zidane 9.1.1 → 9.1.4

package/dist/{types-bDQagoiL.d.ts → types-2HrgolQz.d.ts}

@@ -404,6 +404,19 @@ interface ContextMount {
 }
 /** Kind of execution context: `process`, `docker` or `sandbox`. */
 type ContextType = 'process' | 'docker' | 'sandbox';
+/** Options of {@link ExecutionContext.exec}. */
+interface ExecOptions {
+  /** Folder to run in, resolved against the handle's. Default: the handle's folder. */
+  cwd?: string;
+  /** Variables added to the command's environment. */
+  env?: Record<string, string>;
+  /** Seconds. Default 30. */
+  timeout?: number;
+  /** Kills the command (its whole process group, in the process context) when aborted. */
+  signal?: AbortSignal;
+  /** Output as it arrives, decoded per stream. A chunk can end mid-line. */
+  onOutput?: (stream: 'stdout' | 'stderr', text: string) => void;
+}
 /** An environment where an agent runs commands and reads and writes files: the host process, a Docker container or a remote sandbox. */
 interface ExecutionContext {
   /** Context type identifier */
@@ -433,13 +446,12 @@ interface ExecutionContext {
    * with coreutils `timeout`, sandbox SDKs take seconds/ms per their API).
    * Documented here because the unit is invisible at call sites and a
    * caller assuming milliseconds would set an instant-kill timeout.
+   *
+   * `onOutput` hears the output as it arrives, decoded, before the result
+   * settles (a UI showing a running command). Optional for implementations:
+   * one that cannot stream calls it never, and the result is the same.
    */
-  exec: (handle: ExecutionHandle, command: string, options?: {
-    cwd?: string;
-    env?: Record<string, string>;
-    timeout?: number;
-    signal?: AbortSignal;
-  }) => Promise<ExecResult>;
+  exec: (handle: ExecutionHandle, command: string, options?: ExecOptions) => Promise<ExecResult>;
   /**
    * Start a process in the background. Settles as soon as `spawn` returns
    * — does NOT wait for the child to exit. Stdout + stderr stream
@@ -951,5 +963,5 @@ interface TaskStallInfo {
   bytesWritten: number;
 }
 //#endregion
-export { resolveWritableRootsAsync as A, TerminalProcess as C, isolationAvailability as D, IsolationPolicy as E, parseAllowWriteSetting as O, TerminalOptions as S, IsolationBackend as T, StreamHandle as _, ContextMount as a, TaskHandle as b, EntryKind as c, ExecutionContext as d, ExecutionHandle as f, SpawnConfig as g, ListFilesOptions as h, ContextHardening as i, resolveWritableRoots as k, EntryPort as l, ListFilesEntry as m, BackgroundTerminalOptions as n, ContextType as o, ListFileMetadata as p, ContextCapabilities as r, DetachedTasksCapability as s, BackgroundTaskStatus as t, ExecResult as u, TaskEntry as v, resolveDetachedTasksCapability as w, TaskStallInfo as x, TaskExitInfo as y };
-//# sourceMappingURL=types-bDQagoiL.d.ts.map
+export { resolveWritableRoots as A, TerminalOptions as C, IsolationPolicy as D, IsolationBackend as E, isolationAvailability as O, TaskStallInfo as S, resolveDetachedTasksCapability as T, SpawnConfig as _, ContextMount as a, TaskExitInfo as b, EntryKind as c, ExecResult as d, ExecutionContext as f, ListFilesOptions as g, ListFilesEntry as h, ContextHardening as i, resolveWritableRootsAsync as j, parseAllowWriteSetting as k, EntryPort as l, ListFileMetadata as m, BackgroundTerminalOptions as n, ContextType as o, ExecutionHandle as p, ContextCapabilities as r, DetachedTasksCapability as s, BackgroundTaskStatus as t, ExecOptions as u, StreamHandle as v, TerminalProcess as w, TaskHandle as x, TaskEntry as y };
+//# sourceMappingURL=types-2HrgolQz.d.ts.map

package/dist/types-2HrgolQz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-2HrgolQz.d.ts","names":[],"sources":["../src/contexts/isolation.ts","../src/contexts/types.ts"],"mappings":";;;UAoCiB;;;;;;;EAOf;;;;;;;EAOA;;;;;EAKA;;;KAIU;KA2CA;EAA0B;EAAU,SAAS;EAAkB;;EAAyB;EAAW;;;;;;;;;;;iBAgC/F,sBACd,WAAU,OAAO,UACjB,MAAK,OAAO,aACX;;;;;;;;;;iBAqCa,uBAAuB,aAAa,aAAa;UAuDhD;;EAEf;EACA,MAAM,OAAO;EACb,WAAW,OAAO;;;;;;EAMlB,gBAAgB;;;;;;;;;;iBAiFF,qBAAqB,aAAa,UAAS;;;;;;iBAUrC,0BACpB,aACA,UAAS,KAAK;EAAiD,gBAAgB,gBAAgB;IAC9F;;;;;;;;;;;;;;;;;;KC9SS;;UAGK;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;;;;;;EAWA;;;;;;;;EAQA;;;;;;;EAOA,gBAAgB;;;;;;;;iBASF,+BAA+B,SAAS,mBAAmB;;UAU1D;;EAEf;;EAEA,MAAM;;EAEN;;;UAQe;;EAEf;;EAEA;;EAEA;;;KAIU;;;;;;;UAQK;;EAEf,OAAO,iBAAiB,QAAQ;;EAEhC,OAAO,iBAAiB;;EAExB,QAAQ,iBAAiB;;EAEzB,QAAQ,cAAc,OAAO,eAAe;;EAE5C,OAAO,cAAc,eAAe;;EAEpC,OAAO,cAAc,eAAe;;EAEpC,SAAS,iBAAiB;;EAE1B,YAAY,cAAc,kBAAkB;;;UAI7B;;EAEf;;EAEA;;EAEA;;;KAIU,0BAA0B;;UAGrB;;EAEf;;EAEA;;EAEA;;;;;;EAMA;;EAEA,SAAS;;;UAQM;;EAEf;;;;;;;;;;;;EAYA;;EAEA,MAAM;;;;;;;;;;;EAWN;;;;;;;;;;;;;;;;EAgBA,YAAY;;;;;;EAMZ;;EAEA;;EAEA;;EAEA,SAAS;;EAET;;IAEE;;IAEA;;;;;;IAMA;;;EAGF;IACE;IACA;;;;;;IAMA;KACC;;;;;;;;;;EAWH;;;;;;;;;EAUA,QAAQ;IAAQ;IAAmB;IAAe;;;;;;;;;;;EAWlD;;;;;;;;EASA;;;;;;;;EASA,SAAS;;;;;;;;;;EAWT,YAAY;;;;;;;UAQG;;;;;;EAMf;;;;;EAKA;;;;;EAKA;;;;;EAKA;;;UAIe;;EAEf;;EAEA;;EAEA;;;;;;;EAOA;;;KAQU;;UAGK;;EAEf;;EAEA,MAAM;;EAEN;;EAEA,SAAS;;EAET,YAAY,6BAA6B;;;UAI1B;;WAEN,MAAM;;WAGN,cAAc;;EAGvB,QAAQ,SAAS,gBAAgB,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BzC,OAAO,QAAQ,iBAAiB,iBAAiB,UAAU,gBAAgB,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+BnF,kBACE,QAAQ,iBACR,iBACA;IACE;IACA,MAAM;;;;;;;;IAQN;;IAEA,UAAU,MAAM;;;;;;;IAOhB;;;;;;;;IAQA;;IAEA,WAAW,MAAM;;;;;;IAMjB,WAAW;QAEV,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+Cb,cACE,QAAQ,iBACR,iBACA;IACE;IACA,MAAM;;IAEN,SAAS;QAER,QAAQ;;;;;;;;;;;;EAab,gBAAgB,QAAQ,iBAAiB,SAAS,oBAAoB,QAAQ;;;;;;;EAQ9E,qBAAqB,QAAQ,iBAAiB,YAAY,SAAS,oBAAoB,QAAQ;;;;;;;;;;;EAY/F,kBACE,QAAQ,iBACR,mBACG,QAAQ;;;;;;EAOb,kBACE,QAAQ,oBACL,iBAAiB;;;;;;;;;;;;;;;;;;EAmBtB,kBACE,QAAQ,iBACR,gBACA;IAAY;IAAoB,SAAS;QACtC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCb,2BACE,YAAY,iBACZ,UAAU,iBACV,aAAa,MAAM,uBACnB,cAAc,MAAM,2BACjB,iBAAiB;;EAGtB,WAAW,QAAQ,iBAAiB,iBAAiB;;;;;;;;;;;EAYrD,kBAAkB,QAAQ,iBAAiB,iBAAiB,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCpE,YAAY,QAAQ,iBAAiB,iBAAiB;;;;;;;;EAStD,YAAY,QAAQ,iBAAiB,cAAc,kBAAkB,QAAQ,WAAW,mBAAmB;;;;;;;;;;;EAY3G,YAAY,QAAQ,iBAAiB,cAAc,UAAU,qBAAqB,QAAQ;;;;;;;;;EAU1F,WAAW,QAAQ,oBAAoB;;;;;;;;;;EAWvC,iBAAiB,QAAQ,iBAAiB,0BAA0B;;EAGpE,UAAU,QAAQ,oBAAoB;;;UAQvB;;EAEf;;EAEA;;EAEA;;EAEA,MAAM;;EAEN;;EAEA,SAAS,MAAM;;;UAIA;;EAEf;;EAEA;;EAEA;EACA,QAAQ,eAAe;EACvB,SAAS,cAAc;;EAEvB,YAAY;;EAEZ,cAAc;;EAEd,QAAQ;;;;;;;;;UAUO;EACf;EACA;;EAEA,SAAS,MAAM;;EAEf,WAAW;IAAM,QAAQ,eAAe;IAAqB,SAAS,cAAc;;;;;;;;;;;;;KAa1E;;;;;;;;;UAUK;;;;;;;EAOf;;EAEA;;EAEA;;EAEA;;;;;;;;;;;;;UAce;;EAEf;;;;;;;;;;;;;;;;;;;;;;EAsBA,QAAQ,cAAc;;;;;;;;EAQtB,SAAS,cAAc;;EAEvB,QAAQ,MAAM,eAAe;;EAE7B,YAAY;;;;;EAKZ,QAAQ;;;;;;;;;;;;UAaO;;EAEf;;EAEA,QAAQ,QAAQ;;EAEhB;;EAEA,SAAS,OAAO;;EAEhB;;EAEA;;EAEA;;;;;;;UAQe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;EAMA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA,SAAS,OAAO;;EAEhB;;;;;;;;UASe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA"}

package/dist/types-4q1bFG53.js

@@ -0,0 +1,122 @@
+//#region src/contexts/ansi-strip.ts
+/** Parser states: plain text, after ESC, in a CSI, in an OSC/DCS string, after ESC inside one. */
+const State = {
+	Text: 0,
+	Esc: 1,
+	Csi: 2,
+	Str: 3,
+	StrEsc: 4
+};
+/** Runs of plain text at least this long are appended in one slice; shorter ones char by char, which is cheaper for them. */
+const SLICE_MIN = 4;
+/** Printable text, appended to the line as is: tab, or neither a control (C0, DEL, C1) nor ESC. */
+const isPlain = (code) => code === 9 || code >= 32 && (code < 127 || code >= 160);
+function createAnsiStripper(options = {}) {
+	let state = State.Text;
+	/** Body of the OSC / DCS / APC string being read; OSC only is kept. */
+	let str = "";
+	let strIsOsc = false;
+	let line = "";
+	/** A `\r` arrived; the next printable rewinds the line unless `\n` follows. */
+	let pendingCr = false;
+	/** Part of the current line was handed out by `takePartial`: a rewind must start a new line. */
+	let taken = false;
+	const endString = () => {
+		if (strIsOsc && options.onTitle) {
+			const semi = str.indexOf(";");
+			const code = semi === -1 ? str : str.slice(0, semi);
+			if ((code === "0" || code === "2") && semi !== -1) options.onTitle(str.slice(semi + 1));
+		}
+		str = "";
+		state = State.Text;
+	};
+	return {
+		push(chunk) {
+			let out = "";
+			for (let i = 0; i < chunk.length; i++) {
+				const ch = chunk[i];
+				const code = ch.charCodeAt(0);
+				switch (state) {
+					case State.Text:
+						if (code === 27) state = State.Esc;
+						else if (ch === "\n") {
+							out += `${line}\n`;
+							line = "";
+							pendingCr = false;
+							taken = false;
+						} else if (ch === "\r") pendingCr = true;
+						else if (code === 8) line = line.slice(0, -1);
+						else if (code === 155) state = State.Csi;
+						else if (code === 157) {
+							state = State.Str;
+							strIsOsc = true;
+						} else if (ch === "	" || code >= 32) {
+							if (code >= 127 && code < 160) break;
+							if (pendingCr) {
+								if (taken) out += "\n";
+								taken = false;
+								line = "";
+								pendingCr = false;
+							}
+							let end = i + 1;
+							while (end < chunk.length && isPlain(chunk.charCodeAt(end))) end++;
+							if (end - i < SLICE_MIN) for (let k = i; k < end; k++) line += chunk[k];
