@namzu/sdk 46.0.0 → 48.0.0

package/src/directory/derive.ts

@@ -1,6 +1,5 @@
 import type { RunAgentOptions } from '../agents/runAgent.js'
-import { ToolRegistry } from '../registry/tool/execute.js'
-
+import { toolset } from '../toolsets/toolset.js'
 import type { DeriveTurnOptionsInput, DirectoryManifest } from './types.js'
 
 /**
@@ -32,14 +31,18 @@ export function deriveTurnOptions(
 		)
 	}
 
-	const tools = new ToolRegistry()
-	for (const entry of manifest.tools) tools.register(entry.definition)
+	const toolsets = [
+		toolset(
+			'directory',
+			manifest.tools.map((entry) => entry.definition),
+		),
+	]
 
 	return {
 		provider: input.provider,
 		prompt: input.prompt,
 		model,
-		tools,
+		toolsets,
 		// The one value the project knows and `runAgent` cannot infer. Left
 		// unset it would default to the host's own cwd, pointing the file
 		// tools' containment at the host's source tree rather than at the

package/src/execution/code-runtime/types.ts

@@ -18,7 +18,7 @@
  *    backend that cannot withhold those is not a backend for this.
  *  - **Everything it can do, it does by asking.** The only channel out is a
  *    call back into the host, which is what makes NZ-EXEC-06's dispatch
- *    through the turn's own `ToolRegistry` possible — the program cannot
+ *    through the turn's own `ToolManager` possible — the program cannot
  *    reach a tool the turn did not grant, because it cannot reach anything.
  *  - **Bounded.** Wall clock and output, both enforced by the backend
  *    rather than requested of the program.
@@ -57,7 +57,7 @@ export interface HostCallContext {
  * What the host will answer.
  *
  * A function rather than a table, so the host decides per call. NZ-EXEC-06
- * makes this the turn's `ToolRegistry` and its permission gate, which is
+ * makes this the turn's `ToolManager` and its permission gate, which is
  * exactly the point: the program's reach is the turn's reach, resolved at
  * the moment of the call rather than frozen when the program started.
  */

package/src/invariants/index.ts

@@ -9,6 +9,7 @@
 // worse home than the one it started in.
 
 import { ManagedRegistry } from '../registry/ManagedRegistry.js'
+import { RegistryCollisionError } from '../registry/collision.js'
 
 /**
  * What a module's check said about its own claim, the moment it was asked.
@@ -50,12 +51,14 @@ export type InvariantCheck<TContext = unknown> = (
  * every reference to the other's `id` kept resolving as if it still existed.
  * Mirrors `ProbeNameCollisionError`.
  */
-export class InvariantNameCollisionError extends Error {
+export class InvariantNameCollisionError extends RegistryCollisionError {
 	readonly moduleName: string
 	readonly invariantName: string
 
 	constructor(moduleName: string, invariantName: string) {
 		super(
+			'InvariantRegistry',
+			`${moduleName}:${invariantName}`,
 			`Invariant "${moduleName}:${invariantName}" is already registered. Two modules picked the same name, or this module registered itself twice — pick a different name, or find the second registration.`,
 		)
 		this.name = 'InvariantNameCollisionError'

package/src/manager/agent/lifecycle.ts

@@ -1555,6 +1555,15 @@ export class AgentManager {
 		const input = {
 			...options.input,
 			signal: agentTask.childAbortController.signal,
+			// The admitted child session is the authority. A caller-supplied input
+			// cannot redirect its turn to another tenant, project, topic or session.
+			managedScope: {
+				kind: 'managed' as const,
+				sessionId: agentTask.context.sessionId,
+				topicId: agentTask.context.topicId,
+				projectId: agentTask.context.projectId,
+				tenantId: agentTask.context.tenantId,
+			},
 		}
 
 		const spawnRecord = this.spawnRecords.get(agentTask.taskId)

package/src/manager/connector/environment.ts

@@ -1,6 +1,7 @@
 import type { BaseConnector } from '../../connector/BaseConnector.js'
 import type { BaseExecutionContext } from '../../execution/base.js'
 import { ExecutionContextFactory } from '../../execution/factory.js'
+import { RegistryCollisionError } from '../../registry/collision.js'
 import type { ConnectorRegistry } from '../../registry/connector/definitions.js'
 import type { ScopedConnectorRegistry } from '../../registry/connector/scoped.js'
 import type {
@@ -43,6 +44,21 @@ export interface EnvironmentConnectorManagerConfig {
 	log?: Logger
 }
 
