@hachej/boring-agent 0.1.94 → 0.1.96

package/docs/ERROR_CODES.md

@@ -26,6 +26,7 @@ All API failures must use the response envelope:
 | `INVALID_API_KEY` | Provider rejects API key as malformed/invalid | 401 | re-auth | warn | stable (public API) |
 | `OIDC_REFRESH_FAILED` | OIDC refresh token exchange fails | 401 | re-auth | warn | stable (public API) |
 | `VERCEL_AUTH_FAILED` | Vercel sandbox auth/token request fails | 401 | re-auth | warn | stable (public API) |
+| `BLAXEL_AUTH_FAILED` | Blaxel sandbox auth/workspace request fails | 401 | re-auth | warn | stable (public API) |
 | `CONFIG_INVALID` | Runtime config fails schema validation | 500 | report-bug | error | stable (public API) |
 | `PATH_ESCAPE` | Relative path escapes workspace root | 403 | user-fix | warn | stable (public API) |
 | `PATH_ABSOLUTE` | Absolute path rejected where relative path is required | 400 | user-fix | warn | stable (public API) |
@@ -42,6 +43,12 @@ All API failures must use the response envelope:
 | `AGENT_FLEET_PLUGIN_UNKNOWN` | Agent fleet configuration references a plugin that the app did not load | 500 | fix app configuration | error | stable (trusted API) |
 | `AGENT_FLEET_CONFIG_BINDING_UNKNOWN` | Agent fleet configuration passes a plugin config key outside its declared Agent config contract | 500 | fix app configuration | error | stable (trusted API) |
 | `AGENT_FLEET_MODEL_POLICY_UNCOMPILED` | Agent fleet configuration declares a model policy that the app fleet compiler did not resolve | 500 | configure app fleet compiler | error | stable (trusted API) |
+| `AGENT_FLEET_SEAT_PERSONA_INVALID` | `loadConfiguredAgentFleet` excluded a fleet.yaml seat because its persona package failed to materialize or compose | 500 | fix persona package/spec | error | stable (trusted API) |
+| `AGENT_FLEET_SEAT_SKILL_DIGEST_MISMATCH` | `loadConfiguredAgentFleet` excluded a fleet.yaml seat because a pinned skill's canonical content was unavailable or its digest drifted | 500 | run `pnpm write:skill-digests` or fix the skill file | error | stable (trusted API) |
+| `AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE` | `loadConfiguredAgentFleet` composed a fleet.yaml seat but withheld the link to its persona `instructions.md`. Usually because the host serves a workspace root that does not contain the personas tree (multi-workspace hosts resolve a root per request and pass `workspaceRoot: null`); rarely because the seat name is not a safe path segment | 500 | expected on multi-workspace hosts — the seat runs normally, only the Agent-details instruction link is withheld. On a single-root host, check that `workspaceRoot` is the root the `user` filesystem serves and contains `personasDir`. If the message names the seat, rename it to `[A-Za-z0-9][A-Za-z0-9._-]*` | warn | stable (trusted API) |
+| `AGENT_FLEET_CONFIG_FILE_INVALID` | `loadConfiguredAgentFleet`'s fleet.yaml could not be read, parsed, or validated (whole-fleet failure, not per-seat) | 500 | fix `.agents/factory/fleet.yaml` | error | stable (trusted API) |
+| `AGENT_DEFINITION_ID_CONFLICT` | Multiple discovered plugin packages claim the same agent definition id, so every claimant is excluded | 500 | remove or rename conflicting definitions | error | stable (trusted API) |
+| `AGENT_DEFINITION_UNSEATED` | A discovered agent package is not named by the fleet roster and remains inert | 200 | seat it in class-B fleet config if activation is intended | info | stable (trusted API) |
 | `RUNTIME_PROVISIONING_FAILED` | Agent runtime dependency provisioning failed before Level 3 runtime dependencies became ready | 503 | retry/report | error | stable (public API) |
