@deepstrike/wasm 0.2.74 → 0.2.76

package/dist/agent.js

@@ -2,6 +2,7 @@ import { RuntimeRunner } from "./runtime/runner.js";
 import { LocalExecutionPlane } from "./runtime/execution-plane.js";
 import { InMemorySessionLog } from "./runtime/session-log.js";
 import { extractJsonValue, validateAgainstSchema } from "./runtime/output-schema.js";
+import { checkMemoryWrite } from "./memory/authority.js";
 function statusOf(reason) {
     if (["completed", "success", "done"].includes(reason))
         return "completed";
@@ -170,6 +171,10 @@ export class Agent {
             created_at: now, updated_at: now, recall_count: 0, confidence: input.confidence ?? 1,
             links: [], pinned: input.pinned ?? false, ...(input.ttlDays === undefined ? {} : { ttl_days: input.ttlDays }),
         };
+        // §22.13 · the kernel's write rule, not a copy of it, decides whether this record may be stored.
+        const refusal = await checkMemoryWrite(undefined, record.name, record.content);
+        if (refusal)
+            throw new Error(`agent "${this.name}" memory write denied: ${refusal}`);
         await this.memory.put(record);
         return record;
     }

package/dist/governance.d.ts

@@ -12,16 +12,11 @@ export interface GovernancePolicy {
         windowMs: number;
     }[];
     constraints?: GovernanceConstraint[];
-    /** I5: when true (default), the runner pre-filters denied tools out of the schema. */
+    /** I5: when true (default), the kernel withholds statically denied tools (vetoes and `deny`
+     *  rules, evaluated exactly as the call gate evaluates them) from the provider surface and names
+     *  them once in the knowledge slot. Mirrors Node. */
     surfaceDeniedInSystem?: boolean;
 }
-/** I5: bucket tools into allowed/denied per the policy. Pure. Mirrors Node. */
-export declare function governanceFilterSchema<T extends {
-    name: string;
-}>(tools: T[], policy: GovernancePolicy | undefined): {
-    allowed: T[];
-    denied: string[];
-};
 export type GovernanceConstraint = {
     kind: "required";
     tool: string;
@@ -38,5 +33,34 @@ export type GovernanceConstraint = {
     min?: number;
     max?: number;
 };
-export declare function governancePolicyToKernelEvent(policy: GovernancePolicy): Record<string, unknown>;
+export declare function governancePolicyToKernelEvent(policy: GovernancePolicy): Record<string, unknown> & {
+    rate_limits: Array<{
+        tool: string;
+        max_calls: number;
+        window_ms: number;
+    }>;
+};
+/** A §13.2 live-policy patch replacing the governance posture, for `RuntimeRunner.applyPolicyPatch`. */
+export declare function governancePolicyPatch(policy: GovernancePolicy): {
+    kind: "replace_governance_policy";
+    policy: Record<string, unknown>;
+};
+/** A §13.2 live policy patch in kernel vocabulary — the closed set of policies that may change
+ *  while an operation runs. Use `governancePolicyPatch` to build the governance variant. */
+export type LivePolicyPatch = {
+    kind: "replace_signal_policy";
+    policy: Record<string, unknown>;
+} | {
+    kind: "replace_governance_policy";
+    policy: Record<string, unknown>;
+} | {
+    kind: "replace_recovery_policy";
+    policy: Record<string, unknown>;
+} | {
+    kind: "tighten_resource_quota";
+    max_concurrent_subagents?: number;
+    max_total_subagents?: number;
+    max_spawn_depth?: number;
+    max_workflow_nodes?: number;
+};
 export {};

