@namzu/sdk 3.3.0 → 5.0.0

package/CHANGELOG.md

@@ -1,5 +1,435 @@
 # Changelog
 
+## 5.0.0
+
+### Major Changes
+
+- 1cd1094: Thinking is now resolved per model, `effort` is sendable, and thinking tokens
+  are reported.
+
+  **Thinking on a current model was a failed request, not a degraded one.** The
+  driver mapped `type: 'enabled'` straight to the wire and everything else to
+  `disabled`. The vendor rejects a mismatched mode with a 400 rather than
+  falling back: `thinking.type.enabled` is refused from Claude 4.7 onward,
+  `adaptive` is refused on 4.5 and earlier, and the always-on models refuse
+  `disabled`. One body for every model does not compromise quality, it fails.
+
+  `ThinkingConfig.type` gains `'adaptive'`, and the Anthropic driver resolves the
+  declared intent against the model it is about to call — sending the mode that
+  model accepts, dropping a budget where budgets have no meaning, and omitting
+  the field entirely rather than asking an always-on model to stop thinking. An
+  unrecognised model is treated as manual-only, which is the previous behaviour
+  and keeps a gateway serving an older model working.
+
+  **`ThinkingConfig.display` is narrowed to `'summarized' | 'omitted'`**, and now
+  actually reaches the wire. It was `'full' | 'summarized'`: `'full'` is not a
+  value any vendor accepts — a declared option that could only ever have been
+  rejected — and `'omitted'` was missing. It also was not serialized at all,
+  which matters more than it sounds: `display` defaults to `'omitted'` on newer
+  models, so a caller wanting to show reasoning received thinking blocks with
+  empty text and nothing to explain why.
+
+  **`effort` is new on `ChatCompletionParams`** — `'low' | 'medium' | 'high' |
+'xhigh' | 'max'`. It goes out as `output_config.effort`, a _sibling_ of
+  `thinking` rather than a field inside it, because it shapes the whole response
+  and one manual-mode model accepts it alongside a token budget; nesting it would
+  have made that combination unsayable. It is dropped on models that do not
+  accept it, and refused in the one combination the vendor rejects — thinking
+  disabled at `xhigh`/`max`.
+
+  **`TokenUsage.reasoningTokens`** carries `output_tokens_details.thinking_tokens`
+  when the vendor reports it. It is a _subset_ of `completionTokens`, not an
+  addition — reasoning is billed as output, so summing it into a total would
+  double-count. Absent means not reported, never zero: coercing would claim every
+  turn on every silent driver did no thinking, and streamed events carry the
+  breakdown only on the final delta.
+
+  **Migration.** `display: 'full'` no longer compiles — use `'summarized'`, which
+  is what it meant. Code passing `thinking: { type: 'enabled', budgetTokens }`
+  keeps working and is now translated per model instead of rejected by newer
+  ones. `assertThinkingSupported` in `@namzu/openai` refuses `'adaptive'` as it
+  already refused `'enabled'`, since that driver implements neither.
+
+  Not changed: a report accompanying this work claimed `temperature`, `top_p` and
+  `top_k` are rejected on 5-series models and should be dropped by the driver.
+  The Messages reference, the extended-thinking page and the thinking
+  troubleshooting page document no such restriction, so nothing was implemented —
+  silently dropping sampling parameters that would have worked is its own defect.
+
+### Minor Changes
+
+- 19d6a0f: A host can now steer a turn that is already running.
+
+  `AgentManager.queueMessage` and `drainMessages` have existed for a while and
+  nothing in the iteration loop ever read them — the type said so outright. So a
+  host watching a run go the wrong way had two options, both worse than they
+  sound: cancel and start over, throwing away every tool result already paid
+  for; or reject through the review gate, which only works when a call happens
+  to be pending approval and says "no" when the host meant "yes, but read this
+  first".
+
+  `SteeringChannel` is the delivery that was missing. A host holds one, passes
+  it as `steering` on `drainQuery` params or `SupervisorAgentConfig`, and calls
+  `steer(text)` whenever it likes. Anything queued while a tool batch is running
+  is appended to that batch's **last tool result**.
+
+  That slot is not a stylistic choice. A `tool_use` block must be answered by a
+  `tool_result` with the same id, so a user message wedged between them is
+  rejected by the provider — there is no legal place to insert one mid-batch.
+  The tool result is the slot that already exists, and this SDK had already
+  reached that conclusion for the neighbouring case: a denied call carries its
+  reason inside the `tool_result`, precisely because that is where the model
+  looks for tool outcomes. Steering is the same delivery with the refusal taken
+  out.
+
+  It deliberately does not interrupt. The batch in flight finishes and the
+  guidance lands where the model reads next; a host that wants the current work
+  stopped wants `AbortSignal`, which is a different question. Conflating them is
+  how "also check the tests" ends up killing a half-written file.
+
+  Details worth knowing:
+
+  - Repeated calls before a drain accumulate in order rather than replacing each
+    other — two corrections typed a second apart are two things the model should
+    see.
+  - Guidance is labelled as coming from the operator. Unlabelled it would read
+    as something the tool said, so "stop and ask me first" would look like
+    output from `bash`. This is not the untrusted-content envelope: the operator
+    is the one party whose words the agent _should_ act on.
