@namzu/sdk 2.0.0 → 3.0.0

package/dist/connector/mcp/policy.d.ts

@@ -0,0 +1,57 @@
+import type { MCPToolDefinition } from '../../types/connector/index.js';
+/**
+ * What a host will accept from an MCP server.
+ *
+ * Discovery used to take whatever the server offered, which puts the
+ * REMOTE side in charge of what enters the agent's tool registry — the
+ * exact inversion of least privilege. A server could add a tool between
+ * two runs and it became callable with no one having agreed to it.
+ */
+export interface MCPToolPolicy {
+    /**
+     * Names (as the SERVER reports them, before the `mcp_<server>_` prefix)
+     * that may be admitted. When set, nothing else is, and a tool that
+     * appears later is refused by default rather than admitted by default.
+     */
+    readonly allow?: readonly string[];
+    /** Names that are never admitted, even if `allow` lists them. */
+    readonly deny?: readonly string[];
+}
+export interface MCPToolPolicyDecision {
+    readonly admitted: MCPToolDefinition[];
+    /** Refused tools, with the reason, so a host can log or surface them. */
+    readonly refused: ReadonlyArray<{
+        name: string;
+        reason: 'not_allowed' | 'denied';
+    }>;
+}
+/**
+ * Apply a policy to one server's advertised tools.
+ *
+ * Deny beats allow. A name on both lists is refused — the restrictive
+ * reading is the only safe one when a config contradicts itself.
+ */
+export declare function applyToolPolicy(tools: readonly MCPToolDefinition[], policy: MCPToolPolicy | undefined): MCPToolPolicyDecision;
+/**
+ * A stable fingerprint of what a server is offering.
+ *
+ * Covers each tool's name, description and input schema — everything the
+ * model is shown and everything that determines what a call does. A server
+ * can advertise a benign tool at approval time and swap its description or
+ * schema afterwards; nothing about the tool NAME changes, so a name-only
+ * check would miss it entirely.
+ *
+ * Sorted by name and serialized with sorted keys so the hash reflects
+ * meaning rather than transport ordering.
+ */
+export declare function toolsHash(tools: readonly MCPToolDefinition[]): string;
+/** What changed between two discoveries of the same server. */
+export interface MCPToolDrift {
+    readonly added: string[];
+    readonly removed: string[];
+    /** Same name, different description or schema — the rug-pull shape. */
+    readonly changed: string[];
+}
+export declare function diffTools(before: readonly MCPToolDefinition[], after: readonly MCPToolDefinition[]): MCPToolDrift;
+export declare function hasDrift(drift: MCPToolDrift): boolean;
+//# sourceMappingURL=policy.d.ts.map

package/dist/connector/mcp/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/connector/mcp/policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAEvE;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACjC;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAA;IACtC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,GAAG,QAAQ,CAAA;KAAE,CAAC,CAAA;CACnF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC9B,KAAK,EAAE,SAAS,iBAAiB,EAAE,EACnC,MAAM,EAAE,aAAa,GAAG,SAAS,GAC/B,qBAAqB,CAwBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAiBrE;AAED,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED,wBAAgB,SAAS,CACxB,MAAM,EAAE,SAAS,iBAAiB,EAAE,EACpC,KAAK,EAAE,SAAS,iBAAiB,EAAE,GACjC,YAAY,CAcd;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAErD"}

