@kjerneverk/agentic 1.0.5-dev.0 → 1.0.6-dev.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kjerneverk/agentic",
-  "version": "1.0.5-dev.0",
+  "version": "1.0.6-dev.0",
   "_versionReset": "2026-01-15",
   "description": "Shared agentic framework for multi-turn AI conversations and tool orchestration",
   "type": "module",

package/output/kodrdriv/260110-1207-commit-message.md

@@ -1 +0,0 @@
-chore(npm): add clean and prepublishOnly scripts for build artifacts

package/output/kodrdriv/260110-1208-commit-message.md

@@ -1 +0,0 @@
-chore(release): bump version to 0.0.2

package/output/kodrdriv/260110-1210-release-notes.md

@@ -1,27 +0,0 @@
-# @riotprompt/agentic 0.0.2 — Safer npm publishing (clean + prepublish build)
-
-## Summary
-This release is primarily about making npm publishes more reliable by ensuring build artifacts are recreated automatically before publishing.
-
-## Changes
-### Reliable publish artifacts
-- **Added `clean` script**: removes `dist/` (`rm -rf dist`).
-- **Added `prepublishOnly` script**: runs `clean` and then `build` (`npm run clean && npm run build`).
-
-**Why this matters:** the package entrypoints (`main`/`module`/`types`) point at files under `dist/`. With `prepublishOnly`, `npm publish` will consistently ship fresh compiled JS/CJS and type declarations, reducing the risk of publishing with missing or stale `dist` contents.
-
-### Repo hygiene
-- Updated `.gitignore` to ignore local/dev artifacts (notably `output/` and `kodrdriv` cache/config files), reducing accidental commits of tooling output.
-
-### Dependency metadata
-- Updated `package-lock.json` (no direct runtime dependency changes were introduced in `package.json`).
-
-## Impact
-- **Users installing from npm:** should see no API/runtime changes, but publishing should be more dependable (package is less likely to be missing compiled outputs).
-- **Developers/maintainers publishing the package:** `npm publish` will now run a clean build automatically.
-
-## Breaking changes
-- **None expected.**
-
-## Notes / considerations
-- The `clean` script uses `rm -rf`, which assumes a POSIX-like shell. If you publish from Windows without a compatible shell, you may need to run publishing in an environment that supports it (or adjust the script).

package/output/kodrdriv/260110-1232-commit-message.md

@@ -1 +0,0 @@
-chore(release): bump version to 0.0.3

package/output/kodrdriv/260110-1234-release-notes.md

@@ -1,46 +0,0 @@
-# @riotprompt/agentic v0.0.3 — test/coverage workflow improvements + dependency updates
-
-## Summary
-This release is primarily about improving the project’s test setup and CI ergonomics (separating tests from `src/`, generating coverage by default), plus routine dependency updates.
-
-No production source files changed in this range; the runtime/public API is expected to be unchanged.
-
-## What changed
-### Testing & coverage
-- **Tests moved out of `src/` into `tests/`**
-  - `src/context-manager.test.ts` → `tests/context-manager.test.ts`
-  - `src/tools.test.ts` → `tests/tools.test.ts`
-  - Imports were updated to reference `../src/...`.
-  - **Why it matters:** keeps the production source tree clean and avoids test files being treated like library source (e.g., during packaging/type generation).
-
-- **Coverage is now generated by default when running tests**
-  - `npm test` now runs: `vitest run --coverage`
-  - Added explicit alias: `npm run test:coverage`
-  - Coverage reporting now includes **text, JSON, and HTML**.
-  - Coverage config excludes common non-source inputs (`dist/**`, config files, etc.) to reduce noise.
-  - **Why it matters:** makes it easier to enforce and consume coverage in CI and to inspect results locally.
-
-### Developer workflow
-- Added a `precommit` script:
-  - `npm run precommit` → runs `lint` then `test`
-  - **Note:** this adds a convenient entry point, but does not itself install a git hook (that would require additional tooling/config).
-
-### Dependency updates
-- **zod** upgraded from `^3.25.51` → `^4.3.5`
-- **vitest** upgraded from `^3.2.4` → `^4.0.16`
-- Added **@vitest/coverage-v8** `^4.0.16` to support v8 coverage reporting
-- **globals** upgraded from `^16.2.0` → `^17.0.0`
-- `package-lock.json` updated accordingly
-
-## Impact
-### For library consumers
-- No expected behavior/API changes in the exported library surface.
-- Indirect impact: the package now depends on **Zod v4**. Most consumers won’t notice, but if your tooling forces dependency deduping/resolutions, ensure your Zod constraints are compatible.
-
-### For contributors/maintainers
-- `npm test` is now **slower** (coverage collection is enabled by default) but produces coverage artifacts/reports.
-- Tests must live under `tests/**/*.test.ts` to be picked up by the current Vitest config.
-
-## Breaking changes
-- No explicit breaking changes detected in code or exports.
-- Potential workflow break for contributors: if you had tests under `src/**/*.test.ts`, they will **no longer run** unless moved under `tests/` (or the Vitest include pattern is adjusted).

