zidane 7.2.4 → 8.0.4

package/dist/tool-state-Dku6YqAB.js

@@ -0,0 +1,989 @@
+import { d as toolResultToText } from "./types-Cu0ZGDu9.js";
+import { n as deriveMcpToolMeta, r as nonOwningMcpView } from "./mcp-_wecH9Qe.js";
+import { toolPrompts } from "./tools/prompts.js";
+import { i as styleReplacementForVia, n as resolveOldString } from "./edit-utils-EGosADZq.js";
+import { o as toCanonicalName } from "./aliasing-lVFbm81n.js";
+import { a as readFileTargets, r as readFileBatchHeader, t as formatBytes } from "./format-bytes-C7tfc3Zm.js";
+import { Buffer } from "node:buffer";
+import { resolve } from "node:path";
+//#region src/tools/read-state.ts
+const STATE = /* @__PURE__ */ new WeakMap();
+/**
+* Get or lazily create the per-session read-state map. Returns `undefined`
+* when no session is provided.
+*
+* Most tool callers should prefer {@link resolveReadStateMap}, which
+* additionally honors an explicit `ctx.readState` (the path
+* `spawn`'s `shareReadState: true` uses to forward the parent's map
+* into a sessionless child). Use this helper directly only when the
+* Session-keyed map is exactly what you want and you don't need to
+* accept an override.
+*/
+function getReadState(session) {
+	if (!session) return void 0;
+	let map = STATE.get(session);
+	if (!map) {
+		map = /* @__PURE__ */ new Map();
+		STATE.set(session, map);
+	}
+	return map;
+}
+/**
+* Resolve the active read-state map from a tool context. An explicit
+* `ctx.readState` wins (used by `spawn`'s `shareReadState` opt-in to
+* forward the parent's map into a sessionless child); otherwise the
+* usual `Session`-keyed lookup applies.
+*
+* Tools should call this helper instead of `getReadState(ctx.session)`
+* directly so the `shareReadState` plumbing is honored uniformly.
+*/
+function resolveReadStateMap(ctx) {
+	return ctx.readState ?? getReadState(ctx.session);
+}
+/**
+* Mark a read-state entry as elided from the on-wire history WITHOUT
+* un-registering it.
+*
+* Used by the loop's `elideStaleReads` pass. The entry must survive —
+* deleting it made the `requireReadBeforeEdit` gate reject the very next
+* edit on a file the model had demonstrably read and just edited (the
+* gate's failure mode then defeats the gate: models degrade to raw shell
+* edits that bypass the guard entirely). The `elided` flag instead
+* defeats only the dedup stub: the next identical re-read returns the
+* full body again, and `rememberRead` clears the flag.
+*
+* No-op when the path has no entry in the resolved map(s).
+*/
+function markReadStateElided(ctx, cwd, path) {
+	const key = readStateKey(cwd, path);
+	for (const map of [ctx.readState, ctx.session ? STATE.get(ctx.session) : void 0]) {
+		const entry = map?.get(key);
+		if (entry && entry.elided !== true) map.set(key, {
+			...entry,
+			elided: true
+		});
+	}
+}
+/**
+* Record one `requireReadBeforeEdit` drift refusal against `entry` and
+* return the consecutive count (1 for the first). The caller composes the
+* refusal message with {@link staleRefusalHint}.
+*/
+function noteStaleRejection(map, key, entry) {
+	const count = (entry.staleRejections ?? 0) + 1;
+	map.set(key, {
+		...entry,
+		staleRejections: count
+	});
+	return count;
+}
+/**
+* Escalating suffix for a drift refusal. Empty on the first refusal — the
+* base "re-read the file" advice is correct and sufficient. From the second
+* consecutive refusal on, the model has demonstrably re-read and been
+* refused again, so repeating the same advice reads as a broken tool;
+* name the real hypothesis (an external writer) instead.
+*/
+function staleRefusalHint(count) {
+	if (count < 2) return "";
+	return ` This is refusal #${count} since your last read — a process outside this session (editor auto-save, formatter, codegen watcher) may be rewriting the file between your reads.`;
+}
+/**
+* Canonical read-state key for a `(cwd, path)` pair.
+*
+* `ctx.execution.readFile(handle, path)` resolves the model-provided
+* path against `handle.cwd` before touching disk — so `src/App.tsx`,
+* `./src/App.tsx`, and `/abs/cwd/src/App.tsx` all read the **same**
+* bytes. The read-state map MUST mirror that resolution: without it,
+* a model that reads `src/App.tsx` and then edits `./src/App.tsx`
+* trips the `requireReadBeforeEdit` gate for a file it demonstrably
+* already saw (the gate's "has not been read in this session" message
+* fires on a stale key).
+*
+* `node:path`'s `resolve(cwd, path)` short-circuits when `path` is
+* already absolute, so absolute and relative shapes converge on the
+* same canonical form. We don't `realpath()` symlinks — the file IS
+* the path the model addressed, not the realpath behind it; the host's
+* execution context decides how to dereference.
+*/
+function readStateKey(cwd, path) {
+	return resolve(cwd, path);
+}
+/**
+* 64-bit content hash: two independent 32-bit FNV-1a-style lanes (different
+* offset bases + multipliers) concatenated as 16 hex chars. Fast,
+* non-cryptographic — but wide enough that the `requireReadBeforeEdit`
+* drift gate, which silently corrupts a file on a false "unchanged"
+* verdict, isn't betting on a 32-bit birthday bound (~1 in 4 billion per
+* pair; uncomfortably reachable over many files × many sessions). Entries
+* live only in per-session in-memory maps, so widening needs no
+* stored-format migration. Still cheaper than allocating a Buffer and
+* pulling in `crypto`.
