@cspeach/cli 1.1.18 → 1.1.20

package/dist/tools/shell/shell_exec.js

@@ -45,10 +45,22 @@ import * as path from 'node:path';
 import { registerTool } from '../index.js';
 import { resolveSafePath, PathOutsideRootError } from '../_filesystem-shared.js';
 import { loadSafelist, buildSafeEnv, resolveExecutable, validateArgv, rejectPathSeparator, DEFAULT_SAFELIST, KILL_GRACE_MS, } from '../_command-shared.js';
+import { killProcessTree } from '../fiori/preview/registry.js';
+import { spillToolResult } from '../result-spill.js';
 const DEFAULT_TIMEOUT_MS = 30_000;
+/** After the kill's grace: how long to wait for the pipes before returning anyway. */
+const ORPHAN_WAIT_MS = 3_000;
 const MAX_TIMEOUT_MS = 300_000;
 const MAX_OUTPUT_BYTES = 1_000_000; // per stream
+/**
+ * Task 17 (spec D12) — output above 8 000 chars is saved to the session spill
+ * file; the result carries the first 60 + last 20 lines (the exit code stays
+ * visible) and a pointer. Sized once, here, when the result is created.
+ */
 export async function shellExecHandler(args, ctx) {
+    return spillToolResult(await runShellExec(args, ctx), ctx, 'shell', { label: 'command output' });
+}
+async function runShellExec(args, ctx) {
     if (!args.command || typeof args.command !== 'string') {
         return { content: 'error: command is required (non-empty string)', is_error: true };
     }
@@ -171,18 +183,38 @@ export async function shellExecHandler(args, ctx) {
                 stderrTrunc = true;
             }
         });
+        const timedOutResult = () => {
+            const tail = (stdoutBuf ? `stdout (partial):\n${stdoutBuf}\n${stdoutTrunc ? '[truncated]\n' : ''}` : '') +
+                (stderrBuf ? `stderr (partial):\n${stderrBuf}\n${stderrTrunc ? '[truncated]\n' : ''}` : '');
+            return { content: `error: command timed out after ${timeoutMs} ms — child killed.\n${tail}`, is_error: true };
+        };
         const timer = setTimeout(() => {
             timedOut = true;
-            try {
-                child.kill('SIGTERM');
+            if (process.platform === 'win32') {
+                // Dry run 2026-09-25: `npm start` = npm.cmd → cmd.exe → node. Killing the
+                // direct child left the server alive holding our pipes; 'close' never
+                // fired and a 45 s call returned after 21 minutes. Kill the whole tree.
+                void killProcessTree(child.pid, child);
             }
-            catch { /* ignore */ }
-            setTimeout(() => {
+            else {
                 try {
-                    child.kill('SIGKILL');
+                    child.kill('SIGTERM');
                 }
                 catch { /* ignore */ }
-            }, KILL_GRACE_MS).unref();
+                setTimeout(() => {
+                    try {
+                        child.kill('SIGKILL');
+                    }
+                    catch { /* ignore */ }
+                }, KILL_GRACE_MS).unref();
+            }
+            // Never wait on an orphan: if the pipes are still open after the kill
+            // had its grace, stop reading and return the timeout result anyway.
+            setTimeout(() => {
+                child.stdout?.destroy();
+                child.stderr?.destroy();
+                settle(timedOutResult());
+            }, KILL_GRACE_MS + ORPHAN_WAIT_MS).unref();
         }, timeoutMs);
         timer.unref();
         child.on('error', (err) => {
@@ -192,12 +224,7 @@ export async function shellExecHandler(args, ctx) {
         child.on('close', (code, signal) => {
             clearTimeout(timer);
             if (timedOut) {
-                const tail = (stdoutBuf ? `stdout (partial):\n${stdoutBuf}\n${stdoutTrunc ? '[truncated]\n' : ''}` : '') +
-                    (stderrBuf ? `stderr (partial):\n${stderrBuf}\n${stderrTrunc ? '[truncated]\n' : ''}` : '');
-                settle({
-                    content: `error: command timed out after ${timeoutMs} ms — child killed.\n${tail}`,
-                    is_error: true,
-                });
+                settle(timedOutResult());
                 return;
             }
             const stdoutSection = `stdout:\n${stdoutBuf}${stdoutTrunc ? '\n[truncated — exceeded 1 MB cap]' : ''}`;