+							else line += chunk.slice(i, end);
+							i = end - 1;
+						}
+						break;
+					case State.Esc:
+						if (ch === "[") state = State.Csi;
+						else if (ch === "]" || ch === "P" || ch === "X" || ch === "^" || ch === "_") {
+							state = State.Str;
+							strIsOsc = ch === "]";
+							str = "";
+						} else if (code >= 32 && code <= 47) {} else state = State.Text;
+						break;
+					case State.Csi:
+						if (code >= 64 && code <= 126) state = State.Text;
+						break;
+					case State.Str:
+						if (code === 7) endString();
+						else if (code === 27) state = State.StrEsc;
+						else if (code === 156) endString();
+						else if (str.length < 4096) str += ch;
+						break;
+					case State.StrEsc: if (ch === "\\") endString();
+					else {
+						str += `\x1B${ch}`;
+						state = State.Str;
+					}
+				}
+			}
+			return out;
+		},
+		partial: () => line,
+		takePartial() {
+			const text = line;
+			if (text) taken = true;
+			line = "";
+			return text;
+		}
+	};
+}
+/** One-shot convenience: the plain text of a complete chunk of terminal output. */
+function stripAnsi(text) {
+	const s = createAnsiStripper();
+	return s.push(text) + s.partial();
+}
+//#endregion
+//#region src/contexts/types.ts
+/**
+* Effective {@link DetachedTasksCapability} of a context, with the
+* backward-compatible inference for contexts that predate the field.
+*
+* @param context - Execution context to inspect.
+*/
+function resolveDetachedTasksCapability(context) {
+	return context.capabilities.detachedTasks ?? (context.execBackground ? "process-lifetime" : "none");
+}
+//#endregion
+export { createAnsiStripper as n, stripAnsi as r, resolveDetachedTasksCapability as t };
+
+//# sourceMappingURL=types-4q1bFG53.js.map

package/dist/types-4q1bFG53.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-4q1bFG53.js","names":[],"sources":["../src/contexts/ansi-strip.ts","../src/contexts/types.ts"],"sourcesContent":["/**\n * Terminal output → plain text, incrementally. A PTY emits colors, cursor\n * moves, titles and carriage-return redraws; a model (or a log file) wants\n * the words. Sequences may be split across chunks, so the parser keeps its\n * state between `push` calls.\n *\n * Line semantics follow what a person sees on a terminal, roughly: `\\r\\n`\n * ends a line, a lone `\\r` rewinds it (a progress bar redraws in place, so\n * only its last state survives), backspace erases a character. Anything\n * fancier (cursor addressing in full-screen apps) is dropped, not replayed.\n */\n\nexport interface AnsiStripper {\n  /** Feed raw output; returns the lines it completed (each ends with `\\n`). */\n  push: (chunk: string) => string\n  /** The line being written, not yet ended. */\n  partial: () => string\n  /**\n   * Hand out the unfinished line and treat it as written: a later rewind\n   * starts a fresh line instead of editing text that is already out. For\n   * logs that must show a prompt waiting on the same line.\n   */\n  takePartial: () => string\n}\n\nexport interface AnsiStripperOptions {\n  /** Window title set by the program (OSC 0 / 2), e.g. the running command. */\n  onTitle?: (title: string) => void\n}\n\n/** Parser states: plain text, after ESC, in a CSI, in an OSC/DCS string, after ESC inside one. */\nconst State = { Text: 0, Esc: 1, Csi: 2, Str: 3, StrEsc: 4 } as const\n\n/** Runs of plain text at least this long are appended in one slice; shorter ones char by char, which is cheaper for them. */\nconst SLICE_MIN = 4\n\n/** Printable text, appended to the line as is: tab, or neither a control (C0, DEL, C1) nor ESC. */\nconst isPlain = (code: number) => code === 0x09 || (code >= 0x20 && (code < 0x7F || code >= 0xA0))\n\nexport function createAnsiStripper(options: AnsiStripperOptions = {}): AnsiStripper {\n  let state: (typeof State)[keyof typeof State] = State.Text\n  /** Body of the OSC / DCS / APC string being read; OSC only is kept. */\n  let str = ''\n  let strIsOsc = false\n  let line = ''\n  /** A `\\r` arrived; the next printable rewinds the line unless `\\n` follows. */\n  let pendingCr = false\n  /** Part of the current line was handed out by `takePartial`: a rewind must start a new line. */\n  let taken = false\n\n  const endString = () => {\n    if (strIsOsc && options.onTitle) {\n      const semi = str.indexOf(';')\n      const code = semi === -1 ? str : str.slice(0, semi)\n      if ((code === '0' || code === '2') && semi !== -1)\n        options.onTitle(str.slice(semi + 1))\n    }\n    str = ''\n    state = State.Text\n  }\n\n  return {\n    push(chunk) {\n      let out = ''\n      for (let i = 0; i < chunk.length; i++) {\n        const ch = chunk[i]!\n        const code = ch.charCodeAt(0)\n        switch (state) {\n          case State.Text:\n            if (code === 0x1B) {\n              state = State.Esc\n            }\n            else if (ch === '\\n') {\n              out += `${line}\\n`\n              line = ''\n              pendingCr = false\n              taken = false\n            }\n            else if (ch === '\\r') {\n              pendingCr = true\n            }\n            else if (code === 0x08) {\n              line = line.slice(0, -1)\n            }\n            else if (code === 0x9B) {\n              state = State.Csi\n            }\n            else if (code === 0x9D) {\n              state = State.Str\n              strIsOsc = true\n            }\n            else if (ch === '\\t' || code >= 0x20) {\n              if (code >= 0x7F && code < 0xA0)\n                break\n              if (pendingCr) {\n                if (taken)\n                  out += '\\n'\n                taken = false\n                line = ''\n                pendingCr = false\n              }\n              let end = i + 1\n              while (end < chunk.length && isPlain(chunk.charCodeAt(end)))\n                end++\n              if (end - i < SLICE_MIN) {\n                for (let k = i; k < end; k++) line += chunk[k]\n              }\n              else {\n                line += chunk.slice(i, end)\n              }\n              i = end - 1\n            }\n            break\n          case State.Esc:\n            if (ch === '[') {\n              state = State.Csi\n            }\n            else if (ch === ']' || ch === 'P' || ch === 'X' || ch === '^' || ch === '_') {\n              state = State.Str\n              strIsOsc = ch === ']'\n              str = ''\n            }\n            else if (code >= 0x20 && code <= 0x2F) {\n              // intermediate (e.g. `ESC ( B` charset): swallow the final byte next\n            }\n            else {\n              state = State.Text\n            }\n            break\n          case State.Csi:\n            // parameters / intermediates until a final byte in @..~\n            if (code >= 0x40 && code <= 0x7E)\n              state = State.Text\n            break\n          case State.Str:\n            if (code === 0x07) {\n              endString()\n            }\n            else if (code === 0x1B) {\n              state = State.StrEsc\n            }\n            else if (code === 0x9C) {\n              endString()\n            }\n            else if (str.length < 4096) {\n              str += ch\n            }\n            break\n          case State.StrEsc:\n            if (ch === '\\\\') {\n              endString()\n            }\n            else {\n              str += `\\x1B${ch}`\n              state = State.Str\n            }\n            break\n        }\n      }\n      return out\n    },\n    partial: () => line,\n    takePartial() {\n      const text = line\n      if (text)\n        taken = true\n      line = ''\n      return text\n    },\n  }\n}\n\n/** One-shot convenience: the plain text of a complete chunk of terminal output. */\nexport function stripAnsi(text: string): string {\n  const s = createAnsiStripper()\n  return s.push(text) + s.partial()\n}\n","/**\n * Execution context types.\n *\n * An execution context defines *where* and *how* an agent's tools run.\n * The agent loop and tools interact through this interface without knowing\n * whether they're running in-process, in a Docker container, or in a\n * remote sandbox.\n */\n\nimport type { Buffer } from 'node:buffer'\nimport type { IsolationPolicy } from './isolation'\n\n// ---------------------------------------------------------------------------\n// Capabilities\n// ---------------------------------------------------------------------------\n\n/**\n * Lifetime guarantee of background tasks started through\n * {@link ExecutionContext.execBackground}.\n *\n * - `'none'` — the context cannot detach tasks at all.\n * - `'process-lifetime'` — tasks live as long as the HOST process; a\n *   crash/restart of the host orphans or kills them (`ProcessContext`).\n * - `'durable'` — tasks live on a remote runner and survive host process\n *   death (remote execution contexts driven by durable runtimes).\n *\n * Durable-execution runtimes consult this to decide whether backgrounding\n * is safe to expose (`disableBackgroundTasks: 'non-durable'`, the default\n * in replay mode): a `'durable'` context keeps its tasks across worker\n * crashes, so there is no reason to strip the capability from the model.