZ,CAAC;CAKF,IAAI,OAAO,OAAO;EAChB,IAAI,OAAO,WAAW,SAAS;GAC7B,IAAI,MAAM,qBAAqB,QAAQ,MAAM,OAAO,SAAS,gBAAgB,eAAe,QAAQ,eAAe,KAAK;GACxH,OAAO,EAAE,UAAU,GAAG;;EAExB,IAAI,CAAC,OAAO,QAAQ;GAClB,IAAI,MAAM,2CAA2C,QAAQ,gBAAgB,QAAQ,eAAe,KAAK;GACzG,OAAO,EAAE,UAAU,GAAG;;EAGxB,IADY,cAAc,OAAO,QAAQ,QAAQ,eAC1C,GAAG,GACR,IAAI,MAAM,IAAI,OAAO,OAAO,qBAAqB,QAAQ,gBAAgB,QAAQ,eAAe,MAAM;OAEtG,IAAI,MAAM,eAAe,QAAQ,eAAe,gBAAgB,QAAQ,SAAS,OAAO,OAAO,MAAM;EACvG,OAAO,EAAE,UAAU,GAAG;;CAMxB,IAAI,OAAO,WAAW,SAAS;EAC7B,IAAI,MAAM,0CAA0C,OAAO,SAAS,gBAAgB,KAAK;EACzF,IAAI,CAAC,OAAO,OAAO;GACjB,IAAI,MAAM,gDAAgD;GAC1D,OAAO,EAAE,UAAU,GAAG;;;CAI1B,IAAI,OAAO,UAAU,CAAC,OAAO;MACf,cAAc,OAAO,QAAQ,QAAQ,eAC1C,IAAI,GAAG;GACZ,IAAI,MAAM,eAAe,QAAQ,eAAe,gBAAgB,QAAQ,SAAS,OAAO,OAAO,MAAM;GACrG,OAAO,EAAE,UAAU,GAAG;;;CAQ1B,IAAI,OAAO,SAAS;EAClB,MAAM,cAAc,uBAAuB,EACzC,QAAQ,QAAQ,yBAAyB,GAAG,QAAQ,YAAY,IACjE,CAAC;EACF,IAAI,CAAC,aAAa;GAChB,IAAI,MAAM,0BAA0B,QAAQ,SAAS,GAAG,QAAQ,KAAK,UAAU,QAAQ,YAAY,gDAAgD;GACnJ,OAAO,EAAE,UAAU,GAAG;;EAExB,IAAI,MAAM,eAAe,YAAY,GAAG,QAAQ,KAAK;EACrD,MAAM,SAAS,MAAM,yBAAyB;GAC5C,aAAa;GACb;GACA;GACA,QAAQ,OAAO;GAChB,CAAC;EACF,IAAI,OAAO,WAAW,WAAW;GAC/B,MAAM,OAAO,OAAO,SAAS,kBAAkB;GAC/C,IAAI,MAAM,GAAG,KAAK,IAAI,OAAO,iBAAiB,MAAM,OAAO,WAAW,KAAK;GAC3E,OAAO,EAAE,UAAU,GAAG;;EAExB,IAAI,MAAM,2BAA2B,OAAO,UAAU,gBAAgB,IAAI;EAC1E,IAAI,OAAO,WAAW,WACpB,IAAI,MAAM,qEAAqE;EACjF,OAAO,EAAE,UAAU,GAAG;;CAOxB,MAAM,WAAW,qBAAqB;EAAE,aAAa,QAAQ;EAAa;EAAS,CAAC;CACpF,IAAI,SAAS,MACX,IAAI,MAAM,GAAG,SAAS,KAAK,IAAI;CACjC,IAAI,MAAM,YAAY,SAAS,KAAK,KAAK,IAAI,CAAC,IAAI;CAClD,IAAI,OAAO,QACT,OAAO,EAAE,UAAU,GAAG;CAExB,MAAM,SAAS,MAAM,kBAAkB;EACrC,aAAa,QAAQ;EACrB;EACA,gBAAgB,OAAO,kBAAkB;EAC1C,CAAC;CACF,IAAI,OAAO,YAAY;EACrB,IAAI,MAAM,sBAAsB,OAAO,QAAQ,KAAK,GAAG,MAAM,OAAO,WAAW,IAAI;EACnF,IAAI,MAAM,mDAAmD;EAC7D,OAAO,EAAE,UAAU,GAAG;;CAExB,OAAO,EAAE,UAAU,OAAO,YAAY,GAAG;;AAsB3C,SAAS,UAAU,MAAsC;CACvD,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,IAAI,SAAS;CACb,IAAI,QAAQ;CACZ,IAAI,OAAO;CACX,IAAI;CACJ,IAAI;CACJ,IAAI;CAEJ,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,IAAI,KAAK;EACf,QAAQ,GAAR;GACE,KAAK;IAAW,QAAQ;IAAM;GAC9B,KAAK;GACL,KAAK;IAAa,UAAU;IAAM;GAClC,KAAK;GACL,KAAK;IAAY,SAAS;IAAM;GAChC,KAAK;IAAW,QAAQ;IAAM;GAC9B,KAAK;GACL,KAAK;IAAU,OAAO;IAAM;GAC5B,KAAK;IACH,UAAU,KAAK,EAAE;IACjB,IAAI,CAAC,SACH,OAAO;KAAE,MAAM;KAAS,SAAS;KAA8B;IACjE;GACF,KAAK;IACH,WAAW,KAAK,EAAE;IAClB,IAAI,CAAC,UACH,OAAO;KAAE,MAAM;KAAS,SAAS;KAA+B;IAClE;GACF,KAAK;GACL,KAAK,QAAQ;IACX,MAAM,IAAI,KAAK,EAAE;IACjB,IAAI,CAAC,GACH,OAAO;KAAE,MAAM;KAAS,SAAS;KAAsC;IACzE,IAAI,MAAM,SAAS,MAAM,UAAU,MAAM,UAAU,MAAM,SAAS,MAAM,SACtE,OAAO;KAAE,MAAM;KAAS,SAAS,4BAA4B;KAAK;IACpE,iBAAiB;IACjB;;GAEF,SACE,OAAO;IAAE,MAAM;IAAS,SAAS,qBAAqB;IAAK;;;CAIjE,OAAO;EAAE,MAAM;EAAM;EAAO;EAAS;EAAQ;EAAO;EAAM;EAAS;EAAU;EAAgB"}

package/dist/{contexts-DhmMlT2W.js → contexts-BOtMvzli.js}

@@ -469,4 +469,4 @@ function createSandboxContext(provider) {
 //#endregion
 export { createProcessContext as n, createSandboxContext as t };
 
-//# sourceMappingURL=contexts-DhmMlT2W.js.map
+//# sourceMappingURL=contexts-BOtMvzli.js.map

package/dist/{contexts-DhmMlT2W.js.map → contexts-BOtMvzli.js.map}

@@ -1 +1 @@
-{"version":3,"file":"contexts-DhmMlT2W.js","names":["spawnChild"],"sources":["../src/contexts/process.ts","../src/contexts/sandbox.ts"],"sourcesContent":["/**\n * In-process execution context.\n *\n * Runs everything in the current Node/Bun process.\n * No isolation — fastest, used as the default.\n */\n\nimport type { Buffer } from 'node:buffer'\nimport type { ChildProcess } from 'node:child_process'\nimport type { WriteStream } from 'node:fs'\nimport type { ContextCapabilities, ExecResult, ExecutionContext, ExecutionHandle, SpawnConfig, TaskEntry, TaskExitInfo, TaskHandle } from './types'\nimport { spawn as spawnChild } from 'node:child_process'\nimport { createWriteStream } from 'node:fs'\nimport { mkdir, readdir, readFile, writeFile } from 'node:fs/promises'\nimport { dirname, resolve } from 'node:path'\n\n/**\n * Whether the host supports POSIX process groups (the `detached: true` +\n * `process.kill(-pid)` combination). Windows doesn't — its job-object\n * model is shaped differently — so on win32 we fall back to killing the\n * shell wrapper alone (matches pre-fix behavior; better than nothing).\n */\nconst SUPPORTS_PROCESS_GROUPS = process.platform !== 'win32'\n\n/**\n * Default cap on captured stdout / stderr per child. Matches the\n * pre-fix `child_process.exec` setting so existing callers see the\n * same buffer envelope. Output beyond this is truncated and a\n * marker is appended to stderr.\n */\nconst DEFAULT_MAX_BUFFER = 10 * 1024 * 1024\n\n/**\n * Sanitize a task id before it's joined into a filesystem path.\n *\n * We mint `bash_<n>` ids ourselves (no user input flows into the path\n * for `ProcessContext`), so this is defensive — but third-party contexts\n * MAY accept caller-provided ids, so the helper exists for them too.\n * Anything that doesn't match the expected shape is rejected — never\n * coerced — so the call site sees a clear error rather than a\n * traversal-shaped path.\n */\nconst TASK_ID_RE = /^[a-z][\\w-]*$/i\n\nfunction assertSafeTaskId(taskId: string): void {\n  if (!TASK_ID_RE.test(taskId))\n    throw new Error(`Invalid task id \"${taskId}\" — must match ${TASK_ID_RE}.`)\n}\n\n/**\n * Format `date` as `YYYYMMDD-HHMMSS-mmm` in UTC.\n *\n * Pinned to UTC so the lexical sort of two timestamps always matches\n * their chronological order (local time + DST does not). Used as the\n * per-context suffix on background-task log filenames; see the field\n * doc on `contextTimestamp` for the why.\n */\nexport function formatContextTimestamp(date: Date): string {\n  const pad2 = (n: number): string => n.toString().padStart(2, '0')\n  const pad3 = (n: number): string => n.toString().padStart(3, '0')\n  const y = date.getUTCFullYear()\n  const M = pad2(date.getUTCMonth() + 1)\n  const d = pad2(date.getUTCDate())\n  const h = pad2(date.getUTCHours())\n  const m = pad2(date.getUTCMinutes())\n  const s = pad2(date.getUTCSeconds())\n  const ms = pad3(date.getUTCMilliseconds())\n  return `${y}${M}${d}-${h}${m}${s}-${ms}`\n}\n\n/** Pattern of a background-task log filename. Used by tests + tooling. */\nexport const TASK_LOG_FILENAME_RE = /^(bash_\\d+)\\.(\\d{8}-\\d{6}-\\d{3})\\.log$/\n\nexport function createProcessContext(config?: SpawnConfig): ExecutionContext {\n  let counter = 0\n  const handles = new Map<string, ExecutionHandle>()\n  const defaultCwd = config?.cwd ?? process.cwd()\n  const defaultEnv = config?.env\n\n  /**\n   * Per-context background-task registry. Entries live for the context's\n   * lifetime — even after the child exits — so the model can read output\n   * of completed tasks until `destroy()` tears everything down. Kept as\n   * a plain Map (not a class) per code-quality checklist #7: no premature\n   * abstraction. The state and the operations on it live inline.\n   */\n  const tasks = new Map<string, TaskState>()\n  let taskCounter = 0\n\n  /**\n   * Per-context UTC timestamp segment baked into every background task's\n   * log filename. Same `taskCounter` value across two contexts (e.g. a\n   * TUI restart) would otherwise re-open the SAME `bash_<n>.log` file —\n   * we open with `flags: 'a'` so the new task would APPEND into the old\n   * log, producing scrambled output. The timestamp guarantees each\n   * context owns a distinct log filename without forcing the\n   * model-facing task id (`bash_<n>`) to grow longer.\n   *\n   * Format: `YYYYMMDD-HHMMSS-mmm` in UTC.\n   *   - Sortable (lexical sort = chronological sort).\n   *   - Unambiguous (UTC sidesteps DST / locale shifts).\n   *   - Filesystem-safe (digits + hyphens only).\n   *   - Millisecond precision avoids same-second-restart collisions.\n   *\n   * The timestamp is computed once per context, NOT per task — all of a\n   * context's tasks share the same suffix so a directory listing groups\n   * cleanly by \"which run produced these\".\n   */\n  const contextTimestamp = formatContextTimestamp(new Date())\n\n  /**\n   * Last-resort orphan reaper. With `detached: true`, background tasks\n   * are in their OWN process group — when the parent (zidane TUI) dies,\n   * the OS does NOT send them SIGHUP and they keep running indefinitely.\n   * The user's \"Ctrl+C the TUI\" intent is \"stop everything I started\",\n   * not \"leak a `sleep 60` into the background\".\n   *\n   * `process.on('exit')` fires SYNCHRONOUSLY on `process.exit()` AND on\n   * natural shutdown — exactly the seam we need. The handler can only\n   * do synchronous work (Node ignores async), but `process.kill` IS\n   * synchronous, so a SIGTERM-the-group sweep lands cleanly. The kill\n   * is best-effort: already-dead children throw ESRCH (swallowed).\n   *\n   * Registered lazily on first `execBackground` so contexts that never\n   * background a task don't pay the listener cost. Deregistered in\n   * `destroy()` so reconstructed contexts don't accumulate listeners\n   * (Node warns past 10 — a long-running session that switches sessions\n   * frequently would otherwise hit that).\n   */\n  let exitHandlerRegistered = false\n  const exitHandler = (): void => {\n    for (const task of tasks.values()) {\n      if (task.status !== 'running')\n        continue\n      const pid = task.child.pid\n      if (pid === undefined)\n        continue\n      try {\n        if (SUPPORTS_PROCESS_GROUPS)\n          process.kill(-pid, 'SIGTERM')\n        else\n          process.kill(pid, 'SIGTERM')\n      }\n      catch {\n        // ESRCH (already dead) / EPERM (lost ownership). Swallow —\n        // the process either won't kill cleanly OR is already gone,\n        // both acceptable at shutdown.\n      }\n    }\n  }\n\n  return {\n    type: 'process',\n\n    capabilities: {\n      shell: true,\n      filesystem: true,\n      network: true,\n      gpu: false,\n    } satisfies ContextCapabilities,\n\n    async spawn(overrides?: SpawnConfig): Promise<ExecutionHandle> {\n      const id = `process-${++counter}`\n      const cwd = overrides?.cwd ?? defaultCwd\n\n      await mkdir(cwd, { recursive: true })\n\n      const handle: ExecutionHandle = { id, type: 'process', cwd }\n      handles.set(id, handle)\n      return handle\n    },\n\n    async exec(\n      handle: ExecutionHandle,\n      command: string,\n      options?: { cwd?: string, env?: Record<string, string>, timeout?: number, signal?: AbortSignal },\n    ): Promise<ExecResult> {\n      const cwd = options?.cwd ? resolve(handle.cwd, options.cwd) : handle.cwd\n\n      // Pre-aborted fast path: skip the spawn entirely and synthesize a\n      // killed-by-signal result. Saves a spawn round-trip + dodges Node\n      // emitting an immediate `AbortError`.\n      if (options?.signal?.aborted) {\n        return { stdout: '', stderr: 'aborted by signal before spawn', exitCode: 143 }\n      }\n\n      const timeoutMs = (options?.timeout ?? config?.limits?.timeout ?? 30) * 1000\n      const maxBuffer = DEFAULT_MAX_BUFFER\n\n      return new Promise<ExecResult>((resolveP) => {\n        // Spawn as a NEW process group leader so we can kill the whole\n        // subtree on abort. Without `detached: true`, sending SIGTERM to\n        // the shell's pid only kills the shell wrapper — its child\n        // processes (the actual `sleep`, `npm`, `python`, …) get\n        // reparented to init and keep running. `process.kill(-pid, …)`\n        // with a NEGATIVE pid targets the whole process group; that's\n        // the POSIX idiom for \"shut down everything I started\".\n        //\n        // On Windows there are no process groups in the POSIX sense, so\n        // we leave `detached` off and accept the shell-only kill — the\n        // platform's job-object machinery is the path forward there if\n        // we ever need it, but it's not the bug zidane's users are\n        // hitting today.\n        const child = spawnChild('/bin/sh', ['-c', command], {\n          cwd,\n          env: { ...process.env, ...defaultEnv, ...options?.env },\n          stdio: ['ignore', 'pipe', 'pipe'],\n          detached: SUPPORTS_PROCESS_GROUPS,\n        })\n\n        let stdout = ''\n        let stderr = ''\n        let bufferTruncated = false\n        let timedOut = false\n        let killedByAbort = false\n        let settled = false\n\n        const appendCapped = (slot: 'stdout' | 'stderr', chunk: Buffer): void => {\n          const current = slot === 'stdout' ? stdout : stderr\n          if (current.length >= maxBuffer)\n            return\n          const room = maxBuffer - current.length\n          const piece = chunk.length <= room ? chunk.toString('utf8') : chunk.subarray(0, room).toString('utf8')\n          if (slot === 'stdout')\n            stdout += piece\n          else\n            stderr += piece\n          if (chunk.length > room) {\n            bufferTruncated = true\n            // Kill on overflow — matches `execAsync`'s `maxBuffer`\n            // behavior (which kills the child and surfaces an error).\n            killProcessGroup(child, 'SIGTERM')\n          }\n        }\n\n        child.stdout?.on('data', chunk => appendCapped('stdout', chunk as Buffer))\n        child.stderr?.on('data', chunk => appendCapped('stderr', chunk as Buffer))\n\n        const timeoutTimer = timeoutMs > 0\n          ? setTimeout(() => {\n              timedOut = true\n              killProcessGroup(child, 'SIGTERM')\n            }, timeoutMs)\n          : undefined\n\n        const onAbort = (): void => {\n          killedByAbort = true\n          killProcessGroup(child, 'SIGTERM')\n        }\n        const userSignal = options?.signal\n        if (userSignal)\n          userSignal.addEventListener('abort', onAbort, { once: true })\n\n        const settle = (exitCode: number, extraStderr?: string): void => {\n          if (settled)\n            return\n          settled = true\n          if (timeoutTimer)\n            clearTimeout(timeoutTimer)\n          if (userSignal)\n            userSignal.removeEventListener('abort', onAbort)\n          const finalStderr = extraStderr\n            ? (stderr ? `${stderr}\\n${extraStderr}` : extraStderr)\n            : stderr\n          resolveP({ stdout, stderr: finalStderr, exitCode })\n        }\n\n        child.on('error', (err) => {\n          // Spawn failure (ENOENT on `/bin/sh`, EACCES, …). Mirror\n          // `execAsync`'s \"rejects with an Error\" shape by surfacing\n          // the message on stderr and a non-zero exit.\n          settle(1, err.message)\n        })\n\n        child.on('close', (code, signal) => {\n          // Order matters: killed-by-our-abort wins over timeout wins\n          // over natural exit, because the abort listener fires first\n          // when the user cancels mid-timeout-window. All three land\n          // here through `close`, but we tag the stderr suffix /\n          // exit-code differently so callers can tell the cause.