@namzu/sdk 7.0.0 → 8.0.0

package/dist/verification/gate.js

@@ -30,6 +30,13 @@ export function describeRule(rule) {
             return `allowed by category (${rule.categories.join(', ')})`;
         case 'allow_by_tier':
             return `allowed by tier (${rule.tiers.join(', ')})`;
+        case 'argument_pattern': {
+            // Names the argument, not just the pattern. That is what tells a
+            // model whether a different value could get through — which is the
+            // difference between rewording once and rewording forever.
+            const verb = rule.decision === 'deny' ? 'denied' : 'allowed';
+            return `${verb} because the \`${rule.argument}\` argument matched ${rule.pattern} (this rule applies to ${rule.toolNames.join(', ')})`;
+        }
         case 'custom_pattern': {
             const where = rule.target === 'both' ? 'name or arguments' : rule.target;
             const verb = rule.decision === 'deny' ? 'denied' : 'allowed';
@@ -104,6 +111,43 @@ export class VerificationGate {
                     });
                 }
             }
+            if (rule.type === 'argument_pattern') {
+                // Needs BOTH, because it is the rule that names both.
+                //
+                // The name set is recorded only after the pattern compiles, so
+                // a rule with a typo'd regex leaves neither half behind. That
+                // ordering is defence in depth and NOT what makes the guarantee
+                // — `evaluateRule` returns null on a missing compiled pattern
+                // before it ever looks at the name set, so reversing these two
+                // lines changes no behaviour. Measured: reversing them fails no
+                // test, and the test that looks like it covers this is really
+                // covering the check in `evaluateRule`.
+                //
+                // Written down because the alternative is someone later reading
+                // the order as load-bearing and preserving it for the wrong
+                // reason, or removing the real check believing this one covers
+                // it.
+                if (rule.pattern.length > MAX_CUSTOM_PATTERN_LENGTH) {
+                    this.log.warn('Argument pattern exceeds max length, skipping', {
+                        index: i,
+                        length: rule.pattern.length,
+                        maxLength: MAX_CUSTOM_PATTERN_LENGTH,
+                    });
+                    continue;
+                }
+                try {
+                    const compiled = new RegExp(rule.pattern);
+                    this.compiledPatterns.set(i, compiled);
+                    this.nameSets.set(i, new Set(rule.toolNames));
+                }
+                catch (err) {
+                    this.log.warn('Invalid argument pattern regex, skipping', {
+                        index: i,
+                        pattern: rule.pattern,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
             if (rule.type === 'allow_by_name') {
                 this.nameSets.set(i, new Set(rule.toolNames));
             }