\n */\nexport type DetachedTasksCapability = 'none' | 'process-lifetime' | 'durable'\n\n/** Features an execution context supports. Consumers check these before relying on a feature. */\nexport interface ContextCapabilities {\n  /** Can execute shell commands */\n  shell: boolean\n  /** Can read/write files in a workspace */\n  filesystem: boolean\n  /** Can enumerate glob matches through `ExecutionContext.listFiles(..., { glob: true })`. */\n  glob?: boolean\n  /** Can make outbound network requests */\n  network: boolean\n  /** Has GPU access */\n  gpu: boolean\n  /**\n   * Can open a bidirectional byte stream to a long-lived process through\n   * {@link ExecutionContext.execStream}. Absent / `false` = the context\n   * only supports the buffered {@link ExecutionContext.exec} and (maybe)\n   * the write-to-a-log-file {@link ExecutionContext.execBackground}.\n   *\n   * Consumers that NEED live stdin (stdio MCP servers routed into the\n   * context) must check this before calling; the seam is optional so\n   * contexts backed by a request/response-only API stay valid.\n   */\n  stream?: boolean\n  /**\n   * Shell commands run under an ENFORCED OS-level sandbox (macOS Seatbelt /\n   * Linux bwrap) — see `SpawnConfig.isolation`. `false` when isolation was\n   * not requested AND when it was requested but the backend is unavailable\n   * (that context fails every command closed instead). Absent / `false` =\n   * commands do not run sandboxed.\n   */\n  isolated?: boolean\n  /**\n   * Background-task lifetime guarantee. Optional for backward\n   * compatibility — when absent, callers infer `'process-lifetime'`\n   * if the context implements `execBackground`, `'none'` otherwise\n   * (see {@link resolveDetachedTasksCapability}).\n   */\n  detachedTasks?: DetachedTasksCapability\n}\n\n/**\n * Effective {@link DetachedTasksCapability} of a context, with the\n * backward-compatible inference for contexts that predate the field.\n *\n * @param context - Execution context to inspect.\n */\nexport function resolveDetachedTasksCapability(context: ExecutionContext): DetachedTasksCapability {\n  return context.capabilities.detachedTasks\n    ?? (context.execBackground ? 'process-lifetime' : 'none')\n}\n\n// ---------------------------------------------------------------------------\n// Execution handle\n// ---------------------------------------------------------------------------\n\n/** Opaque handle to a running execution context instance */\nexport interface ExecutionHandle {\n  /** Identifier of the spawned instance, unique within its context. */\n  id: string\n  /** Type of the context that created the handle. */\n  type: ContextType\n  /** Working directory within the context */\n  cwd: string\n}\n\n// ---------------------------------------------------------------------------\n// Exec result\n// ---------------------------------------------------------------------------\n\n/** Result of a buffered command. */\nexport interface ExecResult {\n  /** Captured standard output. */\n  stdout: string\n  /** Captured standard error. */\n  stderr: string\n  /** Process exit code. `0` means success. */\n  exitCode: number\n}\n\n/** What a path is: a file (a symlink counts as one, never followed) or a folder. */\nexport type EntryKind = 'file' | 'dir'\n\n/**\n * The few file operations every entry action is built from\n * (`createEntryOps`, `zidane/chat`), paths resolved like the context's\n * other file methods. None of them overwrites: a target is checked missing\n * first, and the operations refuse one that appeared since.\n */\nexport interface EntryPort {\n  /** What `path` is, `null` when nothing is there. Never follows a final symlink. */\n  stat: (path: string) => Promise<EntryKind | null>\n  /** The names in folder `path`. */\n  list: (path: string) => Promise<string[]>\n  /** Creates folder `path` and its missing parents. */\n  mkdir: (path: string) => Promise<void>\n  /** Writes a new file (its folder exists). */\n  write: (path: string, bytes: Uint8Array) => Promise<void>\n  /** Renames `from` to `to` (missing; its folder exists). */\n  move: (from: string, to: string) => Promise<void>\n  /** Copies `from` (a folder whole, symlinks as links) to `to` (missing; its folder exists). */\n  copy: (from: string, to: string) => Promise<void>\n  /** Removes `path` (a folder whole). */\n  remove: (path: string) => Promise<void>\n  /** Empty folders under folder `path` (`.git` and `node_modules` skipped), relative to it, at most `limit`. */\n  emptyDirs: (path: string, limit: number) => Promise<string[]>\n}\n\n/** A listed file with optional metadata. */\nexport interface ListFileMetadata {\n  /** Path of the file. */\n  path: string\n  /** Size in bytes. */\n  size?: number\n  /** Last modification time, in milliseconds since the epoch. */\n  mtimeMs?: number\n}\n\n/** One listing entry: a plain path, or a {@link ListFileMetadata} object when metadata was requested. */\nexport type ListFilesEntry = string | ListFileMetadata\n\n/** Options for {@link ExecutionContext.listFiles}. */\nexport interface ListFilesOptions {\n  /** Treat `path` as a glob match pattern instead of a literal directory path. */\n  glob?: boolean\n  /** Maximum number of entries to return. */\n  limit?: number\n  /** Return {@link ListFileMetadata} objects instead of plain paths. */\n  metadata?: boolean\n  /**\n   * Skip git-ignored files when globbing. Default `true`. Contexts that can\n   * resolve git's ignore rules (e.g. the local process context) honor it; the\n   * rest treat it as a no-op. Set `false` to match every file, ignored or not.\n   */\n  gitignore?: boolean\n  /** Abort the listing early — forwarded from the calling tool's `ctx.signal`. */\n  signal?: AbortSignal\n}\n\n// ---------------------------------------------------------------------------\n// Spawn config\n// ---------------------------------------------------------------------------\n\n/** Configuration for {@link ExecutionContext.spawn}. Not every context honors every field. */\nexport interface SpawnConfig {\n  /** Working directory (created if it doesn't exist) */\n  cwd?: string\n  /**\n   * Optional workspace-containment root for the file methods (`readFile`,\n   * `writeFile`, `listFiles`) of the process context.\n   *\n   * When set, a resolved path that escapes this root (via absolute path,\n   * `..`, or a symlink pointing outside) is rejected before any I/O. Default\n   * unset = no containment (back-compat; the agent can read/write anywhere\n   * the host process can). Set this for untrusted workloads to confine file\n   * tools to a directory. Shell commands are not covered — use a sandbox /\n   * docker context for full isolation.\n   */\n  workspaceRoot?: string\n  /** Environment variables */\n  env?: Record<string, string>\n  /**\n   * Whether spawned shells inherit the parent `process.env` (process context).\n   *\n   * Default `true` (preserves existing behavior — children see the parent\n   * environment including anything Bun auto-loaded from `.env`). Set `false`\n   * for untrusted workloads so secrets in the parent environment aren't\n   * readable by tool commands; only `env` / per-call env plus a minimal base\n   * (`PATH`, `HOME`, `SHELL`, `LANG`, `LC_ALL`, `USER`, `TERM`, `TMPDIR`) are\n   * passed through.\n   */\n  inheritEnv?: boolean\n  /**\n   * OS-level sandboxing of shell commands (process context only). When set,\n   * every `exec` / `execStream` / `execBackground` runs `/bin/sh -c` under\n   * macOS `sandbox-exec` or Linux `bwrap`: filesystem writes are limited to\n   * `writableRoots`, credential directories are hidden, and network is\n   * `allow`ed or `deny`ed as a whole. `writeFile` applies the same\n   * `writableRoots` check in-process (reads are unrestricted — this is the\n   * Claude Code / Codex boundary, not a full jail; use `workspaceRoot` for\n   * read containment).\n   *\n   * Fails closed: when the backend is unavailable on the host, every command\n   * returns exit 127 with the reason instead of running unsandboxed.\n   *\n   * Build the policy with `resolveWritableRoots` from `contexts/isolation`.\n   */\n  isolation?: IsolationPolicy\n  /**\n   * The session this context runs commands for (process context only): each\n   * command it starts (`exec`, `execStream`, `execBackground`) is recorded in\n   * the session-process registry (`listSessionProcesses`) while it runs.\n   */\n  sessionId?: string\n  /** Docker image (only for 'docker' context) */\n  image?: string\n  /** Docker container name prefix (only for 'docker' context) */\n  name?: string\n  /** Host paths mounted into the context (only for 'docker' context today) */\n  mounts?: ContextMount[]\n  /** Resource limits */\n  limits?: {\n    /** Memory limit in MB */\n    memory?: number\n    /** CPU limit (e.g. '1.0' = 1 core) */\n    cpu?: string\n    /**\n     * Timeout in seconds. The process and docker contexts use it as the\n     * default for each `exec` call that passes no `timeout`. The e2b\n     * context uses it as the sandbox lifetime.\n     */\n    timeout?: number\n  }\n  /** Sandbox provider config (only for 'sandbox' context) */\n  sandbox?: {\n    provider: string\n    apiKey?: string\n    /**\n     * Attach to a pre-existing sandbox by id rather than creating one\n     * (provider-specific; E2B maps it to `Sandbox.connect`). The provider\n     * leaves a connected sandbox running on teardown.