+  - A turn that called no tools has nothing in flight, so guidance stays queued
+    for the next one instead of being dropped.
+
+  Absent, the loop is byte-identical to before.
+
+- 1500973: Every driver that cannot think now says so instead of dropping the request.
+
+  `thinking` sits on `ChatCompletionParams`, so every driver accepts it. Five of
+  them — Bedrock, OpenRouter, HTTP, Ollama, LM Studio — implemented none of it
+  and dropped the field: the caller got an ordinary completion with an empty
+  `reasoning` array, which is indistinguishable from a model that simply chose
+  not to reason. The request looked honoured and the answer looked like an
+  answer.
+
+  The OpenAI driver already refused instead, with the reasoning written out
+  beside it. So the rule had been decided once and applied once, while five
+  siblings went on being silent. It moves to `@namzu/sdk` as
+  `assertThinkingUnsupported(driverName, params)`, and a new driver now inherits
+  it rather than re-deciding it.
+
+  The error names the driver, which in a multi-provider setup is the difference
+  between a bug report about the model and a one-line configuration fix.
+
+  **Turning thinking off stays a no-op** on all of them, because that is the
+  state a driver without thinking is already in — a config shared across
+  providers saying `{ type: 'disabled' }` should not fail on the ones that were
+  never going to think.
+
+  `assertThinkingSupported` in `@namzu/openai` is unchanged as an export and now
+  delegates to the shared helper. Its message changed: it no longer says
+  "extended thinking", because `adaptive` is refused too and calling that
+  extended would be wrong.
+
+  **Migration.** If you passed `thinking` to any of the five and relied on it
+  being ignored, remove it — you were receiving a non-thinking answer either way,
+  and now you find out at the call instead of by inspecting an empty array.
+
+  Not in this change: implementing thinking natively on Bedrock, which serves the
+  same Claude models through a different wire and deserves the per-model
+  resolution the Anthropic driver just gained. That needs the Converse request
+  and response shapes verified against the reference first, and is not something
+  to guess at.
+
+- a2cedfd: Adds `runAgent` — a provider, a model and a prompt is now a complete agent run.
+
+  `drainQuery` is the kernel's entry point and takes eleven required parameters,
+  four of which are identity fields that throw when missing. That is the right
+  shape for a kernel: a run with no tenant is a run no auditor can attribute. It
+  is the wrong shape for the first thing anybody writes, and the proof was
+  in-tree — the eval suites, the test files and the CLI each hand-assembled the
+  same block, which is what a missing front door looks like from the inside.
+
+  ```ts
+  const { output } = await runAgent({
+    provider,
+    model,
+    prompt: "What is 2 + 2?",
+  });
+  ```
+
+  It supplies an environment rather than a new engine: it generates the session
+  identity a single-tenant local run has no opinion about, defaults the budgets,
+  and points the working directory at the process's own. Everything it fills in
+  is an ordinary `drainQuery` parameter, so there is no second code path — a
+  caller who outgrows it passes more options until they are calling `drainQuery`
+  in all but name.
+
+  The identity comes back on the result, and that pairing is the point.
+  Generating one silently would make each call its own session — right for a
+  one-shot and wrong for a conversation, where turn two would start with no
+  history and nothing would say so. Spread `result.identity` into the next call
+  to continue the same session.
+
+  `model` stays required. `LLMProvider` carries no model — a driver may have been
+  constructed with one, but the interface does not expose it, so anything
+  inferred here would be a guess billed to the caller.
+
+  Defaults are safe rather than generous, because nobody reads them before their
+  first runaway loop: 16 iterations, a 200k token budget, a 5-minute timeout.
+  Each is overridable and named on the option.
+
+  The README quick start now shows this instead of a bare `provider.chat()` call
+  — that example demonstrated an HTTP client, not the kernel.
+
+## 4.0.0
+
+### Major Changes
+
+- c3cb587: `read`, `write` and `edit` are now contained to the working directory.
+
+  All three called `resolve(workingDirectory, input.path)` bare, so
+  `path: "../../.."` reached whatever sits above the working directory and the
+  tool used it. No sandbox had to be misconfigured for this — it holds with no
+  sandbox at all, which is the common case, so a model that asks for a parent
+  directory got one. `resolveWithin` existed the whole time and these three
+  never reached it; the search tools (`glob`, `grep`, `ls`) did.
+
+  A lexical check alone would not have been the fix. `atomicWriteFile` resolves
+  its destination and writes _through_ a symlink deliberately, so that editing a
+  linked file updates the target rather than replacing the link with a regular
+  file. Paired with a lexical check that is check-then-follow: a link inside the
+  working directory pointing outside it climbs nothing on paper, and the write
+  lands outside anyway (CWE-59). Containment is therefore decided after
+  canonicalization, which is the ordering CWE-22 states as the mitigation for
+  the family: canonicalize, then validate the canonical form.
+
+  Two details the new resolver has to get right, because getting either wrong
+  breaks ordinary use rather than failing safe:
+
+  - The root can itself be a symlink — `os.tmpdir()` is one on macOS — so both
+    sides are canonicalized. Canonicalizing only the candidate would refuse
+    every path under a temp directory.
