@arnilo/prism 0.5.6 → 0.7.0

package/CHANGELOG.md

@@ -1,3 +1,79 @@
+## [0.7.0] - 2026-09-15 (extended line: plans 072, 073, 074, 075, 077, 078)
+
+> **Channels are not in this cut.** Plan 079 (Telegram/Signal adapters) was reassigned to **0.8.0** so the 0.7.0 cut stops waiting on it; nothing in this release mentions or ships a channel adapter.
+
+### Added
+- **Execution timeline (plan 072).** `@arnilo/prism-core/governance/observability` ships one frozen, JSON-serializable view-model for what a run did: `projectAgentTimeline` (live `AgentEvent[]`), `projectTraceTimeline` (persisted `EvaluationTrace`), `projectWorkflowTimeline` (workflow events plus optional checkpoint), incremental `createTimelineFolder` / `createWorkflowTimelineFolder` folders for SSE/cockpit updates, and `summarizeTimeline` / `summarizeSession` rollups (tool counts capped at 64, no double counting across runs). See [docs/execution-timeline.md](docs/execution-timeline.md).
+- **Workflow graph view-model (plan 072).** `serializeWorkflowGraph`, `workflowGraphToMermaid`, `workflowGraphToDot`, `projectWorkflowGraphRun`, and `createWorkflowGraphRunFolder` render a workflow DAG and overlay live or checkpoint run state (`WorkflowGraphRunView`) without executing it.
+- **Trajectory and outcome evals (plan 072).** Scorers (`defineScorer`, pairwise preferences, model-judge budgets), `runScenario`, `runExperiment`, `runWorkflowExperiment`, dataset items with expected trajectories, trials, manifests, comparisons, and thresholds — with `runComparison` / `datasetFromRuns` curation over recorded runs.
+- **Eval primitives match their contracts (plan 073 Tasks 30–31).** Injection/timeline holes closed, deterministic `mulberry32` sampling, `collectWhileRunning`, and host-activity eval packs (coding, browser, memory, voice invariants) over the true primitives.
+- **Attention compiler (plan 074, opt-in).** `createAttentionCompiler` / `resolveInputCap` / `compileAttention` / `createAttentionTruncationTrigger`: a per-turn gate that measures the assembled input against a host ratio of the model input cap and, only past the ratio, mutates a **history clone** oldest thinking blocks first, then fold-eligible tool results — keeping cache prefixes, the session store, and the observational-memory ledger untouched, and raising `AttentionBudgetError` rather than silently dropping context. Wired through `AgentConfig`, `AgentDefinition`, and `RunOptions` (run overlay narrows), plus `attention_compiled` telemetry and an `attention` timeline step; sticky frontier persists through `persistSessionState`. See [docs/attention-compiler.md](docs/attention-compiler.md).
+- **Memory fabric subpath (plan 075, opt-in).** `@arnilo/prism-memory/fabric` adds typed notes (`fact`, `procedure`, `file`, `working`, `episode`) with links, validity windows, time/tool recall, conversation search, and opt-in consolidation/linker/evolution workers over the stores a host already configured. Inert until `fabric.attach(session)`; no new package, provider, database, or mandatory dependency. See [docs/memory-fabric.md](docs/memory-fabric.md).
+- **Work-scope memory index (plan 077, opt-in).** `createWorkScopeController` appends `om.scope.*` entries to one observational-memory ledger; `foldWorkScopeMap`, `projectWorkMemory`, and `withWorkScope` project the outline to a host-selected working set (leaf `self+ancestors` by default), auto-bind new observations to the leaf, and skip the observation dropper while any host scope exists. Caps fail closed (256 scopes, depth 8, 4,096 binds, 512-char labels). See [docs/compaction-observational-memory.md](docs/compaction-observational-memory.md).
+- **Host-owned subagent spawn (plan 078, opt-in).** `createSpawnAgentTool` turns the supervisor's host-owned child catalog into a non-exclusive `spawn_agent` whose closed schema exposes only allow-listed child ids, input, an optional thread id, and `mode: "sync" | "async"`; `createWaitAgentTool` / `createCancelAgentTool` join or abort async handles from `delegateAsync()`. Child identity narrows from the parent, results and errors are redacted, child slots are reserved atomically (after a before-hook narrows limits), and parent-run abort cancels running children. `createWorktreeChildFactory` gives each child its own linked git worktree and cleans it up on every terminal outcome (including a suspended child that later resumes), while `observeSupervisorLifecycle` bridges `delegation_*` events to redacted coding `subagent_started` / `subagent_stopped` lifecycle events. See [docs/supervisors.md](docs/supervisors.md).
+- **Governed host completeness (plan 073).** Governed provider invocation with aggregate task/tenant accounting across every paid work kind (enterprise migration `006_aggregate_budgets`); durable business-action drafts with editable approvals; Docker process sessions and coherent workspace recovery; incremental Drive knowledge synchronization; snapshot/reconnect lifecycle with a hosted E2B sandbox; fair worker admission and operator routes; cross-layer memory lineage with correction and revocation; semantic artifact review with evidence-backed citations; import-fidelity reports with optional OCR; monotonic per-run tool narrowing with remote invalidation; native Bedrock `Converse`/`ConverseStream`; and governed realtime voice orchestration. New pages: [docs/execution-timeline.md](docs/execution-timeline.md), [docs/host-compositions.md](docs/host-compositions.md), [docs/hosted-sandboxes.md](docs/hosted-sandboxes.md), [docs/knowledge-sync.md](docs/knowledge-sync.md), [docs/realtime-voice.md](docs/realtime-voice.md), [docs/attention-compiler.md](docs/attention-compiler.md), [docs/memory-fabric.md](docs/memory-fabric.md).
+- **Examples.** Runnable demos for the new surfaces: `examples/execution-timeline.ts`, `examples/behavior-evaluation.ts`, `examples/coding-browser-evaluation.ts`, `examples/attention-compiler.ts`, `examples/memory-fabric.ts`, `examples/work-scopes-coding-loop.ts`, `examples/spawn-agent-tool.ts`, `examples/governed-provider.ts`, `examples/docker-process-session.ts`, `examples/drive-rag-sync.ts`, `examples/hosted-sandbox.ts`, `examples/scanned-document-rag.ts`, and `examples/realtime-voice-host.ts`.
+
+### Changed
+- **Lockstep `0.6.0` → `0.7.0`.** All ten publishable manifests move together with `^0.7.0` internal ranges; the lockfile, the `src/index.ts` version constant, the docs index banner, the release-workflow tag lists, and the generated package-truth artifact agree (enforced by `scripts/version-literal-gate.test.mjs`).
+- **Compat baselines regenerated** (`--update-baseline`): **469 added declarations, zero removals**. The additions are the new subpath APIs above plus members added to existing declaration groups; no export was renamed or dropped.
+- **Release budgets rebaselined with recorded reasons**: root packed/unpacked/fileCount moved for the new dist modules, templates, and docs pages, and per-package export ceilings carry the 0.7.0 addition list. Startup and timing ceilings are unchanged.
+- **Migration guide for 0.6.0 hosts**: [docs/migrate-to-0.7.md](docs/migrate-to-0.7.md) (per-item actions for the ACP/model-router refusals, every tightening, the opt-in activation steps, and rollback), indexed from [docs/migration.md](docs/migration.md) and [docs/index.md](docs/index.md).
+- **Options index and peer matrix** cover the new surfaces: [docs/options-index.md](docs/options-index.md) routes `AttentionCompilerOptions`/`AttentionInputCapOptions`/`AttentionCompileOptions`/`AttentionTruncationTriggerOptions`, the fabric and work-scope option objects, and the supervisor/spawn/worktree/lifecycle options to their owning pages (gated by `scripts/live-doc-check.test.mjs`).
+
+### Fixed
+- **Task-scoped enterprise budgets failed on their first insert.** Migration `006_aggregate_budgets`' insert bound one JavaScript `Date` to both a `timestamptz` column and interval arithmetic, so PostgreSQL refused the statement with `42P08 inconsistent types deduced for parameter $8`; the parameter is now explicitly `::timestamptz` (found by the protected PostgreSQL leg, not by hermetic doubles).
+- **A serialization failure inside the budget upsert was swallowed.** The read-then-insert path caught *every* error from the `SELECT … FOR UPDATE` probe and then issued SQL against an aborted transaction (`25P02`), which defeated the retry loop; only a genuinely missing row is recoverable by inserting now.
+- **Serializable retry policy was too small for concurrent writers.** Budget/rate rewrites on one row now retry up to 12 times with full-jitter exponential backoff (capped at 250 ms), so a 16-client burst converges instead of exhausting three near-instant attempts with `ERR_PRISM_ENTERPRISE_POSTGRES_RETRYABLE`.
+- **Integration tests were stale against migration 006** (expected five migrations) and `scripts/phase27-release.test.mjs` still asserted that no `006_` migration existed; both now check the append-only list including `006_aggregate_budgets`.
+
+### Security
+- **ACP MCP destination matching (Trap A).** `mcp.allow` entries now match by WHATWG origin plus path-segment subtree: origin lookalikes (`mcp.example.com.attacker.invalid`) and sibling path prefixes (`/mcp-other`) no longer match, and allow entries carrying userinfo, query, fragment, or ambiguous encoded path forms fail `ConfigError` at parse time.
+- **Model-router facade fails closed (Trap B).** `router.providerSource(model)` throws `ERR_PRISM_MODEL_ROUTER_ASYNC_REQUIRED` / `ERR_PRISM_MODEL_ROUTER_ASYNC_STATE` instead of handing back a provider that bypasses budgets, rate limits, circuits, fallbacks, selection policies, or durable state; `isProviderSourceEligible` lets a host check first.
+- **ACP launcher requires a real provider (Trap C/R05).** No silent `createMockProvider()` fallback; mock mode is an explicit opt-in.
