@namzu/sdk 5.0.0 → 5.2.0

package/dist/agents/index.js

@@ -6,4 +6,8 @@ export { SupervisorAgent } from './SupervisorAgent.js';
 export { defineAgent } from './defineAgent.js';
 export { InvocationLock, ConcurrentInvocationError } from './lock.js';
 export { runAgent } from './runAgent.js';
+// The budgets the front door applies when a caller names none. Exported so a
+// deriver that builds a config by hand lands on the SAME numbers rather than
+// inventing its own or, as `@namzu/project` did, supplying none at all.
+export { DEFAULT_MAX_ITERATIONS, DEFAULT_TIMEOUT_MS, DEFAULT_TOKEN_BUDGET, } from './runAgent.js';
 //# sourceMappingURL=index.js.map

package/dist/agents/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agents/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAErE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agents/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAErE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,6EAA6E;AAC7E,6EAA6E;AAC7E,wEAAwE;AACxE,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,GACpB,MAAM,eAAe,CAAA"}

package/dist/agents/runAgent.d.ts

@@ -2,7 +2,9 @@ import type { ProjectId, SessionId, TenantId, ThreadId } from '../types/ids/inde
 import type { Message } from '../types/message/index.js';
 import type { LLMProvider } from '../types/provider/index.js';
 import type { Run, RunEventListener } from '../types/run/index.js';
+import type { Skill } from '../types/skills/index.js';
 import type { ToolRegistryContract } from '../types/tool/index.js';
+import type { VerificationGateConfig } from '../types/verification/index.js';
 /**
  * The session a run belongs to.
  *
@@ -36,6 +38,26 @@ export interface RunAgentOptions extends AgentIdentity {
      */
     model: string;
     tools?: ToolRegistryContract;
+    /**
+     * Skills to put in front of the model.
+     *
+     * The kernel has taken these since it had a prompt builder; this door did
+     * not forward them, so a caller who assembled skills — `@namzu/project`
+     * reads a whole `skills/` directory — handed them over and got a run that
+     * had never heard of them. Silent, because the `drainQuery` call below was
+     * cast, and a cast seam reports nothing when a field goes missing.
+     */
+    skills?: Skill[];
+    /**
+     * Operator policy for tool calls: which ones need review before they run.
+     *
+     * Absent means every tool runs unreviewed, which is the right default for a
+     * library front door and the wrong one for a host that hands this an agent
+     * directory it did not write. The kernel builds a `VerificationGate` from
+     * this and consults it on every call; without it there is nothing to
+     * consult, so a front-door run is strictly less mediated than a kernel one.
+     */
+    verificationGate?: VerificationGateConfig;
     /** Defaults to the current working directory. */
     workingDirectory?: string;
     maxIterations?: number;
@@ -59,6 +81,18 @@ export interface RunAgentResult {
      */
     readonly identity: Required<AgentIdentity>;
 }
+/**
+ * Defaults chosen to be safe rather than generous.
+ *
+ * A front door exists so a first run works without a decision, and the cost of
+ * that convenience is that nobody reads these numbers before their first
+ * runaway loop. So: a budget that ends a stuck run in seconds rather than
+ * dollars, and an iteration cap that stops a tool-calling loop well before a
+ * context window does. Every one is overridable and named on the option.
+ */
+export declare const DEFAULT_MAX_ITERATIONS = 16;
+export declare const DEFAULT_TOKEN_BUDGET = 200000;
+export declare const DEFAULT_TIMEOUT_MS = 300000;
 /**
  * Run an agent, without assembling a kernel by hand.
  *