package/dist/tools/subagent/adt-serial.js

@@ -0,0 +1,33 @@
+/**
+ * Task 18 (ruling F21) — parallel readers share one AdtClient, and concurrent
+ * ADT requests through it are unverified. Readers run their MODEL work in
+ * parallel, but their SAP calls go through one lock: one ADT request at a
+ * time for the whole reader group.
+ */
+/** A FIFO mutex. A call that fails releases the lock like one that succeeds. */
+export function createAdtLock() {
+    let tail = Promise.resolve();
+    return {
+        run(fn) {
+            const result = tail.then(() => fn());
+            tail = result.then(() => undefined, () => undefined);
+            return result;
+        },
+    };
+}
+/**
+ * A view of `adt` whose method calls run through `lock`. Methods run on the
+ * real client (`this` is the client, so its internal calls are not re-queued);
+ * non-function properties pass through. Every AdtClient method a reader tool
+ * calls is async, so returning a promise changes nothing for the caller.
+ */
+export function serializeAdt(adt, lock) {
+    return new Proxy(adt, {
+        get(target, prop, _receiver) {
+            const value = Reflect.get(target, prop, target);
+            if (typeof value !== 'function')
+                return value;
+            return (...args) => lock.run(() => value.apply(target, args));
+        },
+    });
+}

package/dist/tools/subagent/agent_run.js

@@ -122,6 +122,8 @@ export async function agentRunHandler(args, ctx) {
         cwd: ctx.cwd,
         provider: ctx.provider,
         skillSource: ctx.skillSource,
+        // Task 18 fix M4 — an agent_run child never starts reader subagents.
+        subagent: true,
         // previewHook + pendingDispatch + currentTransport + todoEmitter
         // intentionally omitted.
     };

