@namzu/sdk 27.1.0 → 28.0.0

package/src/public-runtime.ts

@@ -25,6 +25,25 @@ export {
 
 export * from './constants/index.js'
 
+export { ConfigNamespaceCollisionError, ConfigRegistry } from './config/registry.js'
+export type { ConfigRegistryOptions, ConfigScope } from './config/registry.js'
+export {
+	DiskConfigOverrideStore,
+	InMemoryConfigOverrideStore,
+} from './store/config/index.js'
+export type { ConfigOverrideStore } from './store/config/index.js'
+export { MCPReconnectOptionsSchema, MCPReconnectSupervisor } from './connector/mcp/reconnect.js'
+export type { MCPReconnectOptions, MCPReconnectPolicySource } from './connector/mcp/reconnect.js'
+
+export type {
+	CodeNavigationProvider,
+	CodeNavigationResult,
+	HoverResult,
+	SourceLocation,
+	SymbolLocation,
+	SymbolSearchResult,
+} from './types/code-navigation/index.js'
+
 // ─── wire schemas + a2a (contracts/) ─────────────────────────────────────
 
 export {
@@ -62,7 +81,99 @@ export {
 // model list, so that check lives in the driver and needs this.
 export { normaliseModelId, resolveModelPricing, VENDOR_RATES } from './pricing/index.js'
 export { toErrorMessage } from './utils/error.js'
-export { configureLogger, getRootLogger, Logger } from './utils/logger.js'
+export { configureLogger, getLogCounters, getRootLogger, Logger } from './utils/logger.js'
+
+// The LogSink seam — additive. `Logger`/`getRootLogger`/`configureLogger`
+// above are unchanged; this is the new seam that replaces them going
+// forward once a host (the CLI) is migrated to call it.
+export {
+	createLogger,
+	EVENT_NAME_ATTRIBUTE,
+	installProcessSink,
+	jsonLinesSink,
+	LevelFilter,
+	LogAttributes,
+	LogRecord,
+	LogSink,
+	LogSinkCounters,
+	NOOP_LOGGER,
+	NOOP_SINK,
+	prettySink,
+	Resource,
+	SCOPE_ATTRIBUTE,
+	Severity,
+} from './utils/log/index.js'
+
+// A cancellation carries its origin now; these are what a host reads it
+// with.  is exported alongside the class because a host
+// implementing its own gateway holds an abort REASON, not a RunCancelled.
+export { cancelCauseOf, RunCancelled } from './types/run/cancel-cause.js'
+
+// A tool authors how it is shown; a host resolves through this rather than
+// switching on a lowercased tool name, which is what left every MCP and
+// plugin tool with a truncated string no matter what it did.
+// Credential resolution as a seam. All provider credential discovery lived
+// in the CLI, so a host embedding the SDK alone had no way to plug in an
+// env- or file-backed source without reimplementing an interface that asks
+// a different question.
+// The collaboration mode, durable per Topic. It was resolved once per run
+// and copied into the executor, so leaving plan mode meant ending the run
+// and discarding the in-flight step to change one enum.
+// The object a host holds between runs. There was none: no way to ask
+// whether the agent is running, and nowhere to put "when you next run,
+// start with this".
+export { AgentNotRunningError, createAgentHandle } from './agents/handle.js'
+
+export {
+	DiskTopicStateStore,
+	InMemoryTopicStateStore,
+} from './store/topic/state.js'
+export { StaleTopicStateError } from './types/topic/state.js'
+
+// Work that outlives one run. Named explicitly here rather than reached
+// through the sub-barrels, because this file re-exports SELECTED names from
+// `./manager/index.js` and friends rather than star-exporting them — so a
+// name added to a sub-barrel alone never reaches the package entry at all.
+// That is exactly what happened to this API when it landed: fully exported
+// from its module, fully invisible to a consumer, and the public-surface
+// gate said nothing because it reads the built entry point.
+export {
+	DiskTopicObjectiveStore,
+	InMemoryTopicObjectiveStore,
+	ObjectiveExhaustedError,
+	ObjectiveExistsError,
+} from './store/topic/objective.js'
+export {
+	ObjectiveNotProgressingError,
+	advanceObjective,
+	driveObjective,
+} from './manager/topic/objective.js'
+export { StaleObjectiveError } from './types/topic/objective.js'
+
+export {
+	EnvCredentialProvider,
+	ReadOnlyCredentialProviderError,
+} from './vault/CredentialProvider.js'
+// The key-name vocabulary itself, so a host with its own provider registry
+// can assert its variables are ones the host-bash scrub will withhold —
+// the check that stops the two tables drifting apart.
+export { isCredentialEnvKey } from './constants/credential-env-keys.js'
+
+export { createToolPresenter, genericLabel } from './registry/tool/presentation.js'
+export type { ToolPresenter } from './registry/tool/presentation.js'
+
+// A stalled stream trips no request timeout — the request succeeded and
+// the bytes stopped. Composes with withProviderRetry/withProviderFallback:
+// the failure is classified `network`, which both already act on.
+// One header, so a vendor reading its own logs can tell a kernel's traffic
+// from a browser's — and so an abuse or rate-limit investigation lands on
+// the right party.
+export { NAMZU_APP_IDENTITY, attributionHeaders } from './provider/attribution.js'
+export type { AppIdentity } from './provider/attribution.js'
+
+export { withStreamIdleTimeout } from './provider/idle-timeout.js'
+export type { WithStreamIdleTimeoutOptions } from './provider/idle-timeout.js'
+
 export { isTrustedReadOnly } from './tools/trusted-read-only.js'
 export { buildToolResultHashes, hashToolResult } from './utils/hash.js'
 export {
@@ -75,7 +186,7 @@ export { extractFinalResponse } from './utils/conversation.js'
 
