@arnilo/prism 0.0.7 → 0.0.10

package/CHANGELOG.md

@@ -1,10 +1,58 @@
 # Changelog
 
-All notable changes to this project will be documented in this file.
-
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+All notable changes to this project will be documented in this file.
+
+## [0.0.10] - 2026-07-21
+
+### Changed
+
+- Coding harness workspace modes (Phase 5): required `workspaceMode` on `@arnilo/prism-coding-security` composition; sandbox mode unifies shell/FS on one disposable tree; host mode never claims containment; fail-closed mixed wiring + `allowMixedWorkspaceWiring` escape hatch; import/export tree identity; `scripts/benchmark-0.0.10.mjs` evidence.
+- Versioned all 32 first-party manifests and exact internal ranges from the post-ship `0.0.96` graph to `0.0.10` for the roadmap Phase 5 release line.
+
+## [0.0.96] - 2026-07-21
+
+### Changed
+
+- Package graph and runtime version pins bumped from 0.0.9 to 0.0.96 for a clean publish tag after the mistaken `v0.0.95` tag and TypeScript 7 / workspace-order CI fixes.
+
+## [0.0.9] - 2026-07-21
+
+### Added
+
+- Production coding and browser execution for Release 0.0.9: disposable Docker sandbox, bounded native repository list/search, structured Git/named checks/PR handoff, durable coding-plan/checkpoint composition, and optional `@arnilo/prism-browser` with egress/side-effect/upload/download/screenshot policy.
+- Versioned all 32 first-party manifests and exact internal ranges to 0.0.9 (adds `@arnilo/prism-browser` to the publishable graph; browser stays out of `@arnilo/prism-code` and activates only through explicit install or `@arnilo/prism-all`).
+- Added network-free coding/browser adversarial evaluation fixtures, `scripts/benchmark-0.0.9.mjs`, and protected Docker/Playwright gates via `.github/workflows/sandbox-browser.yml`.
+- Office execution remains outside Prism packaging by product decision (host-selected skills/instructions only).
+- `tryParseJsonObjectArguments` and `toolCallFromArgumentsText` for recoverable streamed tool-call argument parsing.
+
+### Fixed
+
+- Malformed streamed tool-call arguments (id+name present) become failed/`tool_execution_blocked` tool results (`invalid_arguments` / `invalid_json_arguments`) instead of terminal `ProviderTransportError`, so models can self-correct within existing turn budgets.
+- Incomplete tool-call deltas (missing id/name) fail with typed `ProviderTransportError` / `ErrorInfo.code: "incomplete_delta"` instead of a bare `Error("Incomplete tool call delta...")`; openai-compatible streams no longer emit `done` alongside leftover incomplete deltas.
+- Empty/whitespace-only call-free artifact candidates (including thinking-only output) are `parse_error` through the revision budget; `generate-validate-revise` session runs no longer resolve `succeeded` without `artifact_finished`.
+
+## [0.0.8] - 2026-07-20
+
+### Added
+
+- Added OpenTelemetry GenAI agent/provider/tool hierarchy, context propagation, delegation/guardrail spans, bounded trace references, and evaluation linkage.
+- Added bounded evaluation trace resolution, host model judges, deterministic pairwise reports, serialized artifacts, and CI threshold assertions.
+- Added MCP resources/prompts/roots/sampling/elicitation plus principal-bound Streamable HTTP sessions on pinned SDK 1.29.0, and full A2A 1.0 durable task/rich-part/reconnect/push interoperability.
+- Added immutable-revision CodeQL/dependency/SBOM/license/secret/attestation release gates, weekly dependency updates, and protected bounded provider/MCP/A2A/web live canaries.
+- Added optional `@arnilo/prism-web-tools` with bounded host-selected Brave/Exa search, Firecrawl Markdown/schema extraction, stable citations, late credentials, and explicit untrusted-content results.
+- Added optional `createBatchedRunLedger()` with bounded FIFO/backpressure, explicit durability/flush status, terminal acknowledgement, and documented buffered crash-loss semantics.
+- Added one-leaf, one-second runtime session snapshot caching with mutation/checkout/resume invalidation and reproducible network-free 0.0.8 performance evidence.
+- Versioned all 31 first-party manifests and exact internal ranges to 0.0.8; no tag or publication was created.
+
+### Fixed
+
+- `generateValidateReviseLoop` routes artifact parse failures through the revision budget (`metadata.reason: "parse_error"`, repairer receives `value: undefined`) instead of returning silently after one provider turn.