\n     */\n    sandboxId?: string\n    [key: string]: unknown\n  }\n\n  /**\n   * How long `destroy()` waits for a SIGTERM'd background task to settle\n   * before escalating to SIGKILL and abandoning the wait (process context\n   * only). Bounds `agent.destroy()` against tasks that trap SIGTERM or\n   * whose stdio pipes are held open by escaped grandchildren.\n   *\n   * Default: `5000`.\n   */\n  destroyGraceMs?: number\n\n  /**\n   * Publish container ports on the host (docker context only).\n   *\n   * Each entry maps a container port to either an explicit host port or\n   * (when `host` is omitted) a Docker-assigned random port. Retrieve the\n   * actual host port at runtime via `getMappedPort(handle, containerPort)`\n   * on the docker context.\n   */\n  ports?: Array<{ container: number, host?: number, proto?: 'tcp' | 'udp' }>\n\n  /**\n   * UID/GID the container should run as (docker context only).\n   *\n   * Accepts the same forms Docker's `--user` does: `uid`, `uid:gid`, or a\n   * named user that exists in the image. Default is the image's default\n   * user (typically root). Setting this to the host user's `uid:gid`\n   * avoids the EACCES-on-cleanup problem when sharing a workspace via\n   * a `shared` mount.\n   */\n  user?: string\n\n  /**\n   * User-defined Docker network to join (docker context only).\n   *\n   * Defaults to Docker's default bridge. Use a user network when you\n   * need multiple sibling containers (e.g. agent + database + dev\n   * server) to discover each other by name.\n   */\n  network?: string\n\n  /**\n   * Docker labels to attach to the container (docker context only).\n   *\n   * Useful for ownership tracking — callers can sweep abandoned\n   * containers (e.g. from a crashed parent process) by filtering on\n   * a label they own: `docker ps -aq --filter label=my-app=true`.\n   */\n  labels?: Record<string, string>\n\n  /**\n   * Container hardening options (docker context only).\n   *\n   * All fields are opt-in and OFF by default to preserve existing behavior\n   * (containers run with the image's default user/capabilities). Enable them\n   * for untrusted workloads. `dropAllCapabilities` and a non-root `user`\n   * (see {@link SpawnConfig.user}) can break images that expect root or\n   * specific capabilities, so they are not applied unless requested.\n   */\n  hardening?: ContextHardening\n}\n\n/**\n * Opt-in container hardening for the docker context. Every field defaults to\n * \"unset\" so an omitted `hardening` (or omitted field) leaves the container\n * unrestricted.\n */\nexport interface ContextHardening {\n  /**\n   * Drop all Linux capabilities (`CapDrop: ['ALL']`). Strong isolation, but\n   * breaks images needing capabilities (e.g. binding low ports, `ping`).\n   * Default: `false`.\n   */\n  dropAllCapabilities?: boolean\n  /**\n   * Set `no-new-privileges` so processes can't gain privileges via setuid\n   * binaries. Low blast radius; safe for most workloads. Default: `false`.\n   */\n  noNewPrivileges?: boolean\n  /**\n   * Mount the container root filesystem read-only. Pair with writable mounts\n   * for scratch space. Default: `false`.\n   */\n  readonlyRootfs?: boolean\n  /**\n   * Max number of processes (`PidsLimit`) — caps fork-bombs. Default: unset\n   * (no limit). A few hundred is usually plenty for an agent sandbox.\n   */\n  pidsLimit?: number\n}\n\n/** A host directory bind-mounted into an execution context. */\nexport interface ContextMount {\n  /** Absolute host path to mount. */\n  source: string\n  /** Absolute path inside the execution context. */\n  target: string\n  /** Mount read-only. Defaults to false for Docker's native bind behavior. */\n  readonly?: boolean\n  /**\n   * Apply the SELinux shared label (`:z`) so the host user and the container\n   * user can both read/write the mount (docker context only). No-op on\n   * non-SELinux hosts. Combine with `SpawnConfig.user` to avoid root-owned\n   * files leaking onto the host. Mutually exclusive with `readonly`.\n   */\n  shared?: boolean\n}\n\n// ---------------------------------------------------------------------------\n// Execution context interface\n// ---------------------------------------------------------------------------\n\n/** Kind of execution context: `process`, `docker` or `sandbox`. */\nexport type ContextType = 'process' | 'docker' | 'sandbox'\n\n/** Options of {@link ExecutionContext.exec}. */\nexport interface ExecOptions {\n  /** Folder to run in, resolved against the handle's. Default: the handle's folder. */\n  cwd?: string\n  /** Variables added to the command's environment. */\n  env?: Record<string, string>\n  /** Seconds. Default 30. */\n  timeout?: number\n  /** Kills the command (its whole process group, in the process context) when aborted. */\n  signal?: AbortSignal\n  /** Output as it arrives, decoded per stream. A chunk can end mid-line. */\n  onOutput?: (stream: 'stdout' | 'stderr', text: string) => void\n}\n\n/** An environment where an agent runs commands and reads and writes files: the host process, a Docker container or a remote sandbox. */\nexport interface ExecutionContext {\n  /** Context type identifier */\n  readonly type: ContextType\n\n  /** What this context supports */\n  readonly capabilities: ContextCapabilities\n\n  /** Spawn a new execution environment */\n  spawn: (config?: SpawnConfig) => Promise<ExecutionHandle>\n\n  /**\n   * Execute a shell command in the context.\n   *\n   * `signal` propagates abort all the way down to the underlying child\n   * process — the implementation is expected to wire it into whatever\n   * spawn primitive it uses so the OS receives a SIGTERM (or equivalent)\n   * when the caller aborts. Without it, a cancelled tool returns its\n   * cancellation marker to the model but the underlying process keeps\n   * running in the background, orphaning compute / locks / IO. Pass\n   * `ctx.signal` from a tool body to inherit the per-call + run-level\n   * abort union; pass a freshly-built one for a host-driven kill.\n   *\n   * Implementations are free to ignore `signal` (the contract degrades\n   * gracefully — the process simply won't be killed), but the process\n   * context honors it.\n   *\n   * `timeout` is in SECONDS (default 30) — every\n   * implementation converts internally (process ×1000 to ms, docker wraps\n   * with coreutils `timeout`, sandbox SDKs take seconds/ms per their API).\n   * Documented here because the unit is invisible at call sites and a\n   * caller assuming milliseconds would set an instant-kill timeout.\n   *\n   * `onOutput` hears the output as it arrives, decoded, before the result\n   * settles (a UI showing a running command). Optional for implementations:\n   * one that cannot stream calls it never, and the result is the same.\n   */\n  exec: (handle: ExecutionHandle, command: string, options?: ExecOptions) => Promise<ExecResult>\n\n  /**\n   * Start a process in the background. Settles as soon as `spawn` returns\n   * — does NOT wait for the child to exit. Stdout + stderr stream\n   * interleaved to the file at the returned `outputPath`. The caller\n   * (typically the agent) reads incremental output via the regular\n   * {@link ExecutionContext.readFile} seam.\n   *\n   * Optional — contexts without background support (some remote sandboxes)\n   * just don't implement it. The shell tool surfaces a clean\n   * \"background mode is not supported in this execution context\" error\n   * when this is undefined.\n   *\n   * `onExit` is called once when the child terminates (natural, killed,\n   * or error). The same instance that called `execBackground` is the\n   * exclusive owner of the callback — it's not a multi-cast bus. Hosts\n   * wire this to the agent's pending-notification queue so the model\n   * gets a `<task-notification>` on its next turn.\n   *\n   * `onExit` is OPTIONAL: remote / durable contexts may have no legal\n   * way to push a callback from a timer back into the host (a replay\n   * journal, for instance, forbids out-of-band writes). Such contexts\n   * record the exit in their registry; the agent loop reconciles\n   * by polling {@link ExecutionContext.listBackground} at run\n   * boundaries, where a host journal wrapper is legal (the\n   * `background:reconcile` hook is the journalable seam).\n   *\n   * See `docs/RUN_IN_BACKGROUND.md` for the broader design contract\n   * (file location, replay semantics, suppression rules).\n   */\n  execBackground?: (\n    handle: ExecutionHandle,\n    command: string,\n    options: {\n      cwd?: string\n      env?: Record<string, string>\n      /**\n       * Absolute directory the context appends `<task-id>.log` to. The\n       * agent owns this path because it carries session-shaped knowledge\n       * (`<userDir>/tasks/<sessionId>/`) the context can't synthesize.\n       * Must already exist OR be creatable by the context — the\n       * implementation handles `mkdir -p` defensively.\n       */\n      outputDir: string\n      /** Push-style exit callback. Optional — see the method doc. */\n      onExit?: (info: TaskExitInfo) => void\n      /**\n       * Cap on bytes written to the output file. Beyond the cap the\n       * process KEEPS RUNNING; further output is counted but dropped,\n       * and a `<output-truncated bytes-dropped=\"N\"/>` marker is\n       * appended when the task settles. Unset / non-positive = no cap.