+*/
+function hashContent(text) {
+	let h1 = 2166136261;
+	let h2 = 2128831031;
+	for (let i = 0; i < text.length; i++) {
+		const c = text.charCodeAt(i);
+		h1 = Math.imul(h1 ^ c, 16777619) >>> 0;
+		h2 = Math.imul(h2 ^ c, 2246822507) >>> 0;
+	}
+	return h1.toString(16).padStart(8, "0") + h2.toString(16).padStart(8, "0");
+}
+const READ_FILE_DEFAULT_OFFSET = 1;
+const READ_FILE_DEFAULT_LIMIT = 2e3;
+const READ_FILE_DEFAULT_MAX_BYTES = 262144;
+const READ_FILE_FOOTER_RE = /\n\n…(?:read lines|truncated)/;
+const READ_FILE_LINE_RE = /^\d{1,9}\t(.*)$/;
+/**
+* Rebuild the per-session read-state map from durable session turns.
+*
+* Durable replay runtimes may return recorded tool results without re-running
+* the tool body, so in-memory side effects like `readState.set(...)` can be
+* missing even though the transcript contains the successful `read_file`.
+* This helper is intentionally opt-in: live hosts keep the normal side-effect
+* behavior unless they call it themselves.
+*
+* Hydration only fills missing keys. Live in-memory state may already reflect a
+* newer read or edit from the current run, and durable history cannot prove it
+* is fresher. Relative paths are resolved against the current execution cwd,
+* matching replay hosts that run sessions from a stable workspace.
+*/
+function hydrateReadStateFromSession(session, cwd, options = {}) {
+	if (!session) return 0;
+	const readState = getReadState(session);
+	if (!readState) return 0;
+	const normalized = normalizeHydrateReadStateOptions(options);
+	const pending = /* @__PURE__ */ new Map();
+	const known = /* @__PURE__ */ new Map();
+	const preexistingKeys = new Set(readState.keys());
+	let hydrated = 0;
+	for (const turn of session.turns) for (const block of turn.content) {
+		if (block.type === "tool_call") {
+			const canonicalName = canonicalToolCallName(block.name, normalized);
+			if (canonicalName === normalized.readFileToolName || canonicalName === normalized.writeFileToolName || canonicalName === normalized.editToolName || canonicalName === normalized.multiEditToolName) pending.set(block.id, {
+				name: canonicalName,
+				input: block.input
+			});
+			continue;
+		}
+		if (block.type !== "tool_result") continue;
+		const call = pending.get(block.callId);
+		if (!call) continue;
+		pending.delete(block.callId);
+		if (block.isError === true) continue;
+		const output = toolResultToText(block.output);
+		for (const next of stateFromToolResult(call, output, turn, cwd, normalized, known)) {
+			if (!preexistingKeys.has(next.key)) {
+				readState.set(next.key, next.file.entry);
+				hydrated += 1;
+			}
+			known.set(next.key, next.file);
+		}
+	}
+	return hydrated;
+}
+/**
+* Async replay hydrator for durable hosts that can cheaply read the current
+* full file through their execution context. Transcript-only reconstruction is
+* still preferred for full reads; partial/truncated read_file entries fall back
+* to `readFileForHash` and hash those full current bytes.
+*/
+async function hydrateReadStateFromSessionAsync(session, cwd, options = {}) {
+	if (!session) return 0;
+	const readState = getReadState(session);
+	if (!readState) return 0;
+	const normalized = normalizeHydrateReadStateOptions(options);
+	const pending = /* @__PURE__ */ new Map();
+	const known = /* @__PURE__ */ new Map();
+	const preexistingKeys = new Set(readState.keys());
+	let hydrated = 0;
+	for (const turn of session.turns) for (const block of turn.content) {
+		if (block.type === "tool_call") {
+			const canonicalName = canonicalToolCallName(block.name, normalized);
+			if (canonicalName === normalized.readFileToolName || canonicalName === normalized.writeFileToolName || canonicalName === normalized.editToolName || canonicalName === normalized.multiEditToolName) pending.set(block.id, {
+				name: canonicalName,
+				input: block.input
+			});
+			continue;
+		}
+		if (block.type !== "tool_result") continue;
+		const call = pending.get(block.callId);
+		if (!call) continue;
+		pending.delete(block.callId);
+		if (block.isError === true) continue;
+		const output = toolResultToText(block.output);
+		for (const next of await stateFromToolResultAsync(call, output, turn, cwd, normalized, known)) {
+			if (!preexistingKeys.has(next.key)) {
+				readState.set(next.key, next.file.entry);
+				hydrated += 1;
+			}
+			known.set(next.key, next.file);
+		}
+	}
+	return hydrated;
+}
+function normalizeHydrateReadStateOptions(options) {
+	return {
+		readFileToolName: options.readFileToolName ?? "read_file",
+		writeFileToolName: options.writeFileToolName ?? "write_file",
+		editToolName: options.editToolName ?? "edit",
+		multiEditToolName: options.multiEditToolName ?? "multi_edit",
+		defaultLineNumbers: options.defaultLineNumbers ?? true,
+		...options.readFileForHash ? { readFileForHash: options.readFileForHash } : {},
+		...options.aliasMaps ? { aliasMaps: options.aliasMaps } : {}
+	};
+}
+/**
+* Resolve a transcript tool-call name to its canonical form for matching.
+* Honors `aliasMaps` (wire → canonical) when present; otherwise the name is
+* already canonical (zidane persists canonical names) and passes through.
