@aexhq/sdk 0.22.0 → 0.23.0

package/dist/_contracts/models.d.ts

@@ -27,6 +27,9 @@ export declare const MODEL_PROVIDER_IDS: {
     readonly "claude-3-5-sonnet-latest": {
         readonly anthropic: "claude-3-5-sonnet-latest";
     };
+    readonly "claude-sonnet-4-6": {
+        readonly anthropic: "claude-sonnet-4-6";
+    };
     readonly "deepseek-v4-flash": {
         readonly deepseek: "deepseek-v4-flash";
     };
@@ -93,6 +96,8 @@ export declare const Models: {
     readonly CLAUDE_3_5_HAIKU_LATEST: "claude-3-5-haiku-latest";
     /** Claude 3.5 Sonnet (latest) — Anthropic. */
     readonly CLAUDE_3_5_SONNET_LATEST: "claude-3-5-sonnet-latest";
+    /** Claude Sonnet 4.6 — Anthropic (1M context, reasoning-capable). */
+    readonly CLAUDE_SONNET_4_6: "claude-sonnet-4-6";
     /** DeepSeek V4 Flash — DeepSeek (non-thinking, fast). */
     readonly DEEPSEEK_V4_FLASH: "deepseek-v4-flash";
     /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */
@@ -148,6 +153,8 @@ export declare const RunModels: {
     readonly CLAUDE_3_5_HAIKU_LATEST: "claude-3-5-haiku-latest";
     /** Claude 3.5 Sonnet (latest) — Anthropic. */
     readonly CLAUDE_3_5_SONNET_LATEST: "claude-3-5-sonnet-latest";
+    /** Claude Sonnet 4.6 — Anthropic (1M context, reasoning-capable). */
+    readonly CLAUDE_SONNET_4_6: "claude-sonnet-4-6";
     /** DeepSeek V4 Flash — DeepSeek (non-thinking, fast). */
     readonly DEEPSEEK_V4_FLASH: "deepseek-v4-flash";
     /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */

package/dist/_contracts/models.js

@@ -20,6 +20,7 @@ export const MODEL_PROVIDER_IDS = {
     "claude-haiku-4-5": { anthropic: "claude-haiku-4-5" },
     "claude-3-5-haiku-latest": { anthropic: "claude-3-5-haiku-latest" },
     "claude-3-5-sonnet-latest": { anthropic: "claude-3-5-sonnet-latest" },
+    "claude-sonnet-4-6": { anthropic: "claude-sonnet-4-6" },
     "deepseek-v4-flash": { deepseek: "deepseek-v4-flash" },
     "deepseek-v4-pro": { deepseek: "deepseek-v4-pro" },
     "deepseek-chat": { deepseek: "deepseek-chat" },
@@ -63,6 +64,8 @@ export const Models = {
     CLAUDE_3_5_HAIKU_LATEST: "claude-3-5-haiku-latest",
     /** Claude 3.5 Sonnet (latest) — Anthropic. */
     CLAUDE_3_5_SONNET_LATEST: "claude-3-5-sonnet-latest",
+    /** Claude Sonnet 4.6 — Anthropic (1M context, reasoning-capable). */
+    CLAUDE_SONNET_4_6: "claude-sonnet-4-6",
     /** DeepSeek V4 Flash — DeepSeek (non-thinking, fast). */
     DEEPSEEK_V4_FLASH: "deepseek-v4-flash",
     /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */

