@modelprofile.com/flexharness 10.11.0 → 10.13.0

package/ts/errors.ts

@@ -118,6 +118,14 @@ export class FlexHarnessAbortError extends FlexHarnessError {
   }
 }
 
+/** The conversational run exhausted its model steps before producing a final answer. */
+export class FlexHarnessStepLimitError extends FlexHarnessError {
+  constructor(public readonly steps: number) {
+    super('FLEX_STEP_LIMIT', `The run exhausted its ${steps} model steps before completing its answer.`);
+    this.name = 'FlexHarnessStepLimitError';
+  }
+}
+
 export class FlexHarnessCallbackOverflowError extends FlexHarnessError {
   constructor(message: string) {
     super('FLEX_CALLBACK_OVERFLOW', message);

package/ts/index.ts

@@ -1,5 +1,6 @@
 export * from './classes.flexharness.js';
 export * from './classes.stores.js';
+export { FlexToolCatalog } from './classes.toolcatalog.js';
 export * from './errors.js';
 export * from './interfaces.js';
 export { normalizeJsonValue } from './utils.json.js';

package/ts/interfaces.ts

@@ -62,6 +62,34 @@ export interface IFlexUsage {
   cacheWriteTokens: number;
 }
 
+/** Durable fixed-size model-call accounting, independent of transcript visibility. */
+export interface IFlexSessionMetricsState {
+  reportedLifetimeUsedTokens: number;
+  reportedLifetimeUsedTokensExact: boolean;
+  lifetimeUsageComplete: boolean;
+  pendingGenerationId?: string;
+  pendingCompactionId?: string;
+  lastObservedInputTokens?: number;
+  lastObservedInputTokensAt?: string;
+}
+
+/** No member estimates current context size or includes child-session / tool-owned model calls. */
+export interface IFlexSessionMetrics {
+  /** Sum of durably settled per-call reports; a lower bound when incomplete. */
+  reportedLifetimeUsedTokens: number;
+  /** False if invalid reports or safe-integer overflow prevented an exact reported sum. */
+  reportedLifetimeUsedTokensExact: boolean;
+  lifetimeUsageComplete: boolean;
+  /** Present only when lifetimeUsageComplete is true. */
+  lifetimeUsedTokens?: number;
+  inFlight: boolean;
+  /** Input of the last durably settled generation call, not its compaction summary call. */
+  lastObservedInputTokens?: number;
+  lastObservedInputTokensAt?: string;
+  /** Always historical: output, steering, compaction and reversion can change context. */
+  lastObservedInputTokensFreshness?: 'historical';
+}
+
 export interface IFlexModelIdentity {
   provider: string;
   model: string;
@@ -620,15 +648,179 @@ export interface IFlexToolProviderContext<TScope> extends IFlexSessionGeneration
   requestPermission(request: IFlexPermissionRequestInput): Promise<void>;
 }
 
-export interface IFlexToolHandle {
+export interface IFlexToolHandle<TScope = unknown> {
   tools: TFlexAgentToolSet;
+  /**
+   * Methods the model finds with `search_tools`, reads with `describe_tools` and calls with
+   * `execute`, instead of seeing each one as a tool on every step. Return the same object on
+   * every run: FlexHarness prepares a catalog once per object and treats it as immutable.
+   */
+  catalog?: IFlexToolCatalog<TScope>;
   close?(): Promise<void> | void;
 }
 
