@deepstrike/sdk 0.2.46 → 0.2.48

package/dist/harness/manifest.d.ts

@@ -0,0 +1,106 @@
+import type { MemoryPolicy } from "../kernel.js";
+import type { RuntimeOptions } from "../runtime/runner.js";
+import type { NudgeRule } from "./nudge.js";
+export interface InstructionProfile {
+    /** Start-up protocol (paper: build_bootstrap_instruction). */
+    bootstrap?: string;
+    /** Execution protocol. */
+    execution?: string;
+    /** Closing verification protocol. */
+    verification?: string;
+    /** Failure-recovery protocol. */
+    failureRecovery?: string;
+}
+/**
+ * Compose the four instruction slots onto `base` in the fixed order base → bootstrap → execution →
+ * verification → failureRecovery, joined with `"\n\n"`, skipping empty slots. All-empty ⇒ `base`
+ * unchanged (identity — the zero-instructions run is byte-for-byte the pre-feature run). The order is
+ * fixed and empty slots are dropped so the composed prefix is byte-stable (prefix-cache axiom).
+ */
+export declare function composeSystemPrompt(base: string | undefined, instructions?: InstructionProfile): string | undefined;
+/**
+ * The exact `RuntimeOptions` fields a manifest may drive. Derived via `Pick` so field names and types
+ * track `RuntimeOptions` verbatim; anything outside this set is rejected by `applyManifest`/`applyPatch`.
+ */
+export type HarnessRuntimePatch = Pick<RuntimeOptions, "maxTurns" | "maxTotalTokens" | "criteriaGate" | "repeatFuse" | "entropyWatch" | "knowledgeBudgetRatio" | "skillLeaseTurns" | "allowedToolIds" | "stableCoreToolIds" | "enablePlanTool" | "skillFilter"> & Pick<MemoryPolicy, "retrievalTopK" | "promotionRecallThreshold">;
+/**
+ * The promotion tier of an editable surface — the SECOND axis of the safety boundary (the whitelist is
+ * the first). Even a whitelisted surface may need a heavier gate than "typed validation passed".
+ */
+export type SurfaceTier = "auto" | "screened" | "human";
+/**
+ * Map an editable surface to its promotion tier. Maintained HERE beside the whitelist so a surface can
+ * never be whitelisted without also being assigned a tier (spec V2-S3 same-place maintenance):
+ *   - "auto"     (Tier A): every `runtime.*` whitelist surface. Typed validation + the capability
+ *                 ceiling invariant + the v1 acceptance rule already guard them, so promotion is fully
+ *                 automatic — there is no free text and no injection surface.
+ *   - "screened" (Tier B): `instructions.*` and `nudges`. Free text can smuggle instructions
+ *                 (persistent prompt-injection laundered through the evidence loop), so a screen runs
+ *                 before promotion.
+ *   - "human"    (Tier C): reserved for capability-WIDENING surfaces. None exist in v2 — intersection
+ *                 semantics make widening structurally inexpressible — but the enum value exists so a v3
+ *                 surface cannot be added without consciously assigning it a tier (and building the
+ *                 human gate). `surfaceTier` therefore never returns "human" in v2.
+ * An unknown surface / slot / runtime key THROWS (same discipline as applySurfaceEdit): a surface with
+ * no tier must never fall through to auto-promotion.
+ */
+export declare function surfaceTier(targetSurface: string): SurfaceTier;
+export interface HarnessManifest {
+    manifestVersion: 1;
+    /** Parent manifest digest; `null` for a seed. */
+    parent: string | null;
+    /** Target-model identifier (per-model profile scenarios). */
+    modelProfile?: string;
+    /**
+     * Opaque isolation key — host decides its semantics (user / tenant / agent-group). Orthogonal to
+     * `modelProfile` (never concatenate the two — that reprises the identity-scoping bug class); absent
+     * ⇒ the host treats it as `"default"`. It rides canonical JSON, so digests domain-separate by scope,
+     * but an absent scope leaves a v1-shaped manifest's digest byte-identical (canonicalJson skips
+     * undefined). Becomes a lineage directory name downstream, hence the path-safe character bound.
+     */
+    scope?: string;
+    instructions?: InstructionProfile;
+    nudges?: NudgeRule[];
+    runtime?: HarnessRuntimePatch;
+    /** The proposer's edit whitelist — patches may only target a surface listed here. */
+    editableSurfaces: string[];
+    audit?: {
+        round: number;
+        createdBy: "seed" | "proposer";
+        targetCluster?: string;
+        rationale?: string;
+        deltaHeldIn?: number;
+        deltaHeldOut?: number;
+        /** Promotion tier of the driving edit (V2-S3). */
+        tier?: SurfaceTier;
+        /** Injection-screen verdict — present only for a screened (Tier B) promotion (V2-S3). */
+        screenVerdict?: "pass" | "screened_out";
+    };
+}
+export interface HarnessPatch {
+    /** Surface path — must be in the manifest's `editableSurfaces`. */
+    targetSurface: string;
+    /** `append` applies only to nudges; `remove` clears a slot or drops a nudge by id. */
+    op: "set" | "append" | "remove";
+    value?: unknown;
+    rationale: string;
+    /** Failure-cluster key this edit is bound to (paper: one edit per failure mechanism). */
+    targetCluster: string;
+    expectedEffect: string;
+}
+/** sha-256 hex over the manifest's canonical JSON — the manifest's stable identity. */
+export declare function manifestDigest(manifest: HarnessManifest): string;
+/** Structural load check — throws on anything a manifest is forbidden to carry. */
+export declare function validateManifest(manifest: HarnessManifest): void;
+/**
+ * Fold a validated manifest onto `base` runtime options. Instructions ride through as DATA — the
+ * runner composes the system prompt once at option normalization so `run_started` and the kernel's
+ * AddSystemMessage stay byte-identical. Runtime keys outside the whitelist throw.
+ */
+export declare function applyManifest(manifest: HarnessManifest, base: RuntimeOptions): RuntimeOptions;
+/**
+ * Apply one structural edit, returning a NEW manifest whose `parent` is the source's digest. Throws
+ * when the surface is off-whitelist, the patch is malformed, or the result violates a bound
+ * (instruction ≤4000 chars, nudge load rules). The source manifest is never mutated.
+ */
+export declare function applyPatch(manifest: HarnessManifest, patch: HarnessPatch): HarnessManifest;