\n          if (killedByAbort) {\n            settle(143, 'aborted by signal')\n            return\n          }\n          if (timedOut) {\n            settle(124, `command timed out after ${timeoutMs}ms`)\n            return\n          }\n          if (bufferTruncated) {\n            settle(143, `output exceeded ${maxBuffer}-byte buffer; process killed`)\n            return\n          }\n          if (signal) {\n            // Killed by some other signal we didn't issue. Treat as\n            // signal-killed for consumer compat.\n            settle(128 + 15, `terminated by signal ${signal}`)\n            return\n          }\n          settle(typeof code === 'number' ? code : 1)\n        })\n      })\n    },\n\n    async readFile(handle: ExecutionHandle, path: string): Promise<string> {\n      return readFile(resolve(handle.cwd, path), 'utf-8')\n    },\n\n    async readFileBinary(handle: ExecutionHandle, path: string): Promise<Uint8Array> {\n      // No encoding → returns a Buffer (which is a Uint8Array). Used by\n      // read_file to ferry image / binary content into the multimodal route.\n      const buf = await readFile(resolve(handle.cwd, path))\n      return new Uint8Array(buf)\n    },\n\n    async writeFile(handle: ExecutionHandle, path: string, content: string): Promise<void> {\n      const fullPath = resolve(handle.cwd, path)\n      await mkdir(dirname(fullPath), { recursive: true })\n      await writeFile(fullPath, content, 'utf-8')\n    },\n\n    async listFiles(handle: ExecutionHandle, path: string): Promise<string[]> {\n      return readdir(resolve(handle.cwd, path))\n    },\n\n    async execBackground(\n      handle: ExecutionHandle,\n      command: string,\n      options: {\n        cwd?: string\n        env?: Record<string, string>\n        outputDir: string\n        onExit: (info: TaskExitInfo) => void\n      },\n    ): Promise<TaskHandle> {\n      const cwd = options.cwd ? resolve(handle.cwd, options.cwd) : handle.cwd\n\n      await mkdir(options.outputDir, { recursive: true })\n\n      // Mint id + path. The id is sequential per context (model-facing,\n      // short, ergonomic for `shell_kill`). The log FILENAME embeds the\n      // context's start timestamp so two contexts sharing an `outputDir`\n      // (TUI restart on the same session, concurrent zidane instances,\n      // …) never resolve to the same file — we open with `flags: 'a'`\n      // and a name collision would interleave their output. Path\n      // validation is defensive — we mint our own ids so it never trips\n      // today, but it pins the invariant for forks / third parties.\n      const taskId = `bash_${++taskCounter}`\n      assertSafeTaskId(taskId)\n      const outputPath = resolve(options.outputDir, `${taskId}.${contextTimestamp}.log`)\n\n      // Install the orphan reaper on first task. See `exitHandler`'s\n      // JSDoc for the kill-on-shutdown rationale.\n      if (!exitHandlerRegistered) {\n        process.on('exit', exitHandler)\n        exitHandlerRegistered = true\n      }\n\n      // Open the output file. The timestamped path is unique per context\n      // so a brand-new file is the expected outcome; `flags: 'a'` is kept\n      // as the safe default (preserves bytes if the path collides for any\n      // reason — same-millisecond context creation, manual pre-population,\n      // etc.) rather than blindly truncating. Streams are opened BEFORE\n      // the spawn to avoid a race where the child writes before the stream\n      // is ready — `child_process` buffers stdio until the consumer\n      // attaches, but the FS handle has to exist either way for our pipe.\n      const outputStream: WriteStream = createWriteStream(outputPath, { flags: 'a' })\n      // Surface FS errors (ENOSPC, EACCES on a remounted FS, etc.)\n      // under ZIDANE_DEBUG instead of crashing the host via an\n      // unhandled 'error' event. Without a listener Node escalates\n      // any stream-level error to an uncaughtException and the whole\n      // process exits — the model and the user would lose every\n      // unrelated in-flight piece of work to one bad task's disk\n      // hiccup. Swallow + log is the safer default for a fire-and-\n      // forget log writer; the task's exit code still reports.\n      outputStream.on('error', (err) => {\n        if (process.env.ZIDANE_DEBUG)\n          process.stderr.write(`[zidane/contexts] task ${taskId} log stream error: ${err.message}\\n`)\n      })\n\n      // Spawn as a NEW process group leader so we can kill the whole\n      // subtree on demand. Same primitive `exec` uses for foreground\n      // shells — see the long comment in that method for the\n      // process-group rationale.\n      const child = spawnChild('/bin/sh', ['-c', command], {\n        cwd,\n        env: { ...process.env, ...defaultEnv, ...options.env },\n        stdio: ['ignore', 'pipe', 'pipe'],\n        detached: SUPPORTS_PROCESS_GROUPS,\n      })\n\n      const state: TaskState = {\n        taskId,\n        handleId: handle.id,\n        pid: child.pid ?? -1,\n        command,\n        cwd,\n        startedAt: Date.now(),\n        outputPath,\n        outputStream,\n        child,\n        status: 'running',\n        bytesWritten: 0,\n        settled: false,\n        onExit: options.onExit,\n      }\n      tasks.set(taskId, state)\n\n      // Pipe both streams into the same file. Order between stdout and\n      // stderr is preserved per-stream; cross-stream ordering depends on\n      // Node's event loop — acceptable interleaving for log-shaped\n      // output. Tracked-bytes is updated on every chunk for the\n      // listBackground UX.\n      const appendChunk = (chunk: Buffer): void => {\n        state.bytesWritten += chunk.length\n        outputStream.write(chunk)\n      }\n      child.stdout?.on('data', chunk => appendChunk(chunk as Buffer))\n      child.stderr?.on('data', chunk => appendChunk(chunk as Buffer))\n\n      // Settle path — at-most-once via `settled` flag (checklist #14).\n      // Three trigger sources: `close` (natural OR signal-killed),\n      // `error` (spawn failure), explicit `killBackground` (which\n      // routes through `close` itself after the SIGTERM lands).\n      const settle = (cause: 'close' | 'error', code: number | null, signal: NodeJS.Signals | null, errMessage?: string): void => {\n        if (state.settled)\n          return\n        state.settled = true\n\n        // Determine final status from cause + signal.\n        const status: TaskExitInfo['status']\n          = signal === 'SIGTERM' || state.killRequested\n            ? 'killed'\n            : 'exited'\n        // Signal-killed children report null `code` from Node; map back\n        // to the POSIX `128 + signum` convention so consumers can read\n        // an integer either way.\n        const exitCode = code !== null\n          ? code\n          : signal === 'SIGTERM'\n            ? 143\n            : signal\n              ? 128\n              : 1\n        state.status = status\n        state.exitCode = exitCode\n        if (signal)\n          state.signal = signal\n\n        // Flush + close the WriteStream BEFORE firing onExit — model\n        // may read the file in the same turn it receives the\n        // notification, and a still-open stream can hold tail bytes\n        // back from disk. `stream.end(callback)` is the documented\n        // \"all queued writes are flushed when this fires\" idiom.\n        //\n        // ORDER MATTERS: any error preamble we want in the log file\n        // (spawn failures with no stdout, buffer overflows) MUST be\n        // written BEFORE `end()` — once `end()` is called the stream\n        // is closed for writing and subsequent `.write()` calls are\n        // dropped. Earlier revisions had this reversed and silently\n        // lost ENOENT-on-`/bin/sh` messages.\n        if (errMessage) {\n          try {\n            outputStream.write(`\\n${errMessage}\\n`)\n          }\n          catch {\n            // Stream may have errored before this — best-effort only.\n          }\n        }\n        outputStream.end(() => {\n          // `stateToTaskExitInfo` reads the same fields we just set\n          // on `state`, so the snapshot the consumer gets matches the\n          // post-settle state exactly.\n          try {\n            state.onExit(stateToTaskExitInfo(state))\n          }\n          catch (err) {\n            // Defensive — a buggy onExit callback shouldn't crash the\n            // host. Surface via stderr under ZIDANE_DEBUG; otherwise\n            // swallow. Matches the spawn-tool's bubbleError pattern.\n            if (process.env.ZIDANE_DEBUG)\n              process.stderr.write(`[zidane/contexts] task ${taskId} onExit threw: ${err instanceof Error ? err.message : String(err)}\\n`)\n          }\n        })\n      }\n\n      child.on('close', (code, signal) => settle('close', code, signal))\n      child.on('error', err => settle('error', null, null, `[spawn error] ${err.message}`))\n\n      return { taskId, pid: state.pid, outputPath }\n    },\n\n    async killBackground(handle: ExecutionHandle, taskId: string): Promise<TaskExitInfo | null> {\n      const state = tasks.get(taskId)\n      // Two miss cases collapse into one `null` return: unknown id, AND\n      // known-id-but-not-owned-by-this-handle. The second case is the\n      // subagent-can't-kill-parent-tasks defense; surfacing it as a\n      // distinct error would leak the existence of the parent's task\n      // to the subagent's model, which violates the per-handle\n      // isolation contract.\n      if (!state || state.handleId !== handle.id)\n        return null\n      // Already exited — return the cached info. We don't keep a\n      // separate cached exit; the state itself carries every field\n      // `TaskExitInfo` needs and `stateToTaskExitInfo` projects it.\n      if (state.status !== 'running')\n        return stateToTaskExitInfo(state)\n\n      // Mark the intent BEFORE issuing the kill so the close handler\n      // classifies the exit as `'killed'` even on platforms where the\n      // SIGTERM-via-group lands faster than the close event drains.\n      // (Checklist #14: at-most-once settle, plus correct status\n      // classification regardless of event ordering.)\n      state.killRequested = true\n\n      // Wait for the existing close listener to fire — `settle()` does\n      // all the flushing + onExit work. We just sit on a one-shot\n      // promise tied to the `child.on('close')` we already registered\n      // at spawn time.\n      const closed = new Promise<void>((resolveP) => {\n        if (state.settled) {\n          resolveP()\n          return\n        }\n        const originalOnExit = state.onExit\n        state.onExit = (info) => {\n          originalOnExit(info)\n          resolveP()\n        }\n      })\n\n      killProcessGroup(state.child, 'SIGTERM')\n      await closed\n      return stateToTaskExitInfo(state)\n    },\n\n    async reassignBackgroundTasks(\n      fromHandle: ExecutionHandle,\n      toHandle: ExecutionHandle,\n      newOnExit?: (info: TaskExitInfo) => void,\n    ): Promise<readonly TaskEntry[]> {\n      // No-op when source = destination — keeps the spawn.ts call site\n      // unconditional without forcing it to dedupe.\n      if (fromHandle.id === toHandle.id)\n        return []\n      const promoted: TaskEntry[] = []\n      for (const state of tasks.values()) {\n        if (state.handleId !== fromHandle.id || state.status !== 'running')\n          continue\n        state.handleId = toHandle.id\n        // Replace the natural-exit callback. The original closed over\n        // the spawning agent's hook bus, which is about to be destroyed\n        // — without rewiring, the task's eventual `background:exit`\n        // fires into a torn-down hookable and the parent never learns.\n        if (newOnExit)\n          state.onExit = newOnExit\n        promoted.push(stateToTaskEntry(state))\n      }\n      return promoted\n    },\n\n    async listBackground(handle: ExecutionHandle): Promise<readonly TaskEntry[]> {\n      // Snapshot — callers must not assume the returned array stays\n      // in sync with the live registry. Sorted by startedAt so the\n      // model / UI sees consistent ordering across calls. Scoped to\n      // the calling handle so subagents don't see the parent's tasks\n      // (and vice versa) in their listing.\n      return [...tasks.values()]\n        .filter(s => s.handleId === handle.id)\n        .sort((a, b) => a.startedAt - b.startedAt)\n        .map(stateToTaskEntry)\n    },\n\n    async destroy(handle: ExecutionHandle): Promise<void> {\n      // Kill every still-running background task SPAWNED THROUGH THIS\n      // HANDLE before tearing the handle down. SIGTERM the groups,\n      // await the close + flush, THEN drop the registry entries.\n      // Sequential — destroy is one-shot teardown, the few ms of extra\n      // latency aren't worth the synchronization complexity.\n      //\n      // The handle scope matters when the same `ExecutionContext` is\n      // shared across a parent agent and its `spawn`-ed subagents (the\n      // default — `spawn.ts` passes `execution: ctx.execution`). Each\n      // agent mints its own `ExecutionHandle` and registers its\n      // background tasks under that handle's id. Without the filter,\n      // a child agent's `destroy()` (fired by `spawn.ts`'s `finally`\n      // when the subagent finishes / is cancelled) would walk the\n      // shared registry and SIGTERM the parent's tasks too. So\n      // cancelling a subagent that has its own background shells now\n      // correctly kills JUST those subagent shells, leaving the\n      // parent's intact.\n      const survivors = [...tasks.values()].filter(s => s.handleId === handle.id && !s.settled)\n      await Promise.all(survivors.map(async (state) => {\n        state.killRequested = true\n        await new Promise<void>((resolveP) => {\n          const originalOnExit = state.onExit\n          state.onExit = (info) => {\n            originalOnExit(info)\n            resolveP()\n          }\n          killProcessGroup(state.child, 'SIGTERM')\n        })\n      }))\n      // Drop only this handle's tasks from the registry. Other handles\n      // (siblings, parent) keep their entries.\n      for (const [taskId, state] of tasks) {\n        if (state.handleId === handle.id)\n          tasks.delete(taskId)\n      }\n      handles.delete(handle.id)\n      // Drop the orphan reaper ONLY when no handles remain — otherwise\n      // a child's `destroy()` would strip the parent's safety net. The\n      // reaper protects every still-tracked task in the context, so it\n      // sticks around until the LAST handle is gone.