@namzu/sdk 52.1.0 → 52.3.0

package/src/runtime/query/iteration/outstanding-work.ts

@@ -5,7 +5,7 @@ import type { TaskHandle } from '../../../types/agent/scheduler.js'
 import { createRuntimeContextMessage } from '../../../types/message/index.js'
 import type { SessionEvent } from '../../../types/session/index.js'
 import { readPositiveIntEnv } from '../../../utils/env.js'
-import { formatJobNote } from '../steering.js'
+import { formatJobNote, formatMonitorNote } from '../steering.js'
 import type { IterationContext } from './phases/index.js'
 
 /**
@@ -179,7 +179,17 @@ export async function* holdForOutstandingWork(
 	// to be running. A job therefore never shortens a wait, and it never
 	// lengthens one either: where a task is outstanding too, that is how
 	// long this turn was waiting anyway.
-	const graceMs = inbox ? settleGraceMs(remainingMs) : awaitedJobGraceMs(remainingMs)
+	let graceMs = inbox ? settleGraceMs(remainingMs) : awaitedJobGraceMs(remainingMs)
+	// A monitor the turn owns is held for until the monitor itself ends, which
+	// its own deadline bounds; the two-minute job ceiling would walk away from
+	// a watch with most of its time left. As with a task, this only ever
+	// lengthens the wait: it is the longest justified leg that sets the
+	// deadline. A second of slack lets the expiry notice arrive before the
+	// grace does.
+	const monitorMs = jobs?.monitorHoldMs()
+	if (monitorMs !== undefined) {
+		graceMs = Math.max(graceMs, Math.min(settleGraceMs(remainingMs), monitorMs + 1000))
+	}
 	ctx.log.info('Holding the turn open for outstanding work', {
 		[NAMZU.TURN_ID]: ctx.recorder.turnId,
 		[NAMZU.ITERATION]: iterationNum,
@@ -217,8 +227,9 @@ export async function* holdForOutstandingWork(
 		)
 	}
 	const exited = deliverAwaitedJobExits(ctx)
+	const monitored = deliverMonitorNotices(ctx)
 	const inbound = await deliverInbound()
-	if (arrived.length === 0 && !exited && inbound === 0) return false
+	if (arrived.length === 0 && !exited && !monitored && inbound === 0) return false
 	await ctx.emitEvent({
 		type: 'iteration_completed',
 		turnId: ctx.recorder.turnId,
@@ -268,6 +279,32 @@ export function deliverAwaitedJobExits(ctx: IterationContext): boolean {
 	return true
 }
 
+/**
+ * Put what a monitor the turn owns has said in front of the model.
+ *
+ * The same shape as {@link deliverAwaitedJobExits}: through the channel the
+ * events already travel on (`monitorNotices`, which `attachNotice` rides out on
+ * the next tool result), and as a `runtime-context` message when the turn made
+ * no tool call and so has no result to carry it. The record that they were
+ * delivered goes with the text, so an event already attached to a tool result
+ * earlier in the turn leaves nothing here and does not buy another turn.
+ *
+ * The message kind is `job-exit`: a monitor is a job, and no host reads a
+ * separate kind for it. What it is carrying (events, or the end) is in the text.
+ */
+export function deliverMonitorNotices(ctx: IterationContext): boolean {
+	if (!ctx.monitorNotices) return false
+	const text = ctx.awaitedJobs?.takeMonitorDelivery(() => ctx.monitorNotices?.drain())
+	if (text === undefined) return false
+
+	ctx.log.info('Delivering monitor events the turn held itself open for', {
+		[NAMZU.TURN_ID]: ctx.recorder.turnId,
+	})
+	ctx.recorder.pushMessage(createRuntimeContextMessage(formatMonitorNote(text), 'job-exit'))
+	ctx.onMonitorNoticeDelivered?.()
+	return true
+}
+
 /** Await arrived tracking writes within the caller's existing turn deadline. */
 export async function drainArrivedTaskCompletions(ctx: IterationContext): Promise<TaskHandle[]> {
 	const inbox = ctx.completionInbox
@@ -418,6 +455,7 @@ export function deliverArrivedCompletions(ctx: IterationContext): void {
  * messages land in the order the work finished in.
  */
 export function deliverArrivedJobExits(ctx: IterationContext): void {
+	deliverArrivedMonitorNotices(ctx)
 	const delivered = ctx.awaitedJobs?.takeDelivery(() => ctx.jobNotices?.drain())
 	if (!delivered) return
 