package/dist/harness/manifest.js

@@ -0,0 +1,461 @@
+/**
+ * Self-Harness H1.1 + H1.3 — the harness face as DATA.
+ *
+ * A `HarnessManifest` is a versioned, hashable lineage node: the editable surfaces a fixed model may
+ * rewrite about its OWN harness — instruction slots, nudge rules, and a whitelisted `RuntimeOptions`
+ * subset — plus the audit trail binding each edit to the failure cluster it targets. Every function
+ * here is pure and deterministic (no clock, no randomness, no I/O), so a manifest digest is a stable
+ * identity across processes and the propose→validate→promote loop replays byte-for-byte.
+ *
+ * The whitelist is the safety boundary: governance / quota / reliability surfaces are deliberately
+ * absent, so a proposer can never rewrite them (spec design principle: conservative promotion).
+ *
+ * Tool/skill surfaces add the SECOND safety invariant (spec design principle A — the capability
+ * ceiling): `allowedToolIds`, `stableCoreToolIds`, and `skillFilter` fold onto the host baseline by
+ * INTERSECTION, never assignment. A manifest can only NARROW the tools/skills the host already
+ * exposes — never widen. Capability expansion (naming a tool the host does not expose) is therefore
+ * structurally inexpressible, and the whole security audit stays O(1): read the whitelist, check the
+ * one invariant. (`enablePlanTool` is exempt — it toggles a kernel-owned meta-tool, attention-shaping
+ * not capability-granting, so it folds by plain assignment.)
+ */
+import { createHash } from "node:crypto";
+import { validateNudgeRules } from "./nudge.js";
+const INSTRUCTION_SLOTS = ["bootstrap", "execution", "verification", "failureRecovery"];
+/** Per-slot upper bound enforced at load and on every `applyPatch` set. */
+const MAX_INSTRUCTION_CHARS = 4000;
+/** A scope key becomes a directory segment; restrict it to a single path-safe token (no separators). */
+const SCOPE_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+/**
+ * Compose the four instruction slots onto `base` in the fixed order base → bootstrap → execution →
+ * verification → failureRecovery, joined with `"\n\n"`, skipping empty slots. All-empty ⇒ `base`
+ * unchanged (identity — the zero-instructions run is byte-for-byte the pre-feature run). The order is
+ * fixed and empty slots are dropped so the composed prefix is byte-stable (prefix-cache axiom).
+ */
+export function composeSystemPrompt(base, instructions) {
+    const parts = [];
+    if (base)
+        parts.push(base);
+    for (const slot of INSTRUCTION_SLOTS) {
+        const text = instructions?.[slot];
+        if (text)
+            parts.push(text);
+    }
+    return parts.length === 0 ? base : parts.join("\n\n");
+}
+const MEMORY_POLICY_PATCH_KEYS = ["retrievalTopK", "promotionRecallThreshold"];
+/** Tool/skill surfaces whose fold is intersection-with-baseline (capability ceiling), not assignment. */
+const INTERSECTION_PATCH_KEYS = ["allowedToolIds", "stableCoreToolIds", "skillFilter"];
+const RUNTIME_PATCH_KEYS = [
+    "maxTurns",
+    "maxTotalTokens",
+    "criteriaGate",
+    "repeatFuse",
+    "entropyWatch",
+    "knowledgeBudgetRatio",
+    "skillLeaseTurns",
+    "allowedToolIds",
+    "stableCoreToolIds",
+    "enablePlanTool",
+    "skillFilter",
+    ...MEMORY_POLICY_PATCH_KEYS,
+];
+/** Bounds for the id-list surfaces (allowedToolIds / stableCoreToolIds / skillFilter). */
+const MAX_TOOL_ID_CHARS = 128;
+const MAX_TOOL_LIST_ENTRIES = 128;
+/**
+ * Map an editable surface to its promotion tier. Maintained HERE beside the whitelist so a surface can
+ * never be whitelisted without also being assigned a tier (spec V2-S3 same-place maintenance):
+ *   - "auto"     (Tier A): every `runtime.*` whitelist surface. Typed validation + the capability
+ *                 ceiling invariant + the v1 acceptance rule already guard them, so promotion is fully
+ *                 automatic — there is no free text and no injection surface.
+ *   - "screened" (Tier B): `instructions.*` and `nudges`. Free text can smuggle instructions
+ *                 (persistent prompt-injection laundered through the evidence loop), so a screen runs
+ *                 before promotion.
+ *   - "human"    (Tier C): reserved for capability-WIDENING surfaces. None exist in v2 — intersection
+ *                 semantics make widening structurally inexpressible — but the enum value exists so a v3
+ *                 surface cannot be added without consciously assigning it a tier (and building the
+ *                 human gate). `surfaceTier` therefore never returns "human" in v2.
+ * An unknown surface / slot / runtime key THROWS (same discipline as applySurfaceEdit): a surface with
+ * no tier must never fall through to auto-promotion.
+ */
+export function surfaceTier(targetSurface) {
+    const [head, sub] = targetSurface.split(".");
+    if (head === "instructions") {
+        if (sub === undefined || !INSTRUCTION_SLOTS.includes(sub)) {
+            throw new RangeError(`unknown instruction slot: ${targetSurface}`);
+        }
+        return "screened";
+    }
+    if (head === "nudges") {
+        if (sub !== undefined)
+            throw new RangeError(`nudges surface takes no sub-path: ${targetSurface}`);
+        return "screened";
+    }
+    if (head === "runtime") {
+        if (sub === undefined || !RUNTIME_PATCH_KEYS.includes(sub)) {
+            throw new RangeError(`runtime patch key not in the editable whitelist: ${targetSurface}`);
+        }
+        return "auto";
+    }
+    throw new RangeError(`unknown surface path: ${targetSurface}`);
+}
+// ── Canonical JSON + digest ──────────────────────────────────────────────────
+/** Deterministic serialization: recursive key sort, undefined-valued keys skipped, arrays ordered. */
+function canonicalJson(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "string" || typeof value === "boolean")
+        return JSON.stringify(value);
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new TypeError("harness manifest requires finite numbers");
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (typeof value === "object") {
+        const obj = value;
+        const keys = Object.keys(obj).filter(key => obj[key] !== undefined).sort();
+        return `{${keys.map(key => `${JSON.stringify(key)}:${canonicalJson(obj[key])}`).join(",")}}`;
+    }
+    throw new TypeError(`harness manifest holds a non-serializable value: ${typeof value}`);
+}
+/** sha-256 hex over the manifest's canonical JSON — the manifest's stable identity. */
+export function manifestDigest(manifest) {
+    return createHash("sha256").update(canonicalJson(manifest), "utf8").digest("hex");
+}
+// ── Load validation ──────────────────────────────────────────────────────────
+function validateInstructionProfile(profile) {
+    if (typeof profile !== "object" || profile === null || Array.isArray(profile)) {
+        throw new TypeError("instructions must be an object");
+    }
+    for (const slot of INSTRUCTION_SLOTS) {
+        const text = profile[slot];
+        if (text === undefined)
+            continue;
+        if (typeof text !== "string")
+            throw new TypeError(`instructions.${slot} must be a string`);
+        if (text.length > MAX_INSTRUCTION_CHARS) {
+            throw new RangeError(`instructions.${slot} exceeds ${MAX_INSTRUCTION_CHARS} chars`);
+        }
+    }
+}
+function validateRuntimePatch(runtime) {
+    if (typeof runtime !== "object" || runtime === null) {
+        throw new TypeError("manifest.runtime must be an object");
+    }
+    for (const [key, value] of Object.entries(runtime)) {