+  - The target may not exist yet, and `realpath` throws on a missing path. The
+    deepest existing ancestor is canonicalized and the remainder appended
+    lexically; the remainder cannot hide a link because nothing is there to be
+    one.
+
+  This does not claim TOCTOU safety. A component swapped for a symlink between
+  the check and the open would still be followed — closing that needs
+  per-component `openat`/`O_NOFOLLOW`, which Node does not expose. The threat
+  addressed is a link that is already present.
+
+  **Migration.** If a host relied on these tools reaching outside
+  `workingDirectory` — reading a config beside the repo, writing to a sibling
+  output directory — those calls now fail with "Path escapes the working
+  directory". Point `workingDirectory` at a root that contains everything the
+  run legitimately needs. Sandboxed runs are unaffected: the sandbox has its own
+  root and its own resolver, and the host-side canonicalization deliberately
+  does not run on that branch.
+
+- a1f67f3: Two allow-lists in the delegation surface stop failing open, and a host can
+  now decline a coordinator tool.
+
+  ## An empty delegate roster means nobody
+
+  `create_task` derived its `agent_id` parameter from `allowedAgentIds` but
+  widened it from the roster enum to a bare string whenever that roster was
+  empty — so the one configuration meaning "this run may delegate to nobody" was
+  the only one that let the model name anybody. An allow-list _is_ the
+  enumeration of what is permitted; an empty one enumerates nothing and admits
+  nothing. Degrading it to an open string to keep functioning is failing open
+  (CWE-636), and the rule it breaks is fail-safe defaults (Saltzer & Schroeder
+  1975, §I.A.3(b)), restated in NIST SP 800-53 Rev. 5 as SC-7(5) "deny by
+  default, allow by exception".
+
+  What that reached is why this is worth a break. The id was not merely rejected
+  downstream: it went to the gateway, which resolves against an `AgentManager`
+  that is typically **shared**, so an agent the host deliberately left out of
+  `agentIds` could still launch if it happened to be registered there. When it
+  was not registered, the failure text listed every registered agent id back to
+  the model, and the plan row was left stranded at `in_progress` because the
+  store write precedes the gateway call while the reconciling update follows it.
+
+  `create_task` is now **not mounted** when the roster is empty, rather than
+  mounted with a schema nothing satisfies — refusing per call reaches the same
+  verdict while paying prompt-prefix tokens and an iteration for it (NIST SP
+  800-53 CM-7, least functionality). It is the only coordinator tool that reads
+  the roster, so `agent_task_list`, `approve_plan` and `ask_user_question` are
+  untouched: "no delegates, but still planning and a human channel" remains a
+  supported configuration. The schema stays closed underneath as defence in
+  depth. If you construct a supervisor with `agentIds: []` and expected
+  `create_task` to be callable, populate the roster — there is no flag that
+  restores the old shape, because the old shape could not correctly succeed.
+
+  `buildAgentTool` carried the identical fallback and now throws at construction
+  instead: it returns exactly one tool and that tool _is_ the delegation surface,
+  so "do not mount it" and "do not build it" are the same statement. It also
+  never checked `subagent_type` against the roster inside `execute`, which is
+  reachable without going through the registry; it does now.
+
+  ## A host can decline a coordinator tool
+
+  `runtimeToolOverrides` is this SDK's declared way to decline a kernel-mounted
+  tool. It is honoured for the task tools and the advisory tools, and
+  `SupervisorAgent` forwards it into its own `drainQuery` call — but it
+  registered the coordinator tools before that, unconditionally, so
+  `{ create_task: 'disabled' }` was obeyed everywhere except the one surface a
+  host would most want to decline. A run that must not delegate had prompt text
+  and a gateway refusal as its only defences. This half is pure gap-closure: the
+  mechanism, the type and two other call sites already existed, and coordinator
+  registration now uses the same idiom.
+
+  ## Collisions refuse instead of overwriting
+
+  This half is new policy, not a gap-closure. Registration now throws
+  `ToolNameCollisionError` (exported, carrying `toolName`) when a coordinator
+  tool's name is already registered on the supervisor's `tools`, instead of the
+  registry's warn-and-overwrite. The reserved names are `create_task`,
+  `agent_task_list`, `approve_plan`, and `ask_user_question` — grep for those
+  four.
+
+  The old behaviour was not "the host's tool quietly loses and the run works".
+  `registerOne` ends by setting availability, and the coordinator call passed
+  none, so a tool the host registered `deferred` or `suspended` was silently
+  promoted to `active` under someone else's implementation; and because the
+  backing store is a `Map`, the replacement inherited the host's insertion
+  position in the prompt-cache prefix. That is a different authorization surface,
+  not a lost registration — detection of an error condition without action
+  (CWE-390), where CWE-694's own mitigation is nearly this fix. Complete
+  mediation is the principle (§I.A.3(c)): a registry entry is a remembered
+  binding of a name to an authority, and rebinding it leaves every decision made
+  about the old binding stale.
+
+  To migrate: rename your tool, or keep your name and decline the coordinator one
+  with `runtimeToolOverrides: { "create_task": "disabled" }`. The error names
+  both routes.
