@hue-run/sdk 0.20.7 → 0.21.0

package/CLI.md

@@ -42,7 +42,7 @@ project manifest are refused because managers can update ancestor locks; Python
 The generated `hue.setup.mjs` or `hue_setup.py` always selects `captureContent: false` /
 `capture_content=False`. For a supported application, setup installs the dependency and adds the
 managed import and middleware registration to the existing entrypoint; an unreferenced helper is
-not a completed integration. TypeScript uses `@hue-run/sdk@0.20.7`, `@opentelemetry/api@1.9.1` and
+not a completed integration. TypeScript uses `@hue-run/sdk@0.21.0`, `@opentelemetry/api@1.9.1` and
 `@opentelemetry/context-async-hooks@2.11.0`; Python setup uses its separately tested package pin.
 Content capture requires an ordinary account-managed key and a later explicit application decision.
 
@@ -381,8 +381,8 @@ and Hue never receives or stores them. The command is part of the `hue` executab
 #   LANGFUSE_PUBLIC_KEY=pk-lf-...
 #   LANGFUSE_SECRET_KEY=sk-lf-...
 #   LANGFUSE_BASE_URL=https://cloud.langfuse.com
-npx -y @hue-run/sdk@0.20.7 import langfuse --env-path .env.langfuse --from 2026-01-01 --dry-run
-npx -y @hue-run/sdk@0.20.7 import langfuse --env-path .env.langfuse --from 2026-01-01 --media
+npx -y @hue-run/sdk@0.21.0 import langfuse --env-path .env.langfuse --from 2026-01-01 --dry-run
+npx -y @hue-run/sdk@0.21.0 import langfuse --env-path .env.langfuse --from 2026-01-01 --media
 ```
 
 `LANGFUSE_PUBLIC_KEY` and `LANGFUSE_SECRET_KEY` come from the environment or `--env-path`
@@ -698,7 +698,7 @@ node packages/sdk-typescript/scripts/verify-package.mjs --artifacts-dir .artifac
 # Set project to an existing supported fixture; use the same directory on resume.
 project=/absolute/path/to/supported-fixture
 node packages/sdk-typescript/scripts/verify-setup-live.mjs \
-  --archive .artifacts/typescript/hue-run-sdk-0.20.7.tgz \
+  --archive .artifacts/typescript/hue-run-sdk-0.21.0.tgz \
   --origin https://STAGING_ORIGIN \
   --project "$project" --command setup \
   --evidence .context/setup-staging-before-claim.json
@@ -709,7 +709,7 @@ the private local handoff and finish the real browser claim, then reconcile the
 
 ```sh
 node packages/sdk-typescript/scripts/verify-setup-live.mjs \
-  --archive .artifacts/typescript/hue-run-sdk-0.20.7.tgz \
+  --archive .artifacts/typescript/hue-run-sdk-0.21.0.tgz \
   --origin https://STAGING_ORIGIN \
   --project "$project" --command claim \
   --evidence .context/setup-staging-after-claim.json
@@ -751,10 +751,10 @@ otherwise. Never hand the agent Hue-native tools (`context.tools`, `context.mcp`
 production agent lacks. Pin the SDK, so the agent's repository gains no dependency:
 
 ```sh
-npx -y @hue-run/sdk@0.20.7 eval --case "Refund an eligible charge" --command "node agent.js"
-npx -y @hue-run/sdk@0.20.7 eval --case https://app.hue.run/projects/demo/scenarios/<id> --command "python agent.py" --timeout 120 --baseline <run id>
-npx -y @hue-run/sdk@0.20.7 eval --set "Billing regressions" --scorer-version <id> --command "node agent.js" --save-version
-npx -y @hue-run/sdk@0.20.7 eval --worker --command "node agent.js" --agent-key support-agent --revision <new-agent-revision>
+npx -y @hue-run/sdk@0.21.0 eval --case "Refund an eligible charge" --command "node agent.js"
+npx -y @hue-run/sdk@0.21.0 eval --case https://app.hue.run/projects/demo/scenarios/<id> --command "python agent.py" --timeout 120 --baseline <run id>
+npx -y @hue-run/sdk@0.21.0 eval --set "Billing regressions" --scorer-version <id> --command "node agent.js" --save-version
+npx -y @hue-run/sdk@0.21.0 eval --worker --command "node agent.js" --agent-key support-agent --revision <new-agent-revision>
 ```
 
 One invocation creates one run holding every selected case; it prints the run URL
@@ -792,7 +792,7 @@ export default function runMyAgent(inputs: JsonValue, context: SimulationTargetC
 ```
 
 ```sh
-npx -y @hue-run/sdk@0.20.7 eval --case "Refund an eligible charge" ./hue-agent.ts --content
+npx -y @hue-run/sdk@0.21.0 eval --case "Refund an eligible charge" ./hue-agent.ts --content
 ```
 
 `--scenario` remains an alias for `--case` for existing scripts. Pass one selection flag.
@@ -834,21 +834,28 @@ former; a case failed for its telemetry has `state: "error"`,
 Hue-owned `world_outcome` checks are graded after the world seals. An experiment always covers
 every case of the saved version; there is no case subset.
 
-`--judges` requests the run's pinned
-`llm_judge` evaluators after outputs upload, before verdict polling. It is off by default and
-works in direct, simulation and worker modes. Requests use Hue's hosted judge budget;
+`hue eval` runs up to four cases at a time by default in one-shot and worker modes.
+`--concurrency 1` runs cases serially. Any explicit `--concurrency` value from 1 to 100 takes precedence.
+Each case keeps its own files, environment and checkpoint.
+
+The CLI requests the run's pinned `llm_judge` evaluators by default after outputs upload,
+before verdict polling, in direct, simulation and worker modes. `--no-judges` skips these requests;
+`--judges` remains accepted for existing commands. Requests use Hue's hosted judge budget;
 Hue applies its admission controls to new jobs. An accepted request remains replayable if the
-budget is later disabled. Cases without stored output are excluded, and combining
-`--judges` with `--no-output` is refused. `--check` creates no judge jobs.
+budget is later disabled. Cases without stored output are excluded. `--no-output` skips judge
+requests, and explicitly combining `--judges` with `--no-output` is refused. Without a pinned
+`llm_judge`, the CLI requests no model jobs. Creating a judge alone does not start one.
+`--check` creates no judge jobs.