\n       */\n      maxOutputBytes?: number\n      /**\n       * Stall watchdog: when the task produces no output for this many\n       * milliseconds, `onStall` fires ONCE (one-shot — re-arms only\n       * after fresh output arrives). The process is NOT killed; the\n       * consumer decides (typically by telling the model the task may\n       * be stuck at an interactive prompt). Unset = no watchdog.\n       */\n      stallTimeoutMs?: number\n      /** One-shot stall callback — see `stallTimeoutMs`. */\n      onStall?: (info: TaskStallInfo) => void\n      /**\n       * Run the task in a terminal — see {@link BackgroundTerminalOptions}.\n       * Contexts without terminal support ignore it and use pipes; check\n       * {@link TaskHandle.terminal} to know which one happened.\n       */\n      terminal?: BackgroundTerminalOptions\n    },\n  ) => Promise<TaskHandle>\n\n  /**\n   * Open a LIVE bidirectional byte stream to a long-lived process in the\n   * context. The third execution mode, alongside the buffered `exec`\n   * (request/response) and `execBackground` (fire-and-forget into a log\n   * file): neither of those can carry a protocol that interleaves reads\n   * and writes over the child's lifetime.\n   *\n   * Motivating consumer: stdio MCP servers. An MCP server is an ordinary\n   * process doing `fs.readFileSync` / `fs.writeFile` against whatever\n   * filesystem it was spawned on. Spawned on the host (the default — see\n   * `McpServerConfig.scope`) it sees the HOST filesystem while the agent's\n   * own tools see the context's, so the two disagree about what a path\n   * means. Routing the server through this seam puts both on the same\n   * filesystem.\n   *\n   * Optional — a context backed by a request/response-only API can't\n   * implement it. Advertise support via `capabilities.stream`; callers\n   * check that (or `execStream !== undefined`) and degrade with a clear\n   * error rather than silently falling back to a host spawn, which would\n   * reintroduce exactly the split this seam exists to close.\n   *\n   * IMPLEMENTOR CONTRACT — the shape is deliberately the SUPERSET of what\n   * the backing APIs can do, because they do not agree:\n   *\n   *   - `stdout` / `stderr` are byte streams, never pre-decoded strings.\n   *     A provider SDK that hands back `string` has already destroyed any\n   *     multibyte codepoint split across a chunk boundary; the caller\n   *     needs the raw bytes to run its own streaming decoder.\n   *   - `stderr` is OPTIONAL because a PTY-backed context physically\n   *     cannot separate it — one terminal, one stream. Such contexts\n   *     redirect the child's stderr to a file; they may then surface it\n   *     here out-of-band (the Daytona context polls that file back), but\n   *     they are not obliged to, so consumers must tolerate its absence.\n   *   - A PTY-backed context MUST also neutralise terminal semantics\n   *     before the child's first byte (echo of everything written to\n   *     stdin, `\\n`→`\\r\\n` rewriting, and the ~4096-byte canonical-mode\n   *     line cap that arbitrary protocol frames exceed). In practice:\n   *     launch through `stty raw -echo; exec <cmd> 2><file>`.\n   *   - `exited` resolves with the exit code. On a PTY the child is an\n   *     interactive shell that never exits on its own, so `kill()` is\n   *     the normal termination path, not an abnormal one.\n   *   - Providers that impose a default command timeout (E2B and Daytona\n   *     both default to 60s) MUST disable or maximise it here. A stream\n   *     opened by this method is expected to live for the whole session.\n   */\n  execStream?: (\n    handle: ExecutionHandle,\n    command: string,\n    options?: {\n      cwd?: string\n      env?: Record<string, string>\n      /** Aborts startup and kills the child once running. */\n      signal?: AbortSignal\n    },\n  ) => Promise<StreamHandle>\n\n  /**\n   * Open an interactive terminal (a PTY running the user's login shell) in\n   * the context: on the host, in the container, in the sandbox. For people,\n   * not protocols: the opposite of {@link execStream}, which defeats every\n   * terminal semantic this one keeps (echo, line editing, job control,\n   * window size).\n   *\n   * Optional: a context without a PTY primitive (or a runtime without one:\n   * the local contexts need Bun) leaves it undefined, and callers offer no\n   * terminal rather than falling back to a host shell.\n   */\n  openTerminal?: (handle: ExecutionHandle, options: TerminalOptions) => Promise<TerminalProcess>\n\n  /**\n   * Re-attach to a terminal opened earlier, by its {@link TerminalProcess.id},\n   * after the host lost the connection (daemon restart, paused sandbox).\n   * Resolves `null` when it is gone. Only contexts whose terminals outlive\n   * the host (remote sandboxes) implement it.\n   */\n  reconnectTerminal?: (handle: ExecutionHandle, id: string, options: TerminalOptions) => Promise<TerminalProcess | null>\n\n  /**\n   * SIGTERM the whole process group of a running background task.\n   * Idempotent — second call returns `null` (or the cached exit info).\n   * Resolves once the process has exited AND its output stream has\n   * been flushed + closed.\n   *\n   * `null` return on miss (unknown id, already cleaned up) so the\n   * shell_kill tool can surface a clean \"no such task\" message\n   * without throwing.\n   */\n  killBackground?: (\n    handle: ExecutionHandle,\n    taskId: string,\n  ) => Promise<TaskExitInfo | null>\n\n  /**\n   * Snapshot of every task in the context's registry — running AND\n   * terminated (entries remain until the next context destroy, so\n   * the model can still read output of exited tasks).\n   */\n  listBackground?: (\n    handle: ExecutionHandle,\n  ) => Promise<readonly TaskEntry[]>\n\n  /**\n   * Block until a background task terminates, then resolve with its\n   * exit info. Resolves immediately for already-terminated tasks.\n   *\n   * Returns `null` when:\n   *   - the task id is unknown (or owned by another handle — same\n   *     isolation contract as `killBackground`), OR\n   *   - `timeoutMs` elapsed / `signal` aborted before the task exited.\n   *\n   * Callers that need to distinguish \"unknown\" from \"still running\"\n   * should consult `listBackground` first (the `wait_task` tool does).\n   *\n   * This is the injectable wait seam for the `wait_task` tool:\n   * in-process contexts implement it on the existing `onExit`\n   * machinery; durable hosts implement it as an awakeable park\n   * (runner fires task-exit over their bridge → resolveAwakeable).\n   */\n  waitBackground?: (\n    handle: ExecutionHandle,\n    taskId: string,\n    options?: { timeoutMs?: number, signal?: AbortSignal },\n  ) => Promise<TaskExitInfo | null>\n\n  /**\n   * Transfer ownership of every still-running task from `fromHandle`\n   * to `toHandle`. Used by the spawn tool to \"promote\" a subagent's\n   * background tasks up to the parent's handle so they outlive the\n   * subagent's destroy() — matching shell semantics, where a `&`-ed\n   * command outlives the parent process.\n   *\n   * With `fromHandle === toHandle` ownership stays put and only the\n   * callbacks are rebound: a host that keeps one handle across agent\n   * rebuilds (`chat/execution-cache.ts`) hands the running tasks to the\n   * freshly built agent this way.\n   *\n   * Side effects:\n   *   - The task's `handleId` is rewritten, so subsequent\n   *     `listBackground(toHandle)` / `killBackground(toHandle, …)` /\n   *     `destroy(toHandle)` see it (and `fromHandle`-scoped operations\n   *     don't).\n   *   - When `newOnExit` / `newOnStall` are provided, the task's OWNER\n   *     callbacks are REPLACED with them. Critical: they were captured\n   *     against the spawning agent's hook bus, which is about to be\n   *     destroyed; without rewiring, the new owner never learns when the\n   *     task terminates or stalls. Pass closures that fire the new owner's\n   *     `background:exit` / `background:stall` hooks. In-flight\n   *     `killBackground` / `waitBackground` resolvers are not owner\n   *     callbacks and keep firing.\n   *\n   * Returns the entries that were actually reassigned (running tasks\n   * only; terminated ones stay where they are). Implementations that\n   * don't support reassignment can leave this undefined; the caller\n   * (spawn.ts) falls back to the current behavior of killing child\n   * tasks at subagent shutdown.\n   */\n  reassignBackgroundTasks?: (\n    fromHandle: ExecutionHandle,\n    toHandle: ExecutionHandle,\n    newOnExit?: (info: TaskExitInfo) => void,\n    newOnStall?: (info: TaskStallInfo) => void,\n  ) => Promise<readonly TaskEntry[]>\n\n  /** Read a file from the context's filesystem */\n  readFile: (handle: ExecutionHandle, path: string) => Promise<string>\n\n  /**\n   * Read a file from the context's filesystem as raw bytes.