+
+- df07db8: Removes `ToolCatalogSurface` and `ToolsetPolicy.surfaces`.
+
+  Both were deprecated in 3.2.0 and shipped deprecated again in 3.3.0, so the
+  window SemVer asks for — at least one minor release in which working code
+  compiles and warns — has been served twice. The deprecation said "slated for
+  removal in the next major"; this is that major, and letting it pass would move
+  the promise to 5.0.0.
+
+  Nothing produced or read either one. No code constructed a member of the
+  union, and `surfaces` was the only field carrying it and was never consulted,
+  so there is no runtime behaviour to change and no working code to migrate:
+  setting it did nothing before and the field is gone now. Under this repo's
+  release rule that is the case where a removal may go straight to major, and it
+  is being said here as that rule asks.
+
+  It was also the wrong axis. Which tools a run may use is already expressible
+  four ways, all per-run and dynamic where this was fixed at definition:
+  `allowedTools` on the query, `ToolAvailability` (`active` / `deferred` /
+  `suspended`) with mid-run activation, `runtimeToolOverrides`, and capability
+  negotiation stripping tools a driver cannot carry. If you set `surfaces`,
+  `allowedTools` is the replacement — it says the same thing per run.
+
+  `SharedRunWorkspace` is unchanged and stays exported without an SDK-side
+  caller. That is deliberate and now documented on the class: its config asks for
+  a host filesystem root and the path an agent will see, which is a deployment
+  shape the kernel does not own. `runtimeRoot` and the paths `refs()` derives
+  from it are the contract.
+
+- 19f390a: A delegated agent's output is now framed as untrusted material, and the
+  framing itself can no longer be forged.
+
+  **Why the child→parent return.** A delegated worker is the component most
+  likely to have consumed something nobody in the run authored: it was handed a
+  task like "read these files and report", it ran `read`, `grep`, possibly a
+  connector fetch over material the user did not write, and its final text
+  landed directly in the parent's context — where the parent typically holds a
+  broader tool grant than the child that produced the text. An unlabelled block
+  there reads as the parent's own reasoning. Connector-supplied prompts already
+  got this treatment; the delegation surface had none.
+
+  `create_task` and the `Agent` tool now wrap their `output` in a
+  `<namzu-untrusted kind="agent-result">` frame naming the agent and task, with
+  one line saying the content is material rather than direction. The worker's
+  text is unaltered inside it, and `data.result` carries it verbatim, so a host
+  reading the result programmatically is unaffected — only the model-facing
+  string changed.
+
+  **The framing was forgeable, and that is fixed.** The existing envelope around
+  connector prompts built its tag by hand and interpolated remote text straight
+  into the body. A prompt whose content contained `</mcp-prompt>` closed the
+  block early, and everything the server wrote after that read as unlabelled —
+  which is to say, as this agent's own instructions. The label was the entire
+  mitigation and the labelled party could remove it. `wrapUntrusted` now defangs
+  the delimiter case-insensitively (a model reads `</NAMZU-UNTRUSTED>` as the
+  same tag) and escapes attribute values, so a source name carrying a quote
+  cannot rewrite the tag it appears in.
+
+  Two decisions worth stating because the obvious alternatives are wrong:
+
+  - **No length threshold.** Skipping short payloads to save tokens leaves the
+    cheapest carrier unframed; an instruction fits in a tweet.
+  - **No "already wrapped, skip it" fast path.** That check is forgeable —
+    content merely beginning with the opening tag would pass through with no
+    framing at all. Wrapping twice is harmless; not wrapping once is not.
+
+  `wrapUntrusted`, `neutralizeEnvelopeDelimiter` and `UntrustedEnvelope` are
+  exported, so a host surfacing its own untrusted content to a model can use the
+  same framing rather than inventing one.
+
+  **Migration.** If you assert on `create_task` or `Agent` output text, read
+  `data.result` instead — it is the worker's text with nothing added. If you
+  call `renderPromptMessages` directly, its output opens with
+  `<namzu-untrusted kind="mcp-prompt" …>` rather than `<mcp-prompt …>`.
+
+### Minor Changes
+
+- 2b9d90e: `edit` can do the thing its own description tells the model to do.
+
+  The tool description says _"For insertions, pass insertLine … use `insertLine: "end"` to extend a file at the end"_, and `write-file` and `bash` point at the same idiom. But `modelInputSchema` advertised only `path`/`old_string`/`new_string`/`replace_all` with `additionalProperties: false`, and `enforceModelInput: true` — so under constrained decoding the append idiom the prompt recommends was the one idiom a model could not emit. A consuming host measured the result over seven days on one tenant: **94 of 159 tool failures** were `edit` rejecting an `insertLine` whose spelling the model had guessed.
+
+  `insertLine` is now in the model-facing schema as `oneOf: [integer ≥ 0, "end"]`. Declaring the union that way also removes the synonym problem at its source: for a provider that constrains generation, `"EOF"` is not emittable, because `"end"` is the only string the schema admits.