package/dist/connector/mcp/policy.js

@@ -0,0 +1,84 @@
+import { createHash } from 'node:crypto';
+/**
+ * Apply a policy to one server's advertised tools.
+ *
+ * Deny beats allow. A name on both lists is refused — the restrictive
+ * reading is the only safe one when a config contradicts itself.
+ */
+export function applyToolPolicy(tools, policy) {
+    if (!policy || (!policy.allow && !policy.deny)) {
+        return { admitted: [...tools], refused: [] };
+    }
+    const allow = policy.allow ? new Set(policy.allow) : null;
+    const deny = new Set(policy.deny ?? []);
+    const admitted = [];
+    const refused = [];
+    for (const tool of tools) {
+        if (deny.has(tool.name)) {
+            refused.push({ name: tool.name, reason: 'denied' });
+            continue;
+        }
+        if (allow && !allow.has(tool.name)) {
+            refused.push({ name: tool.name, reason: 'not_allowed' });
+            continue;
+        }
+        admitted.push(tool);
+    }
+    return { admitted, refused };
+}
+/**
+ * A stable fingerprint of what a server is offering.
+ *
+ * Covers each tool's name, description and input schema — everything the
+ * model is shown and everything that determines what a call does. A server
+ * can advertise a benign tool at approval time and swap its description or
+ * schema afterwards; nothing about the tool NAME changes, so a name-only
+ * check would miss it entirely.
+ *
+ * Sorted by name and serialized with sorted keys so the hash reflects
+ * meaning rather than transport ordering.
+ */
+export function toolsHash(tools) {
+    const canonical = [...tools]
+        .sort((a, b) => a.name.localeCompare(b.name))
+        .map((tool) => ({
+        name: tool.name,
+        description: tool.description ?? '',
+        inputSchema: stableStringify(tool.inputSchema),
+        // `annotations` carries `readOnlyHint` and `destructiveHint`, and
+        // those are what `mcpToolToToolDefinition` turns into `isReadOnly`
+        // / `isDestructive` — the flags the HITL review keys on. Omitting
+        // them meant a server could flip a tool from destructive to
+        // read-only, silently removing it from human review, and the
+        // fingerprint built to catch exactly that rug-pull saw nothing.
+        annotations: stableStringify(tool.annotations),
+    }));
+    return createHash('sha256').update(JSON.stringify(canonical)).digest('hex');
+}
+export function diffTools(before, after) {
+    const beforeByName = new Map(before.map((t) => [t.name, t]));
+    const afterByName = new Map(after.map((t) => [t.name, t]));
+    const added = [...afterByName.keys()].filter((name) => !beforeByName.has(name));
+    const removed = [...beforeByName.keys()].filter((name) => !afterByName.has(name));
+    const changed = [...afterByName.keys()].filter((name) => {
+        const prev = beforeByName.get(name);
+        if (!prev)
+            return false;
+        const next = afterByName.get(name);
+        return toolsHash([prev]) !== toolsHash([next]);
+    });
+    return { added, removed, changed };
+}
+export function hasDrift(drift) {
+    return drift.added.length > 0 || drift.removed.length > 0 || drift.changed.length > 0;
+}
+/** JSON with object keys sorted at every depth, so key order cannot move a hash. */
+function stableStringify(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(',')}]`;
+    const entries = Object.entries(value).sort(([a], [b]) => a.localeCompare(b));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(',')}}`;
+}
+//# sourceMappingURL=policy.js.map

package/dist/connector/mcp/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/connector/mcp/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AA4BxC;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC9B,KAAmC,EACnC,MAAiC;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAC7C,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAEvC,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,MAAM,OAAO,GAA8D,EAAE,CAAA;IAE7E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;YACnD,SAAQ;QACT,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAA;YACxD,SAAQ;QACT,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAmC;IAC5D,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC;SAC1B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;QACnC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;QAC9C,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,4DAA4D;QAC5D,6DAA6D;QAC7D,gEAAgE;QAChE,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC;KAC9C,CAAC,CAAC,CAAA;IAEJ,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC;AAUD,MAAM,UAAU,SAAS,CACxB,MAAoC,EACpC,KAAmC;IAEnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAE1D,MAAM,KAAK,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IACjF,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAA;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAsB,CAAA;QACvD,OAAO,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAmB;IAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;AACtF,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;IACvF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClF,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAClB,CAAA;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AAC9F,CAAC"}

package/dist/connector/mcp/schema-refs.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Resolve `$ref` pointers in a remote tool's input schema before it is
+ * converted.
+ *
+ * A `$ref` reached the converter's `default:` branch and became "anything":
+ * no type, no shape, nothing for the model to work from. And because the
+ * resulting node is inherently optional, a `$ref`'d field the server listed
+ * as required stopped being enforced too — an empty payload validated
+ * clean and was forwarded to the server instead of being rejected with the
+ * "Required: <field>" hint the executor already knows how to build.
+ *
+ * That is not an exotic shape. `$defs` + `$ref` is what several widely used
+ * schema generators emit by default for a nested object, so a server that
+ * did everything right presented its main argument to the model as `{}`.
+ */
+/** How deep to follow a schema before giving up. */
+export declare const MAX_SCHEMA_DEPTH = 64;
+type JsonObject = Record<string, unknown>;
+/**
+ * Return the schema with every resolvable local `$ref` replaced by its
+ * target. Non-local and dangling pointers, and the second visit to a
+ * recursive one, degrade to whatever sibling keywords were present.
+ */
+export declare function inlineSchemaRefs(schema: JsonObject): JsonObject;
+export {};
+//# sourceMappingURL=schema-refs.d.ts.map

package/dist/connector/mcp/schema-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-refs.d.ts","sourceRoot":"","sources":["../../../src/connector/mcp/schema-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,KAAK,CAAA;AAElC,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAmGzC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAE/D"}

