@atbash/sdk 0.16.1-dev.0 → 0.16.3-dev.0

package/dist/browser.d.mts

@@ -721,7 +721,18 @@ declare class AtbashAPIError extends Error {
     readonly status: number;
     /** Raw response body text (may be empty). */
     readonly body: string;
-    constructor(status: number, body: string, statusText?: string, endpoint?: string);
+    /**
+     * Request path this status came from, e.g. `/api/v1/judge` — absent when the
+     * request never reached a response (transport failures carry status 0).
+     *
+     * A status alone does not say what failed. Several routes answer one call, and
+     * more than one of them can 404: a caller reading only `404` cannot tell "this
+     * agent is not registered" from "the chain-routing lookup did not resolve", and
+     * has to guess from the body's prose — which a 404 raised before any handler
+     * ran does not carry. The path is the fact that settles it.
+     */
+    readonly path?: string;
+    constructor(status: number, body: string, statusText?: string, endpoint?: string, path?: string);
 }
 declare class SignatureVerificationError extends Error {
     constructor(message: string);
@@ -1068,6 +1079,13 @@ interface ClassifyMemoryWriteOptions {
  *
  * Empty-content writes return `null`: they can't carry a poisoning
  * payload, and the regular audit path still sees them.
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryWrite(event: unknown, ctx: unknown, opts?: ClassifyMemoryWriteOptions): MemoryEntry | null;
 
@@ -1236,6 +1254,13 @@ interface ClassifyMemoryReadOptions {
  * Caller-supplied `patterns` are MERGED with the defaults (matches
  * Node's original behavior — extending in one plugin doesn't disable
  * standard coverage).
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryRead(event: unknown, ctx: unknown, opts?: ClassifyMemoryReadOptions): boolean;
 

package/dist/browser.mjs

@@ -44409,11 +44409,23 @@ var AtbashAPIError = class extends Error {
   status;
   /** Raw response body text (may be empty). */
   body;
-  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT) {
-    super(enrich(status, body, statusText, endpoint));
+  /**
+   * Request path this status came from, e.g. `/api/v1/judge` — absent when the
+   * request never reached a response (transport failures carry status 0).
+   *
+   * A status alone does not say what failed. Several routes answer one call, and
+   * more than one of them can 404: a caller reading only `404` cannot tell "this
+   * agent is not registered" from "the chain-routing lookup did not resolve", and
+   * has to guess from the body's prose — which a 404 raised before any handler
+   * ran does not carry. The path is the fact that settles it.
+   */
+  path;
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path4) {
+    super(enrich(status, body, statusText, endpoint, path4));
     this.name = "AtbashAPIError";
     this.status = status;
     this.body = body;
+    this.path = path4;
   }
 };
 var SignatureVerificationError = class extends Error {
@@ -44422,9 +44434,9 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
-function enrich(status, body, statusText, endpoint) {
+function enrich(status, body, statusText, endpoint, path4) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-  let msg = `API error ${status}: ${body || statusText}`;
+  let msg = `API error ${status}${path4 ? ` from ${path4}` : ""}: ${body || statusText}`;
   const lowered = body.toLowerCase();
   if (lowered.includes("agent not registered")) {
     msg += `
@@ -44516,6 +44528,13 @@ function classifyTransportError(err, url, method, timeoutMs) {
       { cause: err }
     );
   }
+  if (code2 === "UND_ERR_CONNECT_TIMEOUT") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} could not establish a connection before the transport deadline \u2014 check the endpoint and network`,
+      { cause: err }
+    );
+  }
   if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") {
     return new HttpTransportError(
       "dns",
@@ -44780,7 +44799,6 @@ var Atbash = class _Atbash {
     try {
       setupTelemetry({
         enabled: true,
-        source: "sdk",
         endpoint: this.endpoint,
         getAuthHeaders: () => this.authHeaders()
       });
@@ -45668,7 +45686,8 @@ var Atbash = class _Atbash {
       resp.status,
       await safeText(resp),
       resp.statusText,
-      this.endpoint
+      this.endpoint,
+      requestPath(resp.url)
     );
   }
   /**
@@ -45810,6 +45829,14 @@ function parseJson(bytes) {
   const parsed = tryParseJson(bytes.toString("utf-8"));
   return parsed === void 0 ? {} : parsed;
 }
+function requestPath(url) {
+  if (!url) return void 0;
+  try {
+    return new URL(url).pathname || void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function safeText(resp) {
   try {
     return await resp.text();
@@ -46121,7 +46148,22 @@ async function guardMemoryWrite(input) {
     debug: debug2 = false,
     logger: logger2
   } = input;
-  const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  let memEntry;
+  try {
+    memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    logger2?.warn?.("[atbash] memory classifier refused this tool call's input", { reason: why });
+    if (!enforce) return { handled: false };
+    return {
+      handled: true,
+      decision: {
+        allow: false,
+        block: true,
+        reason: `Memory protection could not read this tool call (${why}); blocked because it could not be checked.`
+      }
+    };
+  }
   if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
   if (!memEntry) return { handled: false };
   let scanResult;