+- **Per-run tool narrowing is monotonic (R11)** and remote invalidation is honored; child agents cannot widen the tenant, account, user, or scopes of the parent identity (`narrowIdentity` + `assertIdentityPropagation`).
+
+### Notes
+- **Protected PostgreSQL leg now green on 0.7.0 code**: `PRISM_TEST_POSTGRES_URL=… npm run test:postgres` passes core (72), memory (457), and the phase conformance legs (11) against `pgvector/pgvector:pg16`, the same image the release workflow uses. The three fixes above are what that leg caught.
+- **Node floor is unchanged** at `>=22` (Node 22/24 supported).
+
+## [0.6.0] - 2026-09-12 (plans 070, 071)
+
+> **0.5.7 was never published.** This release folds that cut's content (durable concurrent tool rounds, strict-provider tool results, host-tunable knobs, peer/options truth, the dependency refresh, and the module splits) together with the 0.6.0 changes below, so a host on 0.5.6 upgrades once. See [docs/migrate-to-0.6.md](docs/migrate-to-0.6.md).
+
+### Fixed
+- **Concurrent tool dispatch dropped sibling results.** With `toolConcurrency > 1` a failed or aborted call threw before the round's results were appended, so every successful sibling result was lost and the next provider request carried unanswered `tool_use` blocks. Results are now persisted before the round fails: successes as-is, the failing call as a real redacted `tool_execution_failed` error, and calls that never started as `tool_call_not_dispatched`. Run-level control errors (`ERR_PRISM_AGENT_RUN_SUSPENDED`, `ERR_PRISM_DELEGATION_SUSPENDED`, `ERR_PRISM_LOOP_*`) still skip synthetic results so durable recovery re-dispatches instead of double-appending.
+- **Content-less tool results serialized as an empty payload.** A `ToolResult` with no `content`/`result` now folds to `EMPTY_TOOL_RESULT_TEXT` (`(tool completed with no output)`) through the shared `serializeToolResultJson` seam (OpenAI-compatible, Alibaba, DeepSeek, Kimi/Moonshot, NeuralWatt, OpenCode-Go), so strict providers stop rejecting zero-length tool payloads.
+- **A failing coverage child hid its own error.** `npm run test:coverage` reported a crashed or failed workspace suite as a bare `no coverage data (suite failed)`, with the child's output discarded (the diagnostic gap that made a one-off `@arnilo/prism-memory` flake unreadable). The summary now prints the child's output tail under the failing row and records `status`/`exitCode`/`tail` on its artifact row — redacted through the public `createSecretRedactor` (repo root and home become placeholders, credential-shaped env values become `[REDACTED]`) and char-bounded (last 40 lines, 8 KiB) so one pathological line cannot bloat the artifact. Passing rows are byte-identical to before.
+- **Memory patch merge aliased caller objects.** `packages/memory`'s `mergeJsonObjects` deep-merged in place; it now delegates to core `mergeConfigLayers` (deep copy, strict JSON validation — `undefined`/`Date`/function values fail closed — with the `MemoryValidationError` taxonomy preserved).
+- **`redactSecrets` was O(n·m) in needles.** A guarded single-pass alternation fast path handles large inputs (≥16 KiB, 2–32 non-overlapping needles) with byte-identical output (~13× faster on 1 MiB transcripts); the ordered loop remains the fallback for overlapping needle sets and small inputs.
+- **Peer manifest resolution broke for packages that do not export `./package.json`** (e.g. `@dietrichgebert/ponytail`): upstream resolvers now resolve the package entry point and walk up to the manifest.
+
+### Added
+- **Host-tunable context assembly:** `AssembleProviderInputOptions.tokenEstimator?: (text: string) => number` replaces the built-in UTF-16/4 heuristic for eviction accounting (byte caps stay estimator-independent).
+- **Host-tunable session snapshot cache:** `AgentSessionConfig.snapshotCacheTtlMs` — `DEFAULT_SNAPSHOT_CACHE_TTL_MS` (1000), `HARD_MAX_SNAPSHOT_CACHE_TTL_MS` (30000), `0` disables the branch-rebuild cache.
+- **Host-tunable memory-session search caps:** `createMemorySessionStore(entries, { search: { maxLinearSessions, maxLinearEntries, maxLinearBytes } })`, validated against the same hard bounds as the defaults.
+- **SSRF allow-list:** `SsrfPolicy.allowedCidrs` accepts IPv4 and IPv6 CIDR entries so a host can explicitly reach a private range; hostname denials (metadata endpoints), credential checks, and the fail-closed unparseable-CIDR behavior are unchanged.
+- **Browser run lifetime:** `BrowserLimitOptions.idleRunTtlMs` (default `0`, `HARD_IDLE_RUN_TTL_MS` 30 min) reaps runs with nothing queued; any interaction resets the idle clock.
+- **Host onboarding docs:** [`docs/peer-dependencies.md`](docs/peer-dependencies.md) (every third-party peer declaration with range, optionality, subpath, install line, and network footprint) and [`docs/options-index.md`](docs/options-index.md) (123 public option/limits/config surfaces routed to the page that documents them), both gated by `live-doc-check` against the manifests and the source.
+- **Real-peer and ACP round-trip coverage:** contract smoke tests for the `@dietrichgebert/ponytail` and `@nanonets/graft` layouts, and stdio round-trip tests driving a spawned ACP agent with the real `@agentclientprotocol/sdk` client (spawn→close, mode negotiation, config options, refused/cancelled permissions).
+- **Release-truth gates:** `scripts/version-literal-gate.test.mjs` asserts every release-claim surface (manifests, internal ranges, `package-lock.json`, the `src/index.ts` version constant, the `docs/index.md` current line, `release.yml` tag lists, `scripts/package-truth.json`) equals the root manifest, so a half-finished cut fails the suite instead of shipping; `scripts/workflow-liveness.test.mjs` resolves every workflow script/workspace/`uses:` reference and requires 40-hex SHA pins for actions; `scripts/wiki-scratch-isolation.test.mjs` proves the memory wiki suites leave tracked fixtures and the repository root untouched; `scripts/run-all-tests.mjs` runs every test stage without short-circuiting, and the startup import budget now asserts a machine-relative ratio (absolute 250 ms ceiling only off-load) so a busy machine no longer reports a false regression.
+
+### Changed
+- **Node floor raised to `>=22`** in all ten publishable packages (`@types/node` `^20.19.0` → `^22.20.0`; the `node20-compat` release leg becomes `node22-compat` on Node 22). Node 20 is upstream EOL since 2026-04-30; Node 24 stays the CI default. This is the host-breaking support-matrix change that the unreleased 0.5.7 deliberately deferred to a minor.
+- **Dependency refresh:** `pg` 8.23, `playwright-core` 1.63.0, `zod` ^4.6.2, `@ai-sdk/provider` 4.0.13 (`@ai-sdk/openai` 4.0.65 with a new supported-version matrix entry), `@office-open/*` 0.14.5 (adapters use the `*Sync` parse variants), `@biomejs/biome` 2.5.13, `@agentclientprotocol/sdk` exact-pinned 1.4.0, and the `@arnilo/prism-memory` `@nanonets/graft` peer range widened to `^0.16.0 || ^0.18.0`.
+- **Examples are Node-20-floor safe:** four runnable examples used `import.meta.main` (Node ≥22.18/≥24.2) on a Node-20 floor; they now use the house `import.meta.url` + `process.argv[1]` guard.
+- **Release gate:** lockstep cuts now require every internal `@arnilo/*` range to be the cut version exactly (`0.6.0` or `^0.6.0`) instead of merely satisfying it, so one release line cannot resolve two first-party minors.
+- **Test/coverage tooling:** the npm test chain runs every stage through `scripts/run-all-tests.mjs` (no short-circuit, one summary), coverage discovery finds nested `dist/**/__tests__` in all 9 workspace packages, `coverage-thresholds.json` may no longer name retired packages, and protected legs use one blocked-gate shape (`scripts/blocked-gate.mjs`) with env **names** only in the release evidence.
+- **Internal structure, additive-only surface:** `runtime/server/artifacts.ts` split into four modules, `enterprise/postgres/model-router.ts` split into a directory (`util`/`circuit`/`capacity`/`reservations`/`expiry`/`state-store`), MCP OAuth discovery extracted to `oauth-metadata.ts`, one abort-aware `Semaphore` shared across `@arnilo/prism-coding-tools` (sandbox error types preserved), shared upstream persona primitives in `@arnilo/prism-coding-tools/src/upstream/`, shared provider HTTP retry primitives (`@arnilo/prism-providers/src/shared/retry-http.ts`), and the `content.ts` ↔ `pinned-fetch.ts` ESM cycle broken via the leaf module `src/media-types.ts`. Compat baselines were regenerated (`--update-baseline`): **69 added declarations, zero removals** — the five new host-tunable surfaces plus the helpers the moved modules now export from their new files.
+
+### Removed
+- **`@arnilo/prism-office` optional `playwright-core` peer** (test-only: `/diagrams` drives a host-supplied iframe). Hosts no longer install a browser for office; see [`docs/peer-dependencies.md`](docs/peer-dependencies.md).
+
+### Notes
+- **Lockstep `0.5.6` → `0.6.0` bump:** all 10 publishable manifests move to `0.6.0` with internal ranges `^0.6.0`; the predecessor published release is **0.5.6** (0.5.7 was never published and is superseded by this cut).
+- **Retired-gate and test-truth fixes** landed in the same window (plans 070/071): frozen-era version markers derive from the root manifest, retired doc paths resolve through the frozen lineage, the packed-consumer enterprise journey no longer inherits a Postgres env var (the `pg` peer is not installed in a packed consumer), the `sandbox-browser` workflow references live packages again, the secret scan is operator-independent (tracked files only), the LSP restart-budget test awaits the exhaustion transition instead of racing a write, and the release workflow tag lists carry every published tag.
+
 ## [0.5.6] - 2026-09-09 (plan 069)
 