 // ─── router, runtime, run ────────────────────────────────────────────────
 
-export { resolveTaskModel } from './router/task-router.js'
+export { resolveTaskModel } from './model-router/task-router.js'
 // Every driver accepts `thinking`; one that does not implement it must
 // refuse rather than drop it. Shared so a new driver inherits the rule.
 export { assertThinkingUnsupported } from './provider/thinking-support.js'
@@ -102,7 +213,7 @@ export { drainQuery, query } from './runtime/query/index.js'
 export { SteeringBinding, attachSteering, formatSteeringNote } from './runtime/query/steering.js'
 export type { SteeringChannel } from './runtime/query/steering.js'
 export { createMockBidiProvider, startBidiRun } from './runtime/bidi/index.js'
-export { ContextCache } from './runtime/query/context-cache.js'
+export { PromptCache } from './runtime/query/prompt-cache.js'
 export {
 	CheckpointManager,
 	findPendingCheckpoint,
@@ -283,14 +394,35 @@ export { claimRun, fencedOut, releaseRun, toClaimSummary } from './store/index.j
 // error. `resolveRunEventReplay` decides what a cursor is owed, and REFUSES
 // rather than delivering a partial catch-up a consumer would fold into its
 // state without knowing it had a hole in it.
+// Walking the actor chain — exported so the next cross-tree concern (an
+// audit over a subtree, a host asking whether one run is contained by
+// another) composes with the chain that is already persisted, rather than
+// building a second parent registry beside it.
+export { actorChain, isDescendantOfActor, MAX_ACTOR_CHAIN_DEPTH } from './session/actor-scope.js'
 export { readRunEventsIn } from './store/index.js'
+export {
+	DiskMessageFeedbackStore,
+	InMemoryMessageFeedbackStore,
+	StaleFeedbackError,
+	UnknownMessageError,
+} from './store/feedback/index.js'
 export { resolveRunEventReplay } from './types/run/event-cursor.js'
 
+// Commands a HOST offers its operator. Deliberately NOT tools: no
+// descriptor reaches a provider and no dispatch path reaches the model — a
+// `/tasks` readout is a question the operator asked, and making it callable
+// would let the model spend a turn on it and record the output as a finding.
+export {
+	HostCommandNameCollisionError,
+	HostCommandRegistry,
+	kernelHostCommands,
+} from './registry/command/index-exports.js'
+
 export {
 	AgentRegistry,
+	BaseRegistry,
 	ManagedRegistry,
 	PluginRegistry,
-	Registry,
 	ToolCatalog,
 	ToolNameCollisionError,
 	ToolRegistry,
@@ -318,16 +450,47 @@ export {
 	// manager, which is the reason it is a function over a store.
 	requireOpenProject,
 	RunPersistence,
+	TopicManager,
+	/**
+	 * @deprecated Use {@link TopicManager}. A literal identity re-export, not a
+	 * wrapper, so `instanceof` and `===` still hold for callers who have not
+	 * migrated. Removal is NZ-TOPIC-05 -- NZ-TOPIC-01 marked it deprecated but
+	 * that release never reached npm, so this major is the first one a consumer
+	 * can actually see the warning in.
+	 */
 	ThreadManager,
 } from './manager/index.js'
 
