@inhuman.tools/turn 0.0.0-stage → 0.1.0

package/dist/tool-catalog/types.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Catalog row identity. wireName is a model-edge projection — never durable
+ * routing. Connection tools route by connectionKey + serverToolName.
+ */
+import type { RuleInput } from "../context/retention/schema.js";
+export type CatalogSource = {
+    readonly kind: "pack";
+    readonly pluginName: string;
+} | {
+    readonly kind: "connection";
+    /** Kernel `connections` map key (slug). Lawful cross-doc pointer to ConnectionSpec. */
+    readonly connectionKey: string;
+    readonly serverToolName: string;
+};
+export type CatalogExecute = (raw: unknown, ctx: {
+    root?: string;
+    signal?: AbortSignal;
+    sessionId?: string;
+    background?: unknown;
+    catalog?: unknown;
+    onPriorContent?: (text: string | null) => void;
+    invocation?: unknown;
+    shellTailBytes?: number;
+    onTail?: (frame: {
+        readonly text: string;
+        readonly totalBytes: number;
+    }) => void;
+}) => Promise<unknown>;
+/** `tool` is completions tools[]. `symbol` is a scheme_repl name. `both` is both. */
+export type ToolRepresentation = "tool" | "symbol" | "both";
+export type PackToolMeta = {
+    readonly kind: "function";
+} | {
+    readonly kind: "bot-call";
+    readonly pluginName: string;
+    readonly target: string;
+    readonly background: boolean;
+    readonly lifetime: "turn" | "call";
+    readonly show: "result" | "omit" | "turn";
+    readonly deadlineMs?: number;
+    readonly supportsNotify: boolean;
+};
+export type CatalogEntry = {
+    readonly wireName: string;
+    readonly description: string;
+    readonly parameters: Record<string, unknown>;
+    /** Catalog class: `read` | `write` | `effect` | `meta`. Missing / unknown → `effect`. */
+    readonly class: string;
+    /**
+     * Model face. Omitted is a scheme symbol and stays off completions tools[].
+     * Native tools set this on `InhumanTool`; the catalog row copies it.
+     */
+    readonly representation?: ToolRepresentation;
+    readonly source: CatalogSource;
+    /**
+     * Pack / host plugins carry execute (InhumanTool.execute).
+     * Connection tools are projection-only — BODY is MCP PEW on the connection.
+     */
+    readonly execute?: CatalogExecute;
+    readonly packMeta?: PackToolMeta;
+    readonly triggersReactLoop?: boolean;
+    /** Skips the license floor. Copied from the tool that declared it. */
+    readonly isSideChannel?: boolean;
+    readonly tapeHidden?: boolean;
+    /**
+     * Self-declared retention hint (e.g. ephemeral output). Narrowing only, and
+     * only for this tool's own key: it can shorten what the policy says, never lengthen it.
+     */
+    readonly retention?: RuleInput;
+    /** Mustache the TUI paints while the call is open, after it seals, and as a caption. */
+    readonly question?: string | null;
+    readonly effect?: string | null;
+    readonly caption?: string | null;
+    /**
+     * Exam admit bag. Structural so this package does not import plugin-sdk.
+     * Plugin ExamAdmit is assignable.
+     */
+    readonly exam?: {
+        readonly program: (state: any, input: any) => string | {
+            readonly error: string;
+        };
+        readonly admit: (state: any, input: any) => any;
+        readonly settle?: (state: any, input: any, result: any) => any;
+    };
+};
+/** What a recipe needs to grant a wire beyond its plain tool list. */
+export type RecipeGrantSpec = {
+    readonly recipeScope: "session" | "project" | "global";
+    readonly mcpJson: string;
+    readonly tools: readonly string[];
+};
+/**
+ * Host-owned parts of the worker tool ceiling (bot-granted MCP, private plugin MCP). The ceiling
+ * itself lives in one place, `workerToolAllowed`; the host only answers these two questions.
+ */
+export type WorkerToolHost = {
+    /** Does the recipe grant this wire through its tool list or its `mcpJson` grants? */
+    readonly recipeGrantsWire: (catalog: object, spec: RecipeGrantSpec, wire: string, projectPath: string) => boolean;
+    /** Is this wire one of the recipe's private plugin MCP tools, not (yet) in the catalog view? */
+    readonly privateWireAllowed: (recipeName: string, wire: string, sessionRoot: object | undefined) => boolean;
+};
+export declare const PLAIN_WORKER_HOST: WorkerToolHost;
+//# sourceMappingURL=types.d.ts.map

