@arnilo/prism-coding-agent 0.0.22 → 0.0.24

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.0.24] - 2026-08-04
+
+### Added
+- Durable `AgentEventSource` (memory + PostgreSQL LISTEN/NOTIFY), recoverable `ToolEffectStore`, and AG-UI MCP/MCP Apps/A2A fronting for Phase 7.
+
+### Changed
+- Publishable graph remains **47** manifests at **0.0.24**; peers and lockfile move together.
+
+See [migration guide](../../docs/migration.md) for the 0.0.23 → 0.0.24 notes.
+
+## [0.0.23] - 2026-08-03
+
+### Changed
+- Released with exact 0.0.23 graph.
+
 ## [0.0.22] - 2026-07-31
 
 ### Changed
@@ -16,14 +31,11 @@
 ### Changed
 - `createCodingTools` returns 9 tools; `createReadOnlyTools` returns 4 (includes `glob`).
 
-
-
 ## [0.0.20] - 2026-07-31
 
 ### Changed
 - Released with exact 0.0.20 graph.
 
-
 ## [0.0.19] - 2026-07-30
 
 ### Changed

package/dist/ask-user-decision.js

@@ -1,4 +1,5 @@
 import { suspend, } from "@arnilo/prism-workflows";
+import { CODING_OBSERVATION_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { validateCodingLimit } from "./limits.js";
 export const ASK_USER_DECISION_TOOL_NAME = "ask_user_decision";
@@ -193,6 +194,7 @@ export function createAskUserDecisionTool(options) {
     const ask = options.ask;
     return {
         name: ASK_USER_DECISION_TOOL_NAME,
+        effect: CODING_OBSERVATION_EFFECT,
         description: "Ask the user to choose a direction when instructions are ambiguous and the choice matters. " +
             "Provide 2+ options; each option MUST include exactly 3 pros and 3 cons. " +
             'Use selectionMode "multiple" when several options may apply together; default is single choice. ' +

package/dist/checks.js

@@ -4,6 +4,7 @@
 import { spawn } from "node:child_process";
 import { rm } from "node:fs/promises";
 import { isAbsolute } from "node:path";
+import { CODING_UNSUPPORTED_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { DEFAULT_CHECK_TIMEOUT_MS, DEFAULT_MAX_CHECK_CONCURRENCY, DEFAULT_MAX_CHECK_DIAGNOSTIC_LINES, DEFAULT_MAX_CHECK_NAMES, DEFAULT_MAX_CHECK_OUTPUT_BYTES, HARD_CHECK_TIMEOUT_MS, HARD_MAX_BYTES, HARD_MAX_CHECK_CONCURRENCY, HARD_MAX_CHECK_DIAGNOSTIC_LINES, HARD_MAX_CHECK_NAMES, HARD_MAX_CHECK_OUTPUT_BYTES, validateCodingLimit, } from "./limits.js";
 import { OutputAccumulator } from "./output-accumulator.js";
@@ -161,6 +162,7 @@ export function createCodingCheckTool(cwd, options) {
     const names = [...checks.keys()].sort();
     return {
         name: "coding_check",
+        effect: CODING_UNSUPPORTED_EFFECT,
         description: `Run a host-declared named check. Allowed names: ${names.join(", ")}. The model cannot choose executables or arguments.`,
         exclusive: true,
         parameters: {

package/dist/delete.js

@@ -1,4 +1,5 @@
 import { lstat, readdir, rmdir, unlink } from "node:fs/promises";
+import { CODING_LOCAL_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { withFileMutationQueue } from "./file-mutation-queue.js";
 import { resolveContainedMutationPath } from "./mutation-path.js";
@@ -28,6 +29,7 @@ export function createDeleteTool(cwd, options) {
     const ops = options?.operations ?? defaultDeleteOperations;
     return {
         name: "delete",
+        effect: CODING_LOCAL_EFFECT,
         description: "High-risk: permanently delete a single file or empty directory in the workspace. Non-empty directories are rejected (no recursive delete). No trash/recycle — host undo is not automatic. Prefer edit/write when content can be fixed in place.",
         parameters: {
             type: "object",