package/dist/tools/subagent/read_agent.js

@@ -0,0 +1,178 @@
+/**
+ * read_agent — Task 18 (model control, 2026-09-27, spec D18).
+ *
+ * Heavy reading (many sources, a where-used walk, ATC-finding triage, a
+ * package inventory) runs in a lean child conversation and only a short
+ * report returns to the parent's history. Unlike agent_run (flag-gated, a
+ * full skill prefix per child), a reader carries:
+ *   - a ~300-token system prompt owned by the proxy (skill header `_reader`,
+ *     ruling F8; BYOK / AI-hub use the pinned copy in reader-prompt.ts),
+ *   - a fixed small tool list (READER_TOOLS: read-only, no tool search),
+ *   - the session model at effort `low`, role `reader` (never enforced, F7),
+ *   - a capped report: overflow is saved to a file and the tail is cut.
+ *
+ * Read-only and depth 1 are enforced by `ctx.readerMode` at dispatch (F22).
+ * The loop runs consecutive read_agent calls concurrently, each with its own
+ * ctx clone whose `adt` is serialized through one lock (F21). The child's
+ * spend is added to the parent's per-turn `readerSpend` (F24); the child also
+ * writes its own reader-*-cost.jsonl.
+ */
+import { EventEmitter } from 'node:events';
+import { listTools, registerTool, toolsForContext } from '../index.js';
+import { runTurn } from '../../agent/loop.js';
+import { collectTurnAssistantText } from '../../agent/turn-assistant-text.js';
+import { newSession } from '../../session/schema.js';
+import { computeSessionCost } from '../../cost/session-cost.js';
+import { sessionIdOf, spillIfLarge } from '../result-spill.js';
+import { INTERRUPTED_LINE, READER_SKILL, READER_SYSTEM_PROMPT, READER_TOOLS, hasReaderReadTools } from './reader-prompt.js';
+export { INTERRUPTED_LINE, READER_SKILL, READER_SYSTEM_PROMPT, READER_TOOLS, hasReaderReadTools };
+export const BRIEF_MAX_CHARS = 4_000;
+export const DEFAULT_REPORT_MAX_CHARS = 3_000;
+export const HARD_REPORT_MAX_CHARS = 6_000;
+/**
+ * Final review tools-I4 — told to every reader. The proxy owns the reader's
+ * system prompt (pinned byte-equal), so the CLI says this in the child's
+ * user message.
+ */
+export const PARENT_OUTPUT_LINE = 'A saved-output path in this brief (a scan or ATC result the main session already ran) can be read with ' +
+    'tool_output_read. Read it instead of repeating the scan: never re-run ATC or a scan whose output you were given.';
+/** The result when the account's proxy refuses the `_reader` skill. */
+export const NOT_ENABLED_LINE = 'readers are not enabled for this account — read the sources directly';
+function reportCap(raw) {
+    if (typeof raw !== 'number' || !Number.isFinite(raw) || raw < 1)
+        return DEFAULT_REPORT_MAX_CHARS;
+    return Math.min(Math.floor(raw), HARD_REPORT_MAX_CHARS);
+}
+function isNotEntitled(err) {
+    const e = err;
+    if (e?.error?.error === 'skill_not_in_entitlements')
+        return true;
+    return typeof e?.message === 'string' && e.message.includes('skill_not_in_entitlements');
+}
+export async function readAgentHandler(args, ctx) {
+    const brief = args?.brief;
+    if (typeof brief !== 'string' || brief.trim().length === 0) {
+        return { content: "error: 'brief' is required: say what to read and what to report.", is_error: true };
+    }
+    if (brief.length > BRIEF_MAX_CHARS) {
+        return { content: `error: 'brief' is ${brief.length} chars; keep it under ${BRIEF_MAX_CHARS}.`, is_error: true };
+    }
+    // Depth 1 (dispatch refuses this too; belt and braces for direct calls).
+    if (ctx.readerMode) {
+        return { content: 'error: a reader cannot start another reader.', is_error: true };
+    }
+    // Fix M4 — an agent_run child does its own reading.
+    if (ctx.subagent) {
+        return { content: 'error: a subagent cannot start a reader — read the sources directly.', is_error: true };
+    }
+    // Fix M5 — nothing a reader could read here (standalone, file tools off).
+    if (!hasReaderReadTools(new Set(toolsForContext(listTools(), ctx).map((t) => t.name)))) {
+        return { content: 'error: no read tools are available to a reader here — read the sources directly.', is_error: true };
+    }
+    if (ctx.signal?.aborted)
+        return { content: INTERRUPTED_LINE, is_error: true };
+    if (!ctx.provider) {
+        return { content: 'error: read_agent requires ctx.provider — not wired into this ToolContext.', is_error: true };
+    }
+    const cap = reportCap(args.report_max_chars);
+    // The session model, never a cheaper one (owner decision 11); effort low.
+    const model = ctx.session.model;
+    const childSession = newSession(`reader-${Date.now()}-${Math.floor(Math.random() * 1e9).toString(16)}`, ctx.session.sap_system ?? null, READER_SKILL, model);
+    // Only what a read needs. No previewHook (no writes), no chunkEmitter /
+    // todoEmitter (the child never paints the parent UI), no pendingDispatch /
+    // currentTransport (the child never changes parent REPL state).
+    const parentSessionId = sessionIdOf(ctx);
+    const childCtx = {
+        adt: ctx.adt,
+        sapAlias: ctx.sapAlias,
+        session: childSession,
+        cwd: ctx.cwd,
+        provider: ctx.provider,
+        skillSource: ctx.skillSource,
+        readerMode: true,
+        // Final review tools-I4 — the reader may open the parent's saved outputs.
+        ...(parentSessionId !== undefined ? { spillParentSessionId: parentSessionId } : {}),
+    };
+    const userMessage = `${brief}\n\n${PARENT_OUTPUT_LINE}\n\nReport limit: ${cap} characters.`;
+    let failure = null;
+    try {
+        await runTurn({
+            provider: ctx.provider,
+            userMessage,
+            skill: READER_SKILL,
+            ctx: childCtx,
+            // Null sink: the child's text lands in childSession.messages only.
+            chunkEmitter: new EventEmitter(),
+            modelRole: 'reader',
+            toolsOverride: READER_TOOLS,
+            effortOverride: 'low',
+            modelOverride: model,
+            suppressSaveHook: true,
+            // Fix I1 — Esc / Ctrl+C on the parent turn stops the reader's stream.
+            signal: ctx.signal,
+        });
+    }
+    catch (err) {
+        failure = err;
+    }
+    finally {
+        // Spend counts whether or not the reader finished.
+        if (ctx.readerSpend) {
+            ctx.readerSpend.cost += computeSessionCost(childSession);
+            ctx.readerSpend.calls += 1;
+        }
+    }
+    if (failure !== null) {
+        if (ctx.signal?.aborted)
+            return { content: INTERRUPTED_LINE, is_error: true };
+        if (isNotEntitled(failure))
+            return { content: NOT_ENABLED_LINE, is_error: true };
+        const msg = failure instanceof Error ? failure.message : String(failure);
+        return { content: `error: the reader failed — ${msg.slice(0, 300)}`, is_error: true };
+    }
+    const text = collectTurnAssistantText(childSession.messages, 0).trim();
+    if (text.length === 0) {
+        return {
+            content: 'error: the reader returned no report — read the sources directly.',
+            is_error: true,
+        };
+    }
+    if (text.length <= cap)
+        return { content: text };
+    // Over the cap: the full report goes to the PARENT's spill area under the
+    // parent's tool_use id, where tool_output_read can open it.
+    const head = text.slice(0, cap);
+    const sessionId = sessionIdOf(ctx);
+    const spilled = sessionId !== undefined
+        ? spillIfLarge({ text, sessionId, toolUseId: ctx.toolUseId, kind: 'report', threshold: cap })
+        : null;
+    const where = spilled?.spilled ? ` — full report saved to ${spilled.path}` : '';
+    return { content: `${head}\n[report cut at ${cap} chars${where}]` };
+}
+registerTool({
+    name: 'read_agent',
+    description: 'Hand heavy reading to a lean read-only reader; only its short report comes back. Use it for more ' +
+        'than two source reads, a where-used scan, ATC-finding triage or a package inventory when the turn ' +
+        'will keep working afterwards. The reader has read-only SAP and file tools; it cannot write, ask the ' +
+        'user or start another reader. Give a precise brief: what to read and what to report. To hand over ' +
+        'a result you already have (ATC findings), put its saved-output path in the brief: the reader reads it ' +
+        'and never re-runs the scan. Send ' +
+        'independent readers in one response; they run at the same time.',
+    isMutating: false,
+    category: 'subagent',
+    input_schema: {
+        type: 'object',
+        properties: {
+            brief: {
+                type: 'string',
+                description: 'What to read (objects, includes, packages) and what to report. Max 4000 characters.',
+            },
+            report_max_chars: {
+                type: 'number',
+                description: 'Report length limit. Default 3000, max 6000. Longer reports are cut and saved to a file.',
+            },
+        },
+        required: ['brief'],
+    },
+    handler: (args, ctx) => readAgentHandler(args, ctx),
+});