package/dist/governance.js

@@ -1,29 +1,4 @@
 // ─── Declarative policy (in-kernel gate) ──────────────────────────────────────
-/** I5: bucket tools into allowed/denied per the policy. Pure. Mirrors Node. */
-export function governanceFilterSchema(tools, policy) {
-    if (!policy)
-        return { allowed: tools, denied: [] };
-    const vetoes = new Set(policy.vetoes ?? []);
-    const allowed = [];
-    const denied = [];
-    const matches = (pat, name) => pat === name || (pat.endsWith("*") && name.startsWith(pat.slice(0, -1)));
-    for (const tool of tools) {
-        if (vetoes.has(tool.name)) {
-            denied.push(tool.name);
-            continue;
-        }
-        let action = policy.defaultAction ?? "allow";
-        for (const r of policy.rules ?? []) {
-            if (matches(r.pattern, tool.name))
-                action = r.action;
-        }
-        if (action === "deny")
-            denied.push(tool.name);
-        else
-            allowed.push(tool);
-    }
-    return { allowed, denied };
-}
 export function governancePolicyToKernelEvent(policy) {
     return {
         kind: "load_governance_policy",
@@ -36,9 +11,31 @@ export function governancePolicyToKernelEvent(policy) {
             window_ms: rl.windowMs,
         })),
         constraints: (policy.constraints ?? []).map(c => c.kind === "enum"
-            ? { kind: "enum", tool: c.tool, path: c.path, values: c.values }
+            ? { kind: "enum", tool: c.tool, param_path: c.path, values: c.values }
             : c.kind === "range"
-                ? { kind: "range", tool: c.tool, path: c.path, ...(c.min !== undefined ? { min: c.min } : {}), ...(c.max !== undefined ? { max: c.max } : {}) }
-                : { kind: "required", tool: c.tool, path: c.path }),
+                ? {
+                    kind: "range", tool: c.tool, param_path: c.path,
+                    // The wire carries fixed-point micro-units so a bound replays byte-identically.
+                    ...(c.min !== undefined ? { min_micros: toMicros(c.min) } : {}),
+                    ...(c.max !== undefined ? { max_micros: toMicros(c.max) } : {}),
+                }
+                : { kind: "required", tool: c.tool, param_path: c.path }),
+        hide_denied_tools: policy.surfaceDeniedInSystem !== false,
     };
 }
+/** A §13.2 live-policy patch replacing the governance posture, for `RuntimeRunner.applyPolicyPatch`. */
+export function governancePolicyPatch(policy) {
+    const { kind: _kind, ...wire } = governancePolicyToKernelEvent(policy);
+    return {
+        kind: "replace_governance_policy",
+        policy: {
+            ...wire,
+            rate_limits: wire.rate_limits.map(limit => ({ ...limit, window_ms: String(limit.window_ms) })),
+        },
+    };
+}
+function toMicros(value) {
+    if (!Number.isFinite(value))
+        throw new RangeError(`governance range bound must be finite, got ${value}`);
+    return Math.round(value * 1_000_000);
+}

package/dist/index.d.ts

@@ -22,7 +22,8 @@ export { OpenAIProvider, qwen, deepseek, minimax, kimi } from "./providers/opena
 export type { OpenAIProviderOptions, BackendProviderOptions } from "./providers/openai.js";
 export { ProviderError, classifyProviderError } from "./providers/provider-error.js";
 export type { ProviderErrorKind, ProviderErrorOptions } from "./providers/provider-error.js";
-export type { GovernancePolicy, GovernanceConstraint } from "./governance.js";
+export type { GovernancePolicy, GovernanceConstraint, LivePolicyPatch } from "./governance.js";
+export { governancePolicyPatch } from "./governance.js";
 export { tool, executeTools } from "./tools/index.js";
 export type { RegisteredTool, ToolExecContext } from "./tools/index.js";
 export { safeTool, ok, fail, ToolError, formatToolError } from "./tools/errors.js";

package/dist/index.js

@@ -14,6 +14,7 @@ export { McpExecutionPlane } from "./runtime/mcp-transport.js";
 export { AnthropicProvider } from "./providers/anthropic.js";
 export { OpenAIProvider, qwen, deepseek, minimax, kimi } from "./providers/openai.js";
 export { ProviderError, classifyProviderError } from "./providers/provider-error.js";
+export { governancePolicyPatch } from "./governance.js";
 export { tool, executeTools } from "./tools/index.js";
 export { safeTool, ok, fail, ToolError, formatToolError } from "./tools/errors.js";
 export { WorkingMemory } from "./memory/index.js";