package/dist/tool-catalog/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/tool-catalog/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACtD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAAC;AAEN,MAAM,MAAM,cAAc,GAAG,CAC3B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/C,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAClF,KACE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE5D,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC,CAAC;AAEN,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;QAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC;KAChE,CAAC;CACH,CAAC;AAEF,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAClH,gGAAgG;IAChG,QAAQ,CAAC,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;CAC7G,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cAG/B,CAAC"}

package/dist/tool-catalog/types.js

@@ -0,0 +1,5 @@
+export const PLAIN_WORKER_HOST = {
+    recipeGrantsWire: (_catalog, spec, wire) => spec.tools.includes(wire),
+    privateWireAllowed: () => false,
+};
+//# sourceMappingURL=types.js.map

package/dist/tool-catalog/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/tool-catalog/types.ts"],"names":[],"mappings":"AA0GA,MAAM,CAAC,MAAM,iBAAiB,GAAmB;IAC/C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IACrE,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK;CAChC,CAAC"}

package/dist/tool-runtime/approval/approved.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Cancel and generic outcome stamps on the leaf. Payload construction lives
+ * in harness-model. Cancel writes `cancelled`, not `approved`. Human
+ * `approvalComment` is a `TurnApprovalNoteChunk`, not this receipt.
+ */
+import { ApprovableJob } from "@inhuman.tools/harness-model";
+export declare function stampToolOutcome(leaf: ApprovableJob, text: "denied" | "cancelled", reason?: unknown): void;
+/**
+ * Unstarted (or allow-side but not yet BODY) cancel. Does not write
+ * `approved` or `orchestrationResult`.
+ */
+export declare const cancelUnstartedTool: (leaf: ApprovableJob, reason?: unknown) => void;
+//# sourceMappingURL=approved.d.ts.map

package/dist/tool-runtime/approval/approved.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approved.d.ts","sourceRoot":"","sources":["../../../src/tool-runtime/approval/approved.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAA4C,MAAM,8BAA8B,CAAC;AAGvG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,GAAG,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAE1G;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,SAAiB,aAAa,WAAW,OAAO,KAAG,IAGjF,CAAC"}

package/dist/tool-runtime/approval/approved.js

@@ -0,0 +1,20 @@
+/**
+ * Cancel and generic outcome stamps on the leaf. Payload construction lives
+ * in harness-model. Cancel writes `cancelled`, not `approved`. Human
+ * `approvalComment` is a `TurnApprovalNoteChunk`, not this receipt.
+ */
+import { applyToolOutcomeReceipt, cancelUnstarted } from "@inhuman.tools/harness-model";
+import { action } from "mobx";
+export function stampToolOutcome(leaf, text, reason) {
+    applyToolOutcomeReceipt(leaf, text, reason);
+}
+/**
+ * Unstarted (or allow-side but not yet BODY) cancel. Does not write
+ * `approved` or `orchestrationResult`.
+ */
+export const cancelUnstartedTool = action((leaf, reason) => {
+    if (leaf.completed || leaf.cancelled)
+        return;
+    cancelUnstarted(leaf, reason);
+});
+//# sourceMappingURL=approved.js.map

package/dist/tool-runtime/approval/approved.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approved.js","sourceRoot":"","sources":["../../../src/tool-runtime/approval/approved.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAiB,uBAAuB,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACvG,OAAO,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAE9B,MAAM,UAAU,gBAAgB,CAAC,IAAmB,EAAE,IAA4B,EAAE,MAAgB;IAClG,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,IAAmB,EAAE,MAAgB,EAAQ,EAAE;IACxF,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO;IAC7C,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC"}

package/dist/tool-runtime/approval/dist.d.ts

@@ -0,0 +1,6 @@
+export declare function distPolicySource(): string;
+/**
+ * Body of the one policy program. Never throws. Missing operator → dist.
+ */
+export declare function loadPolicySource(kernelFsRoot: string): string | undefined;
+//# sourceMappingURL=dist.d.ts.map

package/dist/tool-runtime/approval/dist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist.d.ts","sourceRoot":"","sources":["../../../src/tool-runtime/approval/dist.ts"],"names":[],"mappings":"AASA,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAYD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE"}