 
-With `--judges --wait 0`, the CLI requests the jobs and returns their current verdict state;
+With `--wait 0`, the CLI requests the jobs and returns their current verdict state;
 pending jobs continue in Hue. Uploaded outputs are checkpointed before the attempt or worker
 queue is marked completed. If this handoff or dispatch fails, or its acknowledgement is lost,
 rerun the unchanged command with the same checkpoint directory. The CLI resumes judging the uploaded
-outputs without invoking the agent, using the same idempotency keys. After dispatch succeeds,
+outputs without invoking the agent, using the same idempotency keys. Changing to `--no-judges`
+or `--no-output` while that handoff is pending stops before a new agent run. After dispatch succeeds,
 the next ordinary invocation starts a new run as usual.
 
-`--worker --judges` discards cancelled or released handoffs. Once judge requests succeed, a
+`--worker` discards cancelled or released judge handoffs. Once judge requests succeed, a
 verdict-read failure is logged and the worker keeps accepting runs.
 
 `--command "<shell command>"` spawns the command once per case with the world's environment

package/EVALUATIONS.md

@@ -184,7 +184,7 @@ Scorer deferral shipped in TypeScript `0.3.1`: the local runner executes only th
 
 `world_outcome` pins (`hue.conversion_outcome.v1` and `.v2`, and the `hue.outcome_assertions.v2` and `.v3` case-outcome evaluators, `.v3` with its pinned judge in `config.judge`) run inside Hue and need no local callback or executable source digest. A supporting server owns their execution from saved world evidence. Legacy `local_code` pins still require the exact registered callback; changing the worker cannot convert those immutable pins into hosted ones.
 
-Manual results require a human session. Hosted model-judge dispatch is explicit: call `createJudgeJobs(runId,{idempotencyKey,jobs:[{evaluationItemId,scorerVersionId}]})`. Hue checks its judge budget when admitting new requests. `getJudgeBudget()` reports its current state, and on current servers the organization's monthly AI budget as `organizationBudget`, but replay an interrupted request with the same key and body even if that state changed. The [`hue eval --judges`](./CLI.md#evaluate-an-agent-against-a-case) option performs this dispatch after outputs upload; it is off by default. `listJudgeJobs`, `getJudgeJob` and `cancelJudgeJob` expose job progress and cancellation requests. These methods never claim that local execution has hosted provenance. Hosted job endpoints are covered by HTTP contract tests here; live hosted model execution is a separate platform acceptance phase. `listResults` and `getResult` read recorded local or hosted results.
+Manual results require a human session. Hosted model-judge dispatch is explicit: call `createJudgeJobs(runId,{idempotencyKey,jobs:[{evaluationItemId,scorerVersionId}]})`. Hue checks its judge budget when admitting new requests. `getJudgeBudget()` reports its current state, and on current servers the organization's monthly AI budget as `organizationBudget`, but replay an interrupted request with the same key and body even if that state changed. [`hue eval`](./CLI.md#evaluate-an-agent-against-a-case) dispatches pinned model judges by default after outputs upload; `--no-judges` skips them. Creating or publishing a judge alone starts no model job. `listJudgeJobs`, `getJudgeJob` and `cancelJudgeJob` expose job progress and cancellation requests. These methods never claim that local execution has hosted provenance. Hosted job endpoints are covered by HTTP contract tests here; live hosted model execution is a separate platform acceptance phase. `listResults` and `getResult` read recorded local or hosted results.
 
 When present, the budget's `authentication` reports credential resolution only. An
 `available` status or `configured: true` does not prove that a provider accepted the

package/README.md

@@ -202,6 +202,22 @@ helpers (`setInput`, `setOutput`, `tool` arguments and results, `recordMessages`
 that is not JSON, such as a `Date` or a class instance, is omitted with an instrumentation failure
 while the callback result is returned unchanged.
 
+### Tool endpoint evidence (unreleased)
+
+This checkout adds optional `ToolOptions.endpoint`: `{ url, source, method?, captureQueryParameters? }`.
+Use the actual HTTP(S) request URL, client config URL or receipt URL; set `source` to `request`,
+`client_config` or `receipt`. Supply `method` only when known. With content capture enabled,
+Hue records `url.full`, `hue.tool.endpoint.source` and optional `http.request.method` through the
+existing redactor (`attributes.url.full` for the URL). URL userinfo and fragments are removed;
+query values are omitted unless their names appear in `captureQueryParameters`. Credential names
+are rejected even if allowlisted. Duplicate and empty allowed query values remain intact.
+
+Metadata-only mode omits endpoint evidence. Invalid evidence is omitted and counted without
+changing the tool's result or exception. This helper does not observe HTTP automatically or infer
+account identifiers. Do not supply secret-bearing URL paths, and preserve existing masking of
+account identifiers. See the [setup skill](../../skills/hue/SKILL.md#http-tool-endpoint-evidence)
+for dispatcher integration and source checkout requirements.
+
 ## Images, documents and audio
 
 Hue stores the bytes of images, documents and audio apart from the spans and log records that
@@ -536,8 +552,8 @@ the Langfuse project's own keys (`LANGFUSE_PUBLIC_KEY`, `LANGFUSE_SECRET_KEY`, a
 `HUE_API_KEY`:
 
 ```sh
-npx -y @hue-run/sdk@0.20.7 import langfuse --env-path .env.langfuse --from 2026-01-01 --dry-run
-npx -y @hue-run/sdk@0.20.7 import langfuse --env-path .env.langfuse --from 2026-01-01 --media
+npx -y @hue-run/sdk@0.21.0 import langfuse --env-path .env.langfuse --from 2026-01-01 --dry-run
+npx -y @hue-run/sdk@0.21.0 import langfuse --env-path .env.langfuse --from 2026-01-01 --media
 ```
 
 - It reads Langfuse Cloud and self-hosted v4 through the Observations API v2, and self-hosted v3
@@ -588,6 +604,79 @@ npx -y @hue-run/sdk@latest traces import upload ./exports.hue-import --authoriza
 See [Import a bundle of existing traces](CLI.md#import-a-bundle-of-existing-traces) for the
 formats, the report, what Hue refuses and the exit codes.