\n   *\n   * Used by `read_file` to dispatch image / binary files into the multimodal\n   * `ToolResultContent[]` route. Optional — when not implemented, the tool\n   * falls back to `base64 < path` via the `exec` seam, which works in any\n   * shell-capable context. Implementations that already have a native\n   * binary read (in-process `fs.readFile` without encoding, container API,\n   * sandbox SDK) should override for the latency win.\n   */\n  readFileBinary?: (handle: ExecutionHandle, path: string) => Promise<Uint8Array>\n\n  /**\n   * Cheap size probe for a file in the context's filesystem, in bytes.\n   * `null` = unknowable (missing file, not a regular file, probe failed,\n   * or containment rejected the path — a probe must not leak even the\n   * size of files outside the workspace root).\n   *\n   * Exists because `readFile` has no partial-read form: tools that must\n   * materialize a whole file (read_file's text path, edit/multi_edit,\n   * grep's no-rg fallback) consult this first to refuse multi-GB targets\n   * instead of OOMing the HOST — the read lands in host memory no matter\n   * where the file lives. Per-context posture:\n   *\n   *   - `process` — implements it (local stat, µs).\n   *   - `docker`  — implements it via `wc -c` through its exec; its\n   *     `readFile` gets transport headroom above the tool ceiling so\n   *     the probe (tool policy), not the 10MB exec cap, decides read\n   *     limits — same experience as every other context.\n   *   - `sandbox` (and the e2b / daytona providers behind it) —\n   *     implements it via `wc -c` through the provider's exec: one extra\n   *     round-trip per whole-read tool call, paid so a multi-GB sandbox\n   *     file is refused BEFORE the SDK transfers it into host memory.\n   *\n   * KNOWN RESIDUAL (sandbox providers): this guards the `readFile` path\n   * only. Their `exec` output is buffered inside the provider SDKs\n   * (e2b `commands.run`, daytona `executeCommand`), which we cannot cap\n   * from this side — a command that streams GBs to stdout within its\n   * timeout window can still balloon host memory. Docker doesn't share\n   * the residual (we own its transport; see `output-cap.ts`). A shell\n   * wrapper (`| head -c`) was considered and rejected: preserving exit\n   * codes, stderr separation, and timeout semantics through a pipe for\n   * EVERY command is fragile, and the timeout already time-bounds the\n   * exposure.\n   */\n  fileSize?: (handle: ExecutionHandle, path: string) => Promise<number | null>\n\n  /**\n   * Write a file to the context's filesystem.\n   *\n   * `encoding` applies only when `content` is a string (how its bytes are\n   * produced; defaults to utf-8) and is ignored for a Buffer, which is\n   * written verbatim.\n   */\n  writeFile: (handle: ExecutionHandle, path: string, content: string | Buffer, encoding?: BufferEncoding) => Promise<void>\n\n  /**\n   * List files in the context filesystem.\n   *\n   * Plain paths list immediate directory entries. Paths that\n   * contain glob metacharacters (`*`, `?`, `[]`, `{}`) request matched file\n   * enumeration inside the target context. Contexts that cannot support\n   * globbing should throw a clear error rather than silently returning no\n   * matches. `metadata` is best-effort and only required when the context can\n   * provide it without expensive per-file shell calls.\n   */\n  listFiles: (handle: ExecutionHandle, path: string, options?: ListFilesOptions) => Promise<ListFilesEntry[]>\n\n  /**\n   * The context's own entry operations (create, move, copy, remove) for\n   * `handle`, with paths resolved like every other file method. Optional:\n   * without it, `entryPortOf` (`./entries`) runs POSIX commands through\n   * `exec` (`mkdir -p`, `mv`, `cp -RP`, `rm -rf`), which every shell\n   * context can do. Implement it where a native call is cheaper or safer\n   * (in-process fs, a machine link).\n   */\n  entries?: (handle: ExecutionHandle) => EntryPort\n\n  /**\n   * Resolve the host-side port that a container port was published on\n   * (docker context only, and only when the matching entry was created\n   * with `host` omitted in `SpawnConfig.ports`).\n   *\n   * Resolves to `null` if the container port isn't published. Other\n   * contexts (process, sandbox) don't implement this; they don't have\n   * a port-mapping concept.\n   */\n  getMappedPort?: (handle: ExecutionHandle, containerPort: number) => Promise<number | null>\n\n  /** Destroy the execution environment and clean up resources */\n  destroy: (handle: ExecutionHandle) => Promise<void>\n}\n\n// ---------------------------------------------------------------------------\n// Background task types\n// ---------------------------------------------------------------------------\n\n/** Options for {@link ExecutionContext.openTerminal} and {@link ExecutionContext.reconnectTerminal}. */\nexport interface TerminalOptions {\n  /** Working directory; defaults to the handle's cwd. */\n  cwd?: string\n  /** Terminal width in columns. */\n  cols: number\n  /** Terminal height in rows. */\n  rows: number\n  /** Extra environment on top of what the context's commands get. */\n  env?: Record<string, string>\n  /** Variables to drop from the inherited environment (local contexts). */\n  unsetEnv?: readonly string[]\n  /** Raw terminal output. Called synchronously; never slowed by the consumer. */\n  onData: (data: Uint8Array) => void\n}\n\n/** An interactive terminal opened by {@link ExecutionContext.openTerminal}. */\nexport interface TerminalProcess {\n  /** Opaque id for {@link ExecutionContext.reconnectTerminal}. */\n  id: string\n  /** Whether {@link ExecutionContext.reconnectTerminal} can find it again later. */\n  reconnectable: boolean\n  /** Host pid of the shell, when it runs on this machine (for labels). */\n  localPid?: number\n  write: (data: string | Uint8Array) => void\n  resize: (cols: number, rows: number) => void\n  /** End the shell and everything it started. Idempotent. */\n  kill: () => Promise<void>\n  /** Let go without ending it (a remote PTY keeps running for a reconnect). */\n  detach: () => Promise<void>\n  /** Resolves once with the exit code; `-1` when the connection was lost instead. */\n  exited: Promise<number>\n}\n\n/**\n * Terminal mode for {@link ExecutionContext.execBackground}: run the task in\n * a PTY instead of pipes, so it behaves as it would for a person (colors,\n * progress, tools that insist on a TTY) and can be watched and typed into.\n * The log file still receives the output, with terminal control sequences\n * removed, and the registry (kill, wait, list, reassign) is unchanged.\n */\nexport interface BackgroundTerminalOptions {\n  cols: number\n  rows: number\n  /** Raw output as it arrives (the log gets the stripped text). */\n  onData: (data: Uint8Array) => void\n  /** Receives the functions to type into and resize the task's terminal. */\n  onReady?: (io: { write: (data: string | Uint8Array) => void, resize: (cols: number, rows: number) => void }) => void\n}\n\n/**\n * Lifecycle status of a background task.\n *\n * - `'running'` — process is still live; `exitCode` / `signal` unset.\n * - `'exited'` — process terminated on its own (clean or non-zero exit).\n * - `'killed'` — the host issued `killBackground` (SIGTERM to the group).\n *\n * The status is a coarse-grained signal; the exit code carries the\n * fine-grained detail (e.g. `143 = SIGTERM` for `'killed'`).\n */\nexport type BackgroundTaskStatus = 'running' | 'exited' | 'killed'\n\n/**\n * Returned by `execBackground` once the process has spawned — the handle the model and\n * the framework use to refer to the task until it terminates.\n *\n * `outputPath` is an absolute path to the log file the context is\n * appending stdout + stderr to (interleaved by emit order). The model\n * reads it via the normal `read_file` tool; no special tool is required.\n */\nexport interface TaskHandle {\n  /**\n   * Stable id minted by the context — typically `bash_<n>` for\n   * `ProcessContext`. Sequential within a single context instance,\n   * resets when a new context is constructed. Forwarded to `killBackground` /\n   * `listBackground` and stamped into every `<task-notification>` block.\n   */\n  taskId: string\n  /** OS pid of the spawned shell wrapper (process-group leader on POSIX). */\n  pid: number\n  /** Absolute path to the log file the context is streaming output into. */\n  outputPath: string\n  /** True when the task runs in a terminal (`execBackground`'s `terminal` option was honored). */\n  terminal?: boolean\n}\n\n/**\n * A live bidirectional stream to a process in the context. Returned by\n * {@link ExecutionContext.execStream}; see that method for the full\n * implementor contract (why the streams are bytes, why `stderr` is\n * optional, what PTY-backed contexts must do before the first byte).\n *\n * Ownership: the caller owns the lifetime. Nothing reaps this handle\n * automatically, so `kill()` belongs in the consumer's teardown path —\n * for MCP that is the transport's `close()`, reached via the agent's\n * `mcpConnection.close()` during `destroy()`.\n */\nexport interface StreamHandle {\n  /** Process id inside the context — NOT meaningful on the host. */\n  pid: number\n  /**\n   * Child's stdout as raw byte chunks, in emit order.