@namzu/sdk 2.0.0 → 3.0.0

package/README.md

@@ -30,7 +30,7 @@ Namzu is a single-process TypeScript kernel with the following responsibilities:
 - **Signals.** `AbortController` tree spanning parent and children. `cancel(taskId)` and `cancelAll(parentRunId)` propagate. Runs can be paused and resumed, aborted cleanly, and emit lifecycle events for every transition.
 - **Memory management.** Working memory via structured compaction to a typed `WorkingState`. Long-term memory via an indexed, tag/query/status-searchable store with disk persistence. No vector database required by default.
 - **Durability.** Atomic per-iteration checkpoints, automatic emergency core-dump on SIGINT/SIGTERM, separate storage for runs, threads, conversations, activities, memories, and tasks.
-- **IPC.** Native A2A (Google agent-to-agent) and MCP (Anthropic Model Context Protocol) — both client and server, one SDK. An internal event bus with circuit breakers, file lock manager, and edit ownership tracking so concurrent agents do not stomp on each other.
+- **IPC.** Native A2A (agent-to-agent) and MCP (Model Context Protocol) — both client and server, one SDK. An internal event bus with circuit breakers, file lock manager, and edit ownership tracking so concurrent agents do not stomp on each other.
 - **Capability system.** Tools are first-class, typed, permissioned, and progressively disclosed. The LLM does not see the full tool catalog; tools start deferred, get activated on demand, and can be suspended. Each tool declares `readOnly`, `destructive`, `concurrencySafe`, `permissions`, `category`.
 - **Syscall filtering.** Every tool call goes through a verification gate — allow / deny / ask, with built-in rules for read-only allowlist and dangerous pattern deny-list, plus custom regex rules. This is separate from sandbox isolation; it is the decision layer, the sandbox is the enforcement layer.
 - **Retrieval-augmented context (RAG).** A full pipeline: chunking, embedding providers, ingestion, knowledge base storage, vector store, retriever, context assembler, and a first-class `rag-tool`.
@@ -64,40 +64,39 @@ The goal of that list is not to be minimal — the kernel is plenty rich. The go
 
 ---
 
-## The Complete Feature Map
-
-How Namzu compares, category by category. Framework category tells you what job the project actually does.
-
-| | **Namzu** | LangGraph | CrewAI | Mastra | Vercel AI SDK | OpenAI Agents SDK |
-|---|---|---|---|---|---|---|
-| Category | **Agent Kernel** | Graph framework | Crew framework | TS app framework | Frontend-first SDK | Vendor SDK |
-| Language | TypeScript | Python/JS | Python | TypeScript | TypeScript | Python/JS |
-| Process sandbox (OS-level) | ✅ Seatbelt + NS | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Multi-tenant from day 1 | ✅ | ❌ | ❌ | partial | ❌ | ❌ |
-| Sub-agent spawn (`fork`/`exec`) | ✅ parent/child/depth/budget | via graph | crews | ✅ | ❌ | handoffs |
-| Signal propagation tree | ✅ AbortController + cancelAll | ❌ | ❌ | partial | ❌ | ❌ |
-| Checkpoint + resume | ✅ per-iteration | ✅ per-superstep | ❌ | partial | ❌ | sessions |
-| Emergency save on signal | ✅ `EmergencySaveManager` | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Resource quotas (token / cost / time) | ✅ per run + per child | manual | manual | manual | ❌ | manual |
-| Provider prompt cache wired | ✅ `ContextCache` + telemetry | ❌ | ❌ | partial | ❌ | ✅ |
-| Thread ↔ Run separation | ✅ | ❌ | ❌ | ✅ | ❌ | partial |
-| Native A2A protocol | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Native MCP (client + server) | ✅ | plugin | ❌ | ✅ | ❌ | client only |
-| RAG built into the kernel | ✅ full pipeline | via integrations | via integrations | plugin | ❌ | via tools |
-| Persona inheritance (YAML) | ✅ merge-based | ❌ | role strings | partial | ❌ | instructions |
-| Advisory system (multi-advisor) | ✅ provider-agnostic | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Structured context compaction | ✅ WorkingState | ❌ | ❌ | partial | ❌ | ❌ |
-| Tool tiering (cost-aware) | ✅ user-defined | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Task routing (per-task model) | ✅ fallback chains | manual | manual | manual | ❌ | manual |
-| Progressive tool disclosure | ✅ deferred/active/suspended | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Tool-call verification gate | ✅ allow/deny/ask + custom | ❌ | task-level scope | ❌ | tool approval | ❌ |
-| File ownership / edit locking | ✅ `EditOwnershipTracker` | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Circuit breakers on the bus | ✅ `CircuitBreaker` | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Skills system (separate from tools) | ✅ disclosure-tiered | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Plugin system with lifecycle | ✅ | ❌ | ❌ | partial | ❌ | ❌ |
-| Vault / BYOK | ✅ tenant-scoped | ❌ | ❌ | ❌ | ❌ | ❌ |
-| Telemetry (OpenTelemetry) | ✅ native | via LangSmith | CrewAI+ | partial | ❌ | built-in tracing |
-| Provider lock-in | none | low | low | low | low | OpenAI-first |
+## What the Kernel Provides
+
+Category by category, with the symbol that implements it. This list
+exists to be checked against the source, not against anybody else.
+
+| Capability | What it is here |
+|---|---|
+| Process sandbox (OS-level) | Seatbelt profiles or mount + PID namespaces, refusing when a requested control cannot be enforced |
+| Multi-tenancy | Tenant, project, thread and run are separate identities from day one, not a field added later |
+| Sub-agent spawn | Parent/child with depth, budget and a shared pool the parent debits |
+| Signal propagation | One abort tree; cancelling a parent tears down every descendant |
+| Checkpoint and resume | Per iteration, versioned, written atomically, with the trace context to rejoin |
+| Emergency save | Opt-in snapshot on a fatal signal, replayable through the ordinary restore path |
+| Resource quotas | Token, cost and wall-clock caps per run and per child |
+| Prompt cache | Cache anchors placed by the runtime and reported in telemetry |
+| Thread ↔ Run separation | A conversation outlives the runs inside it |
+| Agent-to-agent protocol | Client and server, in the kernel |
+| Model Context Protocol | Client and server, in the kernel |
+| Retrieval | A full pipeline in the kernel rather than an integration |
+| Persona inheritance | Merge-based, declared in YAML |
+| Advisory | Multiple advisors, each on whichever provider suits it |
+| Context compaction | Structured working state, safe trim points, pinned messages |
+| Tool tiering | Cost-aware, author-defined |
+| Task routing | Per-task model with fallback chains |
+| Progressive tool disclosure | Deferred, active and suspended tool states |
+| Tool-call verification | Allow, deny or ask, with custom gates |
+| File ownership | Edit locking so two concurrent writes cannot clobber |
+| Circuit breakers | On the internal bus |
+| Skills | Disclosure-tiered, separate from tools |
+| Plugins | Install, enable, disable, with a hook lifecycle |
+| Vault / BYOK | Tenant-scoped |
+| Telemetry | OpenTelemetry natively, with GenAI conventions |
+| Provider lock-in | None; the driver is a config choice |
 