@@ -434,3 +472,26 @@ export function deliverArrivedJobExits(ctx: IterationContext): void {
 	ctx.recorder.pushMessage(createRuntimeContextMessage(formatJobNote(delivered.text), 'job-exit'))
 	ctx.onJobNoticeDelivered?.()
 }
+
+/**
+ * The monitor half of {@link deliverArrivedJobExits}: what a held monitor said
+ * after the hold stopped looking is still delivered on the way out, so the
+ * transcript has it and a continued thread opens with it. Only for monitors
+ * the turn holds itself open for; a session's host hears its own.
+ */
+function deliverArrivedMonitorNotices(ctx: IterationContext): void {
+	if (!ctx.monitorNotices) return
+	const text = ctx.awaitedJobs?.takeMonitorDelivery(() => ctx.monitorNotices?.drain())
+	if (text === undefined) return
+
+	// Fix the turn's answer BEFORE appending anything after it; see
+	// `deliverArrivedCompletions` for why the tail walk needs it.
+	const answer = ctx.recorder.materializeResult()
+	if (answer.length > 0) ctx.recorder.setResult(answer, 'outstanding_work')
+
+	ctx.log.info('Delivering monitor events the turn would have settled over', {
+		[NAMZU.TURN_ID]: ctx.recorder.turnId,
+	})
+	ctx.recorder.pushMessage(createRuntimeContextMessage(formatMonitorNote(text), 'job-exit'))
+	ctx.onMonitorNoticeDelivered?.()
+}

package/src/runtime/query/iteration/phases/context.ts

@@ -148,6 +148,15 @@ export interface IterationContext {
 	readonly jobNotices?: SteeringChannel
 	/** Acknowledge exit notices only after their text enters model context. */
 	readonly onJobNoticeDelivered?: () => void
+	/**
+	 * What the turn's monitors have said (and how they ended), drained into the
+	 * next tool result like {@link jobNotices}. A separate channel because its
+	 * text is the system-event envelope of untrusted process output, and
+	 * because a host acknowledges it separately.
+	 */
+	readonly monitorNotices?: SteeringChannel
+	/** Acknowledge monitor notices only after their text enters model context. */
+	readonly onMonitorNoticeDelivered?: () => void
 	/**
 	 * Background jobs the model said it is waiting on, which is the only kind
 	 * the loop holds a finishing run open for.

package/src/runtime/query/iteration/phases/tool-review.ts

@@ -13,7 +13,7 @@ import {
 } from '../../project-instructions.js'
 import { attachRepeatNotice } from '../../repeat-call.js'
 import { isReviewExempt } from '../../review-policy.js'
-import { attachNotice, attachSteering, formatJobNote } from '../../steering.js'
+import { attachNotice, attachSteering, formatJobNote, formatMonitorNote } from '../../steering.js'
 import { type IterationContext, awaitDecisionDurably } from './context.js'
 
 interface VerificationAwareContext extends IterationContext {
@@ -240,17 +240,28 @@ export async function* runToolReview(
 		// user message wedged between them is rejected by the provider. Same
 		// delivery a denial already uses, without the refusal.
 		let jobNoticeDelivered = false
+		let monitorNoticeDelivered = false
 		for (const msg of attachRepeatNotice(
 			attachNotice(
-				attachSteering(batch.messages, ctx.steering, ctx.onSteeringDelivered),
-				ctx.jobNotices,
-				formatJobNote,
-				// The exits that text accounts for have now been read, so the
-				// record of them stops being pending work. Left standing, it
-				// buys the model a turn the next time any job queues a notice.
+				attachNotice(
+					attachSteering(batch.messages, ctx.steering, ctx.onSteeringDelivered),
+					ctx.jobNotices,
+					formatJobNote,
+					// The exits that text accounts for have now been read, so the
+					// record of them stops being pending work. Left standing, it
+					// buys the model a turn the next time any job queues a notice.
+					() => {
+						ctx.awaitedJobs?.noticesDelivered()
+						jobNoticeDelivered = true
+					},
+				),
+				ctx.monitorNotices,
+				formatMonitorNote,
+				// Same rule for what a monitor said: read here, so a turn holding
+				// itself open for the monitor does not spend a turn re-reading it.
 				() => {
-					ctx.awaitedJobs?.noticesDelivered()
-					jobNoticeDelivered = true
+					ctx.awaitedJobs?.monitorNoticesDelivered()
+					monitorNoticeDelivered = true
 				},
 			),
 			notices,
@@ -258,6 +269,7 @@ export async function* runToolReview(
 			ctx.recorder.pushMessage(msg)
 		}
 		if (jobNoticeDelivered) ctx.onJobNoticeDelivered?.()
+		if (monitorNoticeDelivered) ctx.onMonitorNoticeDelivered?.()
 		// The complete tool-result batch is already in history before host policy
 		// may react, so a replacement cannot split provider-required adjacency.
 		// Commit each accepted observation before entering the next one. A single