+
+  `old_string` leaves `required`, because an insert has no text to match — requiring it is exactly what made the idiom unexpressible. Which of `old_string` / `insertLine` is present is decided by the two refinements the execution schema already carries. That is deliberate over a top-level `oneOf`: strict structured-output modes are least surprising with a flat object, and a discriminated union at the root is the construct most likely to be rejected or quietly ignored. The cost is that an incomplete call is now expressible and caught at execution rather than generation — paid knowingly, since the alternative is a working capability nothing can reach.
+
+  For providers that do **not** constrain, `insertLine` also accepts `eof`, `append`, `last` and `end_of_file`. Liberal at execution and strict in the schema is the right way round: none of those is ambiguous, and refusing one bought strictness at the price of a full model round trip. The rejection message now names the value it received.
+
+  Also here, same file family: **`write` refuses a whitespace-only path**, which `edit` has always refused. `.min(1)` admits `"   "`, which resolves to the working directory and fails as an unreadable directory-write error. Two mutating tools disagreeing about the same input is the kind of gap a model finds and a reviewer does not.
+
+- 4be54ca: Three sandbox and delegation gaps, all of the same kind: something declared,
+  threaded through types, and never driven.
+
+  **`SandboxExecOptions.signal` now works — on the backend where it can.** The
+  option was declared, documented and exported, with a docstring stating that
+  without it "a Stop could only ever abandon the _wait_ — the sandboxed process
+  kept running after the host believed the run had been cancelled". Every
+  backend dropped it, so that is exactly what happened. The local sandbox now
+  merges the caller's signal with the call's own deadline and hands the result to
+  `spawn`, so the child actually dies; a cancelled run is no longer reported as
+  `timedOut`, because a run someone stopped did not run too long, and telling the
+  model otherwise invites a retry with a bigger budget.
+
+  The remote backends still ignore it, now explicitly and with the reason in the
+  source. Their wire has no cancel op, so aborting the request would abandon the
+  wait while the command kept running — the original failure, wearing the
+  appearance of a fix. `SandboxExecOptions.signal` documents which backends
+  honour it.
+
+  **`ls` respects the sandbox.** It read the host through `node:fs` and named
+  `context.sandbox` nowhere, in the one builtin whose whole job is telling the
+  model what exists — so under a container or microVM backend the model's picture
+  of the filesystem was the host's. Its paths were host-relative too, while
+  `read`, `grep` and `glob` all resolve inside the sandbox, so an ls-to-read
+  handoff either failed or opened a different file than the one listed. `glob`
+  had the identical defect, was fixed, and its fix notes that "every sibling
+  builtin already remembers this branch"; this was the sibling that did not.
+
+  One behaviour difference worth knowing: inside a sandbox, directories are
+  derived from file paths, because `listFiles` reports files. An empty directory
+  is invisible there.
+
+  **The `Agent` tool's header described a design that no longer exists.** It told
+  readers to prefer `Agent` because `create_task` was a non-blocking trio driven
+  by notification callbacks. `create_task` blocks and returns the worker's output
+  as its own result, and `continue_task` / `cancel_task` are not registered at
+  all. The two tools are separated by how much of the coordinator surface they
+  bring, not by timing.
+
 ## 3.3.0
 
 ### Minor Changes

package/dist/agents/SupervisorAgent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SupervisorAgent.d.ts","sourceRoot":"","sources":["../../src/agents/SupervisorAgent.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,KAAK,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,KAAK,EAAW,KAAK,EAAU,MAAM,uBAAuB,CAAA;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,KAAK,EAAE,KAAK,EACZ,GAAG,GAAE,MAAmB,GACtB,eAAe,EAAE,CAcnB;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAEnF;AAED,qBAAa,eAAgB,SAAQ,aAAa,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IAC/F,QAAQ,CAAC,IAAI,EAAG,YAAY,CAAS;gBAEzB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,cAAc,CAAC;IAalE;;;;;;;;OAQG;IACG,GAAG,CACR,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,qBAAqB,CAAC;YAMnB,YAAY;CA2L1B"}
+{"version":3,"file":"SupervisorAgent.d.ts","sourceRoot":"","sources":["../../src/agents/SupervisorAgent.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAe,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,KAAK,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,MAAM,yBAAyB,CAAA;AAEhC,OAAO,KAAK,EAAW,KAAK,EAAU,MAAM,uBAAuB,CAAA;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACpC,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,KAAK,EAAE,KAAK,EACZ,GAAG,GAAE,MAAmB,GACtB,eAAe,EAAE,CAcnB;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,GAAG,MAAM,CAEnF;AAED,qBAAa,eAAgB,SAAQ,aAAa,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IAC/F,QAAQ,CAAC,IAAI,EAAG,YAAY,CAAS;gBAEzB,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,cAAc,CAAC;IAalE;;;;;;;;OAQG;IACG,GAAG,CACR,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,qBAAqB,CAAC;YAMnB,YAAY;CAkP1B"}

package/dist/agents/SupervisorAgent.js

@@ -1,6 +1,6 @@
 import { EMPTY_TOKEN_USAGE } from '../constants/limits.js';
 import { LocalTaskGateway } from '../gateway/local.js';
-import { ToolRegistry } from '../registry/tool/execute.js';
+import { ToolNameCollisionError, ToolRegistry } from '../registry/tool/execute.js';
 import { drainQuery } from '../runtime/query/index.js';
 import { PendingAnswers, QuestionParkBinding } from '../runtime/query/question-park.js';
 import { buildCoordinatorTools } from '../tools/coordinator/index.js';
@@ -156,8 +156,58 @@ export class SupervisorAgent extends AbstractAgent {
                 tools.register(tool, config.tools.getAvailability(tool.name));
             }
         }
+        // Registered the way every other kernel-mounted tool in this SDK is
+        // registered: honouring `runtimeToolOverrides`, and refusing to take a
+        // name the host already used.
