@deepstrike/sdk 0.2.44 → 0.2.46

package/dist/runtime/execution-plane.js

@@ -124,9 +124,11 @@ export class LocalExecutionPlane {
             },
         };
         try {
-            const args = JSON.parse(call.arguments || "{}");
-            const originalArgsStr = JSON.stringify(args);
-            const validation = validateToolArguments(registered.schema.parameters, args);
+            const rawArgs = JSON.parse(call.arguments || "{}");
+            const originalArgsStr = JSON.stringify(rawArgs);
+            // validation.args, not rawArgs, from here on: a oneOf/anyOf ROOT accepts a repaired probe
+            // CLONE — the original reference never sees those repairs (auto-casts, strips, defaults).
+            const validation = validateToolArguments(registered.schema.parameters, rawArgs);
             if (validation.error)
                 return { callId: call.id, output: `invalid arguments: ${validation.error}`, isError: true };
             if (validation.repaired) {
@@ -135,13 +137,13 @@ export class LocalExecutionPlane {
                     callId: call.id,
                     name: call.name,
                     originalArguments: originalArgsStr,
-                    repairedArguments: JSON.stringify(args),
+                    repairedArguments: JSON.stringify(validation.args),
                 };
             }
             // M3/G4: pass the run context (incl. `cwd`) so cwd-aware tools scope their work to the
             // sub-agent's worktree. `RunContext` is structurally assignable to the tool's `ToolExecContext`.
             // The per-call `audit` helper (above) layers best-effort side-effect handling on top.
-            const output = await registered.execute(args, callCtx);
+            const output = await registered.execute(validation.args, callCtx);
             if (isAsyncIterable(output)) {
                 let combined = "";
                 const iterator = output[Symbol.asyncIterator]();

package/dist/runtime/runner.d.ts

@@ -255,6 +255,13 @@ export interface RuntimeOptions {
      * concurrency stays vehicle-scoped (spec §2.5).
      */
     runGroup?: RunGroup;
+    /**
+     * Set by the SubAgentOrchestrator for host-derived child runs: the child still joins the
+     * `runGroup` (lineage) and settles its actual terminal usage into the group ledger, but reserves
+     * no budget axes — group admission governs peer vehicles only. The child's caps stay local
+     * (kernel `maxTotalTokens` policy + `resourceQuota`). Never set this for a top-level run.
+     */
+    nestedGroupVehicle?: boolean;
     /**
      * Optional long-term memory policy (`set_memory_policy`). Tunes the kernel's memory subsystem
      * (retrieval top-k, stale-warning age, write validation, memory path). Unset leaves the kernel

package/dist/runtime/runner.js

@@ -559,6 +559,7 @@ export class RuntimeRunner {
             spec,
             manifest,
             sessionLog: this.opts.sessionLog,
+            toolAccess: spec.toolAccess,
             ...(this.opts.subAgentHarness ? { harness: this.opts.subAgentHarness } : {}),
         });
         await this.commitKernelApply(runtime, this.pendingObservations, {
@@ -1567,13 +1568,24 @@ export class RuntimeRunner {
                 startPayload.run_spec = agentRunSpecToKernel(spec);
             }
             // Reserve capacity before start_run. The kernel enforces only this vehicle's grant and reports
-            // exact terminal usage against the same opaque reservation identity.
+            // exact terminal usage against the same opaque reservation identity. A nested vehicle joins for
+            // lineage/settlement only: it reserves no budget axes (group admission governs peer vehicles),
+            // so the parent's held reservation cannot squeeze the child's grant to zero.
             if (this.opts.runGroup) {
                 const g = this.opts.runGroup;
-                groupBudgetScope = await GroupBudgetScope.open(g, { sessionId, role: this.opts.agentId, kind: "vehicle" }, this.groupBudgetRequest());
+                groupBudgetScope = await GroupBudgetScope.open(g, { sessionId, role: this.opts.agentId, kind: "vehicle" }, this.opts.nestedGroupVehicle ? { limits: {}, requested: {} } : this.groupBudgetRequest());
                 this.activeGroupBudgetScope = groupBudgetScope;
             }
-            await this.applyKernelPolicies(runtime, groupBudgetScope);
+            try {
+                await this.applyKernelPolicies(runtime, groupBudgetScope);
+            }
+            catch (err) {
+                // Admission failure (e.g. the kernel rejecting a zero-capacity grant): release the
+                // reservation so it cannot linger in the group ledger, then surface the error.
+                await groupBudgetScope?.release();
+                this.activeGroupBudgetScope = undefined;
+                throw err;
+            }
             // Multimodal upload: seed the user's attachments (images/audio) as a history
             // message before start_run pushes the "[TASK STATE]" anchor. init_task does not
             // clear history, so order becomes [attachment user msg, "Proceed…"] — both land

