@sema-agent/core 7.56.0 → 7.57.0

package/dist/core/untrusted-egress.js

@@ -1,3 +1,4 @@
+import { types } from "node:util";
 import { delimitUntrusted, inlineUntrusted, neutralizeForFence } from "./untrusted-text.js";
 import { egressPasses, runRedactionPasses } from "./redaction-passes.js";
 import { CREDENTIAL_VOCABULARY, egressPassGroups, isSensitiveRecordKey, URI_SCHEME_SOURCE } from "./credential-vocabulary.js";
@@ -44,7 +45,9 @@ const VALUE_DEPTH_MAX = 32;
 const VALUE_MEMBERS_MAX = 2_000;
 const WHOLE = "[redacted]";
 export function egressValue(tier, value) {
-    const snapshots = new Map();
+    return foreignValue(tier, value, new Map());
+}
+function foreignValue(tier, value, snapshots) {
     let budget = VALUE_MEMBERS_MAX;
     const ownKeys = (o, all) => {
         try {
@@ -143,9 +146,80 @@ export function egressValue(tier, value) {
     }
     return pass(value, 0, "");
 }
-const REDACTION_MARKER_RE = /\[redacted(?:-[a-z]+)?\]/g;
+export function egressAccount(tier, value) {
+    const snapshots = new Map();
+    const plainShape = (o) => {
+        try {
+            if (types.isProxy(o))
+                return undefined;
+            if (Array.isArray(o))
+                return "array";
+            const proto = Object.getPrototypeOf(o);
+            return proto === Object.prototype || proto === null ? "record" : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    function pass(v, depth) {
+        if (typeof v === "string")
+            return egressText(tier, v);
+        if (typeof v === "function")
+            return undefined;
+        if (typeof v !== "object" || v === null)
+            return v;
+        const known = snapshots.get(v);
+        if (known !== undefined)
+            return known;
+        if (depth >= VALUE_DEPTH_MAX)
+            return WHOLE;
+        const shape = plainShape(v);
+        if (shape === undefined)
+            return foreignValue(tier, v, snapshots);
+        let keys;
+        try {
+            keys = Object.keys(v);
+        }
+        catch {
+            return foreignValue(tier, v, snapshots);
+        }
+        const snapshot = shape === "array" ? [] : prototypeIsNull(v) ? Object.create(null) : {};
+        snapshots.set(v, snapshot);
+        for (const key of keys) {
+            let read;
+            let isData = false;
+            try {
+                const d = Reflect.getOwnPropertyDescriptor(v, key);
+                if (d === undefined)
+                    continue;
+                isData = "value" in d;
+                read = isData ? pass(d.value, depth + 1) : foreignValue(tier, d.get?.call(v), snapshots);
+                if (read === undefined && !(isData && d.value === undefined))
+                    continue;
+            }
+            catch {
+                continue;
+            }
+            Object.defineProperty(snapshot, key, { value: read, enumerable: true, writable: true, configurable: true });
+        }
+        return snapshot;
+    }
+    const prototypeIsNull = (o) => {
+        try {
+            return Object.getPrototypeOf(o) === null;
+        }
+        catch {
+            return false;
+        }
+    };
+    return pass(value, 0);
+}
+const REDACTION_MARKER_RE = /\[redacted(?:-(?:credentials|url|path))?\]/g;
+export function redactionMarkerSpans(s) {
+    return [...s.matchAll(REDACTION_MARKER_RE)].map((m) => [m.index, m.index + m[0].length]);
+}
 function countRedactionMarkers(s) {
-    return (s.match(REDACTION_MARKER_RE) ?? []).length;
+    return redactionMarkerSpans(s).length;
 }
 function safeEllipsisTruncate(s, max) {
     if (max < 1)

package/dist/engine/harness/agent-harness.d.ts

@@ -34,10 +34,11 @@ export interface HaltConsumption {