package/dist/index.d.mts

@@ -721,7 +721,18 @@ declare class AtbashAPIError extends Error {
     readonly status: number;
     /** Raw response body text (may be empty). */
     readonly body: string;
-    constructor(status: number, body: string, statusText?: string, endpoint?: string);
+    /**
+     * Request path this status came from, e.g. `/api/v1/judge` — absent when the
+     * request never reached a response (transport failures carry status 0).
+     *
+     * A status alone does not say what failed. Several routes answer one call, and
+     * more than one of them can 404: a caller reading only `404` cannot tell "this
+     * agent is not registered" from "the chain-routing lookup did not resolve", and
+     * has to guess from the body's prose — which a 404 raised before any handler
+     * ran does not carry. The path is the fact that settles it.
+     */
+    readonly path?: string;
+    constructor(status: number, body: string, statusText?: string, endpoint?: string, path?: string);
 }
 declare class SignatureVerificationError extends Error {
     constructor(message: string);
@@ -1068,6 +1079,13 @@ interface ClassifyMemoryWriteOptions {
  *
  * Empty-content writes return `null`: they can't carry a poisoning
  * payload, and the regular audit path still sees them.
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryWrite(event: unknown, ctx: unknown, opts?: ClassifyMemoryWriteOptions): MemoryEntry | null;
 
@@ -1236,6 +1254,13 @@ interface ClassifyMemoryReadOptions {
  * Caller-supplied `patterns` are MERGED with the defaults (matches
  * Node's original behavior — extending in one plugin doesn't disable
  * standard coverage).
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryRead(event: unknown, ctx: unknown, opts?: ClassifyMemoryReadOptions): boolean;
 

package/dist/index.d.ts

@@ -721,7 +721,18 @@ declare class AtbashAPIError extends Error {
     readonly status: number;
     /** Raw response body text (may be empty). */
     readonly body: string;
-    constructor(status: number, body: string, statusText?: string, endpoint?: string);
+    /**
+     * Request path this status came from, e.g. `/api/v1/judge` — absent when the
+     * request never reached a response (transport failures carry status 0).
+     *
+     * A status alone does not say what failed. Several routes answer one call, and
+     * more than one of them can 404: a caller reading only `404` cannot tell "this
+     * agent is not registered" from "the chain-routing lookup did not resolve", and
+     * has to guess from the body's prose — which a 404 raised before any handler
+     * ran does not carry. The path is the fact that settles it.
+     */
+    readonly path?: string;
+    constructor(status: number, body: string, statusText?: string, endpoint?: string, path?: string);
 }
 declare class SignatureVerificationError extends Error {
     constructor(message: string);
@@ -1068,6 +1079,13 @@ interface ClassifyMemoryWriteOptions {
  *
  * Empty-content writes return `null`: they can't carry a poisoning
  * payload, and the regular audit path still sees them.
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryWrite(event: unknown, ctx: unknown, opts?: ClassifyMemoryWriteOptions): MemoryEntry | null;
 
@@ -1236,6 +1254,13 @@ interface ClassifyMemoryReadOptions {
  * Caller-supplied `patterns` are MERGED with the defaults (matches
  * Node's original behavior — extending in one plugin doesn't disable
  * standard coverage).
+ *
+ * THROWS on host input it cannot read without side effects: a proxy, an accessor where a data
+ * property is expected, a value with no safe projection, or one past the size bounds. Refusing is
+ * deliberate - a silent `null` would report "not a memory write" for a call nobody could classify,
+ * and memory protection would be skipped exactly where the input was strange. Callers that sit in a
+ * host hook MUST catch it and turn it into a decision; `guardMemoryWrite` and
+ * `MemoryGuardManager.handleBeforeToolCall` already do.
  */
 declare function classifyMemoryRead(event: unknown, ctx: unknown, opts?: ClassifyMemoryReadOptions): boolean;
 