package/output/kodrdriv/260110-1308-release-notes.md

@@ -1,20 +0,0 @@
-# Package metadata: add repository URL and resync lockfile
-
-## Summary
-This release is primarily housekeeping: it adds the correct `repository` metadata to `package.json` and refreshes `package-lock.json` after syncing branches.
-
-## Changes
-- **Added `repository` metadata to `package.json`**
-  - `repository.type`: `git`
-  - `repository.url`: `https://github.com/kjerneverk/agentic`
-- **Updated `package-lock.json`** to reflect the current merged dependency graph.
-
-## Why this matters
-- **Users**: npm and other tooling can now reliably surface links back to the source repository (e.g., “Repository” link on npmjs.com, `npm repo`, and related ecosystem tooling).
-- **Developers/maintainers**: improves package discoverability and makes it easier to trace builds/issues back to the correct GitHub repo; lockfile refresh helps keep local installs reproducible.
-
-## Breaking changes
-- **None.** No runtime code, public API, exports, or dependency declarations changed (only metadata and lockfile normalization).
-
-## Notes
-- If you develop from the repo, run `npm ci` (or `npm install`) to pick up the lockfile refresh.

package/output/kodrdriv/260112-2155-commit-message.md

@@ -1 +0,0 @@
-chore(release): bump version to 0.0.4

package/output/kodrdriv/260112-2156-release-notes.md

@@ -1,33 +0,0 @@
-# @riotprompt/agentic 0.0.4 — CI moves to Node 24; install workflow updates
-
-## Summary
-This release is primarily a tooling/CI update. There are no library API/runtime changes in this diff; the main impact is on contributors and release automation.
-
-## Changes
-### CI and publishing now run on Node.js 24
-- GitHub Actions workflows (`test` and `npm-publish`) were updated from **Node 22 → Node 24**.
-- This aligns CI with newer tooling expectations and reduces failures when dependencies require newer Node versions.
-
-**Impact (developers):** if you run the same toolchain locally (lint/build/test), you should use **Node 24** to match CI.
-
-### Switch from `npm ci` to `npm install` in GitHub Actions
-- Both workflows now use `npm install` instead of `npm ci`.
-
-**Why it matters:** `npm ci` requires a committed lockfile. The repo changes in this range indicate the lockfile is no longer expected to be present in the repository, so CI needed to switch to an install mode that works without it.
-
-**Impact (developers/maintainers):** installs may be less “bit-for-bit” reproducible than `npm ci` unless you manage lockfiles in another way.
-
-### Lockfile is no longer tracked
-- `package-lock.json` is now ignored via `.gitignore`.
-
-**Impact (contributors):** don’t commit `package-lock.json` changes going forward; local installs will still generate a lockfile, but it’s intentionally not tracked.
-
-### Version bump
-- `package.json` version: **0.0.3 → 0.0.4**.
-
-## Breaking changes
-- **No user-facing API breaking changes detected.**
-- **Potential developer-facing breaking change:** CI standardizes on **Node 24**. If you were using Node 22 for local development/tests, you may need to upgrade to keep parity with CI.
-
-## Notes for maintainers
-- Release and test workflows now rely on `npm install`; ensure your release process does not assume a committed lockfile.