+*/
+function canonicalToolCallName(name, options) {
+	return options.aliasMaps ? toCanonicalName(name, options.aliasMaps) : name;
+}
+function stateFromToolResult(call, output, resultTurn, cwd, options, known) {
+	let next;
+	if (call.name === options.readFileToolName) return readFileSections(call.input, output).flatMap(({ input, output }) => {
+		const state = readFileStateFromResult(input, output, resultTurn, cwd, options.defaultLineNumbers);
+		return state ? [state] : [];
+	});
+	if (call.name === options.writeFileToolName) next = writeFileStateFromResult(call.input, output, resultTurn, cwd);
+	else if (call.name === options.editToolName) next = editStateFromResult(call.input, output, resultTurn, cwd, known);
+	else if (call.name === options.multiEditToolName) next = multiEditStateFromResult(call.input, output, resultTurn, cwd, known);
+	return next ? [next] : [];
+}
+/**
+* A `read_file` call as single-path reads: the call itself, or, for a
+* `paths` batch, one per `==> path <==` section (each with that entry's
+* offset / limit). Sections are found in call order; hydration stops at the
+* first header it can't locate.
+*/
+function readFileSections(input, output) {
+	if (!Array.isArray(input.paths)) return [{
+		input,
+		output
+	}];
+	const targets = readFileTargets(input);
+	const out = [];
+	let cursor = 0;
+	for (let i = 0; i < targets.length; i++) {
+		const header = `${readFileBatchHeader(targets[i].path)}\n`;
+		if (!output.startsWith(header, cursor)) break;
+		const start = cursor + header.length;
+		const nextHeader = i + 1 < targets.length ? `\n\n${readFileBatchHeader(targets[i + 1].path)}\n` : void 0;
+		const end = nextHeader ? output.indexOf(nextHeader, start) : output.length;
+		if (end === -1) break;
+		const { path, offset, limit } = targets[i];
+		out.push({
+			input: {
+				path,
+				offset,
+				limit,
+				...typeof input.lineNumbers === "boolean" ? { lineNumbers: input.lineNumbers } : {}
+			},
+			output: output.slice(start, end)
+		});
+		cursor = end + 2;
+	}
+	return out;
+}
+async function stateFromToolResultAsync(call, output, resultTurn, cwd, options, known) {
+	if (call.name === options.readFileToolName) {
+		const out = [];
+		for (const section of readFileSections(call.input, output)) {
+			const state = await readFileStateFromResultAsync(section.input, section.output, resultTurn, cwd, {
+				defaultLineNumbers: options.defaultLineNumbers,
+				readFileForHash: options.readFileForHash
+			});
+			if (state) out.push(state);
+		}
+		return out;
+	}
+	return stateFromToolResult(call, output, resultTurn, cwd, options, known);
+}
+function readFileStateFromResult(input, output, resultTurn, cwd, defaultLineNumbers) {
+	const path = typeof input.path === "string" ? input.path : void 0;
+	if (!path || !isSuccessfulFullReadOutput(output)) return void 0;
+	const lineNumbers = typeof input.lineNumbers === "boolean" ? input.lineNumbers : defaultLineNumbers;
+	const content = lineNumbers ? stripReadFileLineNumbers(output) : output;
+	if (content === void 0) return void 0;
+	const entry = {
+		contentHash: hashContent(content),
+		offset: normalizeReadInteger(input.offset, READ_FILE_DEFAULT_OFFSET),
+		limit: normalizeReadInteger(input.limit, READ_FILE_DEFAULT_LIMIT),
+		maxBytes: normalizeReadInteger(input.maxBytes, READ_FILE_DEFAULT_MAX_BYTES),
+		lineNumbers,
+		mtimeMs: resultTurn.createdAt
+	};
+	return {
+		key: readStateKey(cwd, path),
+		file: {
+			content,
+			entry
+		}
+	};
+}
+async function readFileStateFromResultAsync(input, output, resultTurn, cwd, options) {
+	const reconstructed = readFileStateFromResult(input, output, resultTurn, cwd, options.defaultLineNumbers);
+	if (reconstructed) return reconstructed;
+	const path = typeof input.path === "string" ? input.path : void 0;
+	if (!path || !options.readFileForHash || !isSuccessfulReadOutput(output)) return void 0;
+	let content;
+	try {
+		content = await options.readFileForHash(path);
+	} catch {
+		return;
+	}
+	if (typeof content !== "string") return void 0;
+	const lineNumbers = typeof input.lineNumbers === "boolean" ? input.lineNumbers : options.defaultLineNumbers;
+	const entry = {
+		contentHash: hashContent(content),
+		offset: normalizeReadInteger(input.offset, READ_FILE_DEFAULT_OFFSET),
+		limit: normalizeReadInteger(input.limit, READ_FILE_DEFAULT_LIMIT),
+		maxBytes: normalizeReadInteger(input.maxBytes, READ_FILE_DEFAULT_MAX_BYTES),
+		lineNumbers,
+		mtimeMs: resultTurn.createdAt
+	};
+	return {
+		key: readStateKey(cwd, path),
+		file: {
+			content,
+			entry
+		}
+	};
+}
+function writeFileStateFromResult(input, output, resultTurn, cwd) {
+	const path = typeof input.path === "string" ? input.path : void 0;
+	const content = typeof input.content === "string" ? input.content : void 0;
+	if (!path || content === void 0) return void 0;
+	if (!output.startsWith(`Created ${path} (`) && !output.startsWith(`Updated ${path} (`)) return void 0;
+	return {
+		key: readStateKey(cwd, path),
+		file: {
+			content,
+			entry: {
+				contentHash: hashContent(content),