+- `@arnilo/prism-provider-opencode-go` Anthropic route sends provider-owned `x-api-key` and `anthropic-version: 2023-06-01` headers alongside Bearer, fixing HTTP 401 on MiniMax/Qwen models; `structuredOutput: "json_schema"` is no longer inferred from OpenAI routing alone (verified models only), fixing HTTP 400 on `deepseek-v4-pro`; both stream parsers require protocol completion evidence and fail truncated streams with a terminal `error` instead of a false `done`.
+- `@arnilo/prism-provider-kimi` aligns with official contracts: featured Coding `k3` defaults `reasoning_effort: "high"`, 256K-class context windows use the exact `262_144`, the featured Moonshot catalog adds `kimi-k2.7-code-highspeed`/`kimi-k2.6`/`kimi-k2.5`, routing keys (`route`, `preserve_thinking`) no longer leak into wire bodies, the Coding route sends provider-owned `x-api-key`/`anthropic-version` headers, and both stream parsers fail truncated streams instead of emitting `done`.
+
 ## [0.0.7] - 2026-07-19
 
 ### Added

package/README.md

@@ -53,6 +53,7 @@ npm install @arnilo/prism-sdk @arnilo/prism-provider-openai  # application profi
 npm install @arnilo/prism-all                               # every first-party package
 npm install @arnilo/prism-server @arnilo/prism-workflows    # optional Web API boundary
 npm install @arnilo/prism-supervisor                         # optional local delegation + A2A 1.0
+npm install @arnilo/prism-web-tools                          # optional bounded Brave/Exa/Firecrawl research
 ```
 
 See [docs/release-and-install.md](docs/release-and-install.md) for install
@@ -157,6 +158,7 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-mcp` | MCP client/tool bridge |
 | `@arnilo/prism-workflows` | bounded DAG workflows, durable suspend/resume, schedules/background runs, composition/state/replay, and multi-process coordination |
 | `@arnilo/prism-supervisor` | bounded local child delegation and A2A 1.0 interoperability |
+| `@arnilo/prism-web-tools` | host-selected bounded Brave/Exa search and Firecrawl Markdown/schema extraction |
 | `@arnilo/prism-observability-opentelemetry` | optional OpenTelemetry adapter |
 | `@arnilo/prism-credentials-node` | encrypted-file and keychain credentials |
 | `@arnilo/prism-session-store-sqlite` | SQLite persistence/checkpoints/leases/owned run feedback |
@@ -166,7 +168,7 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-base` | profile: core + compaction + JSON Schema validation |
 | `@arnilo/prism-code` | profile: base + coding tools/security + MCP |
 | `@arnilo/prism-sdk` | profile: base + workflows + MCP + credentials + OpenTelemetry |
-| `@arnilo/prism-all` | every first-party package, including both persistence adapters |
+| `@arnilo/prism-all` | every first-party package, including both persistence adapters and web tools |
 
 ## Scripts
 

package/dist/agent-loops.js

@@ -111,15 +111,21 @@ export function generateValidateReviseLoop(opts) {
                     .filter((b) => b.type === "text")
                     .map((b) => b.text)
                     .join("");
-                const parsed = opts.parser
-                    ? await opts.parser(text, artifactCtx)
-                    : { ok: true, value: text };
-                // Parse failure ends the loop silently (terminal parse errors stay on `error`).
-                if (!parsed.ok || parsed.value === undefined)
-                    return usage;
+                // Empty/whitespace-only call-free output is a parse failure (thinking-only
+                // models must not succeed with an empty artifact via the identity parser).
+                const parsed = text.trim() === ""
+                    ? { ok: false, error: "no artifact text in model output" }
+                    : opts.parser
+                        ? await opts.parser(text, artifactCtx)
+                        : { ok: true, value: text };
+                // Parse failure consumes revision budget like a validation failure; the
+                // repairer receives `undefined` value plus a synthetic parse issue.