\n      //\n      // Without this guard, the spawn-tool sequence\n      //   parent.spawn(child) → child.run() → child.destroy() (auto)\n      // would deregister the handler mid-parent-lifetime. The parent's\n      // own subsequent Ctrl+C orphan-kill safety would silently degrade.\n      if (exitHandlerRegistered && handles.size === 0) {\n        process.off('exit', exitHandler)\n        exitHandlerRegistered = false\n      }\n    },\n  }\n}\n\n/**\n * Per-task state. Lives in the context's `tasks` registry. Fields are\n * mutated in place by the spawn / close / kill / destroy code paths —\n * the registry isn't immutable. Treat the type as a record-of-cells,\n * not a value.\n */\ninterface TaskState {\n  taskId: string\n  /**\n   * `ExecutionHandle.id` of the spawning agent. The registry is\n   * context-scoped (one Map shared across all handles a context minted),\n   * so a per-task owner tag is what scopes `listBackground` /\n   * `killBackground` / `destroy` to the calling handle's slice.\n   *\n   * Without this, a subagent spawned via `spawn` tool — which inherits\n   * the parent's `ExecutionContext` but mints its OWN handle — would\n   * see (and accidentally kill on `destroy()`) every task the parent\n   * had running. Came up the first time the model spawned a subagent\n   * that ran a background task: the subagent's run-end `destroy()`\n   * SIGTERMed the parent's `npm run dev` mid-flight.\n   */\n  handleId: string\n  pid: number\n  command: string\n  cwd: string\n  startedAt: number\n  outputPath: string\n  outputStream: WriteStream\n  child: ChildProcess\n  status: 'running' | 'exited' | 'killed'\n  exitCode?: number\n  signal?: NodeJS.Signals\n  bytesWritten: number\n  /**\n   * `at-most-once` settle latch. Multiple trigger sources (`close`,\n   * `error`, `kill`) can race; the flag dedupes so `onExit` fires\n   * exactly once per task (checklist #14).\n   */\n  settled: boolean\n  /**\n   * Set by `killBackground` / `destroy` before issuing SIGTERM so the\n   * close handler classifies the exit as `'killed'` even when the\n   * platform delivers the close event ahead of our intent record.\n   */\n  killRequested?: boolean\n  onExit: (info: TaskExitInfo) => void\n}\n\n/**\n * Send `signal` to the child's whole process group. Falls back to a\n * single-process kill on Windows (no POSIX process groups). Shared\n * across the foreground `exec` path, the background spawn / kill\n * paths, and the shutdown-time orphan reaper — keeping one definition\n * so the kill semantics can't drift between them.\n */\nfunction killProcessGroup(child: ChildProcess, signal: NodeJS.Signals): void {\n  const pid = child.pid\n  if (pid === undefined)\n    return\n  try {\n    if (SUPPORTS_PROCESS_GROUPS)\n      process.kill(-pid, signal)\n    else\n      process.kill(pid, signal)\n  }\n  catch {\n    // ESRCH / EPERM — process is already gone (race with natural exit)\n    // or we lost the right to kill it. Both are safe to swallow.\n  }\n}\n\n/**\n * Project a `TaskState` to the `TaskEntry` shape `listBackground` and\n * `reassignBackgroundTasks` return. Single helper keeps the shape\n * consistent across both call sites (and a future addition of fields\n * to `TaskEntry` only needs to land here).\n */\nfunction stateToTaskEntry(state: TaskState): TaskEntry {\n  return {\n    taskId: state.taskId,\n    pid: state.pid,\n    command: state.command,\n    cwd: state.cwd,\n    startedAt: state.startedAt,\n    outputPath: state.outputPath,\n    status: state.status,\n    ...(state.exitCode !== undefined ? { exitCode: state.exitCode } : {}),\n    ...(state.signal ? { signal: state.signal } : {}),\n    bytesWritten: state.bytesWritten,\n  }\n}\n\n/**\n * Project a settled `TaskState` to the `TaskExitInfo` shape `settle()`\n * fires from `onExit` and `killBackground` returns on the\n * cached-exit path. Pre-condition: `state.status !== 'running'`\n * (callers gate on this).\n */\nfunction stateToTaskExitInfo(state: TaskState): TaskExitInfo {\n  return {\n    taskId: state.taskId,\n    status: state.status as Exclude<TaskState['status'], 'running'>,\n    exitCode: state.exitCode ?? 0,\n    ...(state.signal ? { signal: state.signal } : {}),\n    outputPath: state.outputPath,\n    durationMs: Date.now() - state.startedAt,\n    command: state.command,\n  }\n}\n","/**\n * Remote sandbox execution context.\n *\n * Offloads execution to a remote sandbox API (e.g. Rivet, E2B).\n * Specific providers implement the SandboxProvider interface.\n */\n\nimport type { ContextCapabilities, ExecResult, ExecutionContext, ExecutionHandle, SpawnConfig } from './types'\n\n// ---------------------------------------------------------------------------\n// Sandbox provider interface\n// ---------------------------------------------------------------------------\n\nexport interface SandboxProvider {\n  name: string\n  spawn: (config: SpawnConfig) => Promise<{ id: string, cwd: string }>\n  exec: (sandboxId: string, command: string, options?: { cwd?: string, env?: Record<string, string>, timeout?: number }) => Promise<ExecResult>\n  readFile: (sandboxId: string, path: string) => Promise<string>\n  writeFile: (sandboxId: string, path: string, content: string) => Promise<void>\n  listFiles: (sandboxId: string, path: string) => Promise<string[]>\n  destroy: (sandboxId: string) => Promise<void>\n}\n\n// ---------------------------------------------------------------------------\n// Sandbox execution context\n// ---------------------------------------------------------------------------\n\nexport function createSandboxContext(provider: SandboxProvider): ExecutionContext {\n  const sandboxes = new Map<string, string>()\n\n  function getSandboxId(handle: ExecutionHandle): string {\n    const id = sandboxes.get(handle.id)\n    if (!id)\n      throw new Error(`Sandbox ${handle.id} not found`)\n    return id\n  }\n\n  return {\n    type: 'sandbox',\n\n    capabilities: {\n      shell: true,\n      filesystem: true,\n      network: true,\n      gpu: false,\n    } satisfies ContextCapabilities,\n\n    async spawn(config?: SpawnConfig): Promise<ExecutionHandle> {\n      const result = await provider.spawn(config ?? {})\n      const handle: ExecutionHandle = { id: result.id, type: 'sandbox', cwd: result.cwd }\n      sandboxes.set(handle.id, result.id)\n      return handle\n    },\n\n    async exec(handle: ExecutionHandle, command: string, options?): Promise<ExecResult> {\n      return provider.exec(getSandboxId(handle), command, options)\n    },\n\n    async readFile(handle: ExecutionHandle, path: string): Promise<string> {\n      return provider.readFile(getSandboxId(handle), path)\n    },\n\n    async writeFile(handle: ExecutionHandle, path: string, content: string): Promise<void> {\n      return provider.writeFile(getSandboxId(handle), path, content)\n    },\n\n    async listFiles(handle: ExecutionHandle, path: string): Promise<string[]> {\n      return provider.listFiles(getSandboxId(handle), path)\n    },\n\n    async destroy(handle: ExecutionHandle): Promise<void> {\n      const id = sandboxes.get(handle.id)\n      if (!id)\n        return\n      await provider.destroy(id)\n      sandboxes.delete(handle.id)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,0BAA0B,QAAQ,aAAa;;;;;;;AAQrD,MAAM,qBAAqB,KAAK,OAAO;;;;;;;;;;;AAYvC,MAAM,aAAa;AAEnB,SAAS,iBAAiB,QAAsB;CAC9C,IAAI,CAAC,WAAW,KAAK,OAAO,EAC1B,MAAM,IAAI,MAAM,oBAAoB,OAAO,iBAAiB,WAAW,GAAG;;;;;;;;;;AAW9E,SAAgB,uBAAuB,MAAoB;CACzD,MAAM,QAAQ,MAAsB,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI;CACjE,MAAM,QAAQ,MAAsB,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI;CAQjE,OAAO,GAPG,KAAK,gBAOJ,GAND,KAAK,KAAK,aAAa,GAAG,EAMrB,GALL,KAAK,KAAK,YAAY,CAKb,CAAC,GAJV,KAAK,KAAK,aAAa,CAIT,GAHd,KAAK,KAAK,eAAe,CAGP,GAFlB,KAAK,KAAK,eAAe,CAEH,CAAC,GADtB,KAAK,KAAK,oBAAoB,CACH;;AAMxC,SAAgB,qBAAqB,QAAwC;CAC3E,IAAI,UAAU;CACd,MAAM,0BAAU,IAAI,KAA8B;CAClD,MAAM,aAAa,QAAQ,OAAO,QAAQ,KAAK;CAC/C,MAAM,aAAa,QAAQ;;;;;;;;CAS3B,MAAM,wBAAQ,IAAI,KAAwB;CAC1C,IAAI,cAAc;;;;;;;;;;;;;;;;;;;;CAqBlB,MAAM,mBAAmB,uCAAuB,IAAI,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;CAqB3D,IAAI,wBAAwB;CAC5B,MAAM,oBAA0B;EAC9B,KAAK,MAAM,QAAQ,MAAM,QAAQ,EAAE;GACjC,IAAI,KAAK,WAAW,WAClB;GACF,MAAM,MAAM,KAAK,MAAM;GACvB,IAAI,QAAQ,KAAA,GACV;GACF,IAAI;IACF,IAAI,yBACF,QAAQ,KAAK,CAAC,KAAK,UAAU;SAE7B,QAAQ,KAAK,KAAK,UAAU;WAE1B;;;CAQV,OAAO;EACL,MAAM;EAEN,cAAc;GACZ,OAAO;GACP,YAAY;GACZ,SAAS;GACT,KAAK;GACN;EAED,MAAM,MAAM,WAAmD;GAC7D,MAAM,KAAK,WAAW,EAAE;GACxB,MAAM,MAAM,WAAW,OAAO;GAE9B,MAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;GAErC,MAAM,SAA0B;IAAE;IAAI,MAAM;IAAW;IAAK;GAC5D,QAAQ,IAAI,IAAI,OAAO;GACvB,OAAO;;EAGT,MAAM,KACJ,QACA,SACA,SACqB;GACrB,MAAM,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,QAAQ,IAAI,GAAG,OAAO;GAKrE,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,QAAQ;IAAI,QAAQ;IAAkC,UAAU;IAAK;GAGhF,MAAM,aAAa,SAAS,WAAW,QAAQ,QAAQ,WAAW,MAAM;GACxE,MAAM,YAAY;GAElB,OAAO,IAAI,SAAqB,aAAa;IAc3C,MAAM,QAAQA,MAAW,WAAW,CAAC,MAAM,QAAQ,EAAE;KACnD;KACA,KAAK;MAAE,GAAG,QAAQ;MAAK,GAAG;MAAY,GAAG,SAAS;MAAK;KACvD,OAAO;MAAC;MAAU;MAAQ;MAAO;KACjC,UAAU;KACX,CAAC;IAEF,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,kBAAkB;IACtB,IAAI,WAAW;IACf,IAAI,gBAAgB;IACpB,IAAI,UAAU;IAEd,MAAM,gBAAgB,MAA2B,UAAwB;KACvE,MAAM,UAAU,SAAS,WAAW,SAAS;KAC7C,IAAI,QAAQ,UAAU,WACpB;KACF,MAAM,OAAO,YAAY,QAAQ;KACjC,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,SAAS,OAAO,GAAG,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,OAAO;KACtG,IAAI,SAAS,UACX,UAAU;UAEV,UAAU;KACZ,IAAI,MAAM,SAAS,MAAM;MACvB,kBAAkB;MAGlB,iBAAiB,OAAO,UAAU;;;IAItC,MAAM,QAAQ,GAAG,SAAQ,UAAS,aAAa,UAAU,MAAgB,CAAC;IAC1E,MAAM,QAAQ,GAAG,SAAQ,UAAS,aAAa,UAAU,MAAgB,CAAC;IAE1E,MAAM,eAAe,YAAY,IAC7B,iBAAiB;KACf,WAAW;KACX,iBAAiB,OAAO,UAAU;OACjC,UAAU,GACb,KAAA;IAEJ,MAAM,gBAAsB;KAC1B,gBAAgB;KAChB,iBAAiB,OAAO,UAAU;;IAEpC,MAAM,aAAa,SAAS;IAC5B,IAAI,YACF,WAAW,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;IAE/D,MAAM,UAAU,UAAkB,gBAA+B;KAC/D,IAAI,SACF;KACF,UAAU;KACV,IAAI,cACF,aAAa,aAAa;KAC5B,IAAI,YACF,WAAW,oBAAoB,SAAS,QAAQ;KAClD,MAAM,cAAc,cACf,SAAS,GAAG,OAAO,IAAI,gBAAgB,cACxC;KACJ,SAAS;MAAE;MAAQ,QAAQ;MAAa;MAAU,CAAC;;IAGrD,MAAM,GAAG,UAAU,QAAQ;KAIzB,OAAO,GAAG,IAAI,QAAQ;MACtB;IAEF,MAAM,GAAG,UAAU,MAAM,WAAW;KAMlC,IAAI,eAAe;MACjB,OAAO,KAAK,oBAAoB;MAChC;;KAEF,IAAI,UAAU;MACZ,OAAO,KAAK,2BAA2B,UAAU,IAAI;MACrD;;KAEF,IAAI,iBAAiB;MACnB,OAAO,KAAK,mBAAmB,UAAU,8BAA8B;MACvE;;KAEF,IAAI,QAAQ;MAGV,OAAO,KAAU,wBAAwB,SAAS;MAClD;;KAEF,OAAO,OAAO,SAAS,WAAW,OAAO,EAAE;MAC3C;KACF;;EAGJ,MAAM,SAAS,QAAyB,MAA+B;GACrE,OAAO,SAAS,QAAQ,OAAO,KAAK,KAAK,EAAE,QAAQ;;EAGrD,MAAM,eAAe,QAAyB,MAAmC;GAG/E,MAAM,MAAM,MAAM,SAAS,QAAQ,OAAO,KAAK,KAAK,CAAC;GACrD,OAAO,IAAI,WAAW,IAAI;;EAG5B,MAAM,UAAU,QAAyB,MAAc,SAAgC;GACrF,MAAM,WAAW,QAAQ,OAAO,KAAK,KAAK;GAC1C,MAAM,MAAM,QAAQ,SAAS,EAAE,EAAE,WAAW,MAAM,CAAC;GACnD,MAAM,UAAU,UAAU,SAAS,QAAQ;;EAG7C,MAAM,UAAU,QAAyB,MAAiC;GACxE,OAAO,QAAQ,QAAQ,OAAO,KAAK,KAAK,CAAC;;EAG3C,MAAM,eACJ,QACA,SACA,SAMqB;GACrB,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,KAAK,QAAQ,IAAI,GAAG,OAAO;GAEpE,MAAM,MAAM,QAAQ,WAAW,EAAE,WAAW,MAAM,CAAC;GAUnD,MAAM,SAAS,QAAQ,EAAE;GACzB,iBAAiB,OAAO;GACxB,MAAM,aAAa,QAAQ,QAAQ,WAAW,GAAG,OAAO,GAAG,iBAAiB,MAAM;GAIlF,IAAI,CAAC,uBAAuB;IAC1B,QAAQ,GAAG,QAAQ,YAAY;IAC/B,wBAAwB;;GAW1B,MAAM,eAA4B,kBAAkB,YAAY,EAAE,OAAO,KAAK,CAAC;GAS/E,aAAa,GAAG,UAAU,QAAQ;IAChC,IAAI,QAAQ,IAAI,cACd,QAAQ,OAAO,MAAM,0BAA0B,OAAO,qBAAqB,IAAI,QAAQ,IAAI;KAC7F;GAMF,MAAM,QAAQA,MAAW,WAAW,CAAC,MAAM,QAAQ,EAAE;IACnD;IACA,KAAK;KAAE,GAAG,QAAQ;KAAK,GAAG;KAAY,GAAG,QAAQ;KAAK;IACtD,OAAO;KAAC;KAAU;KAAQ;KAAO;IACjC,UAAU;IACX,CAAC;GAEF,MAAM,QAAmB;IACvB;IACA,UAAU,OAAO;IACjB,KAAK,MAAM,OAAO;IAClB;IACA;IACA,WAAW,KAAK,KAAK;IACrB;IACA;IACA;IACA,QAAQ;IACR,cAAc;IACd,SAAS;IACT,QAAQ,QAAQ;IACjB;GACD,MAAM,IAAI,QAAQ,MAAM;GAOxB,MAAM,eAAe,UAAwB;IAC3C,MAAM,gBAAgB,MAAM;IAC5B,aAAa,MAAM,MAAM;;GAE3B,MAAM,QAAQ,GAAG,SAAQ,UAAS,YAAY,MAAgB,CAAC;GAC/D,MAAM,QAAQ,GAAG,SAAQ,UAAS,YAAY,MAAgB,CAAC;GAM/D,MAAM,UAAU,OAA0B,MAAqB,QAA+B,eAA8B;IAC1H,IAAI,MAAM,SACR;IACF,MAAM,UAAU;IAGhB,MAAM,SACF,WAAW,aAAa,MAAM,gBAC5B,WACA;IAIN,MAAM,WAAW,SAAS,OACtB,OACA,WAAW,YACT,MACA,SACE,MACA;IACR,MAAM,SAAS;IACf,MAAM,WAAW;IACjB,IAAI,QACF,MAAM,SAAS;IAcjB,IAAI,YACF,IAAI;KACF,aAAa,MAAM,KAAK,WAAW,IAAI;YAEnC;IAIR,aAAa,UAAU;KAIrB,IAAI;MACF,MAAM,OAAO,oBAAoB,MAAM,CAAC;cAEnC,KAAK;MAIV,IAAI,QAAQ,IAAI,cACd,QAAQ,OAAO,MAAM,0BAA0B,OAAO,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC,IAAI;;MAEhI;;GAGJ,MAAM,GAAG,UAAU,MAAM,WAAW,OAAO,SAAS,MAAM,OAAO,CAAC;GAClE,MAAM,GAAG,UAAS,QAAO,OAAO,SAAS,MAAM,MAAM,iBAAiB,IAAI,UAAU,CAAC;GAErF,OAAO;IAAE;IAAQ,KAAK,MAAM;IAAK;IAAY;;EAG/C,MAAM,eAAe,QAAyB,QAA8C;GAC1F,MAAM,QAAQ,MAAM,IAAI,OAAO;GAO/B,IAAI,CAAC,SAAS,MAAM,aAAa,OAAO,IACtC,OAAO;GAIT,IAAI,MAAM,WAAW,WACnB,OAAO,oBAAoB,MAAM;GAOnC,MAAM,gBAAgB;GAMtB,MAAM,SAAS,IAAI,SAAe,aAAa;IAC7C,IAAI,MAAM,SAAS;KACjB,UAAU;KACV;;IAEF,MAAM,iBAAiB,MAAM;IAC7B,MAAM,UAAU,SAAS;KACvB,eAAe,KAAK;KACpB,UAAU;;KAEZ;GAEF,iBAAiB,MAAM,OAAO,UAAU;GACxC,MAAM;GACN,OAAO,oBAAoB,MAAM;;EAGnC,MAAM,wBACJ,YACA,UACA,WAC+B;GAG/B,IAAI,WAAW,OAAO,SAAS,IAC7B,OAAO,EAAE;GACX,MAAM,WAAwB,EAAE;GAChC,KAAK,MAAM,SAAS,MAAM,QAAQ,EAAE;IAClC,IAAI,MAAM,aAAa,WAAW,MAAM,MAAM,WAAW,WACvD;IACF,MAAM,WAAW,SAAS;IAK1B,IAAI,WACF,MAAM,SAAS;IACjB,SAAS,KAAK,iBAAiB,MAAM,CAAC;;GAExC,OAAO;;EAGT,MAAM,eAAe,QAAwD;GAM3E,OAAO,CAAC,GAAG,MAAM,QAAQ,CAAC,CACvB,QAAO,MAAK,EAAE,aAAa,OAAO,GAAG,CACrC,MAAM,GAAG,MAAM,EAAE,YAAY,EAAE,UAAU,CACzC,IAAI,iBAAiB;;EAG1B,MAAM,QAAQ,QAAwC;GAkBpD,MAAM,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,QAAO,MAAK,EAAE,aAAa,OAAO,MAAM,CAAC,EAAE,QAAQ;GACzF,MAAM,QAAQ,IAAI,UAAU,IAAI,OAAO,UAAU;IAC/C,MAAM,gBAAgB;IACtB,MAAM,IAAI,SAAe,aAAa;KACpC,MAAM,iBAAiB,MAAM;KAC7B,MAAM,UAAU,SAAS;MACvB,eAAe,KAAK;MACpB,UAAU;;KAEZ,iBAAiB,MAAM,OAAO,UAAU;MACxC;KACF,CAAC;GAGH,KAAK,MAAM,CAAC,QAAQ,UAAU,OAC5B,IAAI,MAAM,aAAa,OAAO,IAC5B,MAAM,OAAO,OAAO;GAExB,QAAQ,OAAO,OAAO,GAAG;GAUzB,IAAI,yBAAyB,QAAQ,SAAS,GAAG;IAC/C,QAAQ,IAAI,QAAQ,YAAY;IAChC,wBAAwB;;;EAG7B;;;;;;;;;AA0DH,SAAS,iBAAiB,OAAqB,QAA8B;CAC3E,MAAM,MAAM,MAAM;CAClB,IAAI,QAAQ,KAAA,GACV;CACF,IAAI;EACF,IAAI,yBACF,QAAQ,KAAK,CAAC,KAAK,OAAO;OAE1B,QAAQ,KAAK,KAAK,OAAO;SAEvB;;;;;;;;AAYR,SAAS,iBAAiB,OAA6B;CACrD,OAAO;EACL,QAAQ,MAAM;EACd,KAAK,MAAM;EACX,SAAS,MAAM;EACf,KAAK,MAAM;EACX,WAAW,MAAM;EACjB,YAAY,MAAM;EAClB,QAAQ,MAAM;EACd,GAAI,MAAM,aAAa,KAAA,IAAY,EAAE,UAAU,MAAM,UAAU,GAAG,EAAE;EACpE,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;EAChD,cAAc,MAAM;EACrB;;;;;;;;AASH,SAAS,oBAAoB,OAAgC;CAC3D,OAAO;EACL,QAAQ,MAAM;EACd,QAAQ,MAAM;EACd,UAAU,MAAM,YAAY;EAC5B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;EAChD,YAAY,MAAM;EAClB,YAAY,KAAK,KAAK,GAAG,MAAM;EAC/B,SAAS,MAAM;EAChB;;;;AClsBH,SAAgB,qBAAqB,UAA6C;CAChF,MAAM,4BAAY,IAAI,KAAqB;CAE3C,SAAS,aAAa,QAAiC;EACrD,MAAM,KAAK,UAAU,IAAI,OAAO,GAAG;EACnC,IAAI,CAAC,IACH,MAAM,IAAI,MAAM,WAAW,OAAO,GAAG,YAAY;EACnD,OAAO;;CAGT,OAAO;EACL,MAAM;EAEN,cAAc;GACZ,OAAO;GACP,YAAY;GACZ,SAAS;GACT,KAAK;GACN;EAED,MAAM,MAAM,QAAgD;GAC1D,MAAM,SAAS,MAAM,SAAS,MAAM,UAAU,EAAE,CAAC;GACjD,MAAM,SAA0B;IAAE,IAAI,OAAO;IAAI,MAAM;IAAW,KAAK,OAAO;IAAK;GACnF,UAAU,IAAI,OAAO,IAAI,OAAO,GAAG;GACnC,OAAO;;EAGT,MAAM,KAAK,QAAyB,SAAiB,SAA+B;GAClF,OAAO,SAAS,KAAK,aAAa,OAAO,EAAE,SAAS,QAAQ;;EAG9D,MAAM,SAAS,QAAyB,MAA+B;GACrE,OAAO,SAAS,SAAS,aAAa,OAAO,EAAE,KAAK;;EAGtD,MAAM,UAAU,QAAyB,MAAc,SAAgC;GACrF,OAAO,SAAS,UAAU,aAAa,OAAO,EAAE,MAAM,QAAQ;;EAGhE,MAAM,UAAU,QAAyB,MAAiC;GACxE,OAAO,SAAS,UAAU,aAAa,OAAO,EAAE,KAAK;;EAGvD,MAAM,QAAQ,QAAwC;GACpD,MAAM,KAAK,UAAU,IAAI,OAAO,GAAG;GACnC,IAAI,CAAC,IACH;GACF,MAAM,SAAS,QAAQ,GAAG;GAC1B,UAAU,OAAO,OAAO,GAAG;;EAE9B"}