 ---
 
@@ -107,7 +106,7 @@ Every folder under `src/` maps to a traditional OS concept. This section walks t
 
 ### 1. The Boundary: Sandbox (`sandbox/`)
 
-Sandboxing is the foundation. Tools do not execute in the host process; they execute inside an OS-enforced jail with deny-default file I/O and scoped network access. macOS uses Seatbelt profiles in SBPL format (the same mechanism Apple's own apps use). Linux uses lightweight mount + PID namespaces, without requiring Docker, systemd, or any container runtime. The `SandboxProvider` abstraction (`sandbox/factory.ts`, `sandbox/provider/`) means you can swap in a Firecracker or gVisor-backed provider later without touching the rest of the kernel.
+Sandboxing is the foundation. Tools do not execute in the host process; they execute inside an OS-enforced jail with deny-default file I/O and scoped network access. macOS uses Seatbelt profiles in SBPL format (the same mechanism Apple's own apps use). Linux uses lightweight mount + PID namespaces, without requiring Docker, systemd, or any container runtime. The `SandboxProvider` abstraction (`sandbox/factory.ts`, `sandbox/provider/`) means you can swap in a virtualization-backed or userspace-kernel-backed provider later without touching the rest of the kernel.
 
 The kernel enforces memory, timeout, and max-process limits on top of whatever the sandbox gives you. The goal: a rogue or hallucinated tool call should never wipe your filesystem or exfiltrate arbitrary data, even if the LLM tries very hard.
 
@@ -115,7 +114,7 @@ The kernel enforces memory, timeout, and max-process limits on top of whatever t
 
 Two layers here, with different jobs.
 
-**Bridge** is cross-process and cross-agent communication. The `bridge/a2a/` folder speaks Google's Agent-to-Agent protocol: your agents can publish agent cards describing their capabilities and can discover and invoke other agents' capabilities. The `bridge/mcp/` folder speaks Anthropic's Model Context Protocol, both as a client (consume MCP servers as tools) and as a server (expose your Namzu tools to any MCP-speaking agent). The `bridge/sse/` folder contains the event mapper that turns in-process events into Server-Sent Events for any consumer on the other side of HTTP. `bridge/tools/` wires it all into the tool system.
+**Bridge** is cross-process and cross-agent communication. The `bridge/a2a/` folder speaks the Agent-to-Agent protocol: your agents can publish agent cards describing their capabilities and can discover and invoke other agents' capabilities. The `bridge/mcp/` folder speaks the Model Context Protocol, both as a client (consume MCP servers as tools) and as a server (expose your Namzu tools to any MCP-speaking agent). The `bridge/sse/` folder contains the event mapper that turns in-process events into Server-Sent Events for any consumer on the other side of HTTP. `bridge/tools/` wires it all into the tool system.
 