package/dist/tool-runtime/approval/dist.js

@@ -0,0 +1,28 @@
+/**
+ * Dist `policy.json` is the never-throwing program in policy-processor.
+ * `{kernelFsRoot}/policy.json` wins when present and non-empty.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { reasonableDefaultsSource } from "@inhuman.tools/policy/floor";
+export function distPolicySource() {
+    return reasonableDefaultsSource;
+}
+function readOperatorPolicySource(kernelFsRoot) {
+    try {
+        const user = readFileSync(join(kernelFsRoot, "policy.json"), "utf8");
+        if (user.trim() !== "")
+            return user;
+    }
+    catch {
+        /* missing operator policy is dist */
+    }
+    return undefined;
+}
+/**
+ * Body of the one policy program. Never throws. Missing operator → dist.
+ */
+export function loadPolicySource(kernelFsRoot) {
+    return readOperatorPolicySource(kernelFsRoot) ?? distPolicySource();
+}
+//# sourceMappingURL=dist.js.map

package/dist/tool-runtime/approval/dist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist.js","sourceRoot":"","sources":["../../../src/tool-runtime/approval/dist.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,SAAS,wBAAwB,CAAC,YAAoB;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,OAAO,wBAAwB,CAAC,YAAY,CAAC,IAAI,gBAAgB,EAAE,CAAC;AACtE,CAAC"}

package/dist/tool-runtime/approval/inbound.d.ts

@@ -0,0 +1,7 @@
+import { ApprovableJob, SessionTurn, type PermissionMode, type SessionPlexus } from "@inhuman.tools/harness-model";
+/** Sequence guard: wait, then true. Never false — that would deny BODY. */
+export declare function inboundTurnGuard(turn: SessionTurn): boolean | Promise<true>;
+export declare function publishPolicyError(session: SessionPlexus, text: string | null): void;
+/** Floor produce is policy-processor `license`. `_policy` is unused — writing it would fork the receipt. */
+export declare function stampLicenseDeny(leaf: ApprovableJob, _policy: PermissionMode): void;
+//# sourceMappingURL=inbound.d.ts.map

package/dist/tool-runtime/approval/inbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.d.ts","sourceRoot":"","sources":["../../../src/tool-runtime/approval/inbound.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,aAAa,EAEb,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AAgBtC,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAQpF;AAED,4GAA4G;AAC5G,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAEnF"}

package/dist/tool-runtime/approval/inbound.js

@@ -0,0 +1,48 @@
+/**
+ * LICENSE WHEN is the Approvable guard. Sequences typically return true;
+ * inbound Turn waits predecessors without returning false (false is deny).
+ */
+import { FieldAwareness } from "@here.build/plexus";
+import { applyDenyReceipt, SessionTurn, } from "@inhuman.tools/harness-model";
+import { when } from "mobx";
+function inboundPredecessorClosed(turn) {
+    if (!turn.inbound)
+        return true;
+    const seen = new Set([turn]);
+    let prior = turn.turnTail;
+    while (prior instanceof SessionTurn && !seen.has(prior)) {
+        seen.add(prior);
+        if (!prior.reducerExited)
+            return false;
+        if (!prior.inbound)
+            break;
+        prior = prior.turnTail;
+    }
+    return true;
+}
+/** Sequence guard: wait, then true. Never false — that would deny BODY. */
+export function inboundTurnGuard(turn) {
+    if (inboundPredecessorClosed(turn))
+        return true;
+    return (async () => {
+        await when(() => inboundPredecessorClosed(turn) || turn.cancelled || turn.completed);
+        return true;
+    })();
+}
+export function publishPolicyError(session, text) {
+    try {
+        const lane = new FieldAwareness(session.awareness, "policyError");
+        if (text == null || text === "")
+            lane.clear();
+        else
+            lane.set(text);
+    }
+    catch {
+        /* presence must not block the floor vote */
+    }
+}
+/** Floor produce is policy-processor `license`. `_policy` is unused — writing it would fork the receipt. */
+export function stampLicenseDeny(leaf, _policy) {
+    applyDenyReceipt(leaf);
+}
+//# sourceMappingURL=inbound.js.map