 ### Added
@@ -92,27 +168,27 @@
 ### Added
 - **OKF adoption (`@arnilo/prism-wiki`)**: wiki-init/refresh/lint emit and validate
   OKF v0.2 bundles (Karpathy prompt retained). See `docs/wiki.md`.
-- **DOCS-1 (Clay integration findings)**: three integrator contracts, in place on
+- **DOCS-1 (integration findings)**: three integrator contracts, in place on
   the pages that own them — resume-aware workflow nodes (`ctx.resume` or silent
   re-suspend) in `docs/workflows.md`; supervisor child factories return `Agent`
   not `AgentSession` (`SupervisorError: child "<id>" factory must return an
   Agent, got <type>`) plus durable-store nested approvals in `docs/supervisors.md`;
   task-boundary `session.compact()` fails closed during an active run in
   `docs/compaction-and-retry.md`. Each block links `examples/autonomous-coding-loop.ts`.
-- **FEATURE-2 (Clay integration findings)**: documented bounded iterate-until-done
+- **FEATURE-2 (integration findings)**: documented bounded iterate-until-done
   host-loop pattern in `docs/workflows.md` — one `runWorkflow` per iteration,
   iteration state in workflow inputs, explicit termination predicate and budgets,
   typed `BudgetExhaustedError` (fail-closed, never a hang), `replayWorkflow` per
   iteration run id. Seeded by `examples/autonomous-coding-loop.ts`. Plan 045 `loop`
   node remains the future in-graph primitive; this intake ships the docs+example
   minimum only.
-- **FEATURE-6 (Clay integration findings)**: composite `examples/autonomous-coding-loop.ts`
+- **FEATURE-6 (integration findings)**: composite `examples/autonomous-coding-loop.ts`
   conformance reference — goal → roadmap → per-task supervisor children (per-child
   models) → `runCodingGoalVerify`-style validation → observational-memory attach +
   task-boundary compact + recall → human gate with simulated restart → host-side
   bounded iterate-until-done with deterministic budget exhaustion. Mock providers
   only; no credentials or network.
-- **FEATURE-3 (Clay integration findings)**: host-opt-in command driver hooks.
+- **FEATURE-3 (integration findings)**: host-opt-in command driver hooks.
   `CommandExecutionContext` gains an optional `drivers?: CommandDrivers`
   (`startRun` / `startWorkflow` / `steer` — typed minimal handles returning
   `AgentRunResult`-shaped results / workflow run id + status) so a contributed
@@ -122,7 +198,7 @@
   the context shape unchanged (no key, no allocation). Drivers are
   host-injected capabilities, never package-supplied.
 ### Fixed
-- **FEATURE-1 (Clay integration findings)**: `resolveAgentDefinition` no longer
+- **FEATURE-1 (integration findings)**: `resolveAgentDefinition` no longer
   throws `Agent "<name>" has no model` when the declarative definition omits
   `model` but `context.overrides.model` supplies one — the fallback is a
   single `??` at `buildBaseConfig`, the `create()` path is unchanged, and a

