@namzu/sdk 26.1.0 → 27.0.0

package/dist/types/tool/index.d.ts

@@ -303,6 +303,34 @@ export interface ToolDefinition<TInput = unknown> {
     isReadOnly?(input: TInput): boolean;
     isDestructive?(input: TInput): boolean;
     isConcurrencySafe?(input: TInput): boolean;
+    /**
+     * Where this tool came from, when it did not come from here.
+     *
+     * Absent means host-defined: this process, code the operator installed,
+     * no untrusted party in the chain. Present means a connected server
+     * supplied both the tool and its own description of what the tool does
+     * — including whether it is read-only, which three separate gates were
+     * treating as a fact rather than as the hint the wire calls it.
+     *
+     * See {@link isTrustedReadOnly}. This field exists so a gate can tell
+     * the two apart; `isReadOnly` keeps reporting faithfully what the
+     * server said, because the outbound re-export and the destructive
+     * label shown to a human both need the server's own answer.
+     */
+    provenance?: ToolProvenance;
+}
+export interface ToolProvenance {
+    /** The connected server this tool came from, named as configured. */
+    readonly server: string;
+    /**
+     * The operator marked this server's read-only claims as trustworthy.
+     *
+     * Per server, never global: one switch meaning "trust annotations"
+     * hands every connected server the same reach, which is the hole it
+     * would be closing. Default false — an unmarked server's claim raises
+     * the requirement and never lowers it.
+     */
+    readonly readOnlyHintTrusted: boolean;
 }
 export type ToolPermission = 'file_read' | 'file_write' | 'shell_execute' | 'network_access' | 'env_access';
 export interface LLMToolSchema {

package/dist/types/tool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/tool/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,MAAM,WAAW,eAAe;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAC/C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;OAIG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAC7B;;;;;;;;;OASG;IACH,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAC7C;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAChC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACzB;IACA,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACrB,GACD;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAA;AAEjC,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAEvF,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAChE,iBAAiB,CAAC,EAAE;QACnB,IAAI,EAAE,cAAc,CAAA;QACpB,KAAK,EAAE,MAAM,CAAA;QACb,gBAAgB,EAAE,MAAM,CAAA;KACxB,CAAA;IAED,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAE/B;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,oBAAoB,EAAE,IAAI,CAAA;IAE9C;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CACrD;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,iBAAiB,CAAA;IAEzD;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACrD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAErE;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtC,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1C;AAED,MAAM,MAAM,cAAc,GACvB,WAAW,GACX,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,YAAY,CAAA;AAEf,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,CAAA;CACD;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAA;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE5E,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,MAAM,CAAA;IAC1D,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,cAAc,CAAA;CAC3B;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACtD,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;IAChD,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACrE,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAExE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/B,KAAK,IAAI,IAAI,CAAA;IAEb,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAA;IAC7C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;IACxC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1B,MAAM,IAAI,cAAc,EAAE,CAAA;IAC1B,OAAO,IAAI,MAAM,EAAE,CAAA;IACnB,SAAS,IAAI,MAAM,EAAE,CAAA;IAErB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC5B,UAAU,IAAI,IAAI,CAAA;IAClB,YAAY,IAAI,OAAO,CAAA;IACvB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAA;IAExD,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAEhG,IAAI,IAAI,MAAM,CAAA;IAEd,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAA;IACjD,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAC7C,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;CAClD;AAED,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/tool/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,MAAM,WAAW,eAAe;IAC/B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAC/C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;OAIG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAC7B;;;;;;;;;OASG;IACH,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAC7C;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAChC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACzB;IACA,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACrB,GACD;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAA;AAEjC,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAEvF,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,KAAK,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,WAAW,CAAA;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAChE,iBAAiB,CAAC,EAAE;QACnB,IAAI,EAAE,cAAc,CAAA;QACpB,KAAK,EAAE,MAAM,CAAA;QACb,gBAAgB,EAAE,MAAM,CAAA;KACxB,CAAA;IAED,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAE/B;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,oBAAoB,EAAE,IAAI,CAAA;IAE9C;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CACrD;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,iBAAiB,CAAA;IAEzD;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACrD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1C;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAErE;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAElB;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACnC,aAAa,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IACtC,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;IAE1C;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;CAC3B;AAED,MAAM,WAAW,cAAc;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;CACrC;AAED,MAAM,MAAM,cAAc,GACvB,WAAW,GACX,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,YAAY,CAAA;AAEf,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KACnC,CAAA;CACD;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAA;AAElE,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE5E,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,kBAAkB,EAAE,CAAA;IAC3B,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,MAAM,CAAA;IAC1D,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,cAAc,CAAA;CAC3B;AAED,MAAM,WAAW,mBAAoB,SAAQ,UAAU;IACtD,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,IAAI,CAAA;IAChD,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACrE,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;IAExE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/B,KAAK,IAAI,IAAI,CAAA;IAEb,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAA;IAC7C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;IACxC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1B,MAAM,IAAI,cAAc,EAAE,CAAA;IAC1B,OAAO,IAAI,MAAM,EAAE,CAAA;IACnB,SAAS,IAAI,MAAM,EAAE,CAAA;IAErB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC5B,UAAU,IAAI,IAAI,CAAA;IAClB,YAAY,IAAI,OAAO,CAAA;IACvB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/C,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAA;IAExD,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAEhG,IAAI,IAAI,MAAM,CAAA;IAEd,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAA;IACjD,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAC7C,cAAc,IAAI,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;CAClD;AAED,cAAc,aAAa,CAAA"}

