@namzu/sdk 3.2.0 → 4.0.0

package/CHANGELOG.md

@@ -1,5 +1,299 @@
 # Changelog
 
+## 4.0.0
+
+### Major Changes
+
+- c3cb587: `read`, `write` and `edit` are now contained to the working directory.
+
+  All three called `resolve(workingDirectory, input.path)` bare, so
+  `path: "../../.."` reached whatever sits above the working directory and the
+  tool used it. No sandbox had to be misconfigured for this — it holds with no
+  sandbox at all, which is the common case, so a model that asks for a parent
+  directory got one. `resolveWithin` existed the whole time and these three
+  never reached it; the search tools (`glob`, `grep`, `ls`) did.
+
+  A lexical check alone would not have been the fix. `atomicWriteFile` resolves
+  its destination and writes _through_ a symlink deliberately, so that editing a
+  linked file updates the target rather than replacing the link with a regular
+  file. Paired with a lexical check that is check-then-follow: a link inside the
+  working directory pointing outside it climbs nothing on paper, and the write
+  lands outside anyway (CWE-59). Containment is therefore decided after
+  canonicalization, which is the ordering CWE-22 states as the mitigation for
+  the family: canonicalize, then validate the canonical form.
+
+  Two details the new resolver has to get right, because getting either wrong
+  breaks ordinary use rather than failing safe:
+
+  - The root can itself be a symlink — `os.tmpdir()` is one on macOS — so both
+    sides are canonicalized. Canonicalizing only the candidate would refuse
+    every path under a temp directory.
+  - The target may not exist yet, and `realpath` throws on a missing path. The
+    deepest existing ancestor is canonicalized and the remainder appended
+    lexically; the remainder cannot hide a link because nothing is there to be
+    one.
+
+  This does not claim TOCTOU safety. A component swapped for a symlink between
+  the check and the open would still be followed — closing that needs
+  per-component `openat`/`O_NOFOLLOW`, which Node does not expose. The threat
+  addressed is a link that is already present.
+
+  **Migration.** If a host relied on these tools reaching outside
+  `workingDirectory` — reading a config beside the repo, writing to a sibling
+  output directory — those calls now fail with "Path escapes the working
+  directory". Point `workingDirectory` at a root that contains everything the
+  run legitimately needs. Sandboxed runs are unaffected: the sandbox has its own
+  root and its own resolver, and the host-side canonicalization deliberately
+  does not run on that branch.
+
+- a1f67f3: Two allow-lists in the delegation surface stop failing open, and a host can
+  now decline a coordinator tool.
+
+  ## An empty delegate roster means nobody
+
+  `create_task` derived its `agent_id` parameter from `allowedAgentIds` but
+  widened it from the roster enum to a bare string whenever that roster was
+  empty — so the one configuration meaning "this run may delegate to nobody" was
+  the only one that let the model name anybody. An allow-list _is_ the
+  enumeration of what is permitted; an empty one enumerates nothing and admits
+  nothing. Degrading it to an open string to keep functioning is failing open
+  (CWE-636), and the rule it breaks is fail-safe defaults (Saltzer & Schroeder
+  1975, §I.A.3(b)), restated in NIST SP 800-53 Rev. 5 as SC-7(5) "deny by
+  default, allow by exception".
+
+  What that reached is why this is worth a break. The id was not merely rejected
+  downstream: it went to the gateway, which resolves against an `AgentManager`
+  that is typically **shared**, so an agent the host deliberately left out of
+  `agentIds` could still launch if it happened to be registered there. When it
+  was not registered, the failure text listed every registered agent id back to
+  the model, and the plan row was left stranded at `in_progress` because the
+  store write precedes the gateway call while the reconciling update follows it.
+
+  `create_task` is now **not mounted** when the roster is empty, rather than
+  mounted with a schema nothing satisfies — refusing per call reaches the same
+  verdict while paying prompt-prefix tokens and an iteration for it (NIST SP
+  800-53 CM-7, least functionality). It is the only coordinator tool that reads
+  the roster, so `agent_task_list`, `approve_plan` and `ask_user_question` are
+  untouched: "no delegates, but still planning and a human channel" remains a
+  supported configuration. The schema stays closed underneath as defence in
+  depth. If you construct a supervisor with `agentIds: []` and expected
+  `create_task` to be callable, populate the roster — there is no flag that
+  restores the old shape, because the old shape could not correctly succeed.
+
+  `buildAgentTool` carried the identical fallback and now throws at construction
+  instead: it returns exactly one tool and that tool _is_ the delegation surface,
+  so "do not mount it" and "do not build it" are the same statement. It also
+  never checked `subagent_type` against the roster inside `execute`, which is
+  reachable without going through the registry; it does now.
+
+  ## A host can decline a coordinator tool
+
+  `runtimeToolOverrides` is this SDK's declared way to decline a kernel-mounted
+  tool. It is honoured for the task tools and the advisory tools, and
+  `SupervisorAgent` forwards it into its own `drainQuery` call — but it
+  registered the coordinator tools before that, unconditionally, so
+  `{ create_task: 'disabled' }` was obeyed everywhere except the one surface a
+  host would most want to decline. A run that must not delegate had prompt text
+  and a gateway refusal as its only defences. This half is pure gap-closure: the
+  mechanism, the type and two other call sites already existed, and coordinator
+  registration now uses the same idiom.
+
+  ## Collisions refuse instead of overwriting
+
+  This half is new policy, not a gap-closure. Registration now throws
+  `ToolNameCollisionError` (exported, carrying `toolName`) when a coordinator
+  tool's name is already registered on the supervisor's `tools`, instead of the
+  registry's warn-and-overwrite. The reserved names are `create_task`,
+  `agent_task_list`, `approve_plan`, and `ask_user_question` — grep for those
+  four.
+
+  The old behaviour was not "the host's tool quietly loses and the run works".
+  `registerOne` ends by setting availability, and the coordinator call passed
+  none, so a tool the host registered `deferred` or `suspended` was silently
+  promoted to `active` under someone else's implementation; and because the
+  backing store is a `Map`, the replacement inherited the host's insertion
+  position in the prompt-cache prefix. That is a different authorization surface,
+  not a lost registration — detection of an error condition without action
+  (CWE-390), where CWE-694's own mitigation is nearly this fix. Complete
+  mediation is the principle (§I.A.3(c)): a registry entry is a remembered
+  binding of a name to an authority, and rebinding it leaves every decision made
+  about the old binding stale.
+
+  To migrate: rename your tool, or keep your name and decline the coordinator one
+  with `runtimeToolOverrides: { "create_task": "disabled" }`. The error names
+  both routes.
+
+- df07db8: Removes `ToolCatalogSurface` and `ToolsetPolicy.surfaces`.
+
+  Both were deprecated in 3.2.0 and shipped deprecated again in 3.3.0, so the
+  window SemVer asks for — at least one minor release in which working code