package/dist/edit.js

@@ -23,6 +23,7 @@ import { Buffer } from "node:buffer";
 import { constants } from "node:fs";
 import { access as fsAccess, stat as fsStat } from "node:fs/promises";
 import { atomicWriteUtf8File } from "./atomic-write.js";
+import { CODING_LOCAL_EFFECT } from "./effects.js";
 import { readFileBounded } from "./bounded-file.js";
 import { applyEditsToNormalizedContent, detectLineEnding, generateDiffString, generateUnifiedPatch, normalizeToLF, restoreLineEndings, stripBom, } from "./edit-diff.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
@@ -95,6 +96,7 @@ export function createEditTool(cwd, options) {
     const maxEdits = validateCodingLimit("maxEdits", options?.maxEdits ?? DEFAULT_MAX_EDITS, HARD_MAX_EDITS);
     return {
         name: "edit",
+        effect: CODING_LOCAL_EFFECT,
         description: "Edit a single file using exact-then-fuzzy text replacement. Every edits[].oldText must match a unique, non-overlapping region of the original file. Exact match is tried first; if it fails, fuzzy match (unicode normalize + whitespace collapse) may still succeed silently — prefer exact oldText to avoid wrong-region edits. Duplicate/ambiguous matches fail closed and leave the file unchanged. If two changes affect the same block or nearby lines, merge them into one edit. Do not include large unchanged regions just to connect distant changes. When the host enabled requireReadBeforeWrite, read the path first or pass force=true.",
         parameters: {
             type: "object",

package/dist/effects.d.ts

@@ -0,0 +1,33 @@
+import type { JsonObject, ToolEffectDeclaration, ToolEffectRecord, ToolResult } from "@arnilo/prism";
+export declare const CODING_OBSERVATION_EFFECT: {
+    readonly kind: "none";
+    readonly idempotency: "none";
+};
+export declare const CODING_LOCAL_EFFECT: {
+    readonly kind: "local_mutation";
+    readonly idempotency: "optional";
+};
+export declare const CODING_UNSUPPORTED_EFFECT: {
+    readonly kind: "external_mutation";
+    readonly idempotency: "unsupported";
+};
+export declare function classifyGitBranchEffect(args: JsonObject): ToolEffectDeclaration;
+export declare function classifyGitWorktreeEffect(args: JsonObject): ToolEffectDeclaration;
+export declare function classifyGitApplyEffect(args: JsonObject): ToolEffectDeclaration;
+export interface CodingEffectReconciliationInput {
+    readonly cwd: string;
+    readonly record: Pick<ToolEffectRecord, "toolCallId" | "toolName">;
+    readonly args: JsonObject;
+    readonly signal?: AbortSignal;
+}
+export type CodingEffectReconciliation = {
+    readonly status: "completed";
+    readonly result: ToolResult;
+} | {
+    readonly status: "unknown";
+};
+/**
+ * Checks only exact local postconditions. Callers retain the pending call arguments,
+ * then pass a completed result to ToolEffectStore.resolveUnknown() when this returns one.
+ */
+export declare function reconcileCodingToolEffect(input: CodingEffectReconciliationInput): Promise<CodingEffectReconciliation>;