package/dist/types/tool/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/tool/index.ts"],"names":[],"mappings":"AAsZA,cAAc,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/tool/index.ts"],"names":[],"mappings":"AAobA,cAAc,aAAa,CAAA"}

package/dist/verification/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/verification/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEpF,wBAAgB,YAAY,CAC3B,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,eAAe,CAAC,EAAE,MAAM,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACnB,YAAY,GAAG,IAAI,CA8FrB"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/verification/rules.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEpF,wBAAgB,YAAY,CAC3B,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,eAAe,CAAC,EAAE,MAAM,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACnB,YAAY,GAAG,IAAI,CAiGrB"}

package/dist/verification/rules.js

@@ -1,8 +1,12 @@
 import { DANGEROUS_PATTERNS } from '../constants/tools/index.js';
+import { isTrustedReadOnly } from '../tools/trusted-read-only.js';
 export function evaluateRule(rule, toolName, toolInput, toolDef, compiledPattern, nameSet) {
     switch (rule.type) {
         case 'allow_read_only': {
-            return toolDef?.isReadOnly?.(toolInput) ? 'allow' : null;
+            // A server's own claim about its own tool cannot settle this. See
+            // `isTrustedReadOnly`: a self-declaration may raise the requirement
+            // and never lower it.
+            return isTrustedReadOnly(toolDef, toolInput) ? 'allow' : null;
         }
         case 'deny_dangerous_patterns': {
             const serialized = JSON.stringify(toolInput);