+				offset: 0,
+				limit: Number.POSITIVE_INFINITY,
+				maxBytes: Number.POSITIVE_INFINITY,
+				mtimeMs: resultTurn.createdAt,
+				elided: true
+			}
+		}
+	};
+}
+function editStateFromResult(input, output, resultTurn, cwd, known) {
+	const path = typeof input.path === "string" ? input.path : void 0;
+	const oldString = typeof input.old_string === "string" ? input.old_string : void 0;
+	const newString = typeof input.new_string === "string" ? input.new_string : void 0;
+	if (!path || oldString === void 0 || newString === void 0) return void 0;
+	if (!output.startsWith(`Edited ${path}: replaced `)) return void 0;
+	const key = readStateKey(cwd, path);
+	const prior = known.get(key);
+	if (!prior) return void 0;
+	const nextContent = applyEdit(prior.content, oldString, newString, input.replace_all === true);
+	if (nextContent === void 0) return void 0;
+	return {
+		key,
+		file: {
+			content: nextContent,
+			entry: {
+				...prior.entry,
+				contentHash: hashContent(nextContent),
+				mtimeMs: resultTurn.createdAt,
+				elided: true
+			}
+		}
+	};
+}
+function multiEditStateFromResult(input, output, resultTurn, cwd, known) {
+	const path = typeof input.path === "string" ? input.path : void 0;
+	const edits = Array.isArray(input.edits) ? input.edits : void 0;
+	if (!path || !edits) return void 0;
+	if (!output.startsWith(`Edited ${path}: applied `)) return void 0;
+	const key = readStateKey(cwd, path);
+	const prior = known.get(key);
+	if (!prior) return void 0;
+	const applied = parseMultiEditAppliedSteps(output, edits.length);
+	let current = prior.content;
+	for (let i = 0; i < edits.length; i++) {
+		if (!applied.has(i)) continue;
+		const step = edits[i];
+		if (typeof step.old_string !== "string" || typeof step.new_string !== "string") return void 0;
+		const next = applyEdit(current, step.old_string, step.new_string, step.replace_all === true);
+		if (next === void 0) return void 0;
+		current = next;
+	}
+	return {
+		key,
+		file: {
+			content: current,
+			entry: {
+				...prior.entry,
+				contentHash: hashContent(current),
+				mtimeMs: resultTurn.createdAt,
+				elided: true
+			}
+		}
+	};
+}
+function applyEdit(content, oldString, newString, replaceAll) {
+	const match = resolveOldString(content, oldString);
+	if (!match) return void 0;
+	if (match.occurrences > 1 && !replaceAll) return void 0;
+	const styledReplacement = styleReplacementForVia(newString, match.via, match.actual);
+	return replaceAll ? content.split(match.actual).join(styledReplacement) : content.replace(match.actual, styledReplacement);
+}
+function parseMultiEditAppliedSteps(output, editCount) {
+	const annotationMatch = /<edit-outcomes>\n([\s\S]*?)\n<\/edit-outcomes>/.exec(output);
+	if (!annotationMatch) return new Set(Array.from({ length: editCount }, (_, i) => i));
+	const applied = /* @__PURE__ */ new Set();
+	for (const line of annotationMatch[1].split("\n")) {
+		const match = /^#(\d+) applied$/.exec(line.trim());
+		if (!match) continue;
+		const index = Number(match[1]) - 1;
+		if (index >= 0 && index < editCount) applied.add(index);
+	}
+	return applied;
+}
+function isSuccessfulFullReadOutput(output) {
+	if (!isSuccessfulReadOutput(output) || READ_FILE_FOOTER_RE.test(output)) return false;
+	return true;
+}
+function isSuccessfulReadOutput(output) {
+	if (output.length === 0) return true;
+	if (output.startsWith("File not found:") || output.startsWith("[binary file:") || output.startsWith("Image:") || output.startsWith("Document:") || output.startsWith("[image too large to inline:") || output.startsWith("[document:") || output.startsWith("[document too large to attach:") || output.startsWith("Image read failed:") || output.startsWith("Document read failed:") || output.startsWith("[skipped:") || output.includes(" unchanged since the previous read in this session ")) return false;
+	return true;
+}
+function stripReadFileLineNumbers(output) {
+	const lines = output.split("\n");
+	const stripped = [];
+	for (const line of lines) {
+		const match = READ_FILE_LINE_RE.exec(line);
+		if (!match) return void 0;
+		stripped.push(match[1]);
+	}
+	return stripped.join("\n");
+}
+function normalizeReadInteger(value, fallback) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return fallback;
+	return Math.floor(value);
+}
+const TOOL_DEDUP_STATE = /* @__PURE__ */ new WeakMap();
+/**
+* Get or lazily create the per-session tool-dedup map. Returns `undefined`
+* when no session is provided — middleware should treat that as "no dedup".
+*/
+function getToolDedupState(session) {
+	if (!session) return void 0;
+	let map = TOOL_DEDUP_STATE.get(session);
+	if (!map) {
+		map = /* @__PURE__ */ new Map();
+		TOOL_DEDUP_STATE.set(session, map);
+	}
+	return map;
+}
+//#endregion
+//#region src/tools/model-search.ts
+/**
+* One display line per model: id, provider, real pricing, context
+* window, reasoning flag. The single source of truth for how models
+* render in BOTH the spawn schema's embedded catalog and `model_search`
+* output, so the model never sees two spellings of the same entry.