+{"version":3,"file":"contexts-BOtMvzli.js","names":["spawnChild"],"sources":["../src/contexts/process.ts","../src/contexts/sandbox.ts"],"sourcesContent":["/**\n * In-process execution context.\n *\n * Runs everything in the current Node/Bun process.\n * No isolation — fastest, used as the default.\n */\n\nimport type { Buffer } from 'node:buffer'\nimport type { ChildProcess } from 'node:child_process'\nimport type { WriteStream } from 'node:fs'\nimport type { ContextCapabilities, ExecResult, ExecutionContext, ExecutionHandle, SpawnConfig, TaskEntry, TaskExitInfo, TaskHandle } from './types'\nimport { spawn as spawnChild } from 'node:child_process'\nimport { createWriteStream } from 'node:fs'\nimport { mkdir, readdir, readFile, writeFile } from 'node:fs/promises'\nimport { dirname, resolve } from 'node:path'\n\n/**\n * Whether the host supports POSIX process groups (the `detached: true` +\n * `process.kill(-pid)` combination). Windows doesn't — its job-object\n * model is shaped differently — so on win32 we fall back to killing the\n * shell wrapper alone (matches pre-fix behavior; better than nothing).\n */\nconst SUPPORTS_PROCESS_GROUPS = process.platform !== 'win32'\n\n/**\n * Default cap on captured stdout / stderr per child. Matches the\n * pre-fix `child_process.exec` setting so existing callers see the\n * same buffer envelope. Output beyond this is truncated and a\n * marker is appended to stderr.\n */\nconst DEFAULT_MAX_BUFFER = 10 * 1024 * 1024\n\n/**\n * Sanitize a task id before it's joined into a filesystem path.\n *\n * We mint `bash_<n>` ids ourselves (no user input flows into the path\n * for `ProcessContext`), so this is defensive — but third-party contexts\n * MAY accept caller-provided ids, so the helper exists for them too.\n * Anything that doesn't match the expected shape is rejected — never\n * coerced — so the call site sees a clear error rather than a\n * traversal-shaped path.\n */\nconst TASK_ID_RE = /^[a-z][\\w-]*$/i\n\nfunction assertSafeTaskId(taskId: string): void {\n  if (!TASK_ID_RE.test(taskId))\n    throw new Error(`Invalid task id \"${taskId}\" — must match ${TASK_ID_RE}.`)\n}\n\n/**\n * Format `date` as `YYYYMMDD-HHMMSS-mmm` in UTC.\n *\n * Pinned to UTC so the lexical sort of two timestamps always matches\n * their chronological order (local time + DST does not). Used as the\n * per-context suffix on background-task log filenames; see the field\n * doc on `contextTimestamp` for the why.\n */\nexport function formatContextTimestamp(date: Date): string {\n  const pad2 = (n: number): string => n.toString().padStart(2, '0')\n  const pad3 = (n: number): string => n.toString().padStart(3, '0')\n  const y = date.getUTCFullYear()\n  const M = pad2(date.getUTCMonth() + 1)\n  const d = pad2(date.getUTCDate())\n  const h = pad2(date.getUTCHours())\n  const m = pad2(date.getUTCMinutes())\n  const s = pad2(date.getUTCSeconds())\n  const ms = pad3(date.getUTCMilliseconds())\n  return `${y}${M}${d}-${h}${m}${s}-${ms}`\n}\n\n/** Pattern of a background-task log filename. Used by tests + tooling. */\nexport const TASK_LOG_FILENAME_RE = /^(bash_\\d+)\\.(\\d{8}-\\d{6}-\\d{3})\\.log$/\n\nexport function createProcessContext(config?: SpawnConfig): ExecutionContext {\n  let counter = 0\n  const handles = new Map<string, ExecutionHandle>()\n  const defaultCwd = config?.cwd ?? process.cwd()\n  const defaultEnv = config?.env\n\n  /**\n   * Per-context background-task registry. Entries live for the context's\n   * lifetime — even after the child exits — so the model can read output\n   * of completed tasks until `destroy()` tears everything down. Kept as\n   * a plain Map (not a class) per code-quality checklist #7: no premature\n   * abstraction. The state and the operations on it live inline.\n   */\n  const tasks = new Map<string, TaskState>()\n  let taskCounter = 0\n\n  /**\n   * Per-context UTC timestamp segment baked into every background task's\n   * log filename. Same `taskCounter` value across two contexts (e.g. a\n   * TUI restart) would otherwise re-open the SAME `bash_<n>.log` file —\n   * we open with `flags: 'a'` so the new task would APPEND into the old\n   * log, producing scrambled output. The timestamp guarantees each\n   * context owns a distinct log filename without forcing the\n   * model-facing task id (`bash_<n>`) to grow longer.\n   *\n   * Format: `YYYYMMDD-HHMMSS-mmm` in UTC.\n   *   - Sortable (lexical sort = chronological sort).\n   *   - Unambiguous (UTC sidesteps DST / locale shifts).\n   *   - Filesystem-safe (digits + hyphens only).\n   *   - Millisecond precision avoids same-second-restart collisions.\n   *\n   * The timestamp is computed once per context, NOT per task — all of a\n   * context's tasks share the same suffix so a directory listing groups\n   * cleanly by \"which run produced these\".\n   */\n  const contextTimestamp = formatContextTimestamp(new Date())\n\n  /**\n   * Last-resort orphan reaper. With `detached: true`, background tasks\n   * are in their OWN process group — when the parent (zidane TUI) dies,\n   * the OS does NOT send them SIGHUP and they keep running indefinitely.\n   * The user's \"Ctrl+C the TUI\" intent is \"stop everything I started\",\n   * not \"leak a `sleep 60` into the background\".\n   *\n   * `process.on('exit')` fires SYNCHRONOUSLY on `process.exit()` AND on\n   * natural shutdown — exactly the seam we need. The handler can only\n   * do synchronous work (Node ignores async), but `process.kill` IS\n   * synchronous, so a SIGTERM-the-group sweep lands cleanly. The kill\n   * is best-effort: already-dead children throw ESRCH (swallowed).\n   *\n   * Registered lazily on first `execBackground` so contexts that never\n   * background a task don't pay the listener cost. Deregistered in\n   * `destroy()` so reconstructed contexts don't accumulate listeners\n   * (Node warns past 10 — a long-running session that switches sessions\n   * frequently would otherwise hit that).\n   */\n  let exitHandlerRegistered = false\n  const exitHandler = (): void => {\n    for (const task of tasks.values()) {\n      if (task.status !== 'running')\n        continue\n      const pid = task.child.pid\n      if (pid === undefined)\n        continue\n      try {\n        if (SUPPORTS_PROCESS_GROUPS)\n          process.kill(-pid, 'SIGTERM')\n        else\n          process.kill(pid, 'SIGTERM')\n      }\n      catch {\n        // ESRCH (already dead) / EPERM (lost ownership). Swallow —\n        // the process either won't kill cleanly OR is already gone,\n        // both acceptable at shutdown.\n      }\n    }\n  }\n\n  return {\n    type: 'process',\n\n    capabilities: {\n      shell: true,\n      filesystem: true,\n      network: true,\n      gpu: false,\n    } satisfies ContextCapabilities,\n\n    async spawn(overrides?: SpawnConfig): Promise<ExecutionHandle> {\n      const id = `process-${++counter}`\n      const cwd = overrides?.cwd ?? defaultCwd\n\n      await mkdir(cwd, { recursive: true })\n\n      const handle: ExecutionHandle = { id, type: 'process', cwd }\n      handles.set(id, handle)\n      return handle\n    },\n\n    async exec(\n      handle: ExecutionHandle,\n      command: string,\n      options?: { cwd?: string, env?: Record<string, string>, timeout?: number, signal?: AbortSignal },\n    ): Promise<ExecResult> {\n      const cwd = options?.cwd ? resolve(handle.cwd, options.cwd) : handle.cwd\n\n      // Pre-aborted fast path: skip the spawn entirely and synthesize a\n      // killed-by-signal result. Saves a spawn round-trip + dodges Node\n      // emitting an immediate `AbortError`.\n      if (options?.signal?.aborted) {\n        return { stdout: '', stderr: 'aborted by signal before spawn', exitCode: 143 }\n      }\n\n      const timeoutMs = (options?.timeout ?? config?.limits?.timeout ?? 30) * 1000\n      const maxBuffer = DEFAULT_MAX_BUFFER\n\n      return new Promise<ExecResult>((resolveP) => {\n        // Spawn as a NEW process group leader so we can kill the whole\n        // subtree on abort. Without `detached: true`, sending SIGTERM to\n        // the shell's pid only kills the shell wrapper — its child\n        // processes (the actual `sleep`, `npm`, `python`, …) get\n        // reparented to init and keep running. `process.kill(-pid, …)`\n        // with a NEGATIVE pid targets the whole process group; that's\n        // the POSIX idiom for \"shut down everything I started\".\n        //\n        // On Windows there are no process groups in the POSIX sense, so\n        // we leave `detached` off and accept the shell-only kill — the\n        // platform's job-object machinery is the path forward there if\n        // we ever need it, but it's not the bug zidane's users are\n        // hitting today.\n        const child = spawnChild('/bin/sh', ['-c', command], {\n          cwd,\n          env: { ...process.env, ...defaultEnv, ...options?.env },\n          stdio: ['ignore', 'pipe', 'pipe'],\n          detached: SUPPORTS_PROCESS_GROUPS,\n        })\n\n        let stdout = ''\n        let stderr = ''\n        let bufferTruncated = false\n        let timedOut = false\n        let killedByAbort = false\n        let settled = false\n\n        const appendCapped = (slot: 'stdout' | 'stderr', chunk: Buffer): void => {\n          const current = slot === 'stdout' ? stdout : stderr\n          if (current.length >= maxBuffer)\n            return\n          const room = maxBuffer - current.length\n          const piece = chunk.length <= room ? chunk.toString('utf8') : chunk.subarray(0, room).toString('utf8')\n          if (slot === 'stdout')\n            stdout += piece\n          else\n            stderr += piece\n          if (chunk.length > room) {\n            bufferTruncated = true\n            // Kill on overflow — matches `execAsync`'s `maxBuffer`\n            // behavior (which kills the child and surfaces an error).\n            killProcessGroup(child, 'SIGTERM')\n          }\n        }\n\n        child.stdout?.on('data', chunk => appendCapped('stdout', chunk as Buffer))\n        child.stderr?.on('data', chunk => appendCapped('stderr', chunk as Buffer))\n\n        const timeoutTimer = timeoutMs > 0\n          ? setTimeout(() => {\n              timedOut = true\n              killProcessGroup(child, 'SIGTERM')\n            }, timeoutMs)\n          : undefined\n\n        const onAbort = (): void => {\n          killedByAbort = true\n          killProcessGroup(child, 'SIGTERM')\n        }\n        const userSignal = options?.signal\n        if (userSignal)\n          userSignal.addEventListener('abort', onAbort, { once: true })\n\n        const settle = (exitCode: number, extraStderr?: string): void => {\n          if (settled)\n            return\n          settled = true\n          if (timeoutTimer)\n            clearTimeout(timeoutTimer)\n          if (userSignal)\n            userSignal.removeEventListener('abort', onAbort)\n          const finalStderr = extraStderr\n            ? (stderr ? `${stderr}\\n${extraStderr}` : extraStderr)\n            : stderr\n          resolveP({ stdout, stderr: finalStderr, exitCode })\n        }\n\n        child.on('error', (err) => {\n          // Spawn failure (ENOENT on `/bin/sh`, EACCES, …). Mirror\n          // `execAsync`'s \"rejects with an Error\" shape by surfacing\n          // the message on stderr and a non-zero exit.\n          settle(1, err.message)\n        })\n\n        child.on('close', (code, signal) => {\n          // Order matters: killed-by-our-abort wins over timeout wins\n          // over natural exit, because the abort listener fires first\n          // when the user cancels mid-timeout-window. All three land\n          // here through `close`, but we tag the stderr suffix /\n          // exit-code differently so callers can tell the cause.\n          if (killedByAbort) {\n            settle(143, 'aborted by signal')\n            return\n          }\n          if (timedOut) {\n            settle(124, `command timed out after ${timeoutMs}ms`)\n            return\n          }\n          if (bufferTruncated) {\n            settle(143, `output exceeded ${maxBuffer}-byte buffer; process killed`)\n            return\n          }\n          if (signal) {\n            // Killed by some other signal we didn't issue. Treat as\n            // signal-killed for consumer compat.\n            settle(128 + 15, `terminated by signal ${signal}`)\n            return\n          }\n          settle(typeof code === 'number' ? code : 1)\n        })\n      })\n    },\n\n    async readFile(handle: ExecutionHandle, path: string): Promise<string> {\n      return readFile(resolve(handle.cwd, path), 'utf-8')\n    },\n\n    async readFileBinary(handle: ExecutionHandle, path: string): Promise<Uint8Array> {\n      // No encoding → returns a Buffer (which is a Uint8Array). Used by\n      // read_file to ferry image / binary content into the multimodal route.\n      const buf = await readFile(resolve(handle.cwd, path))\n      return new Uint8Array(buf)\n    },\n\n    async writeFile(handle: ExecutionHandle, path: string, content: string): Promise<void> {\n      const fullPath = resolve(handle.cwd, path)\n      await mkdir(dirname(fullPath), { recursive: true })\n      await writeFile(fullPath, content, 'utf-8')\n    },\n\n    async listFiles(handle: ExecutionHandle, path: string): Promise<string[]> {\n      return readdir(resolve(handle.cwd, path))\n    },\n\n    async execBackground(\n      handle: ExecutionHandle,\n      command: string,\n      options: {\n        cwd?: string\n        env?: Record<string, string>\n        outputDir: string\n        onExit: (info: TaskExitInfo) => void\n      },\n    ): Promise<TaskHandle> {\n      const cwd = options.cwd ? resolve(handle.cwd, options.cwd) : handle.cwd\n\n      await mkdir(options.outputDir, { recursive: true })\n\n      // Mint id + path. The id is sequential per context (model-facing,\n      // short, ergonomic for `shell_kill`). The log FILENAME embeds the\n      // context's start timestamp so two contexts sharing an `outputDir`\n      // (TUI restart on the same session, concurrent zidane instances,\n      // …) never resolve to the same file — we open with `flags: 'a'`\n      // and a name collision would interleave their output. Path\n      // validation is defensive — we mint our own ids so it never trips\n      // today, but it pins the invariant for forks / third parties.\n      const taskId = `bash_${++taskCounter}`\n      assertSafeTaskId(taskId)\n      const outputPath = resolve(options.outputDir, `${taskId}.