-export { InMemoryThreadStore } from './store/thread/memory.js'
+export {
+	InMemoryTopicStore,
+	/** @deprecated Use {@link InMemoryTopicStore}. Removal is NZ-TOPIC-05. */
+	InMemoryTopicStore as InMemoryThreadStore,
+} from './store/topic/memory.js'
 
-export { LocalTaskGateway } from './gateway/local.js'
+export { LocalTaskScheduler } from './scheduler/local.js'
+
+// A delegate need not be an in-process Namzu agent. `DelegatingTaskScheduler`
+// presents any set of `Delegate`s as the `TaskScheduler` the delegation
+// tools already speak, so a specialist can move out of process without a
+// caller learning that it did.
+export {
+	DelegateCapabilityError,
+	DelegateCapabilityMismatchError,
+	DelegateIdCollisionError,
+	DelegatingTaskScheduler,
+	NoDelegateError,
+} from './scheduler/delegating.js'
+export type { DelegatingTaskSchedulerConfig } from './scheduler/delegating.js'
+export type {
+	Delegate,
+	DelegateCapabilities,
+	DelegateRequest,
+	DelegateResult,
+} from './types/agent/delegate.js'
 // Exported because `buildCoordinatorTools` is: a host that builds the
 // coordinator surface itself needs the same inbox the loop drains, or its
 // abandoned completions go unheard exactly as they did before.
-export { CompletionInbox, formatCompletionNotification } from './gateway/completion-inbox.js'
+export { CompletionInbox, formatCompletionNotification } from './scheduler/completion-inbox.js'
 
 // ─── providers, sandbox, vault ───────────────────────────────────────────
 
@@ -419,6 +582,10 @@ export {
 	EnvironmentConnectorManager,
 	ExecutionContextFactory,
 	HttpConnector,
+	applyNamePolicy,
+	applyToolPolicy,
+	diffTools,
+	hasDrift,
 	HttpSseTransport,
 	HybridExecutionContext,
 	LocalExecutionContext,
@@ -434,14 +601,25 @@ export {
 	mcpToolToToolDefinition,
 	RemoteExecutionContext,
 	ScopedConnectorRegistry,
+	// The only transport in the tree that can RUN an `MCPServer`. It reached
+	// `connector/mcp/index.ts` and stopped there, so the server was public
+	// with no public way to serve it.
+	ServerStdioTransport,
 	StdioTransport,
 	StreamableHttpTransport,
 	TenantConnectorManager,
 	toolDefinitionToMCPTool,
 	toolResultToMCPToolResult,
+	toolsHash,
 	WebhookConnector,
 	zodToMCPJsonSchema,
 } from './connector/index.js'
+export type {
+	MCPToolDiscoveryOptions,
+	MCPToolDrift,
+	MCPToolPolicy,
+	MCPToolPolicyDecision,
+} from './connector/index.js'
 
 // ─── bridges (a2a + sse) ─────────────────────────────────────────────────
 
@@ -458,11 +636,59 @@ export {
 	runToA2ATask,
 } from './bridge/a2a/index.js'
 
+// The client half. Until this landed the bridge was a one-way door: this
+// kernel served a card and could read nobody else's, so the delegate seam
+// had no driven consumer.
+export {
+	A2ADelegate,
+	A2AProtocolMismatchError,
+	A2ARequestError,
+	InvalidAgentCardError,
+	fetchAgentCard,
+} from './bridge/a2a/client.js'
+export type { A2ADelegateConfig, FetchLike } from './bridge/a2a/client.js'
+
 export {
 	mapRunToStreamEvent,
 	mapSessionToStreamEvent,
 } from './bridge/sse/index.js'
 