 | `RUNTIME_PROVISIONING_LOCKED` | Agent runtime provisioning is locked by another reconciler | 423 | retry | warn | stable (public API) |
 | `BWRAP_UNAVAILABLE` | `bwrap` binary not found | 500 | report-bug | error | stable (public API) |
@@ -50,6 +57,10 @@ All API failures must use the response envelope:
 | `SANDBOX_NOT_READY` | Remote sandbox cold start / provisioning | 503 | retry | warn | stable (public API) |
 | `SANDBOX_EXPIRED` | Remote sandbox TTL elapsed | 410 | retry | warn | stable (public API) |
 | `VERCEL_API_ERROR` | Generic upstream Vercel SDK/API failure | 502 | retry | error | stable (public API) |
+| `BLAXEL_API_ERROR` | Generic upstream Blaxel SDK/API failure | 502 | retry | error | stable (public API) |
+| `BLAXEL_CONFIG_DRIFT` | Existing Blaxel sandbox or Volume differs from requested immutable configuration | 409 | operator action | error | stable (public API) |
+| `BLAXEL_RUNTIME_UNQUALIFIED` | Blaxel runtime image lacks required workspace tools | 503 | replace image | error | stable (public API) |
+| `BLAXEL_VOLUME_BUSY` | Durable Blaxel Volume remains attached to another sandbox | 409 | retry | warn | stable (public API) |
 | `REMOTE_WORKER_CONFIG_INVALID` | Static remote-worker fleet configuration is invalid or incomplete | 500 | report-bug | error | stable (trusted API) |
 | `REMOTE_WORKER_PROTOCOL_MISMATCH` | Worker protocol or provider-contract version differs from the configured V1 cohort | 502 | operator-fix | error | stable (trusted API) |
 | `REMOTE_WORKER_UNAUTHENTICATED` | Worker rejected the per-box capability or authenticated receipt | 401 | operator-fix | warn | stable (trusted API) |
@@ -58,6 +69,8 @@ All API failures must use the response envelope:
 | `REMOTE_WORKER_REQUEST_INVALID` | A strict remote-worker request schema rejected the request | 400 | report-bug | warn | stable (trusted API) |
 | `REMOTE_WORKER_RESPONSE_INVALID` | A strict remote-worker response schema rejected the worker response | 502 | operator-fix | error | stable (trusted API) |
 | `REMOTE_WORKER_CAPABILITY_EXPIRED` | A short-lived worker capability expired or exceeded its maximum lifetime | 401 | retry | warn | stable (trusted API) |
+| `REMOTE_WORKER_CAPABILITY_REPLAY` | A single-use worker capability nonce was presented more than once | 409 | report-security | warn | stable (trusted API) |
+| `REMOTE_WORKER_CAPABILITY_NONCE_STORE_EXHAUSTED` | Worker cannot accept another capability without violating its bounded nonce history | 503 | retry | warn | stable (trusted API) |
 | `REMOTE_WORKER_AUTHORIZED_WORKSPACE_REQUIRED` | Remote provider creation lacked an authenticated workspace identity | 403 | report-bug | warn | stable (trusted API) |
 | `REMOTE_WORKER_BINDING_RECEIPT_INVALID` | Create returned an unauthenticated or mismatched sandbox/workspace binding receipt | 502 | operator-fix | error | stable (trusted API) |
 | `REMOTE_WORKER_SANDBOX_WORKSPACE_MISMATCH` | Authorized workspace capability does not match the immutable sandbox lease binding | 404 | report-security | warn | stable (trusted API) |
@@ -69,6 +82,12 @@ All API failures must use the response envelope:
 | `REMOTE_WORKER_IDEMPOTENCY_CONFLICT` | Reused lease/invocation id has a different request digest | 409 | report-bug | warn | stable (trusted API) |
 | `REMOTE_WORKER_EXEC_IN_PROGRESS` | Duplicate invocation is still executing | 409 | retry | warn | stable (trusted API) |
 | `REMOTE_WORKER_SECRET_INVOCATION_NOT_REPLAYABLE` | Completed secret-bearing invocation cannot replay cached output | 409 | start-new-request | warn | stable (trusted API) |
