@mono-agent/agent-runtime 0.15.0 → 0.15.2

package/src/ai/pi-interop.js

@@ -0,0 +1,156 @@
+// Runtime-owned interoperability facade for Pi's built-in model and OAuth
+// surfaces. Consumers should use these functions instead of importing pi-ai
+// directly so the runtime's known-good Pi version remains authoritative.
+
+import { getBuiltinModel, getBuiltinModels } from "@earendil-works/pi-ai/providers/all";
+import { getOAuthApiKey, getOAuthProvider } from "@earendil-works/pi-ai/oauth";
+import { reasoningLevelsForPiModel as resolveReasoningLevels } from "./providers/pi-models.js";
+
+/**
+ * @typedef {{
+ *   id: string,
+ *   name: string,
+ *   api: string,
+ *   provider: string,
+ *   baseUrl: string,
+ *   reasoning: boolean,
+ *   input: Array<"text"|"image">,
+ *   cost: {
+ *     input: number,
+ *     output: number,
+ *     cacheRead: number,
+ *     cacheWrite: number,
+ *     tiers?: Array<{
+ *       inputTokensAbove: number,
+ *       input: number,
+ *       output: number,
+ *       cacheRead: number,
+ *       cacheWrite: number
+ *     }>
+ *   },
+ *   contextWindow: number,
+ *   maxTokens: number,
+ *   thinkingLevelMap?: Object<string, string|null>,
+ *   compat?: Object<string, *>,
+ *   headers?: Object<string, string>,
+ *   [key: string]: *
+ * }} PiBuiltinModelSnapshot
+ */
+
+/**
+ * @typedef {"none"|"minimal"|"low"|"medium"|"high"|"xhigh"|"max"} PiReasoningLevel
+ */
+
+/**
+ * @typedef {{
+ *   refresh: string,
+ *   access: string,
+ *   expires: number,
+ *   [key: string]: *
+ * }} PiOAuthCredentialsSnapshot
+ */
+
+/**
+ * @typedef {Object} PiOAuthLoginCallbacks
+ * @property {(info: {url: string, instructions?: string}) => void} onAuth
+ * @property {(info: {userCode: string, verificationUri: string, intervalSeconds?: number, expiresInSeconds?: number}) => void} onDeviceCode
+ * @property {(prompt: {message: string, placeholder?: string, allowEmpty?: boolean}) => Promise<string>} onPrompt
+ * @property {(message: string) => void} [onProgress]
+ * @property {() => Promise<string>} [onManualCodeInput]
+ * @property {(prompt: {message: string, options: Array<{id: string, label: string}>}) => Promise<string|undefined>} onSelect
+ * @property {AbortSignal} [signal]
+ */
+
+/**
+ * Clone provider-owned data before it crosses the public runtime boundary.
+ * Pi's built-in models and OAuth credentials are structured data on the
+ * supported version, and the package requires a Node release with
+ * `structuredClone`.
+ *
+ * @template T
+ * @param {T} value
+ * @returns {T}
+ */
+function cloneInteropValue(value) {
+  return structuredClone(value);
+}
+
+/**
+ * List defensive snapshots of Pi's built-in models for one provider.
+ *
+ * @param {string} providerId
+ * @returns {PiBuiltinModelSnapshot[]}
+ */
+export function listPiBuiltinModels(providerId) {
+  const models = getBuiltinModels(/** @type {any} */ (providerId));
+  return /** @type {PiBuiltinModelSnapshot[]} */ (cloneInteropValue(models));
+}
+
+/**
+ * Read a defensive snapshot of one Pi built-in model.
+ *
+ * @param {string} providerId
+ * @param {string} modelId
+ * @returns {PiBuiltinModelSnapshot|undefined}
+ */
+export function getPiBuiltinModel(providerId, modelId) {
+  const model = getBuiltinModel(
+    /** @type {any} */ (providerId),
+    /** @type {any} */ (modelId),
+  );
+  return model === undefined
+    ? undefined
+    : /** @type {PiBuiltinModelSnapshot} */ (cloneInteropValue(model));
+}
+
+/**
+ * Translate Pi's model-native thinking levels to mono-agent effort spelling.
+ *
+ * @param {PiBuiltinModelSnapshot} model
+ * @returns {PiReasoningLevel[]}
+ */
+export function reasoningLevelsForPiModel(model) {
+  return /** @type {PiReasoningLevel[]} */ (resolveReasoningLevels(model));
+}
+
+/**
+ * Resolve an OAuth-backed API key without allowing Pi to mutate the caller's
+ * credential record or returning Pi-owned credential objects.
+ *
+ * @param {string} providerId
+ * @param {Object<string, PiOAuthCredentialsSnapshot>} credentials
+ * @returns {Promise<{apiKey: string, newCredentials: PiOAuthCredentialsSnapshot}|null>}
+ */
+export async function resolvePiOAuthApiKey(providerId, credentials) {
+  const result = await getOAuthApiKey(
+    providerId,
+    /** @type {any} */ (cloneInteropValue(credentials)),
+  );
+  if (!result) return null;
+  return {
+    apiKey: result.apiKey,
+    newCredentials: cloneInteropValue(result.newCredentials),
+  };
+}
+
+/**
+ * Run a supported Pi OAuth login flow without exposing Pi's mutable provider
+ * registry or provider instances.
+ *
+ * @param {string} providerId
+ * @param {PiOAuthLoginCallbacks} callbacks
+ * @returns {Promise<PiOAuthCredentialsSnapshot>}
+ */
+export async function loginPiOAuth(providerId, callbacks) {
+  const provider = getOAuthProvider(providerId);
+  if (!provider || typeof provider.login !== "function") {
+    throw new Error(`Pi OAuth provider is unavailable: ${providerId}`);
+  }
+  for (const callbackName of ["onAuth", "onDeviceCode", "onPrompt", "onSelect"]) {
+    if (typeof callbacks?.[callbackName] !== "function") {
+      throw new TypeError(`loginPiOAuth requires callbacks.${callbackName}()`);
+    }
+  }
+  const credentials = await provider.login(/** @type {any} */ ({ ...callbacks }));
+  return cloneInteropValue(credentials);
+}