package/dist/connector/mcp/schema-refs.js

@@ -0,0 +1,111 @@
+/**
+ * Resolve `$ref` pointers in a remote tool's input schema before it is
+ * converted.
+ *
+ * A `$ref` reached the converter's `default:` branch and became "anything":
+ * no type, no shape, nothing for the model to work from. And because the
+ * resulting node is inherently optional, a `$ref`'d field the server listed
+ * as required stopped being enforced too — an empty payload validated
+ * clean and was forwarded to the server instead of being rejected with the
+ * "Required: <field>" hint the executor already knows how to build.
+ *
+ * That is not an exotic shape. `$defs` + `$ref` is what several widely used
+ * schema generators emit by default for a nested object, so a server that
+ * did everything right presented its main argument to the model as `{}`.
+ */
+/** How deep to follow a schema before giving up. */
+export const MAX_SCHEMA_DEPTH = 64;
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Decode one JSON Pointer token (RFC 6901): `~1` is `/`, `~0` is `~`. */
+function decodeToken(token) {
+    return token.replace(/~1/g, '/').replace(/~0/g, '~');
+}
+/**
+ * Follow a local pointer (`#/$defs/Thing`) from the document root.
+ *
+ * Only same-document pointers are resolvable. A `$ref` to another file or
+ * a URL would need a fetch, which is not something a schema conversion may
+ * do — those are left alone and fall through to the permissive branch, the
+ * same as before.
+ */
+function resolvePointer(root, ref) {
+    if (ref === '#')
+        return root;
+    if (!ref.startsWith('#/'))
+        return undefined;
+    let current = root;
+    for (const raw of ref.slice(2).split('/')) {
+        const token = decodeToken(raw);
+        if (Array.isArray(current)) {
+            const index = Number(token);
+            if (!Number.isInteger(index))
+                return undefined;
+            current = current[index];
+            continue;
+        }
+        if (!isObject(current))
+            return undefined;
+        current = current[token];
+    }
+    return current;
+}
+function walk(node, state) {
+    if (Array.isArray(node)) {
+        return node.map((item) => walk(item, state));
+    }
+    if (!isObject(node))
+        return node;
+    if (state.depth >= MAX_SCHEMA_DEPTH)
+        return node;
+    const ref = node.$ref;
+    if (typeof ref === 'string') {
+        return expandRef(node, ref, state);
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(node)) {
+        // `$defs` / `definitions` are a dictionary of targets, not part of
+        // the shape. Once every pointer is inlined they describe nothing, and
+        // leaving them in would re-render as dead weight in the schema the
+        // model is shown.
+        if (key === '$defs' || key === 'definitions')
+            continue;
+        out[key] = walk(value, { ...state, depth: state.depth + 1 });
+    }
+    return out;
+}
+function expandRef(node, ref, state) {
+    const { $ref: _ref, ...siblings } = node;
+    if (state.active.has(ref)) {
+        // A self-referential schema (a tree node whose children are the same
+        // node) cannot be expanded into a finite tree. Stopping here yields
+        // the permissive node the whole conversion used to produce — but for
+        // one branch of one recursive type, not for every `$ref` in the
+        // document.
+        return { ...siblings };
+    }
+    const target = resolvePointer(state.root, ref);
+    if (!isObject(target)) {
+        // A dangling or non-local pointer. The server's schema is wrong or
+        // unreachable; that is its problem to report, and guessing a shape
+        // here would be worse than admitting we do not know one.
+        return { ...siblings };
+    }
+    state.active.add(ref);
+    const expanded = walk(target, { ...state, depth: state.depth + 1 });
+    state.active.delete(ref);
+    // Sibling keywords alongside `$ref` are legal since draft 2019-09 and are
+    // commonly a `description` on the reference site. They win: they are the
+    // more specific statement about this position.
+    return isObject(expanded) ? { ...expanded, ...siblings } : expanded;
+}
+/**
+ * Return the schema with every resolvable local `$ref` replaced by its
+ * target. Non-local and dangling pointers, and the second visit to a
+ * recursive one, degrade to whatever sibling keywords were present.
+ */
+export function inlineSchemaRefs(schema) {
+    return walk(schema, { root: schema, active: new Set(), depth: 0 });
+}
+//# sourceMappingURL=schema-refs.js.map