 **Bus** is in-process. This is where the kernel's internal nervous system lives. The bus emits typed `AgentBusEvent`s for every meaningful transition: run started, iteration begun, checkpoint created, tool call dispatched, tool result returned, agent paused, agent canceled, plan requested, plan approved, error thrown. On top of raw event fan-out, the bus offers three kernel-grade primitives:
 
@@ -215,7 +214,9 @@ The kernel assumes processes crash. Two layers make sure that when they do, you
 
 **Checkpoints** (`store/run/disk.ts`) are atomic per-iteration snapshots. Each `IterationCheckpoint` captures the run state at a super-step boundary — messages, working state, tool-call state, usage, cost, iteration index. Writes are atomic via write-temp-rename (Convention #8). You can read them, list them, and delete them. A future `Run.replay(runId, { fromCheckpoint })` API will build on top of this; the storage is already there.
 
-**Emergency save** (`manager/run/emergency.ts`) is the kernel's core-dump. `EmergencySaveManager` installs handlers for SIGINT and SIGTERM. When the process is dying, every active run gets its `toEmergencySnapshot()` flushed atomically to an `emergency/` directory. On the next boot you can inspect or resume the saved state. There is no reliance on the user remembering to catch signals; the kernel does it.
+**Emergency save** (`manager/run/emergency.ts`) is the kernel's core-dump. Pass `emergencySave: true` to `query()` and `EmergencySaveManager` installs handlers for SIGINT, SIGTERM and `uncaughtException`; when the process is dying the run's `toEmergencySnapshot()` is flushed atomically to an `emergency/` directory, and `replay({ fromCheckpoint: 'emergency' })` reads it back. The handlers are removed when the run settles.
+
+It is **opt-in on purpose.** Attaching means calling `process.on(...)` with handlers that `process.exit()` — a library must not seize a host's termination path by default, and the manager is a singleton, so with concurrent runs the last one to attach would silently become the only one saved. Turn it on for a process that owns its run end to end (a CLI, a single-run worker); leave it off inside a server that has its own drain sequence.
 
 Together these give Namzu durable execution without requiring a database. Runs resume across crashes, across reboots, across graceful shutdowns.
 
@@ -255,7 +256,7 @@ Pieces:
 - `advisory/executor.ts` — `AdvisoryExecutor`, runs the advisor, collects its output, and feeds it back.
 - `advisory/context.ts` — `AdvisoryContext`, the payload passed to advisors.
 
-Unlike Anthropic's advisor tool (Claude-only, single advisor), Namzu's is **provider-agnostic** and **multi-advisor**: put a security advisor on Bedrock, an architecture advisor on OpenRouter, a legal advisor on Anthropic, and the agent decides who to consult. This is one of the things that most cleanly separates Namzu from the pack.
+Advisors are **provider-agnostic** and there can be many: put a security advisor on one provider, an architecture advisor on another, a legal advisor on a third, and let the agent decide who to consult. A single advisor pinned to one vendor cannot express "ask the model that is actually good at this".
 
 ### 14. Human-in-the-Loop (`types/hitl/`, `manager/plan/lifecycle.ts`, `types/decision/`)
 
@@ -326,7 +327,7 @@ pnpm add @namzu/sdk
 
 Requirements: Node ≥ 20, TypeScript strict mode, ESM.
 
-The SDK ships the kernel only. Pick an LLM backend by adding a provider package — `@namzu/anthropic`, `@namzu/openai`, `@namzu/ollama`, `@namzu/bedrock`, `@namzu/openrouter`, `@namzu/lmstudio`, or the zero-dep `@namzu/http`. The kernel alone runs against `MockLLMProvider`, which is pre-registered and good for tests.
+The SDK ships the kernel only. Pick an LLM backend by adding a provider package — `@namzu/anthropic`, `@namzu/openai`, `@namzu/ollama`, `@namzu/bedrock`, `@namzu/openrouter`, `@namzu/lmstudio`, or the zero-dep `@namzu/http`. The kernel alone runs against `MockLLMProvider`, which is pre-registered and scriptable — pass `turns` to script tool calls, failures and mid-stream errors. See [Testing Agents](../../docs/sdk/runtime/testing.md).
 
 ## Quick Start
 
@@ -426,19 +427,15 @@ Namzu is not a toy. It is meant for real workloads.
 
 ## Quality Bar
 
-On architectural fundamentals, Namzu scores at the top of open-source agent frameworks.
-
-| Criterion | Namzu | LangChain/LangGraph | CrewAI | OpenAI Agents SDK | Vercel AI SDK |
-|---|---|---|---|---|---|
-| Type Safety | 9 | 5 | 7 | 7 | 9 |
-| Modularity | 9 | 5 | 7 | 8 | 9 |
-| Interface Segregation | 8 | 4 | 6 | 8 | 8 |
-| Extensibility | 9 | 7 | 6 | 6 | 7 |
-| Convention Consistency | 8 | 5 | 7 | 8 | 8 |
-| Dependency Direction | 9 | 4 | 6 | 8 | 8 |
-| **Overall** | **8.7** | **5.0** | **6.5** | **7.5** | **8.2** |
+The architectural bar this kernel holds itself to is written down in
+its own terms: dependency direction is one-way and enforced, every
+public type has a producer and a consumer, a control that cannot be
+enforced is refused rather than downgraded, and a gate says which way
+it fails. Those are checkable in the source, which is the only kind of
+claim worth making.
 