package/dist/verification/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/verification/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAIhE,MAAM,UAAU,YAAY,CAC3B,IAAsB,EACtB,QAAgB,EAChB,SAAkB,EAClB,OAAmC,EACnC,eAAwB,EACxB,OAAqB;IAErB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,OAAO,OAAO,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACzD,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAA;gBACd,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACrB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YAEjC,IAAI,MAAc,CAAA;YAClB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACV,MAAM,GAAG,QAAQ,CAAA;oBACjB,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBAClC,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;oBACnD,MAAK;gBACN,OAAO,CAAC,CAAC,CAAC;oBACT,MAAM,WAAW,GAAU,IAAI,CAAC,MAAM,CAAA;oBACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAqB,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3D,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YACjC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACpE,MAAM,KAAK,GAAI,SAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAEnE,oEAAoE;YACpE,iEAAiE;YACjE,2DAA2D;YAC3D,EAAE;YACF,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,OAAO,GACZ,OAAO,KAAK,KAAK,QAAQ;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;oBACxD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACf,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAEtC,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5D,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,IAAI,CAAA;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAsC,WAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/F,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/verification/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAIjE,MAAM,UAAU,YAAY,CAC3B,IAAsB,EACtB,QAAgB,EAChB,SAAkB,EAClB,OAAmC,EACnC,eAAwB,EACxB,OAAqB;IAErB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,kEAAkE;YAClE,oEAAoE;YACpE,sBAAsB;YACtB,OAAO,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9D,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAA;gBACd,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACrB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YAEjC,IAAI,MAAc,CAAA;YAClB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACV,MAAM,GAAG,QAAQ,CAAA;oBACjB,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBAClC,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;oBACnD,MAAK;gBACN,OAAO,CAAC,CAAC,CAAC;oBACT,MAAM,WAAW,GAAU,IAAI,CAAC,MAAM,CAAA;oBACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAqB,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3D,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YACjC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACpE,MAAM,KAAK,GAAI,SAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAEnE,oEAAoE;YACpE,iEAAiE;YACjE,2DAA2D;YAC3D,EAAE;YACF,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,OAAO,GACZ,OAAO,KAAK,KAAK,QAAQ;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;oBACxD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACf,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAEtC,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5D,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,IAAI,CAAA;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAsC,WAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/F,CAAC;IACF,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/sdk",
-  "version": "26.1.0",
+  "version": "27.0.0",
   "description": "Open-source AI agent SDK with a built-in runtime. Nothing between you and your agents.",
   "license": "FSL-1.1-MIT",
   "type": "module",

package/src/compaction/manager.ts

@@ -47,8 +47,30 @@ export class WorkingStateManager {
 		this.pushWithEviction('decisions', this.state.decisions, decision, this.config.maxListSize)
 	}
 
+	/**
+	 * Failures evict OLDEST-first, unlike every other slot here.
+	 *
+	 * `keepFirstEntries` exists because early decisions are load-bearing —
+	 * the one that set the run's approach outlives twenty-five incidental
+	 * notes. That reasoning is right for decisions and backwards for
+	 * failures: the earliest failure is the one the model has most likely
+	 * already worked around, and the recent one is the thing it reads to
+	 * decide what to do differently.
+	 *
+	 * It also matters more than a preference. Sinha et al.,
+	 * "The Illusion of Diminishing Returns" (arXiv:2509.09677), inject
+	 * errors into a model's own history at controlled rates and measure
+	 * accuracy far later in the run: conditioning a model on its own
+	 * error-prone history raises the likelihood of further errors, and
+	 * scaling does not rescue it. So a permanently-protected early failure
+	 * is not neutral ballast — it is the input that paper measures.
+	 *
+	 * Nothing here decided failures should keep their oldest entries; the
+	 * behaviour was inherited from a shared helper written for a slot where
+	 * it is correct.
+	 */
 	addFailure(failure: string): void {
-		this.pushWithEviction('failures', this.state.failures, failure, this.config.maxListSize)
+		this.pushWithEviction('failures', this.state.failures, failure, this.config.maxListSize, 0)
 	}
 
 	addDiscovery(discovery: string): void {
@@ -141,9 +163,23 @@ export class WorkingStateManager {
 	 * condenser uses. The eviction is counted so the serializer can say
 	 * something was dropped rather than presenting a gap as complete.
 	 */
-	private pushWithEviction(slot: string, list: string[], item: string, max: number): void {
+	private pushWithEviction(
+		slot: string,
+		list: string[],
+		item: string,
+		max: number,
+		/**
+		 * Entries to protect at the front. Defaults to the configured
+		 * `keepFirstEntries`; pass 0 for a slot where the early entries are
+		 * the ones to lose. See {@link addFailure}.
+		 */
+		keepFirstOverride?: number,
+	): void {
 		list.push(item)
-		const keepFirst = Math.min(this.config.keepFirstEntries, Math.max(0, max - 1))
+		const keepFirst = Math.min(
+			keepFirstOverride ?? this.config.keepFirstEntries,
+			Math.max(0, max - 1),
+		)
 		while (list.length > max) {
 			list.splice(keepFirst, 1)
 			this.state.evicted[slot] = (this.state.evicted[slot] ?? 0) + 1