+        //
+        // Both halves were missing here and nowhere else. `runtimeToolOverrides`
+        // is declared on `AgentInput`, is forwarded into this very `drainQuery`
+        // call below, and is consulted for the task tools and for the advisory
+        // tools — but the coordinator tools were registered before that and
+        // unconditionally, so `{ create_task: 'disabled' }` was honoured
+        // everywhere except the one surface a host would most want to decline.
+        // A run that must not delegate had prompt text and a gateway refusal as
+        // its only defences.
+        //
+        // Collision REFUSES rather than overwrites, and the principle is
+        // complete mediation rather than fail-safe defaults: "proposals to gain
+        // performance by remembering the result of an authority check [must] be
+        // examined skeptically. If a change in authority occurs, such remembered
+        // results must be systematically updated" (Saltzer & Schroeder 1975,
+        // §I.A.3(c)). A registry entry is a remembered binding of a name to an
+        // authority, and a later write that rebinds the name leaves every
+        // decision made about the old binding stale.
+        //
+        // The counter-argument is that today the host's tool merely loses
+        // quietly and the run still works, so six reserved names is a real cost
+        // on a name a consumer may have chosen long ago. It does not hold,
+        // because "loses quietly" is not what happens. `registerOne` ends with
+        // `availability.set(id, state)` and this call passes no state, so a tool
+        // the host registered `deferred` or `suspended` is silently PROMOTED to
+        // active under someone else's implementation; and because the store is a
+        // Map, the replacement inherits the host's insertion position in the
+        // prompt-cache prefix. That is a different authorization surface, not a
+        // lost registration. CWE-390 is the shape `ManagedRegistry` has here —
+        // detection of an error condition without action — and CWE-694's own
+        // mitigation is nearly this fix: do not operate any resource with a
+        // non-unique identifier, and report the error.
+        //
+        // Refusing is also what the peer set does. One runtime's registry
+        // primitive throws on both duplicate and reserved names; another refuses
+        // its injected delegation name in a pre-flight that tells the author to
+        // rename. Closer to home, `ProviderRegistry.register` already throws
+        // unless the caller passes `{ replace: true }` — declared intent is what
+        // separates a legitimate replacement from an accidental one, and no such
+        // intent is expressible here.
+        const overrides = input.runtimeToolOverrides;
         for (const tool of coordinatorToolDefs) {
-            tools.register(tool);
+            const override = overrides?.[tool.name];
+            if (override === 'disabled')
+                continue;
+            if (config.tools?.has(tool.name)) {
+                throw new ToolNameCollisionError(tool.name, 'the supervisor coordinator surface');
+            }
+            tools.register(tool, override ?? 'active');
         }
         const childInvocationState = deriveChildState(config.invocationState ?? { tenantId }, this.metadata.id);
         const run = await drainQuery({
@@ -203,6 +253,12 @@ export class SupervisorAgent extends AbstractAgent {
             // auto-approve. drainQuery falls back to autoApproveHandler
             // when resumeHandler is omitted (= same behaviour as before).
             ...(config.resumeHandler ? { resumeHandler: config.resumeHandler } : {}),
+            // Forwarded for the same reason the handler is. A capability the
+            // kernel honours in `drainQuery` but that never reaches the
+            // surface a host actually constructs is a capability nobody can
+            // use — which is the shape of defect this file has already been
+            // corrected for twice.