package/dist/tools/subagent/reader-prompt.js

@@ -0,0 +1,48 @@
+/**
+ * Task 18 (model control, 2026-09-27, spec D18, ruling F8) — the reader
+ * subagent's system prompt and tool list.
+ *
+ * The PROXY owns READER_SYSTEM_PROMPT (cspeach-proxy/src/skills/
+ * reader-prompt.ts): for the skill header `_reader` it sends that constant
+ * and ignores the client's `system`. This is the CLI's pinned copy, used only
+ * where the CLI talks to a model directly (BYOK, AI-hub, local).
+ * src/tools/__tests__/reader-prompt-pin.test.ts asserts the two template
+ * literals stay byte-equal — edit both files together.
+ *
+ * No imports on purpose: tool-dispatch.ts reads READER_TOOLS, and importing
+ * read_agent.ts there would close a cycle through agent/loop.ts.
+ */
+/** The skill header a reader's model calls carry. */
+export const READER_SKILL = '_reader';
+export const READER_SYSTEM_PROMPT = `You are a read-only investigator inside CSPeach. Read exactly what the brief asks for with the tools you have, then answer the brief. Report facts with object names, includes and line numbers. Say what you could not find. No recommendations unless the brief asks. Stay under the report limit.`;
+/**
+ * The reader's fixed, small, static tool list (no deferred entries, no tool
+ * search): the ten read-only tools of spec D18 plus tool_output_read (Task
+ * 17), so a reader can open a result that was saved to a file. Every entry is
+ * `isMutating: false`. Flag-gated entries (file_read, grep, glob) reach the
+ * reader only when the session has them on, and standalone hides the SAP ones.
+ * tool-dispatch.ts refuses every other tool while `ctx.readerMode` is set.
+ */
+export const READER_TOOLS = Object.freeze([
+    'sap_get_source',
+    'sap_object_structure',
+    'sap_search_object',
+    'sap_sql_query',
+    'sap_usage_references',
+    'sap_class_includes',
+    'sap_atc_run',
+    'file_read',
+    'grep',
+    'glob',
+    'tool_output_read',
+]);
+/** Task 18 fix I1 — the result of a reader stopped by Esc / Ctrl+C (or never started). */
+export const INTERRUPTED_LINE = 'interrupted: the reader was stopped before it finished';
+/**
+ * Task 18 fix M5 — true when a reader would have at least one real read tool
+ * among `visibleNames` (tool_output_read alone reads nothing new: standalone
+ * with the file tools off). The loop hides read_agent otherwise.
+ */
+export function hasReaderReadTools(visibleNames) {
+    return READER_TOOLS.some((n) => n !== 'tool_output_read' && visibleNames.has(n));
+}