package/dist/memory/authority.d.ts

@@ -0,0 +1,30 @@
+import type { MemoryRecall, MemoryRecallLifecycle } from "./index.js";
+/**
+ * §22.13 · the kernel's memory authority for a host with no live operation.
+ *
+ * Inside a run, every memory decision is a kernel transition (`admit_memory_write`, and the
+ * `memory_recalled` / `promotion_suggested` facts a query resolution journals). With no run — an
+ * explicit `remember`, a session extract after the run ended — the host asks the same kernel
+ * functions statelessly. The SDK keeps no copy of the validation rule and never computes a recall
+ * count itself.
+ */
+/** The canonical wire `MemoryPolicy` (the `u64` threshold travels as a decimal string). */
+export interface KernelMemoryPolicyWire {
+    stale_warning_days?: number;
+    retrieval_top_k?: number;
+    validation_enabled?: boolean;
+    max_content_bytes?: number;
+    max_name_length?: number;
+    promotion_recall_threshold?: string;
+}
+export interface MemoryPromotion {
+    record_id: string;
+    recall_count: number;
+}
+/** Would the kernel admit this write? Resolves to the refusal reason, or `undefined` when admitted. */
+export declare function checkMemoryWrite(policy: KernelMemoryPolicyWire | undefined, name: string, content: string): Promise<string | undefined>;
+/** Derive one recall's lifecycle from the counts the store reported it held. */
+export declare function deriveMemoryRecall(policy: KernelMemoryPolicyWire | undefined, recalledAt: number, hits: MemoryRecall[]): Promise<{
+    recalls: MemoryRecallLifecycle[];
+    promotions: MemoryPromotion[];
+}>;

package/dist/memory/authority.js

@@ -0,0 +1,34 @@
+import { getKernel } from "../runtime/kernel.js";
+async function ask(request) {
+    const kernel = await getKernel();
+    return JSON.parse(kernel.memoryAuthorityJson(JSON.stringify(request)));
+}
+/** Would the kernel admit this write? Resolves to the refusal reason, or `undefined` when admitted. */
+export async function checkMemoryWrite(policy, name, content) {
+    const answer = await ask({
+        op: "check_write",
+        ...(policy ? { policy } : {}),
+        name,
+        content_bytes: new TextEncoder().encode(content).byteLength,
+    });
+    return answer.admitted === true ? undefined : String(answer.error ?? "memory write refused");
+}
+/** Derive one recall's lifecycle from the counts the store reported it held. */
+export async function deriveMemoryRecall(policy, recalledAt, hits) {
+    if (hits.length === 0)
+        return { recalls: [], promotions: [] };
+    const answer = await ask({
+        op: "derive_recall",
+        ...(policy ? { policy } : {}),
+        recalled_at: Math.max(0, Math.trunc(recalledAt)),
+        recalls: hits.map(hit => ({
+            record_id: hit.record.record_id,
+            recall_count: Math.max(0, Math.trunc(hit.record.recall_count ?? 0)),
+            ...(hit.record.pinned ? { pinned: true } : {}),
+        })),
+    });
+    return {
+        recalls: (answer.recalls ?? []),
+        promotions: (answer.promotions ?? []),
+    };
+}

package/dist/providers/anthropic.js

@@ -1,5 +1,6 @@
 import { requestSnapshot } from "./prepared-request.js";
 import { assistantReplayKey, collectStreamMessage, toAnthropicMessages } from "./base.js";
+import { malformedToolArguments, toolArgumentsText } from "../runtime/tool-arguments.js";
 /** Anthropic accepts at most this many cache_control breakpoints per request. */
 const MAX_CACHE_BREAKPOINTS = 4;
 /** Rolling cache breakpoints reserved for the message history (system uses ≤2). */
@@ -317,8 +318,8 @@ export class AnthropicProvider {
                                 args = {};
                             }
                             nativeBlocks[idx] = { ...nativeBlocks[idx], input: args };
-                            finalToolCalls.push({ id: tb.id, name: tb.name, arguments: JSON.stringify(args) });
-                            yield { type: "tool_call", id: tb.id, name: tb.name, arguments: args };
+                            finalToolCalls.push({ id: tb.id, name: tb.name, arguments: toolArgumentsText(tb.argsBuf) });
+                            yield { type: "tool_call", id: tb.id, name: tb.name, arguments: args, ...malformedToolArguments(tb.argsBuf) };
                         }
                     }
                 }

package/dist/providers/openai.js

@@ -1,5 +1,6 @@
 import { requestSnapshot } from "./prepared-request.js";
 import { collectStreamMessage, toOpenAIMessages } from "./base.js";
+import { malformedToolArguments } from "../runtime/tool-arguments.js";
 const DEEPSEEK_REASONERS = new Set(["deepseek-reasoner", "deepseek-r1"]);
 const MINIMAX_REASONERS = new Set(["MiniMax-M1", "minimax-m1"]);
 // OpenAI-compatible provider — works for OpenAI, Qwen (DashScope), DeepSeek, MiniMax, Kimi
@@ -107,7 +108,7 @@ export class OpenAIProvider {
             catch {
                 args = {};
             }
-            yield { type: "tool_call", id: tb.id, name: tb.name, arguments: args };
+            yield { type: "tool_call", id: tb.id, name: tb.name, arguments: args, ...malformedToolArguments(tb.argsBuf) };
         }
     }
     prepareRequest(context, tools, extensions, state) {