+                const parseFailure = !parsed.ok || parsed.value === undefined
+                    ? { ok: false, errors: [{ path: "$", message: parsed.error ?? "artifact parse failed" }], metadata: { reason: "parse_error" } }
+                    : undefined;
                 const attempt = ++attempts;
                 ctx.emit({ type: "artifact_validation_started", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt });
-                const result = await opts.validator(parsed.value, artifactCtx);
+                const result = parseFailure ?? await opts.validator(parsed.value, artifactCtx);
                 ctx.emit({ type: "artifact_validation_finished", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt, result });
                 if (result.ok) {
                     ctx.emit({ type: "artifact_finished", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt, result });
@@ -130,7 +136,7 @@ export function generateValidateReviseLoop(opts) {
                     return usage;
                 }
                 ctx.emit({ type: "artifact_revision_started", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt, failure: result });
-                const repair = await repairer(parsed.value, result, artifactCtx);
+                const repair = await repairer(parseFailure ? undefined : parsed.value, result, artifactCtx);
                 const repairMessages = inputMessages(repair).map((m) => ({ ...m, id: randomId("msg") }));
                 for (const message of repairMessages)
                     await ctx.appendMessage(message);

package/dist/agents.js

@@ -12,6 +12,7 @@ import { errorToErrorInfo, redactAgentEvent, redactProviderRequest, redactRunLed
 import { composeSystemPrompt, mergeSystemPromptConfig } from "./system-prompts.js";
 import { createDefaultRetryPolicy, waitForRetry } from "./retry.js";
 import { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, rebuildSessionContext } from "./session-stores.js";
+import { isFlushableRunLedger } from "./run-ledger.js";
 import { createToolRegistry, dispatchToolCall } from "./tools.js";
 import { RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
 import { agentFingerprint, initialAgentRunState, loadAgentRunState, publicState, saveAgentRunState, validateRunStateOptions } from "./agent-run-state.js";
@@ -103,6 +104,8 @@ class RuntimeAgentSession {
     activeLoopTurn = 1;
     ledgerChain = Promise.resolve();
     ledgerFailure;
+    snapshotGeneration = 0;
+    snapshotCache;
     constructor(config) {
         this.id = config.id ?? randomId("session");
         this.agent = config.agent;
@@ -168,6 +171,8 @@ class RuntimeAgentSession {
         this.activeIdempotencyKey = options.idempotencyKey ?? this.agent.config.idempotencyKey;
         this.activeGuardrails = mergeGuardrails(this.agent.config.guardrails, options.guardrails);
         this.activeDurable = resumed ?? (durableOptions ? { options: durableOptions, version: 0 } : undefined);
+        if (resumed)
+            this.invalidateSnapshot();
         const model = options.model ?? this.agent.config.model;
         const startedAt = new Date().toISOString();
         let runError;
@@ -269,6 +274,8 @@ class RuntimeAgentSession {
             };
             // ponytail: LoopContext binds existing private helpers; loop orchestrates only.
             let assembledTurn = false;
+            let artifactFinished = false;
+            let artifactFailedInfo;
             const ctx = {
                 sessionId: this.id,
                 runId,
@@ -363,6 +370,16 @@ class RuntimeAgentSession {
                 emit: (event) => {
                     if (event.type === "turn_started")
                         this.activeLoopTurn = event.turn;
+                    if (event.type === "artifact_finished")
+                        artifactFinished = true;
+                    if (event.type === "artifact_failed") {
+                        const first = event.result.errors?.[0];
+                        const reason = event.result.metadata?.reason;
+                        artifactFailedInfo = {
+                            message: first?.message ?? "artifact failed",
+                            code: typeof reason === "string" || typeof reason === "number" ? reason : "artifact_failed",
+                        };
+                    }
                     this.emit(event);
                 },
             };
@@ -375,6 +392,9 @@ class RuntimeAgentSession {
                 });
             }
             const loopUsage = await loop.run(ctx);
+            if (loop.name === "generate-validate-revise" && !artifactFinished) {
+                throw Object.assign(new Error(artifactFailedInfo?.message ?? "artifact loop ended without a validated artifact"), { name: "ArtifactFailed", code: artifactFailedInfo?.code ?? "artifact_failed" });
+            }
             usage = runUsage.value() ?? loopUsage;