package/output/kodrdriv/260112-2340-commit-message.md

@@ -1 +0,0 @@
-chore(build): ship ESM-only bundle and target Node 24 / ES2024

package/output/kodrdriv/260113-0017-commit-message.md

@@ -1 +0,0 @@
-chore(release): bump version to 0.0.5

package/output/kodrdriv/260113-0017-release-notes.md

@@ -1,53 +0,0 @@
-# @riotprompt/agentic v0.0.5 — ESM-only distribution, Node 24+ / ES2024 target
-
-## Overview
-This release is primarily a packaging/build update. The library now ships **ESM-only** output and raises the runtime baseline to **Node.js 24+** while targeting **ES2024**.
-
-There are **no source/API changes** in this release range—changes are limited to `package.json`, `vite.config.ts`, and `tsconfig.json`.
-
-## Breaking changes
-### ESM-only distribution (CommonJS removed)
-- The package no longer builds or publishes a CommonJS bundle (`dist/index.cjs`).
-- `package.json` no longer provides an `exports["."].require` entry.
-
-**Impact:**
-- Consumers using `require("@riotprompt/agentic")` will fail.
-
-**Migration:**
-- Use ESM import:
-  ```js
-  import { ... } from "@riotprompt/agentic";
-  ```
-- If you are in a CommonJS codebase, use dynamic import:
-  ```js
-  const mod = await import("@riotprompt/agentic");
-  ```
-  (or convert the consuming project/package to ESM).
-
-### Node engine requirement raised to >= 24
-- `package.json` now declares:
-  - `engines.node: ">=24.0.0"`
-
-**Impact:**
-- npm/yarn/pnpm may block installation (or warn, depending on configuration) on Node versions older than 24.
-
-## Build & distribution changes
-- **Entry points simplified to ESM:**
-  - `main` now points to `./dist/index.js` (previously `./dist/index.cjs`).
-  - `exports["."].import` remains `./dist/index.js`.
-- **Vite library build now outputs only ES format:**
-  - `formats: ["es"]`
-  - `fileName: () => "index.js"`
-- **TypeScript target updated to ES2024:**
-  - `compilerOptions.target: "ES2024"`
-  - `compilerOptions.lib: ["ES2024"]`
-
-## Why this matters
-- Removes the complexity and ambiguity of dual ESM/CJS publishing.
-- Aligns the build output with modern Node runtimes and ES2024 language/library features.
-- Makes consumption consistent for ESM-first projects.
-
-## Upgrade checklist
-- Ensure CI/runtime is running **Node 24+**.
-- Update any CommonJS usage (`require`) to ESM `import` or dynamic `import()`.
-- If you had tooling that expected `dist/index.cjs`, update it to reference `dist/index.js` and ESM semantics.

package/output/kodrdriv/260115-0616-commit-message.md

@@ -1,4 +0,0 @@
-chore(release): reset package version to 1.0.0-dev.0
-
-- Add `_versionReset` marker in package.json
-- Add v1.0.0 marker comment to README