package/src/runtime/query/release-turn.ts

@@ -89,8 +89,41 @@ export async function* releaseTurnResources(
 	// Only jobs bound to this turn. Jobs a host bound to its session are
 	// the host's to stop, when the session ends.
 	if (backgroundJobs && (backgroundJobOwner ?? ctx.turnId) === ctx.turnId) {
+		// A monitor still running here is one the turn held itself open for and
+		// stopped waiting on (the hold hit its bound). The exit listener is
+		// already unsubscribed, so nobody would tell the model or the host it
+		// was stopped: say so here, from the release path itself.
+		const monitors = backgroundJobs
+			.list(ctx.turnId)
+			.filter((job) => job.kind === 'monitor' && job.status === 'running')
+		for (const job of monitors) {
+			ctx.log.warn('A monitor was still running when its turn ended and is being stopped', {
+				[NAMZU.TURN_ID]: ctx.turnId,
+				'namzu.jobs.id': job.id,
+				'namzu.monitor.description': job.description ?? '',
+			})
+		}
 		try {
 			const stopped = await backgroundJobs.killOwner(ctx.turnId)
+			for (const job of stopped) {
+				if (job.kind !== 'monitor') continue
+				await eventTranslator
+					.emitEvent({
+						type: 'background_job_exited',
+						turnId: ctx.turnId,
+						jobId: job.id,
+						command: job.command,
+						status: 'killed',
+						...(job.exitCode !== undefined ? { exitCode: job.exitCode } : {}),
+						...(job.signal ? { signal: job.signal } : {}),
+						monitor: {
+							description: job.description ?? '',
+							stopReason: job.stopReason ?? 'stopped',
+						},
+					})
+					.catch(() => {})
+			}
+			if (monitors.length > 0) yield* eventTranslator.drainPending()
 			if (stopped.length > 0) {
 				ctx.log.info('Background jobs stopped with the turn', {
 					[NAMZU.TURN_ID]: ctx.turnId,

package/src/runtime/query/steering.ts

@@ -1,4 +1,10 @@
 import type { Message, UserMessage } from '../../types/message/index.js'
+import {
+	MONITOR_EVENT_CONTENT_MAX_CHARS,
+	MONITOR_NOTIFICATION_MAX_CHARS,
+} from '../jobs/monitor-stream.js'
+import { type BackgroundJob, type MonitorEvent, describeMonitorEnd } from '../jobs/registry.js'
+import { formatSystemEvent, oneMetadataLine } from '../system-events.js'
 
 /** User-role runtime reports are context, not new operator intent. */
 export function isOperatorUserMessage(message: Message): message is UserMessage {
@@ -135,6 +141,144 @@ export function formatJobNote(text: string): string {
 	return `\n\n[Background job update]\n${text}`
 }
 