package/README.md

@@ -162,16 +162,16 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 
 | package | version | notes |
 | --- | --- | --- |
-| `@arnilo/prism` | 0.5.6 | core — runtime, CLI/RPC, templates, docs |
-| `@arnilo/prism-coding-tools` | 0.5.6 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
-| `@arnilo/prism-core` | 0.5.6 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
-| `@arnilo/prism-providers` | 0.5.6 | family — all provider adapters as `/<adapter>` subpaths |
-| `@arnilo/prism-acp-agent` | 0.5.6 | capability — ACP adapter |
-| `@arnilo/prism-ag-ui` | 0.5.6 | capability — AG-UI/A2A/A2UI adapter |
-| `@arnilo/prism-mcp` | 0.5.6 | capability — MCP client/server/OAuth interop |
-| `@arnilo/prism-memory` | 0.5.6 | capability — memory plus /rag, /compaction/*, /graft, /wiki subpaths |
-| `@arnilo/prism-office` | 0.5.6 | capability — /documents, /sheets, /diagrams subpaths |
-| `@arnilo/prism-web-tools` | 0.5.6 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
+| `@arnilo/prism` | 0.7.0 | core — runtime, CLI/RPC, templates, docs |
+| `@arnilo/prism-coding-tools` | 0.7.0 | family — /agent, /security, /document-reader, /openapi, /computer-use-linux, /dev, /caveman, /ponytail, /impeccable subpaths |
+| `@arnilo/prism-core` | 0.7.0 | family — /runtime, /sessions, /governance, /credentials, /enterprise, /work, /validation subpaths |
+| `@arnilo/prism-providers` | 0.7.0 | family — all provider adapters as `/<adapter>` subpaths |
+| `@arnilo/prism-acp-agent` | 0.7.0 | capability — ACP adapter |
+| `@arnilo/prism-ag-ui` | 0.7.0 | capability — AG-UI/A2A/A2UI adapter |
+| `@arnilo/prism-mcp` | 0.7.0 | capability — MCP client/server/OAuth interop |
+| `@arnilo/prism-memory` | 0.7.0 | capability — memory plus /rag, /compaction/*, /fabric, /graft, /wiki subpaths |
+| `@arnilo/prism-office` | 0.7.0 | capability — /documents, /sheets, /diagrams subpaths |
+| `@arnilo/prism-web-tools` | 0.7.0 | capability — Brave/Exa/Firecrawl plus peer-gated /browser and /obscura subpaths |
 <!-- generated:package-truth:inventory end -->
 
 ## Scripts

package/dist/agent-approval.js

@@ -37,8 +37,9 @@ export function assertValidAgentRunResume(resume) {
     if (!Number.isSafeInteger(resume.expectedVersion) || resume.expectedVersion <= 0) {
         throw invalid("Resume expectedVersion must be a positive safe integer");
     }
+    const decisions = resume.decisions;
     const hasDecision = resume.decision !== undefined;
-    const hasDecisions = resume.decisions !== undefined;
+    const hasDecisions = decisions !== undefined;
     if (hasDecision && hasDecisions)
         throw invalid("Resume accepts exactly one of decision or decisions");
     if (!hasDecision && !hasDecisions)
@@ -49,7 +50,6 @@ export function assertValidAgentRunResume(resume) {
         }
         return;
     }
-    const decisions = resume.decisions;
     if (!Array.isArray(decisions))
         throw invalid("Decision batch must be an array");
     if (decisions.length === 0)
@@ -242,10 +242,11 @@ export function decisionScopesEqual(a, b) {
         return false;
     if (a.actionConstraints === undefined || b.actionConstraints === undefined)
         return a.actionConstraints === b.actionConstraints;
-    const keys = Object.keys(a.actionConstraints);
-    return (keys.length === Object.keys(b.actionConstraints).length &&
-        keys.every((key) => key in b.actionConstraints &&
-            canonicalToolEffectJson(a.actionConstraints[key]) === canonicalToolEffectJson(b.actionConstraints[key])));
+    const aConstraints = a.actionConstraints;
+    const bConstraints = b.actionConstraints;
+    const keys = Object.keys(aConstraints);
+    return (keys.length === Object.keys(bConstraints).length &&
+        keys.every((key) => key in bConstraints && canonicalToolEffectJson(aConstraints[key]) === canonicalToolEffectJson(bConstraints[key])));
 }
 export function nestedOutcomeToolResult(outcome, toolCallId, name) {
     return outcome.status === "completed"