package/dist/connector/mcp/schema-refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-refs.js","sourceRoot":"","sources":["../../../src/connector/mcp/schema-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAIlC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAgB,EAAE,GAAW;IACpD,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IAE3C,IAAI,OAAO,GAAY,IAAI,CAAA;IAC3B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAC9C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YACxB,SAAQ;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAA;QACxC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AASD,SAAS,IAAI,CAAC,IAAa,EAAE,KAAkB;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,KAAK,CAAC,KAAK,IAAI,gBAAgB;QAAE,OAAO,IAAI,CAAA;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAA;IACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,kBAAkB;QAClB,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,aAAa;YAAE,SAAQ;QACtD,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,SAAS,CAAC,IAAgB,EAAE,GAAW,EAAE,KAAkB;IACnE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;IAExC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,gEAAgE;QAChE,YAAY;QACZ,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAA;IACvB,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,mEAAmE;QACnE,mEAAmE;QACnE,yDAAyD;QACzD,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;IACnE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAExB,0EAA0E;IAC1E,yEAAyE;IACzE,+CAA+C;IAC/C,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IAClD,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAe,CAAA;AACjF,CAAC"}

package/dist/constants/agent/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/agent/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAEnE,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,kBAAkB,CAI/D,CAAA;AAED,eAAO,MAAM,oBAAoB,EAAE,iBAKlC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/agent/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAEnE,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,kBAAkB,CAO/D,CAAA;AAED,eAAO,MAAM,oBAAoB,EAAE,iBAKlC,CAAA"}

package/dist/constants/agent/index.js

@@ -3,6 +3,9 @@ export const AGENT_MANAGER_DEFAULTS = {
     maxDepth: 3,
     evictionMs: 30_000,
     maxBudgetFraction: 0.5,
+    // Five minutes. Generous for a delegated sub-task, bounded enough that a
+    // wedged child cannot hold its parent open indefinitely.
+    childTimeoutMs: 300_000,
 };
 export const DEFAULT_CAPABILITIES = {
     supportsTools: false,

package/dist/constants/agent/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/agent/index.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAEtC,MAAM,CAAC,MAAM,sBAAsB,GAAiC;IACnE,QAAQ,EAAE,CAAC;IACX,UAAU,EAAE,MAAM;IAClB,iBAAiB,EAAE,GAAG;CACtB,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACtD,aAAa,EAAE,KAAK;IACpB,iBAAiB,EAAE,KAAK;IACxB,mBAAmB,EAAE,KAAK;IAC1B,iBAAiB,EAAE,KAAK;CACxB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/agent/index.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAEtC,MAAM,CAAC,MAAM,sBAAsB,GAAiC;IACnE,QAAQ,EAAE,CAAC;IACX,UAAU,EAAE,MAAM;IAClB,iBAAiB,EAAE,GAAG;IACtB,yEAAyE;IACzE,yDAAyD;IACzD,cAAc,EAAE,OAAO;CACvB,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACtD,aAAa,EAAE,KAAK;IACpB,iBAAiB,EAAE,KAAK;IACxB,mBAAmB,EAAE,KAAK;IAC1B,iBAAiB,EAAE,KAAK;CACxB,CAAA"}

package/dist/constants/compaction/index.js

@@ -1,6 +1,6 @@
 // Tool-name buckets used by the compaction extractor to classify
 // captured tool results. Lowercase to match the canonical builtin
-// tool names (Anthropic Claude emits `tool_use.name` lowercase, see
+// tool names (a tool-use block reports its name lowercase, see
 // ses_008-tool-name-case-fix). `edit` is grouped with `write`
 // because both mutate file content.
 export const READ_TOOLS = new Set(['read']);

package/dist/constants/compaction/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/compaction/index.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,kEAAkE;AAClE,oEAAoE;AACpE,8DAA8D;AAC9D,oCAAoC;AACpC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE3C,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAEpD,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC9B,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE,sBAAsB;IACxC,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,gBAAgB;IAC7B,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,kBAAkB;IAC7B,cAAc,EAAE,oBAAoB;IACpC,WAAW,EAAE,iBAAiB;IAC9B,QAAQ,EAAE,sBAAsB;IAChC,WAAW,EAAE,gBAAgB;CACpB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/compaction/index.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,kEAAkE;AAClE,+DAA+D;AAC/D,8DAA8D;AAC9D,oCAAoC;AACpC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE3C,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAEpD,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;AAE5C,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC9B,IAAI,EAAE,SAAS;IACf,gBAAgB,EAAE,sBAAsB;IACxC,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,gBAAgB;IAC7B,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,kBAAkB;IAC7B,cAAc,EAAE,oBAAoB;IACpC,WAAW,EAAE,iBAAiB;IAC9B,QAAQ,EAAE,sBAAsB;IAChC,WAAW,EAAE,gBAAgB;CACpB,CAAA"}