package/dist/tool-runtime/approval/inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../../src/tool-runtime/approval/inbound.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAEL,gBAAgB,EAChB,WAAW,GAGZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,SAAS,wBAAwB,CAAC,IAAiB;IACjD,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC1B,OAAO,KAAK,YAAY,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM;QAC1B,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,IAAI,wBAAwB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;QACrF,OAAO,IAAa,CAAC;IACvB,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAsB,EAAE,IAAmB;IAC5E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;;YACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,gBAAgB,CAAC,IAAmB,EAAE,OAAuB;IAC3E,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/dist/tool-runtime/approval/unattended.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Unattended coded receipts. Residual ask under auto is the judge, not
+ * `policy_denied`. Operator throw is awareness + dist, not `policy_error`.
+ */
+import { type EvalFailureCode, type EvalPermissionMode } from "@inhuman.tools/harness-model";
+export declare function resolveEvalPermissionMode(policy: string): EvalPermissionMode | null;
+export declare function unattendedFailureText(code: EvalFailureCode, policyId: string, reason?: string): string;
+//# sourceMappingURL=unattended.d.ts.map

package/dist/tool-runtime/approval/unattended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unattended.d.ts","sourceRoot":"","sources":["../../../src/tool-runtime/approval/unattended.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAwB,KAAK,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEnH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAEnF;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAatG"}

package/dist/tool-runtime/approval/unattended.js

@@ -0,0 +1,23 @@
+/**
+ * Unattended coded receipts. Residual ask under auto is the judge, not
+ * `policy_denied`. Operator throw is awareness + dist, not `policy_error`.
+ */
+import { isEvalPermissionMode } from "@inhuman.tools/harness-model";
+export function resolveEvalPermissionMode(policy) {
+    return isEvalPermissionMode(policy) ? policy : null;
+}
+export function unattendedFailureText(code, policyId, reason) {
+    switch (code) {
+        case "interaction_required":
+            return `Operation requires human authorization under policy ${policyId}`;
+        case "policy_denied":
+            return `Operation denied under policy ${policyId}`;
+        case "policy_error":
+            return reason != null && reason !== ""
+                ? `Policy evaluation failed under policy ${policyId}: ${reason}`
+                : `Policy evaluation failed under policy ${policyId}`;
+        case "policy_unavailable":
+            return `Policy ${policyId} is not available`;
+    }
+}
+//# sourceMappingURL=unattended.js.map

package/dist/tool-runtime/approval/unattended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unattended.js","sourceRoot":"","sources":["../../../src/tool-runtime/approval/unattended.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAiD,MAAM,8BAA8B,CAAC;AAEnH,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAqB,EAAE,QAAgB,EAAE,MAAe;IAC5F,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,sBAAsB;YACzB,OAAO,uDAAuD,QAAQ,EAAE,CAAC;QAC3E,KAAK,eAAe;YAClB,OAAO,iCAAiC,QAAQ,EAAE,CAAC;QACrD,KAAK,cAAc;YACjB,OAAO,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE;gBACpC,CAAC,CAAC,yCAAyC,QAAQ,KAAK,MAAM,EAAE;gBAChE,CAAC,CAAC,yCAAyC,QAAQ,EAAE,CAAC;QAC1D,KAAK,oBAAoB;YACvB,OAAO,UAAU,QAAQ,mBAAmB,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/tool-runtime/blob-port.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Write seam for blobs that leave the session document. The kernel's bucket
+ * belongs to the daemon; the places that stamp a large text (a file's prior,
+ * an isolated completion's prompt, the vacuum of a stored session) put through
+ * here and never import the store. Reads go the other way, through
+ * `readBlob` in harness-provider-sdk.
+ */
+import { type BlobRef } from "@inhuman.tools/harness-model";
+/** Synchronous because the stamping paths are: admit mints a job in one tick. */
+export type BlobWriter = (bytes: Uint8Array, mime: string) => BlobRef;
+/** What a `FileMutateToolJob` takes for its prior text: the text itself, or the reference to it. */
+export type PriorProps = {
+    readonly priorContent: string;
+} | {
+    readonly priorBlobJson: string;
+};
+/**
+ * What {@link externalizeText} decided for a text. `inline` is the text itself. `blob` carries what the
+ * document keeps instead: the head for the text field, and the reference (a `StoredBlob` as JSON) for the
+ * `*BlobJson` field beside it.
+ */
+export type TextStamp = {
+    readonly kind: "inline";
+    readonly text: string;
+} | {
+    readonly kind: "blob";
+    readonly head: string;
+    readonly blobJson: string;
+};
+/** The host that owns the bucket binds it once at boot. `null` unbinds. */
+export declare function bindBlobWriter(write: BlobWriter | null): void;
+/**
+ * Puts bytes through the bound writer and returns the reference. Throws while no writer is bound and when the
+ * bucket refuses. For a path that has no inline fallback (the vacuum moves text that is already in the
+ * document; a refused put must stop it, not pass silently). The stamping paths use {@link externalizeText}.
+ */
+export declare function writeBlob(bytes: Uint8Array, mime: string): BlobRef;
+/**
+ * Text within the inline limit stays inline. Larger text goes to the bucket as UTF-8 and the document keeps the
+ * reference with the head that paint and stubs read. With no writer bound, or a bucket that refuses the write,
+ * the text stays inline as it always did: a text is never lost to a full disk.
+ */
+export declare function externalizeText(text: string, mime?: string): TextStamp;
+/** {@link externalizeText} in the shape a `FileMutateToolJob` takes. */
+export declare function externalizePrior(text: string): PriorProps;
+//# sourceMappingURL=blob-port.d.ts.map