+        if (!RUNTIME_PATCH_KEYS.includes(key)) {
+            throw new RangeError(`runtime patch key not in the editable whitelist: ${key}`);
+        }
+        if (value !== undefined)
+            validateRuntimeValue(key, value);
+    }
+    // Same-manifest structural invariant: stable-core keeps tools exposed while a skill narrows, so it
+    // must never name a tool outside this manifest's OWN exposure ceiling (`allowedToolIds`). Checked
+    // only when both are present; either absent means the ceiling is broader (the whole registered set).
+    const allowed = runtime.allowedToolIds;
+    const stable = runtime.stableCoreToolIds;
+    if (Array.isArray(allowed) && Array.isArray(stable)) {
+        const allowedSet = new Set(allowed);
+        const outside = stable.filter(id => !allowedSet.has(id));
+        if (outside.length > 0) {
+            throw new RangeError(`runtime.stableCoreToolIds must be a subset of runtime.allowedToolIds; outside the ceiling: ${outside.join(", ")}`);
+        }
+    }
+}
+/**
+ * Validate an id-list surface: array of unique, non-empty strings (each ≤128 chars), ≤128 entries.
+ * `allowEmpty` is the load-bearing asymmetry. For the tool-id arrays it is FALSE: the runner reads an
+ * empty/absent `allowedToolIds` as "no gating — expose ALL registered tools", so an empty array would
+ * WIDEN exposure to everything if it reached the runner (and a zero-tool run is the v0.2.46 pathology).
+ * For `skillFilter` it is TRUE: the runner's no-gating sentinel is ONLY `undefined`, and an empty array
+ * legitimately means "no skills available" (a proposer may find skills are a distraction) — a narrowing.
+ */
+function validateIdList(key, value, allowEmpty) {
+    if (!Array.isArray(value))
+        throw new TypeError(`runtime.${key} must be a string[]`);
+    if (value.length > MAX_TOOL_LIST_ENTRIES) {
+        throw new RangeError(`runtime.${key} exceeds ${MAX_TOOL_LIST_ENTRIES} entries`);
+    }
+    if (!allowEmpty && value.length === 0) {
+        throw new RangeError(`runtime.${key} must be a non-empty list — an empty array is read by the runner as "no gating" (expose all registered tools), which WIDENS exposure`);
+    }
+    const seen = new Set();
+    for (const entry of value) {
+        if (typeof entry !== "string" || entry.length === 0) {
+            throw new TypeError(`runtime.${key} entries must be non-empty strings`);
+        }
+        if (entry.length > MAX_TOOL_ID_CHARS) {
+            throw new RangeError(`runtime.${key} entry exceeds ${MAX_TOOL_ID_CHARS} chars: ${entry.slice(0, 16)}…`);
+        }
+        if (seen.has(entry))
+            throw new RangeError(`runtime.${key} entries must be unique; duplicate: ${entry}`);
+        seen.add(entry);
+    }
+}
+/** Per-key value typing for runtime patches. An LLM proposer WILL eventually put instruction prose
+ *  where a boolean belongs; rejecting it here turns a mid-run kernel `InvalidConfig` crash into a
+ *  discardable candidate. */
+function validateRuntimeValue(key, value) {
+    const positiveInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0;
+    switch (key) {
+        case "maxTurns":
+        case "maxTotalTokens":
+        case "skillLeaseTurns":
+        case "retrievalTopK":
+        case "promotionRecallThreshold":
+            if (!positiveInt(value))
+                throw new TypeError(`runtime.${key} must be a positive integer`);
+            return;
+        case "criteriaGate":
+            if (typeof value !== "boolean")
+                throw new TypeError("runtime.criteriaGate must be a boolean");
+            return;
+        case "enablePlanTool":
+            if (typeof value !== "boolean")
+                throw new TypeError("runtime.enablePlanTool must be a boolean");
+            return;
+        case "allowedToolIds":
+        case "stableCoreToolIds":
+            validateIdList(key, value, /* allowEmpty */ false);
+            return;
+        case "skillFilter":
+            validateIdList(key, value, /* allowEmpty */ true);
+            return;
+        case "knowledgeBudgetRatio":
+            if (typeof value !== "number" || !(value > 0 && value <= 1)) {
+                throw new TypeError("runtime.knowledgeBudgetRatio must be a number in (0, 1]");
+            }
+            return;
+        case "repeatFuse": {
+            if (value === false)
+                return;
+            if (typeof value !== "object" || value === null) {
+                throw new TypeError("runtime.repeatFuse must be false or { denyAfter?, terminateAfter? }");
+            }
+            const fuse = value;
+            for (const k of Object.keys(fuse)) {
+                if (k !== "denyAfter" && k !== "terminateAfter") {
+                    throw new RangeError(`runtime.repeatFuse has unknown key: ${k}`);
+                }
+                if (fuse[k] !== undefined && !positiveInt(fuse[k])) {
+                    throw new TypeError(`runtime.repeatFuse.${k} must be a positive integer`);
+                }
+            }
+            return;
+        }
+        case "entropyWatch": {
+            if (typeof value !== "object" || value === null) {
+                throw new TypeError("runtime.entropyWatch must be an object");
+            }
+            const watch = value;
+            for (const k of Object.keys(watch)) {
+                const v = watch[k];
+                if (v === undefined)
+                    continue;
+                if (k === "enabled" || k === "notifyModel") {
+                    if (typeof v !== "boolean")
+                        throw new TypeError(`runtime.entropyWatch.${k} must be a boolean`);
+                }
+                else if (k === "threshold" || k === "hysteresis") {
+                    if (typeof v !== "number" || !(v >= 0 && v <= 1)) {
+                        throw new TypeError(`runtime.entropyWatch.${k} must be a number in [0, 1]`);
+                    }
+                }
+                else if (k === "cooldownTurns") {
+                    if (!positiveInt(v))
+                        throw new TypeError("runtime.entropyWatch.cooldownTurns must be a positive integer");
+                }
+                else {
+                    throw new RangeError(`runtime.entropyWatch has unknown key: ${k}`);
+                }
+            }
+            return;
+        }
+        default:
+            throw new RangeError(`runtime patch key not in the editable whitelist: ${key}`);
+    }
+}
+/** Structural load check — throws on anything a manifest is forbidden to carry. */
+export function validateManifest(manifest) {
+    if (typeof manifest !== "object" || manifest === null)
+        throw new TypeError("manifest must be an object");
+    if (manifest.manifestVersion !== 1)
+        throw new TypeError("manifest.manifestVersion must be 1");
+    if (!(manifest.parent === null || typeof manifest.parent === "string")) {
+        throw new TypeError("manifest.parent must be a digest string or null");
+    }
+    if (!Array.isArray(manifest.editableSurfaces) || manifest.editableSurfaces.some(s => typeof s !== "string")) {
+        throw new TypeError("manifest.editableSurfaces must be a string[]");
+    }
+    if (manifest.scope !== undefined) {
+        if (typeof manifest.scope !== "string" || !SCOPE_PATTERN.test(manifest.scope)) {
+            throw new TypeError("manifest.scope must be a non-empty path-safe token matching /^[A-Za-z0-9._-]{1,64}$/");
+        }
+    }
+    if (manifest.instructions !== undefined)
+        validateInstructionProfile(manifest.instructions);
+    if (manifest.nudges !== undefined)