package/dist/agents/runAgent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runAgent.d.ts","sourceRoot":"","sources":["../../src/agents/runAgent.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAQlE;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACnB;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACrD,gEAAgE;IAChE,QAAQ,EAAE,WAAW,CAAA;IAErB,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,CAAA;IAE1B,yBAAyB;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb,KAAK,CAAC,EAAE,oBAAoB,CAAA;IAE5B,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAC3B;AAED,MAAM,WAAW,cAAc;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IAEjB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;CAC1C;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAyChF"}
+{"version":3,"file":"runAgent.d.ts","sourceRoot":"","sources":["../../src/agents/runAgent.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AAQ5E;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC7B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACnB;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACrD,gEAAgE;IAChE,QAAQ,EAAE,WAAW,CAAA;IAErB,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,CAAA;IAE1B,yBAAyB;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,CAAA;IAEb,KAAK,CAAC,EAAE,oBAAoB,CAAA;IAE5B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,CAAA;IAEhB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IAEzC,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAEzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IAEpB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAA;IAEb,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAC3B;AAED,MAAM,WAAW,cAAc;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAA;IAEjB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;CAC1C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAA;AACxC,eAAO,MAAM,oBAAoB,SAAU,CAAA;AAC3C,eAAO,MAAM,kBAAkB,SAAU,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA2ChF"}

package/dist/agents/runAgent.js

@@ -10,9 +10,9 @@ import { generateProjectId, generateSessionId, generateTenantId, generateThreadI
  * dollars, and an iteration cap that stops a tool-calling loop well before a
  * context window does. Every one is overridable and named on the option.
  */
-const DEFAULT_MAX_ITERATIONS = 16;
-const DEFAULT_TOKEN_BUDGET = 200_000;
-const DEFAULT_TIMEOUT_MS = 300_000;
+export const DEFAULT_MAX_ITERATIONS = 16;
+export const DEFAULT_TOKEN_BUDGET = 200_000;
+export const DEFAULT_TIMEOUT_MS = 300_000;
 /**
  * Run an agent, without assembling a kernel by hand.
  *
@@ -85,6 +85,8 @@ export async function runAgent(options) {
         agentName: options.name ?? 'Agent',
         ...(options.instructions ? { systemPrompt: options.instructions } : {}),
         ...(options.signal ? { signal: options.signal } : {}),
+        ...(options.skills ? { skills: options.skills } : {}),
+        ...(options.verificationGate ? { verificationGate: options.verificationGate } : {}),
         ...identity,
     }, options.listener);
     return { output: run.result, run, identity };

package/dist/agents/runAgent.js.map

@@ -1 +1 @@
-{"version":3,"file":"runAgent.js","sourceRoot":"","sources":["../../src/agents/runAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAMtD,OAAO,EACN,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,gBAAgB,CAAA;AAuEvB;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACjC,MAAM,oBAAoB,GAAG,OAAO,CAAA;AACpC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACtD,MAAM,QAAQ,GAA4B;QACzC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,iBAAiB,EAAE;QACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB,EAAE;QAChD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,iBAAiB,EAAE;QACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB,EAAE;KAChD,CAAA;IAED,MAAM,QAAQ,GACb,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAa,CAAC;QAC/E,CAAC,CAAC,OAAO,CAAC,MAAM,CAAA;IAElB,MAAM,GAAG,GAAG,MAAM,UAAU,CAC3B;QACC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,YAAY,EAAE;QAC1C,QAAQ;QACR,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE;QAC3D,SAAS,EAAE;YACV,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,sBAAsB;YAC9D,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,oBAAoB;YACxD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;YAClD,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF;QACD,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,oEAAoE;QACpE,6BAA6B;QAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO;QAChC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO;QAClC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,QAAQ;KACF,EACV,OAAO,CAAC,QAAQ,CAChB,CAAA;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;AAC7C,CAAC"}
+{"version":3,"file":"runAgent.js","sourceRoot":"","sources":["../../src/agents/runAgent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAQtD,OAAO,EACN,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,gBAAgB,CAAA;AA6FvB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAA;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACtD,MAAM,QAAQ,GAA4B;QACzC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,iBAAiB,EAAE;QACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB,EAAE;QAChD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,iBAAiB,EAAE;QACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB,EAAE;KAChD,CAAA;IAED,MAAM,QAAQ,GACb,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAa,CAAC;QAC/E,CAAC,CAAC,OAAO,CAAC,MAAM,CAAA;IAElB,MAAM,GAAG,GAAG,MAAM,UAAU,CAC3B;QACC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,YAAY,EAAE;QAC1C,QAAQ;QACR,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE;QAC3D,SAAS,EAAE;YACV,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,sBAAsB;YAC9D,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,oBAAoB;YACxD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;YAClD,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF;QACD,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,oEAAoE;QACpE,6BAA6B;QAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO;QAChC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO;QAClC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,QAAQ;KACX,EACD,OAAO,CAAC,QAAQ,CAChB,CAAA;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;AAC7C,CAAC"}