             if (usage && this.activeLedger) {
                 const usageRecord = {
@@ -442,6 +462,8 @@ class RuntimeAgentSession {
                         ...this.activeOwnership,
                     };
                     await this.activeLedger.appendRun(redactRunLedgerRecord(finishRecord, this.activeRedactor));
+                    if (isFlushableRunLedger(this.activeLedger) && this.activeLedger.durability === "flush_on_terminal")
+                        await this.activeLedger.flush();
                 }
             }
             finally {
@@ -570,6 +592,7 @@ class RuntimeAgentSession {
     }
     async checkout(leafId) {
         this.currentLeafId = leafId;
+        this.invalidateSnapshot();
         await this.rebuildHistory();
     }
     fork(options = {}) {
@@ -853,6 +876,11 @@ class RuntimeAgentSession {
             idempotencyKey: this.activeIdempotencyKey,
         });
         this.currentLeafId = redacted.id;
+        this.invalidateSnapshot();
+    }
+    invalidateSnapshot() {
+        this.snapshotGeneration += 1;
+        this.snapshotCache = undefined;
     }
     redact(value) {
         return this.activeRedactor?.redact(value) ?? value;
@@ -864,10 +892,16 @@ class RuntimeAgentSession {
         this.history = (await this.snapshot()).messages.slice();
     }
     async snapshot() {
+        const now = performance.now();
+        const cached = this.snapshotCache;
+        if (cached && cached.leafId === this.currentLeafId && cached.generation === this.snapshotGeneration && cached.expiresAt > now)
+            return cached.value;
         const reader = this.branchReader();
-        return reader
-            ? rebuildSessionContext(reader, { sessionId: this.id, leafId: this.currentLeafId })
+        const value = reader
+            ? await rebuildSessionContext(reader, { sessionId: this.id, leafId: this.currentLeafId })
             : rebuildSessionContext(await this.store.list(this.id), { leafId: this.currentLeafId });
+        this.snapshotCache = { leafId: this.currentLeafId, generation: this.snapshotGeneration, expiresAt: now + 1_000, value };
+        return value;
     }
 }
 class EventSubscriber {
@@ -980,7 +1014,7 @@ function policyList(policies) {
     return "apply" in policies ? [policies] : policies;
 }
 function errorFromInfo(error) {
-    return Object.assign(new Error(error.message), { name: error.name ?? "Error", cause: error.cause });
+    return Object.assign(new Error(error.message), { name: error.name ?? "Error", cause: error.cause, code: error.code });
 }
 class ProviderTurnFailure extends Error {
     info;

package/dist/contracts.d.ts

@@ -49,6 +49,8 @@ export interface ToolCallContent {
     readonly id: string;
     readonly name: string;
     readonly arguments: JsonObject;
+    /** Set when streamed arguments failed JSON parse; dispatch blocks without execute(). */
+    readonly argumentsError?: ErrorInfo;
 }
 export interface ToolResultContent {
     readonly type: "tool_result";
@@ -1278,6 +1280,21 @@ export interface RunLedger {
 }
 /** Union of records that may be handed to a {@link RunLedger}. */
 export type RunLedgerRecord = RunRecord | AgentEventRecord | ToolCallRecord | UsageRecord;
+export type RunLedgerDurability = "write_through" | "flush_on_terminal" | "buffered";
+export interface RunLedgerFlushResult {
+    readonly accepted: number;
+    readonly flushed: number;
+    readonly buffered: number;
+}
+/** Optional durability seam implemented by bounded ledger adapters. */
+export interface FlushableRunLedger extends RunLedger {
+    readonly durability: RunLedgerDurability;
+    flush(): Promise<RunLedgerFlushResult>;
+    status(): RunLedgerFlushResult;
+    dispose(options?: {
+        readonly flush?: boolean;
+    }): Promise<void>;
+}
 /** Immutable human feedback linked to an existing owned run/trace and optional evaluations. */
 export interface RunFeedbackRecord extends OwnershipScope {
     readonly id: string;

package/dist/index.d.ts

@@ -2,6 +2,8 @@ export type * from "./contracts.js";
 export type { RunLimitCounters, RunLimitName, SecureAgentOptions } from "./contracts.js";
 export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError, AgentRunStateError } from "./contracts.js";
 export { createAgent, createAgentSession, resumeAgentRun } from "./agents.js";
+export { createBatchedRunLedger, isFlushableRunLedger, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_ENTRIES, DEFAULT_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_BYTES, DEFAULT_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_DELAY_MS, } from "./run-ledger.js";
+export type { BatchedRunLedgerOptions } from "./run-ledger.js";
 export { createSecureAgent } from "./secure-agent.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, requireRunFeedbackOwnership, runFeedbackPageLimit, RunFeedbackError, } from "./feedback.js";
