@namzu/sdk 27.0.0 → 28.0.0

package/dist/tools/env-scrub.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Credential scrubbing for an environment a tool *inherits* rather than one a
+ * host *hands* it.
+ *
+ * The distinction is the whole design. `process.env` arrives by inheritance —
+ * nobody decided the model's command should see it, it is simply what a child
+ * process gets by default. A `ToolContext.env` entry is the opposite: a host
+ * wrote that key deliberately. So the inherited half is scrubbed and the
+ * explicit half is not, and a host that means to hand a command a credential
+ * can still do it by naming it.
+ *
+ * ## This is a denylist, and a denylist is not a boundary
+ *
+ * Stated plainly because the sandbox tiers state their limits the same way
+ * (`sandbox/isolation.ts`): a control that is believed to be enforcing more
+ * than it does is worse than one nobody trusted. This function catches keys
+ * whose *name* looks like a credential. It cannot catch a secret whose name
+ * does not — `DATABASE_URL` with a password in the userinfo, an S3 pre-signed
+ * URL in `ARTIFACT_URL`, a bearer token someone parked in `MY_VAR`. Those
+ * still reach the command.
+ *
+ * The actual boundary is the sandbox, where the inherited set is an allowlist
+ * (`SANDBOX_SAFE_ENV_KEYS`, seven keys) rather than a denylist. An allowlist
+ * is correct there because a sandbox is a fresh environment; it is wrong on
+ * the host path, where the same agent is expected to run `pnpm test`, `make`
+ * and `docker build`, all of which need far more than seven variables. So the
+ * host path gets the weaker control on purpose, and says so.
+ *
+ * ## Why this exists at all
+ *
+ * Namzu reads its own provider credentials out of the environment. A command
+ * that prints its environment — `env`, `printenv`, a Makefile echoing `$(ENV)`,
+ * a build script dumping config on failure — therefore returned the operator's
+ * API keys as tool output. That output is not ephemeral: it is appended to the
+ * durable transcript, persisted by the session store, and re-sent to the model
+ * provider as history on every later turn of the run. One incidental `env` in
+ * a build script converted a local secret into a permanently recorded one that
+ * had also been transmitted to a third party.
+ *
+ * The model does not have to be adversarial for this to fire, which is why it
+ * is scrubbed rather than merely policed.
+ */
+import { isCredentialEnvKey } from '../constants/credential-env-keys.js';
+export { isCredentialEnvKey };
+/** Outcome of a scrub — the surviving environment and what was withheld. */
+export interface ScrubbedEnv {
+    readonly env: Record<string, string>;
+    /**
+     * Names of the dropped variables, sorted. Names only — never values.
+     *
+     * Returned rather than swallowed because a command that genuinely needed
+     * `FOO_TOKEN` otherwise fails with an authentication error that points
+     * nowhere. Naming the withheld key turns that into a readable failure the
+     * model can act on, which is the same reason a denied tool call here
+     * carries the rule that denied it.
+     */
+    readonly dropped: readonly string[];
+}
+/**
+ * Drop credential-shaped keys from an inherited environment.
+ *
+ * Values are never inspected — only key names — so this cannot itself become
+ * a place a secret is read, logged or compared.
+ */
+export declare function scrubInheritedEnv(source?: NodeJS.ProcessEnv): ScrubbedEnv;
+//# sourceMappingURL=env-scrub.d.ts.map

package/dist/tools/env-scrub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-scrub.d.ts","sourceRoot":"","sources":["../../src/tools/env-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AAIxE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAO7B,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAetF"}

