Module agent_runtime 

Bounded direct execution of static agent resources. Runtime persistence is intentionally writable; model-requested retrieval uses read-only connections.

Modules

checkpoint 🔒

Versioned, bounded snapshots at model boundaries. Recovery never replays a tool from a partially persisted turn, even if it appears to have completed.

cli

CLI wiring. Inspection is read-only and independent of model credentials.

context 🔒

Deterministic request projection. Compatibility remains the default; bounded projection is enabled only by an explicit resource budget.

control 🔒

delegation 🔒

Explicit, sequential delegation with inherited authority and shared budgets.

developer 🔒

Workspace developer tools. Path checks protect ordinary filesystem access; process execution is an explicit, unsandboxed capability.

files 🔒

Durable, immutable artifact files and process-lifetime ownership of local runs. Files are synced before their metadata is recorded in SQLite. A crash between those steps can leave an unreferenced file; files are never overwritten or implicitly removed. The persistent lock inode must never be unlinked.

mcp 🔒

Per-run external tool discovery. Even initialization starts an unsandboxed process, so it passes through durable authorization before connecting.

mcp_client 🔒

Bounded stdio MCP sessions. Authorization must precede connect: spawning a server is process execution even when its advertised tools claim read-only.

policy

Host-owned permission ceilings and per-invocation approval. Agent resources can restrict this policy, never widen it.

terminal 🔒

A cancellable terminal-only approval reader. Piped stdin never grants consent.

tools 🔒

Read-only runtime adapters using the existing Tool/ToolRegistry and core retrieval implementation. No connector processes, embeddings or sidecars.

Structs

AgentRuntime

RestoredRequest 🔒

Constants

MAX_TOOL_CALLS_PER_TURN 🔒

MAX_TOOL_RESULT_BYTES 🔒

Functions

cancelled 🔒

canonical_json 🔒

classified_tool_error 🔒

recoverable_observation 🔒

repetition_key 🔒

run_budgets 🔒

static_tool_identity 🔒

Resolve the exact advertised schemas and non-secret binding metadata used by accepted tasks without opening the database or binding/executing a tool.

workspace_id

Workspace binding for the existing cwd-scoped CLI. Registry-based workspace selection is not added here. Canonical roots retain identity across symlinks.