 export type { MemoryRunFeedbackStoreOptions, PrepareRunFeedbackOptions, RunFeedbackLimits, RunFeedbackRun, RunFeedbackRunResolver, } from "./feedback.js";
@@ -58,7 +60,7 @@ export { createMockProvider } from "./mock-provider.js";
 export { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, listSessionBranches, rebuildSessionContext } from "./session-stores.js";
 export type { CreateSessionEntryOptions, SessionBranch, SessionBranchOptions, SessionContextSnapshot } from "./session-stores.js";
 export type { MockProviderOptions } from "./mock-provider.js";
-export { providerContentDelta, providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallContent, } from "./provider-events.js";
+export { providerContentDelta, providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallContent, toolCallFromArgumentsText, } from "./provider-events.js";
 export type { ProviderResolver } from "./contracts.js";
 export { createProviderRegistry, createProviderResolver } from "./providers.js";
 export type { ProviderRegistry, ProviderRegistryOptions } from "./providers.js";
@@ -81,5 +83,5 @@ export type { DispatchToolCallOptions, ToolArgumentValidationError, ToolArgument
 export type { DuplicateRegistrationOptions, DuplicateRegistrationPolicy } from "./registry-options.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop } from "./agent-loops.js";
 export declare const name = "prism";
-export declare const version = "0.0.7";
+export declare const version = "0.0.10";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -1,5 +1,6 @@
 export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError, AgentRunStateError } from "./contracts.js";
 export { createAgent, createAgentSession, resumeAgentRun } from "./agents.js";
+export { createBatchedRunLedger, isFlushableRunLedger, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_ENTRIES, DEFAULT_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_BYTES, DEFAULT_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_DELAY_MS, } from "./run-ledger.js";
 export { createSecureAgent } from "./secure-agent.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, requireRunFeedbackOwnership, runFeedbackPageLimit, RunFeedbackError, } from "./feedback.js";
 export { CHECKPOINT_CONFLICT_CODE, CheckpointConflictError, createMemoryCheckpointStore } from "./checkpoints.js";
@@ -32,7 +33,7 @@ export { createMiddlewareRegistry } from "./middleware.js";
 export { assembleProviderInput, createDefaultInputBuilder, createDefaultPromptBuilder, renderPromptTemplate, resolveContextProviders } from "./input.js";
 export { createMockProvider } from "./mock-provider.js";
 export { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, listSessionBranches, rebuildSessionContext } from "./session-stores.js";
-export { providerContentDelta, providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallContent, } from "./provider-events.js";
+export { providerContentDelta, providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallContent, toolCallFromArgumentsText, } from "./provider-events.js";
 export { createProviderRegistry, createProviderResolver } from "./providers.js";
 export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage, redactProviderRequest, redactRunLedgerRecord, redactSecrets, redactSessionEntry } from "./redaction.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError } from "./security.js";
@@ -44,6 +45,6 @@ export { assertGuardrailsAllowed, GuardrailError, MAX_GUARDRAIL_CONCURRENCY, run
 export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_MAX_RUN_COST, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop } from "./agent-loops.js";
 export const name = "prism";
-export const version = "0.0.7";
+export const version = "0.0.10";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/provider-events.d.ts

@@ -15,3 +15,5 @@ export declare function providerUsage(usage: Usage): ProviderEvent;
 export declare function providerDone(usage?: Usage): ProviderEvent;
 export declare function providerError(error: unknown, secrets?: readonly (string | undefined)[]): ProviderEvent;
 export declare function toolCallContent(id: string, name: string, args?: JsonObject): ToolCallContent;
+/** Build a tool call from streamed arguments text; malformed JSON becomes a blocked call (no throw). */
+export declare function toolCallFromArgumentsText(id: string, name: string, argumentsText: string): ToolCallContent;

package/dist/provider-events.js

@@ -1,3 +1,4 @@
+import { ProviderTransportError, tryParseJsonObjectArguments } from "./providers/transport.js";
 import { errorToErrorInfo } from "./redaction.js";
 export function providerTextDelta(text) {
     return { type: "content_delta", content: { type: "text", text } };
@@ -32,9 +33,10 @@ export function reconstructToolCallDeltas(events) {
         partials.set(event.index, partial);
     }
     return [...partials.entries()].sort(([a], [b]) => a - b).map(([index, partial]) => {