+        validateNudgeRules(manifest.nudges);
+    if (manifest.runtime !== undefined)
+        validateRuntimePatch(manifest.runtime);
+}
+// ── Apply ────────────────────────────────────────────────────────────────────
+/**
+ * Fold a validated manifest onto `base` runtime options. Instructions ride through as DATA — the
+ * runner composes the system prompt once at option normalization so `run_started` and the kernel's
+ * AddSystemMessage stay byte-identical. Runtime keys outside the whitelist throw.
+ */
+export function applyManifest(manifest, base) {
+    validateManifest(manifest);
+    const out = { ...base };
+    if (manifest.instructions !== undefined)
+        out.instructions = manifest.instructions;
+    if (manifest.nudges !== undefined)
+        out.nudges = manifest.nudges;
+    if (manifest.runtime !== undefined) {
+        for (const [key, value] of Object.entries(manifest.runtime)) {
+            if (value === undefined)
+                continue;
+            if (MEMORY_POLICY_PATCH_KEYS.includes(key)) {
+                out.memoryPolicy = { ...out.memoryPolicy, [key]: value };
+            }
+            else if (INTERSECTION_PATCH_KEYS.includes(key)) {
+                out[key] = foldIntersection(key, value, out[key]);
+            }
+            else {
+                // enablePlanTool + numeric/boolean knobs: plain assignment.
+                out[key] = value;
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Fold one intersection surface (capability ceiling): effective = manifest ∩ host-baseline, so a
+ * manifest can only NARROW. The empty-baseline meaning is surface-specific and load-bearing:
+ *
+ *   - allowedToolIds / stableCoreToolIds — the runner reads an empty OR absent baseline as
+ *     "no gating = all registered tools" (the universe), so a non-array/empty baseline yields the
+ *     manifest list verbatim; only a NON-EMPTY baseline is a real ceiling to intersect against. An
+ *     empty intersection THROWS: a zero-tool run reprises the v0.2.46 pathology AND the runner would
+ *     silently reinterpret the empty result as "no gating" (full exposure) — so we turn the candidate
+ *     into a discardable error instead.
+ *   - skillFilter — the runner's no-gating sentinel is ONLY `undefined`; an empty-array baseline is a
+ *     genuine, maximally-tight ceiling (no skills). So ANY present array (even `[]`) is intersected,
+ *     and an empty result is FINE (= no skills). This mirrors the validation asymmetry exactly.
+ */
+function foldIntersection(key, manifestList, baseList) {
+    const skillLike = key === "skillFilter";
+    // Is the host baseline a real constraining set?  Tool ids: non-empty array only (empty == universe).
+    // skillFilter: any array (empty == the empty set).
+    const constrained = Array.isArray(baseList) && (skillLike || baseList.length > 0);
+    const effective = constrained
+        ? manifestList.filter(id => baseList.includes(id)) // manifest order → deterministic
+        : manifestList;
+    if (!skillLike && effective.length === 0) {
+        throw new RangeError(`applyManifest: runtime.${key} intersection is empty — manifest [${manifestList.join(", ")}] ∩ ` +
+            `host [${(baseList ?? []).join(", ")}] names no shared tool. A zero-tool run is rejected (it ` +
+            `reprises the v0.2.46 pathology and the runner would read empty as "no gating" = full exposure).`);
+    }
+    return effective;
+}
+function validatePatchShape(patch) {
+    if (typeof patch !== "object" || patch === null)
+        throw new TypeError("patch must be an object");
+    if (typeof patch.targetSurface !== "string" || patch.targetSurface.length === 0) {
+        throw new TypeError("patch.targetSurface must be a non-empty string");
+    }
+    if (patch.op !== "set" && patch.op !== "append" && patch.op !== "remove") {
+        throw new TypeError(`patch.op must be set|append|remove, got ${String(patch.op)}`);
+    }
+    for (const field of ["rationale", "targetCluster", "expectedEffect"]) {
+        if (typeof patch[field] !== "string" || patch[field].length === 0) {
+            throw new TypeError(`patch.${field} must be a non-empty string`);
+        }
+    }
+}
+function editInstructionSlot(manifest, slot, patch) {
+    if (slot === undefined || !INSTRUCTION_SLOTS.includes(slot)) {
+        throw new RangeError(`unknown instruction slot: ${patch.targetSurface}`);
+    }
+    if (patch.op === "append")
+        throw new RangeError("append applies only to nudges");
+    const key = slot;
+    if (patch.op === "remove") {
+        if (manifest.instructions)
+            delete manifest.instructions[key];
+        return;
+    }
+    if (typeof patch.value !== "string")
+        throw new TypeError(`instructions.${key} set requires a string value`);
+    if (patch.value.length > MAX_INSTRUCTION_CHARS) {
+        throw new RangeError(`instructions.${key} exceeds ${MAX_INSTRUCTION_CHARS} chars`);
+    }
+    manifest.instructions = { ...(manifest.instructions ?? {}), [key]: patch.value };
+}
+function editNudges(manifest, patch) {
+    const current = manifest.nudges ?? [];
+    if (patch.op === "set") {
+        const rules = patch.value;
+        validateNudgeRules(rules);
+        manifest.nudges = rules;
+        return;
+    }
+    if (patch.op === "append") {
+        const additions = Array.isArray(patch.value) ? patch.value : [patch.value];
+        const merged = [...current, ...additions];
+        validateNudgeRules(merged);
+        manifest.nudges = merged;
+        return;
+    }
+    // remove — by id
+    if (typeof patch.value !== "string")
+        throw new TypeError("nudges remove requires a rule id string");
+    manifest.nudges = current.filter(rule => rule.id !== patch.value);
+}
+function editRuntime(manifest, key, patch) {
+    if (key === undefined || !RUNTIME_PATCH_KEYS.includes(key)) {
+        throw new RangeError(`runtime patch key not in the editable whitelist: ${patch.targetSurface}`);
+    }
+    if (patch.op === "append")
+        throw new RangeError("append applies only to nudges");
+    const runtime = { ...(manifest.runtime ?? {}) };
+    if (patch.op === "remove")
+        delete runtime[key];
+    else {
+        validateRuntimeValue(key, patch.value);
+        runtime[key] = patch.value;
+    }
+    manifest.runtime = runtime;
+}
+function applySurfaceEdit(manifest, patch) {
+    const [head, sub] = patch.targetSurface.split(".");
+    if (head === "instructions")
+        return editInstructionSlot(manifest, sub, patch);
+    if (head === "nudges") {
+        if (sub !== undefined)
+            throw new RangeError(`nudges surface takes no sub-path: ${patch.targetSurface}`);
+        return editNudges(manifest, patch);
+    }
+    if (head === "runtime")
+        return editRuntime(manifest, sub, patch);
+    throw new RangeError(`unknown surface path: ${patch.targetSurface}`);
+}
+/**
+ * Apply one structural edit, returning a NEW manifest whose `parent` is the source's digest. Throws
+ * when the surface is off-whitelist, the patch is malformed, or the result violates a bound
+ * (instruction ≤4000 chars, nudge load rules). The source manifest is never mutated.
+ */
+export function applyPatch(manifest, patch) {
+    validatePatchShape(patch);
+    if (!manifest.editableSurfaces.includes(patch.targetSurface)) {
+        throw new RangeError(`surface not in the editable whitelist: ${patch.targetSurface}`);
+    }
+    const next = structuredClone(manifest);
+    applySurfaceEdit(next, patch);
+    next.parent = manifestDigest(manifest);
+    validateManifest(next);
+    return next;
+}