+/** Two environments claiming one id. */
+export class EnvironmentCollisionError extends RegistryCollisionError {
+	readonly environmentId: string
+
+	constructor(environmentId: string) {
+		super(
+			'EnvironmentConnectorManager',
+			environmentId,
+			`Environment "${environmentId}" is already registered. Unregister it first via unregisterEnvironment(), or pick a different id.`,
+		)
+		this.name = 'EnvironmentCollisionError'
+		this.environmentId = environmentId
+	}
+}
+
 interface EnvironmentState {
 	descriptor: EnvironmentDescriptor
 	scopeChain: ScopeChain
@@ -71,10 +87,7 @@ export class EnvironmentConnectorManager {
 	registerEnvironment(setup: EnvironmentConnectorSetup): void {
 		const envId = setup.environment.id
 		if (this.environments.has(envId)) {
-			this.log.warn('Environment already registered, skipping', {
-				'namzu.environment.id': envId,
-			})
-			return
+			throw new EnvironmentCollisionError(envId)
 		}
 
 		const manager = new ConnectorManager({ registry: this.connectorRegistry, log: this.log })

package/src/manager/connector/index.ts

@@ -1,10 +1,10 @@
 export { ConnectorManager } from './lifecycle.js'
 export type { ConnectorManagerConfig } from './lifecycle.js'
 
-export { TenantConnectorManager } from './tenant.js'
+export { TenantCollisionError, TenantConnectorManager } from './tenant.js'
 export type { TenantConnectorManagerConfig } from './tenant.js'
 
-export { EnvironmentConnectorManager } from './environment.js'
+export { EnvironmentCollisionError, EnvironmentConnectorManager } from './environment.js'
 export type {
 	EnvironmentConnectorSetup,
 	EnvironmentConnectorManagerConfig,

package/src/manager/connector/tenant.ts

@@ -1,5 +1,6 @@
 import type { BaseConnector } from '../../connector/BaseConnector.js'
 import { NAMZU } from '../../constants/telemetry/index.js'
+import { RegistryCollisionError } from '../../registry/collision.js'
 import type { ConnectorRegistry } from '../../registry/connector/definitions.js'
 import type {
 	AuthConfig,
@@ -47,6 +48,21 @@ export interface TenantConnectorManagerConfig {
 	log?: Logger
 }
 
+/** Two tenants claiming one id. */
+export class TenantCollisionError extends RegistryCollisionError {
+	readonly tenantId: string
+
+	constructor(tenantId: string) {
+		super(
+			'TenantConnectorManager',
+			tenantId,
+			`Tenant "${tenantId}" is already registered. Unregister it first via unregisterTenant(), or pick a different id.`,
+		)
+		this.name = 'TenantCollisionError'
+		this.tenantId = tenantId
+	}
+}
+
 interface TenantState {
 	descriptor: TenantDescriptor
 	manager: ConnectorManager
@@ -73,10 +89,7 @@ export class TenantConnectorManager {
 
 	registerTenant(descriptor: TenantDescriptor, rateLimit?: TenantRateLimitConfig): void {
 		if (this.tenants.has(descriptor.id)) {
-			this.log.warn('Tenant already registered, skipping', {
-				[NAMZU.TENANT_ID]: descriptor.id,
-			})
-			return
+			throw new TenantCollisionError(descriptor.id)
 		}
 
 		const tenantLog = this.log.child({ [NAMZU.TENANT_ID]: descriptor.id })

package/src/manager/index.ts

@@ -3,10 +3,10 @@ export { TurnRecorder } from './session/turn-recorder.js'
 export { ConnectorManager } from './connector/lifecycle.js'
 export type { ConnectorManagerConfig } from './connector/lifecycle.js'
 