+export {
+	ACP_DEFAULT_REJECTION,
+	ACPServer,
+	clientBackedSandbox,
+	toAcpSessionUpdate,
+	toAcpStopReason,
+	toResumeDecision,
+} from './bridge/acp/index.js'
+export type {
+	AcpAgentGateway,
+	AcpClientFilesystem,
+	AcpPermissionAsker,
+	AcpPermissionOutcome,
+	AcpPermissionRequest,
+	AcpServerOptions,
+} from './bridge/acp/index.js'
+export type {
+	AcpFsReadParams,
+	AcpFsReadResult,
+	AcpFsWriteParams,
+	AcpRequestPermissionParams,
+	AcpRequestPermissionResult,
+	AcpSessionLoadParams,
+	AcpClientCapabilities,
+	AcpInitializeParams,
+	AcpInitializeResult,
+	AcpSessionCancelParams,
+	AcpSessionNewParams,
+	AcpSessionNewResult,
+	AcpSessionPromptParams,
+	AcpSessionPromptResult,
+	AcpSessionUpdate,
+	AcpSessionUpdateNotification,
+	AcpStopReason,
+} from './types/acp/index.js'
+
 // ─── bus, verification ───────────────────────────────────────────────────
 
 export {
@@ -481,14 +707,45 @@ export {
 // the verdict without the sentence would have left the same hole one layer up
 // for anyone driving the rules directly instead of through the gate.
 export {
+	PERMISSION_PRESETS,
+	SANDBOXED_PRESET,
+	SANDBOXED_SHELL_PRESET,
+	SUPERVISED_PRESET,
+	UNATTENDED_PRESET,
+	UnsupportedPermissionPresetError,
+	availablePermissionPresets,
 	defaultSandboxedGateConfig,
+	permissionPreset,
+	resolvePermissionPreset,
 	defaultSandboxedShellGateConfig,
 	describeRule,
 	evaluateRule,
-	VerificationGate,
-} from './verification/index.js'
-
-// ─── probe (typed observation over AgentBus + RunEvent stream) ───────────
+	AuthorizationGate,
+} from './authorization/index.js'
+
+// NZ-BOOT-03: the module-attributed invariant registry. `compaction.ts` and
+// `claim-disk.ts` register themselves against the shared `invariants`
+// instance at import time (see each file); `namzu doctor` and any host can
+// read `invariants.listIds()` to see what this build claims about its own
+// live state, which is the whole point — a registry with nothing on it
+// would be exactly the kind of declaration this task exists to close.
+export {
+	createInvariantRegistry,
+	InvariantNameCollisionError,
+	invariants,
+	InvariantRegistry,
+	ModuleInvariantError,
+} from './invariants/index.js'
+export type { InvariantCheck, InvariantOutcome } from './invariants/index.js'
+
+// ─── probe (typed observation AND enforcement over AgentBus + RunEvent) ──
+//
+// This said "typed observation", which was true of `on`/`onAny`/`dispatch`
+// and false of `veto`/`queryVeto`: a registered veto handler can deny a
+// tool call, and `runtime/query/executor.ts` turns that denial into a
+// failed `tool_result` — the third of the three gates on a tool call.
+// `ProbeObservation` and `ProbeEnforcement` let a signature say which half
+// it needs; `ProbeRegistry` implements both.
 
 export {
 	buildProbeContext,
@@ -498,13 +755,23 @@ export {
 	ProbeRegistry,
 	ProbeVetoError,
 } from './probe/index.js'
+export type { ProbeEnforcement, ProbeObservation } from './probe/index.js'
 
 export { wrapProviderWithProbes } from './provider/instrumentation.js'
 export type { ProviderInstrumentationOptions } from './provider/instrumentation.js'
 export type { ResolvedProviderCapabilities } from './provider/capabilities.js'
-export { collect } from './provider/collect.js'
+export { collectChatCompletion } from './provider/collect-chat-completion.js'
 
-export { wrapVaultWithProbes } from './vault/instrumentation.js'
+// Old spellings of renamed exports, still live for one deprecation window.
+// The file explains why each is a `const`+`type` pair rather than a
+// re-export alias; the short version is that a re-export cannot carry the
+// `@deprecated` tag, and the tag is what the public-surface gate reads.
+export * from './deprecated-aliases.js'
+
+export {
+	wrapCredentialProviderWithProbes,
+	wrapVaultWithProbes,
+} from './vault/instrumentation.js'
 export type { VaultInstrumentationOptions } from './vault/instrumentation.js'
 
