@cogitator-ai/express 0.8.16 → 0.8.17

package/README.md

@@ -60,7 +60,7 @@ POST   /api/agents/:name/resume       - Resume a run paused for tool approvals
 
 Run/stream body: `{ input: string; context?: object; threadId?: string }`. `input` must contain more than whitespace and `threadId`, when sent, must be a non-empty string (`400 INVALID_INPUT` otherwise, before the model is called). The validator comes from `@cogitator-ai/server-shared`, so Express, Fastify, Hono and Koa refuse exactly the same bodies. The `usage` of a run answer carries `inputTokens`, `outputTokens` and `totalTokens`, plus `reasoningTokens`, `cachedInputTokens` and `cacheWriteTokens` when the model reported them, the same shape as every other adapter. The `finish` event of an agent stream carries the same `usage` (never the run's cost or duration). The agent list exposes `config.description`, never the agent instructions. The authenticated `userId` (from `auth`) is passed to the run, and the run is aborted when the client disconnects.
 
-- A run puts `context` into the system prompt, and the model reads a `system` thread message as operator instructions, so clients may set neither unless the server allows it: `acceptContext` lists the `context` keys clients may send (`true` accepts any key, for clients trusted like your own code), and `threadMessageRoles` the roles of `POST /threads/:id/messages` (`user` and `assistant` by default). Anything else is refused with `400 INVALID_INPUT`, over HTTP and WebSocket alike.
+- A run sends `context` to the model as data the application supplied, and the model reads a `system` thread message as operator instructions, so clients may set neither unless the server allows it: `acceptContext` lists the `context` keys clients may send (`true` accepts any key, for clients trusted like your own code), and `threadMessageRoles` the roles of `POST /threads/:id/messages` (`user` and `assistant` by default). Anything else is refused with `400 INVALID_INPUT`, over HTTP and WebSocket alike.
 - A `POST` body that is not JSON (`text/plain`, a form) is refused with `415 UNSUPPORTED_MEDIA_TYPE` before it is parsed: browsers send those across origins without a CORS preflight.
 - `POST /agents/:name/run` and `/resume` answer `toAgentRunResponse()` of `@cogitator-ai/server-shared`: `output`, `threadId`, `usage`, `toolCalls` (`{ id, name, arguments }`), `status` and `traceId`, plus `reasoning`, `pendingApprovals`, `structured`, `structuredError`, `truncated`, `blocked` and `iterationLimitReached` when they apply. The WebSocket `complete` event carries the same object, never the system prompt, the history, trace spans or a paused run's checkpoint.
 - The `start` event of an agent stream names the run's thread (the request's `threadId`, or a new one), and `finish` repeats it with the run's outcome, so a client that sent no thread continues the conversation with this one.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cogitator-ai/express",
-  "version": "0.8.16",
+  "version": "0.8.17",
   "description": "Express.js server adapter for Cogitator AI runtime",
   "type": "module",
   "exports": {
@@ -20,21 +20,21 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@cogitator-ai/core": "0.49.0",
-    "@cogitator-ai/types": "0.51.0",
-    "@cogitator-ai/server-shared": "0.5.16"
+    "@cogitator-ai/core": "0.50.0",
+    "@cogitator-ai/types": "0.52.0",
+    "@cogitator-ai/server-shared": "0.5.17"
   },
   "peerDependencies": {
     "express": ">=4.18.0"
   },
   "optionalDependencies": {
-    "@cogitator-ai/workflows": "0.13.3",
-    "@cogitator-ai/swarms": "0.13.3",
+    "@cogitator-ai/workflows": "0.13.4",
+    "@cogitator-ai/swarms": "0.13.4",
     "ws": "^8.22.0"
   },
   "devDependencies": {
-    "@cogitator-ai/workflows": "0.13.3",
-    "@cogitator-ai/swarms": "0.13.3",
+    "@cogitator-ai/workflows": "0.13.4",
+    "@cogitator-ai/swarms": "0.13.4",
     "@types/express": "^5.0.6",
     "@types/supertest": "^7.2.1",
     "@types/ws": "^8.18.2",