package/dist/effects.js

@@ -0,0 +1,89 @@
+import { readFile, stat } from "node:fs/promises";
+import { Buffer } from "node:buffer";
+import { HARD_MAX_WRITE_BYTES } from "./limits.js";
+import { resolveContainedMutationPath } from "./mutation-path.js";
+export const CODING_OBSERVATION_EFFECT = { kind: "none", idempotency: "none" };
+export const CODING_LOCAL_EFFECT = { kind: "local_mutation", idempotency: "optional" };
+export const CODING_UNSUPPORTED_EFFECT = { kind: "external_mutation", idempotency: "unsupported" };
+export function classifyGitBranchEffect(args) {
+    return args.action === "list" || args.action === "validate" ? CODING_OBSERVATION_EFFECT : CODING_LOCAL_EFFECT;
+}
+export function classifyGitWorktreeEffect(args) {
+    return args.action === "list" ? CODING_OBSERVATION_EFFECT : CODING_LOCAL_EFFECT;
+}
+export function classifyGitApplyEffect(args) {
+    return args.action === "check" ? CODING_OBSERVATION_EFFECT : CODING_LOCAL_EFFECT;
+}
+/**
+ * Checks only exact local postconditions. Callers retain the pending call arguments,
+ * then pass a completed result to ToolEffectStore.resolveUnknown() when this returns one.
+ */
+export async function reconcileCodingToolEffect(input) {
+    input.signal?.throwIfAborted();
+    const completed = () => ({
+        status: "completed",
+        result: {
+            toolCallId: input.record.toolCallId,
+            name: input.record.toolName,
+            content: [{ type: "text", text: "Local tool postcondition verified." }],
+            value: { reconciled: true },
+        },
+    });
+    try {
+        if (input.record.toolName === "write") {
+            const path = stringArg(input.args, "path");
+            const content = stringArg(input.args, "content");
+            if (path === undefined || content === undefined || Buffer.byteLength(content, "utf8") > HARD_MAX_WRITE_BYTES)
+                return { status: "unknown" };
+            const target = await resolveContainedMutationPath(input.cwd, path);
+            const expected = Buffer.from(content, "utf8");
+            if ((await stat(target)).size !== expected.length)
+                return { status: "unknown" };
+            return (await readFile(target)).equals(expected) ? completed() : { status: "unknown" };
+        }
+        if (input.record.toolName === "delete") {
+            const path = stringArg(input.args, "path");
+            if (path === undefined)
+                return { status: "unknown" };
+            await resolveContainedMutationPath(input.cwd, path, { allowMissing: true });
+            return (await missing(input.cwd, path)) ? completed() : { status: "unknown" };
+        }
+        if (input.record.toolName === "move") {
+            const from = stringArg(input.args, "from");
+            const to = stringArg(input.args, "to");
+            if (from === undefined || to === undefined)
+                return { status: "unknown" };
+            await Promise.all([
+                resolveContainedMutationPath(input.cwd, from, { allowMissing: true }),
+                resolveContainedMutationPath(input.cwd, to, { allowMissing: true }),
+            ]);
+            if (await missing(input.cwd, from)) {
+                try {
+                    await resolveContainedMutationPath(input.cwd, to);
+                    return completed();
+                }
+                catch {
+                    return { status: "unknown" };
+                }
+            }
+        }
+    }
+    catch {
+        // Containment/read failure is not proof that an effect did not happen.
+    }
+    return { status: "unknown" };
+}
+function stringArg(args, name) {
+    const value = args[name];
+    return typeof value === "string" ? value : undefined;
+}
+async function missing(cwd, path) {
+    try {
+        await resolveContainedMutationPath(cwd, path);
+        return false;
+    }
+    catch (error) {
+        return error.code === "ENOENT" || error.code === "ENOTDIR";
+    }
+}
+//# sourceMappingURL=effects.js.map