package/dist/tool-runtime/blob-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-port.d.ts","sourceRoot":"","sources":["../../src/tool-runtime/blob-port.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAgD,KAAK,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAE1G,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;AAEtE,oGAAoG;AACpG,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAMhF,2EAA2E;AAC3E,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,SAAS,CASjF;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAGzD"}

package/dist/tool-runtime/blob-port.js

@@ -0,0 +1,47 @@
+/**
+ * Write seam for blobs that leave the session document. The kernel's bucket
+ * belongs to the daemon; the places that stamp a large text (a file's prior,
+ * an isolated completion's prompt, the vacuum of a stored session) put through
+ * here and never import the store. Reads go the other way, through
+ * `readBlob` in harness-provider-sdk.
+ */
+import { blobHeadOf, exceedsInlineMax, storedBlobJson } from "@inhuman.tools/harness-model";
+const TEXT_MIME = "text/plain";
+let writer = null;
+/** The host that owns the bucket binds it once at boot. `null` unbinds. */
+export function bindBlobWriter(write) {
+    writer = write;
+}
+/**
+ * Puts bytes through the bound writer and returns the reference. Throws while no writer is bound and when the
+ * bucket refuses. For a path that has no inline fallback (the vacuum moves text that is already in the
+ * document; a refused put must stop it, not pass silently). The stamping paths use {@link externalizeText}.
+ */
+export function writeBlob(bytes, mime) {
+    if (writer === null)
+        throw new Error("no blob writer is bound");
+    return writer(bytes, mime);
+}
+/**
+ * Text within the inline limit stays inline. Larger text goes to the bucket as UTF-8 and the document keeps the
+ * reference with the head that paint and stubs read. With no writer bound, or a bucket that refuses the write,
+ * the text stays inline as it always did: a text is never lost to a full disk.
+ */
+export function externalizeText(text, mime = TEXT_MIME) {
+    if (writer === null || !exceedsInlineMax(text))
+        return { kind: "inline", text };
+    try {
+        const ref = writer(Buffer.from(text, "utf8"), mime);
+        const head = blobHeadOf(text);
+        return { kind: "blob", head, blobJson: storedBlobJson({ ...ref, head }) };
+    }
+    catch {
+        return { kind: "inline", text };
+    }
+}
+/** {@link externalizeText} in the shape a `FileMutateToolJob` takes. */
+export function externalizePrior(text) {
+    const stamp = externalizeText(text);
+    return stamp.kind === "inline" ? { priorContent: stamp.text } : { priorBlobJson: stamp.blobJson };
+}
+//# sourceMappingURL=blob-port.js.map

package/dist/tool-runtime/blob-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-port.js","sourceRoot":"","sources":["../../src/tool-runtime/blob-port.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAgB,MAAM,8BAA8B,CAAC;AAiB1G,MAAM,SAAS,GAAG,YAAY,CAAC;AAE/B,IAAI,MAAM,GAAsB,IAAI,CAAC;AAErC,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,KAAwB;IACrD,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAiB,EAAE,IAAY;IACvD,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe,SAAS;IACpE,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AACpG,CAAC"}