-        if (!partial.id || !partial.name)
-            throw new Error(`Incomplete tool call delta at index ${index}`);
-        return toolCallContent(partial.id, partial.name, parseToolCallArguments(partial.argumentsText, index));
+        if (!partial.id || !partial.name) {
+            throw new ProviderTransportError("incomplete_delta", `Incomplete tool call delta at index ${index}`);
+        }
+        return toolCallFromArgumentsText(partial.id, partial.name, partial.argumentsText);
     });
 }
 export function providerUsage(usage) {
@@ -50,15 +52,21 @@ export function providerError(error, secrets = []) {
 export function toolCallContent(id, name, args = {}) {
     return { type: "tool_call", id, name, arguments: args };
 }
-function parseToolCallArguments(text, index) {
-    try {
-        const value = text ? JSON.parse(text) : {};
-        if (!value || typeof value !== "object" || Array.isArray(value))
-            throw new Error("not object");
-        return value;
-    }
-    catch (error) {
-        throw new Error(`Invalid tool call arguments at index ${index}: ${error instanceof Error ? error.message : String(error)}`);
-    }
+/** Build a tool call from streamed arguments text; malformed JSON becomes a blocked call (no throw). */
+export function toolCallFromArgumentsText(id, name, argumentsText) {
+    const parsed = tryParseJsonObjectArguments(argumentsText, { toolName: name });
+    if (parsed.ok)
+        return toolCallContent(id, name, parsed.value);
+    return {
+        type: "tool_call",
+        id,
+        name,
+        arguments: {},
+        argumentsError: {
+            name: parsed.error.name,
+            message: parsed.error.message,
+            code: parsed.error.code,
+        },
+    };
 }
 //# sourceMappingURL=provider-events.js.map

package/dist/providers/openai-compatible.js

@@ -1,7 +1,7 @@
 import { resolveCredentialValue } from "../credentials.js";
-import { providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallContent, } from "../provider-events.js";
+import { providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallFromArgumentsText, } from "../provider-events.js";
 import { assertOpenAIChatMessage, applyOpenAIChatStructuredOutput, mapOpenAIChatUsage, serializeOpenAIChatMessage, serializeOpenAITool, } from "./openai-primitives.js";
-import { parseJsonObjectArguments, readBoundedResponseText, readSseData, } from "./transport.js";
+import { ProviderTransportError, readBoundedResponseText, readSseData, } from "./transport.js";
 import { assertStructuredOutputRequestSupported } from "../structured-output.js";
 export function createOpenAICompatibleProvider(options) {
     const providerId = options.id ?? "openai-compatible";
@@ -64,10 +64,13 @@ export function createOpenAICompatibleProvider(options) {
                         }
                     }
                 }
+                const incomplete = [...tools.entries()].find(([, call]) => !call.id || !call.name);
+                if (incomplete) {
+                    yield providerError(new ProviderTransportError("incomplete_delta", `Incomplete tool call delta at index ${incomplete[0]}`), secrets);
+                    return;
+                }
                 for (const call of tools.values()) {
-                    if (call.id && call.name) {
-                        yield providerToolCall(toolCallContent(call.id, call.name, parseJsonObjectArguments(call.argumentsText, { toolName: call.name })));
-                    }
+                    yield providerToolCall(toolCallFromArgumentsText(call.id, call.name, call.argumentsText));
                 }
                 yield providerDone();
             }

package/dist/providers/transport.d.ts

@@ -14,7 +14,7 @@ export interface SseEvent {
     readonly data: string;
     readonly comments?: readonly string[];
 }
-export type ProviderTransportErrorCode = "sse_buffer_overflow" | "sse_event_overflow" | "response_body_overflow" | "aborted" | "invalid_json_arguments";
+export type ProviderTransportErrorCode = "sse_buffer_overflow" | "sse_event_overflow" | "response_body_overflow" | "aborted" | "invalid_json_arguments" | "incomplete_delta";
 export declare class ProviderTransportError extends Error {
     readonly code: ProviderTransportErrorCode;
     readonly limitBytes?: number;
@@ -36,5 +36,14 @@ export declare function readSseEvents(body: ReadableStream<Uint8Array>, options?
 export declare function readSseData(body: ReadableStream<Uint8Array>, options?: ReadSseEventsOptions): AsyncGenerator<string>;
 /** Read a response body with a hard byte ceiling; redacts optional secrets. */
 export declare function readBoundedResponseText(response: Response, options?: ReadBoundedResponseTextOptions): Promise<string>;
+export type ParseJsonObjectArgumentsResult = {
+    readonly ok: true;
+    readonly value: JsonObject;
+} | {
+    readonly ok: false;