 export interface IFlexToolProvider<TScope> {
   provideTools(
     context: IFlexToolProviderContext<TScope>,
-  ): Promise<IFlexToolHandle | undefined> | IFlexToolHandle | undefined;
+  ): Promise<IFlexToolHandle<TScope> | undefined> | IFlexToolHandle<TScope> | undefined;
+}
+
+/** The names of the built-in catalog tools, reserved while a run has a catalog. */
+export const FLEX_TOOL_CATALOG_TOOL_NAMES = Object.freeze({
+  search: 'search_tools',
+  describe: 'describe_tools',
+  execute: 'execute',
+} as const);
+
+export const FLEX_TOOL_CATALOG_LIMITS = Object.freeze({
+  maxMethods: 4096,
+  maxTypes: 4096,
+  maxMethodPathCharacters: 160,
+  maxMethodPathSegments: 8,
+  maxIdentifierCharacters: 128,
+  maxSummaryCharacters: 120,
+  maxDescriptionBytes: 16 * 1024,
+  maxDeclarationBytes: 16 * 1024,
+  maxTags: 16,
+  maxTagCharacters: 48,
+  maxExamples: 4,
+  maxExampleBytes: 1024,
+  maxSchemaBytes: 64 * 1024,
+  defaultSearchResults: 10,
+  maxSearchResults: 50,
+  maxQueryCharacters: 512,
+  maxDescribeMethods: 16,
+  maxDescribeTypes: 32,
+  maxDescribeBytes: 64 * 1024,
+  maxParamIssues: 10,
+});
+
+export interface IFlexCatalogSearchInput {
+  /** Words to rank methods by. */
+  query?: string;
+  /** A dotted namespace to search in or, without `query`, to list. */
+  namespace?: string;
+  limit?: number;
+  offset?: number;
+}
+
+export interface IFlexCatalogDescribeInput {
+  /** Dotted method paths. */
+  methods?: readonly string[];
+  /** Named types to declare again or for the first time. */
+  types?: readonly string[];
+}
+
+export interface IFlexCatalogDescribeResult {
+  /** TypeScript text, or a JSON object in `json-schema` mode. */
+  output: TJsonValue;
+  /** The named types the output declares. */
+  declaredTypes: string[];
+}
+
+/** One way `execute`'s params miss the method's schema. */
+export interface IFlexCatalogParamIssue {
+  /** Where, such as `params.lines[0].amount`. */
+  path: string;
+  expected: string;
+  /** The given value as compact JSON, or `missing`. */
+  got: string;
+}
+
+/** What `execute` reports to the model, as JSON, when it cannot call a method. */
+export type TFlexCatalogCallError =
+  | {
+      error: 'unknown_method';
+      method: string;
+      didYouMean: string[];
+      hint: string;
+    }
+  | {
+      error: 'invalid_params';
+      method: string;
+      issues: IFlexCatalogParamIssue[];
+      /** How many more issues were found than listed. */
+      more?: number;
+      /** The lookup that returns the method's declaration. */
+      see: string;
+    };
+
+export interface IFlexCatalogToolDefinition {
+  description: string;
+  /** The tool's input as JSON Schema. */
+  inputSchema: plugins.JSONSchema7;
+}
+
+/**
+ * A parameter or result schema: a plain JSON Schema object, or a zod, Standard Schema or AI SDK
+ * schema. `$ref`s to `#/$defs/<Name>` or `#/definitions/<Name>` that the schema does not define name
+ * a catalog type.
+ */
+export type TFlexCatalogSchema = { readonly [keyword: string]: unknown } | plugins.FlexibleSchema<unknown>;
+
+export interface IFlexCatalogRunContext<TScope = unknown> {
+  /** The dotted path the model called. */
+  readonly method: string;
+  /** The `execute` call's ID; pass it with permission requests. */
+  readonly toolCallId: string;
+  readonly abortSignal: AbortSignal;
+  /** The run's tool-provider context: scope, session, run and `requestPermission`. */
+  readonly provider: Readonly<IFlexToolProviderContext<TScope>>;
+}
+
+export interface IFlexCatalogMethod<TScope = unknown, TParams = any, TResult = unknown> {
+  /**
+   * The dotted path the model calls, such as `banking.listMovements`: up to 8 segments, each a
+   * JavaScript identifier of letters, digits and `_`.
+   */
+  method: string;
+  /** One line of at most 120 characters, shown in search results. */
+  summary: string;
+  /** The full description, shown with the declaration. */
+  description?: string;
+  /** More words `search_tools` matches. */
+  tags?: readonly string[];
+  /** Code shown as `@example` in the declaration. */
+  examples?: readonly string[];
+  /** The parameter object's schema; `execute` validates every call against it. */
+  inputSchema: TFlexCatalogSchema;
+  /** The result's schema, declared as the method's return type. */
+  outputSchema?: TFlexCatalogSchema;
+  /**
+   * Declaration text that replaces the generated one, such as a declaration built from TypeScript
+   * sources with their JSDoc: `function listMovements(params: …): Promise<…>;`, optionally after
+   * its JSDoc, with the last path segment as the function name.
+   */
+  declaration?: string;
+  /** Runs the method with validated parameters. */
+  run(
+    params: TParams,
+    context: IFlexCatalogRunContext<TScope>,
+  ): TResult | PromiseLike<TResult> | AsyncIterable<TResult>;
+}
+
+/** A named type that method declarations refer to; it needs a `declaration`, a `schema`, or both. */
+export interface IFlexCatalogType {
+  /** A JavaScript identifier such as `IMoney`. */
+  name: string;
+  description?: string;
+  /** Validates parameters that refer to this type, and generates its declaration. */
+  schema?: TFlexCatalogSchema;
+  /** Declaration text that replaces the generated one, such as `interface IMoney { … }`. */
+  declaration?: string;
+}
+
+export interface IFlexToolCatalog<TScope = unknown> {
+  methods: readonly IFlexCatalogMethod<TScope>[];
+  types?: readonly IFlexCatalogType[];
+}
+
+export interface IFlexToolCatalogOptions {
+  /**
+   * What `describe_tools` returns: `typescript` (default) declarations with named types shared
+   * across the session, or `json-schema` with each method's self-contained JSON Schema.
+   */
+  declarations?: 'typescript' | 'json-schema';
 }
 