\n   *\n   * CONSUMER OBLIGATION: drain this (and {@link stderr}) for the stream's\n   * lifetime. Nothing here is bounded, and the consequence of ignoring it\n   * varies by backend and by host runtime, none of it good:\n   *\n   *  - `process` / `docker` hand back real OS pipes. Under Node an unread\n   *    stream stops draining the fd and the child BLOCKS once the pipe\n   *    fills (~64 KiB) — a deadlock, not a slowdown. Under Bun the runtime\n   *    buffers eagerly instead, so it presents as unbounded host memory\n   *    (measured: 32 MiB of unread stderr never blocked the child).\n   *  - `e2b` / `daytona` buffer in a `StreamQueue`, which grows without\n   *    limit. It cannot do otherwise: both SDKs push output through a\n   *    synchronous `(data) => void` callback, so there is no channel to\n   *    apply backpressure, and dropping bytes would desynchronise a framed\n   *    protocol permanently. The queue logs a one-shot warning once the\n   *    unread backlog passes 8 MiB so a stalled consumer is diagnosable.\n   *\n   * `createContextStdioTransport` satisfies this for both streams.\n   */\n  stdout: AsyncIterable<Uint8Array>\n  /**\n   * Child's stderr, when the implementation can provide it separately.\n   * Present on pipe-backed contexts. A PTY-backed context cannot split it\n   * from the terminal stream, so it redirects stderr to a file and either\n   * surfaces it here out-of-band or leaves this unset — expect a lower\n   * latency guarantee there than on stdout.\n   */\n  stderr?: AsyncIterable<Uint8Array>\n  /** Write to the child's stdin. Resolves once the bytes are handed off. */\n  write: (data: Uint8Array) => Promise<void>\n  /** Terminate the child. Idempotent — killing a dead child is a no-op. */\n  kill: () => Promise<void>\n  /**\n   * Resolves with the exit code when the child terminates, including\n   * termination via {@link kill}. Never rejects.\n   */\n  exited: Promise<number>\n}\n\n/**\n * Fired exactly once per task when the child process terminates, via\n * `execBackground`'s `onExit` callback. The agent layer translates this\n * into a queued `<task-notification>` for the next turn.\n *\n * `signal` is set when the child was terminated by a signal (e.g.\n * SIGTERM from our own kill-tree, SIGKILL from oom-killer); absent on\n * natural exit. `exitCode` is `128 + signal-number` on signal-killed\n * children, matching POSIX shell conventions — `143` for SIGTERM, etc.\n */\nexport interface TaskExitInfo {\n  /** Id of the task, as in {@link TaskHandle.taskId}. */\n  taskId: string\n  /** How the task ended. */\n  status: Exclude<BackgroundTaskStatus, 'running'>\n  /** Exit code of the process. */\n  exitCode: number\n  /** Signal that terminated the process, when there was one. */\n  signal?: NodeJS.Signals\n  /** Absolute path of the log file holding the task output. */\n  outputPath: string\n  /** `Date.now()` delta between spawn and exit. */\n  durationMs: number\n  /** The original command string the model invoked — useful for telemetry / banner summary. */\n  command: string\n}\n\n/**\n * One row in `listBackground`'s snapshot. Living entries (status `'running'`)\n * have `exitCode` / `signal` / `endedAt` unset; terminated entries carry the\n * same data `TaskExitInfo` returned at exit time.\n */\nexport interface TaskEntry {\n  /** Id of the task, as in {@link TaskHandle.taskId}. */\n  taskId: string\n  /** Process id. */\n  pid: number\n  /** Command the task runs. */\n  command: string\n  /** Working directory of the task. */\n  cwd: string\n  /** Start time, in milliseconds since the epoch. */\n  startedAt: number\n  /**\n   * Set when the task terminated. Lets pull-based consumers (the agent's\n   * run-boundary reconcile) derive `durationMs = endedAt - startedAt`\n   * without depending on when the snapshot was taken.\n   */\n  endedAt?: number\n  /** Absolute path of the log file holding the task output. */\n  outputPath: string\n  /** Current state of the task. */\n  status: BackgroundTaskStatus\n  /** Exit code. Set once the task terminated. */\n  exitCode?: number\n  /** Signal that terminated the process, when there was one. */\n  signal?: NodeJS.Signals\n  /** Total bytes written to the output file so far — useful for \"task X has produced N KB\" UX hints. */\n  bytesWritten: number\n}\n\n/**\n * Fired by the optional stall watchdog (see `execBackground`'s\n * `stallTimeoutMs`) when a running task has produced no output for the\n * configured window. The process is still alive — this is a signal, not\n * a state transition.\n */\nexport interface TaskStallInfo {\n  /** Id of the stalled task. */\n  taskId: string\n  /** Command the task runs. */\n  command: string\n  /** Absolute path of the log file holding the task output. */\n  outputPath: string\n  /** Milliseconds since the last output chunk (>= the configured window). */\n  stalledForMs: number\n  /** Total bytes the task has written so far. */\n  bytesWritten: number\n}\n"],"mappings":";;AA+BA,MAAM,QAAQ;CAAE,MAAM;CAAG,KAAK;CAAG,KAAK;CAAG,KAAK;CAAG,QAAQ;AAAE;;AAG3D,MAAM,YAAY;;AAGlB,MAAM,WAAW,SAAiB,SAAS,KAAS,QAAQ,OAAS,OAAO,OAAQ,QAAQ;AAE5F,SAAgB,mBAAmB,UAA+B,CAAC,GAAiB;CAClF,IAAI,QAA4C,MAAM;;CAEtD,IAAI,MAAM;CACV,IAAI,WAAW;CACf,IAAI,OAAO;;CAEX,IAAI,YAAY;;CAEhB,IAAI,QAAQ;CAEZ,MAAM,kBAAkB;EACtB,IAAI,YAAY,QAAQ,SAAS;GAC/B,MAAM,OAAO,IAAI,QAAQ,GAAG;GAC5B,MAAM,OAAO,SAAS,KAAK,MAAM,IAAI,MAAM,GAAG,IAAI;GAClD,KAAK,SAAS,OAAO,SAAS,QAAQ,SAAS,IAC7C,QAAQ,QAAQ,IAAI,MAAM,OAAO,CAAC,CAAC;EACvC;EACA,MAAM;EACN,QAAQ,MAAM;CAChB;CAEA,OAAO;EACL,KAAK,OAAO;GACV,IAAI,MAAM;GACV,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;IACrC,MAAM,KAAK,MAAM;IACjB,MAAM,OAAO,GAAG,WAAW,CAAC;IAC5B,QAAQ,OAAR;KACE,KAAK,MAAM;MACT,IAAI,SAAS,IACX,QAAQ,MAAM;WAEX,IAAI,OAAO,MAAM;OACpB,OAAO,GAAG,KAAK;OACf,OAAO;OACP,YAAY;OACZ,QAAQ;MACV,OACK,IAAI,OAAO,MACd,YAAY;WAET,IAAI,SAAS,GAChB,OAAO,KAAK,MAAM,GAAG,EAAE;WAEpB,IAAI,SAAS,KAChB,QAAQ,MAAM;WAEX,IAAI,SAAS,KAAM;OACtB,QAAQ,MAAM;OACd,WAAW;MACb,OACK,IAAI,OAAO,OAAQ,QAAQ,IAAM;OACpC,IAAI,QAAQ,OAAQ,OAAO,KACzB;OACF,IAAI,WAAW;QACb,IAAI,OACF,OAAO;QACT,QAAQ;QACR,OAAO;QACP,YAAY;OACd;OACA,IAAI,MAAM,IAAI;OACd,OAAO,MAAM,MAAM,UAAU,QAAQ,MAAM,WAAW,GAAG,CAAC,GACxD;OACF,IAAI,MAAM,IAAI,WACZ,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,KAAK,QAAQ,MAAM;YAG5C,QAAQ,MAAM,MAAM,GAAG,GAAG;OAE5B,IAAI,MAAM;MACZ;MACA;KACF,KAAK,MAAM;MACT,IAAI,OAAO,KACT,QAAQ,MAAM;WAEX,IAAI,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK;OAC3E,QAAQ,MAAM;OACd,WAAW,OAAO;OAClB,MAAM;MACR,OACK,IAAI,QAAQ,MAAQ,QAAQ,IAAM,CAEvC,OAEE,QAAQ,MAAM;MAEhB;KACF,KAAK,MAAM;MAET,IAAI,QAAQ,MAAQ,QAAQ,KAC1B,QAAQ,MAAM;MAChB;KACF,KAAK,MAAM;MACT,IAAI,SAAS,GACX,UAAU;WAEP,IAAI,SAAS,IAChB,QAAQ,MAAM;WAEX,IAAI,SAAS,KAChB,UAAU;WAEP,IAAI,IAAI,SAAS,MACpB,OAAO;MAET;KACF,KAAK,MAAM,QACT,IAAI,OAAO,MACT,UAAU;UAEP;MACH,OAAO,OAAO;MACd,QAAQ,MAAM;KAChB;IAEJ;GACF;GACA,OAAO;EACT;EACA,eAAe;EACf,cAAc;GACZ,MAAM,OAAO;GACb,IAAI,MACF,QAAQ;GACV,OAAO;GACP,OAAO;EACT;CACF;AACF;;AAGA,SAAgB,UAAU,MAAsB;CAC9C,MAAM,IAAI,mBAAmB;CAC7B,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,QAAQ;AAClC;;;;;;;;;ACjGA,SAAgB,+BAA+B,SAAoD;CACjG,OAAO,QAAQ,aAAa,kBACtB,QAAQ,iBAAiB,qBAAqB;AACtD"}

package/dist/{types-DnRd9_cA.d.ts → types-SXqk6hLD.d.ts}

@@ -1,5 +1,5 @@
-import { $k as Provider, Eo as Preset, NP as ToolDef, QN as SessionContentBlock, UN as PromptPart, Wo as AgentOptions, aL as Session, gP as ToolResultContent, jN as McpServerConfig, lN as AgentBehavior, pL as SessionStore, zo as Agent } from "./index-CGbOWa7y.js";
-import { d as ExecutionContext } from "./types-bDQagoiL.js";
+import { BL as Session, CP as PromptPart, Eo as Preset, JL as SessionStore, MP as SessionContentBlock, NA as Provider, UN as AgentBehavior, Wo as AgentOptions, ZP as ToolResultContent, dP as McpServerConfig, mF as ToolDef, zo as Agent } from "./index-WlE93Q6d.js";
+import { f as ExecutionContext } from "./types-2HrgolQz.js";
 //#region src/acp/client-declared-tools.d.ts
 /** JSON-RPC method the agent sends to the client to run a client-declared tool. */
 declare const CLIENT_TOOL_CALL_METHOD = "_zidane/tool_call";
@@ -1044,4 +1044,4 @@ type AcpContentMapper = (content: string | ToolResultContent[]) => ToolCallConte
 type AcpSessionContentMapper = (blocks: SessionContentBlock[]) => ContentBlock[];
 //#endregion