package/src/connector/mcp/adapter.ts

@@ -419,6 +419,12 @@ export function mcpToolToToolDefinition(
 	tool: MCPToolDefinition,
 	client: MCPClient,
 	serverName: string,
+	/**
+	 * The operator marked this server's read-only claims trustworthy.
+	 * Default false: an unmarked server's claim raises the requirement and
+	 * never lowers it. See `isTrustedReadOnly`.
+	 */
+	readOnlyHintTrusted = false,
 ): ToolDefinition {
 	const inputSchema = mcpJsonSchemaToZod(tool.inputSchema)
 	const toolName = `mcp_${serverName}_${tool.name}`
@@ -436,9 +442,14 @@ export function mcpToolToToolDefinition(
 			: {}),
 		category: 'network',
 		permissions: ['network_access'],
+		// Reports what the SERVER said, faithfully. The outbound re-export
+		// and the destructive label a human is shown both need the server's
+		// own answer; whether a gate may act on it is decided separately, by
+		// `isTrustedReadOnly` reading `provenance` below.
 		isReadOnly: () => tool.annotations?.readOnlyHint ?? false,
 		isDestructive: () => tool.annotations?.destructiveHint ?? false,
 		isConcurrencySafe: () => true,
+		provenance: { server: serverName, readOnlyHintTrusted },
 
 		async execute(input: unknown, _context: ToolContext): Promise<ToolResult> {
 			const result = await client.callTool(tool.name, input as Record<string, unknown>)

package/src/connector/mcp/prompt-adapter.ts

@@ -34,10 +34,16 @@ import type { MCPClient } from './client.js'
 /**
  * Marks where a remote party's words begin and end.
  *
- * A prompt is composed by a SERVER. Untrusted content arriving through a
- * tool result is the standard prompt-injection surface, and the mitigation
- * that survives contact is saying plainly whose words these are — an
- * unlabelled block reads exactly like the agent's own instructions.
+ * A prompt is composed by a SERVER. Untrusted content arriving this way is
+ * the standard prompt-injection surface, and an unlabelled block reads
+ * exactly like the agent's own instructions — so this says whose words
+ * they are.
+ *
+ * Marking, not stopping. See `tools/untrusted-envelope.ts` for the
+ * measurement: delimiting reports near-zero attack success on a static
+ * benchmark and above 95% once the attacker adapts (arXiv:2510.09023).
+ * This paragraph used to call it "the mitigation that survives contact",
+ * which was the same overstatement in a second file.
  */
 export function renderPromptMessages(
 	serverName: string,

package/src/eval/experiment.ts

@@ -7,6 +7,8 @@ import type {
 	Score,
 	Scorer,
 } from './types.js'
+import type { ScoreUncertainty } from './uncertainty.js'
+import { describeUncertainty, uncertaintyOf } from './uncertainty.js'
 
 export interface ExperimentConfig<TInput = unknown> {
 	name: string
@@ -151,6 +153,10 @@ export async function runExperiment<TInput>(
 		name: config.name,
 		cases: settled,
 		mean,
+		// Over the same cases the mean is over. Computing spread across a
+		// different denominator than the average it qualifies would produce
+		// an interval that does not belong to the number beside it.
+		uncertainty: uncertaintyOf(scored.map((r) => r.mean)),
 		passed: settled.filter((r) => r.status === 'passed').length,
 		failed: settled.filter((r) => r.status === 'failed').length,
 		inconclusive: settled.filter((r) => r.status === 'inconclusive').length,
@@ -278,9 +284,33 @@ function meanByScorer(results: readonly CaseResult[]): Record<string, number> {
  * Failures print their scorer reasons, because a CI log that says
  * "0.62" is a log that sends someone back to reproduce it by hand.
  */
+/**
+ * Uncertainty for a report that did not carry its own.
+ *
+ * A suite file is loaded at runtime and may be plain JavaScript, so a
+ * report can reach here hand-built — the type cannot stop it. Deriving
+ * from the cases it does carry is better than either alternative:
+ * printing the mean alone leaves the reader where they started, and
+ * refusing to format would turn a missing convenience into a broken
+ * command.
+ *
+ * Uses the same exclusion `runExperiment` uses, so a derived interval and
+ * a carried one are the same number rather than two conventions.
+ */
+function derivedUncertainty(report: ExperimentReport): ScoreUncertainty {
+	return uncertaintyOf(report.cases.filter((c) => c.status !== 'inconclusive').map((c) => c.mean))
+}
+
 export function formatReport(report: ExperimentReport): string {
 	const lines: string[] = [
 		`${report.name}: ${report.passed}/${report.cases.length} passed (mean ${report.mean.toFixed(2)}) in ${report.durationMs}ms`,
+		// On its own line and always printed, including when the interval is
+		// undefined. A mean printed alone is the thing that has been
+		// over-read: two runs three points apart look like a difference, and
+		// at the n a hand-built suite has they are usually the same run
+		// twice. Computing the interval and not showing it would leave the
+		// reader exactly where they started.
+		`  ${describeUncertainty(report.mean, report.uncertainty ?? derivedUncertainty(report))}`,
 		'',
 	]
 