-export { TenantConnectorManager } from './connector/tenant.js'
+export { TenantCollisionError, TenantConnectorManager } from './connector/tenant.js'
 export type { TenantConnectorManagerConfig } from './connector/tenant.js'
 
-export { EnvironmentConnectorManager } from './connector/environment.js'
+export { EnvironmentCollisionError, EnvironmentConnectorManager } from './connector/environment.js'
 export type {
 	EnvironmentConnectorSetup,
 	EnvironmentConnectorManagerConfig,

package/src/manager/session/attribution.ts

@@ -0,0 +1,79 @@
+import type { SessionLog } from '../../store/session-log/index.js'
+import { NamzuError } from '../../types/errors/index.js'
+import type { ProjectId, SessionId, TenantId, TopicId } from '../../types/ids/index.js'
+
+/** The complete owner a caller says a session log has. */
+export interface SessionLogAttribution {
+	readonly sessionId: SessionId
+	readonly projectId: ProjectId
+	readonly tenantId: TenantId
+	readonly topicId: TopicId
+}
+
+/**
+ * Refuse a session owned by another scope before reading its history or
+ * checkpoints. Call again while holding its writer lease before a new turn:
+ * an empty log seen before the claim may have been opened by another writer.
+ *
+ * Older logs can omit tenantId/topicId in their schema. They remain readable,
+ * but cannot be continued or forked under a guessed owner.
+ * Returns false for an unopened log when `requireStarted` is not set.
+ */
+export async function assertSessionLogAttribution(
+	log: SessionLog,
+	scope: SessionLogAttribution,
+	options: { readonly requireStarted?: boolean } = {},
+): Promise<boolean> {
+	const requiredFields = ['sessionId', 'projectId', 'tenantId', 'topicId'] as const
+	const missingFields = requiredFields.filter(
+		(field) => typeof scope[field] !== 'string' || scope[field] === '',
+	)
+	if (missingFields.length > 0) {
+		throw new NamzuError({
+			code: 'invalid_config',
+			message: `A session owner scope requires ${missingFields.join(', ')}.`,
+			details: { fields: missingFields },
+		})
+	}
+	if (log.sessionId !== scope.sessionId) {
+		throw new NamzuError({
+			code: 'invalid_config',
+			message: `The session log belongs to session ${log.sessionId}, not ${scope.sessionId}.`,
+			details: { fields: ['sessionId'] },
+		})
+	}
+
+	const opened = (await log.readAll({ throughSeq: 1 })).entries[0]?.record
+	if (!opened && !options.requireStarted) return false
+	if (!opened) {
+		throw new NamzuError({
+			code: 'invalid_config',
+			message: `Session ${scope.sessionId} has no session_started owner record.`,
+			details: { fields: ['sessionId'] },
+		})
+	}
+	if (opened.type !== 'session_started') {
+		throw new NamzuError({
+			code: 'invalid_config',
+			message: `Session ${scope.sessionId} has no session_started owner record.`,
+			details: { fields: ['sessionId'] },
+		})
+	}
+
+	const fields: string[] = []
+	if (opened.sessionId !== scope.sessionId) fields.push('sessionId')
+	if (opened.projectId !== scope.projectId) fields.push('projectId')
+	if (opened.tenantId === undefined || opened.tenantId !== scope.tenantId) {
+		fields.push('tenantId')
+	}
+	if (opened.topicId === undefined || opened.topicId !== scope.topicId) {
+		fields.push('topicId')
+	}
+	if (fields.length === 0) return true
+
+	throw new NamzuError({
+		code: 'invalid_config',
+		message: `Session ${scope.sessionId} is not opened under the supplied ${fields.join(', ')} scope.`,
+		details: { fields },
+	})
+}