package/dist/harness/nudge.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Self-Harness H1.2 — declarative event→note rules (the runtime control-policy surface).
+ *
+ * A `NudgeRule` says "when this session event fires, push this note to the model". It generalizes the
+ * two hard-coded precedents (EntropyWatch.notify_model, the RepeatFuse STOP text) into data the
+ * self-harness loop can rewrite. `NudgeEngine` is a pure, clock-free class: `observe(event)` folds one
+ * session event into its per-rule state and returns the notes that fired, which the runner lowers to
+ * the `injectNote` signal channel. No I/O, no randomness — so the trigger matrix is exhaustively
+ * unit-testable and two engines never share state.
+ */
+import type { RuntimeSignalUrgency } from "../signals/types.js";
+import type { SessionEvent } from "../runtime/session-log.js";
+export type NudgeTrigger = {
+    kind: "tool_error";
+    errorKind?: string;
+    toolName?: string;
+} | {
+    kind: "tool_denied";
+    reasonIncludes?: string;
+} | {
+    kind: "tool_calls_at_least";
+    count: number;
+} | {
+    kind: "turns_at_least";
+    count: number;
+} | {
+    kind: "entropy_alert";
+};
+export interface NudgeRule {
+    id: string;
+    on: NudgeTrigger;
+    /** Template — supports {{tool_name}} {{error_kind}} {{turn}} only. */
+    note: string;
+    /** Default "normal" (the injectNote default). */
+    urgency?: RuntimeSignalUrgency;
+    /** Turns that must pass after a fire before the rule may fire again. Default 3. */
+    cooldownTurns?: number;
+    /** Total fires allowed for the whole run. Default 2. */
+    maxFires?: number;
+}
+/** Structural load check — throws on a malformed / oversized / duplicate-id rule set. */
+export declare function validateNudgeRules(rules: NudgeRule[]): void;
+export interface NudgeOutput {
+    note: string;
+    urgency: RuntimeSignalUrgency;
+}
+export declare class NudgeEngine {
+    private readonly rules;
+    private readonly state;
+    /** Cumulative tool_requested calls, for `tool_calls_at_least` edge detection. */
+    private toolCallsSeen;
+    /** Highest turn observed, for cooldown + `turns_at_least` edge detection. */
+    private currentTurn;
+    /** call_id → tool name, so a tool_completed error can name its tool (results carry no name). */
+    private readonly callNames;
+    constructor(rules: NudgeRule[]);
+    /** Fold one session event into rule state; return the notes that fired this event, in rule order. */
+    observe(event: SessionEvent): NudgeOutput[];
+    /** Returns the template context when the trigger matches this event, else null. */
+    private match;
+}