 export interface TrailingToolBatchOptions {
     readonly halt?: HaltRemainingDirective;
 }
-/** `prompt()` option: called when the prompt and next-turn queue's messages enter the loop transcript, before
- *  their frames are emitted and committed. Not called when a trailing-batch settlement ends the run first — the
- *  caller then still owns whatever the prompt was carrying. */
-export type PromptDeliveredCallback = () => void;
+/** `prompt()` option: the prompt's own receipt — called with the entry id once the prompt's user message is in the
+ *  session (its append returned), before its `message_end` is published. Not called when the append fails or when a
+ *  trailing-batch settlement ends the run before the prompt is delivered — the caller then still owns whatever the
+ *  prompt was carrying. */
+export type PromptCommittedCallback = (entryId: string) => void;
 /** An engine-minted message that TRAILS the prompt's human message in the same request (a user-attachment frame):
  *  minted from its content blocks, always an engine note, carrying its delivery record. */
 export interface TrailingMessageSeed {
@@ -173,6 +174,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     private lastPublishedSeat?;
     private readonly seatCutSources;
     private trailingBatchEndedOn?;
+    private promptReceipt?;
     private turnCutConsumed?;
     private readonly committedEntryIds;
     private readonly answerSources;
@@ -410,7 +412,7 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     prompt(text: string, options?: {
         images?: ImageContent[];
         settleUnansweredToolCalls?: TrailingToolBatchOptions;
-        onDelivered?: PromptDeliveredCallback;
+        onCommitted?: PromptCommittedCallback;
     } & UserMessageProvenance & PromptTrailing): Promise<AssistantMessage | undefined>;
     /** R2-③: an empty/whitespace-only injection with no images carries ZERO information — it
      *  must not mint a user frame (strict endpoints reject empty user content, and an empty follow-up would

package/dist/engine/harness/agent-harness.js

@@ -6,6 +6,7 @@ import { isCredentialHeaderName } from "../../core/secret-env.js";
 import { isProviderEchoShape } from "../../brain/errors.js";
 import { convertToLlm } from "./messages.js";
 import { readMember, thrownText } from "../../core/thrown-value.js";
+import { remoteWords } from "../../core/protocol-http-auth.js";
 import { AgentHarnessError, CompactionError, SessionError, SYNTHETIC_MESSAGE_MODEL, toError, } from "./types.js";
 const API_FAILURE_RECORD_MAX_CHARS = 2000;
 function createUserMessage(text, images, provenance) {
@@ -66,7 +67,7 @@ function createFailureMessage(model, error, aborted) {
         provider: model.provider,
         model: model.id,
         stopReason: aborted ? "aborted" : "error",
-        errorMessage: thrownText(error),
+        errorMessage: remoteWords(thrownText(error), []),
         timestamp: Date.now(),
         usage: {
             input: 0,
@@ -207,6 +208,7 @@ export class AgentHarness {
     lastPublishedSeat;
     seatCutSources = new WeakMap();
     trailingBatchEndedOn;
+    promptReceipt;
     turnCutConsumed;
     committedEntryIds = new WeakMap();
     answerSources = new WeakMap();
@@ -842,6 +844,11 @@ export class AgentHarness {
                 entryId = await this.session.appendMessage(event.message);
                 this.committedEntryIds.set(event.message, entryId);
                 this.settleInjectedFrame(event.message, entryId);
+                if (this.promptReceipt?.message === event.message) {
+                    const { commit } = this.promptReceipt;
+                    this.promptReceipt = undefined;
+                    commit(entryId);