package/src/ai/providers/claude-cli.js

@@ -11,6 +11,10 @@ import { createStderrTail } from "../failure.js";
 import { modelWithContextWindow } from "../runtime/context-windows.js";
 import { readRuntimeBrand } from "../../agent/tools/shared/runtime-context.js";
 import { buildCapabilitiesUsed } from "../runtime/capabilities-used.js";
+import {
+  isAllowAllToolPolicy,
+  TOOL_POLICY_PROJECTED,
+} from "../runtime/tool-policy.js";
 import {
   claudeNativeAgentDefinitions,
   resolveClaudeAllowedTools,
@@ -28,13 +32,9 @@ const CLAUDE_CLI_EMPTY_TOOL_POLICY_UNSUPPORTED =
   "Claude Code CLI cannot enforce an explicit empty allowedTools list: omitting --tools would restore Claude Code's default toolset. Use a specific non-empty allowlist, a denylist, or the Claude SDK for a no-tools run.";
 
 function codexCliToolPolicyProblem(options) {
-  const allowedTools = Array.isArray(options.allowedTools) ? options.allowedTools : null;
-  const disallowedTools = Array.isArray(options.disallowedTools) ? options.disallowedTools : [];
-  const exactAllowAll = allowedTools === null
-    || (allowedTools.length === 1 && allowedTools[0] === "*");
-  return exactAllowAll && disallowedTools.length === 0
+  return isAllowAllToolPolicy(options.allowedTools, options.disallowedTools)
     ? null
-    : "Direct Codex CLI cannot enforce allowedTools/disallowedTools. Use exact allow-all ([\"*\"] with no disallowedTools) or another runtime.";
+    : "Direct Codex CLI cannot enforce allowedTools/disallowedTools. Use allow-all-only (omit allowedTools or include \"*\", with no disallowedTools) or another runtime.";
 }
 
 function codexCliCapabilityMismatchResult(options, error, codexErrorCode, start) {
@@ -86,6 +86,7 @@ const DORMANT_CLI_CAPABILITIES = {
   // The one-shot CLI bridge cannot add stdin messages after process launch.
   supports_live_input: false,
   supports_native_subagents: true,
+  tool_policy: TOOL_POLICY_PROJECTED,
 };
 
 function promptFromMessages(messages) {
@@ -465,7 +466,7 @@ export function buildCliCommand({
       args.push("--tools", cliAllowedTools.join(","));
     }
     const autoAllowed = [
-      ...(Array.isArray(cliAllowedTools) ? cliAllowedTools : []),
+      ...(!cliAllowAll && Array.isArray(cliAllowedTools) ? cliAllowedTools : []),
       ...Object.keys(mcpServers || {}).map((name) => `mcp__${name}__*`),
     ];
     if (autoAllowed.length) args.push("--allowedTools", shellList(autoAllowed));