-Scores are informed from public docs, community reports, and direct codebase analysis — not a definitive ranking. Where we know we have work to do: test coverage is not where the architecture deserves. Helping close that gap is the highest-leverage contribution today.
+Where the work is: test coverage is not yet where the architecture
+deserves. Closing that gap is the highest-leverage contribution today.
 
 ---
 
@@ -449,7 +446,6 @@ Honest view. The kernel is already deep. The next three releases tighten the con
 ### v0.2 — Surface Polish (short, mostly wiring + docs)
 
 - `Run.replay(runId, { fromCheckpoint })` API on top of the existing checkpoint store
-- Memory promotion pipeline connecting compaction output to the indexed memory store via a Reflector persona
 - **AEP v1 spec** — version and document the event shapes in `bridge/sse/mapper.ts`
 - Public pattern docs for lifecycle, checkpoints, emergency save, budget / quota, verification gate, context cache, file ownership, and circuit breaker
 - `ContextCache` generalized across providers (OpenRouter today → Anthropic, Bedrock next)

package/dist/__tests__/default-path-conformance.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=default-path-conformance.test.d.ts.map

package/dist/__tests__/default-path-conformance.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-path-conformance.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/default-path-conformance.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/default-path-conformance.test.js

@@ -0,0 +1,262 @@
+import { describe, expect, it, vi } from 'vitest';
+import { findDanglingMessages } from '../compaction/dangling.js';
+import { MockLLMProvider } from '../provider/mock.js';
+import { ToolExecutor } from '../runtime/query/executor.js';
+import { IterationOrchestrator } from '../runtime/query/iteration/index.js';
+import { ActivityStore } from '../store/activity/memory.js';
+import { VerificationGate } from '../verification/gate.js';
+/**
+ * The loop driven the way the SHIPPED CLI drives it, with a human who says
+ * no.
+ *
+ * This is the test that was missing. Every P0 in the hardening audit was a
+ * defect on the default path, and every one of them was invisible because
+ * the existing tests configured their way around it — the SDK default
+ * `autoApproveHandler` means CI never once saw a rejection, so "every
+ * decline kills the run" shipped and stayed shipped. The CLI wires a real
+ * permission prompt straight onto `reject_tools`, so a user declining a
+ * tool was the first thing to hit it.
+ *
+ * The assertion is deliberately end-state rather than mechanism: after the
+ * turn, is the conversation still something a provider would accept?
+ */
+const RUN_ID = 'run_conformance';
+/** The CLI's gate, verbatim in shape: read-only allowed, dangerous denied. */
+const CLI_GATE = {
+    enabled: true,
+    rules: [],
+    allowReadOnlyTools: true,
+    denyDangerousPatterns: true,
+    logDecisions: false,
+};
+function makeLogger() {
+    const stub = { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() };
+    return { ...stub, child: vi.fn(() => ({ ...stub, child: vi.fn() })) };
+}
+function harness(opts) {
+    const messages = [];
+    const executed = [];
+    let iteration = 0;
+    let stopReason;
+    const log = makeLogger();
+    const defs = { read: true, bash: false, ls: true };
+    const tools = {
+        get: vi.fn((name) => ({
+            name,
+            category: defs[name] ? 'filesystem' : 'shell',
+            isReadOnly: () => defs[name] === true,
+            isDestructive: () => defs[name] !== true,
+            isConcurrencySafe: () => defs[name] === true,
+        })),
+        execute: vi.fn(async (name) => {
+            executed.push(name);
+            return { success: true, output: `${name} ok` };
+        }),
+        has: vi.fn(() => true),
+        listNames: vi.fn(() => Object.keys(defs)),
+        getAvailability: vi.fn(() => 'active'),
+        toLLMTools: vi.fn(() => []),
+        register: vi.fn(),
+        unregister: vi.fn(),
+    };
+    const activityStore = new ActivityStore(RUN_ID, {
+        enabled: false,
+        trackToolCalls: false,
+        trackLlmTurns: false,
+    });
+    const runMgr = {
+        id: RUN_ID,
+        messages,
+        tokenUsage: {
+            promptTokens: 0,
+            completionTokens: 0,
+            totalTokens: 0,
+            cachedTokens: 0,
+            cacheWriteTokens: 0,
+        },
+        costInfo: { inputCostPer1M: 0, outputCostPer1M: 0, totalCost: 0, cacheDiscount: 0 },
+        get currentIteration() {
+            return iteration;
+        },
+        incrementIteration: () => ++iteration,
+        pushMessage: (m) => {
+            messages.push(m);
+        },
+        recordTurnUsage: vi.fn(),
+        accumulateUsage: vi.fn(),
+        clearLastPromptTokens: vi.fn(),
+        lastPromptTokens: undefined,
+        setStopReason: (r) => {
+            stopReason = r;
+        },
+        setStructuredOutput: vi.fn(),
+        markCancelled: vi.fn(),
+    };
+    const orchestrator = new IterationOrchestrator({
+        provider: new MockLLMProvider({ turns: opts.turns }),
+        // The CLI's runConfig shape: a huge cumulative budget and a model id.
+        runConfig: { model: 'claude-opus-5', maxIterations: 50, tokenBudget: 1_000_000 },
+        tools,
+        runMgr,
+        toolExecutor: new ToolExecutor({
+            tools,
+            runId: RUN_ID,
+            workingDirectory: '/tmp',
+            permissionMode: 'auto',
+            env: {},
+            abortSignal: new AbortController().signal,
+        }, activityStore, async () => { }, log),
+        activityStore,
+        abortController: new AbortController(),
+        log,
+        emitEvent: async () => { },
+        drainPending: function* () { },
+        checkpointMgr: { create: async () => ({ id: 'cp_1' }) },
+        planManager: { active: undefined },
+        // The CLI's permission prompt resolves to exactly this.
+        resumeHandler: async () => opts.decision,