package/dist/git-tools.js

@@ -1,4 +1,5 @@
 import { createCodingCheckTool } from "./checks.js";
+import { classifyGitApplyEffect, classifyGitBranchEffect, classifyGitWorktreeEffect, CODING_LOCAL_EFFECT, CODING_OBSERVATION_EFFECT, CODING_UNSUPPORTED_EFFECT, } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { createGitOperations, GitError, } from "./git.js";
 function errorResult(toolName, toolCallId, message) {
@@ -39,6 +40,7 @@ export function createGitStatusTool(cwd, options) {
     const getOps = opsFactory(cwd, options);
     return {
         name: "git_status",
+        effect: CODING_OBSERVATION_EFFECT,
         description: "Return structured Git status (porcelain v2) including branch metadata and dirty-state. Does not follow shell; paths are repository-relative.",
         parameters: {
             type: "object",
@@ -84,6 +86,7 @@ export function createGitDiffTool(cwd, options) {
     const getOps = opsFactory(cwd, options);
     return {
         name: "git_diff",
+        effect: CODING_OBSERVATION_EFFECT,
         description: "Return a bounded unified diff (--no-ext-diff --no-textconv). Large diffs truncate inline and may spill through the host artifact writer.",
         parameters: {
             type: "object",
@@ -138,6 +141,7 @@ export function createGitBranchTool(cwd, options) {
     const getOps = opsFactory(cwd, options);
     return {
         name: "git_branch",
+        effect: classifyGitBranchEffect,
         description: "Validate, list, create, or switch branches. Switch refuses a dirty worktree unless createCheckpoint=true.",
         exclusive: true,
         parameters: {
@@ -208,6 +212,7 @@ export function createGitWorktreeTool(cwd, options) {
     const getOps = opsFactory(cwd, options);
     return {
         name: "git_worktree",
+        effect: classifyGitWorktreeEffect,
         description: "List, add, or remove Git worktrees within finite caps. Prefer disposable worktrees for mutating transactions.",
         exclusive: true,
         parameters: {
@@ -269,6 +274,7 @@ export function createGitApplyTool(cwd, options) {
     const getOps = opsFactory(cwd, options);
     return {
         name: "git_apply",
+        effect: classifyGitApplyEffect,
         description: "Check, apply, or reverse a unified patch. Always runs apply --check first for apply/reverse. Dirty trees require createCheckpoint=true; failures restore the checkpoint or clean tree.",
         exclusive: true,
         parameters: {
@@ -336,6 +342,7 @@ export function createGitCommitTool(cwd, options) {
     const getOps = opsFactory(cwd, options);
     return {
         name: "git_commit",
+        effect: CODING_LOCAL_EFFECT,
         description: "Stage and commit explicit paths only (never `git add -A`). Refuses dirty unrelated worktrees unless createCheckpoint=true. Uses --no-verify and a temp message file; never pushes.",
         exclusive: true,
         parameters: {
@@ -395,6 +402,7 @@ export function createGitPrHandoffTool(cwd, options) {
     const getOps = opsFactory(cwd, options);
     return {
         name: "git_pr_handoff",
+        effect: CODING_UNSUPPORTED_EFFECT,
         description: "Build a bounded host-owned PR handoff payload (base/head/commits/paths/diffstat/checks/artifact). Never pushes, authenticates, or opens a PR.",
         exclusive: true,
         parameters: {

package/dist/glob.js

@@ -1,3 +1,4 @@
+import { CODING_OBSERVATION_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { HARD_MAX_REPO_DEPTH, HARD_MAX_REPO_RESULTS, validateCodingLimit, validateCodingLimitAllowZero } from "./limits.js";
 import { createLocalRepositoryOperations, RepositoryError, resolveRepositoryLimits, } from "./repository.js";
@@ -30,6 +31,7 @@ export function createGlobTool(cwd, options) {
     const ops = options?.operations ?? createLocalRepositoryOperations(limits);
     return {
         name: "glob",
+        effect: CODING_OBSERVATION_EFFECT,
         description: `Find workspace files by glob pattern without shell find. Supports * (segment), ? (one char), and ** (directories). Brace expansion is rejected. Skips hidden names and excluded basenames (default: ${limits.exclude.join(", ")}) unless overridden. Does not follow symlinks. Results paginate with offset/maxResults (default ${limits.maxResults}). Depth default ${limits.maxDepth}. Prefer repo_list to enumerate directories and repo_search to find text inside files.`,
         parameters: {
             type: "object",