package/dist/verification/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/verification/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAA;AAO9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAA;AAE7E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAQzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,IAAsB;IAClD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,yBAAyB;YAC7B,OAAO,kFAAkF,CAAA;QAC1F,KAAK,iBAAiB;YACrB,OAAO,yCAAyC,CAAA;QACjD,KAAK,eAAe;YACnB,OAAO,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QACxD,KAAK,cAAc;YAClB,OAAO,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gFAAgF,CAAA;QACpI,KAAK,mBAAmB;YACvB,OAAO,wBAAwB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QAC7D,KAAK,eAAe;YACnB,OAAO,oBAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QACpD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;YACxE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5D,OAAO,GAAG,IAAI,mCAAmC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAA;QAC1E,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,UAAU,GAAU,IAAI,CAAA;YAC9B,OAAO,iCAAiC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAA;QACrE,CAAC;IACF,CAAC;AACF,CAAC;AAED,MAAM,OAAO,gBAAgB;IACX,KAAK,CAAoB;IACzB,gBAAgB,CAAqB;IACrC,QAAQ,CAA0B;IAClC,GAAG,CAAQ;IACX,YAAY,CAAS;IACrB,OAAO,CAAS;IAEjC,YAAY,MAA8B,EAAE,GAAW;QACtD,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACvD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAA;QACvC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAE7B,MAAM,aAAa,GAAuB,EAAE,CAAA;QAE5C,qEAAqE;QACrE,mDAAmD;QACnD,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,sDAAsD;QACtD,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAClC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAA;QACxD,CAAC;QAED,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAEnC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,aAAa,CAAA;QAE1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAA;QAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YAEnB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;oBACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,EAAE;wBAC5D,KAAK,EAAE,CAAC;wBACR,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;wBAC3B,SAAS,EAAE,yBAAyB;qBACpC,CAAC,CAAA;oBACF,SAAQ;gBACT,CAAC;gBACD,IAAI,CAAC;oBACJ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;gBACvD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE;wBACvD,KAAK,EAAE,CAAC;wBACR,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACvD,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;YAC9C,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;YAC9C,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAC,GAAoB;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACN,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,eAAe;aACvB,CAAA;QACF,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,MAAM,QAAQ,GAAG,YAAY,CAC5B,IAAI,EACJ,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,OAAO,EACX,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CACpB,CAAA;YAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAyB;oBACpC,QAAQ;oBACR,WAAW,EAAE,IAAI;oBACjB,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;iBAC1B,CAAA;gBAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE;wBAC/B,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,QAAQ;wBACR,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,SAAS,EAAE,CAAC;qBACZ,CAAC,CAAA;gBACH,CAAC;gBAED,OAAO,MAAM,CAAA;YACd,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAyB;YACpC,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,wBAAwB;SAChC,CAAA;QAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE;gBACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,QAAQ,EAAE,QAAQ;aAClB,CAAC,CAAA;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACd,CAAC;CACD"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/verification/gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAA;AAO9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAA;AAE7E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAQzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,IAAsB;IAClD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,yBAAyB;YAC7B,OAAO,kFAAkF,CAAA;QAC1F,KAAK,iBAAiB;YACrB,OAAO,yCAAyC,CAAA;QACjD,KAAK,eAAe;YACnB,OAAO,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QACxD,KAAK,cAAc;YAClB,OAAO,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gFAAgF,CAAA;QACpI,KAAK,mBAAmB;YACvB,OAAO,wBAAwB