+| `REMOTE_WORKER_SECRET_REFERENCE_REJECTED` | Invocation secret metadata is invalid, cross-workspace, or classified as a model credential | 403 | report-bug | warn | stable (trusted API) |
+| `REMOTE_WORKER_EXEC_ABORTED` | Invocation was aborted after bounded in-sandbox cleanup | 499 | retry | warn | stable (trusted API) |
+| `REMOTE_WORKER_OUTPUT_LIMIT` | Invocation output exceeded its configured combined byte ceiling | 413 | reduce-output | warn | stable (trusted API) |
+| `REMOTE_WORKER_PATH_UNSAFE` | Workspace operation failed dirfd-relative path confinement | 400 | report-bug | warn | stable (trusted API) |
+| `REMOTE_WORKER_PATH_PRIMITIVE_UNAVAILABLE` | Required dirfd/openat2 containment primitive is unavailable | 503 | operator-fix | error | stable (trusted API) |
+| `REMOTE_WORKER_QUOTA_EXCEEDED` | Fixed workspace byte or inode quota was exceeded | 507 | free-space | warn | stable (trusted API) |
 | `REMOTE_WORKER_OUTCOME_UNKNOWN` | Worker loss left an effectful invocation outcome unknown; no automatic replay is safe | 502 | inspect-before-retry | error | stable (public API) |
 | `REMOTE_WORKER_INCOMPLETE_CLEANUP` | Provider could not prove remote lease teardown after bounded retries | 502 | operator-fix | error | stable (trusted API) |
 | `REMOTE_WORKER_DOCKER_COMMAND_FAILED` | Worker runtime command failed without exposing infrastructure stderr | 502 | operator-fix | error | stable (trusted API) |
@@ -81,6 +100,7 @@ All API failures must use the response envelope:
 | `METERING_UNSUPPORTED_COMMAND` | Slash-command execution is disabled because metering cannot yet reserve/settle that path | 409 | user-fix | warn | stable (public API) |
 | `SESSION_NOT_FOUND` | Session id does not exist | 404 | user-fix | warn | stable (public API) |
 | `SESSION_LOCKED` | Session currently locked by concurrent writer | 409 | retry | warn | stable (public API) |
+| `SESSION_TRANSCRIPT_UNREADABLE` | Canonical native session transcript exists but cannot be opened safely | 500 | retry | error | stable (public API) |
 | `STREAM_BUFFER_EVICTED` | Resume cursor evicted from in-memory stream buffer | 410 | retry | warn | stable (public API) |
 | `CURSOR_OUT_OF_RANGE` | Resume cursor invalid/out of range | 416 | user-fix | warn | stable (public API) |
 | `BRIDGE_COMMAND_INVALID` | UI bridge command kind/params invalid | 400 | user-fix | warn | stable (public API) |
@@ -94,6 +114,11 @@ All API failures must use the response envelope:
 | `MCP_AGENT_ARTIFACT_INVALID` | Managed MCP delivery artifact is path-shaped, non-Markdown, binary, malformed UTF-8, or otherwise invalid | 400 | user-fix | warn | stable (public API) |
 | `MCP_AGENT_ARTIFACT_TOO_LARGE` | Managed MCP final text, inline Markdown artifact, or serialized result exceeds the delivery v0 byte cap | 413 | user-fix | warn | stable (public API) |
 | `MCP_AGENT_ARTIFACT_UNAVAILABLE` | Managed MCP artifact is missing, unreadable through the authorized workspace, or changed during read | 409 | retry | warn | stable (public API) |
+| `AGENT_MCP_GRANT_REF_UNGRANTED` | Agent declared an `mcpServerRefs` connector with no matching per-agent MCP grant in the workspace; the connector is dropped, never silently allowed | 200 | user-fix | warn | stable (public API) |
+| `AGENT_MCP_GRANT_TOOL_NOT_ALLOWED` | A grant's `allowedTools` entry is not part of the connector's known tool catalog and was dropped during resolution | 200 | user-fix | warn | stable (public API) |
+| `AGENT_MCP_GRANT_RECORD_MALFORMED` | A persisted MCP grant record has a missing or malformed config and was skipped rather than crashing the workspace's grant listing | 200 | user-fix | warn | stable (public API) |