 
+## Sub-agents
+
+Run a sub-agent with `hue.subagent(name, callback, options)`, inside the tool call that starts it:
+
+```ts
+const findings = await hue.tool("research", { topic }, () =>
+  hue.subagent(
+    "researcher",
+    async () => {
+      const notes = await hue.model("gpt-5-mini", () => callModel(topic), { provider: "openai" });
+      return hue.tool("summarize", notes, () => summarize(notes));
+    },
+    { input: topic },
+  ),
+);
+```
+
+The sub-agent runs inside one `invoke_agent researcher` span with `gen_ai.operation.name`
+`invoke_agent`, `gen_ai.agent.name` `researcher` and `hue.agent.role` `subagent`. That span is a
+child of the active span, here the `execute_tool research` span, and the sub-agent's own model and
+tool spans are its children, so Hue scopes them to the sub-agent. Sub-agents nest: a sub-agent's
+tool can start another. The span is `INTERNAL` unless `options.kind` says otherwise; session, user
+and workspace identifiers are inherited unless `options` sets them. `options.input` and the
+callback's defined result are recorded as `input.value` and `output.value` when `captureContent`
+is true (a callback that calls `setOutput` keeps its own output), and errors are recorded and
+rethrown as in `withSpan`.
+
+The calling agent's role is not set for you: Hue reads roles only from the spans that state them,
+and the span a sub-agent starts under is usually a tool call, not the agent. To label the calling
+agent, give its own span the role:
+
+```ts
+await hue.withSpan("invoke_agent planner", () => runPlanner(), {
+  attributes: {
+    "gen_ai.operation.name": "invoke_agent",
+    "gen_ai.agent.name": "planner",
+    "hue.agent.role": "orchestrator",
+  },
+});
+```
+
+When the sub-agent runs in another process, send the caller's trace context with the request and
+start the sub-agent under it:
+
+```ts
+// The calling process, inside the tool call that hands the task over.
+await hue.tool("research", { topic }, async () => {
+  const headers: Record<string, string> = { "content-type": "application/json" };
+  hue.inject(headers); // adds `traceparent` only
+  const response = await fetch(researcherUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ topic, sessionId }),
+  });
+  return response.json();
+});
+
+// The sub-agent's process, for example an Express handler.
+const { topic, sessionId } = req.body;
+const findings = await hue.subagent("researcher", () => research(topic), {
+  parentContext: hue.extract(req.headers),
+  sessionId,
+});
+```
+
+The `invoke_agent researcher` span then belongs to the caller's trace, with the caller's
+`execute_tool research` span as its parent. `hue.extract()` reads a plain header object such as
+Node's `req.headers`; pass `Object.fromEntries(request.headers)` for a Fetch `Request`. Only
+`traceparent` crosses the boundary, never the API key, baggage or the session, so pass the
+session identifier yourself as above. Accept `traceparent` only from your own services: whoever
+sets it chooses the trace the sub-agent's spans join. On an endpoint that also serves other
+callers, extract it only from authenticated internal requests and start a new trace otherwise.
+
 ## Vercel AI SDK 6
 
 AI SDK 6 accepts a per-call tracer through `experimental_telemetry`. Pass
@@ -610,7 +699,9 @@ installed `ai` major version once per process and throws a `TypeError` below 7.
 
 ## Vercel AI SDK 7
 
-Compatible optional peers are `ai@^7.0.99` and `@ai-sdk/otel@^1.0.99`, alongside
+Compatible optional peers are `ai@^7.0.0` and `@ai-sdk/otel@^1.0.0` (install `@ai-sdk/otel` with
+the matching patch number, for example `ai@7.0.99` with `@ai-sdk/otel@1.0.99`; each `@ai-sdk/otel`
+release depends on exactly that `ai` release), alongside
 `@opentelemetry/api@1.9.1`. For an app without global AI SDK telemetry integrations,
 configure telemetry on each agent or generation call:
 
@@ -780,7 +871,8 @@ and similar attributes on your own providers.
 
 For external parent context pass `parentContext` to `withSpan`. Across processes, use
 `hue.inject(carrier)` inside the producing span and `hue.extract(carrier)` in the worker; both
-speak W3C `traceparent` only and never include the API key or baggage. Hue registers no global
+speak W3C `traceparent` only and never include the API key or baggage. Extract it only from
+trusted internal callers, as described under [Sub-agents](#sub-agents). Hue registers no global
 propagator, so `propagation.inject()` from `@opentelemetry/api` is a no-op unless your
 application configured one. `getContext()` exposes the helper's current context for APIs taking
 an explicit context. Session, user and workspace identifiers (`sessionId` as
@@ -1043,7 +1135,9 @@ receipt request. It does not flush, run your application, create a test span, or
 read captured values. `fields` reports the presence of stored normalized input,
 output, model, usage, and session data across the trace; it does not establish
 content correctness or that every possible span has arrived. Leave unknown usage
-and intentionally disabled content out of `requiredFields`.
+and intentionally disabled content out of `requiredFields`. When Hue reports the trace
+missing, `project` names the project the key searched: a trace absent there was sent with a
+different key (for example one still exported in the shell) or is not stored yet.
 
 The default budget is 10 seconds; set `timeoutMillis` up to 60,000. Only a recognized
 missing trace, HTTP 429, or HTTP 503 is retried, respecting `Retry-After` and the

package/dist/cli/eval.js

@@ -92,15 +92,16 @@ Output and limits:
   --check                         One-shot: check the key, selection and agent, print what the
                                   run would do and exit without creating a run or a world
   --checkpoint-dir <path>         Private checkpoint directory (default: .hue/eval/<agent-key>)
-  --concurrency <n>               Cases in flight, 1-100 (default: 1)
+  --concurrency <n>               Cases in flight, 1-100 (default: 4)
   --trace-not-accepted <policy>   A case whose telemetry Hue did not accept in time: fail_case
                                   (default) completes it as failed with the evidence omitted;
                                   pending completes it in its true state with the trace still to
                                   arrive, which Hue attaches once its export is complete
   --timeout <seconds>             Per-case --command timeout (default: 600)
   --wait <seconds>                Verdict wait after the run finishes (default: 300)
-  --judges                        Request pinned hosted model judges after outputs upload
-                                  (off by default; uses the project's judge budget)
+  --no-judges                     Skip pinned hosted model judges (requested by default
+                                  after outputs upload; uses the project's judge budget)
+  --judges                        Request pinned judges (compatibility flag)
   -h, --help                      Show this help
 
 HUE_API_KEY must be a "Read and write" project key; it is never printed.