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QAC7D,KAAK,eAAe;YACnB,OAAO,oBAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QACpD,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACzB,iEAAiE;YACjE,mEAAmE;YACnE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5D,OAAO,GAAG,IAAI,kBAAkB,IAAI,CAAC,QAAQ,uBAAuB,IAAI,CAAC,OAAO,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QACvI,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;YACxE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5D,OAAO,GAAG,IAAI,mCAAmC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAA;QAC1E,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,UAAU,GAAU,IAAI,CAAA;YAC9B,OAAO,iCAAiC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAA;QACrE,CAAC;IACF,CAAC;AACF,CAAC;AAED,MAAM,OAAO,gBAAgB;IACX,KAAK,CAAoB;IACzB,gBAAgB,CAAqB;IACrC,QAAQ,CAA0B;IAClC,GAAG,CAAQ;IACX,YAAY,CAAS;IACrB,OAAO,CAAS;IAEjC,YAAY,MAA8B,EAAE,GAAW;QACtD,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACzD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAA;QACvD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAA;QACvC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAE7B,MAAM,aAAa,GAAuB,EAAE,CAAA;QAE5C,qEAAqE;QACrE,mDAAmD;QACnD,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,sDAAsD;QACtD,EAAE;QACF,qEAAqE;QACrE,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAClC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAA;QACxD,CAAC;QAED,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAEnC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;QAChD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,aAAa,CAAA;QAE1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAA;QAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YAEnB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACpC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;oBACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,EAAE;wBAC5D,KAAK,EAAE,CAAC;wBACR,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;wBAC3B,SAAS,EAAE,yBAAyB;qBACpC,CAAC,CAAA;oBACF,SAAQ;gBACT,CAAC;gBACD,IAAI,CAAC;oBACJ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;gBACvD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE;wBACvD,KAAK,EAAE,CAAC;wBACR,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACvD,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACtC,sDAAsD;gBACtD,EAAE;gBACF,+DAA+D;gBAC/D,8DAA8D;gBAC9D,gEAAgE;gBAChE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,gEAAgE;gBAChE,8DAA8D;gBAC9D,wCAAwC;gBACxC,EAAE;gBACF,gEAAgE;gBAChE,4DAA4D;gBAC5D,+DAA+D;gBAC/D,MAAM;gBACN,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;oBACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE;wBAC9D,KAAK,EAAE,CAAC;wBACR,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;wBAC3B,SAAS,EAAE,yBAAyB;qBACpC,CAAC,CAAA;oBACF,SAAQ;gBACT,CAAC;gBACD,IAAI,CAAC;oBACJ,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;oBACzC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;oBACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE;wBACzD,KAAK,EAAE,CAAC;wBACR,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACvD,CAAC,CAAA;gBACH,CAAC;YACF,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;YAC9C,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;YAC9C,CAAC;QACF,CAAC;IACF,CAAC;IAED,QAAQ,CAAC,GAAoB;QAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACN,QAAQ,EAAE,QAAQ;gBAClB,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,eAAe;aACvB,CAAA;QACF,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,MAAM,QAAQ,GAAG,YAAY,CAC5B,IAAI,EACJ,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,OAAO,EACX,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CACpB,CAAA;YAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAyB;oBACpC,QAAQ;oBACR,WAAW,EAAE,IAAI;oBACjB,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;iBAC1B,CAAA;gBAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBACvB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE;wBAC/B,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,QAAQ;wBACR,QAAQ,EAAE,IAAI,CAAC,IAAI;wBACnB,SAAS,EAAE,CAAC;qBACZ,CAAC,CAAA;gBACH,CAAC;gBAED,OAAO,MAAM,CAAA;YACd,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAyB;YACpC,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,wBAAwB;SAChC,CAAA;QAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE;gBACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,QAAQ,EAAE,QAAQ;aAClB,CAAC,CAAA;QACH,CAAC;QAED,OAAO,MAAM,CAAA;IACd,CAAC;CACD"}