+                }
                 if (entryId !== undefined && event.message.role === "toolResult" && typeof event.message.toolCallId === "string") {
                     try {
                         this.onFrameCommitted?.({ kind: "tool_result", toolCallId: event.message.toolCallId, content: event.message.content }, entryId);
@@ -908,6 +915,7 @@ export class AgentHarness {
     async executeTurn(turnState, text, options, abortController) {
         let activeTurnState = turnState;
         const userMessage = createUserMessage(text, options?.images, options);
+        this.promptReceipt = options?.onCommitted !== undefined ? { message: userMessage, commit: options.onCommitted } : undefined;
         const trailingMessages = (options?.trailing ?? []).map(createTrailingMessage);
         this.runHistory = new WeakSet(turnState.messages.filter((m) => m.role === "assistant"));
         const beforeResult = await this.emitHook({
@@ -967,7 +975,6 @@ export class AgentHarness {
                             },
                         }
                         : {}),
-                    ...(options?.onDelivered !== undefined ? { onPromptsDelivered: options.onDelivered } : {}),
                 });
             }
             catch (error) {
@@ -1002,6 +1009,8 @@ export class AgentHarness {
             finally {
                 this.runAbortController = undefined;
                 this.activeRun = undefined;
+                if (this.promptReceipt?.message === userMessage)
+                    this.promptReceipt = undefined;
             }
         }
     }

package/dist/engine/loop/agent-loop.d.ts

@@ -129,12 +129,9 @@ export interface TrailingToolBatchSettlement {
         aborted: boolean;
     }) => void;
 }
-/** The caller-facing seams of a prompt run beyond the prompts themselves: an optional trailing-batch
- *  settlement, and the moment the prompts enter the loop transcript, before their frames are emitted
- *  — delivery accounts precede the carrying messages' commits. */
+/** A prompt run's seam beyond its prompts (the trailing-batch settlement); a prompt is delivered at its `message_end`. */
 export interface RunAgentLoopSeams {
     settle?: TrailingToolBatchSettlement;
-    onPromptsDelivered?: () => void;
 }
 /** The last assistant message of `messages` when at least one of its tool calls has no tool result after it. */
 export declare function findUnansweredToolBatch(messages: readonly AgentMessage[]): AssistantMessage | undefined;

package/dist/engine/loop/agent-loop.js

@@ -3,8 +3,10 @@ import { truncateError } from "../../core/tool-errors.js";
 import { judgeToolNameMiss, mountedToolNames } from "../../core/tool-name-aliases.js";
 import { INTERRUPTED_BY_USER_FOR_TOOL_USE_MARKER, INTERRUPTED_BY_USER_MARKER, } from "../../core/session-reconcile.js";
 import { resolveAgentCoreStreamFn } from "./runtime-deps.js";
-import { isErrorLike, readMember, thrownMarksOf } from "../../core/thrown-value.js";
+import { isErrorLike, readMember, readOwnMembers, thrownMarksOf } from "../../core/thrown-value.js";
 import { egressThrownText, egressValue } from "../../core/untrusted-egress.js";
+import { remoteWords } from "../../core/protocol-http-auth.js";
+import { types } from "node:util";
 import { admitToolResultMedia } from "../../core/image-admission.js";
 function appendTextDeltaToAssistantMessage(message, contentIndex, delta) {
     const content = [...message.content];
@@ -75,7 +77,6 @@ export async function runAgentLoop(prompts, context, config, emit, signal, strea
         state.hasMoreToolCalls = true;
     state.context.messages.push(...delivered);
     state.newMessages.push(...delivered);
-    seams?.onPromptsDelivered?.();