package/dist/harness/nudge.js

@@ -0,0 +1,176 @@
+const MAX_RULES = 16;
+const MAX_NOTE_CHARS = 2000;
+const DEFAULT_COOLDOWN_TURNS = 3;
+const DEFAULT_MAX_FIRES = 2;
+const ALLOWED_TEMPLATE_VARS = ["tool_name", "error_kind", "turn"];
+const URGENCIES = ["low", "normal", "high", "critical"];
+// ── Load validation ──────────────────────────────────────────────────────────
+function validateTrigger(on, id) {
+    if (typeof on !== "object" || on === null)
+        throw new TypeError(`nudge rule ${id}: trigger must be an object`);
+    switch (on.kind) {
+        case "tool_error":
+            if (on.errorKind !== undefined && typeof on.errorKind !== "string") {
+                throw new TypeError(`nudge rule ${id}: tool_error.errorKind must be a string`);
+            }
+            if (on.toolName !== undefined && typeof on.toolName !== "string") {
+                throw new TypeError(`nudge rule ${id}: tool_error.toolName must be a string`);
+            }
+            return;
+        case "tool_denied":
+            if (on.reasonIncludes !== undefined && typeof on.reasonIncludes !== "string") {
+                throw new TypeError(`nudge rule ${id}: tool_denied.reasonIncludes must be a string`);
+            }
+            return;
+        case "tool_calls_at_least":
+        case "turns_at_least":
+            if (!Number.isInteger(on.count) || on.count < 1) {
+                throw new RangeError(`nudge rule ${id}: ${on.kind}.count must be a positive integer`);
+            }
+            return;
+        case "entropy_alert":
+            return;
+        default:
+            throw new RangeError(`nudge rule ${id}: unknown trigger kind: ${on.kind}`);
+    }
+}
+function validateTemplateVars(note, id) {
+    const re = /\{\{([^{}]*)\}\}/g;
+    let match;
+    while ((match = re.exec(note)) !== null) {
+        if (!ALLOWED_TEMPLATE_VARS.includes(match[1])) {
+            throw new RangeError(`nudge rule ${id}: unsupported template variable {{${match[1]}}}`);
+        }
+    }
+}
+/** Structural load check — throws on a malformed / oversized / duplicate-id rule set. */
+export function validateNudgeRules(rules) {
+    if (!Array.isArray(rules))
+        throw new TypeError("nudges must be an array");
+    if (rules.length > MAX_RULES)
+        throw new RangeError(`at most ${MAX_RULES} nudge rules (got ${rules.length})`);
+    const ids = new Set();
+    for (const rule of rules) {
+        if (typeof rule !== "object" || rule === null)
+            throw new TypeError("each nudge rule must be an object");
+        if (typeof rule.id !== "string" || rule.id.length === 0) {
+            throw new TypeError("nudge rule id must be a non-empty string");
+        }
+        if (ids.has(rule.id))
+            throw new RangeError(`duplicate nudge rule id: ${rule.id}`);
+        ids.add(rule.id);
+        validateTrigger(rule.on, rule.id);
+        if (typeof rule.note !== "string" || rule.note.length === 0) {
+            throw new TypeError(`nudge rule ${rule.id}: note must be a non-empty string`);
+        }
+        if (rule.note.length > MAX_NOTE_CHARS) {
+            throw new RangeError(`nudge rule ${rule.id}: note exceeds ${MAX_NOTE_CHARS} chars`);
+        }
+        validateTemplateVars(rule.note, rule.id);
+        if (rule.cooldownTurns !== undefined && (!Number.isInteger(rule.cooldownTurns) || rule.cooldownTurns < 0)) {
+            throw new RangeError(`nudge rule ${rule.id}: cooldownTurns must be a non-negative integer`);
+        }
+        if (rule.maxFires !== undefined && (!Number.isInteger(rule.maxFires) || rule.maxFires < 1)) {
+            throw new RangeError(`nudge rule ${rule.id}: maxFires must be a positive integer`);
+        }
+        if (rule.urgency !== undefined && !URGENCIES.includes(rule.urgency)) {
+            throw new RangeError(`nudge rule ${rule.id}: invalid urgency ${rule.urgency}`);
+        }
+    }
+}
+function renderNote(template, ctx) {
+    return template
+        .replace(/\{\{tool_name\}\}/g, ctx.tool_name ?? "")
+        .replace(/\{\{error_kind\}\}/g, ctx.error_kind ?? "")
+        .replace(/\{\{turn\}\}/g, String(ctx.turn));
+}
+export class NudgeEngine {
+    rules;
+    state;
+    /** Cumulative tool_requested calls, for `tool_calls_at_least` edge detection. */
+    toolCallsSeen = 0;
+    /** Highest turn observed, for cooldown + `turns_at_least` edge detection. */
+    currentTurn = 0;
+    /** call_id → tool name, so a tool_completed error can name its tool (results carry no name). */
+    callNames = new Map();
+    constructor(rules) {
+        validateNudgeRules(rules);
+        // Defensive shallow copy: the caller can mutate its array afterwards without touching the engine.
+        this.rules = rules.map(rule => ({ ...rule }));
+        this.state = this.rules.map(() => ({ fires: 0, lastFireTurn: 0 }));
+    }
+    /** Fold one session event into rule state; return the notes that fired this event, in rule order. */
+    observe(event) {
+        const prevToolCalls = this.toolCallsSeen;
+        const prevTurn = this.currentTurn;
+        if (event.kind === "tool_requested") {
+            for (const call of event.calls)
+                this.callNames.set(call.id, call.name);
+            this.toolCallsSeen += event.calls.length;
+        }
+        if ("turn" in event && typeof event.turn === "number") {
+            this.currentTurn = Math.max(this.currentTurn, event.turn);
+        }
+        const out = [];
+        for (let i = 0; i < this.rules.length; i++) {
+            const rule = this.rules[i];
+            const matched = this.match(rule.on, event, prevToolCalls, prevTurn);
+            if (!matched)
+                continue;
+            const st = this.state[i];
+            if (st.fires >= (rule.maxFires ?? DEFAULT_MAX_FIRES))
+                continue;
+            if (st.fires > 0 && this.currentTurn - st.lastFireTurn < (rule.cooldownTurns ?? DEFAULT_COOLDOWN_TURNS))
+                continue;
+            st.fires += 1;
+            st.lastFireTurn = this.currentTurn;
+            out.push({ note: renderNote(rule.note, matched), urgency: rule.urgency ?? "normal" });
+        }
+        return out;
+    }
+    /** Returns the template context when the trigger matches this event, else null. */
+    match(on, event, prevToolCalls, prevTurn) {
+        switch (on.kind) {
+            case "tool_error": {
+                if (event.kind !== "tool_completed")
+                    return null;
+                for (const result of event.results) {
+                    if (!result.is_error)
+                        continue;
+                    if (on.errorKind !== undefined && result.error_kind !== on.errorKind)
+                        continue;
+                    const name = this.callNames.get(result.call_id);
+                    if (on.toolName !== undefined && name !== on.toolName)
+                        continue;
+                    return { tool_name: name ?? "", error_kind: result.error_kind ?? "", turn: event.turn };
+                }
+                return null;
+            }
+            case "tool_denied": {
+                if (event.kind !== "tool_denied")
+                    return null;
+                if (on.reasonIncludes !== undefined && !event.reason.includes(on.reasonIncludes))
+                    return null;
+                return { tool_name: event.tool_name, error_kind: "", turn: event.turn };
+            }
+            case "tool_calls_at_least": {
+                // Edge: the cumulative count crosses the threshold on THIS event (monotonic ⇒ fires once).
+                if (prevToolCalls < on.count && this.toolCallsSeen >= on.count) {
+                    return { turn: this.currentTurn };
+                }
+                return null;
+            }
+            case "turns_at_least": {
+                if (prevTurn < on.count && this.currentTurn >= on.count) {
+                    return { turn: this.currentTurn };
+                }
+                return null;
+            }
+            case "entropy_alert": {
+                if (event.kind !== "entropy_alert")
+                    return null;
+                return { turn: event.turn };
+            }
+        }
+    }
+}