${contextTimestamp}.log`)\n\n      // Install the orphan reaper on first task. See `exitHandler`'s\n      // JSDoc for the kill-on-shutdown rationale.\n      if (!exitHandlerRegistered) {\n        process.on('exit', exitHandler)\n        exitHandlerRegistered = true\n      }\n\n      // Open the output file. The timestamped path is unique per context\n      // so a brand-new file is the expected outcome; `flags: 'a'` is kept\n      // as the safe default (preserves bytes if the path collides for any\n      // reason — same-millisecond context creation, manual pre-population,\n      // etc.) rather than blindly truncating. Streams are opened BEFORE\n      // the spawn to avoid a race where the child writes before the stream\n      // is ready — `child_process` buffers stdio until the consumer\n      // attaches, but the FS handle has to exist either way for our pipe.\n      const outputStream: WriteStream = createWriteStream(outputPath, { flags: 'a' })\n      // Surface FS errors (ENOSPC, EACCES on a remounted FS, etc.)\n      // under ZIDANE_DEBUG instead of crashing the host via an\n      // unhandled 'error' event. Without a listener Node escalates\n      // any stream-level error to an uncaughtException and the whole\n      // process exits — the model and the user would lose every\n      // unrelated in-flight piece of work to one bad task's disk\n      // hiccup. Swallow + log is the safer default for a fire-and-\n      // forget log writer; the task's exit code still reports.\n      outputStream.on('error', (err) => {\n        if (process.env.ZIDANE_DEBUG)\n          process.stderr.write(`[zidane/contexts] task ${taskId} log stream error: ${err.message}\\n`)\n      })\n\n      // Spawn as a NEW process group leader so we can kill the whole\n      // subtree on demand. Same primitive `exec` uses for foreground\n      // shells — see the long comment in that method for the\n      // process-group rationale.\n      const child = spawnChild('/bin/sh', ['-c', command], {\n        cwd,\n        env: { ...process.env, ...defaultEnv, ...options.env },\n        stdio: ['ignore', 'pipe', 'pipe'],\n        detached: SUPPORTS_PROCESS_GROUPS,\n      })\n\n      const state: TaskState = {\n        taskId,\n        handleId: handle.id,\n        pid: child.pid ?? -1,\n        command,\n        cwd,\n        startedAt: Date.now(),\n        outputPath,\n        outputStream,\n        child,\n        status: 'running',\n        bytesWritten: 0,\n        settled: false,\n        onExit: options.onExit,\n      }\n      tasks.set(taskId, state)\n\n      // Pipe both streams into the same file. Order between stdout and\n      // stderr is preserved per-stream; cross-stream ordering depends on\n      // Node's event loop — acceptable interleaving for log-shaped\n      // output. Tracked-bytes is updated on every chunk for the\n      // listBackground UX.\n      const appendChunk = (chunk: Buffer): void => {\n        state.bytesWritten += chunk.length\n        outputStream.write(chunk)\n      }\n      child.stdout?.on('data', chunk => appendChunk(chunk as Buffer))\n      child.stderr?.on('data', chunk => appendChunk(chunk as Buffer))\n\n      // Settle path — at-most-once via `settled` flag (checklist #14).\n      // Three trigger sources: `close` (natural OR signal-killed),\n      // `error` (spawn failure), explicit `killBackground` (which\n      // routes through `close` itself after the SIGTERM lands).\n      const settle = (cause: 'close' | 'error', code: number | null, signal: NodeJS.Signals | null, errMessage?: string): void => {\n        if (state.settled)\n          return\n        state.settled = true\n\n        // Determine final status from cause + signal.\n        const status: TaskExitInfo['status']\n          = signal === 'SIGTERM' || state.killRequested\n            ? 'killed'\n            : 'exited'\n        // Signal-killed children report null `code` from Node; map back\n        // to the POSIX `128 + signum` convention so consumers can read\n        // an integer either way.\n        const exitCode = code !== null\n          ? code\n          : signal === 'SIGTERM'\n            ? 143\n            : signal\n              ? 128\n              : 1\n        state.status = status\n        state.exitCode = exitCode\n        if (signal)\n          state.signal = signal\n\n        // Flush + close the WriteStream BEFORE firing onExit — model\n        // may read the file in the same turn it receives the\n        // notification, and a still-open stream can hold tail bytes\n        // back from disk. `stream.end(callback)` is the documented\n        // \"all queued writes are flushed when this fires\" idiom.\n        //\n        // ORDER MATTERS: any error preamble we want in the log file\n        // (spawn failures with no stdout, buffer overflows) MUST be\n        // written BEFORE `end()` — once `end()` is called the stream\n        // is closed for writing and subsequent `.write()` calls are\n        // dropped. Earlier revisions had this reversed and silently\n        // lost ENOENT-on-`/bin/sh` messages.\n        if (errMessage) {\n          try {\n            outputStream.write(`\\n${errMessage}\\n`)\n          }\n          catch {\n            // Stream may have errored before this — best-effort only.\n          }\n        }\n        outputStream.end(() => {\n          // `stateToTaskExitInfo` reads the same fields we just set\n          // on `state`, so the snapshot the consumer gets matches the\n          // post-settle state exactly.\n          try {\n            state.onExit(stateToTaskExitInfo(state))\n          }\n          catch (err) {\n            // Defensive — a buggy onExit callback shouldn't crash the\n            // host. Surface via stderr under ZIDANE_DEBUG; otherwise\n            // swallow. Matches the spawn-tool's bubbleError pattern.\n            if (process.env.ZIDANE_DEBUG)\n              process.stderr.write(`[zidane/contexts] task ${taskId} onExit threw: ${err instanceof Error ? err.message : String(err)}\\n`)\n          }\n        })\n      }\n\n      child.on('close', (code, signal) => settle('close', code, signal))\n      child.on('error', err => settle('error', null, null, `[spawn error] ${err.message}`))\n\n      return { taskId, pid: state.pid, outputPath }\n    },\n\n    async killBackground(handle: ExecutionHandle, taskId: string): Promise<TaskExitInfo | null> {\n      const state = tasks.get(taskId)\n      // Two miss cases collapse into one `null` return: unknown id, AND\n      // known-id-but-not-owned-by-this-handle. The second case is the\n      // subagent-can't-kill-parent-tasks defense; surfacing it as a\n      // distinct error would leak the existence of the parent's task\n      // to the subagent's model, which violates the per-handle\n      // isolation contract.\n      if (!state || state.handleId !== handle.id)\n        return null\n      // Already exited — return the cached info. We don't keep a\n      // separate cached exit; the state itself carries every field\n      // `TaskExitInfo` needs and `stateToTaskExitInfo` projects it.\n      if (state.status !== 'running')\n        return stateToTaskExitInfo(state)\n\n      // Mark the intent BEFORE issuing the kill so the close handler\n      // classifies the exit as `'killed'` even on platforms where the\n      // SIGTERM-via-group lands faster than the close event drains.\n      // (Checklist #14: at-most-once settle, plus correct status\n      // classification regardless of event ordering.)\n      state.killRequested = true\n\n      // Wait for the existing close listener to fire — `settle()` does\n      // all the flushing + onExit work. We just sit on a one-shot\n      // promise tied to the `child.on('close')` we already registered\n      // at spawn time.\n      const closed = new Promise<void>((resolveP) => {\n        if (state.settled) {\n          resolveP()\n          return\n        }\n        const originalOnExit = state.onExit\n        state.onExit = (info) => {\n          originalOnExit(info)\n          resolveP()\n        }\n      })\n\n      killProcessGroup(state.child, 'SIGTERM')\n      await closed\n      return stateToTaskExitInfo(state)\n    },\n\n    async reassignBackgroundTasks(\n      fromHandle: ExecutionHandle,\n      toHandle: ExecutionHandle,\n      newOnExit?: (info: TaskExitInfo) => void,\n    ): Promise<readonly TaskEntry[]> {\n      // No-op when source = destination — keeps the spawn.ts call site\n      // unconditional without forcing it to dedupe.\n      if (fromHandle.id === toHandle.id)\n        return []\n      const promoted: TaskEntry[] = []\n      for (const state of tasks.values()) {\n        if (state.handleId !== fromHandle.id || state.status !== 'running')\n          continue\n        state.handleId = toHandle.id\n        // Replace the natural-exit callback. The original closed over\n        // the spawning agent's hook bus, which is about to be destroyed\n        // — without rewiring, the task's eventual `background:exit`\n        // fires into a torn-down hookable and the parent never learns.\n        if (newOnExit)\n          state.onExit = newOnExit\n        promoted.push(stateToTaskEntry(state))\n      }\n      return promoted\n    },\n\n    async listBackground(handle: ExecutionHandle): Promise<readonly TaskEntry[]> {\n      // Snapshot — callers must not assume the returned array stays\n      // in sync with the live registry. Sorted by startedAt so the\n      // model / UI sees consistent ordering across calls. Scoped to\n      // the calling handle so subagents don't see the parent's tasks\n      // (and vice versa) in their listing.\n      return [...tasks.values()]\n        .filter(s => s.handleId === handle.id)\n        .sort((a, b) => a.startedAt - b.startedAt)\n        .map(stateToTaskEntry)\n    },\n\n    async destroy(handle: ExecutionHandle): Promise<void> {\n      // Kill every still-running background task SPAWNED THROUGH THIS\n      // HANDLE before tearing the handle down. SIGTERM the groups,\n      // await the close + flush, THEN drop the registry entries.\n      // Sequential — destroy is one-shot teardown, the few ms of extra\n      // latency aren't worth the synchronization complexity.\n      //\n      // The handle scope matters when the same `ExecutionContext` is\n      // shared across a parent agent and its `spawn`-ed subagents (the\n      // default — `spawn.ts` passes `execution: ctx.execution`). Each\n      // agent mints its own `ExecutionHandle` and registers its\n      // background tasks under that handle's id. Without the filter,\n      // a child agent's `destroy()` (fired by `spawn.ts`'s `finally`\n      // when the subagent finishes / is cancelled) would walk the\n      // shared registry and SIGTERM the parent's tasks too. So\n      // cancelling a subagent that has its own background shells now\n      // correctly kills JUST those subagent shells, leaving the\n      // parent's intact.\n      const survivors = [...tasks.values()].filter(s => s.handleId === handle.id && !s.settled)\n      await Promise.all(survivors.map(async (state) => {\n        state.killRequested = true\n        await new Promise<void>((resolveP) => {\n          const originalOnExit = state.onExit\n          state.onExit = (info) => {\n            originalOnExit(info)\n            resolveP()\n          }\n          killProcessGroup(state.child, 'SIGTERM')\n        })\n      }))\n      // Drop only this handle's tasks from the registry. Other handles\n      // (siblings, parent) keep their entries.\n      for (const [taskId, state] of tasks) {\n        if (state.handleId === handle.id)\n          tasks.delete(taskId)\n      }\n      handles.delete(handle.id)\n      // Drop the orphan reaper ONLY when no handles remain — otherwise\n      // a child's `destroy()` would strip the parent's safety net. The\n      // reaper protects every still-tracked task in the context, so it\n      // sticks around until the LAST handle is gone.\n      //\n      // Without this guard, the spawn-tool sequence\n      //   parent.spawn(child) → child.run() → child.destroy() (auto)\n      // would deregister the handler mid-parent-lifetime. The parent's\n      // own subsequent Ctrl+C orphan-kill safety would silently degrade.\n      if (exitHandlerRegistered && handles.size === 0) {\n        process.off('exit', exitHandler)\n        exitHandlerRegistered = false\n      }\n    },\n  }\n}\n\n/**\n * Per-task state. Lives in the context's `tasks` registry. Fields are\n * mutated in place by the spawn / close / kill / destroy code paths —\n * the registry isn't immutable. Treat the type as a record-of-cells,\n * not a value.\n */\ninterface TaskState {\n  taskId: string\n  /**\n   * `ExecutionHandle.id` of the spawning agent. The registry is\n   * context-scoped (one Map shared across all handles a context minted),\n   * so a per-task owner tag is what scopes `listBackground` /\n   * `killBackground` / `destroy` to the calling handle's slice.\n   *\n   * Without this, a subagent spawned via `spawn` tool — which inherits\n   * the parent's `ExecutionContext` but mints its OWN handle — would\n   * see (and accidentally kill on `destroy()`) every task the parent\n   * had running. Came up the first time the model spawned a subagent\n   * that ran a background task: the subagent's run-end `destroy()`\n   * SIGTERMed the parent's `npm run dev` mid-flight.\n   */\n  handleId: string\n  pid: number\n  command: string\n  cwd: string\n  startedAt: number\n  outputPath: string\n  outputStream: WriteStream\n  child: ChildProcess\n  status: 'running' | 'exited' | 'killed'\n  exitCode?: number\n  signal?: NodeJS.Signals\n  bytesWritten: number\n  /**\n   * `at-most-once` settle latch. Multiple trigger sources (`close`,\n   * `error`, `kill`) can race; the flag dedupes so `onExit` fires\n   * exactly once per task (checklist #14).\n   */\n  settled: boolean\n  /**\n   * Set by `killBackground` / `destroy` before issuing SIGTERM so the\n   * close handler classifies the exit as `'killed'` even when the\n   * platform delivers the close event ahead of our intent record.\n   */\n  killRequested?: boolean\n  onExit: (info: TaskExitInfo) => void\n}\n\n/**\n * Send `signal` to the child's whole process group. Falls back to a\n * single-process kill on Windows (no POSIX process groups). Shared\n * across the foreground `exec` path, the background spawn / kill\n * paths, and the shutdown-time orphan reaper — keeping one definition\n * so the kill semantics can't drift between them.\n */\nfunction killProcessGroup(child: ChildProcess, signal: NodeJS.Signals): void {\n  const pid = child.pid\n  if (pid === undefined)\n    return\n  try {\n    if (SUPPORTS_PROCESS_GROUPS)\n      process.kill(-pid, signal)\n    else\n      process.kill(pid, signal)\n  }\n  catch {\n    // ESRCH / EPERM — process is already gone (race with natural exit)\n    // or we lost the right to kill it. Both are safe to swallow.