package/dist/index.js

@@ -3073,11 +3073,23 @@ var AtbashAPIError = class extends Error {
   status;
   /** Raw response body text (may be empty). */
   body;
-  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT) {
-    super(enrich(status, body, statusText, endpoint));
+  /**
+   * Request path this status came from, e.g. `/api/v1/judge` — absent when the
+   * request never reached a response (transport failures carry status 0).
+   *
+   * A status alone does not say what failed. Several routes answer one call, and
+   * more than one of them can 404: a caller reading only `404` cannot tell "this
+   * agent is not registered" from "the chain-routing lookup did not resolve", and
+   * has to guess from the body's prose — which a 404 raised before any handler
+   * ran does not carry. The path is the fact that settles it.
+   */
+  path;
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path7) {
+    super(enrich(status, body, statusText, endpoint, path7));
     this.name = "AtbashAPIError";
     this.status = status;
     this.body = body;
+    this.path = path7;
   }
 };
 var SignatureVerificationError = class extends Error {
@@ -3086,9 +3098,9 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
-function enrich(status, body, statusText, endpoint) {
+function enrich(status, body, statusText, endpoint, path7) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-  let msg = `API error ${status}: ${body || statusText}`;
+  let msg = `API error ${status}${path7 ? ` from ${path7}` : ""}: ${body || statusText}`;
   const lowered = body.toLowerCase();
   if (lowered.includes("agent not registered")) {
     msg += `
@@ -3178,6 +3190,13 @@ function classifyTransportError(err, url, method, timeoutMs) {
       { cause: err }
     );
   }
+  if (code2 === "UND_ERR_CONNECT_TIMEOUT") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} could not establish a connection before the transport deadline \u2014 check the endpoint and network`,
+      { cause: err }
+    );
+  }
   if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") {
     return new HttpTransportError(
       "dns",
@@ -3342,6 +3361,7 @@ var meterProvider = null;
 var callCounter = null;
 var durationHistogram = null;
 var defaultSource = "sdk";
+var sourceExplicitlySet = false;
 function isTelemetryOptedOut() {
   const disabled = process.env.ATBASH_TELEMETRY_DISABLED?.trim().toLowerCase();
   if (disabled && ["1", "true", "yes", "on"].includes(disabled)) {
@@ -3365,11 +3385,14 @@ function autoInit() {
 }
 function setupTelemetry(config2) {
   if (!config2.enabled) return;
-  if (meterProvider) return;
   if (isTelemetryOptedOut()) return;
+  if (config2.source && !sourceExplicitlySet) {
+    defaultSource = config2.source;
+    sourceExplicitlySet = true;
+  }
+  if (meterProvider) return;
   if (!config2.endpoint || !config2.getAuthHeaders) return;
   if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(config2.endpoint)) return;
-  defaultSource = config2.source ?? "sdk";
   const proxyUrl = `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`;
   const getAuthHeaders = config2.getAuthHeaders;
   const exporter = new import_exporter_metrics_otlp_http.OTLPMetricExporter({
@@ -3422,6 +3445,8 @@ async function shutdownTelemetry() {
   meterProvider = null;
   callCounter = null;
   durationHistogram = null;
+  defaultSource = "sdk";
+  sourceExplicitlySet = false;
 }
 