package/dist/tools/env-scrub.js

@@ -0,0 +1,68 @@
+/**
+ * Credential scrubbing for an environment a tool *inherits* rather than one a
+ * host *hands* it.
+ *
+ * The distinction is the whole design. `process.env` arrives by inheritance —
+ * nobody decided the model's command should see it, it is simply what a child
+ * process gets by default. A `ToolContext.env` entry is the opposite: a host
+ * wrote that key deliberately. So the inherited half is scrubbed and the
+ * explicit half is not, and a host that means to hand a command a credential
+ * can still do it by naming it.
+ *
+ * ## This is a denylist, and a denylist is not a boundary
+ *
+ * Stated plainly because the sandbox tiers state their limits the same way
+ * (`sandbox/isolation.ts`): a control that is believed to be enforcing more
+ * than it does is worse than one nobody trusted. This function catches keys
+ * whose *name* looks like a credential. It cannot catch a secret whose name
+ * does not — `DATABASE_URL` with a password in the userinfo, an S3 pre-signed
+ * URL in `ARTIFACT_URL`, a bearer token someone parked in `MY_VAR`. Those
+ * still reach the command.
+ *
+ * The actual boundary is the sandbox, where the inherited set is an allowlist
+ * (`SANDBOX_SAFE_ENV_KEYS`, seven keys) rather than a denylist. An allowlist
+ * is correct there because a sandbox is a fresh environment; it is wrong on
+ * the host path, where the same agent is expected to run `pnpm test`, `make`
+ * and `docker build`, all of which need far more than seven variables. So the
+ * host path gets the weaker control on purpose, and says so.
+ *
+ * ## Why this exists at all
+ *
+ * Namzu reads its own provider credentials out of the environment. A command
+ * that prints its environment — `env`, `printenv`, a Makefile echoing `$(ENV)`,
+ * a build script dumping config on failure — therefore returned the operator's
+ * API keys as tool output. That output is not ephemeral: it is appended to the
+ * durable transcript, persisted by the session store, and re-sent to the model
+ * provider as history on every later turn of the run. One incidental `env` in
+ * a build script converted a local secret into a permanently recorded one that
+ * had also been transmitted to a third party.
+ *
+ * The model does not have to be adversarial for this to fire, which is why it
+ * is scrubbed rather than merely policed.
+ */
+import { isCredentialEnvKey } from '../constants/credential-env-keys.js';
+// Re-exported from its historical home: this module's importers already
+// name it here, and the predicate did not change — only where it lives.
+export { isCredentialEnvKey };
+/**
+ * Drop credential-shaped keys from an inherited environment.
+ *
+ * Values are never inspected — only key names — so this cannot itself become
+ * a place a secret is read, logged or compared.
+ */
+export function scrubInheritedEnv(source = process.env) {
+    const env = {};
+    const dropped = [];
+    for (const [key, value] of Object.entries(source)) {
+        if (value === undefined)
+            continue;
+        if (isCredentialEnvKey(key)) {
+            dropped.push(key);
+            continue;
+        }
+        env[key] = value;
+    }
+    dropped.sort();
+    return { env, dropped };
+}
+//# sourceMappingURL=env-scrub.js.map

package/dist/tools/env-scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-scrub.js","sourceRoot":"","sources":["../../src/tools/env-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AAExE,wEAAwE;AACxE,wEAAwE;AACxE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAsB7B;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAA4B,OAAO,CAAC,GAAG;IACxE,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjB,SAAQ;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACjB,CAAC;IAED,OAAO,CAAC,IAAI,EAAE,CAAA;IACd,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;AACxB,CAAC"}

package/dist/tools/memory/read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/tools/memory/read.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAG/D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CAmCtE"}
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/tools/memory/read.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI/D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,CAsCtE"}

package/dist/tools/memory/read.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { asMemoryId } from '../../utils/id.js';
 import { defineTool } from '../defineTool.js';
 export function buildReadMemoryTool(store) {
     return defineTool({
@@ -13,7 +14,10 @@ export function buildReadMemoryTool(store) {
         destructive: false,
         concurrencySafe: true,
         async execute({ id }) {
-            const memoryId = id;
+            // Checked, not cast. `id` is model-authored and becomes a store key
+            // on the next line; nothing downstream re-examines it, so this is
+            // the only place a `ses_`-shaped value can be stopped.
+            const memoryId = asMemoryId(id);
             const content = await store.get(memoryId);
             if (!content) {
                 return {