+  compiles and warns — has been served twice. The deprecation said "slated for
+  removal in the next major"; this is that major, and letting it pass would move
+  the promise to 5.0.0.
+
+  Nothing produced or read either one. No code constructed a member of the
+  union, and `surfaces` was the only field carrying it and was never consulted,
+  so there is no runtime behaviour to change and no working code to migrate:
+  setting it did nothing before and the field is gone now. Under this repo's
+  release rule that is the case where a removal may go straight to major, and it
+  is being said here as that rule asks.
+
+  It was also the wrong axis. Which tools a run may use is already expressible
+  four ways, all per-run and dynamic where this was fixed at definition:
+  `allowedTools` on the query, `ToolAvailability` (`active` / `deferred` /
+  `suspended`) with mid-run activation, `runtimeToolOverrides`, and capability
+  negotiation stripping tools a driver cannot carry. If you set `surfaces`,
+  `allowedTools` is the replacement — it says the same thing per run.
+
+  `SharedRunWorkspace` is unchanged and stays exported without an SDK-side
+  caller. That is deliberate and now documented on the class: its config asks for
+  a host filesystem root and the path an agent will see, which is a deployment
+  shape the kernel does not own. `runtimeRoot` and the paths `refs()` derives
+  from it are the contract.
+
+- 19f390a: A delegated agent's output is now framed as untrusted material, and the
+  framing itself can no longer be forged.
+
+  **Why the child→parent return.** A delegated worker is the component most
+  likely to have consumed something nobody in the run authored: it was handed a
+  task like "read these files and report", it ran `read`, `grep`, possibly a
+  connector fetch over material the user did not write, and its final text
+  landed directly in the parent's context — where the parent typically holds a
+  broader tool grant than the child that produced the text. An unlabelled block
+  there reads as the parent's own reasoning. Connector-supplied prompts already
+  got this treatment; the delegation surface had none.
+
+  `create_task` and the `Agent` tool now wrap their `output` in a
+  `<namzu-untrusted kind="agent-result">` frame naming the agent and task, with
+  one line saying the content is material rather than direction. The worker's
+  text is unaltered inside it, and `data.result` carries it verbatim, so a host
+  reading the result programmatically is unaffected — only the model-facing
+  string changed.
+
+  **The framing was forgeable, and that is fixed.** The existing envelope around
+  connector prompts built its tag by hand and interpolated remote text straight
+  into the body. A prompt whose content contained `</mcp-prompt>` closed the
+  block early, and everything the server wrote after that read as unlabelled —
+  which is to say, as this agent's own instructions. The label was the entire
+  mitigation and the labelled party could remove it. `wrapUntrusted` now defangs
+  the delimiter case-insensitively (a model reads `</NAMZU-UNTRUSTED>` as the
+  same tag) and escapes attribute values, so a source name carrying a quote
+  cannot rewrite the tag it appears in.
+
+  Two decisions worth stating because the obvious alternatives are wrong:
+
+  - **No length threshold.** Skipping short payloads to save tokens leaves the
+    cheapest carrier unframed; an instruction fits in a tweet.
+  - **No "already wrapped, skip it" fast path.** That check is forgeable —
+    content merely beginning with the opening tag would pass through with no
+    framing at all. Wrapping twice is harmless; not wrapping once is not.
+
+  `wrapUntrusted`, `neutralizeEnvelopeDelimiter` and `UntrustedEnvelope` are
+  exported, so a host surfacing its own untrusted content to a model can use the
+  same framing rather than inventing one.
+
+  **Migration.** If you assert on `create_task` or `Agent` output text, read
+  `data.result` instead — it is the worker's text with nothing added. If you
+  call `renderPromptMessages` directly, its output opens with
+  `<namzu-untrusted kind="mcp-prompt" …>` rather than `<mcp-prompt …>`.
+
+### Minor Changes
+
+- 2b9d90e: `edit` can do the thing its own description tells the model to do.
+
+  The tool description says _"For insertions, pass insertLine … use `insertLine: "end"` to extend a file at the end"_, and `write-file` and `bash` point at the same idiom. But `modelInputSchema` advertised only `path`/`old_string`/`new_string`/`replace_all` with `additionalProperties: false`, and `enforceModelInput: true` — so under constrained decoding the append idiom the prompt recommends was the one idiom a model could not emit. A consuming host measured the result over seven days on one tenant: **94 of 159 tool failures** were `edit` rejecting an `insertLine` whose spelling the model had guessed.
+
+  `insertLine` is now in the model-facing schema as `oneOf: [integer ≥ 0, "end"]`. Declaring the union that way also removes the synonym problem at its source: for a provider that constrains generation, `"EOF"` is not emittable, because `"end"` is the only string the schema admits.
+
+  `old_string` leaves `required`, because an insert has no text to match — requiring it is exactly what made the idiom unexpressible. Which of `old_string` / `insertLine` is present is decided by the two refinements the execution schema already carries. That is deliberate over a top-level `oneOf`: strict structured-output modes are least surprising with a flat object, and a discriminated union at the root is the construct most likely to be rejected or quietly ignored. The cost is that an incomplete call is now expressible and caught at execution rather than generation — paid knowingly, since the alternative is a working capability nothing can reach.
+
+  For providers that do **not** constrain, `insertLine` also accepts `eof`, `append`, `last` and `end_of_file`. Liberal at execution and strict in the schema is the right way round: none of those is ambiguous, and refusing one bought strictness at the price of a full model round trip. The rejection message now names the value it received.
+
+  Also here, same file family: **`write` refuses a whitespace-only path**, which `edit` has always refused. `.min(1)` admits `"   "`, which resolves to the working directory and fails as an unreadable directory-write error. Two mutating tools disagreeing about the same input is the kind of gap a model finds and a reviewer does not.
+
+- 4be54ca: Three sandbox and delegation gaps, all of the same kind: something declared,
+  threaded through types, and never driven.
+
+  **`SandboxExecOptions.signal` now works — on the backend where it can.** The
+  option was declared, documented and exported, with a docstring stating that
+  without it "a Stop could only ever abandon the _wait_ — the sandboxed process
+  kept running after the host believed the run had been cancelled". Every
+  backend dropped it, so that is exactly what happened. The local sandbox now
+  merges the caller's signal with the call's own deadline and hands the result to
+  `spawn`, so the child actually dies; a cancelled run is no longer reported as
+  `timedOut`, because a run someone stopped did not run too long, and telling the
+  model otherwise invites a retry with a bigger budget.
+
+  The remote backends still ignore it, now explicitly and with the reason in the
+  source. Their wire has no cancel op, so aborting the request would abandon the