 // Doctor runtime moved to @namzu/cli in 0.5.0. SDK keeps only the
@@ -550,6 +817,8 @@ export {
 } from './session/intervention/index.js'
 
 export {
+	acceptLegacyContainerId,
+	/** @deprecated Use {@link acceptLegacyContainerId}. Removal is NZ-TOPIC-05. */
 	acceptLegacyThreadId,
 	acquireMigrationLock,
 	DefaultFilesystemMigrator,
@@ -557,11 +826,14 @@ export {
 	LEGACY_DEFAULT_PROJECT_PREFIX,
 	LEGACY_DEFAULT_SESSION_ID,
 	LOCK_REL_PATH,
+	loggingMigrationSink,
 	MARKER_REL_PATH,
 	MIGRATION_VERSION,
 	NOOP_FILESYSTEM_MIGRATION_SINK,
 	NOOP_MIGRATION_WARNING_SINK,
 	readMarker,
+	rejectLegacyContainerPrefix,
+	/** @deprecated Use {@link rejectLegacyContainerPrefix}. Removal is NZ-TOPIC-05. */
 	rejectLegacyPrefix,
 	releaseMigrationLock,
 	StalePrefixError,
@@ -593,6 +865,7 @@ export {
 	// that take it seriously.
 	ProjectClosedError,
 	ProjectNotEmptyError,
+	ProjectRootPathTakenError,
 	StaleProjectError,
 	// Exported with the CAS it announces. A host that opts into
 	// `expectedOwnerVersion` has to be able to tell "somebody else took this
@@ -673,11 +946,17 @@ export {
 // one under the same name; `@namzu/sdk` root barrel exposes one symbol — the
 // config/runtime version is the canonical path. Keep it out of this block.
 export { assertTaskStatus, isTerminalTaskStatus } from './types/task/index.js'
-// NOTE: `VerificationRuleSchema` and `VerificationGateConfigSchema` are NOT
+// NOTE: `AuthorizationRuleSchema` and `AuthorizationGateConfigSchema` are NOT
 // re-exported — they were not part of the pre-ses_011 public surface.
 
 // ─── compaction runtime ──────────────────────────────────────────────────
 
+// Compaction a host can ASK for. `runCompactionCheck` was the only entry
+// point in the kernel and was exported from nowhere, so a host could not
+// offer "compact this conversation", could not shrink an idle session
+// between turns, and could not collapse a span it had chosen.
+export { compactNow, compactRegion } from './compaction/manual.js'
+
 export {
 	buildVerifiedSummary,
 	DEFAULT_ASSUMED_CONTEXT_WINDOW,
@@ -744,6 +1023,12 @@ export {
 // Thrown by a tool-result screen that returned `halt`. Exported because a
 // host has to be able to tell it from an ordinary failure — that is the
 // entire difference between the two refusal outcomes.
+// Nothing in the kernel calls this: the consumer is a host's own HTTP
+// route, and a kernel with no UI and no hosted service has no in-process
+// caller to offer. Exported rather than deleted because the reader it was
+// written for is out of process by construction.
+export { coalesce } from './streaming/coalesce.js'
+
 export { ToolResultHalted } from './registry/tool/screen.js'
 
 // Error taxonomy. `toPlatformError` is the load-bearing one: it normalizes
@@ -762,3 +1047,77 @@ export {
 	withHint,
 } from './types/errors/catalog.js'
 export type { ErrorCatalogRule, ErrorExplanation, ErrorFacts } from './types/errors/catalog.js'
+
+// The box itself is built by `query` — a host receives it through
+// `onApprovalPolicy` rather than constructing one, because changing the
+// policy emits a durable event and only the run holds the emitter. The name
+// constant is exported so a host can recognise the unattended default.
+export { AUTO_APPROVE_POLICY_NAME } from './runtime/query/approval-policy.js'
+
+// The system prompt is open: a contribution registry the assembler
+// consumes, with skills as its first contributor. See `prompt/contributions.ts`.
+export {
+	PromptContributionCollisionError,
+	PromptContributionRegistry,
+	SKILLS_CONTRIBUTION_ID,
+	skillsContribution,
+} from './prompt/index.js'
+
+// Who may reach for a skill. Runtime, not types: `public-types.ts` does
+// `export type *` from the same module, which carries the union and leaves
+// the resolver and the predicate behind — a consumer could name the policy
+// and not ask about it.
+export {
+	SKILL_INVOCATION_DEFAULT,
+	isInvocableBy,
+	skillInvocation,
+} from './types/skills/index.js'
+
+// Reaching the web. Fetching ships guarded because its rules are about the
+// network and the same everywhere; searching ships with no vendor, because
+// choosing one here would choose it for every consumer.
+export {
+	GuardedFetchProvider,
+	WebFetchRefusedError,
+	isPrivateAddress,
+} from './connector/web/index.js'
+
+// Where an attachment's bytes live when the message does not carry them.
+// Inline base64 lands in the transcript, in every checkpoint, and on the
+// wire once per turn; a reference does not.
+export {
+	AttachmentMediaTypeMismatchError,
+	AttachmentNotFoundError,
+	NoAttachmentStoreError,
+	isStoredAttachment,
+	resolveAttachment,
+	resolveAttachments,
+} from './store/attachment/index.js'
+
+// Derived values, maintained from the run's own event log rather than
+// recomputed by whoever asks. See `read-model/registry.ts`.
+export {
+	DuplicateEventError,
+	EventGapError,
+	RUN_STATUS_READ_MODEL_ID,
+	ReadModelCollisionError,
+	ReadModelRegistry,
+	UnknownReadModelError,
+	createRunStatusReadModel,
+} from './read-model/index.js'
+
+// Asking a finished run what happened, including what compaction removed.
+// `compaction_shed` has carried the removed messages since NZ-RUNREC-06 and
+// nothing read them back; evidence nobody can retrieve is evidence nobody
+// kept.
+export { RunQuery } from './run-query/index.js'
+
+// A real pseudo-terminal inside a sandbox, or a refusal that names the
+// binding to install. A pipe is not a terminal, and substituting one is the
+// failure this refuses — see `sandbox/terminal.ts`.
+export {
+	PTY_SPECIFIER,
+	TerminalUnavailableError,
+	loadPty,
+	openTerminalWith,
+} from './sandbox/terminal.js'