package/dist/index.d.ts

@@ -9,6 +9,8 @@ export type { CodingArtifactKind, CodingArtifactRef, CodingCheckpointLimitOption
 export { assertCodingResumeAllowed, buildCodingCheckpointMetadata, CODING_CHECKPOINT_SCHEMA_VERSION, CODING_STATE_KEY, CodingCheckpointError, codingCheckpointStatePatch, codingPlanPathForTask, createCodingArtifactRef, createCodingPlanMarkdown, fingerprintJson, parseCodingPlanTodos, readCodingCheckpointFromState, readCodingPlanFile, resolveCodingCheckpointLimits, validateCodingCheckpointMetadata, verifyCodingArtifactBytes, writeCodingPlanFile, } from "./coding-checkpoint.js";
 export type { Edit, EditOperations, EditToolDetails, EditToolOptions } from "./edit.js";
 export { createEditTool } from "./edit.js";
+export type { CodingEffectReconciliation, CodingEffectReconciliationInput } from "./effects.js";
+export { classifyGitApplyEffect, classifyGitBranchEffect, classifyGitWorktreeEffect, CODING_LOCAL_EFFECT, CODING_OBSERVATION_EFFECT, CODING_UNSUPPORTED_EFFECT, reconcileCodingToolEffect, } from "./effects.js";
 export type { ArtifactReference, ArtifactWriter, BoundGitRunner, CreateGitOperationsOptions, CreateGitRunnerOptions, GitExecRequest, GitExecResult, GitLimitOptions, GitOperations, GitRunner, GitStatusBranch, GitStatusEntry, GitStatusEntryKind, GitStatusResult, PrHandoff, ResolvedGitLimits, } from "./git.js";
 export { createBoundGitRunner, createGitOperations, GitError, parsePorcelainV2, resolveGitLimits, runGitCli, SAFE_GIT_CONFIG_ARGS, SAFE_GIT_ENV, } from "./git.js";
 export type { GitToolsOptions } from "./git-tools.js";

package/dist/index.js

@@ -10,6 +10,7 @@ export { createCodingCheckTool } from "./checks.js";
 export { createDeleteTool } from "./delete.js";
 export { assertCodingResumeAllowed, buildCodingCheckpointMetadata, CODING_CHECKPOINT_SCHEMA_VERSION, CODING_STATE_KEY, CodingCheckpointError, codingCheckpointStatePatch, codingPlanPathForTask, createCodingArtifactRef, createCodingPlanMarkdown, fingerprintJson, parseCodingPlanTodos, readCodingCheckpointFromState, readCodingPlanFile, resolveCodingCheckpointLimits, validateCodingCheckpointMetadata, verifyCodingArtifactBytes, writeCodingPlanFile, } from "./coding-checkpoint.js";
 export { createEditTool } from "./edit.js";
+export { classifyGitApplyEffect, classifyGitBranchEffect, classifyGitWorktreeEffect, CODING_LOCAL_EFFECT, CODING_OBSERVATION_EFFECT, CODING_UNSUPPORTED_EFFECT, reconcileCodingToolEffect, } from "./effects.js";
 export { createBoundGitRunner, createGitOperations, GitError, parsePorcelainV2, resolveGitLimits, runGitCli, SAFE_GIT_CONFIG_ARGS, SAFE_GIT_ENV, } from "./git.js";
 export { createGitApplyTool, createGitBranchTool, createGitCommitTool, createGitDiffTool, createGitPrHandoffTool, createGitStatusTool, createGitTools, createGitWorktreeTool, } from "./git-tools.js";
 export { CODING_GOAL_VERIFY_REVISION, CODING_GOAL_VERIFY_SUSPEND_REASON, CODING_GOAL_VERIFY_WORKFLOW_ID, CodingGoalVerifyError, createCodingGoalVerifyWorkflow, runCodingGoalVerify, } from "./goal-verify.js";