+  wait while the command kept running — the original failure, wearing the
+  appearance of a fix. `SandboxExecOptions.signal` documents which backends
+  honour it.
+
+  **`ls` respects the sandbox.** It read the host through `node:fs` and named
+  `context.sandbox` nowhere, in the one builtin whose whole job is telling the
+  model what exists — so under a container or microVM backend the model's picture
+  of the filesystem was the host's. Its paths were host-relative too, while
+  `read`, `grep` and `glob` all resolve inside the sandbox, so an ls-to-read
+  handoff either failed or opened a different file than the one listed. `glob`
+  had the identical defect, was fixed, and its fix notes that "every sibling
+  builtin already remembers this branch"; this was the sibling that did not.
+
+  One behaviour difference worth knowing: inside a sandbox, directories are
+  derived from file paths, because `listFiles` reports files. An empty directory
+  is invisible there.
+
+  **The `Agent` tool's header described a design that no longer exists.** It told
+  readers to prefer `Agent` because `create_task` was a non-blocking trio driven
+  by notification callbacks. `create_task` blocks and returns the worker's output
+  as its own result, and `continue_task` / `cancel_task` are not registered at
+  all. The two tools are separated by how much of the coordinator surface they
+  bring, not by timing.
+
+## 3.3.0
+
+### Minor Changes
+
+- 635ffa9: A human's approval now crosses the spawn boundary.
+
+  `BaseAgentConfig` carried no resume handler. `SendMessageOptions.configOverrides` is a `Partial` of it, so a parent could not hand its decision channel to a child **at the type level** — and no runtime path could carry one either. Every delegated child fell through to the SDK's `autoApproveHandler`, however carefully its parent had been wired.
+
+  **What that cost, exactly.** A `VerificationGate` _deny_ still bit inside a child: denials are threaded into the executor and no later approval releases them. What was lost is the **review** tier — every call the gate left undecided reached the resume handler, and for a child that handler auto-approved. So a host running "ask before acting" had a human review `write` at the top level and never see the same `write` issued one hop down. The shipped CLI encodes the workaround as policy: its sub-agent prompt says _"do not ask the parent questions; make reasonable assumptions"_, because a question had nowhere to go.
+
+  `AgentTaskContext.resumeHandler` carries the parent's channel and `AgentManager` stamps it onto the child config — beside the trace parent and the tenant triple, for the same reason: a `configBuilder` is written by whoever registered the agent and cannot be trusted to forward something it was never told about. An explicit `configOverrides.resumeHandler` still wins, so one child can be given a different channel or none. `SupervisorAgent` now puts its own handler on the spawn context; it already gave that handler to its own run and its own coordinator tools, so the two had disagreed — the supervisor paused for a human while the workers it launched approved themselves.
+
+  Absent still means auto-approve. A host that never wired a handler is unaffected.
+
+  The handler is passed as the function itself, which works because delegation is in-process — `LocalTaskGateway` is the only gateway in the tree. A gateway dispatching across a process boundary could not carry a closure and would have to proxy the request onto the parent's event stream and route the answer back by request id. The upward half of that already exists: `wrapChildListener` stamps lineage on every child event the parent sees, and `user_question_asked` / `tool_review_requested` / `run_paused` are already typed events.
+
+- 6015989: A published MCP prompt reaches the model.
+
+  `listPrompts` and `getPrompt` landed on the client and server last release and stopped there: a server could publish prompts, the SDK could fetch them, and nothing ever put one in front of a model. That shipped the protocol half without the consumer half — the same primitive-with-no-driver shape this series exists to remove, created by the fix for it.
+
+  A prompt is now adapted into a tool the model can call, `mcp_prompt_<server>_<name>`, with an input schema built from the arguments the prompt declares.
+
+  **Why a tool and not system content.** Folding a prompt into the system prompt puts remote text in the cached prefix, so every turn pays for it and the cache breaks whenever the server changes its wording — and system position _reads_ as instruction, which is the last thing text from a remote party should read as. A slash command would route through the host's UI, so a headless run could never use one. A tool call is explicit, auditable, passes the same admission policy and `allowedTools` filter as every other capability, and its answer arrives as a `tool_result`, which a model already treats as data returned by something rather than as direction.
+
+  The result is wrapped in an envelope naming the server and the prompt, and saying the content is material to work with rather than instructions. Untrusted content arriving through a tool result is the standard injection surface, and the mitigation that survives contact is saying plainly whose words these are. A server that returns an `assistant` message has that role reported inside the envelope, never turned into an assistant turn in the run's own history.
+
+  Prompts pass the **same admission policy** as tools, via a shared name check — a server publishing a prompt is the same trust question as one publishing a tool, and two copies of an allow/deny rule are two chances for one to drift permissive. They are namespaced apart from tools, since a server may publish both under one name and collapsing them would let whichever registered second replace the first.
+
+  A fetch that fails is returned to the model rather than thrown: a read-only lookup that a server cannot answer is something an agent can work around, and ending the run over it is the wrong trade.
+
+### Patch Changes
+
+- 82888c6: One `chat` span per model call, not two.
+
+  3.2.0 shipped a second `chat {model}` span. `stream-turn.ts` already opened one — with the same justification, that `chatSpanName` had no call sites — and 3.2.0 added another beside it, same name, same parent, both carrying token counts. A consumer summing spans double-counted latency and tokens.
+
+  Verified by execution rather than by reading: one scripted model call produced two `chat mock-model` spans, both with `gen_ai.usage.input_tokens`.
+
+  The one added in 3.2.0 is removed and the earlier one kept, because it is strictly better — it wraps the call itself and records time to first delta, which the later one did not.
+
+  **How it shipped, since that matters more than the fix.** The search that concluded "zero call sites" covered `telemetry/attributes.ts` and `constants/telemetry/` and never the runtime. Then the test asserting `toHaveLength(1)` failed with `2`, and the failure was explained away — attributed to a forced-final turn — and relaxed to `>= 1`. That relaxation is now reverted to an exact count, and a mutation confirms it catches a re-introduced duplicate as well as a removed span. The reasoning is recorded next to the assertion so the next person to see it fail with `2` reads the history instead of re-deriving the same wrong explanation.
+
+  Reported by a consuming host reading 3.2.0 against its own telemetry.
+
 ## 3.2.0
 