     for (const prompt of delivered) {
         await emit({ type: "message_start", message: prompt });
         await emit({ type: "message_end", message: prompt });
@@ -756,7 +757,7 @@ async function streamAssistantResponse(context, config, signal, emit, streamFn,
                 break;
             case "done":
             case "error": {
-                const finalMessage = await response.result();
+                const finalMessage = receivedFinal(await response.result());
                 const cutAtSettle = signal?.aborted === true;
                 if (executor && (finalMessage.stopReason === "error" || finalMessage.stopReason === "aborted")) {
                     mergeBackAdmittedCalls(finalMessage, executor);
@@ -775,7 +776,7 @@ async function streamAssistantResponse(context, config, signal, emit, streamFn,
             }
         }
     }
-    const finalMessage = await response.result();
+    const finalMessage = receivedFinal(await response.result());
     const cutAtSettle = signal?.aborted === true;
     if (executor && (finalMessage.stopReason === "error" || finalMessage.stopReason === "aborted")) {
         mergeBackAdmittedCalls(finalMessage, executor);
@@ -1179,6 +1180,27 @@ async function harvestExecutorOnErrorFinal(executor, state, finalMessage, signal
     }
     return results;
 }
+function receivedFinal(message) {
+    const words = readMember(message, "errorMessage");
+    const minted = typeof words === "string" ? remoteWords(words, []) : undefined;
+    if (minted === words && readsTheSame(message, "errorMessage", words))
+        return message;
+    const copy = {};
+    for (const [key, value] of Object.entries(readOwnMembers(message) ?? {}))
+        if (key !== "errorMessage")
+            Object.defineProperty(copy, key, { value, enumerable: true, writable: true, configurable: true });
+    if (minted !== undefined)
+        copy.errorMessage = minted;
+    return copy;
+}
+function readsTheSame(o, key, value) {
+    if (types.isProxy(o))
+        return false;
+    const d = Reflect.getOwnPropertyDescriptor(o, key);
+    if (d === undefined)
+        return value === undefined && !(key in o);
+    return "value" in d && d.value === value;
+}
 function mergeBackAdmittedCalls(finalMessage, executor) {
     const admitted = executor.admittedToolCalls();
     if (admitted.length === 0)

package/dist/index.d.ts

@@ -63,6 +63,7 @@ export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerSt
 export { mcpStartupTimeoutMs } from "./core/mcp.js";
 export { McpConnectionPool } from "./core/mcp-connection-pool.js";
 export { probeMcpServers, type McpProbeResult } from "./core/mcp-probe.js";
+export { judgeMcpNames, describeMcpNameConflict, type McpNameConflict, type McpNameSetServer, type McpNameVerdict } from "./core/mcp-name-judge.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered, type McpLivenessState, type McpServerLiveness } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice, type McpInjectionDropReason, type McpInjectionDropFacts } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice, type AskUnresolvableFacts } from "./core/ask-unresolvable-notice.js";
@@ -126,7 +127,7 @@ export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY
 export { deploymentFaceClampNotice, resolveContainmentFace, type ContainmentFace, type ContainmentFaceInputs, type ContainmentFaceKind, type ContainmentFaceLayer, } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, type WriteProtectionVerdict, type WriteProtectionViewAbsence, type WriteProtectionJudgeContext, type WriteProtectionCompileOptions, type WriteProtectionCheck, WRITE_PROTECTION_TARGET_VIEWS, type WriteProtectionTargetView, type WriteProtectionMount, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, type CheckpointRow, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, type ActorAssertion, type PendingSteerEntry, type PendingSteerInput, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, type RiskDescriptor, type ProbeCause, type ProbeCauseOperands, type CheckpointStore, type CheckpointSummary, type Checkpoint, type CheckpointToken, type CheckpointGate, type CheckpointState, type SerializedCheckpointState, type CheckpointFaultMode, type PendingAction, type ResumeOutcome, type ResolvedOutcome, type ReopenReason, type ResolveExpectation, type TerminalClaimIntent, type TerminalClaimOutcome, type SafetyAxis, type RealApprovalGateBit, type ResourceLedger, type ResourceLimitReason, type PlatformLimitReason, type CheckpointRow, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreIncomplete, } from "./core/checkpoint-store.js";
 export { REOPEN_REASONS, RESUME_STARTUP_CAUSES, resumeStartupCauseOf, reopenReasonOf, type ResumeStartupCause } from "./core/resume-startup-cause.js";
 export { EXECUTION_OUTCOME_RECORD_WORDS, EXECUTION_RECORD_LEAVES_ROW_UNRECORDED, type ExecutionOutcomeRecordWord, type ExecutionRecordRowFacts, type ExecutionVerdict, ExecutionOutcomeConflictError, checkpointExecutionRecorded, executionRecordDisposition, sameExecutionRecord, executionVerdict, } from "./core/checkpoint-execution-record.js";
 export { PAUSE_REGISTRY, type GateKind, type PendingKind, type ResumeGate, isGateKind, resumeGateMatches, type CheckpointPause, type CheckpointFields, pauseOf, checkpointFrom, facetOf } from "./core/pause-registry.js";
@@ -144,6 +145,7 @@ export type { FileHistoryMintProof } from "./core/file-history-store.js";
 export { FILE_HISTORY_REFUSAL_CLASSES } from "./core/file-history-store.js";
 export type { FileHistoryRefusalClass } from "./core/file-history-store.js";
 export type { RewindFilesRequest, RewindFilesResult } from "./core/file-history-store.js";
+export type { CompactSessionRequest, CompactSessionResult } from "./core/auto-compaction.js";
 export { trackKeyOf as fileHistoryTrackKeyOf, resolveTrackKey as fileHistoryResolveTrackKey } from "./core/file-history-store.js";
 export { describeTrackKey as fileHistoryDescribeTrackKey, fileHistoryExportDigest, validateFileHistoryExport } from "./core/file-history-store.js";
 export type { FileHistoryStore, FileHistoryResult, FileHistoryTrackResult, FileHistoryError, FileHistoryKeyFamily, FileHistoryTrackKeyDescriptor, FileHistoryRestoreResult, FileHistoryDiffStats, FileHistoryExport, FileHistoryExportResult, FileBackupCapture, FileRestoreTarget, FileRestoreApplyOptions, FileRestoreApplyOutcome, FileHistoryTrackKeyResolution } from "./core/file-history-store.js";
@@ -173,6 +175,7 @@ export { effectivePathTargetOf, pathTargetBaseOf, type ToolPathBases, type PathT
 export { type BoundPathRule, type PathRuleSpec } from "./core/path-rule-binding.js";
 export { pathFamilyOf, isAbsoluteForFamily, pathIdentityOf, win32NamespaceScreen, WIN32_NAMESPACE_REFUSALS, type PathFamily, type PathIdentity, type PathIdentityReading, type Win32NamespaceRefusal } from "./tools/fs/safety.js";
 export { judgeShellRead, type ShellReadJudgeInput, type ShellReadJudgment, type ShellReadVerdict, type ShellReadStationSeat, type ShellReadAdmission, } from "./tools/fs/shell-read-check.js";
+export type { ReadLanding } from "./tools/fs/shell-read-identity.js";
 export { SHELL_READ_FINDINGS, SHELL_READ_SEATS, SHELL_READ_DECISION, SHELL_READ_FINDING_RANK, type ShellReadFinding, type ShellReadSeat, type ShellReadDisposition, type ShellReadBoundary, type ReadEstablishment, type EstablishedRead, type ReadFinding, } from "./tools/fs/shell-read-judge.js";