+        verificationGate: new VerificationGate(CLI_GATE, log),
+        guard: {
+            beforeIteration: () => ({
+                shouldStop: iteration >= 4,
+                forceFinalize: false,
+                isCancelled: false,
+                stopReason: 'max_iterations',
+            }),
+        },
+    });
+    return { orchestrator, messages, executed, stopReason: () => stopReason };
+}
+async function drain(o) {
+    const gen = o.runLoop();
+    let next = await gen.next();
+    while (!next.done)
+        next = await gen.next();
+}
+/**
+ * The only question that matters: could the next provider request be sent?
+ *
+ * An unanswered `tool_use` is a protocol violation — the wire replies
+ * `400 messages.N: Did not find 1 tool_result block(s)` — and with no
+ * provider retry that ends the run.
+ */
+function expectSendableHistory(messages) {
+    const dangling = findDanglingMessages(messages);
+    expect(dangling.assistantsWithUnmatchedCalls).toEqual([]);
+    expect(dangling.orphanedToolMessages).toEqual([]);
+    expect(dangling.isValid).toBe(true);
+}
+const READ_THEN_ANSWER = [
+    { toolCalls: [{ name: 'read', args: { path: 'a.txt' } }] },
+    { text: 'Here is what I found.' },
+];
+describe('the invariant check itself has teeth', () => {
+    // Running the tests above against the pre-fix `tool-review.ts` makes them
+    // crash on a shape change rather than fail on the assertion, which proves
+    // incompatibility but not detection. So reproduce the exact history the
+    // old code produced and show the check rejects it. Without this, a future
+    // regression could weaken `expectSendableHistory` into something that
+    // passes everything.
+    it('rejects the history the old rejection path produced', () => {
+        const brokenHistory = [
+            { role: 'user', content: 'delete everything' },
+            {
+                role: 'assistant',
+                content: null,
+                toolCalls: [
+                    { id: 'call_0', type: 'function', function: { name: 'bash', arguments: '{}' } },
+                ],
+            },
+            // What the four broken branches pushed instead of a tool_result.
+            { role: 'user', content: '[SYSTEM] Tool calls rejected: no' },
+        ];
+        const dangling = findDanglingMessages(brokenHistory);
+        expect(dangling.isValid).toBe(false);
+        expect(dangling.assistantsWithUnmatchedCalls).toEqual([1]);
+        expect(() => expectSendableHistory(brokenHistory)).toThrow();
+    });
+    it('accepts the same turn once the call is answered', () => {
+        const repaired = [
+            { role: 'user', content: 'delete everything' },
+            {
+                role: 'assistant',
+                content: null,
+                toolCalls: [
+                    { id: 'call_0', type: 'function', function: { name: 'bash', arguments: '{}' } },
+                ],
+            },
+            { role: 'tool', toolCallId: 'call_0', content: 'Error: refused', isError: true },
+        ];
+        expect(() => expectSendableHistory(repaired)).not.toThrow();
+    });
+});
+describe('the CLI default path survives a human saying no', () => {
+    it('a plain rejection leaves a conversation the provider would accept', async () => {
+        const h = harness({
+            decision: { action: 'reject_tools', feedback: 'Do not read that file.' },
+            turns: [
+                { toolCalls: [{ name: 'bash', args: { command: 'ls -la' } }] },
+                { text: 'Understood.' },
+            ],
+        });
+        await drain(h.orchestrator);
+        expectSendableHistory(h.messages);
+        expect(h.executed).toEqual([]);
+        // And the feedback actually reached the model, in the slot it reads.
+        expect(h.messages.some((m) => String(m.content).includes('Do not read that file'))).toBe(true);
+    });
+    it('a gate denial leaves a conversation the provider would accept', async () => {
+        const h = harness({
+            decision: { action: 'approve_tools' },
+            turns: [
+                // `rm -rf /` trips deny_dangerous_patterns in the CLI's gate.
+                { toolCalls: [{ name: 'bash', args: { command: 'rm -rf /' } }] },
+                { text: 'I will not do that.' },
+            ],
+        });
+        await drain(h.orchestrator);
+        expectSendableHistory(h.messages);
+        expect(h.executed).toEqual([]);
+    });
+    it('a human approval cannot release a call the gate denied', async () => {
+        const h = harness({
+            decision: { action: 'approve_tools' },
+            turns: [
+                {
+                    toolCalls: [
+                        { name: 'read', args: { path: 'a.txt' } },
+                        { name: 'bash', args: { command: 'rm -rf /' } },
+                    ],
+                },
+                { text: 'Done what I could.' },
+            ],
+        });
+        await drain(h.orchestrator);
+        // The gate's decision is the floor; approval covers only what it left
+        // undecided.
+        expect(h.executed).toEqual(['read']);
+        expectSendableHistory(h.messages);
+    });
+    it('a partial deny answers the denied call too', async () => {
+        const h = harness({
+            decision: {
+                action: 'modify_tools',
+                modifications: [{ toolCallId: 'call_0_1', action: 'deny' }],
+            },
+            turns: [
+                { toolCalls: [{ name: 'ls' }, { name: 'bash', args: { command: 'echo hi' } }] },
+                { text: 'ok' },
+            ],
+        });
+        await drain(h.orchestrator);
+        expectSendableHistory(h.messages);
+    });
+    it('the approving path is unaffected', async () => {
+        const h = harness({ decision: { action: 'approve_tools' }, turns: READ_THEN_ANSWER });
+        await drain(h.orchestrator);
+        expect(h.executed).toEqual(['read']);
+        expect(h.stopReason()).toBe('end_turn');
+        expectSendableHistory(h.messages);
+    });
+});
+//# sourceMappingURL=default-path-conformance.test.js.map