+*/
+function formatModelLine(entry) {
+	const { model } = entry;
+	const parts = [`${model.id} (${entry.provider})`];
+	if (model.cost) parts.push(`$${model.cost.input}/$${model.cost.output} per Mtok`);
+	if (typeof model.contextWindow === "number" && model.contextWindow > 0) parts.push(`${Math.round(model.contextWindow / 1e3)}k ctx`);
+	if (model.reasoning) parts.push("reasoning");
+	if (model.name && model.name !== model.id) parts.push(model.name);
+	return parts.join(" · ");
+}
+/**
+* Case-insensitive multi-term filter across id, display name, and
+* provider. Every whitespace-separated term must match somewhere
+* (mirrors the TUI picker's `filterModelCatalog` semantics). Empty /
+* whitespace queries pass everything through.
+*/
+function matchModelEntries(entries, query) {
+	const trimmed = query.trim().toLowerCase();
+	if (!trimmed) return [...entries];
+	const terms = trimmed.split(/\s+/);
+	return entries.filter((entry) => {
+		const corpus = `${entry.model.id} ${entry.model.name ?? ""} ${entry.provider}`.toLowerCase();
+		return terms.every((t) => corpus.includes(t));
+	});
+}
+/**
+* Build the `model_search` tool over a spawn model catalog. Register it
+* alongside `createSpawnTool({ models })` — typically only when the
+* catalog is too large to embed in the spawn schema, though it is
+* harmless (and occasionally useful) alongside an embedded catalog too.
+*/
+function createModelSearchTool(models) {
+	return {
+		spec: {
+			name: "model_search",
+			description: toolPrompts.model_search,
+			inputSchema: {
+				type: "object",
+				properties: { query: {
+					type: "string",
+					description: "Optional filter: space-separated terms, ALL must match (e.g. \"haiku\" or \"openrouter qwen\")."
+				} },
+				additionalProperties: false
+			}
+		},
+		async execute(input) {
+			const query = typeof input.query === "string" ? input.query : "";
+			const matches = matchModelEntries(models, query);
+			if (matches.length === 0) return query.trim() === "" ? "No models are configured for subagent use." : `No models match "${query.trim()}". Call model_search without a query to list all ${models.length}.`;
+			return [query.trim() === "" ? `${matches.length} model${matches.length === 1 ? "" : "s"} available for spawned subagents:` : `${matches.length} of ${models.length} model${models.length === 1 ? "" : "s"} match:`, ...matches.map((m) => `- ${formatModelLine(m)}`)].join("\n");
+		}
+	};
+}
+//#endregion
+//#region src/tools/spawn-helpers.ts
+const sessionChildCounters = /* @__PURE__ */ new WeakMap();
+/** Chronological child runs (depth > 0) — index + 1 is the `child-N` label. */
+function childRunsOf(session) {
+	return session.runs.filter((r) => (r.depth ?? 0) > 0);
+}
+/**
+* Human/model-facing list of this session's child runs. Prefers the label
+* persisted at `startRun` (`SessionRun.label`) and falls back to positional
+* numbering for legacy sessions recorded before labels were stored.
+* Rendered into resume-rejection messages so the model can self-correct
+* with a valid label.
+*/
+function describeChildRuns(session) {
+	const childRuns = childRunsOf(session);
+	if (childRuns.length === 0) return "No child runs exist in this session.";
+	return childRuns.map((r, i) => `- ${r.label ?? `child-${i + 1}`} · ${r.status} · ${r.prompt.slice(0, 80)}`).join("\n");
+}
+/**
+* Reserve the next `child-N` label for this session. Exported so the durable
+* (child-as-invocation) spawn tool in `src/restate/spawn.ts` allocates labels
+* from the same session-anchored counter — otherwise the two tools would number
+* children independently and a session that used both would collide.
+*/
+function reserveChildLabel(session) {
+	let counter = sessionChildCounters.get(session);
+	if (counter === void 0) {
+		const childRuns = childRunsOf(session);
+		counter = childRuns.length;
+		for (const r of childRuns) {
+			const m = r.label ? /^child-(\d+)$/.exec(r.label) : null;
+			if (m) counter = Math.max(counter, Number(m[1]));
+		}
+	}
+	counter += 1;
+	sessionChildCounters.set(session, counter);
+	return `child-${counter}`;
+}
+function extractText(message) {
+	if (!message || typeof message !== "object") return "";
+	const msg = message;
+	if (typeof msg.content === "string") return msg.content;
+	if (Array.isArray(msg.content)) return msg.content.filter((block) => !!block && typeof block === "object" && block.type === "text").map((block) => block.text).join("\n");
+	return "";
+}
+/**
+* Read-only tool whitelist applied when a subagent preset has
+* `readonly: true` and no explicit `tools` list. Intentionally narrow —
+* only obviously non-mutating built-ins. Hosts wanting a different
+* read-only profile (e.g. include `glob` for a code-search agent) should
+* pass an explicit `tools` array on the subagent def.
+*/
+const READONLY_TOOL_DEFAULTS = [
+	"read_file",
+	"grep",
+	"glob",
+	"list_files"
+];
+/**
+* Apply a subagent preset's tool filter to the parent's tool registry.
+* Always a strict subset of the input — the child agent never gains
+* tools the parent doesn't have. Names that don't match a parent tool
+* are silently dropped (matches MCP's lenient `enabledTools` behavior).
+*
+* Precedence: `def.tools` (explicit list) > `def.readonly: true`
+* (built-in read-only set) > unfiltered.