package/dist/config/runtime.d.ts

@@ -409,6 +409,7 @@ export declare const RuntimeConfigSchema: z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     timeoutMs: number;
+    model: string;
     compaction: {
         strategy: "disabled" | "structured" | "sliding-window";
         triggerThreshold: number;
@@ -431,11 +432,24 @@ export declare const RuntimeConfigSchema: z.ZodObject<{
         contextWindowTokens?: number | undefined;
         preserveToolResultsFrom?: string[] | undefined;
     };
-    model: string;
     temperature: number;
     tokenBudget: number;
     maxResponseTokens: number;
     maxIterations: number;
+    sandbox?: {
+        enabled: boolean;
+        provider: "local";
+        timeoutMs: number;
+        memoryLimitMb: number;
+        maxProcesses: number;
+        requireIsolation: ("filesystem" | "network" | "process")[];
+    } | undefined;
+    plugins?: {
+        enabled: boolean;
+        autoDiscovery: boolean;
+        allowedScopes: ("user" | "project")[];
+        hookTimeoutMs: number;
+    } | undefined;
     taskRouter?: {
         default?: string | null | undefined;
         compaction?: string | null | undefined;
@@ -453,22 +467,23 @@ export declare const RuntimeConfigSchema: z.ZodObject<{
         breakerFailureThreshold: number;
         breakerResetTimeoutMs: number;
     } | undefined;
-    plugins?: {
-        enabled: boolean;
-        autoDiscovery: boolean;
-        allowedScopes: ("user" | "project")[];
-        hookTimeoutMs: number;
-    } | undefined;
-    sandbox?: {
-        enabled: boolean;
-        provider: "local";
-        timeoutMs: number;
-        memoryLimitMb: number;
-        maxProcesses: number;
-        requireIsolation: ("filesystem" | "network" | "process")[];
-    } | undefined;
 }, {
     timeoutMs?: number | undefined;
+    sandbox?: {
+        enabled?: boolean | undefined;
+        provider?: "local" | undefined;
+        timeoutMs?: number | undefined;
+        memoryLimitMb?: number | undefined;
+        maxProcesses?: number | undefined;
+        requireIsolation?: ("filesystem" | "network" | "process")[] | undefined;
+    } | undefined;
+    plugins?: {
+        enabled?: boolean | undefined;
+        autoDiscovery?: boolean | undefined;
+        allowedScopes?: ("user" | "project")[] | undefined;
+        hookTimeoutMs?: number | undefined;
+    } | undefined;
+    model?: string | undefined;
     compaction?: {
         strategy?: "disabled" | "structured" | "sliding-window" | undefined;
         contextWindowTokens?: number | undefined;
@@ -491,7 +506,6 @@ export declare const RuntimeConfigSchema: z.ZodObject<{
         maxCharsPerRequirement?: number | undefined;
         maxCharsPerTask?: number | undefined;
     } | undefined;
-    model?: string | undefined;
     temperature?: number | undefined;
     tokenBudget?: number | undefined;
     maxResponseTokens?: number | undefined;
@@ -513,20 +527,6 @@ export declare const RuntimeConfigSchema: z.ZodObject<{
         breakerFailureThreshold?: number | undefined;
         breakerResetTimeoutMs?: number | undefined;
     } | undefined;
-    plugins?: {
-        enabled?: boolean | undefined;
-        autoDiscovery?: boolean | undefined;
-        allowedScopes?: ("user" | "project")[] | undefined;
-        hookTimeoutMs?: number | undefined;
-    } | undefined;
-    sandbox?: {
-        enabled?: boolean | undefined;
-        provider?: "local" | undefined;
-        timeoutMs?: number | undefined;
-        memoryLimitMb?: number | undefined;
-        maxProcesses?: number | undefined;
-        requireIsolation?: ("filesystem" | "network" | "process")[] | undefined;
-    } | undefined;
 }>;
 export type RuntimeConfig = z.infer<typeof RuntimeConfigSchema>;
 export declare const RUNTIME_DEFAULTS: Readonly<RuntimeConfig>;