package/dist/__tests__/default-path-conformance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-path-conformance.test.js","sourceRoot":"","sources":["../../src/__tests__/default-path-conformance.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAA;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAQ3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;;;;;;;;;;;;;GAcG;AAEH,MAAM,MAAM,GAAG,iBAA0B,CAAA;AAEzC,8EAA8E;AAC9E,MAAM,QAAQ,GAA2B;IACxC,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,kBAAkB,EAAE,IAAI;IACxB,qBAAqB,EAAE,IAAI;IAC3B,YAAY,EAAE,KAAK;CACnB,CAAA;AAED,SAAS,UAAU;IAClB,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;IAC7E,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAuB,CAAA;AAC3F,CAAC;AAED,SAAS,OAAO,CAAC,IAAwD;IACxE,MAAM,QAAQ,GAAc,EAAE,CAAA;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,UAA8B,CAAA;IAClC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;IAExB,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAE3E,MAAM,KAAK,GAAG;QACb,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO;YAC7C,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;YACrC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;YACxC,iBAAiB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;SAC5C,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;YACrC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,KAAK,EAAE,CAAA;QAC/C,CAAC,CAAC;QACF,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACtB,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC;QACtC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC3B,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;QACjB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;KACgB,CAAA;IAEpC,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE;QAC/C,OAAO,EAAE,KAAK;QACd,cAAc,EAAE,KAAK;QACrB,aAAa,EAAE,KAAK;KACpB,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG;QACd,EAAE,EAAE,MAAM;QACV,QAAQ;QACR,UAAU,EAAE;YACX,YAAY,EAAE,CAAC;YACf,gBAAgB,EAAE,CAAC;YACnB,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,gBAAgB,EAAE,CAAC;SACnB;QACD,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;QACnF,IAAI,gBAAgB;YACnB,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS;QACrC,WAAW,EAAE,CAAC,CAAU,EAAE,EAAE;YAC3B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QACD,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;QACxB,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;QACxB,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;QAC9B,gBAAgB,EAAE,SAAS;QAC3B,aAAa,EAAE,CAAC,CAAS,EAAE,EAAE;YAC5B,UAAU,GAAG,CAAC,CAAA;QACf,CAAC;QACD,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;QAC5B,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;KACtB,CAAA;IAED,MAAM,YAAY,GAAG,IAAI,qBAAqB,CAAC;QAC9C,QAAQ,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAc,EAAE,CAAC;QAC7D,sEAAsE;QACtE,SAAS,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;QAChF,KAAK;QACL,MAAM;QACN,YAAY,EAAE,IAAI,YAAY,CAC7B;YACC,KAAK;YACL,KAAK,EAAE,MAAM;YACb,gBAAgB,EAAE,MAAM;YACxB,cAAc,EAAE,MAAM;YACtB,GAAG,EAAE,EAAE;YACP,WAAW,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM;SACzC,EACD,aAAa,EACb,KAAK,IAAI,EAAE,GAAE,CAAC,EACd,GAAG,CACH;QACD,aAAa;QACb,eAAe,EAAE,IAAI,eAAe,EAAE;QACtC,GAAG;QACH,SAAS,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACzB,YAAY,EAAE,QAAQ,CAAC,MAA0B,CAAC;QAClD,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE;QACvD,WAAW,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAClC,wDAAwD;QACxD,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ;QACxC,gBAAgB,EAAE,IAAI,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC;QACrD,KAAK,EAAE;YACN,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;gBACvB,UAAU,EAAE,SAAS,IAAI,CAAC;gBAC1B,aAAa,EAAE,KAAK;gBACpB,WAAW,EAAE,KAAK;gBAClB,UAAU,EAAE,gBAAgB;aAC5B,CAAC;SACF;KACQ,CAAC,CAAA;IAEX,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAA;AAC1E,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,CAAwB;IAC5C,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAA;IACvB,IAAI,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;IAC3B,OAAO,CAAC,IAAI,CAAC,IAAI;QAAE,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,QAAmB;IACjD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzD,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,gBAAgB,GAAG;IACxB,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE;IAC1D,EAAE,IAAI,EAAE,uBAAuB,EAAE;CACjC,CAAA;AAED,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACrD,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,qBAAqB;IACrB,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC9D,MAAM,aAAa,GAAc;YAChC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE;YAC9C;gBACC,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE;oBACV,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;iBAC/E;aACD;YACD,iEAAiE;YACjE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE;SAC7D,CAAA;QAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAA;QACpD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC1D,MAAM,QAAQ,GAAc;YAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE;YAC9C;gBACC,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE;oBACV,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;iBAC/E;aACD;YACD,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE;SAChF,CAAA;QAED,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IAC5D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAChE,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,CAAC,GAAG,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,wBAAwB,EAAE;YACxE,KAAK,EAAE;gBACN,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE;gBAC9D,EAAE,IAAI,EAAE,aAAa,EAAE;aACvB;SACD,CAAC,CAAA;QAEF,MAAM,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QAE3B,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACjC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC9B,qEAAqE;QACrE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,CAAC,GAAG,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;YACrC,KAAK,EAAE;gBACN,8DAA8D;gBAC9D,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE;gBAChE,EAAE,IAAI,EAAE,qBAAqB,EAAE;aAC/B;SACD,CAAC,CAAA;QAEF,MAAM,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QAE3B,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACjC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,CAAC,GAAG,OAAO,CAAC;YACjB,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;YACrC,KAAK,EAAE;gBACN;oBACC,SAAS,EAAE;wBACV,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;wBACzC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE;qBAC/C;iBACD;gBACD,EAAE,IAAI,EAAE,oBAAoB,EAAE;aAC9B;SACD,CAAC,CAAA;QAEF,MAAM,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QAE3B,sEAAsE;QACtE,aAAa;QACb,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QACpC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,CAAC,GAAG,OAAO,CAAC;YACjB,QAAQ,EAAE;gBACT,MAAM,EAAE,cAAc;gBACtB,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;aACrC;YACvB,KAAK,EAAE;gBACN,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE;gBAC/E,EAAE,IAAI,EAAE,IAAI,EAAE;aACd;SACD,CAAC,CAAA;QAEF,MAAM,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QAE3B,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;QAErF,MAAM,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QAE3B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACvC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/__tests__/shipped-defaults.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=shipped-defaults.test.d.ts.map