@@ -154,7 +155,8 @@ function parse(argv) {
                 content: { type: "boolean" },
                 "no-content": { type: "boolean", default: false },
                 "no-output": { type: "boolean", default: false },
-                judges: { type: "boolean", default: false },
+                judges: { type: "boolean" },
+                "no-judges": { type: "boolean", default: false },
                 "trace-not-accepted": { type: "string" },
                 "save-version": { type: "boolean", default: false },
                 check: { type: "boolean", default: false },
@@ -1123,6 +1125,19 @@ export async function dispatchPinnedJudges(client, experimentId, subjectIds, sig
         await dispatch();
     return count;
 }
+/** Keep the judge lock through execution so an opt-out cannot race a pending dispatch. */
+async function acquireJudgeCheckpoint(directory, projectId, baseUrl, enabled) {
+    const store = await CheckpointStore.acquire(checkpointPath(directory, ["judge-dispatch", "judge checkpoint"]), { kind: "cli-judge-dispatch", projectId, baseUrl });
+    try {
+        if (!enabled && (await store.read("pending")))
+            throw new Error("Recover the pending hosted checks with the original flags before using --no-judges or --no-output");
+        return store;
+    }
+    catch (error) {
+        await store.release();
+        throw error;
+    }
+}
 /** Durable handoff before the original attempt marker or queue acknowledgement. */
 async function checkpointJudges(judging, run, completion) {
     await judging.store.write("pending", {
@@ -1242,7 +1257,7 @@ function parseBaseline(value) {
 }
 async function runOnce(values, connection, agents, agent, hue, output, signal) {
     const client = new EvaluationClient(connection);
-    const concurrency = integer("concurrency", values.concurrency, 1, 1, 100);
+    const concurrency = integer("concurrency", values.concurrency, 4, 1, 100);
     const baselineId = parseBaseline(values.baseline);
     const mode = parseMode(values.mode);
     integer("wait", values.wait, 300, 0, 86_400);
@@ -1267,9 +1282,10 @@ async function runOnce(values, connection, agents, agent, hue, output, signal) {
     // Each kind of run has its own checkpoint directory and identity: a mixed run never resumes
     // from, or is resumed by, a direct or simulation run's checkpoint.
     const checkpointDirectory = await prepareCheckpointDirectory(values["checkpoint-dir"], agent.key, project.id, selection.kind);
+    const judgeStore = await acquireJudgeCheckpoint(checkpointDirectory, project.id, connection.baseUrl, values.judges === true);
     const judging = values.judges
         ? {
-            store: await CheckpointStore.acquire(checkpointPath(checkpointDirectory, ["judge-dispatch", "judge checkpoint"]), { kind: "cli-judge-dispatch", projectId: project.id, baseUrl: connection.baseUrl }),
+            store: judgeStore,
             selectionDigest: digest({
                 datasetVersionId: pins.datasetVersionId,
                 scorerVersionIds: [...pins.scorerVersionIds].sort(),
@@ -1385,7 +1401,7 @@ async function runOnce(values, connection, agents, agent, hue, output, signal) {
         }, baselineId, output, signal, judging);
     }
     finally {
-        await judging?.store.release();
+        await judgeStore.release();
     }
 }
 /**
@@ -1425,7 +1441,7 @@ async function checkRun(client, values, pins, selection, agent, output) {
         mode: kind,
         worldCases: kind === "direct" ? 0 : worldCases,
         directCases: kind === "direct" ? cases : cases - worldCases,
-        agent: { key: agent.key, revision: agent.revision, concurrency: values.concurrency ?? "1" },
+        agent: { key: agent.key, revision: agent.revision, concurrency: values.concurrency ?? "4" },
     };
     if (values.json)
         process.stdout.write(`${JSON.stringify({ check })}\n`);
@@ -1602,19 +1618,16 @@ async function runWorker(values, connection, agents, agent, hue, output, signal)
     const client = new ObservedClient(connection);
     const environmentClient = createEnvironmentClient(connection);
     const wait = integer("wait", values.wait, 300, 0, 86_400);
-    const concurrency = integer("concurrency", values.concurrency, 1, 1, 100);
+    const concurrency = integer("concurrency", values.concurrency, 4, 1, 100);
     let maxRuns = values["max-runs"] === undefined
         ? undefined
         : integer("max-runs", values["max-runs"], 1, 1, 1_000_000);
     const project = await client.checkConnection();
     const checkpointDirectory = await prepareCheckpointDirectory(values["checkpoint-dir"], agent.key, project.id, "worker", slug(agent.revision) || "dev");
+    const judgeStore = await acquireJudgeCheckpoint(checkpointDirectory, project.id, connection.baseUrl, values.judges === true);
     const judging = values.judges
         ? {
-            store: await CheckpointStore.acquire(checkpointPath(checkpointDirectory, ["judge-dispatch", "judge checkpoint"]), {
-                kind: "cli-judge-dispatch",
-                projectId: project.id,
-                baseUrl: connection.baseUrl,
-            }),
+            store: judgeStore,
             selectionDigest: digest(agent),
             source: {
                 directory: checkpointDirectory,
@@ -1787,7 +1800,7 @@ async function runWorker(values, connection, agents, agent, hue, output, signal)
         return 0;
     }
     finally {
-        await judging?.store.release();
+        await judgeStore.release();
     }
 }
 /**
@@ -1831,8 +1844,11 @@ export async function runEvalCommand(argv) {
         worker = values.worker;
         if (values.content && values["no-content"])
             throw new UsageError("Choose either --content or --no-content");
+        if (values.judges && values["no-judges"])
+            throw new UsageError("Choose either --judges or --no-judges");
         if (values.judges && values["no-output"])
             throw new UsageError("--judges requires stored case outputs; remove --no-output");
+        values.judges = !values["no-judges"] && !values["no-output"];
         // A usage error before anything is prepared or created: no run is left to recover from it.
         traceNotAcceptedPolicy(values["trace-not-accepted"]);
         json = values.json;

package/dist/cli/login.js

@@ -220,11 +220,8 @@ async function readBoundedText(response) {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/**
- * Mirrors `checkConnection()` with `GET /api/v1/projects/current`, then confirms evaluation access
- * with `GET /api/v1/datasets`. No redirects are followed.