package/dist/agent-definitions.js

@@ -34,6 +34,7 @@ function buildBaseConfig(def, context) {
         ...(def.context !== undefined && { context: resolveContextProviders(def.name, def.context, context) }),
         ...(def.systemPrompt !== undefined && { systemPrompt: def.systemPrompt }),
         ...(def.instructions !== undefined && { instructions: def.instructions }),
+        ...(def.attentionCompiler !== undefined && { attentionCompiler: def.attentionCompiler }),
         ...(def.loop !== undefined && { loop: def.loop }),
         ...(def.metadata !== undefined && { metadata: def.metadata }),
     };

package/dist/agent-loops.js

@@ -1,6 +1,7 @@
 import { AgentLoopStateError } from "./contracts.js";
 import { createId } from "./ids.js";
 import { inputMessages, toToolResultMessage } from "./input.js";
+import { errorToErrorInfo } from "./redaction.js";
 import { artifactStructuredOutputRequest, withoutStructuredOutput } from "./structured-output.js";
 function throwIfAborted(signal) {
     if (signal.aborted)
@@ -207,12 +208,13 @@ export function generateValidateReviseLoop(opts) {
                         : { ok: true, value: text };
                 // Parse failure consumes revision budget like a validation failure; the
                 // repairer receives `undefined` value plus a synthetic parse issue.
-                const parseFailure = !parsed.ok || parsed.value === undefined
-                    ? { ok: false, errors: [{ path: "$", message: parsed.error ?? "artifact parse failed" }], metadata: { reason: "parse_error" } }
-                    : undefined;
+                const candidate = parsed.ok && parsed.value !== undefined ? { ok: true, value: parsed.value } : undefined;
                 const attempt = ++attempts;
                 ctx.emit({ type: "artifact_validation_started", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt });
-                const result = parseFailure ?? (await opts.validator(parsed.value, artifactCtx));
+                const result = candidate
+                    ? await opts.validator(candidate.value, artifactCtx)
+                    : { ok: false, errors: [{ path: "$", message: parsed.error ?? "artifact parse failed" }], metadata: { reason: "parse_error" } };
+                const parseFailure = candidate ? undefined : result;
                 ctx.emit({ type: "artifact_validation_finished", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt, result });
                 if (result.ok) {
                     ctx.emit({ type: "artifact_finished", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt, result });
@@ -271,39 +273,76 @@ export async function dispatchToolCallsInOrder(calls, ctx) {
     let nextIndex = 0;
     let stopped = false;
     let firstFailure;
-    const recordFailure = (error) => {
+    let failureIndex = -1;
+    const recordFailure = (error, index) => {
         if (stopped)
             return;
         stopped = true;
         firstFailure = error;
+        failureIndex = index;
     };
     const workers = Array.from({ length: concurrency }, async () => {
         for (;;) {
             if (stopped)
                 return;
+            let index = -1;
             try {
                 throwIfAborted(ctx.signal);
-                const index = nextIndex;
+                index = nextIndex;
                 nextIndex += 1;
                 if (index >= calls.length)
                     return;
                 results[index] = await ctx.dispatchToolCall(calls[index]);
             }
             catch (error) {
-                recordFailure(error);
+                recordFailure(error, index >= 0 && index < calls.length ? index : -1);
                 return;
             }
         }
     });
     await Promise.allSettled(workers);
+    // Persist before rethrowing: a stopped batch must not leave the branch with `tool_call`
+    // ids that never got a `tool_result` (providers reject that history on the next turn).
+    // ponytail: synthetic rows carry `errorToErrorInfo` output only — no cause chain; the
+    // store redacts entries again at `appendEntry`, and `ctx.history` mirrors the run error.
+    const claimed = Math.min(nextIndex, calls.length);
+    for (let index = 0; index < calls.length; index += 1) {
+        const result = results[index];
+        if (result) {
+            await appendToolResultMessage(result, ctx);
+            continue;
+        }
+        // Suspension/loop-state errors are not tool outcomes: their machinery appends the real
+        // result on resume, so a synthetic row here would duplicate it.
+        if (index === failureIndex && isRunControlError(firstFailure))
+            continue;
+        const call = calls[index];
+        if (call === undefined)
+            continue;
+        await appendToolResultMessage(syntheticFailureResult(call, index < claimed ? firstFailure : undefined), ctx);
+    }
     if (stopped)
         throw firstFailure;
-    for (const result of results) {
-        throwIfAborted(ctx.signal);
-        if (!result)
-            continue;
-        await appendToolResultMessage(result, ctx);
+}
+/** Run-level control errors rethrown by `dispatchToolCall` (mirrors `src/tools.ts`). */
+function isRunControlError(error) {
+    const code = error?.code;
+    return (typeof code === "string" &&
+        (code === "ERR_PRISM_AGENT_RUN_SUSPENDED" || code === "ERR_PRISM_DELEGATION_SUSPENDED" || code.startsWith("ERR_PRISM_LOOP_")));
+}
+function syntheticFailureResult(call, failure) {
+    if (failure === undefined) {
+        return {
+            toolCallId: call.id,
+            name: call.name,
+            error: {
+                code: "tool_call_not_dispatched",
+                message: "Tool call was not dispatched: the batch stopped after an earlier call failed or the run was aborted.",
+            },
+        };
     }
+    const info = errorToErrorInfo(failure);
+    return { toolCallId: call.id, name: call.name, error: { name: info.name, message: info.message, code: info.code } };
 }
 async function appendToolResultMessage(result, ctx) {
     // Approval-gated calls return a marker instead of a real result; the transcript must not