package/dist/tool-runtime/extra-root.d.ts

@@ -0,0 +1,3 @@
+export declare function runWithExtraRoot<T>(allow: boolean, fn: () => T): T;
+export declare function extraRootAllowed(): boolean;
+//# sourceMappingURL=extra-root.d.ts.map

package/dist/tool-runtime/extra-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extra-root.d.ts","sourceRoot":"","sources":["../../src/tool-runtime/extra-root.ts"],"names":[],"mappings":"AASA,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAElE;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C"}

package/dist/tool-runtime/extra-root.js

@@ -0,0 +1,14 @@
+/**
+ * Dispatch-time extra-root flag. Human allow / remainder grant / yolo
+ * shell is this spawn, not a file-read grant. Effect bodies read it;
+ * they do not set it.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+const extraRootAls = new AsyncLocalStorage();
+export function runWithExtraRoot(allow, fn) {
+    return extraRootAls.run(allow, fn);
+}
+export function extraRootAllowed() {
+    return extraRootAls.getStore() === true;
+}
+//# sourceMappingURL=extra-root.js.map

package/dist/tool-runtime/extra-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extra-root.js","sourceRoot":"","sources":["../../src/tool-runtime/extra-root.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,YAAY,GAAG,IAAI,iBAAiB,EAAW,CAAC;AAEtD,MAAM,UAAU,gBAAgB,CAAI,KAAc,EAAE,EAAW;IAC7D,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,YAAY,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC1C,CAAC"}

package/dist/tool-runtime/handler.d.ts

@@ -0,0 +1,29 @@
+import { AgentCallJob, BotCallJob, CallJob, ProgrammaticJob, SessionRoot, SessionTurn, SystemToolJob, ToolCallJob } from "@inhuman.tools/harness-model";
+import type { ToolCall } from "@inhuman.tools/tool-call-normalize";
+import { type KernelToolCatalog } from "../tool-catalog/index.js";
+/** Catalog face the handler proxies to. A kernel host satisfies this. */
+export type ToolCallKernel = {
+    readonly catalog: KernelToolCatalog;
+};
+export type AdmitContext = {
+    readonly session?: SessionRoot;
+    readonly originTurn?: SessionTurn;
+    readonly loadAgentCall?: (uuid: string) => CallJob | undefined;
+    /**
+     * Receives the job before admit returns. A reachable child can start, so pass
+     * this only for a call that may start.
+     */
+    readonly parent?: {
+        registerJob(child: AdmittedCall): void;
+    };
+};
+export type AdmittedCall = ToolCallJob | ProgrammaticJob;
+/** Standing bot or owned child from an `agent__ask` / `agent__send` wire. Unknown recipes seal the ceiling. */
+export declare function agentCallFromWire(call: ToolCall, catalog: KernelToolCatalog, ctx?: AdmitContext): BotCallJob | AgentCallJob | SystemToolJob;
+export declare class ToolCallHandler {
+    #private;
+    readonly kernel: ToolCallKernel;
+    constructor(kernel: ToolCallKernel);
+    admit(call: ToolCall, catalog?: KernelToolCatalog, ctx?: AdmitContext): AdmittedCall;
+}
+//# sourceMappingURL=handler.d.ts.map

package/dist/tool-runtime/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/tool-runtime/handler.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,YAAY,EACZ,UAAU,EACV,OAAO,EAoBP,eAAe,EAGf,WAAW,EACX,WAAW,EAEX,aAAa,EACb,WAAW,EAQZ,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAQnE,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE9G,yEAAyE;AACzE,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAC;IAC/D;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAA;KAAE,CAAC;CAC9D,CAAC;AAiIF,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,eAAe,CAAC;AAqBzD,+GAA+G;AAC/G,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,iBAAiB,EAC1B,GAAG,GAAE,YAAiB,GACrB,UAAU,GAAG,YAAY,GAAG,aAAa,CA0C3C;AAED,qBAAa,eAAe;;IACd,QAAQ,CAAC,MAAM,EAAE,cAAc;gBAAtB,MAAM,EAAE,cAAc;IAE3C,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,iBAAuC,EAAE,GAAG,GAAE,YAAiB,GAAG,YAAY;CA0S9G"}