package/dist/verification/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/verification/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEpF,wBAAgB,YAAY,CAC3B,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,eAAe,CAAC,EAAE,MAAM,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACnB,YAAY,GAAG,IAAI,CAkErB"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/verification/rules.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AAEpF,wBAAgB,YAAY,CAC3B,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,eAAe,CAAC,EAAE,MAAM,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACnB,YAAY,GAAG,IAAI,CA8FrB"}

package/dist/verification/rules.js

@@ -46,6 +46,33 @@ export function evaluateRule(rule, toolName, toolInput, toolDef, compiledPattern
             }
             return compiledPattern.test(target) ? rule.decision : null;
         }
+        case 'argument_pattern': {
+            if (!compiledPattern)
+                return null;
+            if (!nameSet?.has(toolName))
+                return null;
+            if (typeof toolInput !== 'object' || toolInput === null)
+                return null;
+            const value = toolInput[rule.argument];
+            // The subject is the argument's own value, which is the whole point
+            // — `^git push` here means what a reader expects, where the same
+            // pattern against the serialised object could never match.
+            //
+            // Numbers and booleans are rendered rather than skipped, because
+            // `String(4000)` is unambiguous and anchorable. Objects and arrays
+            // are NOT: no string a pattern could match says anything true about
+            // a structured value, and serialising one would put us back where
+            // `custom_pattern` already is. A rule about the shape of an input
+            // is a rule about the tool, and `deny_by_name` is where it belongs.
+            const subject = typeof value === 'string'
+                ? value
+                : typeof value === 'number' || typeof value === 'boolean'
+                    ? String(value)
+                    : undefined;
+            if (subject === undefined)
+                return null;
+            return compiledPattern.test(subject) ? rule.decision : null;
+        }
         case 'allow_by_tier': {
             if (toolDef?.tier && rule.tiers.includes(toolDef.tier)) {
                 return 'allow';