 export interface IFlexResourceToolProviderResolverContext<TScope> extends IFlexSessionGeneration {
@@ -775,6 +967,8 @@ export interface IFlexProjectionSnapshotV2 {
 
 export interface IFlexProjectionSnapshotV3 {
   schemaVersion: 3;
+  /** Optional for existing schema-3 stores. Absence means lifetime usage is unknown. */
+  metrics?: IFlexSessionMetricsState;
   revision: number;
   messages: IFlexMessage[];
   stagedTerminals: IFlexTerminalProjection[];
@@ -1389,7 +1583,9 @@ export interface IFlexHarnessOptions<TScope> {
   externalErrorProjector?: TFlexExternalErrorProjector;
   subagents?: IFlexSubagentDefinition[];
   builtInTools?: IFlexBuiltInToolsOptions;
+  toolCatalog?: IFlexToolCatalogOptions;
   slashCommands?: readonly TFlexSlashCommandRegistration<TScope>[];
+  /** Maximum child depth (root is 0). Defaults to 6; configurable from 1 through 8. */
   maxSubagentDepth?: number;
   maxSubagentCallsPerRun?: number;
 }

package/ts/plugins.ts

@@ -6,6 +6,13 @@ import * as path from 'node:path';
 
 export { AsyncLocalStorage, crypto, fs, path };
 
+// third party scope
+import { asSchema, jsonSchema } from 'ai';
+import { Validator as JsonSchemaValidator } from '@cfworker/json-schema';
+
+export { asSchema, jsonSchema, JsonSchemaValidator };
+export type { FlexibleSchema, JSONSchema7, ModelMessage, Schema } from 'ai';
+
 // @push.rocks scope
 import {
   AgentEventStoreConflictError,
@@ -44,6 +51,7 @@ export {
 };
 export type {
   IAgentAppliedInput,
+  ISmartAiCacheDispatch,
   IAgentEventArchiveV2,
   IAgentContextCompactionOptions,
   IAgentEventSnapshotV2,
@@ -77,7 +85,7 @@ export type {
   TAgentToolExecutionReconciliationOptions,
 } from '@modelprofile.com/flexharness-agent';
 
-import { isModelLimitError, isModelLimitInfo } from '@modelprofile.com/flexharness-models';
+import { getSmartAiCacheWaitMs, isModelLimitError, isModelLimitInfo } from '@modelprofile.com/flexharness-models';
 
-export { isModelLimitError, isModelLimitInfo };
+export { getSmartAiCacheWaitMs, isModelLimitError, isModelLimitInfo };
 export type { IModelLimitInfo } from '@modelprofile.com/flexharness-models';

package/ts/readme.md

@@ -62,7 +62,7 @@ or provider SDKs.
 | `/chat` | Portable streaming `ChatSession`, history and usage | None |
 | `/chat/cli` | Ink/React terminal chat | `ink ink-text-input react`; TypeScript: `@types/react` |
 | `/chat/web` | Lit `flexchat-window`, `flexchat-message`, `flexchat-input` | `lit` |
-| `/chat/harness` | `FlexHarnessTranscript` and intents for the `@design.estate/dees-catalog` harness components, browser-safe | `@design.estate/dees-catalog` `^17.0.0 \|\| ^19.5.0 \|\| ^20.0.0` (types only) |
+| `/chat/harness` | `FlexHarnessTranscript` and intents for the `@design.estate/dees-catalog` harness components, browser-safe | `@design.estate/dees-catalog` `^17.0.0 \|\| ^19.5.0 \|\| ^20.0.0 \|\| ^21.0.0` (types only) |
 | `/kvm` | Browser control, terminal framing and OCR observation | `puppeteer` |
 | `/documents` | PDF and image documents, `extractTextFromPdf` | `@push.rocks/smartpdf`; for image documents `sharp` |
 | `/mcp` | MCP clients and AI SDK tool conversion | `@modelcontextprotocol/sdk` |
@@ -92,6 +92,41 @@ a model backed by its own server transport, or supply `run` in
 `IChatSessionOptions`. The web element accepts an `IChatSession` and maintains its
 own subscription. Full Node `AgentSession` remains at the agent package root.
 