package/dist/__tests__/shipped-defaults.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shipped-defaults.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/shipped-defaults.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/shipped-defaults.test.js

@@ -0,0 +1,97 @@
+import { describe, expect, it } from 'vitest';
+import { DEFAULT_ASSUMED_CONTEXT_WINDOW, resolveContextWindow, } from '../compaction/context-window.js';
+import { DEFAULT_MCP_REQUEST_TIMEOUT_MS } from '../constants/mcp/index.js';
+import { DEFAULT_STRUCTURED_OUTPUT_RETRIES } from '../constants/tools/index.js';
+import { MOCK_CAPABILITIES } from '../provider/mock-register.js';
+import { DEFAULT_PROVIDER_RETRY } from '../provider/retry.js';
+import { DEFAULT_TOOL_CONCURRENCY, DEFAULT_TOOL_TIMEOUT_MS } from '../runtime/query/executor.js';
+import { DEFAULT_MAX_TOOL_OUTPUT_CHARS } from '../runtime/query/tool-output-budget.js';
+/**
+ * A conformance test over the SHIPPED DEFAULTS.
+ *
+ * Every P0 in the hardening audit was a defect in what namzu does out of the
+ * box, masked by a non-default test path: `autoApproveHandler` hid the
+ * dangling-`tool_use` bug, the CLI's `tokenBudget: 1_000_000` hid the
+ * compaction trigger, and `MOCK_CAPABILITIES.supportsTools: false` meant no
+ * consumer could reach the tool loop at all. Each was individually tested
+ * and each was individually wrong, because the tests configured their way
+ * out of the default.
+ *
+ * So this file asserts the defaults themselves. It is deliberately boring:
+ * the value of a default is that it does not drift, and a number changing
+ * here should be a decision someone made, not a side effect of a refactor.
+ * Every expectation carries the reason the value is what it is.
+ */
+describe('a run cannot hang', () => {
+    it('tools have a deadline, and it is survivable rather than generous', () => {
+        // bash defaulted to ONE HOUR while ignoring Stop entirely.
+        expect(DEFAULT_TOOL_TIMEOUT_MS).toBe(120_000);
+        expect(DEFAULT_TOOL_TIMEOUT_MS).toBeLessThanOrEqual(5 * 60_000);
+    });
+    it('MCP round trips have a deadline', () => {
+        // stdio — the default transport for local servers — armed no timer at
+        // all, so a wedged server hung the run with no error and no run_failed.
+        expect(DEFAULT_MCP_REQUEST_TIMEOUT_MS).toBeGreaterThan(0);
+        expect(DEFAULT_MCP_REQUEST_TIMEOUT_MS).toBeLessThanOrEqual(60_000);
+    });
+    it('tool fan-out is bounded', () => {
+        // `Promise.all` over an unbounded batch: fifty parallel reads opened
+        // fifty handles and fifty activity records at once.
+        expect(DEFAULT_TOOL_CONCURRENCY).toBeGreaterThan(0);
+        expect(DEFAULT_TOOL_CONCURRENCY).toBeLessThanOrEqual(16);
+    });
+});
+describe('a run cannot be killed by one bad response', () => {
+    it('transient provider failures are retried by default', () => {
+        // A single 429 or 503 used to terminate a run outright.
+        expect(DEFAULT_PROVIDER_RETRY.maxRetries).toBeGreaterThan(0);
+    });
+    it('backoff is bounded on both ends', () => {
+        expect(DEFAULT_PROVIDER_RETRY.initialDelayMs).toBeGreaterThan(0);
+        expect(DEFAULT_PROVIDER_RETRY.maxDelayMs).toBeGreaterThan(DEFAULT_PROVIDER_RETRY.initialDelayMs);
+        // A server asking for 15 minutes must not silently park an
+        // interactive run for 15 minutes.
+        expect(DEFAULT_PROVIDER_RETRY.maxRetryAfterMs).toBeLessThanOrEqual(120_000);
+    });
+});
+describe('a run cannot blow its own context', () => {
+    it('tool output is capped, and the cap is a fraction of a small window', () => {
+        // `read` returned whole files, `bash` allowed a 100 MB buffer: a 2 MB
+        // lockfile became ~500k tokens in one tool_result.
+        expect(DEFAULT_MAX_TOOL_OUTPUT_CHARS).toBeGreaterThan(0);
+        // ~4 chars/token; one result must not be able to eat a fifth of a
+        // 200k window.
+        expect(DEFAULT_MAX_TOOL_OUTPUT_CHARS / 4).toBeLessThan(200_000 / 5);
+    });
+    it('compaction always resolves a real window, never a spend budget', () => {
+        // The trigger divided by `runConfig.tokenBudget` — a cumulative spend