package/dist/tools/memory/read.js.map

@@ -1 +1 @@
-{"version":3,"file":"read.js","sourceRoot":"","sources":["../../../src/tools/memory/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,UAAU,mBAAmB,CAAC,KAAkB;IACrD,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,uDAAuD;QACpE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;SACrD,CAAC;QACF,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE;YACnB,MAAM,QAAQ,GAAG,EAAc,CAAA;YAC/B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,EAAE,aAAa;oBACjC,KAAK,EAAE,UAAU,EAAE,YAAY;iBAC/B,CAAA;YACF,CAAC;YAED,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,OAAO,CAAC,OAAO;gBACvB,IAAI,EAAE;oBACL,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC1B;aACD,CAAA;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../../src/tools/memory/read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,UAAU,mBAAmB,CAAC,KAAkB;IACrD,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,uDAAuD;QACpE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;SACrD,CAAC;QACF,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE;YACnB,oEAAoE;YACpE,kEAAkE;YAClE,uDAAuD;YACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;YAC/B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,EAAE,aAAa;oBACjC,KAAK,EAAE,UAAU,EAAE,YAAY;iBAC/B,CAAA;YACF,CAAC;YAED,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,OAAO,CAAC,OAAO;gBACvB,IAAI,EAAE;oBACL,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC1B;aACD,CAAA;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}

package/dist/tools/task/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/tools/task/create.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAG/D,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,cAAc,CA6CtF"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/tools/task/create.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI/D,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG,cAAc,CA6CtF"}

package/dist/tools/task/create.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { asTaskId } from '../../utils/id.js';
 import { defineTool } from '../defineTool.js';
 export function buildTaskCreateTool(taskStore, runId) {
     return defineTool({
@@ -33,7 +34,7 @@ export function buildTaskCreateTool(taskStore, runId) {
                 description,
                 activeForm,
                 owner,
-                blockedBy: blockedBy,
+                blockedBy: blockedBy?.map(asTaskId),
                 metadata,
             });
             return {

package/dist/tools/task/create.js.map

@@ -1 +1 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../src/tools/task/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,UAAU,mBAAmB,CAAC,SAAoB,EAAE,KAAY;IACrE,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,aAAa;QACnB,WAAW,EACV,0QAA0Q;QAC3Q,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YACtF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC/E,UAAU,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,yEAAyE,CAAC;YACrF,KAAK,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4EAA4E,CAAC;YACxF,SAAS,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,wDAAwD,CAAC;YACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;SACrF,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC7E,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;gBACnC,KAAK;gBACL,OAAO;gBACP,WAAW;gBACX,UAAU;gBACV,KAAK;gBACL,SAAS,EAAE,SAA2C;gBACtD,QAAQ;aACR,CAAC,CAAA;YAEF,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,iBAAiB,IAAI,CAAC,EAAE,OAAO,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrF,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;aAC7D,CAAA;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../src/tools/task/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,UAAU,mBAAmB,CAAC,SAAoB,EAAE,KAAY;IACrE,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,aAAa;QACnB,WAAW,EACV,0QAA0Q;QAC3Q,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YACtF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC/E,UAAU,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,yEAAyE,CAAC;YACrF,KAAK,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4EAA4E,CAAC;YACxF,SAAS,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,wDAAwD,CAAC;YACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;SACrF,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC7E,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;gBACnC,KAAK;gBACL,OAAO;gBACP,WAAW;gBACX,UAAU;gBACV,KAAK;gBACL,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC;gBACnC,QAAQ;aACR,CAAC,CAAA;YAEF,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,iBAAiB,IAAI,CAAC,EAAE,OAAO,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrF,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;aAC7D,CAAA;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}

package/dist/tools/task/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/tools/task/update.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAG/D,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,GAAG,cAAc,CAkFxE"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/tools/task/update.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI/D,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,GAAG,cAAc,CAqFxE"}