+| `AGENT_MCP_GRANT_CONNECTOR_UNKNOWN` | A grant's connector is unknown to the supplied connector catalog; the connector is denied rather than left unfiltered | 200 | user-fix | warn | stable (public API) |
+| `AGENT_MCP_GRANT_TOOL_NAME_INVALID` | A grant's `allowedTools` entry contains a glob metacharacter (e.g. `*`), which is rejected at write time so it can never be misinterpreted as a wildcard downstream | 400 | user-fix | warn | stable (public API) |
 | `PLUGIN_LOAD_FAILED` | Plugin failed to load/register | 500 | report-bug | error | stable (public API) |
 | `PLUGIN_NAME_COLLISION` | Plugin name collides with existing tool/plugin | 409 | user-fix | warn | stable (public API) |
 | `PLUGIN_RUNTIME_REVISION_MISMATCH` | Browser requested a stale plugin runtime revision after reload | 409 | retry | warn | stable (public API) |
@@ -113,11 +138,44 @@ All API failures must use the response envelope:
 | `PROVISIONING_UV_BOOTSTRAP_FAILED` | uv bootstrap/preflight failed for Python runtime packages | 500 | user-fix | error | stable (public API) |
 | `PROVISIONING_UV_INSTALL_FAILED` | uv venv or uv pip install failed | 500 | user-fix | error | stable (public API) |
 | `PROVISIONING_ARTIFACT_FAILED` | Runtime-mode adapter failed to prepare/upload install artifact | 500 | retry | error | stable (public API) |
+| `SKILL_DISCOVERY_FAILED` | Skill discovery failed without exposing package-manager or host-path details | 200 | retry | warn | stable (public API) |
+| `PACKAGE_RESOURCE_INVALID` | A declared or scanned package resource (skill/agent) failed validation | 400 | user-fix | warn | stable (public API) |
+| `PACKAGE_RESOURCE_CONFLICT` | Two package resources claim the same identity/path | 409 | user-fix | warn | stable (public API) |
+| `RUNTIME_FILESYSTEM_BINDING_DUPLICATE` | A filesystem id was bound more than once while merging host/request-scoped runtime filesystem bindings | 500 | report-bug | error | stable (public API) |
+| `RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID` | A readonly primary-workspace path is not a normalized workspace-relative path | 400 | user-fix | warn | stable (public API) |
+| `EVENT_STORE_OPEN_FAILED` | `BORING_CHAT_DURABLE_STREAM=1` but the SQLite event-stream store could not be opened: either no host-resolvable root exists (no `sessionRoot` and no host storage root — this deliberately never falls back to an in-sandbox/guest path) or `openDatabase` failed at the resolved path (bad path/permissions); reported via telemetry alongside `DURABLE_STREAM_UNAVAILABLE` | n/a (boot-time diagnostic, not an HTTP response) | report-bug | error | stable (public API) |
+| `DURABLE_STREAM_UNAVAILABLE` | `BORING_CHAT_DURABLE_STREAM=1` but the durable event-stream store could not be opened; boot fails loudly with the underlying cause instead of silently falling back to in-memory streaming (flag off = in-memory, unchanged) | n/a (boot-time failure, not an HTTP response) | user-fix | error | stable (public API) |
 | `ERR_NOT_IMPLEMENTED_UNTIL_T1` | Headless core method exists but the durable T1 implementation has not landed yet | 501 | retry-after-upgrade | warn | stable (public API) |
 | `INTERNAL_ERROR` | Catch-all internal failure | 500 | report-bug | error | internal (may change) |
 | `AR1_SHARE_NOT_FOUND` | `GET /a/:id` deep link: no such Lane W share entry, or the entry belongs to a workspace the requester is not authorized/scoped to (identical response either way — no existence oracle) | 404 | user-fix | warn | stable (public API) |
 | `AR1_SHARE_TOMBSTONED` | `GET /a/:id` deep link: share entry exists but its target file is gone; response renders provenance + last-known metadata, never a bare 404 | 200 | user-fix | warn | stable (public API) |
 