package/dist/constants/continuation.d.ts

@@ -1,9 +1,9 @@
 /**
  * Synthetic user prompt injected by the iteration loop when a turn
- * ends with `stop_reason: max_tokens` AND no tool_use. Mirrors
- * Claude.ai's "Continue" affordance: the loop pushes this message
- * back into the conversation and fires another iteration, letting
- * the model pick up where it was cut off.
+ * ends with `stop_reason: max_tokens` AND no tool_use. A turn cut off
+ * at the output ceiling is not a finished answer: the loop pushes this
+ * message back into the conversation and fires another iteration,
+ * letting the model pick up where it was cut off.
  *
  * The exact string is the marker used by `resolveResult` (in
  * `manager/run/persistence.ts`) to detect auto-continuation

package/dist/constants/continuation.js

@@ -1,9 +1,9 @@
 /**
  * Synthetic user prompt injected by the iteration loop when a turn
- * ends with `stop_reason: max_tokens` AND no tool_use. Mirrors
- * Claude.ai's "Continue" affordance: the loop pushes this message
- * back into the conversation and fires another iteration, letting
- * the model pick up where it was cut off.
+ * ends with `stop_reason: max_tokens` AND no tool_use. A turn cut off
+ * at the output ceiling is not a finished answer: the loop pushes this
+ * message back into the conversation and fires another iteration,
+ * letting the model pick up where it was cut off.
  *
  * The exact string is the marker used by `resolveResult` (in
  * `manager/run/persistence.ts`) to detect auto-continuation

package/dist/constants/mcp/index.d.ts

@@ -1,2 +1,33 @@
+/**
+ * The protocol version this client ADVERTISES in `initialize`.
+ *
+ * Deliberately the version namzu actually implements, not the newest one
+ * published. Advertising a version whose requirements are unimplemented is
+ * worse than advertising an older one honestly: the server tailors its
+ * behavior to what the client claims, and the mismatch surfaces later as
+ * a malformed exchange rather than a clean negotiation failure. Raising
+ * this is a conformance task, not a constant edit.
+ */
 export declare const MCP_PROTOCOL_VERSION = "2024-11-05";
+/**
+ * Versions this client can speak if a server negotiates down (or up) to
+ * one of them, newest first.
+ *
+ * A server is free to answer `initialize` with a version other than the one
+ * the client asked for — that is how the handshake is specified. namzu used
+ * to ignore the answer entirely and carry on regardless, so a server
+ * responding with a version we cannot speak looked exactly like a
+ * successful connection until something downstream broke oddly.
+ */
+export declare const MCP_SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
+/**
+ * Default deadline for one MCP JSON-RPC round trip.
+ *
+ * Generous enough for a server that shells out or hits a network API,
+ * short enough that an unresponsive one surfaces as an error the model
+ * can react to rather than a hang.
+ */
+export declare const DEFAULT_MCP_REQUEST_TIMEOUT_MS = 30000;
+/** JSON-RPC 2.0 reserved code for an unimplemented method. */
+export declare const JSON_RPC_METHOD_NOT_FOUND = -32601;
 //# sourceMappingURL=index.d.ts.map

package/dist/constants/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/mcp/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,eAAe,CAAA;AAEhD;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,EAAE,SAAS,MAAM,EAAmB,CAAA;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,QAAS,CAAA;AAEpD,8DAA8D;AAC9D,eAAO,MAAM,yBAAyB,SAAS,CAAA"}

package/dist/constants/mcp/index.js

@@ -1,2 +1,33 @@
+/**
+ * The protocol version this client ADVERTISES in `initialize`.
+ *
+ * Deliberately the version namzu actually implements, not the newest one
+ * published. Advertising a version whose requirements are unimplemented is
+ * worse than advertising an older one honestly: the server tailors its
+ * behavior to what the client claims, and the mismatch surfaces later as
+ * a malformed exchange rather than a clean negotiation failure. Raising
+ * this is a conformance task, not a constant edit.
+ */
 export const MCP_PROTOCOL_VERSION = '2024-11-05';
+/**
+ * Versions this client can speak if a server negotiates down (or up) to
+ * one of them, newest first.
+ *
+ * A server is free to answer `initialize` with a version other than the one
+ * the client asked for — that is how the handshake is specified. namzu used
+ * to ignore the answer entirely and carry on regardless, so a server
+ * responding with a version we cannot speak looked exactly like a
+ * successful connection until something downstream broke oddly.
+ */
+export const MCP_SUPPORTED_PROTOCOL_VERSIONS = ['2024-11-05'];
+/**
+ * Default deadline for one MCP JSON-RPC round trip.
+ *
+ * Generous enough for a server that shells out or hits a network API,
+ * short enough that an unresponsive one surfaces as an error the model
+ * can react to rather than a hang.
+ */
+export const DEFAULT_MCP_REQUEST_TIMEOUT_MS = 30_000;
+/** JSON-RPC 2.0 reserved code for an unimplemented method. */
+export const JSON_RPC_METHOD_NOT_FOUND = -32601;
 //# sourceMappingURL=index.js.map