package/dist/agent-run-lifecycle.js

@@ -1,4 +1,5 @@
 import { assertValidAgentRunResume, pendingDecisionsOf, resolveRunDecisions } from "./agent-approval.js";
+import { parseAttentionStickyFrontier } from "./attention-compiler.js";
 import { agentFingerprint, loadAgentRunState, publicState, saveAgentRunState } from "./agent-run-state.js";
 import { RuntimeAgentSession, throwIfAbortedSignal } from "./agent-session.js";
 import { AgentRunStateError } from "./contracts.js";
@@ -96,6 +97,9 @@ async function prepareAgentRunResume(agent, ref, resume, options, signal) {
         throw new AgentRunStateError("Stale or non-suspended agent run resume");
     }
     const session = new RuntimeAgentSession({ agent, id: state.sessionId, leafId: state.leafId });
+    // Plan 078 Task 7: hand the reconstructed session to an observer (supervisor child-event pump)
+    // before any event flows. Called for every resume outcome; a throw fails closed.
+    options.onSession?.(session);
     // Opt-in session-state restore (plan 015 Task 4): names only; bodies re-resolve from
     // the live registry the next time the model (re)loads them via load_skill.
     if (options.persistSessionState && state.sessionState?.loadedSkillNames) {
@@ -105,6 +109,13 @@ async function prepareAgentRunResume(agent, ref, resume, options, signal) {
     if (options.persistSessionState && state.sessionState?.activatedToolNames) {
         session.restoreActivatedTools(state.sessionState.activatedToolNames);
     }
+    // Plan 074 P3: restore sticky attention mutations (already validated at load) so the first
+    // turn after a resume keeps its stubs instead of re-deciding them from the ratio.
+    if (options.persistSessionState && state.sessionState?.attentionSticky) {
+        const frontier = parseAttentionStickyFrontier(state.sessionState.attentionSticky);
+        if (frontier)
+            session.restoreAttentionSticky(frontier);
+    }
     // Plan 018 Task 6 (closeout `checkpoint-bodies`): restore exact instructions so the
     // resumed session renders them registry-independently (no load_skill round-trip).
     if (options.persistSessionState && options.includeSkillBodies && state.sessionState?.loadedSkillBodies) {

package/dist/agent-run-state.d.ts

@@ -1,4 +1,5 @@
 import type { Agent, AgentRunInterruption, AgentRunRef, AgentRunState, AgentRunStateOptions, CheckpointRecord, CheckpointStore, JsonValue, Message, ModelConfig, NestedRunRef, OwnershipScope, RunDecision, RunLimitCounters, StickyDecision, ToolCallContent } from "./contracts.js";
+import { type PersistedAttentionStickyFrontier } from "./attention-compiler.js";
 import type { SecretRedactor } from "./redaction.js";
 import { type LoadedSkillBodiesEntry } from "./skill-load.js";
 export declare const AGENT_RUN_STATE_NAMESPACE = "prism.agent-run";
@@ -46,7 +47,12 @@ export interface StoredAgentRunState extends AgentRunState {
         readonly loadedSkillBodies?: readonly LoadedSkillBodiesEntry[];
         /** Plan 041: tools activated via `search_tools` (names only; inert for absent tools on restore). */
         readonly activatedToolNames?: readonly string[];
+        /** Plan 074 P3: sticky attention mutations (thinking hashes + tool-call ids), so a durable
+         *  resume keeps its stubs instead of re-deciding on the first turn. Validated on load. */
+        readonly attentionSticky?: PersistedAttentionStickyFrontier;
     };
+    /** Per-run allow-list (Task 21). Absent = full registered set (legacy checkpoints). */
+    readonly toolNames?: readonly string[];
 }
 /** Session-state caps (plan 015 Task 4): bounded names charged against the run-state byte budget. */
 export declare const MAX_PERSISTED_SKILL_NAMES = 64;

package/dist/agent-run-state.js

@@ -1,6 +1,8 @@
 import { createHash } from "node:crypto";
 import { AgentLoopStateError, AgentRunStateError } from "./contracts.js";
+import { parseAttentionStickyFrontier } from "./attention-compiler.js";
 import { validateLoadedSkillBodies } from "./skill-load.js";
+import { HARD_RUN_TOOL_NAMES } from "./tools.js";
 export const AGENT_RUN_STATE_NAMESPACE = "prism.agent-run";
 export const AGENT_RUN_STATE_SCHEMA_VERSION = 1;
 export const DEFAULT_MAX_AGENT_RUN_STATE_BYTES = 256 * 1024;
@@ -128,7 +130,7 @@ export async function saveAgentRunState(input) {
     return { record, state: { ...bounded, version: record.version } };
 }
 export function publicState(state) {
-    const { input: _input, pending: _pending, pendingCalls: _pendingCalls, nestedRuns: _nestedRuns, interruptBeforeTool: _interruptBeforeTool, counters: _counters, deadlineAt: _deadlineAt, ...publicValue } = state;
+    const { input: _input, pending: _pending, pendingCalls: _pendingCalls, nestedRuns: _nestedRuns, interruptBeforeTool: _interruptBeforeTool, counters: _counters, deadlineAt: _deadlineAt, toolNames: _toolNames, ...publicValue } = state;
     return publicValue;
 }
 export function initialAgentRunState(input) {
@@ -203,6 +205,16 @@ export function parseAgentRunState(value, version) {
             !("snapshot" in state.loopState))) {
         throw new AgentRunStateError("Malformed agent run loop state");
     }
+    if (state.toolNames !== undefined) {
+        if (!Array.isArray(state.toolNames) || state.toolNames.length > HARD_RUN_TOOL_NAMES) {
+            throw new AgentRunStateError(`Run toolNames exceed ${HARD_RUN_TOOL_NAMES} entries`);
+        }
+        for (const name of state.toolNames) {
+            if (typeof name !== "string" || name.length === 0 || name.length > MAX_PERSISTED_SKILL_NAME_CHARS) {
+                throw new AgentRunStateError("Malformed agent run toolNames");
+            }
+        }
+    }
     // Load bounds against the hard cap, not the default: the configured maxStateBytes is a
     // save-side policy knob, while the load-side bound is only a DoS ceiling. States saved
     // with a raised maxStateBytes must remain resumable.
@@ -261,15 +273,23 @@ function validateSessionState(sessionState) {
         }
     }
     const activated = sessionState.activatedToolNames;
-    if (activated === undefined)
-        return;
-    if (!Array.isArray(activated) || activated.length > MAX_PERSISTED_ACTIVATED_TOOL_NAMES) {
-        throw new AgentRunStateError(`Activated-tool names exceed ${MAX_PERSISTED_ACTIVATED_TOOL_NAMES} entries`);
-    }
-    for (const name of activated) {
-        if (typeof name !== "string" || name.length > MAX_PERSISTED_SKILL_NAME_CHARS) {
-            throw new AgentRunStateError(`Activated-tool name exceeds ${MAX_PERSISTED_SKILL_NAME_CHARS} chars`);
+    if (activated !== undefined) {
+        if (!Array.isArray(activated) || activated.length > MAX_PERSISTED_ACTIVATED_TOOL_NAMES) {
+            throw new AgentRunStateError(`Activated-tool names exceed ${MAX_PERSISTED_ACTIVATED_TOOL_NAMES} entries`);
         }
+        for (const name of activated) {
+            if (typeof name !== "string" || name.length > MAX_PERSISTED_SKILL_NAME_CHARS) {
+                throw new AgentRunStateError(`Activated-tool name exceeds ${MAX_PERSISTED_SKILL_NAME_CHARS} chars`);
+            }
+        }
+    }
+    const attention = sessionState.attentionSticky;
+    if (attention === undefined)
+        return;
+    // Both arrays are capped by the parser, and a malformed frontier is dropped rather than
+    // failing the resume: re-deciding a mutation is safe, refusing to resume is not.
+    if (parseAttentionStickyFrontier(attention) === undefined) {
+        throw new AgentRunStateError("Malformed agent run attention frontier");
     }
 }
 //# sourceMappingURL=agent-run-state.js.map