- */
-async function checkEvaluationsKey(fetchImpl, origin, apiKey) {
+/** Mirrors `checkConnection()` with `GET /api/v1/projects/current`; `detail` is the project name. */
+async function checkProject(fetchImpl, origin, apiKey) {
     let response;
     try {
         response = await fetchImpl(`${origin}/api/v1/projects/current`, {
@@ -253,16 +250,21 @@ async function checkEvaluationsKey(fetchImpl, origin, apiKey) {
             detail: `Hue answered HTTP ${response.status} while checking the evaluations key.`,
         };
     }
-    let projectName;
     try {
         const project = JSON.parse(await readBoundedText(response));
         if (!isRecord(project) || typeof project.name !== "string")
             throw new Error("Invalid project");
-        projectName = project.name;
+        return { ok: true, detail: project.name };
     }
     catch {
         return { ok: false, rejected: false, detail: "Hue returned an unexpected project response." };
     }
+}
+/** {@link checkProject}, then confirms evaluation access with `GET /api/v1/datasets`. */
+async function checkEvaluationsKey(fetchImpl, origin, apiKey) {
+    const project = await checkProject(fetchImpl, origin, apiKey);
+    if (!project.ok)
+        return project;
     // Every valid key reaches the project check; only a key with write access can list eval sets,
     // so a Read or Tracing only key is refused here instead of failing later in `hue eval`.
     let evaluations;
@@ -290,7 +292,7 @@ async function checkEvaluationsKey(fetchImpl, origin, apiKey) {
             rejected: false,
             detail: `Hue answered HTTP ${evaluations.status} while checking evaluation access.`,
         };
-    return { ok: true, detail: projectName };
+    return project;
 }
 /** Reads JSON-RPC messages from a JSON body or a `text/event-stream` body. */
 function parseJsonRpcMessages(text, contentType) {
@@ -689,6 +691,21 @@ export async function runLoginCommand(argv, io = {}) {
             out(kind === "evaluations"
                 ? `Evaluations access accepted for project "${check.detail}".`
                 : `Coding-agent access accepted; the Hue MCP server lists ${check.detail} tools.`);
+            // Loaders such as `uv run --env-file` and dotenv keep an exported variable over the file,
+            // so a stale shell key silently sends traces to another project. Name projects, never keys.
+            if (kind === "evaluations" && env.HUE_API_KEY && env.HUE_API_KEY !== value) {
+                // The shell key only goes to the server it was exported for.
+                const shellOrigin = env.HUE_BASE_URL ?? DEFAULT_ORIGIN;
+                const shell = shellOrigin === origin ? await checkProject(fetchImpl, origin, env.HUE_API_KEY) : null;
+                const owner = !shell
+                    ? ` for ${shellOrigin}`
+                    : shell.ok
+                        ? ` for project "${shell.detail}"`
+                        : shell.rejected
+                            ? " that Hue does not accept"
+                            : " whose project could not be checked";
+                stderr.write(`Warning: this shell already exports a different HUE_API_KEY${owner}. It takes precedence over ${envDisplay} (project "${check.detail}") in tools that load env files without overriding them; unset it before running the application.\n`);
+            }
         }
         if (!failure) {
             const text = mergeEnvText(envFile.text, updates);
@@ -738,12 +755,55 @@ export async function runLoginCommand(argv, io = {}) {
     }
     if (failure)
         return fail(failure.message, failure.code);
-    out("Next steps:");
+    const steps = [];
     if (stored.includes("coding-agent"))
         // `hue mcp install` defaults to production; a non-default origin needs its own endpoint.
         // Without --auth it configures sign-in unless HUE_MCP_KEY is exported, so name the key stored.
-        out(`  hue mcp install --client claude-code --auth key${mcpUrl === mcpUrlForOrigin(DEFAULT_ORIGIN) ? "" : ` --url ${mcpUrl}`}`);
-    if (stored.includes("evaluations"))
-        out(`  hue eval --case "<name>" ./hue-agent.ts${envDisplay === DEFAULT_ENV_FILE ? "" : ` --env-file ${envDisplay}`}`);
+        steps.push(`hue mcp install --client ${(await detectMcpClient(cwd)) ?? "<claude-code|codex|conductor|cursor|vscode|windsurf|gemini>"} --auth key${mcpUrl === mcpUrlForOrigin(DEFAULT_ORIGIN) ? "" : ` --url ${mcpUrl}`}`);
+    if (stored.includes("evaluations")) {
+        const agent = await detectEvalAgent(cwd);
+        if (agent)
+            steps.push(`hue eval --case "<name>" ${agent}${envDisplay === DEFAULT_ENV_FILE ? "" : ` --env-file ${envDisplay}`}`);
+    }
+    if (steps.length > 0) {
+        out("Next steps:");
+        for (const step of steps)
+            out(`  ${step}`);
+    }
     return 0;
 }
+/** Client configuration present in the repository root; `hue mcp install` writes the first three. */
+const MCP_CLIENT_MARKERS = [
+    ["claude-code", ".mcp.json"],
+    ["cursor", ".cursor"],
+    ["vscode", ".vscode"],
+    ["claude-code", ".claude"],
+    ["codex", ".codex"],
+    ["gemini", ".gemini"],
+    ["windsurf", ".windsurf"],
+];
+/** The one client whose configuration the repository holds; undefined when none or several do. */
+async function detectMcpClient(cwd) {
+    const found = new Set();
+    for (const [client, marker] of MCP_CLIENT_MARKERS)
+        if (await access(join(cwd, marker)).then(() => true, () => false))
+            found.add(client);
+    return found.size === 1 ? [...found][0] : undefined;
+}
+/** Manifests in the repository root that name its language; the CLI stays outside `hue setup`. */
+const LANGUAGE_MARKERS = [
+    ["./hue-agent.ts", "tsconfig.json"],
+    ['--command "<agent start command>"', "pyproject.toml"],
+    ['--command "<agent start command>"', "requirements.txt"],
+    ['--command "<agent start command>"', "uv.lock"],
+    ['--command "<agent start command>"', "poetry.lock"],
+    // Last: a Python repository often carries a package.json for its tooling.
+    ["./hue-agent.ts", "package.json"],
+];
+/** The `hue eval` agent argument for the repository's language; undefined when it is unknown. */
+async function detectEvalAgent(cwd) {
+    for (const [agent, marker] of LANGUAGE_MARKERS)
+        if (await access(join(cwd, marker)).then(() => true, () => false))
+            return agent;
+    return undefined;
+}

package/dist/client.d.ts

@@ -83,6 +83,18 @@ export declare class HueClient {
      * provider and surface as `hue.mcp.provider` / `hue.mcp.surface`.
      */
     tool<T>(name: string, input: unknown, execute: () => Promise<T> | T, options?: ToolOptions): Promise<T>;
+    /**
+     * Runs `callback` as a sub-agent: inside an `invoke_agent {name}` span carrying
+     * `gen_ai.operation.name` `invoke_agent`, `gen_ai.agent.name` and `hue.agent.role` `subagent`.
