@garuda-agent/garuda 0.16.1 → 0.17.0

package/SECURITY.md

@@ -6,9 +6,15 @@ Garuda runs commands and edits files for a model, so we take security reports se
 
 | Version | Supported |
 | --- | --- |
-| 0.14.x | Yes |
+| 0.17.x | Yes |
 | Older | No |
 
+## Node and dependencies
+
+Run Garuda on Node 22.23.4, 24.22.1 or 26.12.1, or a later release of the same line. Garuda warns
+at start on an older Node. CI, the release workflow and the dependency audit refuse a Node or a
+package with a known security fix missing. See [docs/security-deps.md](docs/security-deps.md).
+
 ## Report a vulnerability
 
 Do not open a public issue. Use GitHub's private vulnerability reporting: in this repository, open
@@ -28,5 +34,6 @@ In scope: the permission engine and the team policy, the OS sandbox (Seatbelt, b
 network allowlist and its proxy, secret redaction, the audit log, and the consent for project
 content (hooks, MCP servers, settings, commands, skills, agents).
 
-Known limits are listed in the README under the status table. A report about one of them is still
+Known limits are listed in [docs/guide/status.md](docs/guide/status.md) and the
+[issue register](docs/quality-baseline/issue-register.md). A report about one of them is still
 welcome when it shows a new way to reach the same effect.

package/dist/{acpCommand-OTAYW7BS.js → acpCommand-7EY3NHPG.js}

@@ -1,37 +1,39 @@
 #!/usr/bin/env node
 import {
-  FileSessionStore,
   Runtime,
   auditDirFor
-} from "./chunk-TILFPYWO.js";
+} from "./chunk-2DYMJMRQ.js";
 import "./chunk-G2AX7MGS.js";
 import "./chunk-A2QAIRQL.js";
-import "./chunk-ULAJPMY7.js";
+import {
+  FileSessionStore
+} from "./chunk-735BKABA.js";
 import {
   chooseModel,
   keepProviderKeys,
   loadModelsConfig,
   providerKeySource,
   resolveModel
-} from "./chunk-NP6RIC25.js";
-import "./chunk-EIXUSVFX.js";
-import "./chunk-R7I2NBPX.js";
+} from "./chunk-JRVWH27M.js";
+import "./chunk-U65DQZDB.js";
+import "./chunk-J4346IDH.js";
 import {
   loadSearchConfig
 } from "./chunk-B25VL4RU.js";
 import "./chunk-23FXBNBB.js";
 import {
   VERSION
-} from "./chunk-VBZCNMUD.js";
+} from "./chunk-BSK5T2ZG.js";
 import "./chunk-5DEWP3YX.js";
 import "./chunk-ZAE25JM2.js";
 import "./chunk-ATW7BNIG.js";
 import "./chunk-PZS3V6P3.js";
-import "./chunk-OUCV3FCT.js";
-import "./chunk-GXZACJUI.js";
-import "./chunk-WMOLXTBU.js";
-import "./chunk-3EQU2GUX.js";
-import "./chunk-HUIK3WXO.js";
+import "./chunk-AOGFYUKG.js";
+import "./chunk-B4SJY7KT.js";
+import "./chunk-BHZ6G65V.js";
+import "./chunk-P6XWWIEK.js";
+import "./chunk-UIRJOQQS.js";
+import "./chunk-4LFJFDCF.js";
 import "./chunk-3NJNVZTK.js";
 
 // src/cli/acpCommand.ts
@@ -45,12 +47,12 @@ async function acpCommand(options) {
 `);
       return 1;
     }
-    const { setupCommand, terminalIO } = await import("./setupCommand-VA7D5MZK.js");
+    const { setupCommand, terminalIO } = await import("./setupCommand-GBQIVYJC.js");
     return setupCommand({}, { io: await terminalIO() });
   }
   const output = protocolOutput(process.stdout, process.stderr);
   const input = Readable.toWeb(process.stdin);
-  const { acpServer, setupNeeded } = await import("./server-NGKVIQEV.js");
+  const { acpServer, setupNeeded } = await import("./server-VEYIJHEU.js");
   const server = acpServer({
     version: VERSION,
     // Not on native Windows: the setup there could not keep a key private (no 0600).
@@ -114,7 +116,7 @@ async function prepare(options, from = {}) {
     const why = credentialsWarning === void 0 ? "" : ` ${credentialsWarning}`;
     return fail(`Garuda has no key for ${resolved.spec} (${keyName}).${why} ${SETUP_HINT}`, true);
   }
-  const { loadTeamPolicy } = await import("./policy-EJPLEEXP.js");
+  const { loadTeamPolicy } = await import("./policy-ZJ7RMOFN.js");
   let team;
   try {
     team = await loadTeamPolicy("managed" in from ? { home, managed: from.managed } : { home });
@@ -188,4 +190,4 @@ export {
   prepare,
   protocolOutput
 };
-//# sourceMappingURL=acpCommand-OTAYW7BS.js.map
+//# sourceMappingURL=acpCommand-7EY3NHPG.js.map

package/dist/{anthropic-NQDBCHJU.js → anthropic-NQIZLD64.js}

@@ -14,10 +14,12 @@ var AnthropicClient = class {
     this.client = options.client ?? new Anthropic(clientOptions(options.apiKey));
   }
   async *stream(request, options) {
-    const stream = this.client.messages.stream(
-      toWireParams(this.model, request),
-      options?.signal === void 0 ? {} : { signal: options.signal }
-    );
+    const stream = this.client.messages.stream(toWireParams(this.model, request), {
+      ...options?.signal === void 0 ? {} : { signal: options.signal },
+      // Under the token budget (0.17) the SDK must not send the request again on its own: the loop
+      // retries, and each of its attempts reserves first.
+      ...options?.meter === void 0 ? {} : { maxRetries: 0 }
+    });
     for await (const event of stream) {
       if (event.type === "content_block_delta" && event.delta.type === "text_delta") {
         yield { type: "text_delta", text: event.delta.text };
@@ -238,7 +240,11 @@ var AnthropicBatchClient = class {
     );
     const batch = await this.client.messages.batches.create(
       { requests: [{ custom_id: "garuda", params }] },
-      signal === void 0 ? {} : { signal }
+      {
+        ...signal === void 0 ? {} : { signal },
+        // Batch submission is a generation attempt too. The loop, not the SDK, owns retries.
+        ...options?.meter === void 0 ? {} : { maxRetries: 0 }
+      }
     );
     const started = Date.now();
     this.onWait?.({ batchId: batch.id, waitedMs: 0, status: "created" });
@@ -324,4 +330,4 @@ export {
   toWireTools,
   withHiddenThinking
 };
-//# sourceMappingURL=anthropic-NQDBCHJU.js.map
+//# sourceMappingURL=anthropic-NQIZLD64.js.map