package/dist/verification/rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/verification/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAIhE,MAAM,UAAU,YAAY,CAC3B,IAAsB,EACtB,QAAgB,EAChB,SAAkB,EAClB,OAAmC,EACnC,eAAwB,EACxB,OAAqB;IAErB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,OAAO,OAAO,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACzD,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAA;gBACd,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACrB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YAEjC,IAAI,MAAc,CAAA;YAClB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACV,MAAM,GAAG,QAAQ,CAAA;oBACjB,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBAClC,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;oBACnD,MAAK;gBACN,OAAO,CAAC,CAAC,CAAC;oBACT,MAAM,WAAW,GAAU,IAAI,CAAC,MAAM,CAAA;oBACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAqB,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3D,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,IAAI,CAAA;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAsC,WAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/F,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/verification/rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAIhE,MAAM,UAAU,YAAY,CAC3B,IAAsB,EACtB,QAAgB,EAChB,SAAkB,EAClB,OAAmC,EACnC,eAAwB,EACxB,OAAqB;IAErB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACxB,OAAO,OAAO,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QACzD,CAAC;QAED,KAAK,yBAAyB,CAAC,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;YAC5C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;gBAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9B,OAAO,MAAM,CAAA;gBACd,CAAC;YACF,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/C,CAAC;QAED,KAAK,cAAc,CAAC,CAAC,CAAC;YACrB,OAAO,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YAEjC,IAAI,MAAc,CAAA;YAClB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,KAAK,MAAM;oBACV,MAAM,GAAG,QAAQ,CAAA;oBACjB,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;oBAClC,MAAK;gBACN,KAAK,MAAM;oBACV,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAA;oBACnD,MAAK;gBACN,OAAO,CAAC,CAAC,CAAC;oBACT,MAAM,WAAW,GAAU,IAAI,CAAC,MAAM,CAAA;oBACtC,MAAM,IAAI,KAAK,CAAC,oCAAoC,WAAqB,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC3D,CAAC;QAED,KAAK,kBAAkB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAA;YACjC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;YAExC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YACpE,MAAM,KAAK,GAAI,SAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAEnE,oEAAoE;YACpE,iEAAiE;YACjE,2DAA2D;YAC3D,EAAE;YACF,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,MAAM,OAAO,GACZ,OAAO,KAAK,KAAK,QAAQ;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;oBACxD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACf,CAAC,CAAC,SAAS,CAAA;YACd,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YAEtC,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5D,CAAC;QAED,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,IAAI,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAA;YACf,CAAC;YACD,OAAO,IAAI,CAAA;QACZ,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,WAAW,GAAU,IAAI,CAAA;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAsC,WAAgC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC/F,CAAC;IACF,CAAC;AACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/sdk",
-  "version": "7.0.0",
+  "version": "8.0.0",
   "description": "Open-source AI agent SDK with a built-in runtime. Nothing between you and your agents.",
   "license": "FSL-1.1-MIT",
   "type": "module",

package/src/agents/SupervisorAgent.ts

@@ -185,181 +185,190 @@ export class SupervisorAgent extends AbstractAgent<SupervisorAgentConfig, Superv
 		const completionInbox = new CompletionInbox()
 		completionInbox.attach(gateway)
 
-		const coordinatorToolDefs = buildCoordinatorTools({
-			gateway,
-			completionInbox,
-			workingDirectory: input.workingDirectory,
-			runtimeContext: input.runtimeContext,
-			allowedAgentIds: config.agentIds,
-			// The only hop between the config and the decision. Omit it and
-			// everything still compiles: the field is settable, documented, and
-			// read by nothing — which is the shape of a declaration this repo
-			// has had to go and delete before.
-			allowDelegation: config.allowDelegation,
-			taskStore: input.taskStore,
-			runId,
-			getPlanManager: () => planManagerRef,
-			onTaskLaunched: (agentTaskId, meta) => {
-				launchedTasks.set(agentTaskId, meta)
-			},
-			// With a resume handler present the coordinator surface gains
-			// ask_user_question — the model can park the run on a question
-			// routed through the same HITL channel as plan approvals.
-			...(config.resumeHandler ? { resumeHandler: config.resumeHandler } : {}),
-			questionParks,
-			pendingAnswers,
-		})
+		// From here to the return in a try/finally, so the listener is released
+		// on every way out. The registration loop below can throw
+		// ToolNameCollisionError, and a host that hits that fixes its config and
+		// runs again — which is how a leak of one listener per run becomes a leak
+		// of one per ATTEMPT.
+		try {
+			const coordinatorToolDefs = buildCoordinatorTools({
+				gateway,
+				completionInbox,
+				workingDirectory: input.workingDirectory,
+				runtimeContext: input.runtimeContext,
+				allowedAgentIds: config.agentIds,
+				// The only hop between the config and the decision. Omit it and
+				// everything still compiles: the field is settable, documented, and
+				// read by nothing — which is the shape of a declaration this repo
+				// has had to go and delete before.
+				allowDelegation: config.allowDelegation,
+				taskStore: input.taskStore,
+				runId,
+				getPlanManager: () => planManagerRef,
+				onTaskLaunched: (agentTaskId, meta) => {
+					launchedTasks.set(agentTaskId, meta)
+				},
+				// With a resume handler present the coordinator surface gains
+				// ask_user_question — the model can park the run on a question
+				// routed through the same HITL channel as plan approvals.
+				...(config.resumeHandler ? { resumeHandler: config.resumeHandler } : {}),
+				questionParks,
+				pendingAnswers,
+			})
 