 export { type ReadCandidate, type ShellReadPlan, type ShellReadSegment } from "./tools/fs/shell-read-plan.js";
 export { TOOL_CONFORMANCE_VECTORS, type ToolConformanceVector } from "./core/tool-conformance.js";
@@ -180,7 +183,7 @@ export { applyMcpToolFaces, toolFaceProblem, APPROVAL_CARD_REQUIRED_KEYS, type M
 export { readToolFaces } from "./core/tool-face-reader.js";
 export { createStructuredProjector } from "./core/runner/tool-output-projection.js";
 export { parkedToolIdentity } from "./core/tool-roster.js";
-export { approvalObjectOf, judgeApprovalObject, APPROVAL_STATION_MEMBERS, APPROVAL_TARGET_ROLES, type ApprovalObject, type ApprovalTargets, type ApprovalStation, type ApprovalMember, type ApprovalMismatch, type ApprovalDisposition, type LiveApprovalObject } from "./core/approval-object.js";
+export { approvalObjectOf, judgeApprovalObject, APPROVAL_STATION_MEMBERS, APPROVAL_TARGET_ROLES, type ApprovalObject, type ApprovalTargets, type ApprovalTargetReads, type ApprovalStation, type ApprovalMember, type ApprovalMismatch, type ApprovalDisposition, type LiveApprovalObject } from "./core/approval-object.js";
 export { type ToolCallIdentity } from "./core/fs-write-gate-policy.js";
 export { type RuleFaceView, catalogRuleFaceView } from "./core/permission-rules.js";
 export { DURABLE_HISTORY_NAMES } from "./engine/compaction/utils.js";
@@ -191,8 +194,8 @@ export { type StoreFidelity } from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, type HumanInputSource, type HumanInputFrame, type HumanInputEvent, type HumanInputDelivery, } from "./core/human-input-projection.js";
 export { USER_ATTACHMENT_SEAT, USER_ATTACHMENT_KINDS, USER_ATTACHMENT_SUPPLIES, USER_ATTACHMENT_OUTCOMES, USER_ATTACHMENTS_MAX, USER_ATTACHMENT_LABEL_MAX, type UserAttachmentDeclaration, } from "./core/user-attachment.js";
 export type { HumanInputAttachment } from "./core/types.js";
-export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, type SemaTaskType, type SemaTaskStatus, type SemaTaskHandle, type ParkedClaimTicket, type TaskAccess, type UnifiedTaskOutput, type TaskRetrievalStatus, type StopSource, type RegisterMonitorInput, type MonitorTimers, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, type BackgroundShellHardKillReceipt, } from "./core/task-registry.js";
-export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, type MailboxStoreErrorCode, MAILBOX_TOMBSTONED_RECIPIENT_CODE, type MailboxAppendMessage, type MailboxPeerMeta, type MailboxPeerFromMode, type MailboxPeerRecordKind, type MailboxPeerNoticeMeta, type MailboxPeerNoticeState, MAILBOX_PEER_NOTICE_STATES, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, type MailboxCrossProcessVerdict, type MailboxAckResult, } from "./core/mailbox-store.js";
+export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, type SemaTaskType, type SemaTaskStatus, type SemaTaskHandle, type ParkedClaimTicket, type TaskAccess, type UnifiedTaskOutput, type TaskRetrievalStatus, type StopSource, type RegisterMonitorInput, type MonitorTimers, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, engineAgentName, type BackgroundShellHardKillReceipt, } from "./core/task-registry.js";
+export { InMemoryMailboxStore, type MailboxStore, type MailboxMessage, type MailboxLease, MailboxStoreError, type MailboxStoreErrorCode, MAILBOX_TOMBSTONED_RECIPIENT_CODE, type MailboxAppendMessage, type MailboxPeerMeta, type MailboxPeerFromMode, type MailboxPeerRecordKind, type MailboxPeerNoticeMeta, type MailboxPeerNoticeState, MAILBOX_PEER_NOTICE_STATES, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, type MailboxCrossProcessVerdict, type MailboxAckResult, type MailboxDecision, type MailboxDecisionOutcome, MAILBOX_DECISIONS, MAILBOX_INVALID_DECISION_MOVE_CODE, isMailboxDecision, isMailboxDecisionFinal, isMailboxDecisionDeliverable, mailboxDecisionEdgeAllowed, assertMailboxDecisionMove, moveMailboxDecision, readStoredMailboxDecision, } from "./core/mailbox-store.js";