package/dist/runtime/canonical-kernel-step.d.ts

@@ -43,6 +43,12 @@ export declare class CanonicalKernelRejectedError extends Error {
     readonly fault: Record<string, unknown>;
     constructor(faultJson: string);
 }
+/**
+ * Whether a run-loop failure was the kernel refusing a malformed input (`invalid_arg`) rather than
+ * any other error. Decided by the fault the kernel named, or a binding's argument-conversion
+ * status — never by searching the message text.
+ */
+export declare function isInvalidInputError(error: unknown): boolean;
 /**
  * A record is already authoritative once the journal append returns. A later native commit failure
  * is therefore a rebuild boundary, never an abort boundary.
@@ -68,6 +74,13 @@ export declare class CanonicalKernelHost {
     readonly journal: KernelJournal;
     readonly operationId: string;
     constructor(kernel: CanonicalKernelInstance, journal: KernelJournal, operationId: string);
+    /**
+     * The journal holds one outbound envelope slot per operation, so two transitions of the same
+     * operation must never overlap: the second would overwrite the first's staged bytes before its
+     * append was acknowledged. Every entry point that stages or drains goes through this queue.
+     */
+    private exclusiveTail;
+    private exclusive;
     transition(input: CanonicalKernelInput, options?: CanonicalTransitionOptions): Promise<CanonicalTransition>;
     /** Restore the latest installed checkpoint and its authoritative record tail in place. */
     restore(): Promise<CanonicalRestoreCost>;
@@ -94,6 +107,10 @@ export interface CanonicalRunnerRuntimeOptions {
         preview: string;
     }>;
 }
+/** Positional ids for anonymous appended nodes. A known DAG size yields `wf-node{base+i}`, the same
+ *  id the kernel gives the node internally; an unknown size (after a restore) yields a batch-scoped
+ *  id that cannot collide with anything already declared. */
+export type WorkflowNodeIdBase = number | string;
 export declare function sha256(value: string): string;
 /**
  * Canonical operation runtime used by the WASM host.
@@ -108,9 +125,17 @@ export declare class CanonicalRunnerRuntime {
     private started;
     private turns;
     private lastAction;
+    /** Live policy revision (§13.2): 0 at genesis, then each `live_policy_changed`. Unknown after a
+     *  restore, when a patch must name the revision it expects explicitly. */
+    private policyRevision;
+    /** Kernel-minted attempt per launched task, learned from each launch acknowledgement. */
+    private readonly taskAttempts;
     private readonly newMessages;
     private readonly hostObservations;
     private spawnedTasks;
+    /** Nodes in the active workflow DAG, mirrored from committed facts so anonymous appended nodes get
+     *  unique positional ids. `undefined` after a restore until the next committed submission. */
+    private workflowNodeCount;
     private readonly memoryBindingId;
     private payloadInlineThreshold;
     private payloadPreviewBytes;
@@ -119,6 +144,8 @@ export declare class CanonicalRunnerRuntime {
     get journal(): KernelJournal;
     turn(): number;
     isTerminal(): boolean;
+    /** Whether the operation has a root — the precondition for any live host control command. */
+    hasStarted(): boolean;
     recoveryContentBytes(): number;
     preservedRefs(): string[];
     drainNewMessages(): ModelMessage[];
@@ -129,11 +156,16 @@ export declare class CanonicalRunnerRuntime {
     resumeAction(): KernelRunnerAction | null;
     startAgent(taskValue: Record<string, unknown>, runSpecValue?: Record<string, unknown>): Promise<KernelRunnerAction | null>;
     startWorkflow(specValue: Record<string, unknown>): Promise<KernelRunnerAction | null>;
+    private appendBase;
     applyHostEvent(event: Record<string, unknown>): Promise<KernelRunnerAction | null>;
     private ensureConfigured;
     private commit;
+    /** Record what a committed transition tells the host: its observations and published effects. */
+    private absorbTransition;
     private currentAction;
     private pendingEffects;
+    /** One list field of the pending effect `effectId`, which must be of kind `kind`. */
+    private pendingEffectPayload;
     private succeededEffect;
     private failedEffect;
     private pageOutResolution;