-		const tools = new ToolRegistry()
-		if (config.tools) {
-			for (const tool of config.tools.getAll()) {
-				tools.register(tool, config.tools.getAvailability(tool.name))
+			const tools = new ToolRegistry()
+			if (config.tools) {
+				for (const tool of config.tools.getAll()) {
+					tools.register(tool, config.tools.getAvailability(tool.name))
+				}
 			}
-		}
-		// Registered the way every other kernel-mounted tool in this SDK is
-		// registered: honouring `runtimeToolOverrides`, and refusing to take a
-		// name the host already used.
-		//
-		// Both halves were missing here and nowhere else. `runtimeToolOverrides`
-		// is declared on `AgentInput`, is forwarded into this very `drainQuery`
-		// call below, and is consulted for the task tools and for the advisory
-		// tools — but the coordinator tools were registered before that and
-		// unconditionally, so `{ create_task: 'disabled' }` was honoured
-		// everywhere except the one surface a host would most want to decline.
-		// A run that must not delegate had prompt text and a gateway refusal as
-		// its only defences.
-		//
-		// Collision REFUSES rather than overwrites, and the principle is
-		// complete mediation rather than fail-safe defaults: "proposals to gain
-		// performance by remembering the result of an authority check [must] be
-		// examined skeptically. If a change in authority occurs, such remembered
-		// results must be systematically updated" (Saltzer & Schroeder 1975,
-		// §I.A.3(c)). A registry entry is a remembered binding of a name to an
-		// authority, and a later write that rebinds the name leaves every
-		// decision made about the old binding stale.
-		//
-		// The counter-argument is that today the host's tool merely loses
-		// quietly and the run still works, so six reserved names is a real cost
-		// on a name a consumer may have chosen long ago. It does not hold,
-		// because "loses quietly" is not what happens. `registerOne` ends with
-		// `availability.set(id, state)` and this call passes no state, so a tool
-		// the host registered `deferred` or `suspended` is silently PROMOTED to
-		// active under someone else's implementation; and because the store is a
-		// Map, the replacement inherits the host's insertion position in the
-		// prompt-cache prefix. That is a different authorization surface, not a
-		// lost registration. CWE-390 is the shape `ManagedRegistry` has here —
-		// detection of an error condition without action — and CWE-694's own
-		// mitigation is nearly this fix: do not operate any resource with a
-		// non-unique identifier, and report the error.
-		//
-		// Refusing is also what the peer set does. One runtime's registry
-		// primitive throws on both duplicate and reserved names; another refuses
-		// its injected delegation name in a pre-flight that tells the author to
-		// rename. Closer to home, `ProviderRegistry.register` already throws
-		// unless the caller passes `{ replace: true }` — declared intent is what
-		// separates a legitimate replacement from an accidental one, and no such
-		// intent is expressible here.
-		const overrides = input.runtimeToolOverrides
-		for (const tool of coordinatorToolDefs) {
-			const override = overrides?.[tool.name]
-			if (override === 'disabled') continue
-			if (config.tools?.has(tool.name)) {
-				throw new ToolNameCollisionError(tool.name, 'the supervisor coordinator surface')
+			// Registered the way every other kernel-mounted tool in this SDK is
+			// registered: honouring `runtimeToolOverrides`, and refusing to take a
+			// name the host already used.
+			//
+			// Both halves were missing here and nowhere else. `runtimeToolOverrides`
+			// is declared on `AgentInput`, is forwarded into this very `drainQuery`
+			// call below, and is consulted for the task tools and for the advisory
+			// tools — but the coordinator tools were registered before that and
+			// unconditionally, so `{ create_task: 'disabled' }` was honoured
+			// everywhere except the one surface a host would most want to decline.
+			// A run that must not delegate had prompt text and a gateway refusal as
+			// its only defences.
+			//
+			// Collision REFUSES rather than overwrites, and the principle is
+			// complete mediation rather than fail-safe defaults: "proposals to gain
+			// performance by remembering the result of an authority check [must] be
+			// examined skeptically. If a change in authority occurs, such remembered
+			// results must be systematically updated" (Saltzer & Schroeder 1975,
+			// §I.A.3(c)). A registry entry is a remembered binding of a name to an
+			// authority, and a later write that rebinds the name leaves every
+			// decision made about the old binding stale.
+			//
+			// The counter-argument is that today the host's tool merely loses
+			// quietly and the run still works, so six reserved names is a real cost
+			// on a name a consumer may have chosen long ago. It does not hold,
+			// because "loses quietly" is not what happens. `registerOne` ends with
+			// `availability.set(id, state)` and this call passes no state, so a tool
+			// the host registered `deferred` or `suspended` is silently PROMOTED to
+			// active under someone else's implementation; and because the store is a
+			// Map, the replacement inherits the host's insertion position in the
+			// prompt-cache prefix. That is a different authorization surface, not a
+			// lost registration. CWE-390 is the shape `ManagedRegistry` has here —
+			// detection of an error condition without action — and CWE-694's own
+			// mitigation is nearly this fix: do not operate any resource with a
+			// non-unique identifier, and report the error.
+			//
+			// Refusing is also what the peer set does. One runtime's registry
+			// primitive throws on both duplicate and reserved names; another refuses
+			// its injected delegation name in a pre-flight that tells the author to
+			// rename. Closer to home, `ProviderRegistry.register` already throws
+			// unless the caller passes `{ replace: true }` — declared intent is what
+			// separates a legitimate replacement from an accidental one, and no such
+			// intent is expressible here.
+			const overrides = input.runtimeToolOverrides
+			for (const tool of coordinatorToolDefs) {
+				const override = overrides?.[tool.name]
+				if (override === 'disabled') continue
+				if (config.tools?.has(tool.name)) {
+					throw new ToolNameCollisionError(tool.name, 'the supervisor coordinator surface')
+				}
+				tools.register(tool, override ?? 'active')
 			}
-			tools.register(tool, override ?? 'active')
-		}
 