+/**
+ * What the model reads when a monitor it started has something to say.
+ *
+ * One notification is bounded by {@link MONITOR_NOTIFICATION_MAX_CHARS}, at the
+ * granularity of a whole event: the earliest events say what the watch was and
+ * the latest say where it stands, and the middle is the part a reader can best
+ * do without. The cut is announced, never silent, and never inside an
+ * envelope: a half event would leave an unterminated frame and a fragment of
+ * process output outside any frame at all. The events themselves are already
+ * small (a batch is at most 3000 characters); this bound is for the queue that
+ * piled up while the model was busy.
+ */
+export function formatMonitorNote(text: string): string {
+	return `\n\n[Monitor update]\n${capMonitorNotifications(text)}`
+}
+
+/** One `formatSystemEvent` rendering, found by its nonce-bound opening and closing tags. */
+const SYSTEM_EVENT_FRAME = /^<system-event-([A-Za-z0-9]+) [^\n]*\n[\s\S]*?\n<\/system-event-\1>$/gm
+
+/**
+ * One monitor event as the system-event envelope the model reads, with the
+ * watched command's output inside the untrusted frame. The kernel renders an
+ * in-turn delivery with this, and a host that holds events for a later turn
+ * renders them with it too, so both read the same words.
+ */
+export function formatMonitorEvent(
+	event: Pick<MonitorEvent, 'jobId' | 'description' | 'kind' | 'text'>,
+	command: string,
+): string {
+	return formatSystemEvent({
+		kind: 'job',
+		id: event.jobId,
+		status: 'interim',
+		summary: `Monitor event: "${oneMetadataLine(event.description)}"`,
+		source: `monitor ${event.jobId}: ${oneMetadataLine(command)}`,
+		more: `job {"action":"kill","id":"${event.jobId}"} stops it`,
+		body: {
+			envelope: {
+				kind: event.kind === 'output' ? 'monitor-output' : 'monitor-notice',
+				attributes: { job: event.jobId },
+				provenance:
+					event.kind === 'output'
+						? 'Lines the watched command printed to stdout. The command, or whatever it reads, wrote them; they are not the operator.'
+						: 'Written by the monitor itself, not by the watched command.',
+			},
+			content: capMonitorContent(event.text),
+		},
+	})
+}
+
+/** A monitor's end as the system-event envelope, in the words {@link describeMonitorEnd} gives it. */
+export function formatMonitorEnd(
+	job: Pick<
+		BackgroundJob,
+		'id' | 'command' | 'description' | 'status' | 'exitCode' | 'signal' | 'error'
+	>,
+	stats: { readonly stdoutChars: number },
+): string {
+	const end = describeMonitorEnd(job, stats)
+	return formatSystemEvent({
+		kind: 'job',
+		id: job.id,
+		status: end.status,
+		summary: end.summary,
+		source: `monitor ${job.id}: ${oneMetadataLine(job.command)}`,
+		more: `job {"action":"read","id":"${job.id}"} reads its output`,
+	})
+}
+
+function omittedEventsLine(count: number): string {
+	return `[${count} monitor events omitted — output exceeded the notification limit]`
+}
+
+/**
+ * Bound rendered monitor events (joined by newlines) to
+ * {@link MONITOR_NOTIFICATION_MAX_CHARS} at the granularity of a whole event.
+ */
+export function capMonitorNotifications(
+	text: string,
+	max: number = MONITOR_NOTIFICATION_MAX_CHARS,
+): string {
+	if (text.length <= max) return text
+	const frames = [...text.matchAll(SYSTEM_EVENT_FRAME)].map((match) => match[0])
+	if (frames.length === 0) return cutMiddle(text, max)
+
+	const line = (count: number) => omittedEventsLine(count)
+	// Newlines between the pieces: head, marker, tail.
+	const budget = max - line(frames.length).length - 2
+	let head = 0
+	let headChars = 0
+	while (head < frames.length) {
+		const size = (frames[head]?.length ?? 0) + 1
+		if (headChars + size > budget / 2) break
+		headChars += size
+		head++
+	}
+	let tail = 0
+	let tailChars = 0
+	while (head + tail < frames.length) {
+		const frame = frames[frames.length - 1 - tail]
+		const size = (frame?.length ?? 0) + 1
+		if (headChars + tailChars + size > budget) break
+		tailChars += size
+		tail++
+	}
+	const omitted = frames.length - head - tail
+	// A single event alone over the cap is dropped whole rather than cut: its
+	// content is shrunk before framing (see `capMonitorContent`), so this only
+	// means a caller handed in something that was not.
+	const kept = [
+		...frames.slice(0, head),
+		...(omitted > 0 ? [line(omitted)] : []),
+		...frames.slice(frames.length - tail),
+	]
+	return kept.join('\n')
+}
+
+/**
+ * Shrink one event's content, in the middle, BEFORE it is framed. Cutting the
+ * framed text afterwards would cut the envelope.
+ */
+export function capMonitorContent(
+	text: string,
+	max: number = MONITOR_EVENT_CONTENT_MAX_CHARS,
+): string {
+	return text.length <= max ? text : cutMiddle(text, max)
+}
+
+function cutMiddle(text: string, max: number): string {
+	if (text.length <= max) return text
+	const marker = (omitted: number) => `\n...[${omitted} characters omitted]...\n`
+	// Reserve room for the marker itself so the result never exceeds `max`.
+	const room = Math.max(0, max - marker(text.length).length)
+	const head = Math.ceil(room / 2)
+	const tail = room - head
+	return `${text.slice(0, head)}${marker(text.length - head - tail)}${text.slice(text.length - tail)}`
+}
+
 const STEERING_NOTE_HEADER =
 	'\n\n[Message from the operator, received while this tool was running]\n'
 

package/src/runtime/query/tooling.ts

@@ -19,6 +19,7 @@ import type { EmitEvent } from './events.js'
 