 export { FileMailboxStore, type FileMailboxStoreOptions } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createMonitorTool, type MonitorToolOptions } from "./tools/monitor.js";
@@ -258,7 +261,7 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReachOutcome, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBase, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, PERSISTED_RULE_MATCHES, RULE_OFFER_KINDS, RULE_OFFER_BATCH_MEMBER_KINDS, UNCOVERED_SEGMENT_REASONS, EDITED_RULE_BREADTH_WARNING_CODES, RULE_ADD_ORIGINS, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, adjudicatePersistedToolRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReachOutcome, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBase, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, PERSISTED_RULE_MATCHES, RULE_OFFER_KINDS, RULE_OFFER_BATCH_MEMBER_KINDS, UNCOVERED_SEGMENT_REASONS, EDITED_RULE_BREADTH_WARNING_CODES, RULE_ADD_ORIGINS, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
 export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type AddResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, PERMISSION_RULES_LATER_GRAMMAR_CODE, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleTightenAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { readRuleOwner, sameRuleOwner, type RuleOwner, RULE_OWNER_KINDS, } from "./core/rule-owner.js";
 export { principalNameOf } from "./core/principal-name.js";
@@ -266,7 +269,7 @@ export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH,
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";
 export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, type ShellCommandShape, type ShellSegment, type ShellWord, type ShellRedirection, type ShellWrapperName, } from "./core/shell-run-candidates.js";
-export { readOnlyShellVerdict, type ReadOnlyShellVerdict } from "./core/read-only-shell.js";
+export { readOnlyShellVerdict, type ReadOnlyShellVerdict, type ReadOnlyShellOptions } from "./core/read-only-shell.js";
 export { READ_ONLY_FLAG_ARITIES, FLAG_VALUE_ACCEPTS, READ_ONLY_COMMAND_TABLE, READ_ONLY_BARE_PROGRAMS, READ_ONLY_GLOB_PROGRAMS, READ_ONLY_EXACT_FORMS, READ_ONLY_BARE_ONLY, FIND_ACTION_PRIMARIES, FIND_VALUE_PRIMARIES, FIND_NEWER_PRIMARY, READ_ONLY_ENV_NAMES, XARGS_READ_ONLY_TARGETS, type ReadOnlyFlagArity, type ReadOnlyCommandRow, } from "./core/read-only-shell-table.js";
 export { orgRuleVerdictFor, sameOrgPolicyContent, type OrgRuleVerdict, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
@@ -280,6 +283,7 @@ export type { ClassicEventMap, ClassicEventName, ObservedAnswer, EngineModRegist
 export { KERNEL_CONTRACT_VERSION, MOD_TIERS, MOD_SEATS, MOD_EVENT_SIDES, MOD_EVENT_TABLE, MODS_INVALID_CODE, MODS_REGISTRATION_REFUSED_CODE, type ModTier, type ModRegistrationTier, type ModSeat, type ModEventSide, type ModEventName, type ModEventRow, type ModStation, type ModRegistration, type ModUses, type On, type ModHandler, type ModHandlerOptions, type ModNext, type ModOrigin, type ModTraceEntry, type ModCaughtError, type ModDollarBase, type ModEventPayload, type ModMatcher, type ModAdmissionRecord, } from "./core/mods/kernel/index.js";
 export type { EngineDollar, ModelCompleteBlock, ToolCallAnswer } from "./core/mods/dollar.js";
 export { admitModChain } from "./core/mods/stations.js";