+## Credential registry
+
+Credential failures use their own stable enum, `CREDENTIAL_ERROR_CODES` in
+`src/shared/credentials/errors.ts`, surfaced as `CredentialResolutionError.code`.
+These are trusted-API codes: messages are metadata only and never carry a
+credential value, a workspace DEK, or KEK material.
+
+| Code | When it fires | HTTP status | Suggested client action | Log level | Stability |
+| --- | --- | --- | --- | --- | --- |
+| `CREDENTIAL_PROVIDER_UNKNOWN` | The referenced provider is not in the startup provider registry | 404 | report-bug | warn | stable (trusted API) |
+| `CREDENTIAL_NOT_CONFIGURED` | No credential material is configured for that workspace/provider, or a required registered field is absent | 404 | user-fix (connect the provider) | warn | stable (trusted API) |
+| `CREDENTIAL_DISABLED` | The workspace credential exists but is administratively disabled | 403 | user-fix | warn | stable (trusted API) |
+| `CREDENTIAL_REVOKED` | The workspace credential was revoked; no fallback is attempted | 403 | user-fix (reconnect) | warn | stable (trusted API) |
+| `CREDENTIAL_FORBIDDEN` | The verified principal may not use this credential | 403 | user-fix | warn | stable (trusted API) |
+| `CREDENTIAL_WORKSPACE_MISMATCH` | A credential artifact does not belong to the authority-verified workspace | 403 | report-bug | error | stable (trusted API) |
+| `CREDENTIAL_CONSUMER_MISMATCH` | A reference, binding, and provider triple disagree, or the binding is not registered for its provider | 403 | report-bug | warn | stable (trusted API) |
+| `CREDENTIAL_DELIVERY_FORBIDDEN` | The requested delivery channel is not permitted for that binding, or a lease was serialized | 403 | report-bug | error | stable (trusted API) |
+| `CREDENTIAL_AUTHORITY_INVALID` | The workspace credential authority is unissued, copied, or expired | 403 | re-auth | warn | stable (trusted API) |
+| `CREDENTIAL_SCHEMA_MISMATCH` | A credential reference, registry/binding definition, KEK context, or envelope AAD context failed strict validation | 400 | report-bug | warn | stable (trusted API) |
+| `CREDENTIAL_UNREADABLE` | A credential envelope or wrapped workspace DEK failed AES-256-GCM authentication — tampered ciphertext/nonce/tag, a swapped AAD component, a wrong KEK, or another backend's envelope. Never treated as "absent" | 500 | operator-fix | error | stable (trusted API) |
+| `CREDENTIAL_BACKEND_UNAVAILABLE` | The credential store or its KEK provider reported not-ready or failed unexpectedly; the operation fails closed with no fallback | 503 | retry/operator-fix | error | stable (trusted API) |
+| `CREDENTIAL_KEK_UNAVAILABLE` | The configured KEK source is missing, unreadable, or the wrong length, so no workspace DEK could be wrapped or unwrapped. Never falls back to another backend or to plaintext | 503 | operator-fix (mount/repair the sealed KEK file) | error | stable (trusted API) |
+| `CREDENTIAL_LEASE_EXPIRED` | A resolved credential lease was used after disposal or expiry | 410 | resolve a fresh lease | warn | stable (trusted API) |
+| `CREDENTIAL_OAUTH_STATE_INVALID` | A one-use OAuth state transaction was unknown, replayed, or expired | 400 | restart the connect flow | warn | stable (trusted API) |
+| `CREDENTIAL_OAUTH_REFRESH_FAILED` | Upstream refused a refresh-token exchange | 401 | re-auth | warn | stable (trusted API) |
+
 ## Readiness error details
 