 // src-ts/userConfig.ts
@@ -3612,7 +3637,6 @@ var Atbash = class _Atbash {
     try {
       setupTelemetry({
         enabled: true,
-        source: "sdk",
         endpoint: this.endpoint,
         getAuthHeaders: () => this.authHeaders()
       });
@@ -4500,7 +4524,8 @@ var Atbash = class _Atbash {
       resp.status,
       await safeText(resp),
       resp.statusText,
-      this.endpoint
+      this.endpoint,
+      requestPath(resp.url)
     );
   }
   /**
@@ -4642,6 +4667,14 @@ function parseJson(bytes) {
   const parsed = tryParseJson(bytes.toString("utf-8"));
   return parsed === void 0 ? {} : parsed;
 }
+function requestPath(url) {
+  if (!url) return void 0;
+  try {
+    return new URL(url).pathname || void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function safeText(resp) {
   try {
     return await resp.text();
@@ -35299,9 +35332,9 @@ var ZodUnion = class extends ZodType {
   }
 };
 types.ZodUnion = ZodUnion;
-ZodUnion.create = (types2, params) => {
+ZodUnion.create = (types3, params) => {
   return new ZodUnion({
-    options: types2,
+    options: types3,
     typeName: ZodFirstPartyTypeKind.ZodUnion,
     ...processCreateParams(params)
   });
@@ -38758,9 +38791,9 @@ _nodeUtil.exports;
   var freeProcess = moduleExports && freeGlobal2.process;
   var nodeUtil2 = (function() {
     try {
-      var types2 = freeModule && freeModule.require && freeModule.require("util").types;
-      if (types2) {
-        return types2;
+      var types3 = freeModule && freeModule.require && freeModule.require("util").types;
+      if (types3) {
+        return types3;
       }
       return freeProcess && freeProcess.binding && freeProcess.binding("util");
     } catch (e) {
@@ -43140,12 +43173,96 @@ async function rollbackMemory(toId, reason, auth, opts) {
 }
 
 // src-ts/memory/_json_safe.ts
+var import_node_util = require("util");
+var replacementKeys = [
+  "newText",
+  "new_string",
+  "new_str",
+  "newStr",
+  "replacement"
+];
+var argumentKeys = [
+  "file_path",
+  "path",
+  "filename",
+  "target",
+  "file",
+  "filePath",
+  "content",
+  ...replacementKeys,
+  "value",
+  "text"
+];
+var maxPrototypeDepth = 32;
+var maxEditSlots = 65536;
+var maxTextUnits = 16 * 1024 * 1024;
+function invalid() {
+  throw new TypeError("Unreadable or unsupported memory classifier input");
+}
+function dataProperty(value, key3) {
+  let current = value;
+  for (let depth = 0; current !== null; depth++) {
+    if (depth >= maxPrototypeDepth || import_node_util.types.isProxy(current)) invalid();
+    const descriptor = Object.getOwnPropertyDescriptor(current, key3);
+    if (descriptor) {
+      if (!("value" in descriptor)) invalid();
+      return descriptor.value;
+    }
+    current = Object.getPrototypeOf(current);
+  }
+  return void 0;
+}
 function toJsonSafe(value) {
-  try {
-    return JSON.parse(JSON.stringify(value ?? null));
-  } catch {
-    return null;
+  let textUnits = 0;
+  function scalar(input) {
+    if (input == null) return null;
+    if (typeof input === "string") {
+      textUnits += input.length;
+      if (textUnits > maxTextUnits) invalid();
+      return input;
+    }
+    if (typeof input === "boolean") return input;
+    if (typeof input === "number" && Number.isFinite(input)) return input;
+    return invalid();
+  }
+  function project(input, shape) {
+    if (input == null || typeof input !== "object") return scalar(input);
+    if (import_node_util.types.isProxy(input) || Array.isArray(input)) invalid();
+    const output = /* @__PURE__ */ Object.create(null);
+    const keys2 = shape === "envelope" ? ["toolName", "name"] : shape === "tool" ? ["name"] : shape === "args" ? argumentKeys : replacementKeys;
+    for (const key3 of keys2) {
+      const field = dataProperty(input, key3);
+      if (field !== void 0) output[key3] = scalar(field);
+    }
+    if (shape === "envelope") {
+      for (const key3 of ["params", "args", "arguments", "tool"]) {
+        const field = dataProperty(input, key3);
+        if (field !== void 0)
+          output[key3] = project(field, key3 === "tool" ? "tool" : "args");
+      }
+    }
+    if (shape === "args") {
+      const edits = dataProperty(input, "edits");
+      if (edits !== void 0) {
+        if (edits !== null && typeof edits === "object" && import_node_util.types.isProxy(edits))
+          invalid();
+        if (Array.isArray(edits)) {
+          const length = dataProperty(edits, "length");
+          if (typeof length !== "number" || !Number.isInteger(length) || length < 0 || length > maxEditSlots)
+            invalid();
+          const entries = [];
+          for (let index2 = 0; index2 < length; index2++) {
+            entries.push(project(dataProperty(edits, String(index2)), "edit"));
+          }
+          output.edits = entries;
+        } else {
+          output.edits = scalar(edits);
+        }
+      }
+    }
+    return output;
   }
+  return project(value, "envelope");
 }
 