\n  }\n}\n\n/**\n * Project a `TaskState` to the `TaskEntry` shape `listBackground` and\n * `reassignBackgroundTasks` return. Single helper keeps the shape\n * consistent across both call sites (and a future addition of fields\n * to `TaskEntry` only needs to land here).\n */\nfunction stateToTaskEntry(state: TaskState): TaskEntry {\n  return {\n    taskId: state.taskId,\n    pid: state.pid,\n    command: state.command,\n    cwd: state.cwd,\n    startedAt: state.startedAt,\n    outputPath: state.outputPath,\n    status: state.status,\n    ...(state.exitCode !== undefined ? { exitCode: state.exitCode } : {}),\n    ...(state.signal ? { signal: state.signal } : {}),\n    bytesWritten: state.bytesWritten,\n  }\n}\n\n/**\n * Project a settled `TaskState` to the `TaskExitInfo` shape `settle()`\n * fires from `onExit` and `killBackground` returns on the\n * cached-exit path. Pre-condition: `state.status !== 'running'`\n * (callers gate on this).\n */\nfunction stateToTaskExitInfo(state: TaskState): TaskExitInfo {\n  return {\n    taskId: state.taskId,\n    status: state.status as Exclude<TaskState['status'], 'running'>,\n    exitCode: state.exitCode ?? 0,\n    ...(state.signal ? { signal: state.signal } : {}),\n    outputPath: state.outputPath,\n    durationMs: Date.now() - state.startedAt,\n    command: state.command,\n  }\n}\n","/**\n * Remote sandbox execution context.\n *\n * Offloads execution to a remote sandbox API (e.g. Rivet, E2B).\n * Specific providers implement the SandboxProvider interface.\n */\n\nimport type { ContextCapabilities, ExecResult, ExecutionContext, ExecutionHandle, SpawnConfig } from './types'\n\n// ---------------------------------------------------------------------------\n// Sandbox provider interface\n// ---------------------------------------------------------------------------\n\nexport interface SandboxProvider {\n  name: string\n  spawn: (config: SpawnConfig) => Promise<{ id: string, cwd: string }>\n  exec: (sandboxId: string, command: string, options?: { cwd?: string, env?: Record<string, string>, timeout?: number }) => Promise<ExecResult>\n  readFile: (sandboxId: string, path: string) => Promise<string>\n  writeFile: (sandboxId: string, path: string, content: string) => Promise<void>\n  listFiles: (sandboxId: string, path: string) => Promise<string[]>\n  destroy: (sandboxId: string) => Promise<void>\n}\n\n// ---------------------------------------------------------------------------\n// Sandbox execution context\n// ---------------------------------------------------------------------------\n\nexport function createSandboxContext(provider: SandboxProvider): ExecutionContext {\n  const sandboxes = new Map<string, string>()\n\n  function getSandboxId(handle: ExecutionHandle): string {\n    const id = sandboxes.get(handle.id)\n    if (!id)\n      throw new Error(`Sandbox ${handle.id} not found`)\n    return id\n  }\n\n  return {\n    type: 'sandbox',\n\n    capabilities: {\n      shell: true,\n      filesystem: true,\n      network: true,\n      gpu: false,\n    } satisfies ContextCapabilities,\n\n    async spawn(config?: SpawnConfig): Promise<ExecutionHandle> {\n      const result = await provider.spawn(config ?? {})\n      const handle: ExecutionHandle = { id: result.id, type: 'sandbox', cwd: result.cwd }\n      sandboxes.set(handle.id, result.id)\n      return handle\n    },\n\n    async exec(handle: ExecutionHandle, command: string, options?): Promise<ExecResult> {\n      return provider.exec(getSandboxId(handle), command, options)\n    },\n\n    async readFile(handle: ExecutionHandle, path: string): Promise<string> {\n      return provider.readFile(getSandboxId(handle), path)\n    },\n\n    async writeFile(handle: ExecutionHandle, path: string, content: string): Promise<void> {\n      return provider.writeFile(getSandboxId(handle), path, content)\n    },\n\n    async listFiles(handle: ExecutionHandle, path: string): Promise<string[]> {\n      return provider.listFiles(getSandboxId(handle), path)\n    },\n\n    async destroy(handle: ExecutionHandle): Promise<void> {\n      const id = sandboxes.get(handle.id)\n      if (!id)\n        return\n      await provider.destroy(id)\n      sandboxes.delete(handle.id)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;AAsBA,MAAM,0BAA0B,QAAQ,aAAa;;;;;;;AAQrD,MAAM,qBAAqB,KAAK,OAAO;;;;;;;;;;;AAYvC,MAAM,aAAa;AAEnB,SAAS,iBAAiB,QAAsB;CAC9C,IAAI,CAAC,WAAW,KAAK,OAAO,EAC1B,MAAM,IAAI,MAAM,oBAAoB,OAAO,iBAAiB,WAAW,GAAG;;;;;;;;;;AAW9E,SAAgB,uBAAuB,MAAoB;CACzD,MAAM,QAAQ,MAAsB,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI;CACjE,MAAM,QAAQ,MAAsB,EAAE,UAAU,CAAC,SAAS,GAAG,IAAI;CAQjE,OAAO,GAPG,KAAK,gBAOJ,GAND,KAAK,KAAK,aAAa,GAAG,EAMrB,GALL,KAAK,KAAK,YAAY,CAKb,CAAC,GAJV,KAAK,KAAK,aAAa,CAIT,GAHd,KAAK,KAAK,eAAe,CAGP,GAFlB,KAAK,KAAK,eAAe,CAEH,CAAC,GADtB,KAAK,KAAK,oBAAoB,CACH;;AAMxC,SAAgB,qBAAqB,QAAwC;CAC3E,IAAI,UAAU;CACd,MAAM,0BAAU,IAAI,KAA8B;CAClD,MAAM,aAAa,QAAQ,OAAO,QAAQ,KAAK;CAC/C,MAAM,aAAa,QAAQ;;;;;;;;CAS3B,MAAM,wBAAQ,IAAI,KAAwB;CAC1C,IAAI,cAAc;;;;;;;;;;;;;;;;;;;;CAqBlB,MAAM,mBAAmB,uCAAuB,IAAI,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;CAqB3D,IAAI,wBAAwB;CAC5B,MAAM,oBAA0B;EAC9B,KAAK,MAAM,QAAQ,MAAM,QAAQ,EAAE;GACjC,IAAI,KAAK,WAAW,WAClB;GACF,MAAM,MAAM,KAAK,MAAM;GACvB,IAAI,QAAQ,KAAA,GACV;GACF,IAAI;IACF,IAAI,yBACF,QAAQ,KAAK,CAAC,KAAK,UAAU;SAE7B,QAAQ,KAAK,KAAK,UAAU;WAE1B;;;CAQV,OAAO;EACL,MAAM;EAEN,cAAc;GACZ,OAAO;GACP,YAAY;GACZ,SAAS;GACT,KAAK;GACN;EAED,MAAM,MAAM,WAAmD;GAC7D,MAAM,KAAK,WAAW,EAAE;GACxB,MAAM,MAAM,WAAW,OAAO;GAE9B,MAAM,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;GAErC,MAAM,SAA0B;IAAE;IAAI,MAAM;IAAW;IAAK;GAC5D,QAAQ,IAAI,IAAI,OAAO;GACvB,OAAO;;EAGT,MAAM,KACJ,QACA,SACA,SACqB;GACrB,MAAM,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,QAAQ,IAAI,GAAG,OAAO;GAKrE,IAAI,SAAS,QAAQ,SACnB,OAAO;IAAE,QAAQ;IAAI,QAAQ;IAAkC,UAAU;IAAK;GAGhF,MAAM,aAAa,SAAS,WAAW,QAAQ,QAAQ,WAAW,MAAM;GACxE,MAAM,YAAY;GAElB,OAAO,IAAI,SAAqB,aAAa;IAc3C,MAAM,QAAQA,MAAW,WAAW,CAAC,MAAM,QAAQ,EAAE;KACnD;KACA,KAAK;MAAE,GAAG,QAAQ;MAAK,GAAG;MAAY,GAAG,SAAS;MAAK;KACvD,OAAO;MAAC;MAAU;MAAQ;MAAO;KACjC,UAAU;KACX,CAAC;IAEF,IAAI,SAAS;IACb,IAAI,SAAS;IACb,IAAI,kBAAkB;IACtB,IAAI,WAAW;IACf,IAAI,gBAAgB;IACpB,IAAI,UAAU;IAEd,MAAM,gBAAgB,MAA2B,UAAwB;KACvE,MAAM,UAAU,SAAS,WAAW,SAAS;KAC7C,IAAI,QAAQ,UAAU,WACpB;KACF,MAAM,OAAO,YAAY,QAAQ;KACjC,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,SAAS,OAAO,GAAG,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,OAAO;KACtG,IAAI,SAAS,UACX,UAAU;UAEV,UAAU;KACZ,IAAI,MAAM,SAAS,MAAM;MACvB,kBAAkB;MAGlB,iBAAiB,OAAO,UAAU;;;IAItC,MAAM,QAAQ,GAAG,SAAQ,UAAS,aAAa,UAAU,MAAgB,CAAC;IAC1E,MAAM,QAAQ,GAAG,SAAQ,UAAS,aAAa,UAAU,MAAgB,CAAC;IAE1E,MAAM,eAAe,YAAY,IAC7B,iBAAiB;KACf,WAAW;KACX,iBAAiB,OAAO,UAAU;OACjC,UAAU,GACb,KAAA;IAEJ,MAAM,gBAAsB;KAC1B,gBAAgB;KAChB,iBAAiB,OAAO,UAAU;;IAEpC,MAAM,aAAa,SAAS;IAC5B,IAAI,YACF,WAAW,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;IAE/D,MAAM,UAAU,UAAkB,gBAA+B;KAC/D,IAAI,SACF;KACF,UAAU;KACV,IAAI,cACF,aAAa,aAAa;KAC5B,IAAI,YACF,WAAW,oBAAoB,SAAS,QAAQ;KAClD,MAAM,cAAc,cACf,SAAS,GAAG,OAAO,IAAI,gBAAgB,cACxC;KACJ,SAAS;MAAE;MAAQ,QAAQ;MAAa;MAAU,CAAC;;IAGrD,MAAM,GAAG,UAAU,QAAQ;KAIzB,OAAO,GAAG,IAAI,QAAQ;MACtB;IAEF,MAAM,GAAG,UAAU,MAAM,WAAW;KAMlC,IAAI,eAAe;MACjB,OAAO,KAAK,oBAAoB;MAChC;;KAEF,IAAI,UAAU;MACZ,OAAO,KAAK,2BAA2B,UAAU,IAAI;MACrD;;KAEF,IAAI,iBAAiB;MACnB,OAAO,KAAK,mBAAmB,UAAU,8BAA8B;MACvE;;KAEF,IAAI,QAAQ;MAGV,OAAO,KAAU,wBAAwB,SAAS;MAClD;;KAEF,OAAO,OAAO,SAAS,WAAW,OAAO,EAAE;MAC3C;KACF;;EAGJ,MAAM,SAAS,QAAyB,MAA+B;GACrE,OAAO,SAAS,QAAQ,OAAO,KAAK,KAAK,EAAE,QAAQ;;EAGrD,MAAM,eAAe,QAAyB,MAAmC;GAG/E,MAAM,MAAM,MAAM,SAAS,QAAQ,OAAO,KAAK,KAAK,CAAC;GACrD,OAAO,IAAI,WAAW,IAAI;;EAG5B,MAAM,UAAU,QAAyB,MAAc,SAAgC;GACrF,MAAM,WAAW,QAAQ,OAAO,KAAK,KAAK;GAC1C,MAAM,MAAM,QAAQ,SAAS,EAAE,EAAE,WAAW,MAAM,CAAC;GACnD,MAAM,UAAU,UAAU,SAAS,QAAQ;;EAG7C,MAAM,UAAU,QAAyB,MAAiC;GACxE,OAAO,QAAQ,QAAQ,OAAO,KAAK,KAAK,CAAC;;EAG3C,MAAM,eACJ,QACA,SACA,SAMqB;GACrB,MAAM,MAAM,QAAQ,MAAM,QAAQ,OAAO,KAAK,QAAQ,IAAI,GAAG,OAAO;GAEpE,MAAM,MAAM,QAAQ,WAAW,EAAE,WAAW,MAAM,CAAC;GAUnD,MAAM,SAAS,QAAQ,EAAE;GACzB,iBAAiB,OAAO;GACxB,MAAM,aAAa,QAAQ,QAAQ,WAAW,GAAG,OAAO,GAAG,iBAAiB,MAAM;GAIlF,IAAI,CAAC,uBAAuB;IAC1B,QAAQ,GAAG,QAAQ,YAAY;IAC/B,wBAAwB;;GAW1B,MAAM,eAA4B,kBAAkB,YAAY,EAAE,OAAO,KAAK,CAAC;GAS/E,aAAa,GAAG,UAAU,QAAQ;IAChC,IAAI,QAAQ,IAAI,cACd,QAAQ,OAAO,MAAM,0BAA0B,OAAO,qBAAqB,IAAI,QAAQ,IAAI;KAC7F;GAMF,MAAM,QAAQA,MAAW,WAAW,CAAC,MAAM,QAAQ,EAAE;IACnD;IACA,KAAK;KAAE,GAAG,QAAQ;KAAK,GAAG;KAAY,GAAG,QAAQ;KAAK;IACtD,OAAO;KAAC;KAAU;KAAQ;KAAO;IACjC,UAAU;IACX,CAAC;GAEF,MAAM,QAAmB;IACvB;IACA,UAAU,OAAO;IACjB,KAAK,MAAM,OAAO;IAClB;IACA;IACA,WAAW,KAAK,KAAK;IACrB;IACA;IACA;IACA,QAAQ;IACR,cAAc;IACd,SAAS;IACT,QAAQ,QAAQ;IACjB;GACD,MAAM,IAAI,QAAQ,MAAM;GAOxB,MAAM,eAAe,UAAwB;IAC3C,MAAM,gBAAgB,MAAM;IAC5B,aAAa,MAAM,MAAM;;GAE3B,MAAM,QAAQ,GAAG,SAAQ,UAAS,YAAY,MAAgB,CAAC;GAC/D,MAAM,QAAQ,GAAG,SAAQ,UAAS,YAAY,MAAgB,CAAC;GAM/D,MAAM,UAAU,OAA0B,MAAqB,QAA+B,eAA8B;IAC1H,IAAI,MAAM,SACR;IACF,MAAM,UAAU;IAGhB,MAAM,SACF,WAAW,aAAa,MAAM,gBAC5B,WACA;IAIN,MAAM,WAAW,SAAS,OACtB,OACA,WAAW,YACT,MACA,SACE,MACA;IACR,MAAM,SAAS;IACf,MAAM,WAAW;IACjB,IAAI,QACF,MAAM,SAAS;IAcjB,IAAI,YACF,IAAI;KACF,aAAa,MAAM,KAAK,WAAW,IAAI;YAEnC;IAIR,aAAa,UAAU;KAIrB,IAAI;MACF,MAAM,OAAO,oBAAoB,MAAM,CAAC;cAEnC,KAAK;MAIV,IAAI,QAAQ,IAAI,cACd,QAAQ,OAAO,MAAM,0BAA0B,OAAO,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC,IAAI;;MAEhI;;GAGJ,MAAM,GAAG,UAAU,MAAM,WAAW,OAAO,SAAS,MAAM,OAAO,CAAC;GAClE,MAAM,GAAG,UAAS,QAAO,OAAO,SAAS,MAAM,MAAM,iBAAiB,IAAI,UAAU,CAAC;GAErF,OAAO;IAAE;IAAQ,KAAK,MAAM;IAAK;IAAY;;EAG/C,MAAM,eAAe,QAAyB,QAA8C;GAC1F,MAAM,QAAQ,MAAM,IAAI,OAAO;GAO/B,IAAI,CAAC,SAAS,MAAM,aAAa,OAAO,IACtC,OAAO;GAIT,IAAI,MAAM,WAAW,WACnB,OAAO,oBAAoB,MAAM;GAOnC,MAAM,gBAAgB;GAMtB,MAAM,SAAS,IAAI,SAAe,aAAa;IAC7C,IAAI,MAAM,SAAS;KACjB,UAAU;KACV;;IAEF,MAAM,iBAAiB,MAAM;IAC7B,MAAM,UAAU,SAAS;KACvB,eAAe,KAAK;KACpB,UAAU;;KAEZ;GAEF,iBAAiB,MAAM,OAAO,UAAU;GACxC,MAAM;GACN,OAAO,oBAAoB,MAAM;;EAGnC,MAAM,wBACJ,YACA,UACA,WAC+B;GAG/B,IAAI,WAAW,OAAO,SAAS,IAC7B,OAAO,EAAE;GACX,MAAM,WAAwB,EAAE;GAChC,KAAK,MAAM,SAAS,MAAM,QAAQ,EAAE;IAClC,IAAI,MAAM,aAAa,WAAW,MAAM,MAAM,WAAW,WACvD;IACF,MAAM,WAAW,SAAS;IAK1B,IAAI,WACF,MAAM,SAAS;IACjB,SAAS,KAAK,iBAAiB,MAAM,CAAC;;GAExC,OAAO;;EAGT,MAAM,eAAe,QAAwD;GAM3E,OAAO,CAAC,GAAG,MAAM,QAAQ,CAAC,CACvB,QAAO,MAAK,EAAE,aAAa,OAAO,GAAG,CACrC,MAAM,GAAG,MAAM,EAAE,YAAY,EAAE,UAAU,CACzC,IAAI,iBAAiB;;EAG1B,MAAM,QAAQ,QAAwC;GAkBpD,MAAM,YAAY,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,QAAO,MAAK,EAAE,aAAa,OAAO,MAAM,CAAC,EAAE,QAAQ;GACzF,MAAM,QAAQ,IAAI,UAAU,IAAI,OAAO,UAAU;IAC/C,MAAM,gBAAgB;IACtB,MAAM,IAAI,SAAe,aAAa;KACpC,MAAM,iBAAiB,MAAM;KAC7B,MAAM,UAAU,SAAS;MACvB,eAAe,KAAK;MACpB,UAAU;;KAEZ,iBAAiB,MAAM,OAAO,UAAU;MACxC;KACF,CAAC;GAGH,KAAK,MAAM,CAAC,QAAQ,UAAU,OAC5B,IAAI,MAAM,aAAa,OAAO,IAC5B,MAAM,OAAO,OAAO;GAExB,QAAQ,OAAO,OAAO,GAAG;GAUzB,IAAI,yBAAyB,QAAQ,SAAS,GAAG;IAC/C,QAAQ,IAAI,QAAQ,YAAY;IAChC,wBAAwB;;;EAG7B;;;;;;;;;AA0DH,SAAS,iBAAiB,OAAqB,QAA8B;CAC3E,MAAM,MAAM,MAAM;CAClB,IAAI,QAAQ,KAAA,GACV;CACF,IAAI;EACF,IAAI,yBACF,QAAQ,KAAK,CAAC,KAAK,OAAO;OAE1B,QAAQ,KAAK,KAAK,OAAO;SAEvB;;;;;;;;AAYR,SAAS,iBAAiB,OAA6B;CACrD,OAAO;EACL,QAAQ,MAAM;EACd,KAAK,MAAM;EACX,SAAS,MAAM;EACf,KAAK,MAAM;EACX,WAAW,MAAM;EACjB,YAAY,MAAM;EAClB,QAAQ,MAAM;EACd,GAAI,MAAM,aAAa,KAAA,IAAY,EAAE,UAAU,MAAM,UAAU,GAAG,EAAE;EACpE,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;EAChD,cAAc,MAAM;EACrB;;;;;;;;AASH,SAAS,oBAAoB,OAAgC;CAC3D,OAAO;EACL,QAAQ,MAAM;EACd,QAAQ,MAAM;EACd,UAAU,MAAM,YAAY;EAC5B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;EAChD,YAAY,MAAM;EAClB,YAAY,KAAK,KAAK,GAAG,MAAM;EAC/B,SAAS,MAAM;EAChB;;;;AClsBH,SAAgB,qBAAqB,UAA6C;CAChF,MAAM,4BAAY,IAAI,KAAqB;CAE3C,SAAS,aAAa,QAAiC;EACrD,MAAM,KAAK,UAAU,IAAI,OAAO,GAAG;EACnC,IAAI,CAAC,IACH,MAAM,IAAI,MAAM,WAAW,OAAO,GAAG,YAAY;EACnD,OAAO;;CAGT,OAAO;EACL,MAAM;EAEN,cAAc;GACZ,OAAO;GACP,YAAY;GACZ,SAAS;GACT,KAAK;GACN;EAED,MAAM,MAAM,QAAgD;GAC1D,MAAM,SAAS,MAAM,SAAS,MAAM,UAAU,EAAE,CAAC;GACjD,MAAM,SAA0B;IAAE,IAAI,OAAO;IAAI,MAAM;IAAW,KAAK,OAAO;IAAK;GACnF,UAAU,IAAI,OAAO,IAAI,OAAO,GAAG;GACnC,OAAO;;EAGT,MAAM,KAAK,QAAyB,SAAiB,SAA+B;GAClF,OAAO,SAAS,KAAK,aAAa,OAAO,EAAE,SAAS,QAAQ;;EAG9D,MAAM,SAAS,QAAyB,MAA+B;GACrE,OAAO,SAAS,SAAS,aAAa,OAAO,EAAE,KAAK;;EAGtD,MAAM,UAAU,QAAyB,MAAc,SAAgC;GACrF,OAAO,SAAS,UAAU,aAAa,OAAO,EAAE,MAAM,QAAQ;;EAGhE,MAAM,UAAU,QAAyB,MAAiC;GACxE,OAAO,SAAS,UAAU,aAAa,OAAO,EAAE,KAAK;;EAGvD,MAAM,QAAQ,QAAwC;GACpD,MAAM,KAAK,UAAU,IAAI,OAAO,GAAG;GACnC,IAAI,CAAC,IACH;GACF,MAAM,SAAS,QAAQ,GAAG;GAC1B,UAAU,OAAO,OAAO,GAAG;;EAE9B"}

package/dist/contexts.js

@@ -1,2 +1,2 @@
-import { n as createProcessContext, t as createSandboxContext } from "./contexts-DhmMlT2W.js";
+import { n as createProcessContext, t as createSandboxContext } from "./contexts-BOtMvzli.js";
 export { createProcessContext, createSandboxContext };

package/dist/{errors-CDwtPIMX.js → errors-C5VSakmT.js}

@@ -169,4 +169,4 @@ function toTypedError(classification, provider, cause) {
 //#endregion
 export { AgentToolPairingError as a, matchesContextExceeded as c, AgentToolNotAllowedError as i, toTypedError as l, AgentContextExceededError as n, CONTEXT_EXCEEDED_MESSAGE_PATTERNS as o, AgentProviderError as r, errorMessage as s, AgentAbortedError as t };
 
-//# sourceMappingURL=errors-CDwtPIMX.js.map
+//# sourceMappingURL=errors-C5VSakmT.js.map

package/dist/{errors-CDwtPIMX.js.map → errors-C5VSakmT.js.map}

@@ -1 +1 @@