package/dist/harness/public.d.ts

@@ -4,3 +4,7 @@ export { VerdictFnJudge, LlmEvalJudge, HybridJudge } from "./judge.js";
 export type { AttemptJudge, JudgeContext, JudgeResult, SkillCandidate } from "./judge.js";
 export { judge } from "../runtime/eval.js";
 export type { VerdictDetail, JudgeArgs } from "../runtime/eval.js";
+export { composeSystemPrompt, manifestDigest, applyManifest, applyPatch, validateManifest, surfaceTier, } from "./manifest.js";
+export type { InstructionProfile, HarnessManifest, HarnessRuntimePatch, HarnessPatch, SurfaceTier, } from "./manifest.js";
+export { NudgeEngine, validateNudgeRules } from "./nudge.js";
+export type { NudgeTrigger, NudgeRule, NudgeOutput } from "./nudge.js";

package/dist/harness/public.js

@@ -2,3 +2,7 @@
 export { AttemptLoop, RuntimeAttemptBody, continueSession, freshWithFeedback, freshWithDigest, } from "./harness.js";
 export { VerdictFnJudge, LlmEvalJudge, HybridJudge } from "./judge.js";
 export { judge } from "../runtime/eval.js";
+// Self-Harness H1: the harness face as data (manifest lineage + declarative event→note rules). The
+// lab layer loads these through the compiled dist, so they live on this public barrel.
+export { composeSystemPrompt, manifestDigest, applyManifest, applyPatch, validateManifest, surfaceTier, } from "./manifest.js";
+export { NudgeEngine, validateNudgeRules } from "./nudge.js";

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export type { LoopSpec, LoopOutcome } from "./runtime/loop-driver.js";
 export type { RunAgentOptions, RunFanoutOptions } from "./runtime/facade.js";
 export { RuntimeRunner, collectText } from "./runtime/runner.js";
 export type { RuntimeOptions, KernelReliabilityOptions, OperationCancellationReason, PromptBudget, SchedulerPolicy } from "./runtime/runner.js";
+export type { InstructionProfile, NudgeRule, NudgeTrigger } from "./harness/public.js";
 export type { SignalPolicy } from "./runtime/os-profile.js";
 export { readKernelDiagnostics, restoreKernelRuntime, snapshotKernelRuntime } from "./runtime/kernel-step.js";
 export type { KernelDiagnostics, KernelSnapshot } from "./runtime/kernel-step.js";

package/dist/runtime/runner.d.ts

@@ -16,6 +16,8 @@ import { type NativeOsProfile, type OsProfileId, type SignalPolicy } from "./os-
 import { LargeResultSpool } from "./large-result-spool.js";
 import type { BackgroundTaskErrorHandler } from "./reliability.js";
 import { type ContextPolicyOverridesV1 } from "./context-policy.js";
+import { type InstructionProfile } from "../harness/manifest.js";
+import { type NudgeRule } from "../harness/nudge.js";
 export interface SchedulerPolicy {
     version: 1;
     criticalPathWeight: number;
@@ -142,8 +144,24 @@ export interface RuntimeOptions {
         phase?: "initial" | "renewal";
     }) => Promise<MemoryQuery[] | undefined> | MemoryQuery[] | undefined;
     systemPrompt?: string;
+    /** Self-Harness H1.1: the four instruction slots (bootstrap/execution/verification/failureRecovery)
+     *  composed onto `systemPrompt` in fixed order at option normalization. The kernel still sees ONE
+     *  system prompt; this is the editable instruction surface the self-harness loop rewrites. Absent ⇒
+     *  `systemPrompt` is used verbatim (zero behavior difference). */
+    instructions?: InstructionProfile;
+    /** Self-Harness H1.2: declarative event→note rules. On each matching session event a rendered note
+     *  is pushed through the `injectNote` signal channel (same path as `onToolResult`'s `{note}`).
+     *  ≤16 rules, validated at construction. Absent/empty ⇒ no engine, no append wrapping, zero
+     *  behavior difference. */
+    nudges?: NudgeRule[];
     initialMemory?: string[];
     skillDir?: string;
+    /** Host-layer allowlist over the `skillDir` catalog by skill NAME. When set, only scanned skills
+     *  whose name is listed are fed to the kernel via `set_available_skills` (the manifest layer
+     *  intersects onto this host baseline in `applyManifest`). Absent ⇒ zero behavior difference (all
+     *  scanned skills fed); empty array ⇒ no skills (a legitimate narrowing — unlike an empty
+     *  `allowedToolIds`, which the runner reads as "no gating"). Only takes effect when `skillDir` is set. */
+    skillFilter?: string[];
     dreamStore?: DreamStore;
     /** M4: advisory callback when a recalled record crosses the promotion threshold. The host/model
      *  decides whether to pin the record or promote its content into knowledge. */
@@ -372,6 +390,11 @@ export declare class RuntimeRunner {
     private dashboard;
     /** Most recent kernel entropy sample of the active/last run (see `latestEntropy`). */
     private lastEntropySample;
+    /** H1.1: `systemPrompt` with the instruction slots composed in, computed ONCE so `run_started` and
+     *  the kernel AddSystemMessage take the identical string. */
+    private readonly composedSystemPrompt;
+    /** H1.2: present only when `opts.nudges` is non-empty; else null and the append funnel is untouched. */
+    private readonly nudgeEngine;
     constructor(opts: RuntimeOptions);
     /** Host configuration (for coordinator / sub-agent spawn). */
     get hostOptions(): RuntimeOptions;