package/dist/tools/task/update.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { asTaskId } from '../../utils/id.js';
 import { defineTool } from '../defineTool.js';
 export function buildTaskUpdateTool(taskStore) {
     return defineTool({
@@ -30,7 +31,10 @@ export function buildTaskUpdateTool(taskStore) {
         destructive: false,
         concurrencySafe: true,
         async execute({ id, subject, description, activeForm, status, owner, addBlocks, addBlockedBy, metadata, }) {
-            const taskId = id;
+            // Checked. Without it a malformed id reads as "Task not found",
+            // which tells the model its task disappeared rather than that it
+            // named the wrong thing.
+            const taskId = asTaskId(id);
             if (status === 'deleted') {
                 const deleted = await taskStore.delete(taskId);
                 return {
@@ -40,12 +44,12 @@ export function buildTaskUpdateTool(taskStore) {
             }
             if (addBlocks) {
                 for (const blockedId of addBlocks) {
-                    await taskStore.block(taskId, blockedId);
+                    await taskStore.block(taskId, asTaskId(blockedId));
                 }
             }
             if (addBlockedBy) {
                 for (const blockerId of addBlockedBy) {
-                    await taskStore.block(blockerId, taskId);
+                    await taskStore.block(asTaskId(blockerId), taskId);
                 }
             }
             const updated = await taskStore.update(taskId, {

package/dist/tools/task/update.js.map

@@ -1 +1 @@
-{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../src/tools/task/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,UAAU,mBAAmB,CAAC,SAAoB;IACvD,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,aAAa;QACnB,WAAW,EACV,mMAAmM;QACpM,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YACvD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;YACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAClE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YAC7E,MAAM,EAAE,CAAC;iBACP,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;iBACxD,QAAQ,EAAE;iBACV,QAAQ,CAAC,YAAY,CAAC;YACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YACvE,SAAS,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,0CAA0C,CAAC;YACtD,YAAY,EAAE,CAAC;iBACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,0CAA0C,CAAC;YACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;SACpF,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EACb,EAAE,EACF,OAAO,EACP,WAAW,EACX,UAAU,EACV,MAAM,EACN,KAAK,EACL,SAAS,EACT,YAAY,EACZ,QAAQ,GACR;YACA,MAAM,MAAM,GAAG,EAAY,CAAA;YAE3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC9C,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY;iBAC/D,CAAA;YACF,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACf,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;oBACnC,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,SAAmB,CAAC,CAAA;gBACnD,CAAC;YACF,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBAClB,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;oBACtC,MAAM,SAAS,CAAC,KAAK,CAAC,SAAmB,EAAE,MAAM,CAAC,CAAA;gBACnD,CAAC;YACF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC9C,OAAO;gBACP,WAAW;gBACX,UAAU;gBACV,MAAM,EAAE,MAA6D;gBACrE,KAAK;gBACL,QAAQ;aACR,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;YAC1D,CAAC;YAED,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,QAAQ,EAAE,sBAAsB,OAAO,CAAC,MAAM,EAAE;gBACxD,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;aACtE,CAAA;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../src/tools/task/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,UAAU,mBAAmB,CAAC,SAAoB;IACvD,OAAO,UAAU,CAAC;QACjB,IAAI,EAAE,aAAa;QACnB,WAAW,EACV,mMAAmM;QACpM,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YACvD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;YACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAClE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YAC7E,MAAM,EAAE,CAAC;iBACP,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;iBACxD,QAAQ,EAAE;iBACV,QAAQ,CAAC,YAAY,CAAC;YACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YACvE,SAAS,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,0CAA0C,CAAC;YACtD,YAAY,EAAE,CAAC;iBACb,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,0CAA0C,CAAC;YACtD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;SACpF,CAAC;QACF,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,KAAK;QAClB,eAAe,EAAE,IAAI;QACrB,KAAK,CAAC,OAAO,CAAC,EACb,EAAE,EACF,OAAO,EACP,WAAW,EACX,UAAU,EACV,MAAM,EACN,KAAK,EACL,SAAS,EACT,YAAY,EACZ,QAAQ,GACR;YACA,gEAAgE;YAChE,iEAAiE;YACjE,yBAAyB;YACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;YAE3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC9C,OAAO;oBACN,OAAO,EAAE,OAAO;oBAChB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY;iBAC/D,CAAA;YACF,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACf,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;oBACnC,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;gBACnD,CAAC;YACF,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBAClB,KAAK,MAAM,SAAS,IAAI,YAAY,EAAE,CAAC;oBACtC,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAA;gBACnD,CAAC;YACF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE;gBAC9C,OAAO;gBACP,WAAW;gBACX,UAAU;gBACV,MAAM,EAAE,MAA6D;gBACrE,KAAK;gBACL,QAAQ;aACR,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;YAC1D,CAAC;YAED,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,QAAQ,EAAE,sBAAsB,OAAO,CAAC,MAAM,EAAE;gBACxD,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;aACtE,CAAA;QACF,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}