package/dist/list.js

@@ -1,3 +1,4 @@
+import { CODING_OBSERVATION_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { HARD_MAX_REPO_DEPTH, HARD_MAX_REPO_RESULTS, validateCodingLimit, validateCodingLimitAllowZero } from "./limits.js";
 import { createLocalRepositoryOperations, RepositoryError, resolveRepositoryLimits, } from "./repository.js";
@@ -33,6 +34,7 @@ export function createRepoListTool(cwd, options) {
     const ops = options?.operations ?? createLocalRepositoryOperations(limits);
     return {
         name: "repo_list",
+        effect: CODING_OBSERVATION_EFFECT,
         description: `List repository entries under the workspace with deterministic relative paths. Prefer glob when you already know a filename pattern (*.ts, **/src/**). Prefer repo_search to find text inside files. Skips hidden names and excluded basenames (default: ${limits.exclude.join(", ")}) unless overridden. Does not follow symlinks. Results paginate with offset/maxResults (default ${limits.maxResults}). Depth default ${limits.maxDepth}.`,
         parameters: {
             type: "object",

package/dist/move.js

@@ -2,6 +2,7 @@ import { access, constants } from "node:fs";
 import { dirname } from "node:path";
 import { lstat, rename, unlink } from "node:fs/promises";
 import { promisify } from "node:util";
+import { CODING_LOCAL_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { withFileMutationQueue } from "./file-mutation-queue.js";
 import { resolveContainedMutationPath } from "./mutation-path.js";
@@ -36,6 +37,7 @@ export function createMoveTool(cwd, options) {
     const ops = options?.operations ?? defaultMoveOperations;
     return {
         name: "move",
+        effect: CODING_LOCAL_EFFECT,
         description: "High-risk: move or rename a file within the workspace. Set overwrite=true to replace an existing destination file only (directories/non-empty dest rejected). Does not create parent directories. No trash — host undo is not automatic.",
         parameters: {
             type: "object",

package/dist/read.js

@@ -23,6 +23,7 @@ import { Buffer } from "node:buffer";
 import { constants } from "node:fs";
 import { access as fsAccess, stat as fsStat, open } from "node:fs/promises";
 import { readFileBounded } from "./bounded-file.js";
+import { CODING_OBSERVATION_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { DEFAULT_MAX_BYTES, DEFAULT_MAX_IMAGE_BYTES, DEFAULT_MAX_LINES, DEFAULT_MAX_TEXT_SCAN_BYTES, HARD_MAX_BYTES, HARD_MAX_IMAGE_BYTES, HARD_MAX_LINES, HARD_MAX_TEXT_SCAN_BYTES, validateCodingLimit, } from "./limits.js";
 import { resolveReadPathAsync } from "./path-utils.js";
@@ -307,6 +308,7 @@ export function createReadTool(cwd, options) {
     const maxScanBytes = validateCodingLimit("maxScanBytes", options?.maxScanBytes ?? DEFAULT_MAX_TEXT_SCAN_BYTES, HARD_MAX_TEXT_SCAN_BYTES);
     return {
         name: "read",
+        effect: CODING_OBSERVATION_EFFECT,
         description: `Read the contents of a file. Supports text files and images (jpg, png, gif, webp, bmp); images are returned as image content. For text files, output is truncated to ${maxLines} lines or ${maxBytes / 1024}KB (whichever is hit first). When truncated, continue with the suggested offset until complete. Prefer repo_search to find text across many files.`,
         parameters: {
             type: "object",