+            ...(config.steering ? { steering: config.steering } : {}),
             ...(config.verificationGate ? { verificationGate: config.verificationGate } : {}),
             ...(config.sandboxProvider ? { sandboxProvider: config.sandboxProvider } : {}),
             // Working-memory / compaction seam (optional; absent => unchanged

package/dist/agents/SupervisorAgent.js.map

@@ -1 +1 @@
-{"version":3,"file":"SupervisorAgent.js","sourceRoot":"","sources":["../../src/agents/SupervisorAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAWrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACpC,WAAkC,EAClC,KAAY,EACZ,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI;YACxB,KAAK;YACL,MAAM,EAAE,QAAiB;YACzB,KAAK,EAAE,EAAE,GAAG,iBAAiB,EAAE;YAC/B,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE;YACtB,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,GAAG,GAAG,MAAM,CAAC,SAAS;YAClC,QAAQ,EAAE,EAAE;SACZ;QACD,SAAS,EAAE,KAAK;KAChB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,WAAuC;IAC1E,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAA;AACzE,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,aAA2D;IACtF,IAAI,GAAG,YAAqB,CAAA;IAErC,YAAY,QAAsD;QACjE,KAAK,CAAC;YACL,GAAG,QAAQ;YACX,IAAI,EAAE,YAAY;YAClB,YAAY,EAAE;gBACb,aAAa,EAAE,IAAI;gBACnB,iBAAiB,EAAE,IAAI;gBACvB,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EAAE,IAAI;aACvB;SACD,CAAC,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACR,KAAiB,EACjB,MAA6B,EAC7B,QAA2B;QAE3B,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACjE,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAC1E,CAAA;IACF,CAAC;IAEO,KAAK,CAAC,YAAY,CACzB,KAAiB,EACjB,MAA6B,EAC7B,QAA2B;QAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAEhC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CACd,+GAA+G,CAC/G,CAAA;QACF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAEhC,MAAM,WAAW,GAAa;YAC7B,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAa;YACpC,QAAQ;SACR,CAAA;QAED,IAAI,OAAoB,CAAA;QACxB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QACzB,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,oBAAoB,GAAG,MAAM,CAAC,cAAc;gBACjD,CAAC,CAAC;oBACA,GAAG,MAAM,CAAC,cAAc;oBACxB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,cAAc,CAAC,UAAU;iBACjE;gBACF,CAAC,CAAC,MAAM,CAAC,UAAU;oBAClB,CAAC,CAAE;wBACD,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC6B;oBAC5D,CAAC,CAAC,SAAS,CAAA;YAEb,MAAM,WAAW,GAAqB;gBACrC,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC/B,qBAAqB,EAAE,IAAI,CAAC,eAAe;gBAC3C,KAAK,EAAE,CAAC;gBACR,aAAa,EAAE;oBACd,KAAK,EAAE,MAAM,CAAC,WAAW;oBACzB,SAAS,EAAE,MAAM,CAAC,WAAW;iBAC7B;gBACD,cAAc,EAAE,oBAAoB;gBACpC,+DAA+D;gBAC/D,6DAA6D;gBAC7D,0DAA0D;gBAC1D,4DAA4D;gBAC5D,yDAAyD;gBACzD,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,WAAW;aACX,CAAA;YACD,OAAO,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAClF,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAA;QAEzD,IAAI,cAA8E,CAAA;QAElF,kEAAkE;QAClE,oEAAoE;QACpE,0DAA0D;QAC1D,MAAM,aAAa,GAAG,IAAI,mBAAmB,EAAE,CAAA;QAC/C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAA;QAE3C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;YACjD,OAAO;YACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,eAAe,EAAE,MAAM,CAAC,QAAQ;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK;YACL,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc;YACpC,cAAc,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE;gBACrC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACrC,CAAC;YACD,8DAA8D;YAC9D,+DAA+D;YAC/D,0DAA0D;YAC1D,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,aAAa;YACb,cAAc;SACd,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAA;QAChC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9D,CAAC;QACF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACxC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAC5C,MAAM,CAAC,eAAe,IAAI,EAAE,QAAQ,EAAE,EACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAChB,CAAA;QAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAC3B;YACC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;YACL,SAAS,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;aACf;YACD,aAAa;YACb,cAAc;YACd,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAC7B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,QAAQ;YACR,SAAS;YACT,QAAQ;YACR,KAAK;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM;YACpB,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;gBACrC,cAAc,GAAG,WAAW,CAAA;YAC7B,CAAC;YACD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW,EAAE,OAAO;YACpB,aAAa;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,oBAAoB;YACrC,gEAAgE;YAChE,6DAA6D;YAC7D,4DAA4D;YAC5D,8DAA8D;YAC9D,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,kEAAkE;YAClE,yDAAyD;YACzD,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,qBAAqB;gBAC/B,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,EACD,QAAQ,CACR,CAAA;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;QACvC,MAAM,WAAW,GAAG,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAE7D,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAEvD,OAAO;YACN,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YAC3D,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,UAAU;YACrB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,UAAU,EAAE,GAAG,CAAC,gBAAgB;YAChC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW;YACX,cAAc;YACd,UAAU,EAAE,WAAW,CAAC,MAAM;SAC9B,CAAA;IACF,CAAC;CACD"}