 `WORKSPACE_NOT_READY` is reserved for workspace substrate requirements:

package/docs/README.md

@@ -68,6 +68,7 @@ the agent ↔ workspace boundary is in
 
 - [API](./API.md) — the four entry points and what each exports.
 - [AUTHORING](./AUTHORING.md) — declarative agent directories, bounds, validation, and legacy catalog migration.
+- [AGENT_PACKAGES](./AGENT_PACKAGES.md) — install, seat, update, unseat, and remove plugin-shaped agent packages in a workspace.
 - [STYLING](./STYLING.md) — CSS-variable theming contract and public selectors.
 - [UI-SHADCN](./UI-SHADCN.md) — `ChatPanel` styling model and tool-renderer overrides.
 - [tools](./tools.md) — built-in tools, package-added tools, and how to add custom tools.

package/docs/runtime.md

@@ -3,7 +3,7 @@
 # Runtime Modes and Provisioning
 
 Every v1 agent is bound to an authorized workspace and an approved runtime
-adapter. The agent supports three built-in execution modes controlling how
+adapter. The agent supports multiple built-in execution modes controlling how
 `bash` and filesystem tools run. A headless host may omit its UI/presentation
 surface, but it still supplies the same workspace-backed runtime contract.
 
@@ -14,6 +14,7 @@ surface, but it still supplies the same workspace-backed runtime contract.
 | `direct` | tools run directly in the host process | local dev, trusted environments |
 | `local` | tools run in a `bwrap` sandbox (Linux only) | self-hosted, untrusted input |
 | `vercel-sandbox` | tools run in Vercel Firecracker microVMs | production on Vercel |
+| `blaxel` | tools run in a Blaxel sandbox pinned to an explicit EU region | sovereign-compute bridge; production safety gate remains opt-in |
 
 Set via env var:
 
@@ -53,9 +54,25 @@ Mode-specific roots:
 - `direct`: `runtimeCwd` is the real host workspace path.
 - `local`/bwrap: `runtimeCwd` is `/workspace`; the host workspace is adapter-private.
 - `vercel-sandbox`: `runtimeCwd` is `/workspace`; `/vercel/sandbox` is adapter-private.
+- `blaxel`: `runtimeCwd` is the EU-pinned persistent Volume mount at `/workspace`.
 
 Never expose adapter-private paths (host workspace roots for bwrap, `/vercel/sandbox` for Vercel) in model-facing prompts, tool descriptions, or observations.
 
+### Blaxel v1 fidelity limits
+
+Blaxel SDK 0.3.11 does not expose a server-side output byte limit. The adapter
+therefore reads the terminal process record and applies Boring's single combined
+byte budget locally, allocating stdout before stderr. The SDK's live log stream
+is line based rather than byte exact, so v1 intentionally does not invoke
+`onStdout`/`onStderr`; callers receive byte-capped terminal output instead.
+
+Abort and timeout are implemented with a stable named process plus
+`process.kill()`. This is best effort across control-plane races: Boring preserves
+the caller's exact abort reason and returns exit 124 on timeout, but a provider
+transport failure can delay confirmation that the remote process stopped.
+Snapshots, forking, and Agent Drive remain out of scope because those Blaxel
+surfaces are private preview in the pinned SDK.
+
 ## `.boring-agent/` runtime layout
 