package/dist/tools/syntax-state.js

@@ -0,0 +1,67 @@
+/**
+ * Round 7 item 8e — which objects' LAST syntax check found errors (this CLI
+ * process). Written by every syntax check the CLI runs (the Rule 10 write
+ * gate and the sap_syntax_check tool); read by the approval risk floor (such
+ * an object never auto-approves) and by sap_activate (an automatically minted
+ * approval never activates it). A clean check clears the object.
+ *
+ * Review r7 M-3 — keyed by object TYPE and name: a PROG and a CLAS with the
+ * same name never share the flag. `PROG/P` and `PROG` are the same type.
+ *
+ * Re-review 2 item 2 — a name index of flagged objects. When either side's
+ * type is not a known ADT code (a recorded "ABAP CLASS", a queried "some
+ * thing"), the object is matched by name alone: over-match, never miss.
+ */
+import { normaliseAdtType } from '../approvals/adt-type.js';
+const UNKNOWN = '?';
+/** name → the type codes (or UNKNOWN) flagged under that name. */
+const byName = new Map();
+const nameOf = (name) => name.trim().toUpperCase();
+const codeOf = (type) => normaliseAdtType(type) ?? UNKNOWN;
+export function recordSyntaxCheck(type, name, hasErrors) {
+    const n = nameOf(name);
+    const c = codeOf(type);
+    const set = byName.get(n) ?? new Set();
+    if (hasErrors)
+        set.add(c);
+    else {
+        set.delete(c);
+        // Final review A M-3 — a clean check under a KNOWN code also clears an
+        // entry recorded under an unknown type word for the same name.
+        if (c !== UNKNOWN)
+            set.delete(UNKNOWN);
+    }
+    if (set.size > 0)
+        byName.set(n, set);
+    else
+        byName.delete(n);
+}
+export function hasRecordedSyntaxErrors(type, name) {
+    const set = byName.get(nameOf(name));
+    if (!set || set.size === 0)
+        return false;
+    const c = codeOf(type);
+    return c === UNKNOWN || set.has(c) || set.has(UNKNOWN);
+}
+/** Final review A M-1 — any flagged entry with this name, whatever its type. */
+export function hasRecordedSyntaxErrorsByName(name) {
+    return (byName.get(nameOf(name))?.size ?? 0) > 0;
+}
+/**
+ * Final review A M-2 — a successful activation verified against the
+ * inactive-objects list proves the current source compiles: clear the name.
+ */
+export function clearSyntaxErrorsAfterActivation(name) {
+    byName.delete(nameOf(name));
+}
+/** `TYPE:NAME` keys (TYPE is an ADT code, or `?` when the type word was unknown). */
+export function objectsWithSyntaxErrors() {
+    const out = [];
+    for (const [n, set] of byName)
+        for (const c of set)
+            out.push(`${c}:${n}`);
+    return out;
+}
+export function resetSyntaxStateForTest() {
+    byName.clear();
+}