 export { PermissionOption as $, DeleteSessionRequest as A, ToolCallContent as At, JsonRpcId as B, createClientDeclaredTools as Bt, CancelNotification as C, SetSessionConfigOptionResponse as Ct, ContentChunk as D, TerminalOutputResponse as Dt, ContentBlock as E, TerminalExitStatus as Et, ImageContent as F, WriteTextFileRequest as Ft, JsonRpcSuccess as G, JsonRpcNotification as H, InitializeRequest as I, AcpClientToolSpec as It, LoadSessionRequest as J, ListSessionsRequest as K, InitializeResponse as L, CLIENT_TOOL_CALL_METHOD as Lt, EmbeddedResourceResource as M, ToolCallStatus as Mt, EnvVariable as N, ToolCallUpdate as Nt, Cost as O, TextContent as Ot, HttpHeader as P, ToolKind as Pt, NewSessionResponse as Q, JsonRpcError as R, CLIENT_TOOL_CANCEL_METHOD as Rt, BlobResourceContents as S, SetSessionConfigOptionRequest as St, ContentAnnotations as T, StopReason as Tt, JsonRpcRequest as U, JsonRpcMessage as V, parseClientToolSpecs as Vt, JsonRpcResponse as W, McpCapabilities as X, LoadSessionResponse as Y, NewSessionRequest as Z, AudioContent as _, SessionInfo as _t, AcpImplementationInfo as a, RequestPermissionOutcome as at, AvailableCommand as b, SessionNotification as bt, AcpModelOption as c, ResumeSessionRequest as ct, AcpPromptMapping as d, SessionCapabilities as dt, PlanEntry as et, AcpServerOptions as f, SessionConfigOption as ft, AgentCapabilities as g, SessionConfigSelectOptions as gt, AgentAuthCapabilities as h, SessionConfigSelectOption as ht, AcpErrorCode as i, ReadTextFileRequest as it, EmbeddedResource as j, ToolCallLocation as jt, CreateTerminalRequest as k, TextResourceContents as kt, AcpPeer as l, ResumeSessionResponse as lt, AcpSessionRuntime as m, SessionConfigSelectGroup as mt, AcpClientCapabilities as n, PromptRequest as nt, AcpMcpServer as o, RequestPermissionRequest as ot, AcpSessionContentMapper as p, SessionConfigOptionCategory as pt, ListSessionsResponse as q, AcpContentMapper as r, PromptResponse as rt, AcpModelChoice as s, ResourceLink as st, ACP_PROTOCOL_VERSION as t, PromptCapabilities as tt, AcpPermissionPolicy as u, Role as ut, AuthMethod as v, SessionMode as vt, CloseSessionRequest as w, SetSessionModeRequest as wt, AvailableCommandInput as x, SessionUpdate as xt, AuthenticateRequest as y, SessionModeState as yt, JsonRpcFailure as z, ClientToolCallResponse as zt };
-//# sourceMappingURL=types-DnRd9_cA.d.ts.map
+//# sourceMappingURL=types-SXqk6hLD.d.ts.map

package/dist/{types-DnRd9_cA.d.ts.map → types-SXqk6hLD.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-DnRd9_cA.d.ts","names":["_$__client_declared_tools0.AcpClientToolSpec","_$___agent0.Agent"],"sources":["../src/acp/client-declared-tools.ts","../src/acp/types.ts"],"mappings":";;;;cAKa;;cAGA;;;;;;;UAUI;;EAEf;;EAEA;;EAEA,aAAa;;EAEb;;;UAIe;;EAEf;;EAEA;;;;;;;iBAac,qBAAqB,MAAM,6CAA6C;;;;;;;;iBAwDxE,0BACd,gBAAgB,qBAChB;EAAW,QAAQ;EAAS;IAC3B,eAAe;;;;cCjGL;;KAGD;;UAGK;;EAEf;;EAEA,IAAI;;EAEJ;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA,IAAI;;EAEJ;;;UAIe;;EAEf;;EAEA,IAAI;;EAEJ,OAAO;;;KAIG,kBAAkB,iBAAiB;;KAEnC,iBAAiB,iBAAiB,sBAAsB;;UAGnD;;EAEf;;EAEA;;EAEA;;;aAIU;;EAEV;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;UAIe;;EAEf,cAAc,gBAAgB,qBAAqB;;EAEnD,mBAAmB,gBAAgB,4BAA4B;;;;;;;UAQhD;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;IAEE;;IAEA;;;EAGF;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,qBAAqB;;EAErB,aAAa,QAAQ;;EAErB,QAAQ;;;UAIO;;EAEf;;EAEA,qBAAqB;;EAErB,kBAAkB;;EAElB,sBAAsB;;EAEtB,OAAO;;EAEP,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf,SAAS;;EAET,QAAQ;;;UAIO;;EAEf,OAAO;;EAEP,SAAS;;EAET,wBAAwB;;EAExB,SAAS;;EAET,QAAQ;;EAER,QAAQ;;;UAIO;;EAEf;;EAEA,mBAAmB;;EAEnB,YAAY;;EAEZ,aAAa;;EAEb,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,YAAY;;EAEZ,QAAQ;;;UAIO,2BAA2B;;EAE1C;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA,aAAa;;EAEb,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf,UAAU;;EAEV;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;EAER,gBAAgB;;EAEhB,QAAQ;;;;;;;UAQO;;EAEf,QAAQ;;EAER,gBAAgB;;EAEhB,QAAQ;;;KAIE,wBAAwB;;UAGnB;;EAEf;;EAEA,QAAQ;;EAER,QAAQ;;;UAIO;;EAEf,YAAY;;EAEZ,QAAQ;;;KAIE;;UAGK;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf,eAAe;;EAEf,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,gBAAgB;;EAEhB,QAAQ;;;KAIE;EACJ;EAAgB;EAAc;EAAiB;EAAgB,KAAK;EAAe,QAAQ;;EAC3F;EAAsB;EAAc;EAAa,SAAS;EAAc,QAAQ;;;UAGvE;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;KAIE,eACN,cACA,eACA,eACA,eACA;;KAGM;;UAGK;;EAEf,WAAW;;EAEX;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;KAIE,2BAA2B,uBAAuB;;UAG7C;;EAEf;;EAEA,UAAU;;EAEV,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf,SAAS;;EAET;;EAEA,QAAQ;;;KAIE;;KAEA;;KAGA;EACJ;EAAiB,SAAS;EAAc,QAAQ;;EAChD;EAAc;EAAc;EAAyB;EAAiB,QAAQ;;EAC9E;EAAkB;EAAoB,QAAQ;;;UAGrC;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,OAAO;;EAEP,SAAS;;EAET,UAAU;;EAEV,YAAY;;EAEZ;;EAEA;;EAEA,QAAQ;;;KAIE;EACH;IAAwC;EACxC;IAAyC;EACzC;IAAyC;EACzC;IAA+B;EAC/B;IAAsC;EACvC;EAAuB,SAAS;EAAa,QAAQ;;EACrD;EAA4C,mBAAmB;EAAoB,QAAQ;;EAC3F;EAAsC;EAAuB,QAAQ;;EACrE;EAAuC,eAAe;EAAuB,QAAQ;;EACrF;EAAsC;EAAuB;EAA2B,QAAQ;;EAChG;EAA+B;EAAc;EAAc,OAAO;EAAa,QAAQ;;;UAG9E;;EAEf;;EAEA,QAAQ;;EAER,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;EAER,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,SAAS;;EAET,QAAQ;;;KAIE,6BAA6B,8BAA8B;;KAG3D;;;;;UAMK;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA,SAAS;;EAET;;EAEA,WAAW;;EAEX,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;KAIE;EACJ;;EACA;EAAqB;EAAkB,QAAQ;;;UAGtC;;EAEf;;EAEA,UAAU;;EAEV,SAAS;;EAET,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,MAAM;;EAEN;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,aAAa;;EAEb,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,YAAY;;EAEZ,aAFYA;;EAIZ,SAAS;;EAET,WAAW;;EAEX,OAFWC;;;;;;EAQX,UAAU;;EAEV,QAAQ,eAAe;;EAEvB;;EAEA,eAAe;;EAEf,QAAQ;;EAER;;EAEA,uBAAuB,UAAU;;EAEjC,kBAAkB;;EAElB,WAAW,QAAQ;;;UAIJ;;;;;EAKf;;EAEA,eAAe,kBAAkB,OAAO;;;;;EAKxC,UAAU;;;;;;;;UASK;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA,UAAU;;EAEV,UAAU,kBAAkB;;;UAIb;;EAEf;;EAEA;;EAEA;;;UAIe;;;;;EAKf,WAAW,kBAAkB;;EAE7B;;;;;;;EAOA,SAAS;;EAET;;;;;EAKA,SAAS;;EAET,QAAQ,eAAe;;EAEvB;;EAEA,WAAW;;EAEX,QAAQ;;;;;EAKR,YAAY,qBAAqB,SAAS,oBAAoB,qBAAqB,yBAAyB;;;;;EAK5G,YAAY;;;;;EAKZ,cAAc;;EAEd,gBAAgB,SAAS,wBAAwB;;EAEjD,eAAe;;;;;EAKf,QAAQ;;;;;EAKR;;EAEA,gBAAgB;;EAEhB,WAAW;;;;;;;EAOX;;EAEA,aAAa;;;;;EAKb;;;;;EAKA;;;;;EAKA;;EAEA,eAAe,QAAQ,KAAK;;;UAIb;;EAEf,QAAQ;;EAER;;;KAIU,oBAAoB,kBAAkB,wBAAwB;;KAG9D,2BAA2B,QAAQ,0BAA0B"}
+{"version":3,"file":"types-SXqk6hLD.d.ts","names":["_$__client_declared_tools0.AcpClientToolSpec","_$___agent0.Agent"],"sources":["../src/acp/client-declared-tools.ts","../src/acp/types.ts"],"mappings":";;;;cAKa;;cAGA;;;;;;;UAUI;;EAEf;;EAEA;;EAEA,aAAa;;EAEb;;;UAIe;;EAEf;;EAEA;;;;;;;iBAac,qBAAqB,MAAM,6CAA6C;;;;;;;;iBAwDxE,0BACd,gBAAgB,qBAChB;EAAW,QAAQ;EAAS;IAC3B,eAAe;;;;cCjGL;;KAGD;;UAGK;;EAEf;;EAEA,IAAI;;EAEJ;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;;UAIe;;EAEf;;EAEA,IAAI;;EAEJ;;;UAIe;;EAEf;;EAEA,IAAI;;EAEJ,OAAO;;;KAIG,kBAAkB,iBAAiB;;KAEnC,iBAAiB,iBAAiB,sBAAsB;;UAGnD;;EAEf;;EAEA;;EAEA;;;aAIU;;EAEV;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;UAIe;;EAEf,cAAc,gBAAgB,qBAAqB;;EAEnD,mBAAmB,gBAAgB,4BAA4B;;;;;;;UAQhD;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;IAEE;;IAEA;;;EAGF;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,qBAAqB;;EAErB,aAAa,QAAQ;;EAErB,QAAQ;;;UAIO;;EAEf;;EAEA,qBAAqB;;EAErB,kBAAkB;;EAElB,sBAAsB;;EAEtB,OAAO;;EAEP,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf,SAAS;;EAET,QAAQ;;;UAIO;;EAEf,OAAO;;EAEP,SAAS;;EAET,wBAAwB;;EAExB,SAAS;;EAET,QAAQ;;EAER,QAAQ;;;UAIO;;EAEf;;EAEA,mBAAmB;;EAEnB,YAAY;;EAEZ,aAAa;;EAEb,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,YAAY;;EAEZ,QAAQ;;;UAIO,2BAA2B;;EAE1C;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA,aAAa;;EAEb,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf,UAAU;;EAEV;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;EAER,gBAAgB;;EAEhB,QAAQ;;;;;;;UAQO;;EAEf,QAAQ;;EAER,gBAAgB;;EAEhB,QAAQ;;;KAIE,wBAAwB;;UAGnB;;EAEf;;EAEA,QAAQ;;EAER,QAAQ;;;UAIO;;EAEf,YAAY;;EAEZ,QAAQ;;;KAIE;;UAGK;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf,eAAe;;EAEf,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA,gBAAgB;;EAEhB,QAAQ;;;KAIE;EACJ;EAAgB;EAAc;EAAiB;EAAgB,KAAK;EAAe,QAAQ;;EAC3F;EAAsB;EAAc;EAAa,SAAS;EAAc,QAAQ;;;UAGvE;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;KAIE,eACN,cACA,eACA,eACA,eACA;;KAGM;;UAGK;;EAEf,WAAW;;EAEX;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;KAIE,2BAA2B,uBAAuB;;UAG7C;;EAEf;;EAEA,UAAU;;EAEV,cAAc;;EAEd,QAAQ;;;UAIO;;EAEf,SAAS;;EAET;;EAEA,QAAQ;;;KAIE;;KAEA;;KAGA;EACJ;EAAiB,SAAS;EAAc,QAAQ;;EAChD;EAAc;EAAc;EAAyB;EAAiB,QAAQ;;EAC9E;EAAkB;EAAoB,QAAQ;;;UAGrC;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,OAAO;;EAEP,SAAS;;EAET,UAAU;;EAEV,YAAY;;EAEZ;;EAEA;;EAEA,QAAQ;;;KAIE;EACH;IAAwC;EACxC;IAAyC;EACzC;IAAyC;EACzC;IAA+B;EAC/B;IAAsC;EACvC;EAAuB,SAAS;EAAa,QAAQ;;EACrD;EAA4C,mBAAmB;EAAoB,QAAQ;;EAC3F;EAAsC;EAAuB,QAAQ;;EACrE;EAAuC,eAAe;EAAuB,QAAQ;;EACrF;EAAsC;EAAuB;EAA2B,QAAQ;;EAChG;EAA+B;EAAc;EAAc,OAAO;EAAa,QAAQ;;;UAG9E;;EAEf;;EAEA,QAAQ;;EAER,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;EAER,QAAQ;;;UAIO;;EAEf;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,SAAS;;EAET,QAAQ;;;KAIE,6BAA6B,8BAA8B;;KAG3D;;;;;UAMK;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA,SAAS;;EAET;;EAEA,WAAW;;EAEX,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;KAIE;EACJ;;EACA;EAAqB;EAAkB,QAAQ;;;UAGtC;;EAEf;;EAEA,UAAU;;EAEV,SAAS;;EAET,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,MAAM;;EAEN;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA,aAAa;;EAEb,QAAQ;;;UAIO;;EAEf;;EAEA;;EAEA;;EAEA,YAAY;;EAEZ,aAFYA;;EAIZ,SAAS;;EAET,WAAW;;EAEX,OAFWC;;;;;;EAQX,UAAU;;EAEV,QAAQ,eAAe;;EAEvB;;EAEA,eAAe;;EAEf,QAAQ;;EAER;;EAEA,uBAAuB,UAAU;;EAEjC,kBAAkB;;EAElB,WAAW,QAAQ;;;UAIJ;;;;;EAKf;;EAEA,eAAe,kBAAkB,OAAO;;;;;EAKxC,UAAU;;;;;;;;UASK;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA,UAAU;;EAEV,UAAU,kBAAkB;;;UAIb;;EAEf;;EAEA;;EAEA;;;UAIe;;;;;EAKf,WAAW,kBAAkB;;EAE7B;;;;;;;EAOA,SAAS;;EAET;;;;;EAKA,SAAS;;EAET,QAAQ,eAAe;;EAEvB;;EAEA,WAAW;;EAEX,QAAQ;;;;;EAKR,YAAY,qBAAqB,SAAS,oBAAoB,qBAAqB,yBAAyB;;;;;EAK5G,YAAY;;;;;EAKZ,cAAc;;EAEd,gBAAgB,SAAS,wBAAwB;;EAEjD,eAAe;;;;;EAKf,QAAQ;;;;;EAKR;;EAEA,gBAAgB;;EAEhB,WAAW;;;;;;;EAOX;;EAEA,aAAa;;;;;EAKb;;;;;EAKA;;;;;EAKA;;EAEA,eAAe,QAAQ,KAAK;;;UAIb;;EAEf,QAAQ;;EAER;;;KAIU,oBAAoB,kBAAkB,wBAAwB;;KAG9D,2BAA2B,QAAQ,0BAA0B"}