-		const childInvocationState = deriveChildState(
-			config.invocationState ?? { tenantId },
-			this.metadata.id,
-		)
+			const childInvocationState = deriveChildState(
+				config.invocationState ?? { tenantId },
+				this.metadata.id,
+			)
 
-		const run = await drainQuery(
-			{
-				systemPrompt: config.systemPrompt,
-				skills: config.skills,
-				provider: config.provider,
-				tools,
-				runConfig: {
-					model: config.model,
-					tokenBudget: config.tokenBudget,
-					timeoutMs: config.timeoutMs,
-					maxIterations: config.maxIterations,
-					temperature: config.temperature,
-					env: config.env,
-					// See ReactiveAgent: a hand-listed literal drops what nobody
-					// remembered to add, and reports nothing when it does.
-					...(config.thinking ? { thinking: config.thinking } : {}),
-					...(config.effort ? { effort: config.effort } : {}),
-				},
-				questionParks,
-				pendingAnswers,
-				agentId: this.metadata.id,
-				agentName: this.metadata.name,
-				workingDirectory: input.workingDirectory,
-				messages: input.messages,
-				signal: input.signal,
-				sessionId,
-				threadId,
-				projectId,
-				tenantId,
-				runId,
-				parentRunId: config.parentRunId,
-				depth: config.depth,
-				contextLevel: 'full',
-				onContextCreated: ({ planManager }) => {
-					planManagerRef = planManager
+			const run = await drainQuery(
+				{
+					systemPrompt: config.systemPrompt,
+					skills: config.skills,
+					provider: config.provider,
+					tools,
+					runConfig: {
+						model: config.model,
+						tokenBudget: config.tokenBudget,
+						timeoutMs: config.timeoutMs,
+						maxIterations: config.maxIterations,
+						temperature: config.temperature,
+						env: config.env,
+						// See ReactiveAgent: a hand-listed literal drops what nobody
+						// remembered to add, and reports nothing when it does.
+						...(config.thinking ? { thinking: config.thinking } : {}),
+						...(config.effort ? { effort: config.effort } : {}),
+					},
+					questionParks,
+					pendingAnswers,
+					agentId: this.metadata.id,
+					agentName: this.metadata.name,
+					workingDirectory: input.workingDirectory,
+					messages: input.messages,
+					signal: input.signal,
+					sessionId,
+					threadId,
+					projectId,
+					tenantId,
+					runId,
+					parentRunId: config.parentRunId,
+					depth: config.depth,
+					contextLevel: 'full',
+					onContextCreated: ({ planManager }) => {
+						planManagerRef = planManager
+					},
+					taskStore: input.taskStore,
+					runtimeToolOverrides: input.runtimeToolOverrides,
+					runtimeContext: input.runtimeContext,
+					taskGateway: gateway,
+					completionInbox,
+					launchedTasks,
+					advisory: config.advisory,
+					invocationState: childInvocationState,
+					// HITL surface: forward optional review-time hooks so hosts can
+					// run "Ask before acting" supervisors instead of the default
+					// auto-approve. drainQuery falls back to autoApproveHandler
+					// when resumeHandler is omitted (= same behaviour as before).
+					...(config.resumeHandler ? { resumeHandler: config.resumeHandler } : {}),
+					// Forwarded for the same reason the handler is. A capability the
+					// kernel honours in `drainQuery` but that never reaches the
+					// surface a host actually constructs is a capability nobody can
+					// use — which is the shape of defect this file has already been
+					// corrected for twice.
+					...(config.steering ? { steering: config.steering } : {}),
+					...(config.verificationGate ? { verificationGate: config.verificationGate } : {}),
+					...(config.sandboxProvider ? { sandboxProvider: config.sandboxProvider } : {}),
+					// Working-memory / compaction seam (optional; absent => unchanged
+					// run path, byte-identical for every existing consumer).
+					...(config.compactionConfig ? { compactionConfig: config.compactionConfig } : {}),
+					...(config.workingMemoryProvider
+						? { workingMemoryProvider: config.workingMemoryProvider }
+						: {}),
 				},
-				taskStore: input.taskStore,
-				runtimeToolOverrides: input.runtimeToolOverrides,
-				runtimeContext: input.runtimeContext,
-				taskGateway: gateway,
-				completionInbox,
-				launchedTasks,
-				advisory: config.advisory,
-				invocationState: childInvocationState,
-				// HITL surface: forward optional review-time hooks so hosts can
-				// run "Ask before acting" supervisors instead of the default
-				// auto-approve. drainQuery falls back to autoApproveHandler
-				// when resumeHandler is omitted (= same behaviour as before).
-				...(config.resumeHandler ? { resumeHandler: config.resumeHandler } : {}),
-				// Forwarded for the same reason the handler is. A capability the
-				// kernel honours in `drainQuery` but that never reaches the
-				// surface a host actually constructs is a capability nobody can
-				// use — which is the shape of defect this file has already been
-				// corrected for twice.
-				...(config.steering ? { steering: config.steering } : {}),
-				...(config.verificationGate ? { verificationGate: config.verificationGate } : {}),
-				...(config.sandboxProvider ? { sandboxProvider: config.sandboxProvider } : {}),
-				// Working-memory / compaction seam (optional; absent => unchanged
-				// run path, byte-identical for every existing consumer).
-				...(config.compactionConfig ? { compactionConfig: config.compactionConfig } : {}),
-				...(config.workingMemoryProvider
-					? { workingMemoryProvider: config.workingMemoryProvider }
-					: {}),
-			},
-			listener,
-		)
+				listener,
+			)
 
-		const taskHandles = gateway.listTasks()
-		const taskResults = synthesizeTaskResults(taskHandles, runId)
+			const taskHandles = gateway.listTasks()
+			const taskResults = synthesizeTaskResults(taskHandles, runId)
 
-		const completedTasks = countCompletedTasks(taskResults)
+			const completedTasks = countCompletedTasks(taskResults)
 
-		return {
-			runId: run.id,
-			status: run.status === 'completed' ? 'completed' : 'failed',
-			stopReason: run.stopReason,
-			usage: run.tokenUsage,
-			cost: run.costInfo,
-			iterations: run.currentIteration,
-			durationMs: Date.now() - startTime,
-			messages: run.messages,
-			result: run.result,
-			lastError: run.lastError,
-			taskResults,
-			completedTasks,
-			totalTasks: taskResults.length,
+			return {
+				runId: run.id,
+				status: run.status === 'completed' ? 'completed' : 'failed',
+				stopReason: run.stopReason,
+				usage: run.tokenUsage,
+				cost: run.costInfo,
+				iterations: run.currentIteration,
+				durationMs: Date.now() - startTime,
+				messages: run.messages,
+				result: run.result,
+				lastError: run.lastError,
+				taskResults,
+				completedTasks,
+				totalTasks: taskResults.length,
+			}
+		} finally {
+			completionInbox.close()
 		}
 	}
 }