package/dist/agent-session/session/assemble.js

@@ -3,6 +3,7 @@ import { AgentRunSuspended } from "../../agent-approval.js";
 import { resolveLoop, resolveToolConcurrency } from "../../agent-loops.js";
 import { validateRunStateOptions } from "../../agent-run-state.js";
 import { activeTools } from "../../agent-tool-dispatch.js";
+import { resolveRunAttentionCompiler } from "../../attention-compiler.js";
 import { AgentLoopStateError, AgentRunError, AgentRunStateError } from "../../contracts.js";
 import { assertGuardrailsAllowed, runGuardrails } from "../../guardrails.js";
 import { identityTelemetryAttributes, ownershipFromIdentity, resolveRunIdentity } from "../../identity.js";
@@ -16,7 +17,7 @@ import { assertStructuredOutputRequestSupported, resolveRunProviderOptions } fro
 import { composeSystemPrompt, mergeSystemPromptConfig } from "../../system-prompts.js";
 import { resolveToolResultFold } from "../../tool-result-fold.js";
 import { createSearchToolsTool, createToolSearchState, resolveToolsDisclosure } from "../../tool-search.js";
-import { createToolRegistry } from "../../tools.js";
+import { createToolRegistry, selectRunTools } from "../../tools.js";
 import { bridgeAbort, createUsageAccumulator, inputToMessages, isDurableLoop, isSteerSoftInterrupt, mergeGuardrails, throwIfAborted, } from "../helpers.js";
 import { cleanupRun, persistDurable, persistSucceeded, suspendDurable } from "./persist.js";
 import { generateWithRetry, recordProviderUsage } from "./provider-round.js";
@@ -61,7 +62,12 @@ async function assembleRoundContext(params) {
     };
     await session.activeLedger?.appendRun(redactRunLedgerRecord(startRecord, session.activeRedactor));
     await session.rebuildHistory();
-    const { registry: baseRegistry, tools: activeToolList } = activeTools(session.agent.config.tools);
+    const { tools: listed } = activeTools(session.agent.config.tools);
+    const selected = selectRunTools(listed, options.toolNames, resumed?.state?.toolNames);
+    session.activeToolNames = selected.grant;
+    // Run-local snapshot: concurrent runs and MCP refresh must not mutate this registry.
+    const activeToolList = selected.tools;
+    const baseRegistry = createToolRegistry(activeToolList);
     const toolsDisclosure = resolveToolsDisclosure(options.toolsDisclosure, session.agent.config.toolsDisclosure);
     const toolSearch = toolsDisclosure === "search" && activeToolList.length > 0
         ? {
@@ -115,6 +121,26 @@ async function assembleRoundContext(params) {
     const providerOptions = resolveRunProviderOptions(options, session.agent.config);
     assertStructuredOutputRequestSupported(options.model ?? session.agent.config.model, providerOptions);
     const validate = options.validate ?? session.agent.config.validator;
+    // Resolved once per run, before any provider turn: a bad setting or a widening run overlay
+    // fails here rather than on the turn that happens to cross the ratio (plan 074 C12).
+    const attentionCompiler = resolveRunAttentionCompiler(session.agent.config.attentionCompiler, options.attentionCompiler, options.model ?? session.agent.config.model);
+    // Telemetry seam (plan 074 T6): one `attention_compiled` per mutated turn, counts and the
+    // measured ratio inputs only. Under-ratio turns and compiler-off runs emit nothing.
+    const onAttentionReport = attentionCompiler
+        ? (report) => session.emit({
+            type: "attention_compiled",
+            sessionId: session.id,
+            runId,
+            used: report.used,
+            usedAfter: report.usedAfter,
+            inputCap: report.inputCap,
+            triggerRatio: report.triggerRatio,
+            droppedThinkingTurns: report.droppedThinkingTurns,
+            stubbedToolResults: report.stubbedToolResults,
+            stubbedBytes: report.stubbedBytes,
+            truncated: report.truncated,
+        })
+        : undefined;
     const instructionInjectors = options.instructionInjectors ?? session.agent.config.instructionInjectors ?? [];
     const inputLayout = options.inputLayout ?? session.agent.config.inputLayout;
     const loop = resolveLoop(options, session.agent.config);
@@ -183,6 +209,11 @@ async function assembleRoundContext(params) {
                 toolsSearch: session.agent.config.toolsSearch,
                 activatedTools: session.activatedTools,
                 toolResultFold: resolveToolResultFold(options.toolResultFold, session.agent.config.toolResultFold),
+                attentionCompiler,
+                // Session-owned: a stub made earlier stays applied even on a later under-ratio turn, so
+                // the prompt-cache prefix is not rewritten (C10). Undefined when the compiler is off.
+                attentionSticky: attentionCompiler ? session.attentionStickyFor() : undefined,
+                onAttentionReport,
                 loadedSkills: session.loadedSkills,
                 tools,
                 resourceLoader: session.agent.config.resourceLoader,