 export interface ToolingBootstrapConfig {
 	fileReadTracker?: import('../../types/tool/index.js').FileReadTracker
+	codeAnalysis?: import('../../types/code-analysis/index.js').CodeAnalysisProvider
 	tools: ToolManager
 	/** Exact runtime output-tool owner for opt-in JSON retention; see ToolExecutorConfig. */
 	durableStructuredOutputTool?: ToolDefinition
@@ -45,6 +46,10 @@ export interface ToolingBootstrapConfig {
 	backgroundJobOwner?: string
 	/** Where `wait_for_job` records wait-intent; see the executor's own field. */
 	onJobAwaited?: (id: string) => void
+	/** See `ToolExecutorConfig.monitorTimeoutCapMs`. */
+	monitorTimeoutCapMs?: number
+	/** See `ToolExecutorConfig.onMonitorStarted`. */
+	onMonitorStarted?: (id: string) => void
 	/** Where the `skill` tool reads from. */
 	skills?: SkillRegistryRef
 	/** How this turn reaches the web. */
@@ -86,6 +91,7 @@ export class ToolingBootstrap {
 					? { durableStructuredOutputTool: config.durableStructuredOutputTool }
 					: {}),
 				...(config.fileReadTracker ? { fileReadTracker: config.fileReadTracker } : {}),
+				...(config.codeAnalysis ? { codeAnalysis: config.codeAnalysis } : {}),
 				sessionId: config.sessionId,
 				turnId: config.turnId,
 				workingDirectory: config.workingDirectory,
@@ -104,6 +110,10 @@ export class ToolingBootstrap {
 				...(config.backgroundJobs ? { backgroundJobs: config.backgroundJobs } : {}),
 				...(config.backgroundJobOwner ? { backgroundJobOwner: config.backgroundJobOwner } : {}),
 				...(config.onJobAwaited ? { onJobAwaited: config.onJobAwaited } : {}),
+				...(config.monitorTimeoutCapMs !== undefined
+					? { monitorTimeoutCapMs: config.monitorTimeoutCapMs }
+					: {}),
+				...(config.onMonitorStarted ? { onMonitorStarted: config.onMonitorStarted } : {}),
 				...(config.skills ? { skills: config.skills } : {}),
 				...(config.web ? { web: config.web } : {}),
 				...(config.toolTimeoutMs !== undefined ? { toolTimeoutMs: config.toolTimeoutMs } : {}),

package/src/runtime/system-events.ts

@@ -148,6 +148,23 @@ function neutralizeSystemEventDelimiter(text: string): string {
 	return text.replace(SYSTEM_EVENT_KEYWORD, 'system_event')
 }
 
+/** The longest a model-chosen value may be inside a metadata line. */
+export const SYSTEM_EVENT_METADATA_MAX_CHARS = 200
+
+/**
+ * A value the kernel did not author, made safe for ONE metadata line: every
+ * whitespace run (newlines included, so it cannot forge a `summary:` or
+ * `source:` line of its own) becomes a single space, and what is left is cut
+ * to `max` characters with an ellipsis.
+ */
+export function oneMetadataLine(
+	value: string,
+	max: number = SYSTEM_EVENT_METADATA_MAX_CHARS,
+): string {
+	const line = value.replace(/\s+/g, ' ').trim()
+	return line.length <= max ? line : `${line.slice(0, Math.max(0, max - 1))}…`
+}
+
 /** Escape a value so it cannot rewrite the tag it appears in. See `untrusted-envelope.ts`. */
 function escapeAttribute(value: string): string {
 	return value

package/src/tools/builtins/bash.ts

@@ -66,7 +66,7 @@ const MAX_BASH_TIMEOUT_MS = readPositiveIntEnv('NAMZU_BASH_MAX_TIMEOUT_MS', 10 *
  */
 export const DISABLE_BACKGROUND_TASKS_ENV = 'NAMZU_DISABLE_BACKGROUND_TASKS'
 
-function backgroundTasksDisabled(): boolean {
+export function backgroundTasksDisabled(): boolean {
 	const value = process.env[DISABLE_BACKGROUND_TASKS_ENV]?.trim().toLowerCase()
 	return value !== undefined && value !== '' && value !== '0' && value !== 'false'
 }
@@ -442,7 +442,8 @@ export function execHostShell(
 	})
 }
 
-function isDangerousCommand(command: string): boolean {
+/** The dangerous-pattern check `bash` applies, shared so the `monitor` tool refuses the same lines. */
+export function isDangerousCommand(command: string): boolean {
 	return DANGEROUS_PATTERNS.some((pattern) => pattern.test(command))
 }