package/dist/constants/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/mcp/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAA;AAEhD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAsB,CAAC,YAAY,CAAC,CAAA;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAA;AAEpD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,CAAA"}

package/dist/constants/plugin/index.d.ts

@@ -3,8 +3,21 @@ export declare const PROJECT_PLUGIN_DIR = ".namzu/plugins";
 export declare const USER_PLUGIN_DIR = ".namzu/plugins";
 /** Manifest file name */
 export declare const PLUGIN_MANIFEST_FILENAME = "plugin.json";
-/** Namespacing separator between plugin name and component name */
-export declare const PLUGIN_NAMESPACE_SEPARATOR = ":";
+/**
+ * Namespacing separator between plugin name and component name.
+ *
+ * `__`, not `:`. A tool name reaches the provider verbatim, and the major
+ * message APIs accept `[a-zA-Z0-9_-]` only — so a colon made EVERY
+ * plugin-contributed tool name illegal, unconditionally. Those tools are
+ * registered deferred, so the rejection fired the moment one was activated
+ * and took down the whole request rather than that one tool, with nothing
+ * naming the culprit.
+ *
+ * Double underscore rather than single so the boundary stays legible in a
+ * name that already contains underscores, and it matches the separator the
+ * remote-tool bridge next door already uses.
+ */
+export declare const PLUGIN_NAMESPACE_SEPARATOR = "__";
 /** Plugin name validation */
 export declare const PLUGIN_NAME_MAX_LENGTH = 64;
 export declare const PLUGIN_NAME_PATTERN: RegExp;
@@ -17,5 +30,13 @@ export declare const MAX_CONNECTORS_PER_PLUGIN = 10;
 export declare const MAX_PERSONAS_PER_PLUGIN = 5;
 /** Hook execution */
 export declare const HOOK_TIMEOUT_MS = 5000;
+/**
+ * Priority a hook gets when it does not declare one.
+ *
+ * Mid-scale on purpose: a guard can sort itself decisively ahead of every
+ * existing hook without having to know what they chose, and an observer
+ * can sort itself after.
+ */
+export declare const DEFAULT_HOOK_PRIORITY = 100;
 export declare const HOOK_MAX_CONCURRENT = 10;
 //# sourceMappingURL=index.d.ts.map

package/dist/constants/plugin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/plugin/index.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,eAAO,MAAM,kBAAkB,mBAAmB,CAAA;AAClD,eAAO,MAAM,eAAe,mBAAmB,CAAA;AAE/C,yBAAyB;AACzB,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAErD,mEAAmE;AACnE,eAAO,MAAM,0BAA0B,MAAM,CAAA;AAE7C,6BAA6B;AAC7B,eAAO,MAAM,sBAAsB,KAAK,CAAA;AACxC,eAAO,MAAM,mBAAmB,QAA+B,CAAA;AAE/D,qCAAqC;AACrC,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,eAAO,MAAM,0BAA0B,IAAI,CAAA;AAC3C,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAC3C,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC,qBAAqB;AACrB,eAAO,MAAM,eAAe,OAAQ,CAAA;AACpC,eAAO,MAAM,mBAAmB,KAAK,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/plugin/index.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,eAAO,MAAM,kBAAkB,mBAAmB,CAAA;AAClD,eAAO,MAAM,eAAe,mBAAmB,CAAA;AAE/C,yBAAyB;AACzB,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAErD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAA;AAE9C,6BAA6B;AAC7B,eAAO,MAAM,sBAAsB,KAAK,CAAA;AACxC,eAAO,MAAM,mBAAmB,QAA+B,CAAA;AAE/D,qCAAqC;AACrC,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,eAAO,MAAM,0BAA0B,IAAI,CAAA;AAC3C,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAC3C,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC,qBAAqB;AACrB,eAAO,MAAM,eAAe,OAAQ,CAAA;AAEpC;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAA;AACxC,eAAO,MAAM,mBAAmB,KAAK,CAAA"}