package/dist/agent-session/session/persist.js

@@ -9,11 +9,14 @@ export async function persistDurable(session, state) {
     const durable = session.activeDurable;
     if (!durable)
         throw new AgentRunStateError("Durable run state is not configured");
+    const withGrant = session.activeToolNames !== undefined ? { ...state, toolNames: session.activeToolNames } : state;
+    const attentionSticky = session.serializedAttentionSticky();
     const persisted = durable.options.persistSessionState
         ? {
-            ...state,
+            ...withGrant,
             sessionState: {
                 loadedSkillNames: session.loadedSkills.list(),
+                ...(attentionSticky ? { attentionSticky } : {}),
                 ...(session.activatedTools.list().length ? { activatedToolNames: session.activatedTools.list() } : {}),
                 ...(durable.options.includeSkillBodies
                     ? {
@@ -24,7 +27,7 @@ export async function persistDurable(session, state) {
                     : {}),
             },
         }
-        : state;
+        : withGrant;
     const saved = await saveAgentRunState({
         checkpoints: durable.options.checkpoints,
         state: persisted,
@@ -155,6 +158,7 @@ export async function cleanupRun(input) {
         session.activeMetadata = undefined;
         session.activePromptVersion = undefined;
         session.activeLimits?.dispose();
+        session.activeToolNames = undefined;
         session.activeLimits = undefined;
         session.activeLimitOutputBuffer = false;
         session.activeRedactor = undefined;

package/dist/agent-session/session/tool-round.js

@@ -278,6 +278,7 @@ export function bindDispatchToolCall(ctx) {
                 ownership: ctx.session.activeOwnership,
                 identity: ctx.session.activeIdentity,
                 guardrails: ctx.session.activeGuardrails,
+                ...(ctx.tools.length > 0 ? { filter: { allow: ctx.tools.map((tool) => tool.name) } } : {}),
                 limitTracker: ctx.limits,
                 beforeExecute: async (mediatedCall) => {
                     const durable = ctx.session.activeDurable;

package/dist/agent-session/session/types.d.ts

@@ -1,6 +1,7 @@
 /** Shared host/round types for runInternal phase split (plan 059). Internal only. */
 import type { ActiveDurableRun } from "../../agent-approval.js";
 import type { PendingToolCall } from "../../agent-run-state.js";
+import type { AttentionStickyFrontier, PersistedAttentionStickyFrontier } from "../../attention-compiler.js";
 import type { Agent, AgentEvent, AgentLoopStrategy, AgentRunResult, AIProvider, ErrorInfo, Guardrails, LoopContext, Message, ModelConfig, OwnershipScope, PendingDecision, PromptVersionRef, ProviderRequest, RunLedger, RunOptions, SessionEntry, SessionStore, Skill, ToolDefinition, ToolEffectStore, ToolRegistry, Usage } from "../../contracts.js";
 import type { AgentIdentity } from "../../identity.js";
 import type { AgentInput } from "../../input.js";
@@ -47,6 +48,15 @@ export type SessionHost = {
     readonly activatedTools: ActiveToolSet;
     restoredSkillBodies: readonly LoadedSkillBodiesEntry[];
     activeRunSkills: readonly Skill[];
+    /** Names-only grant for this run; undefined means the full registered set. */
+    activeToolNames?: readonly string[];
+    /** Sticky mutation frontier for this session (plan 074 C10); session-owned so it survives
+     *  across turns, runs, and provider rounds. Lazily created on first use. */
+    attentionStickyFor(): AttentionStickyFrontier;
+    /** Plan 074 P3: bounded frontier snapshot for durable checkpoints (undefined before any mutation). */
+    serializedAttentionSticky(): PersistedAttentionStickyFrontier | undefined;
+    /** Plan 074 P3: restore a frontier that was validated when the checkpoint was loaded. */
+    restoreAttentionSticky(persisted: PersistedAttentionStickyFrontier): void;
     invalidateSnapshot(): void;
     resolveRunProvider(options: RunOptions): void;
     emit(event: AgentEvent): void;

package/dist/agent-session/session.d.ts

@@ -1,6 +1,7 @@
 /** session (0.2.5 plan 025 Task 1 split). Moved verbatim from agent-session.ts; public surface unchanged behind the barrel. */
 import { ActiveDurableRun } from "../agent-approval.js";
 import type { PendingToolCall, StoredAgentRunState } from "../agent-run-state.js";
+import { type AttentionStickyFrontier, type PersistedAttentionStickyFrontier } from "../attention-compiler.js";
 import type { Agent, AgentEvent, AgentRunResult, AgentRunState, AgentRunStateOptions, AgentSession, AgentSessionConfig, AIProvider, CompactionOptions, CompactionResult, ErrorInfo, Message, OwnershipScope, PendingDecision, PromptVersionRef, ProviderRequest, RunDecision, RunOptions, SessionEntry, Skill, SteerOptions, SubscribeOptions, ToolDefinition, ToolEffectStore, Usage } from "../contracts.js";
 import type { AgentIdentity } from "../identity.js";
 import type { AgentInput } from "../input.js";
@@ -48,6 +49,19 @@ export declare class RuntimeAgentSession implements AgentSession {
     restoredSkillBodies: readonly LoadedSkillBodiesEntry[];
     /** Skills of the current run (for the bodies snapshot); replaced at each run start. */
     activeRunSkills: readonly import("../contracts.js").Skill[];
+    /** Per-run tool allow-list (Task 21); undefined means the full registered set. */
+    activeToolNames?: readonly string[];
+    /** Sticky frontier for this session (plan 074 C10); created on first use, so a session whose
+     *  agents never enable the compiler allocates nothing. Mutations stay applied once made, so a
+     *  later under-ratio turn re-applies them instead of rewriting the prompt-cache prefix. */
+    private attentionSticky?;
+    attentionStickyFor(): AttentionStickyFrontier;
+    /** Plan 074 P3: bounded snapshot for a durable checkpoint; `undefined` when the session never
+     *  mutated anything, so a compiler-off (or never-over-ratio) session persists nothing extra. */
+    serializedAttentionSticky(): PersistedAttentionStickyFrontier | undefined;
+    /** Plan 074 P3: restore a frontier validated at checkpoint load, so a resumed run keeps its
+     *  stubs instead of re-deciding its first turn from the ratio. */
+    restoreAttentionSticky(persisted: PersistedAttentionStickyFrontier): void;
     /** Plan 015 Task 4: re-add persisted loaded-skill names (names only; bodies re-resolve on demand). */
     restoreLoadedSkills(names: readonly string[]): void;
     /** Plan 041: re-add persisted activated-tool names (names only; inert for absent tools). */
@@ -60,6 +74,7 @@ export declare class RuntimeAgentSession implements AgentSession {
     private ledgerFailure;
     private snapshotGeneration;
     private snapshotCache?;
+    private readonly snapshotCacheTtlMs;
     constructor(config: AgentSessionConfig & {
         readonly agent: Agent;
     });