 ### Minor Changes

package/dist/agents/SupervisorAgent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SupervisorAgent.d.ts","sourceRoot":"","sources":["../../src/agents/SupervisorAgent.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,KAAK,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,KAAK,EAAW,KAAK,EAAU,MAAM,uBAAuB,CAAA;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,KAAK,EAAE,KAAK,EACZ,GAAG,GAAE,MAAmB,GACtB,eAAe,EAAE,CAcnB;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAEnF;AAED,qBAAa,eAAgB,SAAQ,aAAa,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IAC/F,QAAQ,CAAC,IAAI,EAAG,YAAY,CAAS;gBAEzB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,cAAc,CAAC;IAalE;;;;;;;;OAQG;IACG,GAAG,CACR,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,qBAAqB,CAAC;YAMnB,YAAY;CAqL1B"}
+{"version":3,"file":"SupervisorAgent.d.ts","sourceRoot":"","sources":["../../src/agents/SupervisorAgent.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,KAAK,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,KAAK,EAAW,KAAK,EAAU,MAAM,uBAAuB,CAAA;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,KAAK,EAAE,KAAK,EACZ,GAAG,GAAE,MAAmB,GACtB,eAAe,EAAE,CAcnB;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAEnF;AAED,qBAAa,eAAgB,SAAQ,aAAa,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IAC/F,QAAQ,CAAC,IAAI,EAAG,YAAY,CAAS;gBAEzB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,cAAc,CAAC;IAalE;;;;;;;;OAQG;IACG,GAAG,CACR,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,qBAAqB,CAAC;YAMnB,YAAY;CA4O1B"}