package/src/public-tools.ts

@@ -28,8 +28,48 @@ export { ReadFileTool } from './tools/builtins/read-file.js'
 export { WriteFileTool } from './tools/builtins/write-file.js'
 export { EditTool } from './tools/builtins/edit.js'
 export { BashTool } from './tools/builtins/bash.js'
+export { LSP_TOOL_NAME, LspTool, getCodeNavigationTools } from './tools/builtins/lsp.js'
 export { GlobTool } from './tools/builtins/glob.js'
 export { GrepTool } from './tools/builtins/grep.js'
+// Reads, lists and stops what `bash run_in_background` starts. Ships in
+// the default builtin set alongside bash, because the two are one
+// capability: an id with nothing that reads it is the unbacked suggestion
+// that was removed from bash's schema.
+export { JobTool } from './tools/builtins/job.js'
+// Loads a skill's instructions, and adopts the tool scope it declares.
+// NOT in the default builtin set: a run with no skills has nothing for it
+// to do, and offering a tool that can only refuse is worse than not
+// offering it. Hosts register it alongside a skills registry.
+export { SKILL_TOOL_NAME, SkillTool, parseAllowedTools } from './tools/builtins/skill.js'
+// Both declare `category: 'network'`, which is what the authorization
+// presets branch on. NOT in the default builtin set: a run with no web
+// provider has nothing for them to do, and only the `unattended` preset --
+// the one requiring the sandbox to confine the network -- auto-approves
+// them.
+export {
+	WEB_FETCH_TOOL_NAME,
+	WEB_SEARCH_TOOL_NAME,
+	WebFetchTool,
+	WebSearchTool,
+} from './tools/builtins/web.js'
+// The paragraph neither tool owns: how to use the two together, and what a
+// fetched page is. Registered with the prompt contribution registry only
+// when the tools are — guidance about tools a run does not have spends the
+// cached prefix telling the model to cite a search it cannot run.
+export {
+	WEB_GUIDANCE_CONTRIBUTION_ID,
+	webGuidanceContribution,
+} from './tools/builtins/web-guidance.js'
+// A program the model wrote, calling this run's own tools in a loop. Opt-in
+// and NOT in the default builtin set: a run that does not need
+// model-authored control flow should not have a way to execute
+// model-authored text, and "the tool was there so it got used" is not a
+// threat model.
+export {
+	RUN_CODE_TOOL_NAME,
+	buildRunCodeTool,
+} from './tools/builtins/run-code.js'
+export type { RunCodeToolOptions } from './tools/builtins/run-code.js'
 export { LsTool } from './tools/builtins/ls.js'
 export { SearchToolsTool } from './tools/builtins/search-tools.js'
 export { VerifyOutputsTool } from './tools/builtins/verify-outputs.js'
@@ -70,4 +110,4 @@ export {
 	createConnectorListTool,
 	createConnectorRouterTool,
 	createConnectorTools,
-} from './bridge/tools/connector/index.js'
+} from './connector/tools/index.js'