+     * The span nests under the active span, normally the `tool()` span of the call that started
+     * the sub-agent, or under `options.parentContext`, for example `hue.extract(headers)` in
+     * another process. The sub-agent's own model and tool spans nest under it, and session, user
+     * and workspace identifiers are inherited unless `options` sets them. `options.input` and a
+     * defined result are recorded as `input.value` / `output.value` when `captureContent` is true;
+     * a callback that calls `setOutput` keeps its own output. Errors are recorded and rethrown as
+     * in `withSpan`. A blank or non-string name is recorded as `unknown` and counted.
+     */
+    subagent<T>(name: string, callback: (span: HueSpan) => Promise<T> | T, options?: SpanOptions): Promise<T>;
     /**
      * Runs `callback` inside a GenAI client span for one direct provider call, named
      * `{operation} {model}` unless `options.name` is given and carrying `gen_ai.operation.name`,

package/dist/client.js

@@ -11,6 +11,7 @@ import { defaultResource, resourceFromAttributes } from "@opentelemetry/resource
 import { HUE_SCOPE } from "./config.js";
 import { hostedServerAddresses, hostedToolActivity, hostedToolProvider, providerErrorDescription, } from "./provider-tools.js";
 import { toolCatalogSummary } from "./tool-definitions.js";
+import { toolEndpointAttributes } from "./tool-endpoint.js";
 import { contentLimitsOf, encodeBoundedContent, encodeContent, noopSpan, safeSpan, spanSource, } from "./safety.js";
 import { TRUNCATED_KEY, withTruncatedKeys } from "./privacy.js";
 import { countFallback, MAX_BLOB_BYTES, newTally, sizeOf } from "./blobs.js";
@@ -269,10 +270,12 @@ export class HueClient {
      * @throws HueTraceVerificationError for authentication, unsupported endpoint, transport or invalid response failures.
      * @throws TypeError for an invalid trace ID or options.
      */
-    verifyTrace(traceId, options = {}) {
+    async verifyTrace(traceId, options = {}) {
         if (!this.enabled)
-            return Promise.reject(new HueConnectionError("Hue telemetry is disabled"));
-        return verifyTrace(this.transport.options, traceId, options);
+            throw new HueConnectionError("Hue telemetry is disabled");
+        // Once Hue reports the trace missing, name the project this key searched so a wrong key reads
+        // differently from a trace that is not stored yet.
+        return verifyTrace(this.transport.options, traceId, options, () => this.checkConnection().catch(() => undefined));
     }
     /** The helper's current context: the innermost active Hue span, else the OpenTelemetry active context. */
     getContext() {
@@ -385,6 +388,15 @@ export class HueClient {
         stamp("mcp.server.version", options.mcp?.version);
         stamp("hue.mcp.provider", options.mcp?.provider);
         stamp("hue.mcp.surface", options.mcp?.surface);
+        if (this.enabled && !this.closed && this.captureContent) {
+            try {
+                if (options.endpoint !== undefined)
+                    Object.assign(attributes, toolEndpointAttributes(options.endpoint));
+            }
+            catch {
+                this.instrumentationFailed();
+            }
+        }
         return this.withSpan(`execute_tool ${name}`, async ({ span }) => {
             this.setContent(span, "gen_ai.tool.call.arguments", input);
             const result = await execute();
@@ -396,6 +408,46 @@ export class HueClient {
             ...(options.parentContext ? { parentContext: options.parentContext } : {}),
         });
     }
+    /**
+     * Runs `callback` as a sub-agent: inside an `invoke_agent {name}` span carrying
+     * `gen_ai.operation.name` `invoke_agent`, `gen_ai.agent.name` and `hue.agent.role` `subagent`.
+     * The span nests under the active span, normally the `tool()` span of the call that started
+     * the sub-agent, or under `options.parentContext`, for example `hue.extract(headers)` in
+     * another process. The sub-agent's own model and tool spans nest under it, and session, user
+     * and workspace identifiers are inherited unless `options` sets them. `options.input` and a
+     * defined result are recorded as `input.value` / `output.value` when `captureContent` is true;
+     * a callback that calls `setOutput` keeps its own output. Errors are recorded and rethrown as
+     * in `withSpan`. A blank or non-string name is recorded as `unknown` and counted.
+     */
+    async subagent(name, callback, options = {}) {
+        let agent = name;
+        if (!isLabel(name)) {
+            agent = "unknown";
+            if (this.enabled && !this.closed)
+                this.instrumentationFailed();
+        }
+        return this.withSpan(`invoke_agent ${agent}`, async (span) => {
+            let outputSet = false;
+            const result = await callback({
+                ...span,
+                setOutput: (value) => {
+                    outputSet = true;
+                    span.setOutput(value);
+                },
+            });
+            if (result !== undefined && !outputSet)
+                span.setOutput(result);
+            return result;
+        }, {
+            ...options,
+            attributes: {
+                ...options.attributes,
+                "gen_ai.operation.name": "invoke_agent",
+                "gen_ai.agent.name": agent,
+                "hue.agent.role": "subagent",
+            },
+        });
+    }
     /**
      * Runs `callback` inside a GenAI client span for one direct provider call, named
      * `{operation} {model}` unless `options.name` is given and carrying `gen_ai.operation.name`,

package/dist/receipt.d.ts

@@ -1,4 +1,4 @@
-import type { HueOptions, TraceVerification, VerifyTraceOptions } from "./types.js";
+import type { ProjectConnection, HueOptions, TraceVerification, VerifyTraceOptions } from "./types.js";
 /**
  * Thrown by {@link HueClient.verifyTrace} when verification cannot proceed: denied key, unsupported
  * or refusing server, unreachable network or an invalid receipt. A timeout is not an error; it
@@ -18,4 +18,4 @@ export declare class HueTraceVerificationError extends Error {
 /** Observe persisted evidence after the application and its exporter have finished. */
 export declare function verifyTrace(connection: Pick<HueOptions, "apiKey"> & {
     baseUrl: string;
-}, traceId: string, options?: VerifyTraceOptions): Promise<TraceVerification>;
+}, traceId: string, options?: VerifyTraceOptions, onMissing?: () => Promise<ProjectConnection | undefined>): Promise<TraceVerification>;

package/dist/receipt.js

@@ -145,14 +145,16 @@ async function pause(milliseconds, signal) {