+## Durable session token metrics
+
+Read `await harness.getSessionMetrics(scopeId, sessionId)` for bounded, durable
+accounting independent of transcript visibility. It reads fixed-size projection
+state rather than summing assistant messages or scanning event/archive/child history.
+A warm read joins outstanding projection writes and surfaces accounting failures.
+
+| Field | Meaning |
+| --- | --- |
+| `reportedLifetimeUsedTokens` | Sum of durably settled per-call reports. Incomplete accounting makes this a lower bound. |
+| `reportedLifetimeUsedTokensExact` | Whether the sum of those reports is exact; invalid reports and safe-integer overflow make it inexact. |
+| `lifetimeUsageComplete` | Every owned call is accounted for and no accounting operation remains in flight. |
+| `lifetimeUsedTokens` | Present only when the lifetime total is complete. Zero is a valid total. |
+| `inFlight` | A generation or actual compactor invocation has not settled its accounting yet. |
+| `lastObservedInputTokens`, `lastObservedInputTokensAt` | Input count and observation time of the last settled generation call with complete input/output totals. |
+| `lastObservedInputTokensFreshness` | Always `historical`. This is **not** current context size: output, steering, compaction and reversion can change context. |
+
+Accounting covers this session's generation calls and reported compaction calls,
+including failure, cancellation and retries. Child sessions own their own spend;
+tool-owned model calls are not included. Do not sum cumulative assistant-message
+usage to reconstruct lifetime spend. Missing/partial reports remain incomplete;
+unsafe totals saturate at `Number.MAX_SAFE_INTEGER` without claiming exactness.
+A compactor that reports no calls cannot prove zero spend.
+
+New sessions start complete at zero. Existing/imported sessions with unknown prior
+spend start incomplete. Write-ahead operation markers make interrupted recovery
+conservative: unresolved operations are cleared without certifying their unknown
+spend. Undo, redo, compaction and transcript archiving never subtract lifetime
+spend. Importing visible history does not reconstruct historical billing.
+
+Conversational runs that exhaust `maxSteps` with tool work or unseen input remaining
+fail with `FlexHarnessStepLimitError` (`FLEX_STEP_LIMIT`), rather than being marked
+completed with an empty answer. Standalone Agent callers retain tool-only results
+and can inspect `terminationReason: 'model' | 'step-limit'`.
+
 ## Provider subpaths
 
 Install `@modelprofile.com/flexharness-providers` once. Its root exports all provider
@@ -260,7 +295,7 @@ const harness = new FlexHarness<IProjectScope>({
       maxSteps: 8,
     },
   ],
-  maxSubagentDepth: 1,
+  maxSubagentDepth: 6,
   maxSubagentCallsPerRun: 32,
   externalErrorProjector: (_error, context) => ({
     name: 'ModelOperationError',
@@ -414,12 +449,10 @@ Normal Flex session cleanup always waits in-flight local project operations, the
 
 ## Subagents
 
-`subagents` enables the harness-owned `delegate` and `delegate_result` tools when at least one definition exists and the session depth is below `maxSubagentDepth`. A tool provider cannot replace either enabled built-in. Delegation is asynchronous by default: `delegate` returns `{ taskId, status: 'running', runId }` after durable child admission, so the parent can continue independent work. `delegate_result({ taskId, waitMs? })` reads live status and, once settled, bounded final text and model identity; its optional wait is limited to 240 seconds and observes parent cancellation. Set `foreground: true` to await the final answer in `delegate` itself. Children remain owned by the parent turn: Stop cancels its exact child runs, and the parent joins them before releasing authority and finalizing. A child result enters the parent's next model context as untrusted task data. When the parent's model ends its turn while background children still run, the turn waits for the next child to settle and takes its result in with another step (while steps remain), so a delegated result is never lost because the parent finished first.
+`subagents` enables the harness-owned `delegate`, `delegate_result`, and `delegate_send` tools when at least one definition exists and the session depth is below `maxSubagentDepth`. A tool provider cannot replace any enabled built-in; global and agent tool allowlists still intersect to control model-facing exposure. Delegation is asynchronous by default: `delegate` returns `{ taskId, status: 'running', runId }` after durable child admission, so the parent can continue independent work. `delegate_result({ taskId, waitMs? })` reads live status and, once settled, bounded final text and model identity; its optional wait is limited to 240 seconds and observes parent cancellation. Set `foreground: true` to await the final answer in `delegate` itself. Children remain owned by the parent turn: Stop cancels its exact child runs, and the parent joins them before releasing authority and finalizing. A child result enters the parent's next model context as untrusted task data. When the parent's model ends its turn while background children still run, the turn waits for the next child to settle and takes its result in with another step (while steps remain), so a delegated result is never lost because the parent finished first.
 