package/src/ai/providers/claude-sdk.js

@@ -748,6 +748,7 @@ export async function generateClaudeResponse(systemPrompt, options) {
   const prompt = options.liveInput
     ? livePromptMessages({ initialPrompt: promptString, liveInput: options.liveInput, sessionId: reusableProviderSessionId || randomUUID(), prompts: options.prompts })
     : promptString;
+  const claudeAgentQuery = options.claudeAgentQuery ?? query;
   const providerRequestStartedAt = Date.now();
   emitEvent({
     type: "provider_request_started",
@@ -805,7 +806,7 @@ export async function generateClaudeResponse(systemPrompt, options) {
   }
 
   try {
-    stream = query({ prompt: /** @type {any} */ (prompt), options: queryOptions });
+    stream = claudeAgentQuery({ prompt: /** @type {any} */ (prompt), options: queryOptions });
     for await (const event of stream) {
       const nextSessionId = sessionIdFromEvent(event);
       if (nextSessionId) providerSessionId = nextSessionId;

package/src/ai/providers/codex-app.js

@@ -10,6 +10,10 @@ import { buildCapabilitiesUsed } from "../runtime/capabilities-used.js";
 import { resolveSandboxPolicy } from "../../agent/tools/shared/tool-context.js";
 import { createSessionRegistry } from "../runtime/sessions.js";
 import { createSessionLiveness } from "../runtime/session-liveness.js";
+import {
+  isAllowAllToolPolicy,
+  TOOL_POLICY_ALLOW_ALL_ONLY,
+} from "../runtime/tool-policy.js";
 
 const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
 const DEFAULT_THREAD_START_ATTEMPTS = 2;
@@ -448,6 +452,7 @@ const CODEX_APP_CAPABILITIES = {
   supports_live_input: true,
   supports_native_subagents: true,
   supports_fast_mode: true,
+  tool_policy: TOOL_POLICY_ALLOW_ALL_ONLY,
 };
 
 function promptFromMessages(messages) {
@@ -558,14 +563,9 @@ function codexToolPolicyProblem(options) {
     }
     return "Codex no-tool probe mode requires an empty tool policy, no MCP servers, and a disposable session.";
   }
-  // `undefined` retains the public runtime's documented allow-all default.
-  // Once a caller specifies a policy, require the exact wildcard contract.
-  // Extra entries can conceal a caller's mistaken belief that Codex enforces a
-  // mixed allowlist, which the app-server cannot project.
-  const effectiveAllowAll = allowedTools === null || (allowedTools.length === 1 && allowedTools[0] === "*");
-  return effectiveAllowAll && disallowedTools.length === 0
+  return isAllowAllToolPolicy(allowedTools, disallowedTools)
     ? null
-    : "Direct Codex cannot enforce allowedTools/disallowedTools. Use exact allow-all ([\"*\"] with no disallowedTools) or another runtime.";
+    : "Direct Codex cannot enforce allowedTools/disallowedTools. Use allow-all-only (omit allowedTools or include \"*\", with no disallowedTools) or another runtime.";
 }
 
 const CODEX_NO_TOOL_ACTION_ITEMS = new Set([
@@ -1143,7 +1143,9 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
   let serverRequestViolation = null;
   let resolveTurn;
   let resolveTurnReady;
+  let resolveLiveInputStop;
   let turnReadyResolved = false;
+  let liveInputStopped = false;
   const fileChangeSnapshots = new Map();
   const codexItemContext = {
     fileChangePayload: (raw) => createFileChangePayload(raw, {
@@ -1153,6 +1155,13 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
   };
   const turnDone = new Promise((resolve) => { resolveTurn = resolve; });
   const turnReady = new Promise((resolve) => { resolveTurnReady = resolve; });
+  const liveInputStop = new Promise((resolve) => { resolveLiveInputStop = resolve; });
+
+  function stopLiveInput() {
+    if (liveInputStopped) return;
+    liveInputStopped = true;
+    resolveLiveInputStop();
+  }
 
   function setActiveTurnId(turnId, { steerReady = false } = {}) {
     activeTurnId = turnId || activeTurnId;
@@ -1175,6 +1184,21 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
     options.onEvent?.(safeEvent);
   }
 