package/dist/constants/plugin/index.js

@@ -3,8 +3,21 @@ export const PROJECT_PLUGIN_DIR = '.namzu/plugins';
 export const USER_PLUGIN_DIR = '.namzu/plugins';
 /** Manifest file name */
 export const PLUGIN_MANIFEST_FILENAME = 'plugin.json';
-/** Namespacing separator between plugin name and component name */
-export const PLUGIN_NAMESPACE_SEPARATOR = ':';
+/**
+ * Namespacing separator between plugin name and component name.
+ *
+ * `__`, not `:`. A tool name reaches the provider verbatim, and the major
+ * message APIs accept `[a-zA-Z0-9_-]` only — so a colon made EVERY
+ * plugin-contributed tool name illegal, unconditionally. Those tools are
+ * registered deferred, so the rejection fired the moment one was activated
+ * and took down the whole request rather than that one tool, with nothing
+ * naming the culprit.
+ *
+ * Double underscore rather than single so the boundary stays legible in a
+ * name that already contains underscores, and it matches the separator the
+ * remote-tool bridge next door already uses.
+ */
+export const PLUGIN_NAMESPACE_SEPARATOR = '__';
 /** Plugin name validation */
 export const PLUGIN_NAME_MAX_LENGTH = 64;
 export const PLUGIN_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -17,5 +30,13 @@ export const MAX_CONNECTORS_PER_PLUGIN = 10;
 export const MAX_PERSONAS_PER_PLUGIN = 5;
 /** Hook execution */
 export const HOOK_TIMEOUT_MS = 5_000;
+/**
+ * Priority a hook gets when it does not declare one.
+ *
+ * Mid-scale on purpose: a guard can sort itself decisively ahead of every
+ * existing hook without having to know what they chose, and an observer
+ * can sort itself after.
+ */
+export const DEFAULT_HOOK_PRIORITY = 100;
 export const HOOK_MAX_CONCURRENT = 10;
 //# sourceMappingURL=index.js.map

package/dist/constants/plugin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/plugin/index.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAA;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAA;AAE/C,yBAAyB;AACzB,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA;AAErD,mEAAmE;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAA;AAE7C,6BAA6B;AAC7B,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAA;AAE/D,qCAAqC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAA;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AACvC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAA;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAExC,qBAAqB;AACrB,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAA;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/plugin/index.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAA;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAA;AAE/C,yBAAyB;AACzB,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAA;AAE9C,6BAA6B;AAC7B,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAA;AAE/D,qCAAqC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAA;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AACvC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAA;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAExC,qBAAqB;AACrB,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAA;AAEpC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA"}

package/dist/constants/sandbox/index.d.ts

@@ -22,9 +22,8 @@ export declare const SANDBOX_DEFAULT_UPLOADS_PATH = "/mnt/user-data/uploads";
 /**
  * Default container path for the agent's working/scratch space (RW).
  * Sibling mount to {@link SANDBOX_DEFAULT_OUTPUTS_PATH} — anything
- * written here is invisible to the output collector by design,
- * mirroring the Anthropic Cowork pattern (`/home/claude` scratch vs.
- * `/mnt/user-data/outputs` user-visible).
+ * written here is invisible to the output collector by design: an
+ * agent needs somewhere to think out loud that is not the deliverable.
  */
 export declare const SANDBOX_DEFAULT_SCRATCH_PATH = "/mnt/user-data/scratch";
 /** Default container path for cached tool fetches (RO). */

package/dist/constants/sandbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/sandbox/index.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,eAAO,MAAM,0BAA0B,QAAS,CAAA;AAEhD,uCAAuC;AACvC,eAAO,MAAM,+BAA+B,MAAM,CAAA;AAElD,wCAAwC;AACxC,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAE/C,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,QAAmB,CAAA;AAExD,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,eAAe,CAAA;AAEnD,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,OAAQ,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,aAQhC,CAAA;AAYF,qEAAqE;AACrE,eAAO,MAAM,4BAA4B,2BAA2B,CAAA;AAEpE,2DAA2D;AAC3D,eAAO,MAAM,4BAA4B,2BAA2B,CAAA;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAA;AAEpE,2DAA2D;AAC3D,eAAO,MAAM,iCAAiC,gCAAgC,CAAA;AAE9E,sEAAsE;AACtE,eAAO,MAAM,gCAAgC,qBAAqB,CAAA;AAElE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/sandbox/index.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,eAAO,MAAM,0BAA0B,QAAS,CAAA;AAEhD,uCAAuC;AACvC,eAAO,MAAM,+BAA+B,MAAM,CAAA;AAElD,wCAAwC;AACxC,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAE/C,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,QAAmB,CAAA;AAExD,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,eAAe,CAAA;AAEnD,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,OAAQ,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,qBAAqB,aAQhC,CAAA;AAcF,qEAAqE;AACrE,eAAO,MAAM,4BAA4B,2BAA2B,CAAA;AAEpE,2DAA2D;AAC3D,eAAO,MAAM,4BAA4B,2BAA2B,CAAA;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,2BAA2B,CAAA;AAEpE,2DAA2D;AAC3D,eAAO,MAAM,iCAAiC,gCAAgC,CAAA;AAE9E,sEAAsE;AACtE,eAAO,MAAM,gCAAgC,qBAAqB,CAAA;AAElE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,gBAAgB,CAAA"}