package/dist/types/acp/index.d.ts

@@ -0,0 +1,161 @@
+import type { SerializableHostCommand } from '../command/index.js';
+import type { ToolCallView } from '../tool/presentation.js';
+/**
+ * The wire shapes an editor or an orchestrator sees.
+ *
+ * Declared here rather than inferred from the server's own returns, because
+ * these cross a process boundary: a shape that only exists as a function's
+ * inferred return type is a contract nobody can read, and the reader is
+ * frequently writing the client in another language.
+ *
+ * Everything here is JSON. No `Date`, no `Map`, no branded id reaching the
+ * wire as anything but a string — a peer cannot construct a branded id and
+ * should not have to.
+ */
+/** What the client says it can do. */
+export interface AcpClientCapabilities {
+    /**
+     * Capability names the client supports.
+     *
+     * An array of strings rather than a booleans object, so a client can
+     * declare a capability this agent has not heard of without the field
+     * being dropped by a parser that only knew the old shape.
+     */
+    readonly capabilities?: readonly string[];
+}
+export interface AcpInitializeParams extends AcpClientCapabilities {
+    /** The revision the client speaks. */
+    readonly protocolVersion?: number;
+    /** Free-form, for logs. Never used to vary behaviour. */
+    readonly clientInfo?: {
+        readonly name?: string;
+        readonly version?: string;
+    };
+}
+export interface AcpInitializeResult {
+    readonly protocolVersion: number;
+    readonly agentInfo: {
+        readonly name: string;
+        readonly version: string;
+    };
+    /**
+     * The commands a client may offer its operator.
+     *
+     * Comes from `HostCommandRegistry.describe()`, never hand-written here.
+     * A front end that authored its own list would be a second definition of
+     * the command surface, and the one that drifted would be the one an
+     * operator was looking at.
+     */
+    readonly commands: readonly SerializableHostCommand[];
+    /** Which capabilities this agent needs the client to have. */
+    readonly requiredClientCapabilities: readonly string[];
+    /**
+     * Capabilities that change what this agent can do without being required.
+     *
+     * Kept apart from `required` because demanding a filesystem of a peer that
+     * is not an editor would refuse a session that is perfectly able to run.
+     */
+    readonly optionalClientCapabilities: readonly string[];
+}
+export interface AcpSessionNewParams {
+    /** Where the agent works. Absent means the process's own directory. */
+    readonly cwd?: string;
+}
+export interface AcpSessionNewResult {
+    readonly sessionId: string;
+}
+export interface AcpSessionLoadParams {
+    /** The session to resume. Answered with the SAME id, never a new one. */
+    readonly sessionId: string;
+    readonly cwd?: string;
+}
+/** What the agent asks the client before running a tool batch. */
+export interface AcpRequestPermissionParams {
+    readonly sessionId: string;
+    readonly toolCalls: readonly {
+        readonly id: string;
+        readonly name: string;
+        readonly input: unknown;
+        readonly isDestructive: boolean;
+    }[];
+}
+/**
+ * The client's answer.
+ *
+ * `approve_all` is a distinct outcome rather than `approve` plus a flag,
+ * because the two mean different things to the human who chose one and a
+ * boolean beside an enum invites a client to send `approve` with the flag on.
+ */
+export interface AcpRequestPermissionResult {
+    readonly outcome: 'approve' | 'approve_all' | 'reject';
+    /** Why, for a rejection. Reaches the MODEL, so it is worth writing. */
+    readonly feedback?: string;
+}
+export interface AcpFsReadParams {
+    readonly sessionId: string;
+    readonly path: string;
+}
+export interface AcpFsReadResult {
+    readonly content: string;
+}
+export interface AcpFsWriteParams {