package/src/eval/index.ts

@@ -10,6 +10,8 @@ export {
 	stepBudgetScorer,
 	trajectoryScorer,
 } from './scorers.js'
+export { describeUncertainty, uncertaintyOf } from './uncertainty.js'
+export type { ScoreUncertainty } from './uncertainty.js'
 export type {
 	CaseResult,
 	CaseStatus,

package/src/eval/types.ts

@@ -1,4 +1,5 @@
 import type { StepResult } from '../types/run/step.js'
+import type { ScoreUncertainty } from './uncertainty.js'
 
 /**
  * One case in a dataset: an input, and what a good run looks like.
@@ -143,6 +144,22 @@ export interface ExperimentReport {
 	cases: readonly CaseResult[]
 	/** Mean score across the cases that produced one. */
 	mean: number
+	/**
+	 * How much of {@link mean} is signal.
+	 *
+	 * A mean on its own has been read as a result, and at the n a
+	 * hand-built suite has it usually is not one: two runs three points
+	 * apart are normally the same run twice.
+	 *
+	 * Optional, and deliberately so after trying it the other way. A suite
+	 * file is loaded at runtime and may be plain JavaScript, so a required
+	 * field is not enforced at the boundary that matters — it buys type
+	 * safety for one kind of consumer and a crash for the other. Producers
+	 * that go through `runExperiment` always set it; `formatReport` derives
+	 * it from {@link cases} when a hand-built report does not, so no report
+	 * is printed without an interval either way.
+	 */
+	uncertainty?: ScoreUncertainty
 	passed: number
 	failed: number
 	/** Cases where no scorer could produce a judgement. */