+*/
+function filterToolsForSubagent(parentTools, def) {
+	if (!parentTools) return parentTools;
+	const explicit = def.tools;
+	if (explicit && explicit.length > 0) {
+		const wanted = new Set(explicit);
+		const filtered = {};
+		for (const [registryKey, t] of Object.entries(parentTools)) if (wanted.has(t.spec.name)) filtered[registryKey] = t;
+		return filtered;
+	}
+	if (def.readonly) {
+		const wanted = new Set(READONLY_TOOL_DEFAULTS);
+		const filtered = {};
+		for (const [registryKey, t] of Object.entries(parentTools)) if (wanted.has(t.spec.name)) filtered[registryKey] = t;
+		return filtered;
+	}
+	return parentTools;
+}
+/**
+* Wrap the parent's live MCP connection as a child `mcpConnector`. The
+* child agent gets the SAME already-connected, already-wrapped tool defs
+* (and instructions) — no re-bootstrap, no re-auth, so servers connected
+* through a custom parent connector (e.g. the TUI's OAuth-aware one) stay
+* reachable from subagents. `close` is a no-op: the parent owns the
+* transports and closes them on its own destroy; a child's destroy must
+* never tear down connections the parent is still using.
+*
+* Shared tool defs keep the hook bus they were built with, so
+* `mcp:tool:gate` / `mcp:tool:transform` fire on the parent's hooks —
+* child MCP calls are governed by the same gate policy as the session
+* that spawned them.
+*/
+function nonOwningMcpConnector(connection) {
+	return async () => nonOwningMcpView(connection);
+}
+/**
+* Decide what MCP state a child inherits, honoring the subagent tool
+* policy. `filterToolsForSubagent` only sees the parent's native registry
+* — MCP tools arrive later via the child's connector — so without this
+* gate a `readonly` or allowlisted subagent would inherit the parent's
+* FULL MCP toolset on top of its filtered natives.
+*
+* Policy mirror of {@link filterToolsForSubagent}:
+*   - no def / unrestricted def → full inheritance (config + shared live
+*     connection when present).
+*   - `readonly: true` → nothing. MCP tools carry unknown mutation risk;
+*     the read-only whitelist is intentionally native-only. Subagents that
+*     need specific MCP reads should use an explicit `tools` list.
+*   - explicit `tools` list → only MCP tools named in the list, and only
+*     through the shared live connection — forwarding configs without one
+*     would re-bootstrap every server and reopen the bypass this exists
+*     to close. Instructions are trimmed to servers that still contribute
+*     a tool.
+*
+* CONTRACT CAVEAT — configless parents: the child only invokes its
+* connector when its own `mcpServers` list is non-empty (`agent.ts` gates
+* every connect path on config count; pinned by `test/mcp.test.ts`
+* "connector + zero configs → no connect"). So a parent with a live
+* `ctx.mcpConnection` but an absent/empty `ctx.mcpServers` hands down a
+* connector that never fires — the child gets NO MCP tools, allowlisted
+* or not. Hosts sharing a connection must pass the matching transformed
+* config list alongside it (`agent.mcpServers` — see the command-spawn
+* seam in the TUI).
+*/
+function inheritedMcpForSubagent(ctx, def) {
+	const explicit = def?.tools;
+	if (!(def !== void 0 && (def.readonly === true || explicit !== void 0 && explicit.length > 0))) return {
+		...ctx.mcpServers !== void 0 ? { mcpServers: ctx.mcpServers } : {},
+		...ctx.mcpConnection !== void 0 ? { mcpConnector: nonOwningMcpConnector(ctx.mcpConnection) } : {}
+	};
+	if (!explicit || explicit.length === 0) return {};
+	if (ctx.mcpConnection === void 0) return {};
+	const wanted = new Set(explicit);
+	const tools = {};
+	for (const [key, t] of Object.entries(ctx.mcpConnection.tools)) if (wanted.has(t.spec.name)) tools[key] = t;
+	const surviving = Object.keys(tools);
+	if (surviving.length === 0) return {};
+	const servers = ctx.mcpServers ?? [];
+	const keepServers = new Set(surviving.map((name) => deriveMcpToolMeta(name, servers).server));
+	const instructions = ctx.mcpConnection.instructions;
+	const filteredInstructions = instructions ? new Map([...instructions].filter(([name]) => keepServers.has(name))) : void 0;
+	return {
+		...ctx.mcpServers !== void 0 ? { mcpServers: ctx.mcpServers } : {},
+		mcpConnector: nonOwningMcpConnector({
+			tools,
+			...filteredInstructions !== void 0 && filteredInstructions.size > 0 ? { instructions: filteredInstructions } : {}
+		})
+	};
+}
+/**
+* Render the per-type descriptions into a single schema-field
+* description string the model reads when choosing a `subagent_type`.
+* Falls back to a generic line when the host didn't supply any per-type
+* descriptions.
+*/
+function buildSubagentTypeDescription(registry) {
+	const lines = [];
+	let hasAny = false;
+	for (const [key, def] of Object.entries(registry)) if (def.description) {
+		lines.push(`- "${key}": ${def.description}`);
+		hasAny = true;
+	} else lines.push(`- "${key}"`);
+	lines.push("- \"general-purpose\": no specialization; uses the spawn tool's default config.");
+	if (!hasAny) return `Optional subagent preset. One of: ${lines.map((l) => l.replace(/^- /, "").replace(/:.*$/, "")).join(", ")}.`;
+	return `Optional subagent preset that overlays the spawn tool's defaults.\n${lines.join("\n")}`;
+}
+/**
+* Build the `model` field's description: delegation doctrine plus either
+* the embedded catalog (small) or a pointer at `model_search` (large).