 // src-ts/memory/classifier.ts
@@ -43198,7 +43315,22 @@ async function guardMemoryWrite(input) {
     debug: debug2 = false,
     logger: logger2
   } = input;
-  const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  let memEntry;
+  try {
+    memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    logger2?.warn?.("[atbash] memory classifier refused this tool call's input", { reason: why });
+    if (!enforce) return { handled: false };
+    return {
+      handled: true,
+      decision: {
+        allow: false,
+        block: true,
+        reason: `Memory protection could not read this tool call (${why}); blocked because it could not be checked.`
+      }
+    };
+  }
   if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
   if (!memEntry) return { handled: false };
   let scanResult;
@@ -43542,7 +43674,21 @@ var MemoryGuardManager = class {
    * that allows is a call the host still needs to judge.
    */
   async handleBeforeToolCall(event, ctx) {
-    if (classifyMemoryRead(event, ctx, this.opts.memoryReadClassifier)) {
+    let isMemoryRead;
+    try {
+      isMemoryRead = classifyMemoryRead(event, ctx, this.opts.memoryReadClassifier);
+    } catch (err) {
+      const why = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] memory classifier refused this tool call's input", { reason: why });
+      if (!this.enforce) return null;
+      return {
+        allow: false,
+        block: true,
+        blockReason: `Memory protection could not read this tool call (${why}); blocked because it could not be checked.`,
+        audited: true
+      };
+    }
+    if (isMemoryRead) {
       this.logger.info("[atbash] memory read intercepted \u2014 running sync check");
       return await this.handleMemoryRead(event, ctx);
     }

package/dist/index.mjs

@@ -2977,11 +2977,23 @@ var AtbashAPIError = class extends Error {
   status;
   /** Raw response body text (may be empty). */
   body;
-  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT) {
-    super(enrich(status, body, statusText, endpoint));
+  /**
+   * Request path this status came from, e.g. `/api/v1/judge` — absent when the
+   * request never reached a response (transport failures carry status 0).
+   *
+   * A status alone does not say what failed. Several routes answer one call, and
+   * more than one of them can 404: a caller reading only `404` cannot tell "this
+   * agent is not registered" from "the chain-routing lookup did not resolve", and
+   * has to guess from the body's prose — which a 404 raised before any handler
+   * ran does not carry. The path is the fact that settles it.
+   */
+  path;
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path7) {
+    super(enrich(status, body, statusText, endpoint, path7));
     this.name = "AtbashAPIError";
     this.status = status;
     this.body = body;
+    this.path = path7;
   }
 };
 var SignatureVerificationError = class extends Error {
@@ -2990,9 +3002,9 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
-function enrich(status, body, statusText, endpoint) {
+function enrich(status, body, statusText, endpoint, path7) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-  let msg = `API error ${status}: ${body || statusText}`;
+  let msg = `API error ${status}${path7 ? ` from ${path7}` : ""}: ${body || statusText}`;
   const lowered = body.toLowerCase();
   if (lowered.includes("agent not registered")) {
     msg += `
@@ -3082,6 +3094,13 @@ function classifyTransportError(err, url, method, timeoutMs) {
       { cause: err }
     );
   }
+  if (code2 === "UND_ERR_CONNECT_TIMEOUT") {
+    return new HttpTransportError(
+      "timeout",
+      `${method} ${url} could not establish a connection before the transport deadline \u2014 check the endpoint and network`,
+      { cause: err }
+    );
+  }
   if (code2 === "ENOTFOUND" || code2 === "EAI_AGAIN") {
     return new HttpTransportError(
       "dns",
@@ -3249,6 +3268,7 @@ var meterProvider = null;
 var callCounter = null;
 var durationHistogram = null;
 var defaultSource = "sdk";
+var sourceExplicitlySet = false;
 function isTelemetryOptedOut() {
   const disabled = process.env.ATBASH_TELEMETRY_DISABLED?.trim().toLowerCase();
   if (disabled && ["1", "true", "yes", "on"].includes(disabled)) {
@@ -3272,11 +3292,14 @@ function autoInit() {
 }
 function setupTelemetry(config2) {
   if (!config2.enabled) return;
-  if (meterProvider) return;
   if (isTelemetryOptedOut()) return;
+  if (config2.source && !sourceExplicitlySet) {
+    defaultSource = config2.source;
+    sourceExplicitlySet = true;
+  }
+  if (meterProvider) return;
   if (!config2.endpoint || !config2.getAuthHeaders) return;
   if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(config2.endpoint)) return;
-  defaultSource = config2.source ?? "sdk";
   const proxyUrl = `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`;
   const getAuthHeaders = config2.getAuthHeaders;
   const exporter = new OTLPMetricExporter({
@@ -3329,6 +3352,8 @@ async function shutdownTelemetry() {
   meterProvider = null;
   callCounter = null;
   durationHistogram = null;
+  defaultSource = "sdk";
+  sourceExplicitlySet = false;
 }
 