package/dist/constants/tools/__tests__/dangerous-patterns.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dangerous-patterns.test.d.ts.map

package/dist/constants/tools/__tests__/dangerous-patterns.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dangerous-patterns.test.d.ts","sourceRoot":"","sources":["../../../../src/constants/tools/__tests__/dangerous-patterns.test.ts"],"names":[],"mappings":""}

package/dist/constants/tools/__tests__/dangerous-patterns.test.js

@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest';
+import { DANGEROUS_PATTERNS } from '../index.js';
+/**
+ * `DANGEROUS_PATTERNS` is what `deny_dangerous_patterns` consults, and
+ * `namzu run`'s own docstring promises that in a non-interactive run "the
+ * safety gate still hard-denies catastrophic commands".
+ *
+ * The fork-bomb entry could not deny one. It was written `/:(){ :\|:& };:/`,
+ * and in a regular expression `()` is an empty capture group rather than two
+ * literal parentheses — so the pattern described `:{ :|:& };:`, a string that
+ * is not valid shell and that nobody types. The list looked complete in review
+ * and had a hole in it that only running the regex reveals.
+ *
+ * No test named a fork bomb before this one, which is how it survived.
+ */
+function denies(command) {
+    return DANGEROUS_PATTERNS.some((p) => p.test(command));
+}
+describe('the dangerous-command list denies fork bombs', () => {
+    // Spelling varies with whitespace and with the function's name; the bomb
+    // does not care, so neither may the pattern.
+    it.each([
+        ':(){ :|:& };:',
+        ':(){:|:&};:',
+        ':() { :|:& }; :',
+        ':(){ : | : & }; :',
+        'bomb(){ bomb|bomb& }; bomb',
+        'f(){ f|f& };f',
+    ])('denies %j', (command) => {
+        expect(denies(command)).toBe(true);
+    });
+});
+describe('it does not deny ordinary shell', () => {
+    // A function containing a pipe and a background job is not a fork bomb.
+    // The signature is SELF-reference — the same name on both sides — and a
+    // pattern that fired on the general shape would make the gate useless by
+    // crying wolf.
+    it.each([
+        'build(){ make | tee log & }',
+        'watch(){ tail -f log | grep ERROR & }; watch',
+        'f(){ g|h& };f',
+        'run(){ a|b& }; run',
+        'git log | head -20',
+        'npm test',
+    ])('allows %j', (command) => {
+        expect(denies(command)).toBe(false);
+    });
+});
+describe('the rest of the list still fires', () => {
+    it.each(['rm -rf /', 'mkfs.ext4 /dev/sda', 'dd if=/dev/zero of=/dev/sda', 'sudo rm x'])('denies %j', (command) => {
+        expect(denies(command)).toBe(true);
+    });
+});
+//# sourceMappingURL=dangerous-patterns.test.js.map

package/dist/constants/tools/__tests__/dangerous-patterns.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dangerous-patterns.test.js","sourceRoot":"","sources":["../../../../src/constants/tools/__tests__/dangerous-patterns.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD;;;;;;;;;;;;GAYG;AAEH,SAAS,MAAM,CAAC,OAAe;IAC9B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,QAAQ,CAAC,8CAA8C,EAAE,GAAG,EAAE;IAC7D,yEAAyE;IACzE,6CAA6C;IAC7C,EAAE,CAAC,IAAI,CAAC;QACP,eAAe;QACf,aAAa;QACb,iBAAiB;QACjB,mBAAmB;QACnB,4BAA4B;QAC5B,eAAe;KACf,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAChD,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,eAAe;IACf,EAAE,CAAC,IAAI,CAAC;QACP,6BAA6B;QAC7B,8CAA8C;QAC9C,eAAe;QACf,oBAAoB;QACpB,oBAAoB;QACpB,UAAU;KACV,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,WAAW,CAAC,CAAC,CACtF,WAAW,EACX,CAAC,OAAO,EAAE,EAAE;QACX,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC,CACD,CAAA;AACF,CAAC,CAAC,CAAA"}