+*/
+function buildModelFieldDescription(catalog) {
+	const doctrine = "Optional model id to run the child on. Cost-tier your delegation: mechanical, parallelizable, or high-volume search work suits cheaper/faster models; keep synthesis and final judgment on your own model. Omit to inherit your model.";
+	if (catalog.length <= 8) return `${doctrine}\nAvailable:\n${catalog.map((e) => `- ${formatModelLine(e)}`).join("\n")}`;
+	return `${doctrine}\n${catalog.length} models are available: call \`model_search\` to browse ids, pricing, and context windows.`;
+}
+/**
+* Resolve a catalog entry's `Provider.name` against the run's provider
+* list: the active provider first, then the fallback-chain providers
+* (`ToolContext.providers`, populated by the loop for multi-provider
+* runs). `undefined` when no instance with that name serves this run.
+*/
+function resolveProviderByName(name, ctx) {
+	if (ctx.provider.name === name) return ctx.provider;
+	return ctx.providers?.find((p) => p.name === name);
+}
+/**
+* Race `task` (an already-running child `agent.run()` promise) against a
+* timer. Does NOT race against the parent abort signal — the child agent
+* already observes the same signal internally and handles its own aborted
+* bookkeeping, so racing here would detach the spawn from the child's
+* session-persisting finally block.
+*
+* On timeout: rejects with `SpawnTimeoutError`; caller is expected to call
+* `agent.abort()` and subsequently `await` the original `task` so the
+* child's session state (runs, turns, status) gets flushed before the
+* parent moves on.
+*/
+async function raceWithTimeout(task, timeoutMs) {
+	if (!timeoutMs || timeoutMs <= 0) return task;
+	let timer;
+	try {
+		return await new Promise((resolve, reject) => {
+			timer = setTimeout(() => reject(new SpawnTimeoutError(timeoutMs)), timeoutMs);
+			task.then(resolve, reject);
+		});
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+var SpawnTimeoutError = class extends Error {
+	timeoutMs;
+	constructor(timeoutMs) {
+		super(`Child agent timed out after ${timeoutMs}ms`);
+		this.name = "SpawnTimeoutError";
+		this.timeoutMs = timeoutMs;
+	}
+};
+//#endregion
+//#region src/tool-state.ts
+/**
+* Durable key/value state for tools.
+*
+* A tool reaches this through {@link ToolContext.state} — a plain,
+* SYNCHRONOUS map view. Synchronous is not a convenience choice: under a
+* durable-execution runtime the tool body runs inside a journaled action
+* (Restate's `ctx.run`), and a durable read (`ctx.get`) is illegal in
+* there. So the flow is split into three phases the runtime can journal
+* independently:
+*
+*   1. **hydrate** — load the snapshot ONCE per agent, outside any
+*      journaled action, before the first tool dispatch.
+*   2. **stage** — the tool mutates its per-call view. Mutations are
+*      recorded as an ordered {@link ToolStateOp} list, NOT written
+*      through: they're plain data, so a durable adapter can journal them
+*      alongside the tool result.
+*   3. **commit** — the loop applies the staged ops through
+*      {@link ToolStateStore.commit} after the call settles, outside the
+*      journaled action.
+*
+* The invariant that makes this replay-safe:
+*
+* > A staged mutation is committed only if it came back OUT of a journal
+* > entry.
+*
+* A durable adapter (see `restateTool`) reads {@link StagedToolState.pending}
+* from inside its journaled closure, ships the ops out as part of the
+* journaled value, and calls {@link StagedToolState.restore} outside it. On
+* replay the tool body never runs, so nothing is staged live — `restore`
+* re-seeds the exact same ops from the journal and the commit re-issues an
+* identical write. Paths that produced no journal entry (a fatal error, a
+* control abort, a dead attempt) call {@link StagedToolState.clear} so live
+* mutations from an attempt nobody recorded can never reach the store.
+*
+* The store seam is deliberately runtime-agnostic: `zidane/restate` ships
+* `restateToolStateStore`, but a Redis / Postgres / file-backed
+* implementation is the same two methods. With no store configured the
+* controller is in-memory only — `ctx.state` still works everywhere
+* (local CLI, tests, subagents), it just doesn't outlive the process.
+*/
+/**
+* Default per-value size budget: 64 KiB of JSON.
+*
+* Deliberately far below any backend's hard ceiling (Restate's journal-entry
+* limit is 32 MiB) because this is a design guard, not a protocol limit.
+* Durable tool state is for flags, ids, counters, and cursors; a value that
+* doesn't fit in 64 KiB is a payload, and payloads belong in the tool result
+* or in storage the tool owns. Raise it on the store if you disagree — but
+* know that everything here is rewritten on every commit.
+*/
+const DEFAULT_MAX_VALUE_BYTES = 65536;
+/** Brand so {@link stagedToolState} can recognise views this module made. */
+const STAGED = Symbol("zidane.toolState.staged");
+/**
+* Resolve the staging handle behind a view. Returns `undefined` for a
+* missing view or a foreign implementation (a host that supplied its own
+* `ToolStateView`), which lets adapters degrade to "no durable staging"
+* instead of throwing.