-{"version":3,"file":"errors-CDwtPIMX.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Typed error classes for agent runs.\n *\n * Providers classify native errors into one of these so downstream consumers\n * can react without string-sniffing messages.\n *\n * Provider authors: implement `Provider.classifyError` to map native errors\n * (SDK exceptions, HTTP responses) to a `ClassifiedError`. The loop wraps\n * unclassified errors in `AgentProviderError` automatically.\n */\n\n/** Kind of classified provider error */\nexport type ClassifiedErrorKind = 'context_exceeded' | 'provider_error' | 'aborted' | 'tool_pairing_corruption'\n\n/** Structured classification returned by `Provider.classifyError` */\nexport interface ClassifiedError {\n  kind: ClassifiedErrorKind\n  /** Upstream error code as surfaced by the provider (e.g. `context_length_exceeded`). Optional. */\n  providerCode?: string\n  /** Optional human-readable message override. Falls back to the underlying error's message. */\n  message?: string\n  /**\n   * Hint that the error is transient and a retry with backoff is reasonable\n   * (e.g. 429, 5xx, truncated stream). Omitted when the provider can't decide;\n   * callers should default to \"do not retry\" when absent to avoid hammering\n   * terminal failures (auth, invalid request).\n   */\n  retryable?: boolean\n}\n\ninterface TypedErrorOptions {\n  /** Provider name, always set (e.g. `anthropic`, `openrouter`) */\n  provider: string\n  /** Optional upstream error code */\n  providerCode?: string\n  /** Original error from the provider SDK/HTTP layer */\n  cause?: unknown\n  /** See {@link ClassifiedError.retryable}. */\n  retryable?: boolean\n}\n\n/**\n * Thrown when the model or provider signals that the context window was exceeded.\n * Downstream consumers should catch this, prune history, and retry.\n */\nexport class AgentContextExceededError extends Error {\n  readonly code = 'context_exceeded' as const\n  readonly provider: string\n  readonly providerCode?: string\n\n  constructor(message: string, options: TypedErrorOptions) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentContextExceededError'\n    this.provider = options.provider\n    this.providerCode = options.providerCode\n  }\n}\n\n/**\n * Thrown when the provider returns a non-context error (auth, rate limit, server error, etc.).\n * Catch-all for unclassified provider failures.\n */\nexport class AgentProviderError extends Error {\n  readonly code = 'provider_error' as const\n  readonly provider: string\n  readonly providerCode?: string\n  /**\n   * Whether a retry with backoff is likely to succeed. See\n   * {@link ClassifiedError.retryable}. Absent when the provider did not\n   * classify the error — callers should treat absent as \"don't retry\".\n   */\n  readonly retryable?: boolean\n\n  constructor(message: string, options: TypedErrorOptions) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentProviderError'\n    this.provider = options.provider\n    this.providerCode = options.providerCode\n    this.retryable = options.retryable\n  }\n}\n\n/**\n * Thrown when a run is aborted by the consumer via `agent.abort()` or an external `AbortSignal`.\n */\nexport class AgentAbortedError extends Error {\n  readonly code = 'aborted' as const\n\n  constructor(message = 'Agent run aborted', options?: { cause?: unknown }) {\n    super(message, options?.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentAbortedError'\n  }\n}\n\n/**\n * Thrown by the pre-send pairing repair when {@link AgentBehavior.strictToolPairing}\n * is `true` and {@link ensureToolResultPairing} would otherwise patch over\n * corruption. Strict mode opts into fail-fast for training-data collectors and\n * any consumer that prefers to bail out rather than ship a transcript carrying\n * a {@link SYNTHETIC_TOOL_RESULT_PLACEHOLDER}.\n *\n * The `repairs` field carries every repair the loop would have made — useful\n * for postmortems and for surfacing exactly which transcripts were rejected.\n *\n * Note: callers consuming the chat layer (TUI/SDK presets) typically leave\n * `strictToolPairing` off so user-facing sessions auto-heal instead of\n * crashing.\n */\nexport class AgentToolPairingError extends Error {\n  readonly code = 'tool_pairing_corruption' as const\n  /** Provider whose wire format the corruption would have hit. */\n  readonly provider?: string\n  /** Upstream error code when the corruption was detected from a 400 response. */\n  readonly providerCode?: string\n  /**\n   * Repairs the harness would have performed had strict mode been off.\n   * Preserves the full diagnostic so consumers can route to telemetry,\n   * `/rewind` flows, or training-data quarantine without re-walking the\n   * transcript.\n   */\n  readonly repairs: ReadonlyArray<{\n    mode: string\n    callId?: string\n    messageIndex: number\n  }>\n\n  constructor(options: {\n    message: string\n    provider?: string\n    providerCode?: string\n    repairs: ReadonlyArray<{ mode: string, callId?: string, messageIndex: number }>\n    cause?: unknown\n  }) {\n    super(options.message, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentToolPairingError'\n    this.provider = options.provider\n    this.providerCode = options.providerCode\n    this.repairs = options.repairs\n  }\n}\n\n/**\n * Thrown (well — constructed; attach via the `tool:gate` block signal) when the\n * union of `allowed-tools` across active skills does not permit a tool call.\n *\n * Produced by the allowed-tools middleware registered on `tool:gate` /\n * `mcp:tool:gate`. The gate's `block = true` + `reason` carry the same message\n * so consumers that don't look at this typed error still get a useful string.\n */\nexport class AgentToolNotAllowedError extends Error {\n  readonly code = 'tool_not_allowed' as const\n  /** Canonical tool name the agent tried to call. */\n  readonly toolName: string\n  /** Aliased / wire name the LLM saw. */\n  readonly displayName: string\n  /** Flattened union of `allowedTools` patterns across active skills. */\n  readonly allowedUnion: readonly string[]\n  /** Names of the skills currently active when the block fired. */\n  readonly activeSkills: readonly string[]\n\n  constructor(options: {\n    toolName: string\n    displayName: string\n    allowedUnion: readonly string[]\n    activeSkills: readonly string[]\n    cause?: unknown\n  }) {\n    // Recovery hint points the model at the deactivate path. Without it the\n    // model would invent folk theories like \"skill restrictions reset on\n    // the next user message\" and silently waste turns probing other tools.\n    // The hint mentions exactly one of the active skills (if any) so the\n    // model has a concrete `skills_use({ mode: \"deactivate\", name: ... })`\n    // call to make.\n    const sample = options.activeSkills[0]\n    const hint = sample !== undefined\n      ? ` To use this tool, call \\`skills_use\\` with \\`mode: \"deactivate\"\\` and the active skill name (e.g. \"${sample}\") to lift its restriction — or ask the user to switch agent profile.`\n      : ''\n    const msg = (\n      `Tool \"${options.displayName}\" is not in the allowed-tools union of the active `\n      + `skill(s) [${options.activeSkills.join(', ')}]. Union: [${options.allowedUnion.join(' ')}].${hint}`\n    )\n    super(msg, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentToolNotAllowedError'\n    this.toolName = options.toolName\n    this.displayName = options.displayName\n    this.allowedUnion = options.allowedUnion\n    this.activeSkills = options.activeSkills\n  }\n}\n\n/**\n * Regex patterns matching common \"context window exceeded\" messages across providers.\n *\n * Use {@link matchesContextExceeded} to test a free-form error message against them.\n * Provider authors can also compose these into their own `classifyError` fallbacks.\n */\nexport const CONTEXT_EXCEEDED_MESSAGE_PATTERNS: readonly RegExp[] = [\n  /context[_\\s]length[_\\s]exceeded/i,\n  /maximum context length/i,\n  /prompt is too long/i,\n  /context window/i,\n]\n\n/**\n * Return true when `message` matches any of the known \"context window exceeded\"\n * phrasings. Safe for `''` / non-strings (returns false).\n */\nexport function matchesContextExceeded(message: unknown): boolean {\n  if (typeof message !== 'string' || message.length === 0)\n    return false\n  return CONTEXT_EXCEEDED_MESSAGE_PATTERNS.some(re => re.test(message))\n}\n\n/**\n * Extract a printable message from an unknown thrown value.\n *\n * Standardizes the `err instanceof Error ? err.message : String(err)` idiom\n * that every `catch (err)` block was reaching for.\n */\nexport function errorMessage(err: unknown): string {\n  if (err instanceof Error)\n    return err.message\n  return String(err)\n}\n\n/**\n * Convert a `ClassifiedError` + underlying cause into the matching typed error instance.\n */\nexport function toTypedError(\n  classification: ClassifiedError,\n  provider: string,\n  cause: unknown,\n): AgentContextExceededError | AgentProviderError | AgentAbortedError | AgentToolPairingError {\n  const message = classification.message ?? errorMessage(cause)\n\n  if (classification.kind === 'context_exceeded') {\n    return new AgentContextExceededError(message, {\n      provider,\n      providerCode: classification.providerCode,\n      cause,\n    })\n  }\n\n  if (classification.kind === 'aborted') {\n    return new AgentAbortedError(message, { cause })\n  }\n\n  if (classification.kind === 'tool_pairing_corruption') {\n    return new AgentToolPairingError({\n      message,\n      provider,\n      providerCode: classification.providerCode,\n      // Server-side rejection: we don't have the structured repair list a\n      // local-pre-send strict-mode throw would carry. Surface an empty\n      // array so consumers branching on `repairs.length` see \"the harness\n      // didn't get a chance to walk the transcript\".\n      repairs: [],\n      cause,\n    })\n  }\n\n  return new AgentProviderError(message, {\n    provider,\n    providerCode: classification.providerCode,\n    retryable: classification.retryable,\n    cause,\n  })\n}\n"],"mappings":";;;;;AA6CA,IAAa,4BAAb,cAA+C,MAAM;CACnD,OAAgB;CAChB;CACA;CAEA,YAAY,SAAiB,SAA4B;EACvD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EAClF,KAAK,OAAO;EACZ,KAAK,WAAW,QAAQ;EACxB,KAAK,eAAe,QAAQ;;;;;;;AAQhC,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAgB;CAChB;CACA;;;;;;CAMA;CAEA,YAAY,SAAiB,SAA4B;EACvD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EAClF,KAAK,OAAO;EACZ,KAAK,WAAW,QAAQ;EACxB,KAAK,eAAe,QAAQ;EAC5B,KAAK,YAAY,QAAQ;;;;;;AAO7B,IAAa,oBAAb,cAAuC,MAAM;CAC3C,OAAgB;CAEhB,YAAY,UAAU,qBAAqB,SAA+B;EACxE,MAAM,SAAS,SAAS,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EACnF,KAAK,OAAO;;;;;;;;;;;;;;;;;AAkBhB,IAAa,wBAAb,cAA2C,MAAM;CAC/C,OAAgB;;CAEhB;;CAEA;;;;;;;CAOA;CAMA,YAAY,SAMT;EACD,MAAM,QAAQ,SAAS,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EAC1F,KAAK,OAAO;EACZ,KAAK,WAAW,QAAQ;EACxB,KAAK,eAAe,QAAQ;EAC5B,KAAK,UAAU,QAAQ;;;;;;;;;;;AAY3B,IAAa,2BAAb,cAA8C,MAAM;CAClD,OAAgB;;CAEhB;;CAEA;;CAEA;;CAEA;CAEA,YAAY,SAMT;EAOD,MAAM,SAAS,QAAQ,aAAa;EACpC,MAAM,OAAO,WAAW,KAAA,IACpB,uGAAuG,OAAO,yEAC9G;EACJ,MAAM,MACJ,SAAS,QAAQ,YAAY,8DACd,QAAQ,aAAa,KAAK,KAAK,CAAC,aAAa,QAAQ,aAAa,KAAK,IAAI,CAAC,IAAI;EAEjG,MAAM,KAAK,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EAC9E,KAAK,OAAO;EACZ,KAAK,WAAW,QAAQ;EACxB,KAAK,cAAc,QAAQ;EAC3B,KAAK,eAAe,QAAQ;EAC5B,KAAK,eAAe,QAAQ;;;;;;;;;AAUhC,MAAa,oCAAuD;CAClE;CACA;CACA;CACA;CACD;;;;;AAMD,SAAgB,uBAAuB,SAA2B;CAChE,IAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,GACpD,OAAO;CACT,OAAO,kCAAkC,MAAK,OAAM,GAAG,KAAK,QAAQ,CAAC;;;;;;;;AASvE,SAAgB,aAAa,KAAsB;CACjD,IAAI,eAAe,OACjB,OAAO,IAAI;CACb,OAAO,OAAO,IAAI;;;;;AAMpB,SAAgB,aACd,gBACA,UACA,OAC4F;CAC5F,MAAM,UAAU,eAAe,WAAW,aAAa,MAAM;CAE7D,IAAI,eAAe,SAAS,oBAC1B,OAAO,IAAI,0BAA0B,SAAS;EAC5C;EACA,cAAc,eAAe;EAC7B;EACD,CAAC;CAGJ,IAAI,eAAe,SAAS,WAC1B,OAAO,IAAI,kBAAkB,SAAS,EAAE,OAAO,CAAC;CAGlD,IAAI,eAAe,SAAS,2BAC1B,OAAO,IAAI,sBAAsB;EAC/B;EACA;EACA,cAAc,eAAe;EAK7B,SAAS,EAAE;EACX;EACD,CAAC;CAGJ,OAAO,IAAI,mBAAmB,SAAS;EACrC;EACA,cAAc,eAAe;EAC7B,WAAW,eAAe;EAC1B;EACD,CAAC"}
+{"version":3,"file":"errors-C5VSakmT.js","names":[],"sources":["../src/errors.ts"],"sourcesContent":["/**\n * Typed error classes for agent runs.\n *\n * Providers classify native errors into one of these so downstream consumers\n * can react without string-sniffing messages.\n *\n * Provider authors: implement `Provider.classifyError` to map native errors\n * (SDK exceptions, HTTP responses) to a `ClassifiedError`. The loop wraps\n * unclassified errors in `AgentProviderError` automatically.\n */\n\n/** Kind of classified provider error */\nexport type ClassifiedErrorKind = 'context_exceeded' | 'provider_error' | 'aborted' | 'tool_pairing_corruption'\n\n/** Structured classification returned by `Provider.classifyError` */\nexport interface ClassifiedError {\n  kind: ClassifiedErrorKind\n  /** Upstream error code as surfaced by the provider (e.g. `context_length_exceeded`). Optional. */\n  providerCode?: string\n  /** Optional human-readable message override. Falls back to the underlying error's message. */\n  message?: string\n  /**\n   * Hint that the error is transient and a retry with backoff is reasonable\n   * (e.g. 429, 5xx, truncated stream). Omitted when the provider can't decide;\n   * callers should default to \"do not retry\" when absent to avoid hammering\n   * terminal failures (auth, invalid request).\n   */\n  retryable?: boolean\n}\n\ninterface TypedErrorOptions {\n  /** Provider name, always set (e.g. `anthropic`, `openrouter`) */\n  provider: string\n  /** Optional upstream error code */\n  providerCode?: string\n  /** Original error from the provider SDK/HTTP layer */\n  cause?: unknown\n  /** See {@link ClassifiedError.retryable}. */\n  retryable?: boolean\n}\n\n/**\n * Thrown when the model or provider signals that the context window was exceeded.\n * Downstream consumers should catch this, prune history, and retry.\n */\nexport class AgentContextExceededError extends Error {\n  readonly code = 'context_exceeded' as const\n  readonly provider: string\n  readonly providerCode?: string\n\n  constructor(message: string, options: TypedErrorOptions) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentContextExceededError'\n    this.provider = options.provider\n    this.providerCode = options.providerCode\n  }\n}\n\n/**\n * Thrown when the provider returns a non-context error (auth, rate limit, server error, etc.).\n * Catch-all for unclassified provider failures.\n */\nexport class AgentProviderError extends Error {\n  readonly code = 'provider_error' as const\n  readonly provider: string\n  readonly providerCode?: string\n  /**\n   * Whether a retry with backoff is likely to succeed. See\n   * {@link ClassifiedError.retryable}. Absent when the provider did not\n   * classify the error — callers should treat absent as \"don't retry\".\n   */\n  readonly retryable?: boolean\n\n  constructor(message: string, options: TypedErrorOptions) {\n    super(message, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentProviderError'\n    this.provider = options.provider\n    this.providerCode = options.providerCode\n    this.retryable = options.retryable\n  }\n}\n\n/**\n * Thrown when a run is aborted by the consumer via `agent.abort()` or an external `AbortSignal`.\n */\nexport class AgentAbortedError extends Error {\n  readonly code = 'aborted' as const\n\n  constructor(message = 'Agent run aborted', options?: { cause?: unknown }) {\n    super(message, options?.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentAbortedError'\n  }\n}\n\n/**\n * Thrown by the pre-send pairing repair when {@link AgentBehavior.strictToolPairing}\n * is `true` and {@link ensureToolResultPairing} would otherwise patch over\n * corruption. Strict mode opts into fail-fast for training-data collectors and\n * any consumer that prefers to bail out rather than ship a transcript carrying\n * a {@link SYNTHETIC_TOOL_RESULT_PLACEHOLDER}.\n *\n * The `repairs` field carries every repair the loop would have made — useful\n * for postmortems and for surfacing exactly which transcripts were rejected.\n *\n * Note: callers consuming the chat layer (TUI/SDK presets) typically leave\n * `strictToolPairing` off so user-facing sessions auto-heal instead of\n * crashing.