+  function invokeLiveInputCallback(message, callbackName, ...args) {
+    const callback = message?.[callbackName];
+    if (typeof callback !== "function") return;
+    try {
+      callback.apply(message, args);
+    } catch (err) {
+      const detail = safeDiagnostic(err, 512);
+      emitEvent({
+        type: "runtime_warning",
+        warning_kind: "live_input_callback_failed",
+        message: safeDiagnostic(`Live-input ${callbackName} callback failed: ${detail}`, 1_024),
+      });
+    }
+  }
+
   const compactionTurnKey = (params = {}) => `${params.threadId || threadId || "thread"}:${params.turnId || activeTurnId || "turn"}`;
 
   /**
@@ -1269,6 +1293,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       client?.request("turn/interrupt", { threadId, turnId: activeTurnId }).catch(() => {});
     }
     turnCompleted = true;
+    stopLiveInput();
     resolveTurn({ id: activeTurnId, status: "interrupted" });
   }
 
@@ -1293,6 +1318,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       message: errorMessage,
     });
     turnCompleted = true;
+    stopLiveInput();
     resolveTurn({ id: activeTurnId, status: "interrupted" });
   }
 
@@ -1323,6 +1349,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
     if (method === "turn/completed") {
       setActiveTurnId(params.turn?.id);
       turnCompleted = true;
+      stopLiveInput();
       if (params.turn?.status === "failed") {
         errorMessage = safeDiagnostic(params.turn?.error?.message || params.turn?.error || "Codex turn failed");
         failureKind = "provider_unavailable";
@@ -1482,6 +1509,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
 
   const abortHandler = () => {
     abortRequested = true;
+    stopLiveInput();
     if (threadId && activeTurnId && !interruptSent) {
       interruptSent = true;
       client?.request("turn/interrupt", { threadId, turnId: activeTurnId }).catch(() => {});
@@ -1495,20 +1523,19 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
     if (!options.liveInput) return;
     const iterator = options.liveInput[Symbol.asyncIterator]();
     try {
-      while (!turnCompleted) {
+      while (!turnCompleted && !liveInputStopped) {
         const next = await Promise.race([
           iterator.next(),
-          turnDone.then(() => ({ done: true, value: undefined })),
+          liveInputStop.then(() => ({ done: true, value: undefined })),
         ]);
-        if (next.done || turnCompleted) break;
+        if (next.done || turnCompleted || liveInputStopped) break;
         const message = next.value;
         if (!threadId || !activeTurnId || !turnReadyResolved) {
           await Promise.race([
             turnReady,
-            turnDone,
-            client.closed.then((err) => { throw err; }),
+            liveInputStop,
           ]);
-          if (turnCompleted || !turnReadyResolved) break;
+          if (turnCompleted || liveInputStopped || !turnReadyResolved) break;
         }
         const input = userTextInput(formatLiveInputGuidance(message.body, options.prompts));
         try {
@@ -1518,16 +1545,15 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
             input,
           });
           activeTurnId = response?.turnId || activeTurnId;
-          message.acknowledge?.();
+          invokeLiveInputCallback(message, "acknowledge");
         } catch (err) {
           const providerError = err?.responseError;
           if (isNoActiveTurnToSteer(providerError || err)) {
             await Promise.race([
               turnReady,
-              turnDone,
-              client.closed.then((closedErr) => { throw closedErr; }),
+              liveInputStop,
             ]);
-            if (turnCompleted) break;
+            if (turnCompleted || liveInputStopped) break;
             try {
               const response = await client.request("turn/steer", {
                 threadId,
@@ -1535,10 +1561,10 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
                 input,
               });
               activeTurnId = response?.turnId || activeTurnId;
-              message.acknowledge?.();
+              invokeLiveInputCallback(message, "acknowledge");
               continue;
             } catch (retryErr) {
-              message.reject?.(retryErr);
+              invokeLiveInputCallback(message, "reject", retryErr);
               const retryProviderError = retryErr?.responseError
                 ? safeResponseError(retryErr.responseError)
                 : null;
@@ -1552,7 +1578,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
               break;
             }
           }
-          message.reject?.(err);
+          invokeLiveInputCallback(message, "reject", err);
           emitEvent({
             type: "runtime_warning",
             warning_kind: isActiveTurnNotSteerable(providerError) ? "active_turn_not_steerable" : "live_input_rejected",
@@ -1789,6 +1815,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
         closedSignal.then((err) => {
           if (!turnCompleted) {
             prematureClose = true;
+            stopLiveInput();
             throw err || new Error("codex app-server closed");
           }
           return null;
@@ -1803,6 +1830,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       }
     } finally {
       abortRaceCleanup();
+      stopLiveInput();
     }
     turnCompleted = true;
     await steerTask;
@@ -1923,6 +1951,7 @@ export async function generateCodexAppResponse(systemPrompt, options = {}) {
       }),
     };
   } finally {
+    stopLiveInput();
     if (activeCompactions.size > 0) {
       const cancelled = !!options.abortSignal?.aborted;
       finalizeOpenCompactions(