 The model calls it with this exact input shape:
 
-When upgrading from 9.x, callers that require the previous synchronous delegate result must pass `foreground: true`. Tool providers must also leave the newly reserved `delegate_result` name available when subagents are enabled.
-
 ```typescript
 interface IDelegateInput {
   description: string;
@@ -430,9 +463,24 @@ interface IDelegateInput {
 }
 ```
 
+When upgrading from 9.x, callers that require the previous synchronous delegate result must pass `foreground: true`. Tool providers must also leave the reserved `delegate_result` and `delegate_send` names available when subagents are enabled.
+
+`delegate_send({ taskId, prompt })` sends follow-up instructions to a running direct child owned by this exact parent turn. Both fields are required and extra fields are rejected; `taskId` is non-empty and at most 512 UTF-8 bytes, and `prompt` is non-empty and at most 64 KiB. It returns `{ steerId, queueId, runId }` on admission, with a stable steer identity derived from the parent run and tool call. The child takes the input at its next inference boundary, without interrupting a running tool or permission wait. A child waiting to finish while its own descendants run can take the follow-up and continue inference; those descendants keep running. Use `delegate_result` to inspect progress and collect the final answer.
+
+Controllers can use the same admission path explicitly:
+
+```typescript
+await harness.sendSubagentInput(scopeId, parentSessionId, parentRunId, taskId, {
+  steerId: 'follow-up-1',
+  prompt: 'Prefer primary sources and include the publication date.',
+});
+```
+
+Sending requires the exact active parent run, its currently delegated direct child, matching captured configuration and parent/child generations, and live writable ancestors. It does not authorize a root to skip levels, or infer ownership from immutable creation-origin metadata: a resumed child belongs to the current delegate invocation. Foreign, unowned, stale, cancelled, settled, or ending runs reject; sending never starts an idle generation, restarts a child, or resumes one. General public `steerPrompt()` still forbids child sessions. Child sends share root steering's duplicate rejection, pending count/byte bounds, accepted/applied events, durable user-message application, and terminal unapplied-input accounting.
+
 Before creating or resuming a child, FlexHarness requests permission on the parent run with `kind: 'subagent.start'`, the parent `toolCallId`, and separately bounded harness-owned agent/task metadata. Its metadata includes `childSessionId`, the exact ID reserved for this call: FlexHarness derives it deterministically when `taskId` is omitted and copies the supplied candidate when `taskId` is present. A resume also retains that candidate as `taskId`. This block is not truncated by `toolOutputLimits`. The reserved ID binds permission handling before child creation but does not prove that the child exists or is owned: applications must treat the later delegated admission context as authoritative. The controller answers through the normal permission APIs. This request has no `rememberKey`, so `always` is invalid; controllers use `once` or `reject`.
 
-Each new invocation creates a durable child `IFlexSession` with immutable `parentSessionId`, origin `parentRunId`, origin `parentToolCallId`, `agent`, and `depth`. New public roots persist `depth: 0`; legacy schema-1 roots may omit it. These fields are harness-owned; public `createSession()` remains limited to `sessionId`, `sessionGenerationId`, and `title`. Child sessions reject direct `prompt()`, `startPrompt()`, `enqueuePrompt()`, and `schedulePrompt()` calls and run only through the `delegate` tool. The model and tool resolver contexts receive optional immutable `parentSessionId` and `agent` values so integrations can apply agent-specific model and tool policy. Child prompts use the definition's `modelHint`, `system`, and `maxSteps`.
+Each new invocation creates a durable child `IFlexSession` with immutable `parentSessionId`, origin `parentRunId`, origin `parentToolCallId`, `agent`, and `depth`. New public roots persist `depth: 0`; legacy schema-1 roots may omit it. These fields are harness-owned; public `createSession()` accepts `sessionId`, `sessionGenerationId`, `configurationRef`, and `title`. A child inherits its parent's `configurationRef` and cannot resume under a different reference. Child sessions reject direct `prompt()`, `startPrompt()`, `enqueuePrompt()`, and `schedulePrompt()` calls and run only through the `delegate` tool. The model and tool resolver contexts receive optional immutable `parentSessionId` and `agent` values so integrations can apply agent-specific model and tool policy. Child prompts use the definition's `modelHint`, `system`, and `maxSteps`.
 