package/dist/runtime/runner.js

@@ -19,6 +19,8 @@ import { LargeResultSpool } from "./large-result-spool.js";
 import { formatToolError } from "../tools/errors.js";
 import { ManagedTaskScope } from "./reliability.js";
 import { contextPolicyV1, normalizeContextPolicyV1, } from "./context-policy.js";
+import { composeSystemPrompt } from "../harness/manifest.js";
+import { NudgeEngine } from "../harness/nudge.js";
 export function schedulerPolicyToKernel(policy) {
     const allowed = new Set([
         "version", "criticalPathWeight", "fanoutWeight", "ageWeight", "tokenCostWeight",
@@ -97,12 +99,18 @@ export class RuntimeRunner {
     dashboard = null;
     /** Most recent kernel entropy sample of the active/last run (see `latestEntropy`). */
     lastEntropySample = null;
+    /** H1.1: `systemPrompt` with the instruction slots composed in, computed ONCE so `run_started` and
+     *  the kernel AddSystemMessage take the identical string. */
+    composedSystemPrompt;
+    /** H1.2: present only when `opts.nudges` is non-empty; else null and the append funnel is untouched. */
+    nudgeEngine;
     constructor(opts) {
         this.opts = opts;
         const schemaAttempts = opts.workflowSchemaValidationAttempts ?? 2;
         if (!Number.isInteger(schemaAttempts) || schemaAttempts < 1 || schemaAttempts > 16) {
             throw new RangeError("workflowSchemaValidationAttempts must be an integer between 1 and 16");
         }
+        this.composedSystemPrompt = composeSystemPrompt(opts.systemPrompt, opts.instructions);
         if (opts.enableDiagnosticsDashboard) {
             const originalAppend = opts.sessionLog.append.bind(opts.sessionLog);
             opts.sessionLog.append = async (sessionId, event) => {
@@ -114,6 +122,21 @@ export class RuntimeRunner {
                 return seq;
             };
         }
+        // H1.2: feed the nudge engine at the append funnel, stacking OVER any prior wrapping so the event
+        // is durably logged before a nudge observes it. Notes drain through the same `injectNote` channel
+        // as host `onToolResult` notes, surfacing in the NEXT provider request. Skipped entirely when no
+        // rules are configured, keeping the default event stream byte-identical.
+        this.nudgeEngine = opts.nudges?.length ? new NudgeEngine(opts.nudges) : null;
+        if (this.nudgeEngine) {
+            const priorAppend = opts.sessionLog.append.bind(opts.sessionLog);
+            opts.sessionLog.append = async (sessionId, event) => {
+                const seq = await priorAppend(sessionId, event);
+                for (const { note, urgency } of this.nudgeEngine.observe(event)) {
+                    this.injectNote(note, urgency);
+                }
+                return seq;
+            };
+        }
     }
     /** Host configuration (for coordinator / sub-agent spawn). */
     get hostOptions() {
@@ -1222,7 +1245,7 @@ export class RuntimeRunner {
                 goal: req.goal,
                 criteria: req.criteria ?? [],
                 agent_id: this.opts.agentId,
-                system_prompt: this.opts.systemPrompt,
+                system_prompt: this.composedSystemPrompt,
                 ...(attachments ? { attachments } : {}),
             });
         }
@@ -1424,11 +1447,11 @@ export class RuntimeRunner {
                 kind: "set_tools",
                 tools: this.opts.executionPlane.schemas().map(toolSchemaToKernel),
             });
-            if (this.opts.systemPrompt) {
+            if (this.composedSystemPrompt) {
                 await this.commitKernelApply(runtime, this.pendingObservations, {
                     kind: "add_system_message",
-                    content: this.opts.systemPrompt,
-                    tokens: Math.max(1, Math.ceil(this.opts.systemPrompt.length / 4)),
+                    content: this.composedSystemPrompt,
+                    tokens: Math.max(1, Math.ceil(this.composedSystemPrompt.length / 4)),
                 });
             }
             if (this.opts.initialMemory) {
@@ -1443,11 +1466,17 @@ export class RuntimeRunner {
             if (this.opts.skillDir) {
                 const { scanSkillDir } = await import("../skills/loader.js");
                 const metas = await scanSkillDir(this.opts.skillDir);
+                // S2 host-layer skill allowlist: keep only scanned skills named in `skillFilter` before feeding
+                // the catalog. Absent ⇒ feed all (identical to the pre-feature message); empty ⇒ feed none. The
+                // `set_available_skills` message is ALWAYS sent when a skillDir exists (shape preserved) — only
+                // the list narrows; the no-skillDir path stays untouched.
+                const filter = this.opts.skillFilter;
+                const selected = filter === undefined ? metas : metas.filter(m => filter.includes(m.name));
                 // P1-B: pass the full SkillMetadata (incl. `allowedTools`) straight through — re-mapping it
                 // field-by-field previously dropped `allowedTools`.
                 await this.commitKernelApply(runtime, this.pendingObservations, {
                     kind: "set_available_skills",
-                    skills: metas.map(m => skillMetadataToKernel(m)),
+                    skills: selected.map(m => skillMetadataToKernel(m)),
                 });
             }
             // P1-B/D: configure the stable-core tool ids (always exposed under skill gating). Empty/absent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepstrike/sdk",
-  "version": "0.2.46",
+  "version": "0.2.48",
   "description": "DeepStrike Node.js SDK",
   "type": "module",
   "main": "dist/index.js",
@@ -72,7 +72,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.99.0",
-    "@deepstrike/core": "0.2.46",
+    "@deepstrike/core": "0.2.48",
     "@google/generative-ai": "^0.24.1",
     "openai": "^5.23.2"
   },