package/src/ai/providers/opencode-app.js

@@ -3,6 +3,10 @@ import { estimateCost } from "../cost.js";
 import { buildCapabilitiesUsed } from "../runtime/capabilities-used.js";
 import { createApprovalManager, RISK_TIERS } from "../../agent/approval.js";
 import { resolveSandboxPolicy } from "../../agent/tools/shared/tool-context.js";
+import {
+  isAllowAllToolPolicy,
+  TOOL_POLICY_ALLOW_ALL_ONLY,
+} from "../runtime/tool-policy.js";
 import { createIsolatedOpencode } from "./opencode-server.js";
 import {
   toolUseEvent,
@@ -37,6 +41,7 @@ const OPENCODE_APP_CAPABILITIES = {
   supports_live_input: false,
   supports_native_subagents: false,
   supports_fast_mode: false,
+  tool_policy: TOOL_POLICY_ALLOW_ALL_ONLY,
 };
 
 // How long to keep draining the event stream after session.prompt resolves, in
@@ -428,13 +433,9 @@ export function mapSpawnFailureKind(err) {
 }
 
 function opencodeToolPolicyProblem(options) {
-  const allowedTools = Array.isArray(options.allowedTools) ? options.allowedTools : null;
-  const disallowedTools = Array.isArray(options.disallowedTools) ? options.disallowedTools : [];
-  const exactAllowAll = allowedTools === null
-    || (allowedTools.length === 1 && allowedTools[0] === "*");
-  return exactAllowAll && disallowedTools.length === 0
+  return isAllowAllToolPolicy(options.allowedTools, options.disallowedTools)
     ? null
-    : "Direct OpenCode cannot enforce allowedTools/disallowedTools. Use exact allow-all ([\"*\"] with no disallowedTools) or a Pi runtime (including pi:opencode-go:*).";
+    : "Direct OpenCode cannot enforce allowedTools/disallowedTools. Use allow-all-only (omit allowedTools or include \"*\", with no disallowedTools) or a Pi runtime (including pi:opencode-go:*).";
 }
 
 function opencodeCapabilityMismatchResult({

package/src/ai/runtime/capabilities.js

@@ -1,3 +1,8 @@
+import {
+  TOOL_POLICY_ALLOW_ALL_ONLY,
+  TOOL_POLICY_PROJECTED,
+} from "./tool-policy.js";
+
 export const COMMON_CAPABILITIES = {
   streaming: true,
   structured_output: true,
@@ -9,6 +14,7 @@ export const COMMON_CAPABILITIES = {
   supports_live_input: true,
   supports_native_subagents: true,
   supports_fast_mode: false,
+  tool_policy: TOOL_POLICY_PROJECTED,
 };
 
 export const RUNTIME_CAPABILITIES = {
@@ -36,6 +42,7 @@ export const RUNTIME_CAPABILITIES = {
     // when options.sessionKeepAlive is set; resumed turns reuse the thread.
     supports_session_resume: true,
     supports_fast_mode: true,
+    tool_policy: TOOL_POLICY_ALLOW_ALL_ONLY,
   },
   opencode: {
     runtime: "cli",
@@ -46,6 +53,7 @@ export const RUNTIME_CAPABILITIES = {
     supports_skills: false,
     supports_live_input: false,
     supports_native_subagents: false,
+    tool_policy: TOOL_POLICY_ALLOW_ALL_ONLY,
   },
 };
 