 The parent tool part receives `childSessionId` as soon as the child is acquired, so a host can offer an authorized live transcript. A foreground call also adds the resolved child model to its part and returns bounded JSON:
 
@@ -485,7 +533,7 @@ Acquisition completes before generation-side branch reversion, context compactio
 
 For a normally acquired lease, FlexHarness gives `close()` an awaited attempt after AgentSession generation and before canonical accepted, rejected, or interrupted finalization and the terminal `prompt.finished` event. If an abort detaches an acquisition that ignores its signal, the run may settle before acquisition returns; FlexHarness retains that owner and closes any late lease. `close()` must be idempotent and safe to retry after rejection. A close failure prevents successful child acceptance and remains owned by the exact child session generation for retry by later exact-session deletion, scope retirement, or disposal. Retirement and disposal truthfully wait for late acquisition and lease cleanup.
 
-Limits are validated and frozen at construction: at most 32 unique definitions; names are non-empty and at most 128 UTF-8 bytes; descriptions 2048 bytes; optional model hints 512 bytes; optional system prompts 64 KiB; and optional `maxSteps` a positive safe integer. `maxSubagentDepth` defaults to 1 and must be a positive safe integer at most 8. `maxSubagentCallsPerRun` defaults to 32 and must be a positive safe integer at most 128. A call slot is consumed synchronously at the start of every schema-valid delegate execution, before semantic bounds, subagent type/depth validation, permission, or child work. Inputs rejected by the tool schema never start delegate execution and do not consume a slot. After successful semantic validation, the child ID candidate is reserved for the rest of the parent run, including after permission rejection or later failure. Permission rejection creates no child session. Omitting `taskId` reserves a deterministic new child ID; supplying `taskId` reserves that unverified candidate and attempts resume after permission only if it identifies a resumable child. Delegate descriptions are non-empty and at most 256 UTF-8 bytes, prompts non-empty and at most 64 KiB, subagent types at most 128 bytes, and task IDs at most 512 bytes.
+Limits are validated and frozen at construction: at most 32 unique definitions; names are non-empty and at most 128 UTF-8 bytes; descriptions 2048 bytes; optional model hints 512 bytes; optional system prompts 64 KiB; and optional `maxSteps` a positive safe integer. `maxSubagentDepth` defaults to 6 and must be a positive safe integer at most 8. The root is depth 0, so the default permits six child levels (depths 1 through 6); delegation tools are absent at the configured maximum. `maxSubagentCallsPerRun` defaults to 32 and must be a positive safe integer at most 128. A call slot is consumed synchronously at the start of every schema-valid delegate execution, before semantic bounds, subagent type/depth validation, permission, or child work. Inputs rejected by the tool schema never start delegate execution and do not consume a slot. After successful semantic validation, the child ID candidate is reserved for the rest of the parent run, including after permission rejection or later failure. Permission rejection creates no child session. Omitting `taskId` reserves a deterministic new child ID; supplying `taskId` reserves that unverified candidate and attempts resume after permission only if it identifies a resumable child. Delegate descriptions are non-empty and at most 256 UTF-8 bytes, prompts non-empty and at most 64 KiB, subagent types at most 128 bytes, and task IDs at most 512 bytes.
 
 Scope snapshots remain schema 1 and legacy child tombstones without `subagent` provenance continue to load. New child tombstones write the atomic provenance block and reject partial, parent-generation-mismatched, depth-mismatched, or duplicate-origin records. FlexHarness versions before this provenance addition reject that new optional key under their strict reader, so downgrading or mixing old readers with newly written scope snapshots is unsupported.
 
@@ -645,7 +693,7 @@ console.log(result.unappliedSteerIds); // [] once the run took the steer in
 
 The run takes a steer in at its next step boundary: after the tool results of its current model step are recorded and before its next model call. A running tool call or a pending permission is never interrupted; the steer waits for the boundary that follows it. A steer taken in is a user message of the run (`steerId` set) that the model sees in its next call and every later turn. If the run had already answered, the assistant message that answered is completed and the run answers on in a new assistant message after the steer; a steer taken in before the run answered anything is placed before its still empty assistant message. `IFlexPromptResult.userMessage` stays the prompt and `assistantMessage` is the run's last assistant message. Undo and redo treat the run's messages as one turn.
 