+        // cap — whenever `contextWindowTokens` was absent, which was always.
+        for (const model of [undefined, '', 'totally-unknown-model', 'claude-opus-5', 'gpt-4']) {
+            const resolved = resolveContextWindow(undefined, model);
+            expect(resolved.tokens).toBeGreaterThan(0);
+            expect(resolved.source).not.toBe('config');
+        }
+    });
+    it('the unknown-model fallback is conservative, not optimistic', () => {
+        // Under-estimating costs a summarization pass. Over-estimating kills
+        // the run on a provider context-length error with nothing recoverable.
+        expect(DEFAULT_ASSUMED_CONTEXT_WINDOW).toBeLessThanOrEqual(200_000);
+    });
+});
+describe('a run cannot loop on a demand the model will not meet', () => {
+    it('structured-output re-prompts are bounded well below the iteration cap', () => {
+        expect(DEFAULT_STRUCTURED_OUTPUT_RETRIES).toBeGreaterThan(0);
+        // The shipped `maxIterations` default is 200; this must fail fast.
+        expect(DEFAULT_STRUCTURED_OUTPUT_RETRIES).toBeLessThan(10);
+    });
+});
+describe('the shipped test model can exercise the tool loop', () => {
+    it('declares tool support', () => {
+        // `supportsTools: false` made capability negotiation strip the tool
+        // surface before a request was built, so no consumer could test that
+        // the loop calls their tool — and namzu hand-rolled eight fakes.
+        expect(MOCK_CAPABILITIES.supportsTools).toBe(true);
+        expect(MOCK_CAPABILITIES.supportsFunctionCalling).toBe(true);
+    });
+});
+//# sourceMappingURL=shipped-defaults.test.js.map

package/dist/__tests__/shipped-defaults.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shipped-defaults.test.js","sourceRoot":"","sources":["../../src/__tests__/shipped-defaults.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EACN,8BAA8B,EAC9B,oBAAoB,GACpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAA;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAA;AAEtF;;;;;;;;;;;;;;;GAeG;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC3E,2DAA2D;QAC3D,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,CAAC,uBAAuB,CAAC,CAAC,mBAAmB,CAAC,CAAC,GAAG,MAAM,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC1C,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,CAAC,8BAA8B,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACzD,MAAM,CAAC,8BAA8B,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QAClC,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,CAAC,wBAAwB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACnD,MAAM,CAAC,wBAAwB,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC7D,wDAAwD;QACxD,MAAM,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QAChE,MAAM,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAA;QAChG,2DAA2D;QAC3D,kCAAkC;QAClC,MAAM,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,sEAAsE;QACtE,mDAAmD;QACnD,MAAM,CAAC,6BAA6B,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACxD,kEAAkE;QAClE,eAAe;QACf,MAAM,CAAC,6BAA6B,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACzE,sEAAsE;QACtE,qEAAqE;QACrE,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,uBAAuB,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC;YACxF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YACvD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;YAC1C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC3C,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,CAAC,8BAA8B,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,iCAAiC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QAC5D,mEAAmE;QACnE,MAAM,CAAC,iCAAiC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAClE,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAChC,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClD,MAAM,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/advisory/__tests__/budget-enforcement.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=budget-enforcement.test.d.ts.map

package/dist/advisory/__tests__/budget-enforcement.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget-enforcement.test.d.ts","sourceRoot":"","sources":["../../../src/advisory/__tests__/budget-enforcement.test.ts"],"names":[],"mappings":""}