package/src/ai/runtime/live-input-events.js

@@ -0,0 +1,94 @@
+// Metadata-only live-input acknowledgement instrumentation.
+//
+// Provider bridges already call message.acknowledge() only after their native
+// steering boundary accepts guidance. Wrapping that callback here creates one
+// adapter-neutral `live_input_applied` event without copying the guidance body
+// into runtime telemetry. A wrapper owns one logical-run dedupe set and is
+// intentionally reused by the fallback router across provider attempts.
+
+// @ts-check
+
+const LIVE_INPUT_APPLIED_INSTRUMENTED = Symbol("mono-agent.live-input-applied-instrumented");
+
+/**
+ * @typedef {{body: string, id?: string, receivedAt?: string, acknowledge?: () => void, reject?: (reason?: unknown) => void}} RuntimeLiveInputMessage
+ * @typedef {{type: "live_input_applied", inputId: string, receivedAt?: string}} LiveInputAppliedEvent
+ */
+
+/**
+ * @param {AsyncIterable<RuntimeLiveInputMessage>|undefined} liveInput
+ * @param {(event: LiveInputAppliedEvent) => void} onApplied
+ * @returns {AsyncIterable<RuntimeLiveInputMessage>|undefined}
+ */
+export function instrumentLiveInputAppliedEvents(liveInput, onApplied) {
+  if (liveInput === undefined || isInstrumented(liveInput)) return liveInput;
+
+  const appliedInputIds = new Set();
+  const instrumented = {
+    [LIVE_INPUT_APPLIED_INSTRUMENTED]: true,
+    [Symbol.asyncIterator]() {
+      const iterator = liveInput[Symbol.asyncIterator]();
+      let ordinal = 0;
+      return {
+        async next() {
+          const next = await iterator.next();
+          if (next.done === true) return next;
+          ordinal += 1;
+          const message = next.value;
+          const inputId = stableInputId(message?.id, ordinal);
+          const receivedAt = typeof message?.receivedAt === "string" && message.receivedAt.length > 0
+            ? message.receivedAt
+            : undefined;
+          const acknowledge = typeof message?.acknowledge === "function"
+            ? message.acknowledge.bind(message)
+            : undefined;
+          return {
+            done: false,
+            value: {
+              ...message,
+              acknowledge: () => {
+                acknowledge?.();
+                if (appliedInputIds.has(inputId)) return;
+                appliedInputIds.add(inputId);
+                try {
+                  onApplied({
+                    type: "live_input_applied",
+                    inputId,
+                    ...(receivedAt === undefined ? {} : { receivedAt }),
+                  });
+                } catch {
+                  // Telemetry must never turn accepted guidance into a provider
+                  // failure after the native steering call already succeeded.
+                }
+              },
+            },
+          };
+        },
+        async return(value) {
+          return typeof iterator.return === "function"
+            ? iterator.return(value)
+            : { done: true, value };
+        },
+        async throw(error) {
+          if (typeof iterator.throw === "function") return iterator.throw(error);
+          throw error;
+        },
+      };
+    },
+  };
+  return /** @type {AsyncIterable<RuntimeLiveInputMessage>} */ (instrumented);
+}
+
+/** @param {unknown} value */
+function isInstrumented(value) {
+  return typeof value === "object"
+    && value !== null
+    && value[LIVE_INPUT_APPLIED_INSTRUMENTED] === true;
+}
+
+/** @param {unknown} value @param {number} ordinal */
+function stableInputId(value, ordinal) {
+  return typeof value === "string" && value.trim().length > 0
+    ? value
+    : `anonymous:${ordinal}`;
+}

package/src/ai/runtime/router.js

@@ -41,6 +41,8 @@ import { runtimeCapabilities } from "./capabilities.js";
 import { buildTranscriptTailSnapshot, renderResumeSnapshot } from "../../agent/transcript.js";
 import { passthroughSandbox } from "../../agent/sandbox-seam.js";
 import { resolveRuntimeBrand } from "../../runtime-brand.js";
+import { createObserverHub } from "../observer.js";
+import { instrumentLiveInputAppliedEvents } from "./live-input-events.js";
 