package/dist/runtime/sub-agent-orchestrator.js

@@ -89,6 +89,15 @@ export class SubAgentOrchestrator {
         const inherit = ctx.toolAccess === "inherit";
         const permitted = new Set(ctx.manifest.permitted_capability_ids ?? []);
         const metaTools = inherit ? availableMetaTools(ctx.parentOpts) : deriveMetaTools(permitted, ctx.parentOpts);
+        // A "filtered" spawn with no capability grants and no meta-tools resolves to a deny-all plane —
+        // the child model sees zero tools and reports "no tools available". Warn the host (visible, not
+        // fatal) with the fix, mirroring `maybeWarnFailureShapedChunk`'s tone. Exempt workflow nodes:
+        // `!inherit && workflow-node ⇒ quarantined ⇒ intentional deny-all, not a misconfiguration.
+        if (!inherit && !ctx.isWorkflowNode && permitted.size === 0 && metaTools.size === 0) {
+            console.warn(`[deepstrike] spawned sub-agent "${ctx.spec.identity.agentId}" resolved to zero tools ` +
+                `(deny-all filter). Mount tools as capabilities and grant via spec.capabilityFilter, or pass ` +
+                `spec.toolAccess:'inherit' to run on the parent's plane. If a tool-less child is intentional, ignore this.`);
+        }
         const basePlane = inherit
             ? ctx.parentOpts.executionPlane
             : new FilteredExecutionPlane(ctx.parentOpts.executionPlane, permitted, metaTools);
@@ -126,6 +135,10 @@ export class SubAgentOrchestrator {
             enablePlanTool: metaTools.has("update_plan") ? ctx.parentOpts.enablePlanTool : undefined,
             // M5 v2.1: a workflow node's `start_workflow` flattens to the parent kernel (no nested pivot).
             isWorkflowNode: ctx.isWorkflowNode,
+            // Nested vehicle: the child joins the inherited runGroup for lineage/settlement only — it
+            // must NOT re-reserve budget axes the parent already holds (that double-reserve squeezed the
+            // child's grant to 0 and the kernel stripped its first-turn tools).
+            nestedGroupVehicle: true,
             // The child runs under ITS OWN spec, never the parent's: the spread above would otherwise
             // leak the parent's `runSpec` (identity, capability filter — and a LoopDriver's armed
             // `loopRound`, giving every child a phantom pace tool). A loop-node iteration carries its

package/dist/tools/index.d.ts

@@ -26,6 +26,7 @@ export declare function toolChunkText(chunk: ToolChunk): string;
 export declare function validateToolArguments(schemaJson: string, args: Record<string, unknown>): {
     error?: string;
     repaired: boolean;
+    args: Record<string, unknown>;
 };
 export declare function executeTools(calls: {
     id: string;