+{"version":3,"file":"SupervisorAgent.js","sourceRoot":"","sources":["../../src/agents/SupervisorAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAEtD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAWrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAG/D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CACpC,WAAkC,EAClC,KAAY,EACZ,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI;YACxB,KAAK;YACL,MAAM,EAAE,QAAiB;YACzB,KAAK,EAAE,EAAE,GAAG,iBAAiB,EAAE;YAC/B,IAAI,EAAE,EAAE,GAAG,SAAS,EAAE;YACtB,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,GAAG,GAAG,MAAM,CAAC,SAAS;YAClC,QAAQ,EAAE,EAAE;SACZ;QACD,SAAS,EAAE,KAAK;KAChB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,WAAuC;IAC1E,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAA;AACzE,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,aAA2D;IACtF,IAAI,GAAG,YAAqB,CAAA;IAErC,YAAY,QAAsD;QACjE,KAAK,CAAC;YACL,GAAG,QAAQ;YACX,IAAI,EAAE,YAAY;YAClB,YAAY,EAAE;gBACb,aAAa,EAAE,IAAI;gBACnB,iBAAiB,EAAE,IAAI;gBACvB,mBAAmB,EAAE,IAAI;gBACzB,iBAAiB,EAAE,IAAI;aACvB;SACD,CAAC,CAAA;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CACR,KAAiB,EACjB,MAA6B,EAC7B,QAA2B;QAE3B,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CACjE,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAC1E,CAAA;IACF,CAAC;IAEO,KAAK,CAAC,YAAY,CACzB,KAAiB,EACjB,MAA6B,EAC7B,QAA2B;QAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAEhC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CACd,+GAA+G,CAC/G,CAAA;QACF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;QAEhC,MAAM,WAAW,GAAa;YAC7B,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAa;YACpC,QAAQ;SACR,CAAA;QAED,IAAI,OAAoB,CAAA;QACxB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QACzB,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,oBAAoB,GAAG,MAAM,CAAC,cAAc;gBACjD,CAAC,CAAC;oBACA,GAAG,MAAM,CAAC,cAAc;oBACxB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,cAAc,CAAC,UAAU;iBACjE;gBACF,CAAC,CAAC,MAAM,CAAC,UAAU;oBAClB,CAAC,CAAE;wBACD,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC6B;oBAC5D,CAAC,CAAC,SAAS,CAAA;YAEb,MAAM,WAAW,GAAqB;gBACrC,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAC/B,qBAAqB,EAAE,IAAI,CAAC,eAAe;gBAC3C,KAAK,EAAE,CAAC;gBACR,aAAa,EAAE;oBACd,KAAK,EAAE,MAAM,CAAC,WAAW;oBACzB,SAAS,EAAE,MAAM,CAAC,WAAW;iBAC7B;gBACD,cAAc,EAAE,oBAAoB;gBACpC,+DAA+D;gBAC/D,6DAA6D;gBAC7D,0DAA0D;gBAC1D,4DAA4D;gBAC5D,yDAAyD;gBACzD,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,QAAQ;gBACR,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,WAAW;aACX,CAAA;YACD,OAAO,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QAClF,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;QACrF,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAA;QAEzD,IAAI,cAA8E,CAAA;QAElF,kEAAkE;QAClE,oEAAoE;QACpE,0DAA0D;QAC1D,MAAM,aAAa,GAAG,IAAI,mBAAmB,EAAE,CAAA;QAC/C,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAA;QAE3C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;YACjD,OAAO;YACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,eAAe,EAAE,MAAM,CAAC,QAAQ;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK;YACL,cAAc,EAAE,GAAG,EAAE,CAAC,cAAc;YACpC,cAAc,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE;gBACrC,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACrC,CAAC;YACD,8DAA8D;YAC9D,+DAA+D;YAC/D,0DAA0D;YAC1D,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,aAAa;YACb,cAAc;SACd,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAA;QAChC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1C,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9D,CAAC;QACF,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,8BAA8B;QAC9B,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,iEAAiE;QACjE,uEAAuE;QACvE,wEAAwE;QACxE,qBAAqB;QACrB,EAAE;QACF,iEAAiE;QACjE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,6CAA6C;QAC7C,EAAE;QACF,kEAAkE;QAClE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,+CAA+C;QAC/C,EAAE;QACF,kEAAkE;QAClE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,8BAA8B;QAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,oBAAoB,CAAA;QAC5C,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACvC,IAAI,QAAQ,KAAK,UAAU;gBAAE,SAAQ;YACrC,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,oCAAoC,CAAC,CAAA;YAClF,CAAC;YACD,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB,CAC5C,MAAM,CAAC,eAAe,IAAI,EAAE,QAAQ,EAAE,EACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAChB,CAAA;QAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAC3B;YACC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;YACL,SAAS,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;aACf;YACD,aAAa;YACb,cAAc;YACd,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YAC7B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,QAAQ;YACR,SAAS;YACT,QAAQ;YACR,KAAK;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM;YACpB,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;gBACrC,cAAc,GAAG,WAAW,CAAA;YAC7B,CAAC;YACD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,WAAW,EAAE,OAAO;YACpB,aAAa;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,oBAAoB;YACrC,gEAAgE;YAChE,6DAA6D;YAC7D,4DAA4D;YAC5D,8DAA8D;YAC9D,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,iEAAiE;YACjE,4DAA4D;YAC5D,gEAAgE;YAChE,gEAAgE;YAChE,uBAAuB;YACvB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,kEAAkE;YAClE,yDAAyD;YACzD,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,MAAM,CAAC,qBAAqB;gBAC/B,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,EACD,QAAQ,CACR,CAAA;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;QACvC,MAAM,WAAW,GAAG,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAE7D,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAEvD,OAAO;YACN,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YAC3D,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,UAAU;YACrB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,UAAU,EAAE,GAAG,CAAC,gBAAgB;YAChC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW;YACX,cAAc;YACd,UAAU,EAAE,WAAW,CAAC,MAAM;SAC9B,CAAA;IACF,CAAC;CACD"}

package/dist/agents/__tests__/run-agent.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=run-agent.test.d.ts.map

package/dist/agents/__tests__/run-agent.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-agent.test.d.ts","sourceRoot":"","sources":["../../../src/agents/__tests__/run-agent.test.ts"],"names":[],"mappings":""}