+    readonly error: ProviderTransportError;
+};
+/** Parse streamed tool arguments without throwing; prefer this for recoverable tool-call recovery. */
+export declare function tryParseJsonObjectArguments(text: string, options?: ParseJsonObjectArgumentsOptions): ParseJsonObjectArgumentsResult;
 /** Parse streamed tool arguments as a JSON object; throws {@link ProviderTransportError} on invalid input. */
 export declare function parseJsonObjectArguments(text: string, options?: ParseJsonObjectArgumentsOptions): JsonObject;

package/dist/providers/transport.js

@@ -197,25 +197,41 @@ export async function readBoundedResponseText(response, options) {
         }
     }
 }
-/** Parse streamed tool arguments as a JSON object; throws {@link ProviderTransportError} on invalid input. */
-export function parseJsonObjectArguments(text, options) {
+/** Parse streamed tool arguments without throwing; prefer this for recoverable tool-call recovery. */
+export function tryParseJsonObjectArguments(text, options) {
     const maxBytes = options?.maxBytes ?? DEFAULT_MAX_ARGUMENT_BYTES;
     const suffix = options?.toolName ? ` for tool ${options.toolName}` : "";
     if (!text)
-        return {};
+        return { ok: true, value: {} };
     if (byteLength(text) > maxBytes) {
-        throw new ProviderTransportError("invalid_json_arguments", `Tool arguments${suffix} exceeded ${maxBytes} bytes`, maxBytes);
+        return {
+            ok: false,
+            error: new ProviderTransportError("invalid_json_arguments", `Tool arguments${suffix} exceeded ${maxBytes} bytes`, maxBytes),
+        };
     }
     let parsed;
     try {
         parsed = JSON.parse(text);
     }
-    catch (error) {
-        throw new ProviderTransportError("invalid_json_arguments", `Invalid tool arguments JSON${suffix}`);
+    catch {
+        return {
+            ok: false,
+            error: new ProviderTransportError("invalid_json_arguments", `Invalid tool arguments JSON${suffix}`),
+        };
     }
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-        throw new ProviderTransportError("invalid_json_arguments", `Tool arguments${suffix} must be a JSON object`);
+        return {
+            ok: false,
+            error: new ProviderTransportError("invalid_json_arguments", `Tool arguments${suffix} must be a JSON object`),
+        };
     }
-    return parsed;
+    return { ok: true, value: parsed };
+}
+/** Parse streamed tool arguments as a JSON object; throws {@link ProviderTransportError} on invalid input. */
+export function parseJsonObjectArguments(text, options) {
+    const result = tryParseJsonObjectArguments(text, options);
+    if (!result.ok)
+        throw result.error;
+    return result.value;
 }
 //# sourceMappingURL=transport.js.map

package/dist/run-ledger.d.ts

@@ -0,0 +1,21 @@
+import type { FlushableRunLedger, RunLedger, RunLedgerDurability } from "./contracts.js";
+export declare const DEFAULT_LEDGER_BATCH_ENTRIES = 128;
+export declare const HARD_LEDGER_BATCH_ENTRIES = 4096;
+export declare const DEFAULT_LEDGER_BATCH_BYTES: number;
+export declare const HARD_LEDGER_BATCH_BYTES: number;
+export declare const DEFAULT_LEDGER_BATCH_DELAY_MS = 25;
+export declare const HARD_LEDGER_BATCH_DELAY_MS = 60000;
+export interface BatchedRunLedgerOptions {
+    readonly maxBatchEntries?: number;
+    readonly maxBatchBytes?: number;
+    readonly maxBufferedEntries?: number;
+    readonly maxBufferedBytes?: number;
+    readonly maxDelayMs?: number;
+    readonly durability?: RunLedgerDurability;
+}
+/**
+ * Wrap any RunLedger with one bounded FIFO. Inputs must already be redacted, as required by RunLedger.
+ * `buffered` may lose accepted records on process crash; call `flush()` for acknowledgement.
+ */
+export declare function createBatchedRunLedger(target: RunLedger, options?: BatchedRunLedgerOptions): FlushableRunLedger;
+export declare function isFlushableRunLedger(ledger: RunLedger): ledger is FlushableRunLedger;

package/dist/run-ledger.js

@@ -0,0 +1,115 @@
+export const DEFAULT_LEDGER_BATCH_ENTRIES = 128;
+export const HARD_LEDGER_BATCH_ENTRIES = 4096;
+export const DEFAULT_LEDGER_BATCH_BYTES = 512 * 1024;
+export const HARD_LEDGER_BATCH_BYTES = 8 * 1024 * 1024;
+export const DEFAULT_LEDGER_BATCH_DELAY_MS = 25;
+export const HARD_LEDGER_BATCH_DELAY_MS = 60_000;
+function integer(value, fallback, hard, name) {
+    const selected = value ?? fallback;
+    if (!Number.isInteger(selected) || selected < 1 || selected > hard)
+        throw new RangeError(`${name} must be an integer in [1, ${hard}]`);
+    return selected;
+}
+function terminal(record) {
+    return record.status !== undefined && record.status !== "queued" && record.status !== "running";
+}
+/**
+ * Wrap any RunLedger with one bounded FIFO. Inputs must already be redacted, as required by RunLedger.
+ * `buffered` may lose accepted records on process crash; call `flush()` for acknowledgement.