package/dist/agents/SupervisorAgent.js

@@ -1,6 +1,6 @@
 import { EMPTY_TOKEN_USAGE } from '../constants/limits.js';
 import { LocalTaskGateway } from '../gateway/local.js';
-import { ToolRegistry } from '../registry/tool/execute.js';
+import { ToolNameCollisionError, ToolRegistry } from '../registry/tool/execute.js';
 import { drainQuery } from '../runtime/query/index.js';
 import { PendingAnswers, QuestionParkBinding } from '../runtime/query/question-park.js';
 import { buildCoordinatorTools } from '../tools/coordinator/index.js';
@@ -108,6 +108,12 @@ export class SupervisorAgent extends AbstractAgent {
                     remaining: config.tokenBudget,
                 },
                 factoryOptions: mergedFactoryOptions,
+                // The supervisor already hands this to its OWN run and its own
+                // coordinator tools; handing it to the spawn context is what
+                // makes a worker ask the same person the supervisor asks.
+                // Without it the two disagreed: the supervisor paused for a
+                // human and the workers it launched approved themselves.
+                ...(config.resumeHandler ? { resumeHandler: config.resumeHandler } : {}),
                 tenantId,
                 threadId,
                 sessionId,
@@ -150,8 +156,58 @@ export class SupervisorAgent extends AbstractAgent {
                 tools.register(tool, config.tools.getAvailability(tool.name));
             }
         }
+        // Registered the way every other kernel-mounted tool in this SDK is
+        // registered: honouring `runtimeToolOverrides`, and refusing to take a
+        // name the host already used.
+        //
+        // Both halves were missing here and nowhere else. `runtimeToolOverrides`
+        // is declared on `AgentInput`, is forwarded into this very `drainQuery`
+        // call below, and is consulted for the task tools and for the advisory
+        // tools — but the coordinator tools were registered before that and
+        // unconditionally, so `{ create_task: 'disabled' }` was honoured
+        // everywhere except the one surface a host would most want to decline.
+        // A run that must not delegate had prompt text and a gateway refusal as
+        // its only defences.
+        //
+        // Collision REFUSES rather than overwrites, and the principle is
+        // complete mediation rather than fail-safe defaults: "proposals to gain
+        // performance by remembering the result of an authority check [must] be
+        // examined skeptically. If a change in authority occurs, such remembered
+        // results must be systematically updated" (Saltzer & Schroeder 1975,
+        // §I.A.3(c)). A registry entry is a remembered binding of a name to an
+        // authority, and a later write that rebinds the name leaves every
+        // decision made about the old binding stale.
+        //
+        // The counter-argument is that today the host's tool merely loses
+        // quietly and the run still works, so six reserved names is a real cost
+        // on a name a consumer may have chosen long ago. It does not hold,
+        // because "loses quietly" is not what happens. `registerOne` ends with
+        // `availability.set(id, state)` and this call passes no state, so a tool
+        // the host registered `deferred` or `suspended` is silently PROMOTED to
+        // active under someone else's implementation; and because the store is a
+        // Map, the replacement inherits the host's insertion position in the
+        // prompt-cache prefix. That is a different authorization surface, not a
+        // lost registration. CWE-390 is the shape `ManagedRegistry` has here —
+        // detection of an error condition without action — and CWE-694's own
+        // mitigation is nearly this fix: do not operate any resource with a
+        // non-unique identifier, and report the error.
+        //
+        // Refusing is also what the peer set does. One runtime's registry
+        // primitive throws on both duplicate and reserved names; another refuses
+        // its injected delegation name in a pre-flight that tells the author to
+        // rename. Closer to home, `ProviderRegistry.register` already throws
+        // unless the caller passes `{ replace: true }` — declared intent is what
+        // separates a legitimate replacement from an accidental one, and no such
+        // intent is expressible here.
+        const overrides = input.runtimeToolOverrides;
         for (const tool of coordinatorToolDefs) {
-            tools.register(tool);
+            const override = overrides?.[tool.name];
+            if (override === 'disabled')
+                continue;
+            if (config.tools?.has(tool.name)) {
+                throw new ToolNameCollisionError(tool.name, 'the supervisor coordinator surface');
+            }
+            tools.register(tool, override ?? 'active');
         }
         const childInvocationState = deriveChildState(config.invocationState ?? { tenantId }, this.metadata.id);
         const run = await drainQuery({