+*/
+function stagedToolState(view) {
+	if (!view) return void 0;
+	return view[STAGED] ?? void 0;
+}
+function createToolStateController(store) {
+	const snapshot = /* @__PURE__ */ new Map();
+	const views = /* @__PURE__ */ new Map();
+	const maxValueBytes = store?.maxValueBytes ?? 65536;
+	let hydrated;
+	const hydrate = () => {
+		if (hydrated) return hydrated;
+		hydrated = (async () => {
+			if (!store) return;
+			const loaded = await store.load();
+			for (const [key, value] of Object.entries(loaded ?? {})) if (!snapshot.has(key)) snapshot.set(key, value);
+		})().catch((err) => {
+			hydrated = void 0;
+			throw err;
+		});
+		return hydrated;
+	};
+	const begin = (callId) => {
+		const existing = views.get(callId);
+		if (existing) return existing;
+		const view = createStagingView(snapshot, maxValueBytes);
+		views.set(callId, view);
+		return view;
+	};
+	const commit = async (callId) => {
+		const view = views.get(callId);
+		if (!view) return;
+		views.delete(callId);
+		const ops = view[STAGED].pending();
+		if (ops.length === 0) return;
+		await store?.commit(ops);
+		applyOps(snapshot, ops);
+	};
+	return {
+		hydrate,
+		begin,
+		commit,
+		discard: (callId) => {
+			views.delete(callId);
+		},
+		pending: (callId) => views.get(callId)?.[STAGED].pending() ?? [],
+		snapshot: () => Object.fromEntries(snapshot),
+		committed: {
+			get: (key) => snapshot.get(key),
+			has: (key) => snapshot.has(key),
+			keys: () => [...snapshot.keys()].sort()
+		}
+	};
+}
+/**
+* Build a view over `snapshot` that records writes instead of applying
+* them. Reads layer staged ops on top of the snapshot so a tool sees its
+* own writes back — including deletions, which read as absent.
+*/
+function createStagingView(snapshot, maxValueBytes) {
+	let ops = [];
+	const latest = /* @__PURE__ */ new Map();
+	const stage = (op) => {
+		ops.push(op);
+		latest.set(op.key, op);
+	};
+	const resolve = (key) => {
+		const staged = latest.get(key);
+		if (staged) return staged.delete === true ? { present: false } : {
+			present: true,
+			value: staged.value
+		};
+		return snapshot.has(key) ? {
+			present: true,
+			value: snapshot.get(key)
+		} : { present: false };
+	};
+	const view = {
+		get: (key) => {
+			const resolved = resolve(key);
+			return resolved.present ? resolved.value : void 0;
+		},
+		set: (key, value) => {
+			assertStorable(key, value, maxValueBytes);
+			if (value === void 0) stage({
+				key,
+				delete: true
+			});
+			else stage({
+				key,
+				value
+			});
+		},
+		delete: (key) => {
+			stage({
+				key,
+				delete: true
+			});
+		},
+		has: (key) => resolve(key).present,
+		keys: () => {
+			const keys = new Set(snapshot.keys());
+			for (const [key, op] of latest) if (op.delete === true) keys.delete(key);
+			else keys.add(key);
+			return [...keys].sort();
+		},
+		[STAGED]: {
+			pending: () => [...ops],
+			restore: (restored) => {
+				ops = [...restored];
+				latest.clear();
+				for (const op of ops) latest.set(op.key, op);
+			},
+			clear: () => {
+				ops = [];
+				latest.clear();
+			}
+		}
+	};
+	Object.defineProperty(view, STAGED, {
+		value: view[STAGED],
+		enumerable: false
+	});
+	return view;
+}
+/**
+* Reject a value that can't survive the trip to the store, at the moment the
+* tool stages it.
+*
+* Scalars are skipped: they're bounded, and paying a `JSON.stringify` per
+* `set` on a hot tool would be a real cost for no signal. Strings and objects
+* are measured in UTF-8 bytes, which is what both the journal and the store
+* actually spend.
+*/
+function assertStorable(key, value, maxValueBytes) {
+	if (value === void 0 || value === null || typeof value === "boolean" || typeof value === "number") return;
+	if (typeof value === "function" || typeof value === "symbol" || typeof value === "bigint") throw new TypeError(`tool state value for "${key}" is a ${typeof value}, which a durable store can't hold. Use a JSON-serializable value.`);
+	let json;
+	try {
+		json = typeof value === "string" ? value : JSON.stringify(value) ?? "";
+	} catch (err) {
+		throw new TypeError(`tool state value for "${key}" is not JSON-serializable (${err instanceof Error ? err.message : String(err)}). Durable tool state crosses a journal, so cycles and exotic values can't be stored.`);
+	}
+	const bytes = Buffer.byteLength(json, "utf8");
+	if (bytes > maxValueBytes) throw new RangeError(`tool state value for "${key}" is ${formatBytes(bytes)}, over the ${formatBytes(maxValueBytes)} limit. Durable tool state is for flags, ids, counters, and cursors. It is rewritten on every commit and crosses a journal entry. Keep the payload in the tool result or in storage the tool owns, and store a reference here.`);
+}
+/** Apply ops to a snapshot map in order — last write per key wins. */
+function applyOps(snapshot, ops) {
+	for (const op of ops) if (op.delete === true) snapshot.delete(op.key);
+	else snapshot.set(op.key, op.value);
+}
+/** Runtime guard for a journaled op list — adapters validate before restoring. */
+function isToolStateOps(value) {
+	return Array.isArray(value) && value.every((op) => typeof op === "object" && op !== null && typeof op.key === "string" && (op.delete === true || "value" in op));
+}
+//#endregion
+export { hydrateReadStateFromSessionAsync as C, resolveReadStateMap as D, readStateKey as E, staleRefusalHint as O, hydrateReadStateFromSession as S, noteStaleRejection as T, formatModelLine as _, SpawnTimeoutError as a, getToolDedupState as b, childRunsOf as c, filterToolsForSubagent as d, inheritedMcpForSubagent as f, createModelSearchTool as g, resolveProviderByName as h, stagedToolState as i, describeChildRuns as l, reserveChildLabel as m, createToolStateController as n, buildModelFieldDescription as o, raceWithTimeout as p, isToolStateOps as r, buildSubagentTypeDescription as s, DEFAULT_MAX_VALUE_BYTES as t, extractText as u, matchModelEntries as v, markReadStateElided as w, hashContent as x, getReadState as y };
+
+//# sourceMappingURL=tool-state-Dku6YqAB.js.map