+    readonly sessionId: string;
+    readonly path: string;
+    readonly content: string;
+}
+export interface AcpSessionPromptParams {
+    readonly sessionId: string;
+    /** The operator's message, already plain text. */
+    readonly prompt: string;
+}
+/** Why a prompt stopped, in the peer's vocabulary. */
+export type AcpStopReason = 'end_turn' | 'cancelled' | 'refused' | 'error' | 'max_turns';
+export interface AcpSessionPromptResult {
+    readonly stopReason: AcpStopReason;
+}
+export interface AcpSessionCancelParams {
+    readonly sessionId: string;
+}
+/**
+ * One streamed update.
+ *
+ * A discriminated union on `kind`, and closed: an open one would let this
+ * bridge emit an update shape no client can render, which fails silently at
+ * the far end — the same reason `ToolCallView` is closed.
+ */
+export type AcpSessionUpdate = 
+/** A fragment of the assistant's answer. */
+{
+    readonly kind: 'agent_message_chunk';
+    readonly text: string;
+}
+/** A fragment of the assistant's reasoning, when the model emits any. */
+ | {
+    readonly kind: 'agent_thought_chunk';
+    readonly text: string;
+}
+/**
+ * A tool call, rendered by the TOOL rather than by this bridge.
+ *
+ * `view` is a `ToolCallView` verbatim. This module never compares a tool
+ * name: the moment a front end writes `name === 'edit'`, a tool it has
+ * not heard of can never be shown properly, which is the defect
+ * `createToolPresenter` exists to have fixed once.
+ */
+ | {
+    readonly kind: 'tool_call';
+    readonly toolCallId: string;
+    readonly title: string;
+    readonly status: 'pending' | 'completed' | 'failed';
+    readonly view: ToolCallView;
+}
+/** The turn is over. Carries the same reason the prompt result will. */
+ | {
+    readonly kind: 'turn_ended';
+    readonly stopReason: AcpStopReason;
+};
+export interface AcpSessionUpdateNotification {
+    readonly sessionId: string;
+    readonly update: AcpSessionUpdate;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/types/acp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/acp/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAE3D;;;;;;;;;;;GAWG;AAEH,sCAAsC;AACtC,MAAM,WAAW,qBAAqB;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IACjE,sCAAsC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,yDAAyD;IACzD,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3E;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACvE;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,uBAAuB,EAAE,CAAA;IACrD,8DAA8D;IAC9D,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAA;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAA;CACtD;AAED,MAAM,WAAW,mBAAmB;IACnC,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACpC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,kEAAkE;AAClE,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS;QAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;QACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;QACvB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;KAC/B,EAAE,CAAA;CACH;AAED;;;;;;GAMG;AACH,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAA;IACtD,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACvB;AAED,sDAAsD;AACtD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,CAAA;AAExF,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAA;CAClC;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB;AAC3B,4CAA4C;AAC1C;IAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACjE,yEAAyE;GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACjE;;;;;;;GAOG;GACD;IACA,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC1B;AACH,wEAAwE;GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAA;CAAE,CAAA;AAEtE,MAAM,WAAW,4BAA4B;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CACjC"}

package/dist/types/acp/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/types/acp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/acp/index.ts"],"names":[],"mappings":""}