     });
 }
 /** Observe persisted evidence after the application and its exporter have finished. */
-export async function verifyTrace(connection, traceId, options = {}) {
-    return verifyTraceAtPath(connection, traceId, options, false, fetch);
+export async function verifyTrace(connection, traceId, options = {}, onMissing) {
+    return verifyTraceAtPath(connection, traceId, options, false, fetch, undefined, onMissing);
 }
 /** @internal Dedicated receipt path for setup credentials; ordinary clients stay unchanged. */
 export async function verifySetupTrace(connection, traceId, options, fetcher, signal) {
     return verifyTraceAtPath(connection, traceId, options, true, fetcher, signal);
 }
-async function verifyTraceAtPath(connection, traceId, options, setup, fetcher, signal) {
+async function verifyTraceAtPath(connection, traceId, options, setup, fetcher, signal, 
+/** Looks up the project the key searched once Hue has reported the trace missing. */
+onMissing) {
     if (!validId(traceId, 32))
         throw new TypeError("traceId must be a nonzero lowercase 32-character OpenTelemetry trace ID");
     if (options === null || typeof options !== "object" || Array.isArray(options))
@@ -181,6 +183,8 @@ async function verifyTraceAtPath(connection, traceId, options, setup, fetcher, s
     const timer = setTimeout(() => controller.abort(), timeout);
     const requestSignal = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
     let receipt = null;
+    let missing = false;
+    let lookup;
     let delay = 250;
     try {
         while (!requestSignal.aborted && performance.now() < deadline) {
@@ -204,6 +208,7 @@ async function verifyTraceAtPath(connection, traceId, options, setup, fetcher, s
                 const body = await readJson(response);
                 if (!record(body) || body.code !== "TRACE_NOT_FOUND")
                     throw new HueTraceVerificationError("http", "This Hue server does not support trace receipts. Check the server version and baseUrl.", 404);
+                missing = true;
             }
             else {
                 await response.body?.cancel();
@@ -221,6 +226,12 @@ async function verifyTraceAtPath(connection, traceId, options, setup, fetcher, s
             if (remaining <= 0)
                 break;
             const wait = Math.max(delay, retryAfter);
+            // Once the backoff would outlast the budget, the rest of it names the project the key
+            // searched instead of sleeping.
+            if (wait >= remaining && missing && onMissing) {
+                lookup = onMissing();
+                break;
+            }
             await pause(Math.min(wait, remaining), requestSignal);
             // A truncated backoff exhausts this call even if a timer wakes just early.
             if (wait >= remaining)
@@ -240,5 +251,13 @@ async function verifyTraceAtPath(connection, traceId, options, setup, fetcher, s
     finally {
         clearTimeout(timer);
     }
+    if (lookup && !receipt) {
+        const project = await Promise.race([
+            lookup,
+            pause(Math.max(0, deadline - performance.now()), controller.signal),
+        ]);
+        if (project)
+            return { verified: false, receipt, project };
+    }
     return { verified: false, receipt };
 }

package/dist/tool-endpoint.d.ts

@@ -0,0 +1,4 @@
+import type { Attributes } from "@opentelemetry/api";
+import type { ToolEndpoint } from "./types.js";
+/** Copy evidence, never send a request or resolve an endpoint from a tool name. */
+export declare function toolEndpointAttributes(endpoint: ToolEndpoint): Attributes;

package/dist/tool-endpoint.js

@@ -0,0 +1,46 @@
+import { isCredentialKey } from "./tool-definitions.js";
+/** Copy evidence, never send a request or resolve an endpoint from a tool name. */
+export function toolEndpointAttributes(endpoint) {
+    if (!endpoint ||
+        typeof endpoint.url !== "string" ||
+        endpoint.url.length > 8192 ||
+        /[\s\\\p{Cc}]/u.test(endpoint.url) ||
+        /%(?![0-9a-f]{2})/i.test(endpoint.url) ||
+        !["request", "client_config", "receipt"].includes(endpoint.source))
+        throw new Error("Invalid tool endpoint evidence");
+    const url = new URL(endpoint.url);
+    if (!["http:", "https:"].includes(url.protocol))
+        throw new Error("Invalid tool endpoint protocol");
+    const names = endpoint.captureQueryParameters ?? [];
+    if (!Array.isArray(names) ||
+        names.length > 32 ||
+        names.some((name) => typeof name !== "string" ||
+            !/^[a-zA-Z][a-zA-Z0-9_.-]{0,63}$/.test(name) ||
+            isCredentialKey(name)))
+        throw new Error("Invalid tool endpoint query allowlist");
+    // Keep the raw pairs, including duplicates and empty values. Re-encoding or selecting the
+    // first value can turn missing, malformed or ambiguous routing evidence into a usable ID.
+    const query = url.search
+        .slice(1)
+        .split("&")
+        .filter((pair) => {
+        const key = decodeURIComponent(pair.split("=", 1)[0].replace(/\+/g, " "));
+        return names.includes(key);
+    })
+        .join("&");
+    url.username = "";
+    url.password = "";
+    url.hash = "";
+    url.search = query;
+    const attributes = {
+        "url.full": url.href,
+        "hue.tool.endpoint.source": endpoint.source,
+    };
+    if (endpoint.method !== undefined) {
+        if (typeof endpoint.method !== "string" ||
+            !/^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,32}$/.test(endpoint.method))
+            throw new Error("Invalid tool endpoint method");
+        attributes["http.request.method"] = endpoint.method;
+    }
+    return attributes;
+}

package/dist/transport.js

@@ -16,7 +16,7 @@ import { MediaDigestMemo, isMediaName } from "./inline-files.js";
 import { locateParts } from "./attachment.js";
 import { snapshotLog, snapshotSpan } from "./snapshot.js";
 import { DROPPED_RECORDS_KEY, isContentKey, isTruncatedMarker, redactLog, redactSpan, TRUNCATED_KEY, truncatedMarker, withTruncatedKeys, } from "./privacy.js";
-import { sdkVersion } from "./version.js";
+import { otlpExporterVersion, sdkVersion } from "./version.js";
 /** A record's trace: a span's context, a log record's span identifiers; "" when unreadable. */
 function recordTraceId(record) {
     try {
@@ -2021,7 +2021,7 @@ class ReportingExporter {
         await this.forceFlush();
     }
 }
-// OpenTelemetry's OTLP/HTTP transport rules (otlp-exporter-base 0.222), restated because that
+// OpenTelemetry's OTLP/HTTP transport rules, restated because that
 // transport discards response headers, which Hue uses to announce features.