-`steerPrompt()` resolves with `{ steerId, queueId, runId }` once the run accepted the steer and `prompt.steer.accepted` was emitted; `prompt.steer.applied` carries the `messageId` of the user message the steer became. Every accepted steer ends in exactly one of two ways: it is in the model context of later turns, or it is listed in `unappliedSteerIds`, in arrival order, on `IFlexPromptResult` and `run.finished`, and on the finished queue entry when that list is not empty. A steer is listed when the run did not take it in before it ended, because its last model step was already running or because it was stopped or failed, and also when the run itself does not stay in context. `keptInContext` on `run.finished` and on the finished queue entry says whether it does: it is `false` for a failed run and for a run stopped before any model output, and such a run lists every steer it accepted, including the ones it took in and reported with `prompt.steer.applied`. Send its prompt and its unapplied steers again to have them answered. The run stops taking steers atomically when its generation ends or `abort()`/`cancelPrompt()` stops it. A steer for a prompt without a running run, or whose run is ending, is refused with `FlexHarnessSteerRejectedError` reason `not-running`; the caller sends it as the next turn instead. Reusing a `steerId` within a run is refused with reason `duplicate`, an unknown `queueId` throws `FlexHarnessNotFoundError`, and subagent sessions are not steerable. A run holds at most `maxOutstandingPromptsPerSession` pending steers, and their bytes count against the session's outstanding prompt byte limit until the run takes them in or ends, so `startPrompt()` and `enqueuePrompt()` are refused with `FlexHarnessQueueFullError` while pending steers fill it. They are process-local like queue entries: a process restart ends the run and drops its pending steers, while steers it took in are durable parts of the turn.
+`steerPrompt()` resolves with `{ steerId, queueId, runId }` once the run accepted the steer and `prompt.steer.accepted` was emitted; `prompt.steer.applied` carries the `messageId` of the user message the steer became. Every accepted steer ends in exactly one of two ways: it is in the model context of later turns, or it is listed in `unappliedSteerIds`, in arrival order, on `IFlexPromptResult` and `run.finished`, and on the finished queue entry when that list is not empty. A steer is listed when the run did not take it in before it ended, because its last model step was already running or because it was stopped or failed, and also when the run itself does not stay in context. `keptInContext` on `run.finished` and on the finished queue entry says whether it does: it is `false` for a failed run and for a run stopped before any model output, and such a run lists every steer it accepted, including the ones it took in and reported with `prompt.steer.applied`. Send its prompt and its unapplied steers again to have them answered. The run stops taking steers atomically when its generation ends or `abort()`/`cancelPrompt()` stops it. A steer for a prompt without a running run, or whose run is ending, is refused with `FlexHarnessSteerRejectedError` reason `not-running`; the caller sends it as the next turn instead. Reusing a `steerId` within a run is refused with reason `duplicate`, an unknown `queueId` throws `FlexHarnessNotFoundError`, and child sessions reject this general API (their exact parent run uses `sendSubagentInput()` or `delegate_send` instead). A run holds at most `maxOutstandingPromptsPerSession` pending steers, and their bytes count against the session's outstanding prompt byte limit until the run takes them in or ends, so `startPrompt()` and `enqueuePrompt()` are refused with `FlexHarnessQueueFullError` while pending steers fill it. They are process-local like queue entries: a process restart ends the run and drops its pending steers, while steers it took in are durable parts of the turn.
 
 ## Slash Commands
 
@@ -1089,6 +1137,8 @@ Each domain serializes its own mutations. A successful run first persists a hidd
 
 Projection stores accept schema version 1, 2, or 3 from `load()`, but every `save()` receives the current schema-3 shape. Schema 3 records explicit reversion protocol, transcript/workspace provenance, and V2 disposition. A terminal V2 segment must be conclusively `revertible`, `no-change`, or `nonrevertible`; a pending V2 capture remains owned by its capture WAL and is never treated as transcript history.
 
+Current schema-3 projections also persist optional `metrics` state. Older strict readers that do not recognize this key cannot reopen a projection after metrics have been written; downgrade or mixed-version access to that session is unsupported.
+
 A loaded schema-1 projection has no reversion state. Schema-2 `workspaceCaptured` segments migrate as protocol-1 workspace/revertible history without discarding references; transcript-only segments migrate as protocol-1 transcript provenance. Under `workspace-required`, that legacy transcript history is a barrier. The next projection mutation writes schema 3. Custom stores must preserve strict compare-and-swap revisions across schema-1 and schema-2 read-upgrade-write cycles, including uncertain-save reconciliation.
 
 ## Migrating From 2.x

package/ts/utils.harnessoptions.ts

@@ -13,6 +13,7 @@ import type {
   IFlexSlashCommandHandlerRegistration,
   IFlexSlashCommandTemplateRegistration,
   IFlexSubagentDefinition,
+  IFlexToolCatalogOptions,
   TFlexSlashCommandRegistration,
 } from './interfaces.js';
 import {
@@ -156,6 +157,27 @@ export function normalizeSubagents(
   return Object.freeze(normalized);
 }
 