package/output/kodrdriv/260115-0739-commit-message.md

@@ -1 +0,0 @@
-chore(git-hooks): run build in precommit script

package/output/kodrdriv/260115-0746-commit-message.md

@@ -1 +0,0 @@
-chore(release): bump version to 1.0.0

package/output/kodrdriv/260115-0747-release-notes.md

@@ -1,91 +0,0 @@
-# v1.0.0: Tool execution security (ToolGuard/ToolSandbox), safer defaults, and improved tool invocation
-
-## Overview
-This release focuses on making tool execution safer and more controllable in agentic workflows. It introduces opt-in security and sandboxing layers for tools, changes the default logging behavior to reduce accidental information disclosure, and adds safer JSON argument handling for tool calls.
-
-## Highlights
-
-### Tool execution security (new)
-You can now add a security layer to tool execution via **ToolGuard**:
-
-- **Allow/deny lists** for tools (`allowedTools`, `deniedTools`)
-- **Zod-based parameter validation** (when a tool provides a `schema`)
-- **Safe JSON argument parsing** with **prototype pollution detection** (`__proto__`, `constructor`, `prototype`)
-- **Security event hooks** for monitoring/telemetry (validation failures, blocked execution, prototype pollution attempts)
-
-New/updated APIs:
-- `ToolRegistry.withSecurity(guard)`
-- `ToolRegistry.getSecurityGuard()`
-- `ToolRegistry.executeFromJSON(name, jsonArgs)` (uses `ToolGuard` parsing when configured)
-- `Tool` and `ToolDefinition` now support an optional `schema?: ZodSchema<any>`
-
-Example:
-```ts
-import { ToolRegistry, ToolGuard } from '@riotprompt/agentic';
-import { z } from 'zod';
-
-const registry = ToolRegistry.create();
-const guard = new ToolGuard({ deniedTools: ['rm_rf'] });
-
-registry.withSecurity(guard);
-
-registry.register({
-  name: 'read_file',
-  description: 'Read a file',
-  parameters: { type: 'object', properties: { path: { type: 'string', description: 'Path' } } },
-  schema: z.object({ path: z.string().min(1) }),
-  execute: async ({ path }) => path,
-});
-
-await registry.executeFromJSON('read_file', '{"path":"./README.md"}');
-```
-
-### Tool sandboxing (new)
-You can now enforce runtime constraints on tool execution via **ToolSandbox**:
-
-- **Timeout enforcement** (`maxExecutionTime`)
-- **Concurrency limits** (`maxConcurrentCalls`)
-- **Output size limits** (per-execution `maxOutputSize`)
-- **Cancellation support** (`cancel(executionId)`, `cancelAll()`)
-- Tools receive an extended `context.sandbox` object (execution id, limits, allowed operations set)
-
-New/updated APIs:
-- `ToolRegistry.withSandbox(sandbox)`
-- `ToolRegistry.getSandbox()`
-- `ToolSandbox.execute(tool, params, context, options?)`
-- `createSecureTool(tool, sandbox, guard)` helper to wrap individual tools
-
-## Behavior changes / improvements
-
-### Logging is now silent by default
-The logging system is now backed by `@fjell/logging`, and the library’s **default logger does not emit logs unless explicitly enabled**. This reduces the risk of sensitive data leaking via logs.
-
-To enable logging:
-- `AGENTIC_LOGGING=true`, or
-- `DEBUG=*agentic*`, or
-- `NODE_ENV=development`
-
-### Context deduplication hash strengthened
-`ContextManager` now uses **32 hex characters (128 bits)** of the SHA-256 digest (previously shorter). This reduces the likelihood of collisions when deduplicating context content.
-
-## Documentation
-- Added `SECURITY.md` describing tool execution security concepts and recommended operational practices.
-- Added a `<!-- v1.0.0 -->` marker comment to `README.md`.
-
-## Developer experience
-- `precommit` now runs `build` before lint and tests: `npm run build && npm run lint && npm run test`.
-- Build/test config files were reformatted (no functional behavior intended beyond configuration maintenance).
-
-## Dependencies
-- Added runtime dependency: `@fjell/logging`.
-
-## Breaking changes / upgrade notes
-- **Version bump to 1.0.0**: this is a major release.
-- **Default logging behavior change**: if you relied on logs being emitted by default, you must now explicitly enable logging (see “Logging is now silent by default”).
-- **Context hashing change**: if you persist or compare `ContextManager` content hashes externally, the hash values will differ going forward.
-
-## Full change categories
-- **Security**: ToolGuard + ToolSandbox, schema validation, safer JSON parsing, runtime limits.
-- **Core**: ToolRegistry security/sandbox integration and JSON execution helper.
-- **Operational**: safer default logging with `@fjell/logging`.
-- **Maintenance**: precommit now builds; docs and config updates.

package/output/kodrdriv/260126-0851-commit-message.md

@@ -1 +0,0 @@
-chore(gitignore): ignore output/ and kodrdriv-generated files

package/output/kodrdriv/260128-0900-commit-message.md

@@ -1 +0,0 @@
-No changes detected in the current working tree.