package/dist/agents/SupervisorAgent.js.map

@@ -1 +1 @@
-{"version":3,"file":"SupervisorAgent.js","sourceRoot":"","sources":["../../src/agents/SupervisorAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAWrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACpC,WAAkC,EAClC,KAAY,EACZ,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI;YACxB,KAAK;YACL,MAAM,EAAE,QAAiB;YACzB,KAAK,EAAE,EAAE,GAAG,iBAAiB,EAAE;YAC/B,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE;YACtB,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,GAAG,GAAG,MAAM,CAAC,SAAS;YAClC,QAAQ,EAAE,EAAE;SACZ;QACD,SAAS,EAAE,KAAK;KAChB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,WAAuC;IAC1E,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAA;AACzE,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,aAA2D;IACtF,IAAI,GAAG,YAAqB,CAAA;IAErC,YAAY,QAAsD;QACjE,KAAK,CAAC;YACL,GAAG,QAAQ;YACX,IAAI,EAAE,YAAY;YAClB,YAAY,EAAE;gBACb,aAAa,EAAE,IAAI;gBACnB,iBAAiB,EAAE,IAAI;gBACvB,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EAAE,IAAI;aACvB;SACD,CAAC,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACR,KAAiB,EACjB,MAA6B,EAC7B,QAA2B;QAE3B,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACjE,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAC1E,CAAA;IACF,CAAC;IAEO,KAAK,CAAC,YAAY,CACzB,KAAiB,EACjB,MAA6B,EAC7B,QAA2B;QAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAEhC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CACd,+GAA+G,CAC/G,CAAA;QACF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAEhC,MAAM,WAAW,GAAa;YAC7B,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAa;YACpC,QAAQ;SACR,CAAA;QAED,IAAI,OAAoB,CAAA;QACxB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QACzB,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,oBAAoB,GAAG,MAAM,CAAC,cAAc;gBACjD,CAAC,CAAC;oBACA,GAAG,MAAM,CAAC,cAAc;oBACxB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,cAAc,CAAC,UAAU;iBACjE;gBACF,CAAC,CAAC,MAAM,CAAC,UAAU;oBAClB,CAAC,CAAE;wBACD,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC6B;oBAC5D,CAAC,CAAC,SAAS,CAAA;YAEb,MAAM,WAAW,GAAqB;gBACrC,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC/B,qBAAqB,EAAE,IAAI,CAAC,eAAe;gBAC3C,KAAK,EAAE,CAAC;gBACR,aAAa,EAAE;oBACd,KAAK,EAAE,MAAM,CAAC,WAAW;oBACzB,SAAS,EAAE,MAAM,CAAC,WAAW;iBAC7B;gBACD,cAAc,EAAE,oBAAoB;gBACpC,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,WAAW;aACX,CAAA;YACD,OAAO,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAClF,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAA;QAEzD,IAAI,cAA8E,CAAA;QAElF,kEAAkE;QAClE,oEAAoE;QACpE,0DAA0D;QAC1D,MAAM,aAAa,GAAG,IAAI,mBAAmB,EAAE,CAAA;QAC/C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAA;QAE3C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;YACjD,OAAO;YACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,eAAe,EAAE,MAAM,CAAC,QAAQ;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK;YACL,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc;YACpC,cAAc,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE;gBACrC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACrC,CAAC;YACD,8DAA8D;YAC9D,+DAA+D;YAC/D,0DAA0D;YAC1D,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,aAAa;YACb,cAAc;SACd,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAA;QAChC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9D,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACxC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAC5C,MAAM,CAAC,eAAe,IAAI,EAAE,QAAQ,EAAE,EACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAChB,CAAA;QAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAC3B;YACC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;YACL,SAAS,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;aACf;YACD,aAAa;YACb,cAAc;YACd,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAC7B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,QAAQ;YACR,SAAS;YACT,QAAQ;YACR,KAAK;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM;YACpB,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;gBACrC,cAAc,GAAG,WAAW,CAAA;YAC7B,CAAC;YACD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW,EAAE,OAAO;YACpB,aAAa;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,oBAAoB;YACrC,gEAAgE;YAChE,6DAA6D;YAC7D,4DAA4D;YAC5D,8DAA8D;YAC9D,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,kEAAkE;YAClE,yDAAyD;YACzD,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,qBAAqB;gBAC/B,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,EACD,QAAQ,CACR,CAAA;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;QACvC,MAAM,WAAW,GAAG,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAE7D,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAEvD,OAAO;YACN,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YAC3D,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,UAAU;YACrB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,UAAU,EAAE,GAAG,CAAC,gBAAgB;YAChC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW;YACX,cAAc;YACd,UAAU,EAAE,WAAW,CAAC,MAAM;SAC9B,CAAA;IACF,CAAC;CACD"}