package/dist/_contracts/run-custody.js

@@ -445,7 +445,16 @@ const forbiddenStringPatterns = Object.freeze([
     { reason: "vault_id", regex: /\b(?:vault|vlt|secret)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i },
     {
         reason: "private_resource_handle",
-        regex: /\b(?:machine|session|agent|file|skill|env|resource|handle|token_hash|bearer_hash)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i
+        // `<keyword><sep><id>` opaque handles (`session_a1B2c3D4e5`, `file_9f8e7d…`).
+        // The keyword set overlaps ordinary English (agent/file/skill/resource/…), so
+        // the bare shape also matched documentation prose that simply chains those
+        // words with `_`/`-` (`agent_decision_failure`, `file_grounded`,
+        // `session_handoff_contract`, `agent-judgment` — read straight out of a
+        // skill-pack doc in tool-result text). The `accept` predicate keeps the shape
+        // but requires the id segment to look minted rather than spelled — i.e. carry
+        // a digit — so genuine handles stay flagged while dictionary-word prose does not.
+        regex: /\b(?:machine|session|agent|file|skill|env|resource|handle|token_hash|bearer_hash)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i,
+        accept: isMintedResourceHandle
     },
     {
         reason: "high_entropy_token",
@@ -487,6 +496,20 @@ function isHighEntropySecretRun(run) {
     }
     return highEntropyShannonBits(run) >= 3.0;
 }
+/**
+ * Decide whether a `<keyword><sep><id>` shape-match is a genuinely minted private
+ * handle rather than dictionary-word prose. The id segment (everything after the
+ * first `_`/`-`/`:`) must carry a digit — the property that separates a minted
+ * opaque handle (`session_a1B2c3D4e5`, `file_9f8e7d6c5b4a`, `machine_1234567890`)
+ * from a chain of English words (`agent_decision_failure`, `file_grounded`). This
+ * mirrors `isHighEntropySecretRun`'s letter+digit requirement: a prefixless secret
+ * blob and a minted handle both carry digits; prose does not.
+ */
+function isMintedResourceHandle(match) {
+    const separatorIndex = match.search(/[_:-]/);
+    const id = match.slice(separatorIndex + 1);
+    return /\d/.test(id);
+}
 function highEntropyCharClassCount(value) {
     let count = 0;
     if (/[a-z]/.test(value))

package/dist/cli.mjs

@@ -162,6 +162,7 @@ var MODEL_PROVIDER_IDS = {
   "claude-haiku-4-5": { anthropic: "claude-haiku-4-5" },
   "claude-3-5-haiku-latest": { anthropic: "claude-3-5-haiku-latest" },
   "claude-3-5-sonnet-latest": { anthropic: "claude-3-5-sonnet-latest" },
+  "claude-sonnet-4-6": { anthropic: "claude-sonnet-4-6" },
   "deepseek-v4-flash": { deepseek: "deepseek-v4-flash" },
   "deepseek-v4-pro": { deepseek: "deepseek-v4-pro" },
   "deepseek-chat": { deepseek: "deepseek-chat" },
@@ -901,7 +902,16 @@ var forbiddenStringPatterns = Object.freeze([
   { reason: "vault_id", regex: /\b(?:vault|vlt|secret)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i },
   {
     reason: "private_resource_handle",
-    regex: /\b(?:machine|session|agent|file|skill|env|resource|handle|token_hash|bearer_hash)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i
+    // `<keyword><sep><id>` opaque handles (`session_a1B2c3D4e5`, `file_9f8e7d…`).
+    // The keyword set overlaps ordinary English (agent/file/skill/resource/…), so
+    // the bare shape also matched documentation prose that simply chains those
+    // words with `_`/`-` (`agent_decision_failure`, `file_grounded`,
+    // `session_handoff_contract`, `agent-judgment` — read straight out of a
+    // skill-pack doc in tool-result text). The `accept` predicate keeps the shape
+    // but requires the id segment to look minted rather than spelled — i.e. carry
+    // a digit — so genuine handles stay flagged while dictionary-word prose does not.
+    regex: /\b(?:machine|session|agent|file|skill|env|resource|handle|token_hash|bearer_hash)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i,
+    accept: isMintedResourceHandle
   },
   {
     reason: "high_entropy_token",
@@ -931,6 +941,11 @@ function isHighEntropySecretRun(run) {
   }
   return highEntropyShannonBits(run) >= 3;
 }
+function isMintedResourceHandle(match) {
+  const separatorIndex = match.search(/[_:-]/);
+  const id = match.slice(separatorIndex + 1);
+  return /\d/.test(id);
+}
 function highEntropyCharClassCount(value) {
   let count = 0;
   if (/[a-z]/.test(value))

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-bfd0fb573fa113fe08d69fc50f246c821bfc9e0acd9bddd6e92775d38120e201  cli.mjs
+37cb8db75fb0852134f1feae2b14bcea847d968f9fe13862c508f916366d1f85  cli.mjs

package/dist/version.d.ts

@@ -6,4 +6,4 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export declare const SDK_VERSION = "0.22.0";
+export declare const SDK_VERSION = "0.23.0";

package/dist/version.js

@@ -6,5 +6,5 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export const SDK_VERSION = "0.22.0";
+export const SDK_VERSION = "0.23.0";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/sdk",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "TypeScript SDK for running autonomous agent sessions across providers (Anthropic, OpenAI, DeepSeek, Gemini, Mistral) behind one interface.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "examples"
   ],
   "devDependencies": {
-    "@aexhq/contracts": "0.22.0"
+    "@aexhq/contracts": "0.23.0"
   },
   "engines": {
     "node": ">=20"