package/output/kodrdriv/260128-0900-release-notes.md

@@ -1,29 +0,0 @@
-# Version 1.0.1
-
-### Overview
-Version 1.0.1 contains important updates primarily focused on dependency management and configuration improvements. This release resolves issues, enhances existing functionality, and ensures compatibility with newer dependencies.
-
-### What's New
-- **Dependency Updates**: The `package.json` has been revised to include updated versions of essential libraries:
-  - The `@fjell/logging` package version has been updated to `^4.4.68`.
-  - The `zod` package version has been updated to `^4.3.5`.
-- **Development Tools**: Enhancements made in the `devDependencies` section provide tools for better testing, linting, and coverage reporting.
-- **Configuration of Build Scripts**: Refinements in build scripts ensure a smoother workflow during development.
-
-### Problem Solved
-This release addresses potential compatibility issues stemming from outdated dependencies. By upgrading these libraries, it enhances the overall stability and functionality of the software.
-
-### Impact on Users and Developers
-- **Users**: End-users should notice improved performance and reliability due to the updates in underlying libraries.
-- **Developers**: Developers will benefit from enhanced build and testing processes, streamlining development tasks including linting and testing.
-
-### Breaking Changes
-No breaking changes have been detected in this release. However, users are encouraged to review the updates in the dependency versions to ensure compatibility with their usage. 
-
-### File Changes Overview
-1. **Updated files**:
-   - **`package.json`**: 5 insertions and 3 deletions reflecting dependency updates, build script adjustments, and metadata changes.
-   - **`.gitignore`**: Minor updates to ensure untracked files remain free from unwanted commits.
-
-### Conclusion
-Version 1.0.1 is an essential step forward in maintaining the health of the project through dependency management. Users and developers should upgrade to ensure they benefit from the latest fixes and improvements.

package/output/kodrdriv/260128-0905-commit-message.md

@@ -1 +0,0 @@
-No changes to commit; the specified file does not exist in the current working tree or may have been deleted.

package/output/kodrdriv/260128-0913-commit-message.md

@@ -1 +0,0 @@
-No changes to commit; file not found or deleted.

package/output/kodrdriv/260128-0913-release-notes.md

@@ -1,23 +0,0 @@
-# Version 1.0.2
-
-### Overview
-Version 1.0.2 introduces important changes to the `package.json` file, primarily focused on resolving dependency conflicts. This release addresses a specific issue with the `ajv` library, ensuring compatibility and stability for users. 
-
-### Key Changes
-- **Dependency Resolution**: This update specifically resolves a dependency conflict involving the `ajv` library by adding an explicit override to ensure compatibility with peer dependencies.
-- **File Modifications**: The `package.json` file was modified, resulting in:
-  - **2 insertions**: New entries for dependency overrides.
-  - **6 deletions**: Cleanup of unnecessary or conflicting entries.
-
-### Impact on Users and Developers
-- **Users**: This release is critical for those utilizing the `ajv` library as part of their workflow. Ensuring dependency resolution will lead to a smoother integration and less likelihood of encountering runtime errors related to this library.
-- **Developers**: Developers need to be aware of the updates to the `package.json` file. It will enhance the development experience by reducing issues related to dependency management and ensuring that packages are up to date.
-
-### Breaking Changes
-- There are currently no identified breaking changes in this release. However, it is advisable to conduct a manual review of any features that interact with the updated dependencies to confirm compatibility.
-
-### Recommendations
-- Users should update to version 1.0.2 to benefit from these dependency resolutions.
-- Review changes in the `package.json` file to understand the new state of dependencies and ensure that your applications leverage the updates effectively.
-
-This release underscores a commitment to maintaining a stable product while responding to user needs for dependency management.

package/output/kodrdriv/260128-0919-commit-message.md

@@ -1 +0,0 @@
-fix: ensure all changes are logically grouped for improved clarity and maintainability.

package/output/kodrdriv/260128-0919-release-notes.md

@@ -1,21 +0,0 @@
-# Version 1.0.2
-
-### Overview
-This release (1.0.2) introduces several improvements to the npm publish workflow, aiming to enhance package publishing automation and address minor issues that affect the release process.
-
-### Key Changes
-- **NPM Publish Workflow Update**: The GitHub Actions workflow file `.github/workflows/npm-publish.yml` has been modified to streamline the npm publishing process. The changes include:
-  - Introduced a condition to determine the npm tag based on the package version. Packages with a pre-release version (containing a dash `-`) will be tagged as `dev`, while stable releases will use the `latest` tag.
-  - Added steps to ensure the latest npm version is installed and operational.
-
-### Problem Resolution
-This release addresses a dependency conflict during the npm publishing process. By explicitly managing package versions and utilizing a workflow, it minimizes the likelihood of manual errors and inconsistencies that could affect the packaging pipeline.
-
-### Impact on Users and Developers
-- The improved workflow simplifies the development process, particularly for those contributing to npm package management. Developers can expect a more reliable and consistent publishing experience, reducing the odds of publishing errors.
-- As no breaking changes have been introduced, existing functionality remains unchanged, ensuring a smooth transition to this version.
-
-### Breaking Changes
-No breaking changes have been detected in this release. Manual review of API changes is recommended, but no immediate disruption is expected for users or current integrations. 
-
-This version enhances the automation of the npm publish process and helps ensure that packages are published correctly with appropriate tags based on their versioning status.