package/src/eval/uncertainty.ts

@@ -0,0 +1,124 @@
+/**
+ * How much of a score is signal.
+ *
+ * A suite reported a mean and nothing else, so two runs differing by three
+ * points read as a difference. At the n a hand-built suite has, that is
+ * usually noise, and there was no number on the page that would have said
+ * so.
+ *
+ * Evan Miller, "Adding Error Bars to Evals" (arXiv:2411.00640), is the
+ * reference. Two of its results shape what is and is not computed here.
+ */
+
+/**
+ * Two-sided 95% critical values of Student's t, by degrees of freedom.
+ *
+ * The normal approximation (1.96) is what most harnesses use and it is
+ * wrong in the direction that matters: at n=5 the true multiplier is 2.78,
+ * so a normal interval is nearly 30% too narrow exactly where a suite is
+ * small enough for that to mislead. Eval suites are small; this table is
+ * the difference between an interval that covers and one that flatters.
+ */
+const T_95: readonly number[] = [
+	12.706, 4.303, 3.182, 2.776, 2.571, 2.447, 2.365, 2.306, 2.262, 2.228, 2.201, 2.179, 2.16, 2.145,
+	2.131, 2.12, 2.11, 2.101, 2.093, 2.086, 2.08, 2.074, 2.069, 2.064, 2.06, 2.056, 2.052, 2.048,
+	2.045, 2.042,
+]
+
+function critical95(df: number): number {
+	if (df < 1) return Number.NaN
+	// Beyond 30 the t value is within ~1% of the normal, and pretending
+	// otherwise would imply a precision the rest of this does not have.
+	return T_95[df - 1] ?? 1.96
+}
+
+export interface ScoreUncertainty {
+	/** Cases that produced a score. Not the number of cases run. */
+	readonly n: number
+	/** Sample standard deviation, Bessel-corrected. */
+	readonly stdDev: number
+	/** Standard error of the mean. */
+	readonly stdError: number
+	/** Half-width of the 95% interval: the mean plus or minus this. */
+	readonly margin95: number
+	/**
+	 * The 95% interval, clamped to the score range.
+	 *
+	 * Clamped because a mean of 0.95 with a wide interval otherwise reports
+	 * an upper bound above 1, which is not a possible score and makes a
+	 * reader distrust the whole figure. The clamp is cosmetic and the
+	 * margin above is not — read that one for the width.
+	 */
+	readonly ci95: readonly [low: number, high: number]
+	/**
+	 * True when there is not enough data for an interval at all.
+	 *
+	 * One case has no spread to measure. Reporting `±0` there would be the
+	 * most confident-looking output the suite can produce, from the least
+	 * evidence it can have.
+	 */
+	readonly undefinedInterval: boolean
+}
+
+/**
+ * Spread of a set of scores, with the interval a reader should apply.
+ *
+ * **Assumes the cases are independent, and they may not be.** Miller's
+ * clustered standard errors run up to 3x the naive figure when cases come
+ * in related groups — several cases derived from one scenario, or one
+ * document, or one seed. This harness has no grouping key on a case, so
+ * there is nothing here to cluster on and this returns the naive figure.
+ * Where a suite does build several cases from one source, treat the
+ * interval below as a floor rather than as the answer.
+ *
+ * Stated rather than silently assumed because a too-narrow interval is
+ * worse than none: it turns "we cannot tell" into a number that looks
+ * like we can.
+ */
+export function uncertaintyOf(scores: readonly number[]): ScoreUncertainty {
+	const n = scores.length
+	if (n < 2) {
+		return {
+			n,
+			stdDev: 0,
+			stdError: 0,
+			margin95: Number.NaN,
+			ci95: [Number.NaN, Number.NaN],
+			undefinedInterval: true,
+		}
+	}
+
+	const mean = scores.reduce((a, b) => a + b, 0) / n
+	// Bessel-corrected: dividing by n estimates the spread of THESE cases,
+	// and the question is about the suite they were drawn from.
+	const variance = scores.reduce((acc, s) => acc + (s - mean) ** 2, 0) / (n - 1)
+	const stdDev = Math.sqrt(variance)
+	const stdError = stdDev / Math.sqrt(n)
+	const margin95 = critical95(n - 1) * stdError
+
+	return {
+		n,
+		stdDev,
+		stdError,
+		margin95,
+		ci95: [Math.max(0, mean - margin95), Math.min(1, mean + margin95)],
+		undefinedInterval: false,
+	}
+}
+
+/**
+ * One line a reader can act on, for a surface that prints a score.
+ *
+ * Names the interval rather than only the mean, because the mean alone is
+ * the thing that has been over-read. An interval spanning most of the
+ * scale says the suite cannot currently tell two runs apart, and that is
+ * the most useful sentence such a suite can produce.
+ */
+export function describeUncertainty(mean: number, u: ScoreUncertainty): string {
+	if (u.undefinedInterval) {
+		return u.n === 0
+			? 'no scored cases, so no score'
+			: `${mean.toFixed(3)} from a single case — no interval, and one case cannot show spread`
+	}
+	return `${mean.toFixed(3)} ±${u.margin95.toFixed(3)} (95% CI ${u.ci95[0].toFixed(3)}–${u.ci95[1].toFixed(3)}, n=${u.n}); assumes cases are independent`
+}