+ */
+export function createBatchedRunLedger(target, options = {}) {
+    const maxBatchEntries = integer(options.maxBatchEntries, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_ENTRIES, "maxBatchEntries");
+    const maxBatchBytes = integer(options.maxBatchBytes, DEFAULT_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_BYTES, "maxBatchBytes");
+    const maxBufferedEntries = integer(options.maxBufferedEntries, Math.min(HARD_LEDGER_BATCH_ENTRIES, maxBatchEntries * 2), HARD_LEDGER_BATCH_ENTRIES, "maxBufferedEntries");
+    const maxBufferedBytes = integer(options.maxBufferedBytes, Math.min(HARD_LEDGER_BATCH_BYTES, maxBatchBytes * 2), HARD_LEDGER_BATCH_BYTES, "maxBufferedBytes");
+    const maxDelayMs = integer(options.maxDelayMs, DEFAULT_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_DELAY_MS, "maxDelayMs");
+    const durability = options.durability ?? "flush_on_terminal";
+    const queue = [];
+    let bufferedBytes = 0;
+    let accepted = 0;
+    let flushed = 0;
+    let timer;
+    let flushChain = Promise.resolve();
+    let disposed = false;
+    const status = () => ({ accepted, flushed, buffered: queue.length });
+    const cancelTimer = () => { if (timer)
+        clearTimeout(timer); timer = undefined; };
+    const schedule = () => {
+        if (timer || disposed || queue.length === 0)
+            return;
+        timer = setTimeout(() => { timer = undefined; void flush().catch(() => undefined); }, maxDelayMs);
+        timer.unref?.();
+    };
+    const write = (item) => {
+        if (item.kind === "run")
+            return target.appendRun(item.record);
+        if (item.kind === "event")
+            return target.appendEvent(item.record);
+        if (item.kind === "tool")
+            return target.appendToolCall(item.record);
+        return target.appendUsage(item.record);
+    };
+    const flush = () => {
+        cancelTimer();
+        const operation = flushChain.then(async () => {
+            let entries = 0;
+            let bytes = 0;
+            while (queue.length) {
+                const item = queue[0];
+                if (entries && (entries >= maxBatchEntries || bytes + item.bytes > maxBatchBytes)) {
+                    entries = 0;
+                    bytes = 0;
+                }
+                await write(item);
+                queue.shift();
+                bufferedBytes -= item.bytes;
+                flushed += 1;
+                entries += 1;
+                bytes += item.bytes;
+            }
+            return status();
+        });
+        flushChain = operation.then(() => undefined, () => undefined);
+        return operation;
+    };
+    const enqueue = async (item) => {
+        if (disposed)
+            throw new Error("batched run ledger is disposed");
+        const bytes = Buffer.byteLength(JSON.stringify(item.record));
+        if (bytes > maxBatchBytes || bytes > maxBufferedBytes)
+            throw new RangeError("run ledger record exceeds byte limit");
+        if (queue.length >= maxBufferedEntries || bufferedBytes + bytes > maxBufferedBytes)
+            await flush();
+        queue.push({ ...item, bytes });
+        bufferedBytes += bytes;
+        accepted += 1;
+        if (durability === "write_through" || queue.length >= maxBatchEntries || bufferedBytes >= maxBatchBytes || (item.kind === "run" && terminal(item.record) && durability === "flush_on_terminal"))
+            await flush();
+        else
+            schedule();
+    };
+    return {
+        durability,
+        appendRun: (record) => enqueue({ kind: "run", record }),
+        appendEvent: (record) => enqueue({ kind: "event", record }),
+        appendToolCall: (record) => enqueue({ kind: "tool", record }),
+        appendUsage: (record) => enqueue({ kind: "usage", record }),
+        flush,
+        status,
+        async dispose(disposeOptions = {}) {
+            disposed = true;
+            cancelTimer();
+            if (disposeOptions.flush !== false)
+                await flush();
+            else {
+                await flushChain;
+                queue.length = 0;
+                bufferedBytes = 0;
+            }
+        },
+    };
+}
+export function isFlushableRunLedger(ledger) {
+    return "flush" in ledger && typeof ledger.flush === "function";
+}
+//# sourceMappingURL=run-ledger.js.map

package/dist/tools.js

@@ -176,6 +176,8 @@ async function checkCall(call, options, startedAt) {
         return blocked(call, context, "unknown_tool", { message: `Unknown tool: ${call.name}` }, options, startedAt);
     if (filterTools([tool], options.filter).length === 0)
         return blocked(call, context, "tool_denied", { message: `Tool denied: ${call.name}` }, options, startedAt);
+    if (call.argumentsError)
+        return blocked(call, context, "invalid_arguments", call.argumentsError, options, startedAt);
     if (!isJsonObject(call.arguments))
         return blocked(call, context, "invalid_arguments", { message: "Tool arguments must be a JSON object" }, options, startedAt);
     return undefined;