 // src-ts/userConfig.ts
@@ -3525,7 +3550,6 @@ var Atbash = class _Atbash {
     try {
       setupTelemetry({
         enabled: true,
-        source: "sdk",
         endpoint: this.endpoint,
         getAuthHeaders: () => this.authHeaders()
       });
@@ -4413,7 +4437,8 @@ var Atbash = class _Atbash {
       resp.status,
       await safeText(resp),
       resp.statusText,
-      this.endpoint
+      this.endpoint,
+      requestPath(resp.url)
     );
   }
   /**
@@ -4555,6 +4580,14 @@ function parseJson(bytes) {
   const parsed = tryParseJson(bytes.toString("utf-8"));
   return parsed === void 0 ? {} : parsed;
 }
+function requestPath(url) {
+  if (!url) return void 0;
+  try {
+    return new URL(url).pathname || void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function safeText(resp) {
   try {
     return await resp.text();
@@ -35212,9 +35245,9 @@ var ZodUnion = class extends ZodType {
   }
 };
 types.ZodUnion = ZodUnion;
-ZodUnion.create = (types2, params) => {
+ZodUnion.create = (types3, params) => {
   return new ZodUnion({
-    options: types2,
+    options: types3,
     typeName: ZodFirstPartyTypeKind.ZodUnion,
     ...processCreateParams(params)
   });
@@ -38671,9 +38704,9 @@ _nodeUtil.exports;
   var freeProcess = moduleExports && freeGlobal2.process;
   var nodeUtil2 = (function() {
     try {
-      var types2 = freeModule && freeModule.require && freeModule.require("util").types;
-      if (types2) {
-        return types2;
+      var types3 = freeModule && freeModule.require && freeModule.require("util").types;
+      if (types3) {
+        return types3;
       }
       return freeProcess && freeProcess.binding && freeProcess.binding("util");
     } catch (e) {
@@ -43053,12 +43086,96 @@ async function rollbackMemory(toId, reason, auth, opts) {
 }
 
 // src-ts/memory/_json_safe.ts
+import { types as types2 } from "util";
+var replacementKeys = [
+  "newText",
+  "new_string",
+  "new_str",
+  "newStr",
+  "replacement"
+];
+var argumentKeys = [
+  "file_path",
+  "path",
+  "filename",
+  "target",
+  "file",
+  "filePath",
+  "content",
+  ...replacementKeys,
+  "value",
+  "text"
+];
+var maxPrototypeDepth = 32;
+var maxEditSlots = 65536;
+var maxTextUnits = 16 * 1024 * 1024;
+function invalid() {
+  throw new TypeError("Unreadable or unsupported memory classifier input");
+}
+function dataProperty(value, key3) {
+  let current = value;
+  for (let depth = 0; current !== null; depth++) {
+    if (depth >= maxPrototypeDepth || types2.isProxy(current)) invalid();
+    const descriptor = Object.getOwnPropertyDescriptor(current, key3);
+    if (descriptor) {
+      if (!("value" in descriptor)) invalid();
+      return descriptor.value;
+    }
+    current = Object.getPrototypeOf(current);
+  }
+  return void 0;
+}
 function toJsonSafe(value) {
-  try {
-    return JSON.parse(JSON.stringify(value ?? null));
-  } catch {
-    return null;
+  let textUnits = 0;
+  function scalar(input) {
+    if (input == null) return null;
+    if (typeof input === "string") {
+      textUnits += input.length;
+      if (textUnits > maxTextUnits) invalid();
+      return input;
+    }
+    if (typeof input === "boolean") return input;
+    if (typeof input === "number" && Number.isFinite(input)) return input;
+    return invalid();
+  }
+  function project(input, shape) {
+    if (input == null || typeof input !== "object") return scalar(input);
+    if (types2.isProxy(input) || Array.isArray(input)) invalid();
+    const output = /* @__PURE__ */ Object.create(null);
+    const keys2 = shape === "envelope" ? ["toolName", "name"] : shape === "tool" ? ["name"] : shape === "args" ? argumentKeys : replacementKeys;
+    for (const key3 of keys2) {
+      const field = dataProperty(input, key3);
+      if (field !== void 0) output[key3] = scalar(field);
+    }
+    if (shape === "envelope") {
+      for (const key3 of ["params", "args", "arguments", "tool"]) {
+        const field = dataProperty(input, key3);
+        if (field !== void 0)
+          output[key3] = project(field, key3 === "tool" ? "tool" : "args");
+      }
+    }
+    if (shape === "args") {
+      const edits = dataProperty(input, "edits");
+      if (edits !== void 0) {
+        if (edits !== null && typeof edits === "object" && types2.isProxy(edits))
+          invalid();
+        if (Array.isArray(edits)) {
+          const length = dataProperty(edits, "length");
+          if (typeof length !== "number" || !Number.isInteger(length) || length < 0 || length > maxEditSlots)
+            invalid();
+          const entries = [];
+          for (let index2 = 0; index2 < length; index2++) {
+            entries.push(project(dataProperty(edits, String(index2)), "edit"));
+          }
+          output.edits = entries;
+        } else {
+          output.edits = scalar(edits);
+        }
+      }
+    }
+    return output;
   }
+  return project(value, "envelope");
 }
 