package/dist/search.js

@@ -1,3 +1,4 @@
+import { CODING_OBSERVATION_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { HARD_MAX_SEARCH_CONTEXT_LINES, HARD_MAX_SEARCH_MATCHES, validateCodingLimit, validateCodingLimitAllowZero } from "./limits.js";
 import { createLocalRepositoryOperations, RepositoryError, resolveRepositoryLimits, } from "./repository.js";
@@ -101,6 +102,7 @@ export function createRepoSearchTool(cwd, options) {
     const ops = options?.operations ?? createLocalRepositoryOperations(limits);
     return {
         name: "repo_search",
+        effect: CODING_OBSERVATION_EFFECT,
         description: `Search text files under the workspace using literal substring match. Use outputMode "files_with_matches" for paths only or "count" for totals without line bodies. Skips binary files, excluded basenames (default: ${limits.exclude.join(", ")}), and hidden names unless includeHidden is true. Does not follow symlinks. Caps matches/scanned bytes/time.`,
         parameters: {
             type: "object",

package/dist/shell.js

@@ -23,6 +23,7 @@
 import { spawn } from "node:child_process";
 import { constants, existsSync } from "node:fs";
 import { access as fsAccess } from "node:fs/promises";
+import { CODING_UNSUPPORTED_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, DEFAULT_MAX_TOTAL_OUTPUT_BYTES, DEFAULT_SHELL_TIMEOUT_SECONDS, HARD_MAX_BYTES, HARD_MAX_LINES, HARD_MAX_TOTAL_OUTPUT_BYTES, HARD_SHELL_TIMEOUT_SECONDS, validateCodingLimit, } from "./limits.js";
 import { OutputAccumulator } from "./output-accumulator.js";
@@ -264,6 +265,7 @@ export function createShellTool(cwd, options) {
     const tempFilePrefix = options?.tempFilePrefix ?? "prism-shell";
     return {
         name: "shell",
+        effect: CODING_UNSUPPORTED_EFFECT,
         exclusive: true,
         description: `Execute a shell command in the current working directory. Returns combined stdout and stderr. Prefer repo_list, repo_search, glob, read, write, edit, delete, or move for those jobs — use shell only when no dedicated tool fits. Output is truncated to the last ${maxLines} lines or ${maxBytes / 1024}KB and capped at ${formatSize(maxTotalOutputBytes)} total. Truncated successful output is saved to a temp file. Timeout defaults to ${defaultTimeout} seconds.`,
         parameters: {

package/dist/write.js

@@ -18,6 +18,7 @@ import { Buffer } from "node:buffer";
 import { mkdir as fsMkdir } from "node:fs/promises";
 import { dirname } from "node:path";
 import { atomicWriteUtf8File } from "./atomic-write.js";
+import { CODING_LOCAL_EFFECT } from "./effects.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { withFileMutationQueue } from "./file-mutation-queue.js";
 import { DEFAULT_MAX_WRITE_BYTES, HARD_MAX_WRITE_BYTES, validateCodingLimit } from "./limits.js";
@@ -45,6 +46,7 @@ export function createWriteTool(cwd, options) {
     const maxInputBytes = validateCodingLimit("maxInputBytes", options?.maxInputBytes ?? DEFAULT_MAX_WRITE_BYTES, HARD_MAX_WRITE_BYTES);
     return {
         name: "write",
+        effect: CODING_LOCAL_EFFECT,
         description: "Create or overwrite a file (full replace). Creates parent directories. Prefer edit for targeted changes. When the host enabled requireReadBeforeWrite, read the path first or pass force=true to override.",
         parameters: {
             type: "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism-coding-agent",
-  "version": "0.0.22",
+  "version": "0.0.24",
   "description": "Optional coding-agent tools (shell, read, write, edit, repo_list, repo_search, glob, delete, move, opt-in Git/check/ask-user-decision, and durable plan/checkpoint helpers) package for Prism.",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,8 +28,8 @@
     "diff": "^9.0.0"
   },
   "peerDependencies": {
-    "@arnilo/prism": "0.0.22",
-    "@arnilo/prism-workflows": "0.0.22"
+    "@arnilo/prism": "0.0.24",
+    "@arnilo/prism-workflows": "0.0.24"
   },
   "devDependencies": {
     "@arnilo/prism": "file:../..",