+{"version":3,"file":"SupervisorAgent.js","sourceRoot":"","sources":["../../src/agents/SupervisorAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAWrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACpC,WAAkC,EAClC,KAAY,EACZ,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI;YACxB,KAAK;YACL,MAAM,EAAE,QAAiB;YACzB,KAAK,EAAE,EAAE,GAAG,iBAAiB,EAAE;YAC/B,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE;YACtB,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,GAAG,GAAG,MAAM,CAAC,SAAS;YAClC,QAAQ,EAAE,EAAE;SACZ;QACD,SAAS,EAAE,KAAK;KAChB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,WAAuC;IAC1E,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAA;AACzE,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,aAA2D;IACtF,IAAI,GAAG,YAAqB,CAAA;IAErC,YAAY,QAAsD;QACjE,KAAK,CAAC;YACL,GAAG,QAAQ;YACX,IAAI,EAAE,YAAY;YAClB,YAAY,EAAE;gBACb,aAAa,EAAE,IAAI;gBACnB,iBAAiB,EAAE,IAAI;gBACvB,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EAAE,IAAI;aACvB;SACD,CAAC,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACR,KAAiB,EACjB,MAA6B,EAC7B,QAA2B;QAE3B,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACjE,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAC1E,CAAA;IACF,CAAC;IAEO,KAAK,CAAC,YAAY,CACzB,KAAiB,EACjB,MAA6B,EAC7B,QAA2B;QAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAEhC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CACd,+GAA+G,CAC/G,CAAA;QACF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAEhC,MAAM,WAAW,GAAa;YAC7B,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAa;YACpC,QAAQ;SACR,CAAA;QAED,IAAI,OAAoB,CAAA;QACxB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QACzB,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,oBAAoB,GAAG,MAAM,CAAC,cAAc;gBACjD,CAAC,CAAC;oBACA,GAAG,MAAM,CAAC,cAAc;oBACxB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,cAAc,CAAC,UAAU;iBACjE;gBACF,CAAC,CAAC,MAAM,CAAC,UAAU;oBAClB,CAAC,CAAE;wBACD,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC6B;oBAC5D,CAAC,CAAC,SAAS,CAAA;YAEb,MAAM,WAAW,GAAqB;gBACrC,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC/B,qBAAqB,EAAE,IAAI,CAAC,eAAe;gBAC3C,KAAK,EAAE,CAAC;gBACR,aAAa,EAAE;oBACd,KAAK,EAAE,MAAM,CAAC,WAAW;oBACzB,SAAS,EAAE,MAAM,CAAC,WAAW;iBAC7B;gBACD,cAAc,EAAE,oBAAoB;gBACpC,+DAA+D;gBAC/D,6DAA6D;gBAC7D,0DAA0D;gBAC1D,4DAA4D;gBAC5D,yDAAyD;gBACzD,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,WAAW;aACX,CAAA;YACD,OAAO,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAClF,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAA;QAEzD,IAAI,cAA8E,CAAA;QAElF,kEAAkE;QAClE,oEAAoE;QACpE,0DAA0D;QAC1D,MAAM,aAAa,GAAG,IAAI,mBAAmB,EAAE,CAAA;QAC/C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAA;QAE3C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;YACjD,OAAO;YACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,eAAe,EAAE,MAAM,CAAC,QAAQ;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK;YACL,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc;YACpC,cAAc,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE;gBACrC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACrC,CAAC;YACD,8DAA8D;YAC9D,+DAA+D;YAC/D,0DAA0D;YAC1D,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,aAAa;YACb,cAAc;SACd,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAA;QAChC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9D,CAAC;QACF,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,8BAA8B;QAC9B,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,iEAAiE;QACjE,uEAAuE;QACvE,wEAAwE;QACxE,qBAAqB;QACrB,EAAE;QACF,iEAAiE;QACjE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,6CAA6C;QAC7C,EAAE;QACF,kEAAkE;QAClE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,+CAA+C;QAC/C,EAAE;QACF,kEAAkE;QAClE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,8BAA8B;QAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,CAAA;QAC5C,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACvC,IAAI,QAAQ,KAAK,UAAU;gBAAE,SAAQ;YACrC,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,oCAAoC,CAAC,CAAA;YAClF,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAC5C,MAAM,CAAC,eAAe,IAAI,EAAE,QAAQ,EAAE,EACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAChB,CAAA;QAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAC3B;YACC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;YACL,SAAS,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;aACf;YACD,aAAa;YACb,cAAc;YACd,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAC7B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,QAAQ;YACR,SAAS;YACT,QAAQ;YACR,KAAK;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM;YACpB,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;gBACrC,cAAc,GAAG,WAAW,CAAA;YAC7B,CAAC;YACD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW,EAAE,OAAO;YACpB,aAAa;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,oBAAoB;YACrC,gEAAgE;YAChE,6DAA6D;YAC7D,4DAA4D;YAC5D,8DAA8D;YAC9D,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,kEAAkE;YAClE,yDAAyD;YACzD,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,qBAAqB;gBAC/B,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,EACD,QAAQ,CACR,CAAA;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;QACvC,MAAM,WAAW,GAAG,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAE7D,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAEvD,OAAO;YACN,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YAC3D,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,UAAU;YACrB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,UAAU,EAAE,GAAG,CAAC,gBAAgB;YAChC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW;YACX,cAAc;YACd,UAAU,EAAE,WAAW,CAAC,MAAM;SAC9B,CAAA;IACF,CAAC;CACD"}