 Provisioned runtime artifacts live under the workspace-local `.boring-agent/` directory:
@@ -244,7 +261,7 @@ substrate as one runtime bundle.
 
 ```ts
 interface RuntimeModeAdapter {
-  id: string                                  // built-ins: 'direct' | 'local' | 'vercel-sandbox'
+  id: string                                  // built-ins: 'direct' | 'local' | 'blaxel' | 'vercel-sandbox'
   workspaceFsCapability?: Workspace['fsCapability']
                                               // describes how much host-side fs access exists before create();
                                               // remote backends must not claim strong host visibility

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-agent",
-  "version": "0.1.94",
+  "version": "0.1.96",
   "type": "module",
   "license": "MIT",
   "description": "Pane-embeddable coding agent. Ships direct/local/vercel-sandbox execution modes behind one interface.",
@@ -37,6 +37,11 @@
       "import": "./dist/server/agent-host/testing/gatewayConformance.js",
       "default": "./dist/server/agent-host/testing/gatewayConformance.js"
     },
+    "./server/agent-host/testing/compositionRouteProof": {
+      "types": "./dist/server/agent-host/testing/compositionRouteProof.d.ts",
+      "import": "./dist/server/agent-host/testing/compositionRouteProof.js",
+      "default": "./dist/server/agent-host/testing/compositionRouteProof.js"
+    },
     "./server/worker": {
       "types": "./dist/server/worker/index.d.ts",
       "import": "./dist/server/worker/index.js",
@@ -61,58 +66,58 @@
   ],
   "dependencies": {
     "@mariozechner/pi-coding-agent": "npm:@earendil-works/pi-coding-agent@0.80.7",
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "@radix-ui/react-collapsible": "^1.1.14",
-    "@radix-ui/react-dialog": "^1.1.17",
-    "@radix-ui/react-dropdown-menu": "^2.1.18",
-    "@radix-ui/react-hover-card": "^1.1.17",
-    "@radix-ui/react-select": "^2.3.1",
-    "@radix-ui/react-separator": "^1.1.10",
-    "@radix-ui/react-slot": "^1.3.0",
-    "@radix-ui/react-tooltip": "^1.2.10",
-    "@radix-ui/react-use-controllable-state": "^1.2.3",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "@radix-ui/react-collapsible": "^1.1.20",
+    "@radix-ui/react-dialog": "^1.1.23",
+    "@radix-ui/react-dropdown-menu": "^2.1.24",
+    "@radix-ui/react-hover-card": "^1.1.23",
+    "@radix-ui/react-select": "^2.3.7",
+    "@radix-ui/react-separator": "^1.1.15",
+    "@radix-ui/react-slot": "^1.3.3",
+    "@radix-ui/react-tooltip": "^1.2.16",
+    "@radix-ui/react-use-controllable-state": "^1.2.6",
     "@streamdown/cjk": "^1.0.3",
     "@streamdown/code": "^1.1.1",
     "@streamdown/math": "^1.0.2",
     "@streamdown/mermaid": "^1.0.2",
-    "@tanstack/react-query": "^5.101.1",
-    "ai": "^7.0.31",
+    "@tanstack/react-query": "^5.101.4",
+    "ai": "^7.0.40",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "diff": "^9.0.0",
-    "fastify": "^5.9.0",
-    "lucide-react": "^1.25.0",
-    "motion": "^12.42.0",
+    "fastify": "^5.11.2",
+    "lucide-react": "^1.27.0",
+    "motion": "^12.43.0",
     "nanoid": "^6.0.0",
-    "shiki": "^4.3.0",
+    "shiki": "^4.4.2",
     "streamdown": "^2.5.0",
     "tailwind-merge": "^3.5.0",
     "use-stick-to-bottom": "^1.1.6",
     "yaml": "^2.9.0",
     "zod": "^3.25.76",
-    "@hachej/boring-bash": "0.1.94",
-    "@hachej/boring-sandbox": "0.1.94",
-    "@hachej/boring-ui-kit": "0.1.94"
+    "@hachej/boring-bash": "0.1.96",
+    "@hachej/boring-ui-kit": "0.1.96",
+    "@hachej/boring-sandbox": "0.1.96"
   },
   "devDependencies": {
-    "@vercel/sandbox": "2.7.1",
+    "@vercel/sandbox": "2.9.2",
     "@antithesishq/bombadil": "0.6.1",
     "@opentelemetry/api": "^1.9.1",
-    "@tailwindcss/postcss": "^4.3.1",
+    "@tailwindcss/postcss": "^4.3.3",
     "@types/node": "^22.20.0",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.1.3",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "@vitejs/plugin-react": "^4.7.0",
     "ajv": "^8.20.0",
     "esbuild": "^0.28.1",
-    "postcss": "^8.5.19",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "postcss": "^8.5.25",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "tsup": "^8.4.0",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.6",
     "typescript": "^6.0.3",
-    "vite": "^8.1.5",
+    "vite": "^8.2.0",
     "vitest": "^4.1.9"
   },
   "peerDependencies": {

package/dist/DebugDrawer-RYEBQ6CO.js

@@ -1,6 +0,0 @@
-import {
-  DebugDrawer
-} from "./chunk-BOIV2I3N.js";
-export {
-  DebugDrawer
-};