 /**
  * @typedef {import('../types.js').RuntimeModelRef} RuntimeModelRef
@@ -127,6 +129,22 @@ export function createRouterRuntime({ host = {}, chain = [], routeSafety = "unif
      * @returns {Promise<RuntimeResult>}
      */
     async run(systemPrompt, options = {}) {
+      const liveInputHub = options.liveInput === undefined
+        ? undefined
+        : createObserverHub({
+            observers: [
+              ...(Array.isArray(host.observers) ? host.observers : []),
+              ...(Array.isArray(options.observers) ? options.observers : []),
+            ],
+            onEvent: options.onEvent,
+          });
+      if (options.liveInput !== undefined && liveInputHub !== undefined) {
+        options = {
+          ...options,
+          liveInput: instrumentLiveInputAppliedEvents(options.liveInput, liveInputHub.emit),
+        };
+      }
+      try {
       /** @type {Array<{model: RuntimeModelRef, failureKind: (string|null), requestId?: (string|null|undefined), retryableSubkind?: (string|null|undefined), requirements?: (Object<string,*>|null), routeSafety?: import('../types.js').RuntimeRouteSafetyMode, safetyContract?: import('../types.js').RuntimeRouteSafetyContract}>} */
       const failoverHistory = [];
       /** @type {RuntimeResult|null} */
@@ -374,6 +392,9 @@ export function createRouterRuntime({ host = {}, chain = [], routeSafety = "unif
         failoverHistory,
         routeSafetyHistory,
       };
+      } finally {
+        await liveInputHub?.flush();
+      }
     },
     chain: () => entries.slice(),
     configureTools(next = {}) {

package/src/ai/runtime/tool-policy.js

@@ -0,0 +1,22 @@
+// @ts-check
+
+/** @type {"projected"} */
+export const TOOL_POLICY_PROJECTED = "projected";
+/** @type {"allow_all_only"} */
+export const TOOL_POLICY_ALLOW_ALL_ONLY = "allow_all_only";
+
+/**
+ * True when a tool policy is semantically unrestricted.
+ *
+ * An omitted allowlist and any allowlist containing the global `"*"` sentinel
+ * both mean allow-all. A denylist still makes the policy restrictive.
+ *
+ * @param {*} allowedTools
+ * @param {*} disallowedTools
+ * @returns {boolean}
+ */
+export function isAllowAllToolPolicy(allowedTools, disallowedTools) {
+  const allowAll = !Array.isArray(allowedTools) || allowedTools.includes("*");
+  const hasDeniedTools = Array.isArray(disallowedTools) && disallowedTools.length > 0;
+  return allowAll && !hasDeniedTools;
+}

package/src/ai/types.js

@@ -56,7 +56,12 @@
  * branch ran for a particular command.
  */
 
-/** @typedef {"mono-agent-monotonic"|"mono-agent-policy"|"provider-representable"|"exact-allow-all"|"unsupported"} RuntimeRouteToolsContract */
+/**
+ * @typedef {"mono-agent-monotonic"|"mono-agent-policy"|"provider-representable"|"exact-allow-all"|"unsupported"} RuntimeRouteToolsContract
+ * `exact-allow-all` is a stable telemetry token. It describes an effective
+ * unrestricted contract, including mixed allowlists that contain `"*"`;
+ * it does not require the literal one-element array `["*"]`.
+ */
 
 /**
  * @typedef {Object} RuntimeRouteSafetyContract
@@ -131,6 +136,7 @@
  * @property {string} [executionMode]                     "sdk" (default) or "cli"; selects which bridge variant handles the model.
  * @property {string} [sessionId]                         Host conversation/session key for resumable bridges.
  * @property {string} [providerSessionId]                 Provider-owned resume id for resumable bridges.
+ * @property {typeof import("@anthropic-ai/claude-agent-sdk").query} [claudeAgentQuery] Advanced programmatic/test seam for the Claude SDK route; omitted runs use the runtime's pinned SDK query implementation.
  * @property {boolean} [sessionKeepAlive]                 Keep resumable provider state alive after the turn.
  * @property {number} [sessionIdleTimeoutMs]              Idle TTL for resumable provider state.
  * @property {AsyncIterable<{body: string, id?: string, receivedAt?: string, acknowledge?: () => void, reject?: (error?: unknown) => void}>} [liveInput] Stream of in-flight user messages for steering an active run. Providers acknowledge only after accepting a message into the active turn.
@@ -222,6 +228,10 @@
  * @property {boolean} [supports_live_input]
  * @property {boolean} [supports_native_subagents]
  * @property {boolean} [supports_fast_mode]
+ * @property {"projected"|"allow_all_only"} [tool_policy] Whether the bridge can
+ *   project named allow/deny policies or accepts only a semantically unrestricted
+ *   policy. Built-in bridges always report this field; omission means unknown
+ *   for custom structural capability objects.
  */
 
 /**