package/dist/constants/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/tools/index.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,kBAAkB,UAiB9B,CAAA;AAED,eAAO,MAAM,gBAAgB,aAA6C,CAAA;AAE1E;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,IAAI,CAAA;AAElD,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,oKAC2H,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/tools/index.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,kBAAkB,UA4C9B,CAAA;AAED,eAAO,MAAM,gBAAgB,aAA6C,CAAA;AAE1E;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,IAAI,CAAA;AAElD,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,oKAC2H,CAAA"}

package/dist/constants/tools/index.js

@@ -17,7 +17,34 @@ export const DANGEROUS_PATTERNS = [
     /rm\s+-rf\s+\//,
     /mkfs/,
     /dd\s+if=/,
-    /:(){ :\|:& };:/,
+    /**
+     * Fork bomb.
+     *
+     * The previous entry was `/:(){ :\|:& };:/`, which could not match one. In
+     * a regular expression `()` is an empty capture group, not two literal
+     * parentheses, so that pattern described the string `:{ :|:& };:` — which
+     * is not valid shell and which nobody would ever type. Probed: it returned
+     * false for `:(){ :|:& };:` and every spelling of it, while `run.ts`'s own
+     * docstring promised "the safety gate still hard-denies catastrophic
+     * commands".
+     *
+     * Matched on SELF-REFERENCE rather than on one literal spelling: a fork
+     * bomb is a function whose own name appears on both sides of a pipe, is
+     * backgrounded, and is then invoked. That is what separates it from a
+     * function that merely contains a pipe — `watch(){ tail -f log | grep E & }`
+     * does not match, and `bomb(){ bomb|bomb& }; bomb` does.
+     *
+     * EVERY run is bounded, not just the name. The first version bounded the
+     * name and left the gaps as `\s*`, and static analysis caught what a hand
+     * probe did not: a chain of unbounded runs backtracks polynomially, and
+     * this list is matched against SERIALIZED TOOL INPUT — model output, which
+     * a prompt injection can shape. A denial of service in the check that
+     * exists to prevent one is the wrong way round.
+     *
+     * `[ \t]` rather than `\s`, because a shell function definition of this
+     * shape lives on one line, and the bound is generous for real spacing.
+     */
+    /([\w.]{1,32}|:)[ \t]{0,8}\([ \t]{0,8}\)[ \t]{0,8}\{[ \t]{0,8}\1[ \t]{0,8}\|[ \t]{0,8}\1[ \t]{0,8}&[ \t]{0,8};?[ \t]{0,8}\}[ \t]{0,8};?[ \t]{0,8}\1/,
     // Privilege escalation + world-writable chmod on /.
     /\bsudo\b/,
     /\bsu\s+-/,

package/dist/constants/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/tools/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,8DAA8D;AAC9D,gEAAgE;AAChE,gEAAgE;AAChE,4DAA4D;AAC5D,kEAAkE;AAClE,iEAAiE;AACjE,EAAE;AACF,gEAAgE;AAChE,kEAAkE;AAClE,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG;IACjC,gDAAgD;IAChD,eAAe;IACf,MAAM;IACN,UAAU;IACV,gBAAgB;IAChB,oDAAoD;IACpD,UAAU;IACV,UAAU;IACV,4BAA4B;IAC5B,wDAAwD;IACxD,qCAAqC;IACrC,qCAAqC;IACrC,+BAA+B;IAC/B,cAAc;IACd,+BAA+B;IAC/B,iBAAiB;CACjB,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAA;AAElD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GACtC,iKAAiK,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/tools/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,8DAA8D;AAC9D,gEAAgE;AAChE,gEAAgE;AAChE,4DAA4D;AAC5D,kEAAkE;AAClE,iEAAiE;AACjE,EAAE;AACF,gEAAgE;AAChE,kEAAkE;AAClE,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG;IACjC,gDAAgD;IAChD,eAAe;IACf,MAAM;IACN,UAAU;IACV;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,oJAAoJ;IACpJ,oDAAoD;IACpD,UAAU;IACV,UAAU;IACV,4BAA4B;IAC5B,wDAAwD;IACxD,qCAAqC;IACrC,qCAAqC;IACrC,+BAA+B;IAC/B,cAAc;IACd,+BAA+B;IAC/B,iBAAiB;CACjB,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAA;AAElD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GACtC,iKAAiK,CAAA"}