package/dist/types/agent/base.d.ts

@@ -1,11 +1,12 @@
-import type { AgentStatus, CostInfo, TokenUsage } from '../common/index.js';
+import type { Logger } from '../../utils/logger.js';
+import type { CostInfo, RunExecutionStatus, TokenUsage } from '../common/index.js';
 import type { ResumeHandler } from '../hitl/index.js';
 import type { RunId, SessionId, TenantId } from '../ids/index.js';
 import type { InvocationState } from '../invocation/index.js';
 import type { Message } from '../message/index.js';
 import type { PermissionMode } from '../permission/index.js';
 import type { StopReason } from '../run/stop-reason.js';
-import type { ProjectId, ThreadId } from '../session/ids.js';
+import type { ProjectId, TopicId } from '../session/ids.js';
 import type { TaskStore } from '../task/index.js';
 import type { ToolAvailability } from '../tool/index.js';
 export type AgentType = 'reactive' | 'pipeline' | 'router' | 'supervisor';
@@ -19,6 +20,62 @@ export interface BaseAgentConfig {
     maxResponseTokens?: number;
     costLimitUsd?: number;
     permissionMode?: PermissionMode;
+    /**
+     * The tools this run may use, narrowing whatever its registry holds.
+     *
+     * `allowedTools` existed on `QueryParams` and on `ToolContext` and
+     * nowhere on the path a delegation takes — so a supervisor handing a
+     * read-only research subtask to an agent whose definition also grants
+     * `write` and `bash` had no way to say so. The child ran with
+     * everything the agent had.
+     *
+     * `query()` binds this to BOTH the request tool list and the
+     * `ToolExecutor`, which is what makes it enforced rather than
+     * presentational: narrowing only the request showed the model fewer
+     * tools and let it call any of them by name.
+     */
+    /**
+     * Text queued for this run since its last turn, drained at the boundary.
+     *
+     * A callback rather than an array, because the queue is owned by
+     * whoever accepts the messages — `AgentManager` for a delegated child, a
+     * host for a top-level run — and an array captured at config time would
+     * be whatever was queued before the run started.
+     *
+     * It exists because two public APIs could accept text and silently never
+     * deliver it. `AgentManager.continueTask` and `queueMessage` pushed onto
+     * `pendingMessages` and nothing in the kernel ever drained it — the
+     * manager interface's own docblock said so, and `continue_task` was
+     * unmounted from the coordinator tools because of it. The steering
+     * channel had the mirror-image hole: it can only ride on a tool result,
+     * so guidance queued during a turn that called no tools stayed pending
+     * until the run ended.
+     */
+    inboundMessages?: () => import('../message/index.js').Message[];
+    allowedTools?: readonly string[];
+    /**
+     * Tools this run may NOT use, subtracted from whatever it would
+     * otherwise have.
+     *
+     * Separate from `allowedTools` because they answer different
+     * questions and a delegation needs the second. `allowedTools` absent
+     * means "everything the registry holds", so a caller narrowing a child
+     * would otherwise have to enumerate the agent's whole tool set to
+     * remove one from it — and would then silently pin that list against
+     * an agent that later gains a tool.
+     */
+    deniedTools?: readonly string[];
+    /** Persona for this run, overriding what the agent's definition supplies. */
+    persona?: import('../persona/index.js').AgentPersona;
+    /**
+     * Override the logger this run's `AbstractAgent.bindRun` uses instead of
+     * the logger the agent was CONSTRUCTED with. Same reason `thinking` and
+     * `effort` are declared here rather than per-config: every concrete agent
+     * builds its `runConfig` by hand-listing fields, and a field absent from a
+     * hand-listed literal is dropped in silence. A host that wants one run's
+     * output routed differently — without reconstructing the agent — sets this.
+     */
+    logger?: Logger;
     /**
      * Extra environment variables for this agent's tools and sandboxed
      * commands, merged over whatever ambient environment the execution path
@@ -92,7 +149,7 @@ export interface BaseAgentConfig {
      * need to be updated before this tightens. Tightening to required
      * lands with the `AgentFactoryOptions` triple refactor.
      */
-    threadId?: ThreadId;
+    topicId?: TopicId;
     /** Session under which the run executes. See `projectId` for the tightening plan. */
     sessionId?: SessionId;
     /** Isolation boundary (Convention #17). See `projectId` for the tightening plan. */
@@ -117,7 +174,7 @@ export interface BaseAgentConfig {
      * however carefully its parent had been wired.
      *
      * What that cost is narrower than "no gate in children" and worth
-     * stating exactly. A `VerificationGate` DENY still bites inside a
+     * stating exactly. A `AuthorizationGate` DENY still bites inside a
      * child, because denials are threaded into the executor and no later
      * approval releases them. What was lost is the REVIEW tier: every call
      * the gate left undecided went to the resume handler, and for a child
@@ -155,7 +212,7 @@ export interface AgentInput {
 }
 export interface BaseAgentResult {
     runId: RunId;
-    status: AgentStatus;
+    status: RunExecutionStatus;
     stopReason?: StopReason;
     usage: TokenUsage;
     cost: CostInfo;