package/dist/tools/todo.js

@@ -7,14 +7,14 @@
  *
  * Semantics: FULL-LIST REPLACE on every call — never a delta. 1..20 items.
  *
- * Transcript render (CC-style, 2026-07): on every successful set the
- * handler also emits the FULL checklist as a scrollback block via
- * ctx.chunkEmitter (renderer/todo-block.ts). The raw ⏺/⎿ todo_set rows are
- * widget-suppressed (renderer/tool-widget.ts) so the block is the sole
- * visible representation — the transcript now shows the whole plan
- * advancing, not a raw `⏺ todo_set({"todos":[…])` JSON line. This is the
- * Claude-Code parity the owner asked for; the turn-status strip (single ▶
- * row) and Ctrl+T panel stay exactly as they were.
+ * Transcript render (piece 2, spec §4 — was CC-style 2026-07): WHERE the
+ * checklist is drawn depends on the render mode (renderer/checklist-format.ts
+ * checklistRenderMode). Ink draws a LIVE checklist (ui/checklist.tsx) that
+ * redraws in place, with one close line at turn end; classic interactive
+ * prints the block once at turn end (repl/plan-turn-end.ts); only headless /
+ * one-shot emit the per-set scrollback block (renderer/todo-block.ts) via
+ * ctx.chunkEmitter, so CI logs keep the progression. The raw ⏺/⎿ todo_set
+ * rows are widget-suppressed (renderer/tool-widget.ts) in every mode.
  *
  * Session-write route (chosen with evidence, 2026-07-05): the tool mutates
  * `ctx.session.todos` directly. ToolContext.session IS the live
@@ -45,6 +45,8 @@
  */
 import { registerTool } from './index.js';
 import { formatTodoChecklistBlock } from '../renderer/todo-block.js';
+import { checklistRenderMode } from '../renderer/checklist-format.js';
+import { markTodoSetThisTurn } from '../ui/todo-emitter.js';
 /** Hard cap on list length — past this the list stops being a glanceable plan. */
 export const TODO_MAX_ITEMS = 20;
 const VALID_STATUSES = new Set(['pending', 'in_progress', 'completed']);
@@ -85,16 +87,19 @@ export async function todoSetHandler(args, ctx) {
     // copy so a consumer mutating the payload can never corrupt the
     // persisted session state.
     ctx.todoEmitter?.emit('update', todos.map((t) => ({ ...t })));
-    // Transcript render (CC-style, 2026-07): drop the FULL checklist into
-    // scrollback on every successful set. The raw ⏺/⎿ todo_set rows are
-    // widget-suppressed (renderer/tool-widget.ts), so this block is the sole
-    // visible representation — mirroring ask_question. ctx.chunkEmitter routes
-    // to Ink Static scrollback AND the classic 'chunk'→stdout path
-    // (renderer/notices.ts). Subagent ctxs deliberately omit chunkEmitter
-    // (tools/subagent/agent_run.ts), so a child turn's todo_set can never
-    // print its checklist into the PARENT transcript — same seam as the
-    // todoEmitter suppression above.
-    ctx.chunkEmitter?.emit('chunk', formatTodoChecklistBlock(todos));
+    // Piece 2 (spec §4) — where the checklist is drawn depends on the mode.
+    // Ink: the live checklist (ui/checklist.tsx) redraws in place — no
+    // scrollback reprint per update; one close line lands at turn end
+    // (repl/plan-turn-end.ts). Classic interactive: the block prints once, at
+    // turn end. Headless / one-shot: the block still prints on EVERY update so
+    // CI logs keep the progression. The raw ⏺/⎿ todo_set rows stay
+    // widget-suppressed (renderer/tool-widget.ts). Subagent ctxs omit both
+    // emitters, so a child todo_set never reaches the parent's transcript.
+    if (checklistRenderMode() === 'per-update') {
+        ctx.chunkEmitter?.emit('chunk', formatTodoChecklistBlock(todos));
+    }
+    if (ctx.todoEmitter)
+        markTodoSetThisTurn();
     const result = {
         count: todos.length,
         // LAST-wins, matching the app strip and Ctrl+T panel (both `.at(-1)`).
@@ -119,7 +124,9 @@ registerTool({
         'in_progress at a time. The user sees this list — keep items short and outcome-shaped. ' +
         'Update at EVERY step transition: when you finish a step, immediately call todo_set ' +
         'marking it completed and the next step in_progress. Never batch several finished steps ' +
-        'into one later call — the user watches the ▶ indicator live.',
+        'into one later call — the user watches the ▶ indicator live. ' +
+        // Task 16 (cost profile lever 7): a lone todo_set round re-reads the whole context.
+        'Call todo_set in the same response as your next action, never as the only tool call in a response.',
     isMutating: false,
     category: 'session',
     input_schema: {