package/dist/constants/sandbox/index.js

@@ -27,8 +27,10 @@ export const SANDBOX_SAFE_ENV_KEYS = new Set([
 // ContainerSandboxLayout default container paths
 // ---------------------------------------------------------------------------
 //
-// Mirrors the taxonomy Anthropic's container architecture exposes to
-// the model (Claude container blueprint, Code Interpreter, "skills").
+// A container needs one place the user will see and several the user
+// will not, and the difference has to be legible to the model from the
+// path alone — otherwise everything lands in the output bind and the
+// user reads the agent's scratch work as its answer.
 // Exported so prompt-template consumers can write
 // `Outputs go to ${SANDBOX_DEFAULT_OUTPUTS_PATH}` instead of
 // hard-coding the string in two places that drift.
@@ -39,9 +41,8 @@ export const SANDBOX_DEFAULT_UPLOADS_PATH = '/mnt/user-data/uploads';
 /**
  * Default container path for the agent's working/scratch space (RW).
  * Sibling mount to {@link SANDBOX_DEFAULT_OUTPUTS_PATH} — anything
- * written here is invisible to the output collector by design,
- * mirroring the Anthropic Cowork pattern (`/home/claude` scratch vs.
- * `/mnt/user-data/outputs` user-visible).
+ * written here is invisible to the output collector by design: an
+ * agent needs somewhere to think out loud that is not the deliverable.
  */
 export const SANDBOX_DEFAULT_SCRATCH_PATH = '/mnt/user-data/scratch';
 /** Default container path for cached tool fetches (RO). */

package/dist/constants/sandbox/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/sandbox/index.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAA;AAEhD,uCAAuC;AACvC,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAA;AAElD,wCAAwC;AACxC,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAA;AAE/C,sDAAsD;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAExD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAA;AAEnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAC5C,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;CACV,CAAC,CAAA;AAEF,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAC9E,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,kDAAkD;AAClD,6DAA6D;AAC7D,mDAAmD;AAEnD,qEAAqE;AACrE,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAA;AAEpE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iCAAiC,GAAG,6BAA6B,CAAA;AAE9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,gCAAgC,GAAG,kBAAkB,CAAA;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/sandbox/index.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAA;AAEhD,uCAAuC;AACvC,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAA;AAElD,wCAAwC;AACxC,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAA;AAE/C,sDAAsD;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAExD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAA;AAEnD,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAC5C,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;CACV,CAAC,CAAA;AAEF,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAC9E,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,qDAAqD;AACrD,kDAAkD;AAClD,6DAA6D;AAC7D,mDAAmD;AAEnD,qEAAqE;AACrE,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAA;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAA;AAEpE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iCAAiC,GAAG,6BAA6B,CAAA;AAE9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,gCAAgC,GAAG,kBAAkB,CAAA;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAA"}

package/dist/constants/telemetry/index.d.ts

@@ -9,6 +9,13 @@ export declare const GENAI: {
     readonly RESPONSE_ID: "gen_ai.response.id";
     readonly USAGE_INPUT_TOKENS: "gen_ai.usage.input_tokens";
     readonly USAGE_OUTPUT_TOKENS: "gen_ai.usage.output_tokens";
+    /**
+     * Which kind of token a usage measurement counts. The convention keys
+     * one metric by this rather than minting a metric name per kind, so a
+     * dashboard that sums the metric gets the whole picture instead of one
+     * slice of it.
+     */
+    readonly TOKEN_TYPE: "gen_ai.token.type";
     readonly TOOL_NAME: "gen_ai.tool.name";
     readonly TOOL_TYPE: "gen_ai.tool.type";
     readonly TOOL_CALL_ID: "gen_ai.tool.call_id";

package/dist/constants/telemetry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/telemetry/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;CAqBR,CAAA;AAEV,eAAO,MAAM,KAAK;;;;;;;;;;CAUR,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/telemetry/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,KAAK;;;;;;;;;;;IAejB;;;;;OAKG;;;;;;;CASM,CAAA;AAEV,eAAO,MAAM,KAAK;;;;;;;;;;CAUR,CAAA"}