\n */\nexport class AgentToolPairingError extends Error {\n  readonly code = 'tool_pairing_corruption' as const\n  /** Provider whose wire format the corruption would have hit. */\n  readonly provider?: string\n  /** Upstream error code when the corruption was detected from a 400 response. */\n  readonly providerCode?: string\n  /**\n   * Repairs the harness would have performed had strict mode been off.\n   * Preserves the full diagnostic so consumers can route to telemetry,\n   * `/rewind` flows, or training-data quarantine without re-walking the\n   * transcript.\n   */\n  readonly repairs: ReadonlyArray<{\n    mode: string\n    callId?: string\n    messageIndex: number\n  }>\n\n  constructor(options: {\n    message: string\n    provider?: string\n    providerCode?: string\n    repairs: ReadonlyArray<{ mode: string, callId?: string, messageIndex: number }>\n    cause?: unknown\n  }) {\n    super(options.message, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentToolPairingError'\n    this.provider = options.provider\n    this.providerCode = options.providerCode\n    this.repairs = options.repairs\n  }\n}\n\n/**\n * Thrown (well — constructed; attach via the `tool:gate` block signal) when the\n * union of `allowed-tools` across active skills does not permit a tool call.\n *\n * Produced by the allowed-tools middleware registered on `tool:gate` /\n * `mcp:tool:gate`. The gate's `block = true` + `reason` carry the same message\n * so consumers that don't look at this typed error still get a useful string.\n */\nexport class AgentToolNotAllowedError extends Error {\n  readonly code = 'tool_not_allowed' as const\n  /** Canonical tool name the agent tried to call. */\n  readonly toolName: string\n  /** Aliased / wire name the LLM saw. */\n  readonly displayName: string\n  /** Flattened union of `allowedTools` patterns across active skills. */\n  readonly allowedUnion: readonly string[]\n  /** Names of the skills currently active when the block fired. */\n  readonly activeSkills: readonly string[]\n\n  constructor(options: {\n    toolName: string\n    displayName: string\n    allowedUnion: readonly string[]\n    activeSkills: readonly string[]\n    cause?: unknown\n  }) {\n    // Recovery hint points the model at the deactivate path. Without it the\n    // model would invent folk theories like \"skill restrictions reset on\n    // the next user message\" and silently waste turns probing other tools.\n    // The hint mentions exactly one of the active skills (if any) so the\n    // model has a concrete `skills_use({ mode: \"deactivate\", name: ... })`\n    // call to make.\n    const sample = options.activeSkills[0]\n    const hint = sample !== undefined\n      ? ` To use this tool, call \\`skills_use\\` with \\`mode: \"deactivate\"\\` and the active skill name (e.g. \"${sample}\") to lift its restriction — or ask the user to switch agent profile.`\n      : ''\n    const msg = (\n      `Tool \"${options.displayName}\" is not in the allowed-tools union of the active `\n      + `skill(s) [${options.activeSkills.join(', ')}]. Union: [${options.allowedUnion.join(' ')}].${hint}`\n    )\n    super(msg, options.cause !== undefined ? { cause: options.cause } : undefined)\n    this.name = 'AgentToolNotAllowedError'\n    this.toolName = options.toolName\n    this.displayName = options.displayName\n    this.allowedUnion = options.allowedUnion\n    this.activeSkills = options.activeSkills\n  }\n}\n\n/**\n * Regex patterns matching common \"context window exceeded\" messages across providers.\n *\n * Use {@link matchesContextExceeded} to test a free-form error message against them.\n * Provider authors can also compose these into their own `classifyError` fallbacks.\n */\nexport const CONTEXT_EXCEEDED_MESSAGE_PATTERNS: readonly RegExp[] = [\n  /context[_\\s]length[_\\s]exceeded/i,\n  /maximum context length/i,\n  /prompt is too long/i,\n  /context window/i,\n]\n\n/**\n * Return true when `message` matches any of the known \"context window exceeded\"\n * phrasings. Safe for `''` / non-strings (returns false).\n */\nexport function matchesContextExceeded(message: unknown): boolean {\n  if (typeof message !== 'string' || message.length === 0)\n    return false\n  return CONTEXT_EXCEEDED_MESSAGE_PATTERNS.some(re => re.test(message))\n}\n\n/**\n * Extract a printable message from an unknown thrown value.\n *\n * Standardizes the `err instanceof Error ? err.message : String(err)` idiom\n * that every `catch (err)` block was reaching for.\n */\nexport function errorMessage(err: unknown): string {\n  if (err instanceof Error)\n    return err.message\n  return String(err)\n}\n\n/**\n * Convert a `ClassifiedError` + underlying cause into the matching typed error instance.\n */\nexport function toTypedError(\n  classification: ClassifiedError,\n  provider: string,\n  cause: unknown,\n): AgentContextExceededError | AgentProviderError | AgentAbortedError | AgentToolPairingError {\n  const message = classification.message ?? errorMessage(cause)\n\n  if (classification.kind === 'context_exceeded') {\n    return new AgentContextExceededError(message, {\n      provider,\n      providerCode: classification.providerCode,\n      cause,\n    })\n  }\n\n  if (classification.kind === 'aborted') {\n    return new AgentAbortedError(message, { cause })\n  }\n\n  if (classification.kind === 'tool_pairing_corruption') {\n    return new AgentToolPairingError({\n      message,\n      provider,\n      providerCode: classification.providerCode,\n      // Server-side rejection: we don't have the structured repair list a\n      // local-pre-send strict-mode throw would carry. Surface an empty\n      // array so consumers branching on `repairs.length` see \"the harness\n      // didn't get a chance to walk the transcript\".\n      repairs: [],\n      cause,\n    })\n  }\n\n  return new AgentProviderError(message, {\n    provider,\n    providerCode: classification.providerCode,\n    retryable: classification.retryable,\n    cause,\n  })\n}\n"],"mappings":";;;;;AA6CA,IAAa,4BAAb,cAA+C,MAAM;CACnD,OAAgB;CAChB;CACA;CAEA,YAAY,SAAiB,SAA4B;EACvD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EAClF,KAAK,OAAO;EACZ,KAAK,WAAW,QAAQ;EACxB,KAAK,eAAe,QAAQ;;;;;;;AAQhC,IAAa,qBAAb,cAAwC,MAAM;CAC5C,OAAgB;CAChB;CACA;;;;;;CAMA;CAEA,YAAY,SAAiB,SAA4B;EACvD,MAAM,SAAS,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EAClF,KAAK,OAAO;EACZ,KAAK,WAAW,QAAQ;EACxB,KAAK,eAAe,QAAQ;EAC5B,KAAK,YAAY,QAAQ;;;;;;AAO7B,IAAa,oBAAb,cAAuC,MAAM;CAC3C,OAAgB;CAEhB,YAAY,UAAU,qBAAqB,SAA+B;EACxE,MAAM,SAAS,SAAS,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EACnF,KAAK,OAAO;;;;;;;;;;;;;;;;;AAkBhB,IAAa,wBAAb,cAA2C,MAAM;CAC/C,OAAgB;;CAEhB;;CAEA;;;;;;;CAOA;CAMA,YAAY,SAMT;EACD,MAAM,QAAQ,SAAS,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EAC1F,KAAK,OAAO;EACZ,KAAK,WAAW,QAAQ;EACxB,KAAK,eAAe,QAAQ;EAC5B,KAAK,UAAU,QAAQ;;;;;;;;;;;AAY3B,IAAa,2BAAb,cAA8C,MAAM;CAClD,OAAgB;;CAEhB;;CAEA;;CAEA;;CAEA;CAEA,YAAY,SAMT;EAOD,MAAM,SAAS,QAAQ,aAAa;EACpC,MAAM,OAAO,WAAW,KAAA,IACpB,uGAAuG,OAAO,yEAC9G;EACJ,MAAM,MACJ,SAAS,QAAQ,YAAY,8DACd,QAAQ,aAAa,KAAK,KAAK,CAAC,aAAa,QAAQ,aAAa,KAAK,IAAI,CAAC,IAAI;EAEjG,MAAM,KAAK,QAAQ,UAAU,KAAA,IAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,KAAA,EAAU;EAC9E,KAAK,OAAO;EACZ,KAAK,WAAW,QAAQ;EACxB,KAAK,cAAc,QAAQ;EAC3B,KAAK,eAAe,QAAQ;EAC5B,KAAK,eAAe,QAAQ;;;;;;;;;AAUhC,MAAa,oCAAuD;CAClE;CACA;CACA;CACA;CACD;;;;;AAMD,SAAgB,uBAAuB,SAA2B;CAChE,IAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,GACpD,OAAO;CACT,OAAO,kCAAkC,MAAK,OAAM,GAAG,KAAK,QAAQ,CAAC;;;;;;;;AASvE,SAAgB,aAAa,KAAsB;CACjD,IAAI,eAAe,OACjB,OAAO,IAAI;CACb,OAAO,OAAO,IAAI;;;;;AAMpB,SAAgB,aACd,gBACA,UACA,OAC4F;CAC5F,MAAM,UAAU,eAAe,WAAW,aAAa,MAAM;CAE7D,IAAI,eAAe,SAAS,oBAC1B,OAAO,IAAI,0BAA0B,SAAS;EAC5C;EACA,cAAc,eAAe;EAC7B;EACD,CAAC;CAGJ,IAAI,eAAe,SAAS,WAC1B,OAAO,IAAI,kBAAkB,SAAS,EAAE,OAAO,CAAC;CAGlD,IAAI,eAAe,SAAS,2BAC1B,OAAO,IAAI,sBAAsB;EAC/B;EACA;EACA,cAAc,eAAe;EAK7B,SAAS,EAAE;EACX;EACD,CAAC;CAGJ,OAAO,IAAI,mBAAmB,SAAS;EACrC;EACA,cAAc,eAAe;EAC7B,WAAW,eAAe;EAC1B;EACD,CAAC"}

package/dist/index.js

@@ -1,15 +1,15 @@
-import { A as resolvePersistDir, C as TOOL_USE_SKIPPED_MESSAGE, D as buildPersistedStub, E as PERSISTENCE_PREVIEW_BYTES, F as resolveReadStateMap, M as getReadState, O as cleanupPersistedSession, P as readStateKey, S as TOOL_USE_CANCELLED_MESSAGE, T as PERSISTED_STUB_PREFIX, _ as createSkillsReadTool, a as multiEdit, b as INTERRUPT_MESSAGE_FOR_TOOL_USE, c as grep, g as createSkillsRunScriptTool, h as createSkillsUseTool, j as resolveTasksDir, k as maybePersistToolResult, l as glob, n as createSpawnTool, p as createAgent, s as createInteractionTool, u as edit, v as createShellTool, w as validateToolArgs, x as SHELL_CASCADE_CANCEL_MESSAGE } from "./tools-D_icxa-V.js";
-import { n as createProcessContext, t as createSandboxContext } from "./contexts-DhmMlT2W.js";
-import { a as AgentToolPairingError, c as matchesContextExceeded, i as AgentToolNotAllowedError, l as toTypedError, n as AgentContextExceededError, o as CONTEXT_EXCEEDED_MESSAGE_PATTERNS, r as AgentProviderError, s as errorMessage, t as AgentAbortedError } from "./errors-CDwtPIMX.js";
-import { n as toolResultToText, t as toolOutputByteLength } from "./types-IcokUOyC.js";
-import { a as detectTurnInterruption, b as sanitizeToolSpecs, c as fromAnthropic, d as toOpenAI, f as OpenAICompatHttpError, g as openaiCompat, h as mapOAIFinishReason, i as autoDetectAndConvert, l as fromOpenAI, m as classifyOpenAICompatError, n as SYNTHETIC_TOOL_RESULT_PLACEHOLDER, o as ensureToolResultPairing, r as TOOL_USE_INTERRUPTED_MARKER, s as filterUnresolvedToolUses, t as ORPHANED_TOOL_RESULT_MARKER, u as toAnthropic, y as sanitizeToolSchema } from "./messages-fTR19Ga6.js";
-import { c as createMemoryMcpCredentialStore, i as resultToString, l as hasAuthorizationHeader, n as normalizeMcpBlocks, r as normalizeMcpServers, s as McpOAuthProvider, t as connectMcpServers } from "./mcp-CNUbvbsy.js";
-import { _ as validateResourcePath, a as discoverSkills, b as createSkillActivationState, f as IMPLICITLY_ALLOWED_SKILL_TOOLS, g as parseAllowedToolPattern, h as matchesAllowedTool, i as writeSkillsToDisk, l as parseSkillFile, m as isToolAllowedByUnion, n as resolveSkills, p as installAllowedToolsGate, r as writeSkillToDisk, t as interpolateShellCommands, u as buildCatalog, v as validateSkillForWrite, y as validateSkillName } from "./interpolate-BaaKaKzN.js";
-import { C as summaryToTurn, E as CompactPromptTooLongError, S as stripImagesFromTurns, T as CompactInvalidInputError, _ as buildTailCompactPrompt, a as selectFilesFromSession, b as anchorPreviewFor, c as BYTES_PER_TOKEN, d as BASE_INSTRUCTIONS, f as NO_TOOLS_PREAMBLE, g as buildFullCompactPrompt, h as buildFromCompactPrompt, i as selectFilesFromReadState, l as estimateTokens, m as buildCompactPrompt, n as startOAuthCallback, o as selectRecentFiles, p as TRAILER, r as buildPostCompactAttachments, s as compactConversation, t as loginMcpServer, u as utf8ByteLength, v as buildUpToCompactPrompt, w as truncateHeadForPtlRetry, x as sliceForCompaction, y as ANCHOR_PREVIEW_MAX_CHARS } from "./login-iTy-0wYz.js";
-import { r as statsByModel, t as flattenTurns } from "./stats-DgOvY7wd.js";
-import { i as basic_default, n as definePreset, r as basicTools } from "./presets-h6UWhghO.js";
-import { i as anthropic, n as openai, r as cerebras, t as openrouter } from "./providers-G0VBZK9j.js";
-import { a as createFileMapStore, i as createMemoryStore, n as loadSession, r as createRemoteStore, t as createSession } from "./session-CbkiJDlH.js";
+import { A as resolvePersistDir, C as TOOL_USE_SKIPPED_MESSAGE, D as buildPersistedStub, E as PERSISTENCE_PREVIEW_BYTES, F as resolveReadStateMap, M as getReadState, O as cleanupPersistedSession, P as readStateKey, S as TOOL_USE_CANCELLED_MESSAGE, T as PERSISTED_STUB_PREFIX, _ as createSkillsReadTool, a as multiEdit, b as INTERRUPT_MESSAGE_FOR_TOOL_USE, c as grep, g as createSkillsRunScriptTool, h as createSkillsUseTool, j as resolveTasksDir, k as maybePersistToolResult, l as glob, n as createSpawnTool, p as createAgent, s as createInteractionTool, u as edit, v as createShellTool, w as validateToolArgs, x as SHELL_CASCADE_CANCEL_MESSAGE } from "./tools-BavL6n7q.js";
+import { n as createProcessContext, t as createSandboxContext } from "./contexts-BOtMvzli.js";
+import { a as AgentToolPairingError, c as matchesContextExceeded, i as AgentToolNotAllowedError, l as toTypedError, n as AgentContextExceededError, o as CONTEXT_EXCEEDED_MESSAGE_PATTERNS, r as AgentProviderError, s as errorMessage, t as AgentAbortedError } from "./errors-C5VSakmT.js";
+import { n as toolResultToText, t as toolOutputByteLength } from "./types-C-9h2drI.js";
+import { a as detectTurnInterruption, b as sanitizeToolSpecs, c as fromAnthropic, d as toOpenAI, f as OpenAICompatHttpError, g as openaiCompat, h as mapOAIFinishReason, i as autoDetectAndConvert, l as fromOpenAI, m as classifyOpenAICompatError, n as SYNTHETIC_TOOL_RESULT_PLACEHOLDER, o as ensureToolResultPairing, r as TOOL_USE_INTERRUPTED_MARKER, s as filterUnresolvedToolUses, t as ORPHANED_TOOL_RESULT_MARKER, u as toAnthropic, y as sanitizeToolSchema } from "./messages-BBWakTN6.js";
+import { c as createMemoryMcpCredentialStore, i as resultToString, l as hasAuthorizationHeader, n as normalizeMcpBlocks, r as normalizeMcpServers, s as McpOAuthProvider, t as connectMcpServers } from "./mcp-C8XUNC_R.js";
+import { _ as validateResourcePath, a as discoverSkills, b as createSkillActivationState, f as IMPLICITLY_ALLOWED_SKILL_TOOLS, g as parseAllowedToolPattern, h as matchesAllowedTool, i as writeSkillsToDisk, l as parseSkillFile, m as isToolAllowedByUnion, n as resolveSkills, p as installAllowedToolsGate, r as writeSkillToDisk, t as interpolateShellCommands, u as buildCatalog, v as validateSkillForWrite, y as validateSkillName } from "./interpolate-Cvjy8gpk.js";
+import { C as summaryToTurn, E as CompactPromptTooLongError, S as stripImagesFromTurns, T as CompactInvalidInputError, _ as buildTailCompactPrompt, a as selectFilesFromSession, b as anchorPreviewFor, c as BYTES_PER_TOKEN, d as BASE_INSTRUCTIONS, f as NO_TOOLS_PREAMBLE, g as buildFullCompactPrompt, h as buildFromCompactPrompt, i as selectFilesFromReadState, l as estimateTokens, m as buildCompactPrompt, n as startOAuthCallback, o as selectRecentFiles, p as TRAILER, r as buildPostCompactAttachments, s as compactConversation, t as loginMcpServer, u as utf8ByteLength, v as buildUpToCompactPrompt, w as truncateHeadForPtlRetry, x as sliceForCompaction, y as ANCHOR_PREVIEW_MAX_CHARS } from "./login-DthdFNzR.js";
+import { r as statsByModel, t as flattenTurns } from "./stats-Lc3zL3RM.js";
+import { i as basic_default, n as definePreset, r as basicTools } from "./presets-C5E9hokO.js";
+import { i as anthropic, n as openai, r as cerebras, t as openrouter } from "./providers-CsUyN_FJ.js";
+import { a as createFileMapStore, i as createMemoryStore, n as loadSession, r as createRemoteStore, t as createSession } from "./session-DzfRacU_.js";
 import { defineSkill } from "./skills.js";
 //#region src/logger.ts
 /**