 // src-ts/memory/classifier.ts
@@ -43111,7 +43228,22 @@ async function guardMemoryWrite(input) {
     debug: debug2 = false,
     logger: logger2
   } = input;
-  const memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  let memEntry;
+  try {
+    memEntry = classifyMemoryWrite(event, ctx, { patterns, toolNames });
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    logger2?.warn?.("[atbash] memory classifier refused this tool call's input", { reason: why });
+    if (!enforce) return { handled: false };
+    return {
+      handled: true,
+      decision: {
+        allow: false,
+        block: true,
+        reason: `Memory protection could not read this tool call (${why}); blocked because it could not be checked.`
+      }
+    };
+  }
   if (debug2) emitDebugProbe(event, ctx, memEntry, logger2);
   if (!memEntry) return { handled: false };
   let scanResult;
@@ -43455,7 +43587,21 @@ var MemoryGuardManager = class {
    * that allows is a call the host still needs to judge.
    */
   async handleBeforeToolCall(event, ctx) {
-    if (classifyMemoryRead(event, ctx, this.opts.memoryReadClassifier)) {
+    let isMemoryRead;
+    try {
+      isMemoryRead = classifyMemoryRead(event, ctx, this.opts.memoryReadClassifier);
+    } catch (err) {
+      const why = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] memory classifier refused this tool call's input", { reason: why });
+      if (!this.enforce) return null;
+      return {
+        allow: false,
+        block: true,
+        blockReason: `Memory protection could not read this tool call (${why}); blocked because it could not be checked.`,
+        audited: true
+      };
+    }
+    if (isMemoryRead) {
       this.logger.info("[atbash] memory read intercepted \u2014 running sync check");
       return await this.handleMemoryRead(event, ctx);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/sdk",
-  "version": "0.16.1-dev.0",
+  "version": "0.16.3-dev.0",
   "description": "TypeScript SDK for Atbash — the safety layer that evaluates AI agent actions against operator-defined policies before execution.",
   "keywords": [
     "atbash",
@@ -89,10 +89,10 @@
     "typescript-eslint": "^8.62.1"
   },
   "optionalDependencies": {
-    "@atbash/sdk-linux-x64-gnu": "0.16.1-dev.0",
-    "@atbash/sdk-linux-arm64-gnu": "0.16.1-dev.0",
-    "@atbash/sdk-linux-x64-musl": "0.16.1-dev.0",
-    "@atbash/sdk-darwin-arm64": "0.16.1-dev.0",
-    "@atbash/sdk-win32-x64-msvc": "0.16.1-dev.0"
+    "@atbash/sdk-linux-x64-gnu": "0.16.3-dev.0",
+    "@atbash/sdk-linux-arm64-gnu": "0.16.3-dev.0",
+    "@atbash/sdk-linux-x64-musl": "0.16.3-dev.0",
+    "@atbash/sdk-darwin-arm64": "0.16.3-dev.0",
+    "@atbash/sdk-win32-x64-msvc": "0.16.3-dev.0"
   }
 }