package/src/public-runtime.ts

@@ -63,6 +63,7 @@ export {
 export { normaliseModelId, resolveModelPricing, VENDOR_RATES } from './pricing/index.js'
 export { toErrorMessage } from './utils/error.js'
 export { configureLogger, getRootLogger, Logger } from './utils/logger.js'
+export { isTrustedReadOnly } from './tools/trusted-read-only.js'
 export { buildToolResultHashes, hashToolResult } from './utils/hash.js'
 export {
 	compressShellOutput,

package/src/registry/tool/execute.ts

@@ -3,6 +3,7 @@ import { assertStrictSchema } from '../../provider/strict-schema.js'
 import { GENAI, NAMZU, toolSpanName } from '../../telemetry/attributes.js'
 import { recordToolCall } from '../../telemetry/metrics.js'
 import { getTracer } from '../../telemetry/runtime-accessors.js'
+import { isTrustedReadOnly } from '../../tools/trusted-read-only.js'
 import type {
 	LLMToolSchema,
 	ToolAvailability,
@@ -487,7 +488,7 @@ Executable tool names, descriptions, and JSON input schemas are attached through
 
 				const mode = context.permissionContext?.mode ?? 'auto'
 				if (mode === 'plan') {
-					const isReadOnly = tool.isReadOnly ? tool.isReadOnly(rawInput) : false
+					const isReadOnly = isTrustedReadOnly(tool, rawInput)
 					if (!isReadOnly) {
 						const msg = `plan mode: non-read-only tool "${toolName}" blocked`
 						span.setAttributes({

package/src/tools/trusted-read-only.ts

@@ -0,0 +1,52 @@
+import type { ToolDefinition } from '../types/tool/index.js'
+
+/**
+ * May this tool's read-only claim settle a gate on its own?
+ *
+ * A connected server declares whether its own tools are read-only, and
+ * that declaration decided whether a call was approved without asking. The
+ * thing being gated supplied the input to the gate.
+ *
+ * The wire itself calls these fields HINTS. Three separate consumers read
+ * them as facts, so a server setting `readOnlyHint: true` and
+ * `destructiveHint: false` controlled the whole predicate for its own
+ * tools — the kernel's `allow_read_only` rule, the operator prompt
+ * exemption, and the plan-mode pass.
+ *
+ * The estate floor this repository inherits already decided this: least
+ * privilege, default deny, and — on tool results and fetched content —
+ * data is not instructions, and untrusted content cannot escalate
+ * capabilities. A server's declaration about its own tools is untrusted
+ * content by that definition. This is that rule applied, not a new policy.
+ *
+ * **The asymmetry is the design.** A self-declaration may RAISE the
+ * requirement and never LOWER it:
+ *
+ *  - `destructiveHint: true` from a server is believed. A server
+ *    volunteering that its tool is dangerous moves toward caution, and
+ *    disbelieving it buys nothing.
+ *  - `readOnlyHint: true` from a server does not, on its own, settle a
+ *    call as allowed or skip a prompt. That is the untrusted party
+ *    opening its own gate.
+ *
+ * Trust for the second case comes from the operator, per server, and is
+ * recorded on the tool as `provenance.readOnlyHintTrusted`. Never a global
+ * switch: one flag meaning "trust annotations" hands every connected
+ * server the same reach, which is the hole restated.
+ *
+ * `isReadOnly` itself is left reporting faithfully what the server said.
+ * Provenance and policy are different questions, and collapsing them would
+ * corrupt the outbound re-export and the prompt's own destructive label in
+ * order to fix a gate.
+ */
+export function isTrustedReadOnly(tool: ToolDefinition | undefined, input: unknown): boolean {
+	if (!tool?.isReadOnly) return false
+
+	// No provenance means the tool is host-defined: it came from this
+	// process, from code the operator installed, and there is no untrusted
+	// party in the chain. Requiring an opt-in for a builtin would break
+	// every read-only exemption for no gain in trust.
+	if (tool.provenance && !tool.provenance.readOnlyHintTrusted) return false
+
+	return tool.isReadOnly(input)
+}