package/output/kodrdriv/260130-1642-commit-message.md

@@ -1 +0,0 @@
-chore(package): bump version to 1.0.4

package/output/kodrdriv/260130-1642-release-notes.md

@@ -1,29 +0,0 @@
-# 1.0.4 — Silent-by-default logging and package metadata updates
-
-## Main changes
-
-### Logging: `DEFAULT_LOGGER` is now silent unless explicitly enabled
-The library’s default logger has been changed to **discard all output by default** to reduce the risk of accidentally logging sensitive data.
-
-Logging is now only enabled when one of the following is true:
-- `AGENTIC_LOGGING=true`
-- `DEBUG` includes `agentic` (for example: `DEBUG=*agentic*`)
-- `NODE_ENV=development`
-
-**Why this matters**
-- **Safer defaults** for production usage (less chance of leaking tool inputs/outputs, secrets, etc.).
-- Still supports structured/masked logging via the Fjell-backed logger when enabled.
-
-**Impact**
-- If you previously relied on logs appearing without configuration, you may now see no output until you set one of the environment variables above.
-- This affects components that use the default logger internally (for example: `ToolGuard`, `ToolSandbox`, `ToolRegistry`, and `ContextManager`), since they wrap `DEFAULT_LOGGER`.
-
-### Package metadata/dependency adjustments
-- Updated `package.json` metadata and dependency declarations.
-- Version is now `1.0.4`.
-
-### Security documentation updates
-- `SECURITY.md` was updated to better document supported versions, security features, and recommended configuration (including logging enablement).
-
-## Breaking changes
-No explicit API-breaking changes were detected in this range, but **the default logging behavior change** may be user-visible if your integration depended on default log output. To restore logs, set `AGENTIC_LOGGING=true` or configure `DEBUG`/`NODE_ENV` as described above.

package/output/kodrdriv/RELEASE_NOTES.md

@@ -1,27 +0,0 @@
-## Main changes
-
-### Logging: `DEFAULT_LOGGER` is now silent unless explicitly enabled
-The library’s default logger has been changed to **discard all output by default** to reduce the risk of accidentally logging sensitive data.
-
-Logging is now only enabled when one of the following is true:
-- `AGENTIC_LOGGING=true`
-- `DEBUG` includes `agentic` (for example: `DEBUG=*agentic*`)
-- `NODE_ENV=development`
-
-**Why this matters**
-- **Safer defaults** for production usage (less chance of leaking tool inputs/outputs, secrets, etc.).
-- Still supports structured/masked logging via the Fjell-backed logger when enabled.
-
-**Impact**
-- If you previously relied on logs appearing without configuration, you may now see no output until you set one of the environment variables above.
-- This affects components that use the default logger internally (for example: `ToolGuard`, `ToolSandbox`, `ToolRegistry`, and `ContextManager`), since they wrap `DEFAULT_LOGGER`.
-
-### Package metadata/dependency adjustments
-- Updated `package.json` metadata and dependency declarations.
-- Version is now `1.0.4`.
-
-### Security documentation updates
-- `SECURITY.md` was updated to better document supported versions, security features, and recommended configuration (including logging enablement).
-
-## Breaking changes
-No explicit API-breaking changes were detected in this range, but **the default logging behavior change** may be user-visible if your integration depended on default log output. To restore logs, set `AGENTIC_LOGGING=true` or configure `DEBUG`/`NODE_ENV` as described above.

package/output/kodrdriv/RELEASE_TITLE.md

@@ -1 +0,0 @@
-1.0.4 — Silent-by-default logging and package metadata updates