@hachej/boring-agent 0.4.58 → 0.4.60

package/README.md

@@ -300,7 +300,7 @@ Responses expose the narrow native decision, with `no-store` headers. An observe
 
 `test/packages/agent-question-response.test.mjs` exercises real native transactions through Fetch requests, including duplicate answers, identity/policy refusal, streamed byte limits, unacknowledged source cancellation and lost response recovery. `npm run test:question-consumer` repeats these scenarios from the installed agent and files tarballs without UI/execution packages; the handler reads bodies through `@hachej/boring-files/request-guard`, so install `@hachej/boring-files` (an optional peer) with this subpath. Set `npm_config_cache` to a writable cache of the pinned dependencies. Socket/browser authentication, remote inbox presentation and human identity-provider integration remain unqualified.
 
-The strict TypeScript consumer recipe additionally installs `@modelcontextprotocol/sdk@1.32.1`. Pinned Pi model declarations transitively load `@google/genai`, whose declarations reference that optional SDK. This dependency is needed for this `skipLibCheck: false` recipe even though the question runtime does not call MCP. The consumer does not establish strict checking with only the agent's declared peers installed.
+The strict TypeScript consumer recipe additionally installs `@modelcontextprotocol/sdk@1.32.2`. Pinned Pi model declarations transitively load `@google/genai`, whose declarations reference that optional SDK. This dependency is needed for this `skipLibCheck: false` recipe even though the question runtime does not call MCP. The consumer does not establish strict checking with only the agent's declared peers installed.
 
 `@hachej/boring-agent/git` exports `createGitTool(repository?)`. Register this ordinary native tool with the same host-created `@hachej/boring-files/git` repository used by Bash or direct callers, or without one: each call then uses the `repository` of its own workspace binding (the one attached to the call's env, see [Workspace per call](#workspace-per-call)), so one tool serves a repository per person. It exposes the local service operations and preserves native ToolTask execution. The tool is always unsafe to replay because working Git has no publication receipts. The repository's host-bound authorization applies on every call. No environment or shell is mandatory for a file-only repository binding.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-agent",
-  "version": "0.4.58",
+  "version": "0.4.60",
   "license": "MIT",
   "private": false,
   "type": "module",
@@ -188,8 +188,8 @@
     "@earendil-works/pi-durable": "~1.4.0",
     "@earendil-works/pi-ai": "~1.4.0",
     "@earendil-works/chord": "~1.4.0",
-    "@hachej/boring-files": "^0.4.58",
-    "@hachej/boring-ui-kit": "^0.4.58",
+    "@hachej/boring-files": "^0.4.60",
+    "@hachej/boring-ui-kit": "^0.4.60",
     "typebox": "1.3.27",
     "xlsx": "^0.20.3"
   },