package/dist/tools/index.js

@@ -1,11 +1,24 @@
 import { formatToolError } from "./errors.js";
+/** Fail at registration, not as a vendor 400 at call time: every major provider (OpenAI-compat,
+ *  Anthropic, Gemini) rejects a tool whose parameters root is not `type: "object"` — the wire
+ *  error ("schema must be a JSON Schema of 'type: \"object\"'") surfaces far from the tool that
+ *  caused it. Union roots must be wrapped: object root + flattened properties + `oneOf` sibling. */
+function assertObjectRootSchema(name, parameters) {
+    if (!parameters || typeof parameters !== "object" || Array.isArray(parameters) || parameters.type !== "object") {
+        throw new Error(`tool "${name}": parameters must be a JSON Schema with root type "object" `
+            + `(got type: ${JSON.stringify(parameters?.type ?? null)}); `
+            + `providers reject any other root — wrap union variants as an object root with a oneOf sibling`);
+    }
+}
 export function tool(name, description, parameters, fn) {
+    assertObjectRootSchema(name, parameters);
     return {
         schema: { name, description, parameters: JSON.stringify(parameters) },
         async execute(args, ctx) { return fn(args, ctx); },
     };
 }
 export function streamingTool(name, description, parameters, fn) {
+    assertObjectRootSchema(name, parameters);
     return {
         schema: { name, description, parameters: JSON.stringify(parameters) },
         execute(args, ctx) { return fn(args, ctx); },
@@ -27,12 +40,14 @@ export function validateToolArguments(schemaJson, args) {
         schema = JSON.parse(schemaJson);
     }
     catch {
-        return { error: "invalid tool schema", repaired: false };
+        return { error: "invalid tool schema", repaired: false, args };
     }
     const state = { repaired: false };
     const wrapper = { root: args };
     const error = validateValue(schema, wrapper, "root", "$", state);
-    return { error, repaired: state.repaired };
+    // A oneOf/anyOf ROOT replaces the value with its accepted probe clone — in-place mutation of
+    // the caller's object only covers non-union roots. Callers must use the returned `args`.
+    return { error, repaired: state.repaired, args: wrapper.root };
 }
 function validateValue(schema, parent, key, path, state) {
     let value = parent[key];
@@ -188,12 +203,72 @@ function validateValue(schema, parent, key, path, state) {
             if (typeof value !== "boolean")
                 return `${path} must be boolean`;
         }
+        else if (expectedType === "null") {
+            if (value !== null)
+                return `${path} must be null`;
+        }
     }
     else if (path === "$" && (!value || typeof value !== "object" || Array.isArray(value))) {
         return `${path} must be object`;
     }
     if (Array.isArray(schema.enum) && !schema.enum.includes(value))
         return `${path} must be one of enum values`;
+    // `const` is THE discriminator convention for oneOf variants (kind: {const: "edit"}). Without
+    // it, union branches match on required+type alone and the WRONG branch can win — then its
+    // allow-list strips keys the right branch declared.
+    if ("const" in schema) {
+        const want = schema.const;
+        const matches = want !== null && typeof want === "object"
+            ? JSON.stringify(value) === JSON.stringify(want)
+            : value === want;
+        if (!matches)
+            return `${path} must equal the const value ${JSON.stringify(want)}`;
+    }
+    // Constraint keywords, checked per the value's actual type (JSON Schema semantics: string
+    // constraints ignore non-strings, etc.). Keywords outside this set (allOf, multipleOf,
+    // uniqueItems, format, if/then/else, …) are ignored, not rejected.
+    if (typeof value === "string") {
+        if (typeof schema.minLength === "number" && value.length < schema.minLength) {
+            return `${path} must be at least ${schema.minLength} characters`;
+        }
+        if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
+            return `${path} must be at most ${schema.maxLength} characters`;
+        }
+        if (typeof schema.pattern === "string") {
+            let re;
+            try {
+                re = new RegExp(schema.pattern);
+            }
+            catch {
+                re = undefined;
+            } // author-side bad regex: skip, never fail the call
+            if (re && !re.test(value))
+                return `${path} must match pattern ${schema.pattern}`;
+        }
+    }
+    else if (typeof value === "number") {
+        if (typeof schema.minimum === "number" && value < schema.minimum)
+            return `${path} must be >= ${schema.minimum}`;
+        if (typeof schema.maximum === "number" && value > schema.maximum)
+            return `${path} must be <= ${schema.maximum}`;
+        if (typeof schema.exclusiveMinimum === "number" && value <= schema.exclusiveMinimum)
+            return `${path} must be > ${schema.exclusiveMinimum}`;
+        if (typeof schema.exclusiveMaximum === "number" && value >= schema.exclusiveMaximum)
+            return `${path} must be < ${schema.exclusiveMaximum}`;
+    }
+    else if (Array.isArray(value)) {
+        if (typeof schema.minItems === "number" && value.length < schema.minItems)
+            return `${path} must have at least ${schema.minItems} items`;
+        if (typeof schema.maxItems === "number" && value.length > schema.maxItems)
+            return `${path} must have at most ${schema.maxItems} items`;
+    }
+    // `not`: probe on a clone so a matching (= rejected) subschema's repairs never leak out.
+    if (schema.not && typeof schema.not === "object" && !Array.isArray(schema.not)) {
+        const probe = { v: structuredClone(value) };
+        if (!validateValue(schema.not, probe, "v", path, { repaired: false })) {
+            return `${path} must not match the disallowed shape`;
+        }
+    }
     return undefined;
 }
 export async function executeTools(calls, registry) {
@@ -206,7 +281,9 @@ export async function executeTools(calls, registry) {
             const validation = validateToolArguments(t.schema.parameters, args);
             if (validation.error)
                 return { callId: c.id, output: `invalid arguments: ${validation.error}`, isError: true };
-            const output = await t.execute(args);
+            // validation.args, not args: a oneOf/anyOf ROOT accepts a repaired probe CLONE — the
+            // original reference never sees those repairs (auto-casts, strips, defaults).
+            const output = await t.execute(validation.args);
             if (isAsyncIterable(output)) {
                 let combined = "";
                 for await (const chunk of output)

package/dist/types/agent.d.ts

@@ -52,6 +52,13 @@ export interface AgentRunSpec {
     /** O3: per-child wall-clock cap in milliseconds (sets the child runner's `timeoutMs`; falls back to
      *  the parent's). A hung child terminates `timeout` instead of stalling the parent indefinitely. */
     maxWallMs?: number;
+    /** Tool surface for a spawned sub-agent. Host-side only (like `modelHint`) — NOT sent to the kernel
+     *  (`agentRunSpecToKernel` maps fields explicitly and omits it). Default `"filtered"` keeps the spawn
+     *  path's deny-all-safe default: the child is filtered to its manifest grants, and a grant-less spawn
+     *  resolves to zero tools. `"inherit"` runs the child on the parent's execution plane with the
+     *  parent's meta-tool availability (same mechanism trusted workflow nodes use) — the child's surface
+     *  is a subset of the parent's, never a privilege escalation. */
+    toolAccess?: "inherit" | "filtered";
 }
 /** Kernel process-table observation (Phase 3 canonical spawn signal). */
 export interface AgentProcessChangedObservation {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/sdk",
-  "version": "0.2.44",
+  "version": "0.2.46",
   "description": "DeepStrike Node.js SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -72,7 +72,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.99.0",
-    "@deepstrike/core": "0.2.44",
+    "@deepstrike/core": "0.2.46",
     "@google/generative-ai": "^0.24.1",
     "openai": "^5.23.2"
   },