package/src/tools/untrusted-envelope.ts

@@ -2,12 +2,32 @@
  * Framing for content the agent did not author and must not obey.
  *
  * An unlabelled block of text in a tool result reads exactly like the agent's
- * own instructions. The mitigation that survives contact with a real model is
- * not filtering — it is saying plainly whose words these are and that they are
+ * own instructions. This says plainly whose words these are and that they are
  * material rather than direction. That is the floor this estate already
  * states: data is not instructions, and a tool result cannot escalate what an
  * agent may do.
  *
+ * **It marks provenance. It refuses nothing, and it does not stop an
+ * attacker who is trying.** This paragraph used to claim the framing was
+ * "the mitigation that survives contact with a real model", and that is
+ * measurably wrong. Nasr et al., "The Attacker Moves Second"
+ * (arXiv:2510.09023), broke twelve published defences at above 90% attack
+ * success once the attacker adapts; the majority had originally reported
+ * near-zero success. Delimiting specifically goes from as low as 1% under
+ * a static benchmark to above 95% under adaptive attack.
+ *
+ * So read every number for a prompt-level defence as static unless it says
+ * otherwise, and treat this envelope as raising cost rather than as a
+ * boundary. What survives an adapting attacker in the same literature is
+ * architectural: AgentDojo (arXiv:2406.13352) found tool isolation and
+ * tool filtering the effective mitigations, and this repository's real
+ * boundaries are of that kind — the permission gate, the sandbox, the
+ * egress proxy deciding by resolved address.
+ *
+ * The two details below still matter. They are what stops the framing
+ * being trivially removable by the content itself, which is a lower bar
+ * than stopping an attacker and worth clearing anyway.
+ *
  * Two details make the difference between a boundary and a decoration, and
  * both were missing from this repo's first envelope:
  *

package/src/types/tool/index.ts

@@ -322,6 +322,36 @@ export interface ToolDefinition<TInput = unknown> {
 	isReadOnly?(input: TInput): boolean
 	isDestructive?(input: TInput): boolean
 	isConcurrencySafe?(input: TInput): boolean
+
+	/**
+	 * Where this tool came from, when it did not come from here.
+	 *
+	 * Absent means host-defined: this process, code the operator installed,
+	 * no untrusted party in the chain. Present means a connected server
+	 * supplied both the tool and its own description of what the tool does
+	 * — including whether it is read-only, which three separate gates were
+	 * treating as a fact rather than as the hint the wire calls it.
+	 *
+	 * See {@link isTrustedReadOnly}. This field exists so a gate can tell
+	 * the two apart; `isReadOnly` keeps reporting faithfully what the
+	 * server said, because the outbound re-export and the destructive
+	 * label shown to a human both need the server's own answer.
+	 */
+	provenance?: ToolProvenance
+}
+
+export interface ToolProvenance {
+	/** The connected server this tool came from, named as configured. */
+	readonly server: string
+	/**
+	 * The operator marked this server's read-only claims as trustworthy.
+	 *
+	 * Per server, never global: one switch meaning "trust annotations"
+	 * hands every connected server the same reach, which is the hole it
+	 * would be closing. Default false — an unmarked server's claim raises
+	 * the requirement and never lowers it.
+	 */
+	readonly readOnlyHintTrusted: boolean
 }
 
 export type ToolPermission =

package/src/verification/rules.ts

@@ -1,4 +1,5 @@
 import { DANGEROUS_PATTERNS } from '../constants/tools/index.js'
+import { isTrustedReadOnly } from '../tools/trusted-read-only.js'
 import type { ToolDefinition } from '../types/tool/index.js'
 import type { GateDecision, VerificationRule } from '../types/verification/index.js'
 
@@ -12,7 +13,10 @@ export function evaluateRule(
 ): GateDecision | null {
 	switch (rule.type) {
 		case 'allow_read_only': {
-			return toolDef?.isReadOnly?.(toolInput) ? 'allow' : null
+			// A server's own claim about its own tool cannot settle this. See
+			// `isTrustedReadOnly`: a self-declaration may raise the requirement
+			// and never lower it.
+			return isTrustedReadOnly(toolDef, toolInput) ? 'allow' : null
 		}
 
 		case 'deny_dangerous_patterns': {