package/dist/types/agent/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/types/agent/base.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAA;AAEzE,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;AAE/D,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE5B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,OAAO,sBAAsB,EAAE,cAAc,CAAA;IACxD,MAAM,CAAC,EAAE,OAAO,sBAAsB,EAAE,eAAe,CAAA;IAEvD;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAA;IAErB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAEnB,qFAAqF;IACrF,SAAS,CAAC,EAAE,SAAS,CAAA;IAErB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAEnB,WAAW,CAAC,EAAE,KAAK,CAAA;IAEnB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,YAAY,CAAC,EAAE,iBAAiB,CAAA;IAEhC,+DAA+D;IAC/D,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC,kEAAkE;IAClE,UAAU,CAAC,EAAE,OAAO,oBAAoB,EAAE,IAAI,CAAA;IAE9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;CAC7B;AAED,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAAC,CAAA;AAEhF,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,CAAC,EAAE,WAAW,CAAA;IAEpB,SAAS,CAAC,EAAE,SAAS,CAAA;IAErB,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAE3C,cAAc,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAED,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,KAAK,CAAA;IACZ,MAAM,EAAE,WAAW,CAAA;IACnB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,EAAE,UAAU,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IACjC,aAAa,EAAE,OAAO,CAAA;IACtB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,iBAAiB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,SAAS,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,iBAAiB,CAAA;CAC/B"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/types/agent/base.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAClF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAA;AAEzE,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;AAE/D,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,EAAE,MAAM,OAAO,qBAAqB,EAAE,OAAO,EAAE,CAAA;IAE/D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAEhC;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE/B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,qBAAqB,EAAE,YAAY,CAAA;IAEpD;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE5B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,OAAO,sBAAsB,EAAE,cAAc,CAAA;IACxD,MAAM,CAAC,EAAE,OAAO,sBAAsB,EAAE,eAAe,CAAA;IAEvD;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAA;IAErB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB,qFAAqF;IACrF,SAAS,CAAC,EAAE,SAAS,CAAA;IAErB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAEnB,WAAW,CAAC,EAAE,KAAK,CAAA;IAEnB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,YAAY,CAAC,EAAE,iBAAiB,CAAA;IAEhC,+DAA+D;IAC/D,eAAe,CAAC,EAAE,eAAe,CAAA;IAEjC,kEAAkE;IAClE,UAAU,CAAC,EAAE,OAAO,oBAAoB,EAAE,IAAI,CAAA;IAE9C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,aAAa,CAAC,EAAE,aAAa,CAAA;CAC7B;AAED,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAAC,CAAA;AAEhF,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,CAAC,EAAE,WAAW,CAAA;IAEpB,SAAS,CAAC,EAAE,SAAS,CAAA;IAErB,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAE3C,cAAc,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAED,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,KAAK,CAAA;IACZ,MAAM,EAAE,kBAAkB,CAAA;IAC1B,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,KAAK,EAAE,UAAU,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IACjC,aAAa,EAAE,OAAO,CAAA;IACtB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,iBAAiB,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,SAAS,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,iBAAiB,CAAA;CAC/B"}