 const MAX_RETRIES = 5;
 const INITIAL_BACKOFF_MILLIS = 1000;
@@ -2042,7 +2042,7 @@ const RETRYABLE_NETWORK_ERRORS = new Set([
     "EHOSTUNREACH",
 ]);
 /** OpenTelemetry's exporter token, which follows Hue's in the User-Agent as it always has. */
-const OTEL_USER_AGENT = "OTel-OTLP-Exporter-JavaScript/0.222.0";
+const OTEL_USER_AGENT = `OTel-OTLP-Exporter-JavaScript/${otlpExporterVersion}`;
 function retryAfterMillis(value) {
     if (value == null)
         return undefined;
@@ -2141,12 +2141,13 @@ class OtlpHttpTransport {
             if (this.aborted)
                 throw new Error("Hue export deadline exceeded");
             const url = new URL(this.url);
-            const protocol = url.protocol;
             // Loaded on first use, as OpenTelemetry's exporter does, so importing Hue never loads http
-            // before the application's http instrumentation can patch it. A request measured before it
-            // was sent is not compressed again.
+            // before the application's http instrumentation can patch it. Each specifier is a literal:
+            // bundlers (Next.js Turbopack, webpack) cannot resolve a computed one and replace the import
+            // with a throw, so every export would fail. A request measured before it was sent is not
+            // compressed again.
             const [{ Agent: ConnectionAgent, request }, body] = await Promise.all([
-                import(protocol === "https:" ? "node:https" : "node:http"),
+                url.protocol === "https:" ? import("node:https") : import("node:http"),
                 this.body && data === this.body.data ? this.body.compressed : compress(data),
             ]);
             if (this.aborted)

package/dist/types.d.ts

@@ -201,11 +201,21 @@ export interface McpServerInfo {
     /** Hue surface such as `google.gmail/mcp`, recorded as `hue.mcp.surface`. */
     surface?: string;
 }
-/**
- * Options for {@link HueClient.tool}. `callId` is the provider-issued tool-call
- * id; `mcp` is the MCP server that handled the call.
- */
+/** Explicit routing evidence for {@link HueClient.tool}; values come from the application. */
+export interface ToolEndpoint {
+    /** Actual HTTP(S) URL used by the tool. Never synthesize it from a tool or server label. */
+    url: string;
+    /** Where the URL was observed. Recorded as `hue.tool.endpoint.source`. */
+    source: "request" | "client_config" | "receipt";
+    /** Actual HTTP method, when known; the SDK supplies no default. */
+    method?: string;
+    /** Non-secret query names to retain, including every occurrence. All others are removed. */
+    captureQueryParameters?: readonly string[];
+}
+/** Options for {@link HueClient.tool}, including call identity and opt-in routing evidence. */
 export interface ToolOptions extends Pick<SpanOptions, "parentContext"> {
+    /** Opt-in routing evidence. Only captured with content enabled, through existing redaction. */
+    endpoint?: ToolEndpoint;
     /** Provider-issued identifier of this tool call, recorded as `gen_ai.tool.call.id`. */
     callId?: string;
     /**
@@ -390,4 +400,9 @@ export interface TraceVerification {
     verified: boolean;
     /** Latest receipt observed, or `null` when the trace was never found. */
     receipt: TraceReceipt | null;
+    /**
+     * The project the key searched, looked up when no receipt arrived: a trace missing there was
+     * sent with a different key or is not stored yet. Absent when that lookup failed.
+     */
+    project?: ProjectConnection;
 }

package/dist/version.d.ts

@@ -1,2 +1,4 @@
 /** Package version shared by the instrumentation scope and the export User-Agent. */
-export declare const sdkVersion = "0.20.7";
+export declare const sdkVersion = "0.21.0";
+/** OTLP dependency version sent in the export User-Agent. */
+export declare const otlpExporterVersion = "0.223.0";

package/dist/version.js

@@ -1,3 +1,5 @@
 // Generated by scripts/write-version.mjs from package.json; do not edit by hand.
 /** Package version shared by the instrumentation scope and the export User-Agent. */
-export const sdkVersion = "0.20.7";
+export const sdkVersion = "0.21.0";
+/** OTLP dependency version sent in the export User-Agent. */
+export const otlpExporterVersion = "0.223.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hue-run/sdk",
-  "version": "0.20.7",
+  "version": "0.21.0",
   "private": false,
   "license": "MIT",
   "publishConfig": {
@@ -91,30 +91,30 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.9",
-    "@opentelemetry/api-logs": "0.222.0",
-    "@opentelemetry/core": "2.11.0",
-    "@opentelemetry/otlp-exporter-base": "0.222.0",
-    "@opentelemetry/otlp-transformer": "0.222.0",
-    "@opentelemetry/resources": "2.11.0",
-    "@opentelemetry/sdk-logs": "0.222.0",
-    "@opentelemetry/sdk-trace": "2.11.0",
+    "@opentelemetry/api-logs": "0.223.0",
+    "@opentelemetry/core": "2.12.0",
+    "@opentelemetry/otlp-exporter-base": "0.223.0",
+    "@opentelemetry/otlp-transformer": "0.223.0",
+    "@opentelemetry/resources": "2.12.0",
+    "@opentelemetry/sdk-logs": "0.223.0",
+    "@opentelemetry/sdk-trace": "2.12.0",
     "zod": "^3.25.76 || ^4.6.5"
   },
   "devDependencies": {
-    "@ai-sdk/otel": "1.0.99",
+    "@ai-sdk/otel": "1.0.137",
     "@opentelemetry/api": "1.9.1",
-    "@opentelemetry/context-async-hooks": "2.11.0",
+    "@opentelemetry/context-async-hooks": "2.12.0",
     "@types/bun": "1.4.2",
     "@types/node": "26.6.4",
-    "ai": "7.0.99",
+    "ai": "7.0.137",
     "ajv": "8.20.0",
     "protobufjs": "8.8.0",
     "typescript": "7.0.2"
   },
   "peerDependencies": {
-    "@ai-sdk/otel": "^1.0.99",
+    "@ai-sdk/otel": "^1.0.0",
     "@opentelemetry/api": "^1.9.1",
-    "ai": "^6.0.0 || ^7.0.99",
+    "ai": "^6.0.0 || ^7.0.0",
     "ajv": "^8.17.0"
   },
   "peerDependenciesMeta": {