package/dist/agents/__tests__/supervisor-coordinator-registration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=supervisor-coordinator-registration.test.d.ts.map

package/dist/agents/__tests__/supervisor-coordinator-registration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-coordinator-registration.test.d.ts","sourceRoot":"","sources":["../../../src/agents/__tests__/supervisor-coordinator-registration.test.ts"],"names":[],"mappings":""}

package/dist/agents/__tests__/supervisor-coordinator-registration.test.js

@@ -0,0 +1,122 @@
+import { mkdtemp } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, expect, it, vi } from 'vitest';
+import { z } from 'zod';
+import { MockLLMProvider } from '../../provider/mock.js';
+import { ToolNameCollisionError, ToolRegistry } from '../../registry/tool/execute.js';
+import { defineTool } from '../../tools/defineTool.js';
+import { SupervisorAgent } from '../SupervisorAgent.js';
+/**
+ * How the supervisor mounts its own coordinator tools.
+ *
+ * `runtimeToolOverrides` is this SDK's declared way for a host to decline a
+ * kernel-mounted tool. It is honoured for the task tools and the advisory
+ * tools inside `drainQuery`, and the supervisor forwards it there — but the
+ * supervisor registered the coordinator tools BEFORE that call and
+ * unconditionally, so `{ create_task: 'disabled' }` was obeyed everywhere
+ * except the one surface a host would most want to decline.
+ *
+ * The second case is the collision: `ManagedRegistry` warns and overwrites, so
+ * a host tool sharing a coordinator name vanished into a log line and the
+ * model kept a `create_task` whose behaviour depended on registration order.
+ */
+const HOST_TOOL_DESCRIPTION = 'a tool this host registered deliberately';
+function stubManager() {
+    return {
+        sendMessage: vi.fn(async () => ({ taskId: 'task_1', status: 'completed' })),
+        await: vi.fn(async () => undefined),
+        cancel: vi.fn(),
+        dispose: vi.fn(),
+        on: vi.fn(),
+        off: vi.fn(),
+    };
+}
+const hostTool = (name) => defineTool({
+    name,
+    description: HOST_TOOL_DESCRIPTION,
+    inputSchema: z.object({}),
+    category: 'custom',
+    permissions: [],
+    readOnly: true,
+    destructive: false,
+    concurrencySafe: true,
+    async execute() {
+        return { success: true, output: 'host tool ran' };
+    },
+});
+async function runWith(options) {
+    const agent = new SupervisorAgent({
+        id: 'supervisor',
+        name: 'Supervisor',
+        version: '1',
+        category: 'test',
+        description: 'coordinates workers',
+    });
+    const provider = new MockLLMProvider({ turns: [{ text: 'nothing to delegate' }] });
+    const tools = new ToolRegistry();
+    for (const name of options.hostTools ?? [])
+        tools.register(hostTool(name));
+    await agent.run({
+        messages: [{ role: 'user', content: 'go', timestamp: 1 }],
+        workingDirectory: await mkdtemp(join(tmpdir(), 'namzu-sup-reg-')),
+        ...(options.runtimeToolOverrides
+            ? { runtimeToolOverrides: options.runtimeToolOverrides }
+            : {}),
+    }, {
+        provider,
+        agentIds: ['worker'],
+        agentManager: stubManager(),
+        tools,
+        systemPrompt: 'You coordinate.',
+        model: 'mock-model',
+        tokenBudget: 100_000,
+        timeoutMs: 30_000,
+        maxIterations: 2,
+        sessionId: 'ses_sup',
+        threadId: 'thd_sup',
+        projectId: 'prj_sup',
+        tenantId: 'tnt_sup',
+    });
+    const advertised = provider.requests[0]?.tools ?? [];
+    return {
+        names: new Set(advertised.map((t) => t.function.name)),
+        describedAs: (name) => advertised.find((t) => t.function.name === name)?.function.description ?? '',
+    };
+}
+describe('supervisor coordinator-tool registration', () => {
+    it('advertises create_task by default', async () => {
+        expect((await runWith({})).names).toContain('create_task');
+    });
+    it('does not advertise a coordinator tool the host disabled', async () => {
+        const { names } = await runWith({ runtimeToolOverrides: { create_task: 'disabled' } });
+        expect(names).not.toContain('create_task');
+        // Declining one coordinator tool must not decline the rest.
+        expect(names).toContain('agent_task_list');
+    });
+    it('leaves a host tool that shares no coordinator name alone', async () => {
+        const { names } = await runWith({ hostTools: ['host_only'] });
+        expect(names).toContain('host_only');
+        expect(names).toContain('create_task');
+    });
+    it('refuses to take a name the host already registered', async () => {
+        // Named and carrying the name, so a host can catch it narrowly rather
+        // than match on message text — the shape `DuplicateProviderError`
+        // already set in this repo.
+        await expect(runWith({ hostTools: ['create_task'] })).rejects.toThrow(ToolNameCollisionError);
+        await expect(runWith({ hostTools: ['create_task'] })).rejects.toThrow(/runtimeToolOverrides: \{ "create_task": "disabled" \}/);
+    });
+    it('lets the host keep its own tool under that name by declining the coordinator one', async () => {
+        const { names, describedAs } = await runWith({
+            hostTools: ['create_task'],
+            runtimeToolOverrides: { create_task: 'disabled' },
+        });
+        expect(names).toContain('create_task');
+        expect(names).toContain('agent_task_list');
+        // The name surviving is not the assertion — WHOSE tool holds it is.
+        // Overwriting also leaves the name present, so a membership check
+        // alone passes against the very behaviour this replaces.
+        expect(describedAs('create_task')).toBe(HOST_TOOL_DESCRIPTION);
+    });
+});
+//# sourceMappingURL=supervisor-coordinator-registration.test.js.map

package/dist/agents/__tests__/supervisor-coordinator-registration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-coordinator-registration.test.js","sourceRoot":"","sources":["../../../src/agents/__tests__/supervisor-coordinator-registration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AAEH,MAAM,qBAAqB,GAAG,0CAA0C,CAAA;AAExE,SAAS,WAAW;IACnB,OAAO;QACN,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3E,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;QACnC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;QACf,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;QAChB,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;QACX,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;KACZ,CAAA;AACF,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,UAAU,CAAC;IACV,IAAI;IACJ,WAAW,EAAE,qBAAqB;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACzB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,IAAI;IACd,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,KAAK,CAAC,OAAO;QACZ,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC3D,CAAC;CACD,CAAC,CAAA;AAEH,KAAK,UAAU,OAAO,CAAC,OAGtB;IACA,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;QACjC,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,qBAAqB;KAClC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,EAAE,CAAC,CAAA;IAElF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE;QAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAE1E,MAAM,KAAK,CAAC,GAAG,CACd;QACC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACzD,gBAAgB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,oBAAoB;YAC/B,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;KACG,EACV;QACC,QAAQ;QACR,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,YAAY,EAAE,WAAW,EAAE;QAC3B,KAAK;QACL,YAAY,EAAE,iBAAiB;QAC/B,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,OAAO;QACpB,SAAS,EAAE,MAAM;QACjB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE,SAAS;QACpB,QAAQ,EAAE,SAAS;KACV,CACV,CAAA;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAA;IACpD,OAAO;QACN,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtD,WAAW,EAAE,CAAC,IAAY,EAAE,EAAE,CAC7B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;KAC7E,CAAA;AACF,CAAC;AAED,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACzD,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,oBAAoB,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAEtF,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QAC1C,4DAA4D;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAE7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QACnE,sEAAsE;QACtE,kEAAkE;QAClE,4BAA4B;QAC5B,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;QAC7F,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACpE,uDAAuD,CACvD,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,OAAO,CAAC;YAC5C,SAAS,EAAE,CAAC,aAAa,CAAC;YAC1B,oBAAoB,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;SACjD,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;QACtC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;QAC1C,oEAAoE;QACpE,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/agents/__tests__/supervisor-hands-down-hitl.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=supervisor-hands-down-hitl.test.d.ts.map

package/dist/agents/__tests__/supervisor-hands-down-hitl.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-hands-down-hitl.test.d.ts","sourceRoot":"","sources":["../../../src/agents/__tests__/supervisor-hands-down-hitl.test.ts"],"names":[],"mappings":""}