+export function normalizeToolCatalogOptions(
+  options: IFlexHarnessOptions<unknown>['toolCatalog'],
+): Readonly<Required<IFlexToolCatalogOptions>> {
+  if (options === undefined) return Object.freeze({ declarations: 'typescript' });
+  if (
+    !options
+    || typeof options !== 'object'
+    || Array.isArray(options)
+    || ![Object.prototype, null].includes(Object.getPrototypeOf(options))
+  ) {
+    throw new FlexHarnessValidationError('toolCatalog must be a plain object.');
+  }
+  const unsupported = Object.keys(options).find((key) => key !== 'declarations');
+  if (unsupported) throw new FlexHarnessValidationError(`toolCatalog does not support "${unsupported}".`);
+  const declarations = options.declarations ?? 'typescript';
+  if (declarations !== 'typescript' && declarations !== 'json-schema') {
+    throw new FlexHarnessValidationError('toolCatalog.declarations must be "typescript" or "json-schema".');
+  }
+  return Object.freeze({ declarations });
+}
+
 export function normalizeBuiltInTools(
   options: IFlexHarnessOptions<unknown>['builtInTools'],
 ): INormalizedBuiltInTools {

package/ts/utils.json.ts

@@ -1506,6 +1506,35 @@ function validateAffectedWorkspaces(value: unknown, path: string): void {
   }
 }
 
+function assertSessionMetrics(value: unknown): void {
+  const path = '$snapshot.metrics';
+  const metrics = requireRecord(value, path);
+  requireOnlyKeys(metrics, [
+    'reportedLifetimeUsedTokens', 'reportedLifetimeUsedTokensExact', 'lifetimeUsageComplete',
+    'pendingGenerationId', 'pendingCompactionId', 'lastObservedInputTokens', 'lastObservedInputTokensAt',
+  ], path);
+  requireNonNegativeInteger(metrics.reportedLifetimeUsedTokens, `${path}.reportedLifetimeUsedTokens`);
+  for (const key of ['reportedLifetimeUsedTokensExact', 'lifetimeUsageComplete']) {
+    if (typeof metrics[key] !== 'boolean') throw new FlexHarnessStoreFormatError(`${path}.${key} must be boolean.`);
+  }
+  if (!metrics.reportedLifetimeUsedTokensExact && metrics.lifetimeUsageComplete) {
+    throw new FlexHarnessStoreFormatError(`${path} cannot certify an inexact total.`);
+  }
+  for (const key of ['pendingGenerationId', 'pendingCompactionId']) {
+    if (Object.hasOwn(metrics, key)) requireBoundedString(metrics[key], `${path}.${key}`, 512);
+  }
+  const hasInput = Object.hasOwn(metrics, 'lastObservedInputTokens');
+  const hasTime = Object.hasOwn(metrics, 'lastObservedInputTokensAt');
+  if (hasInput !== hasTime) throw new FlexHarnessStoreFormatError(`${path} has a partial input observation.`);
+  if (hasInput) {
+    requireNonNegativeInteger(metrics.lastObservedInputTokens, `${path}.lastObservedInputTokens`);
+    const timestamp = requireString(metrics.lastObservedInputTokensAt, `${path}.lastObservedInputTokensAt`);
+    if (!Number.isFinite(Date.parse(timestamp)) || new Date(timestamp).toISOString() !== timestamp) {
+      throw new FlexHarnessStoreFormatError(`${path}.lastObservedInputTokensAt must be an ISO timestamp.`);
+    }
+  }
+}
+
 export function assertFlexProjectionSnapshotV3(
   value: unknown,
 ): asserts value is IFlexProjectionSnapshotV3 {
@@ -1514,6 +1543,7 @@ export function assertFlexProjectionSnapshotV3(
   requireOnlyKeys(snapshot, [
     'schemaVersion',
     'revision',
+    'metrics',
     'messages',
     'stagedTerminals',
     'reversionSegments',
@@ -1522,6 +1552,7 @@ export function assertFlexProjectionSnapshotV3(
     'pendingReversion',
     'pendingReversionReleases',
   ], '$snapshot');
+  if (Object.hasOwn(snapshot, 'metrics')) assertSessionMetrics(snapshot.metrics);
   if (snapshot.schemaVersion !== 3) {
     throw new FlexHarnessStoreFormatError('Projection snapshot schemaVersion must be 3.');
   }
@@ -1673,8 +1704,9 @@ export function assertFlexProjectionSnapshotV3(
     }
     releaseCaptureIds.add(captureId);
   }
+  const { metrics: _metrics, ...compatibleSnapshot } = snapshot;
   const compatibleV2 = {
-    ...snapshot,
+    ...compatibleSnapshot,
     schemaVersion: 2,
     reversionSegments: snapshot.reversionSegments.map((entry) => {
       const segment = entry as Record<string, unknown>;