+export { CREDENTIAL_REF_KINDS, CREDENTIAL_REF_TRUST, CREDENTIAL_REF_TEXT_MAX, CREDENTIAL_REF_MAP_MAX, CREDENTIAL_REF_PROBLEM_REASONS, readCredentialRef, type CredentialRef, type CredentialRefKind, type CredentialRefRequestAdmission, type CredentialRefProblem, type CredentialRefProblemReason, type CredentialRefReading, } from "./primitives/index.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, MEMORY_PROJECT_KEY_ABSENT_REASONS, type MemoryProjectKeyAbsentReason, type MemoryProjectKey, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type ConsolidationWriteGate, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, type SessionMemoryStatus, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, CONSOLIDATION_WRITE_REFUSED_CODE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type ConsolidationWriteJudge, type ConsolidationWriteTarget, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, isOrgScopeKey, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { createConsolidationWriteJudge, deliverWriteRefusal, type ConsolidationWriteJudgeInput } from "./core/runner/memory-consolidation-write-judge.js";
@@ -294,6 +298,7 @@ export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDAT
 export { consolidateScope, advanceCursorAfterInline, type ConsolidateScopeDeps, type ConsolidateScopeOptions, } from "./core/consolidate-scope.js";
 export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, // the ONE arming reading (`memory.auto_consolidation.arming_has_one_resolver`) — the seat's absence is not "off"
 type MemoryConsolidationDriverDeps, } from "./core/runner/memory-consolidation-driver.js";
+export { teardownLegBudget } from "./core/runner/teardown-bounded.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
 export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, type PromptBlock, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
@@ -398,7 +403,7 @@ export { principalInboundLayers } from "./agents/cross-session-judge.js";
 export { PRINCIPAL_INBOX_UNMINTED_CAUSE } from "./agents/peer-session-drain.js";
 export { renderCrossSessionMessageFrame, renderCrossSessionNoticeLine } from "./core/task-notification.js";
 export { PEER_HELD_QUEUE_CAP, PEER_IDLE_SUBSCRIPTION_TTL_MS, PEER_IDLE_SUBSCRIBER_TABLE_CAP, PEER_IDLE_OUTSTANDING_CAP, PEER_IDLE_PRIORS_KEPT, PEER_IDLE_FIRE_DEBOUNCE_MS, PEER_IDLE_HELD_BACKOFF_MS, PEER_IDLE_LABEL_MAX, CROSS_SESSION_DIALOG_EXPIRY_VALUES, CROSS_SESSION_DIALOG_EXPIRY_DEFAULT, resolveCrossSessionDialogExpiry, PEER_HELD_REVIEW_CAUSES, PEER_DELIVERY_RECEIPT_STATES, isPeerDeliveryReceiptState, PEER_DROP_REASONS, peerRecipientSuffix, renderCrossSessionDeliveryNotice, describePeerDropReasons, renderCrossSessionDroppedNotice, PEER_IDLE_NOTICE_KINDS, isPeerIdleNoticeKind, PEER_IDLE_UNAVAILABLE_CAUSES, peerIdleNoticeLabel, formatPeerNoticeClock, renderCrossSessionIdleNotice, describePeerIdleSubscription, type CrossSessionDialogExpiry, type ResolvedCrossSessionDialogExpiry, type PeerDeliveryReceiptState, type PeerDropReason, type PeerIdleNoticeKind, type PeerIdleNoticeFields, } from "./agents/peer-notices.js";
-export { createPeerHeldQueue, peerHeldQueueFor, peerHeldQueueIfAny, peerHeldQueueKey, realPeerClock, type PeerInboundHoldCause, type PeerHeldEntry, type PeerHeldSettlement, type PeerHeldSettleReason, type PeerHeldSettleOutcome, type PeerClock, type PeerHeldQueueSink, type PeerHeldQueueConfig, type PeerHeldQueue, } from "./agents/peer-held-queue.js";
+export { createPeerHeldQueue, peerHeldQueueFor, peerHeldQueueIfAny, peerHeldQueueKey, realPeerClock, type PeerInboundHoldCause, type PeerHeldEntry, type PeerHeldSettlement, type PeerHeldSettleReason, type PeerHeldSettleOutcome, type PeerHoldOutcome, type PeerCardDecision, type PeerClock, type PeerHeldQueueSink, type PeerHeldQueueConfig, type PeerHeldQueue, } from "./agents/peer-held-queue.js";
 export { createPeerIdleTarget, createPeerIdleRequester, peerIdleMachineFor, peerIdleMachineIfAny, peerIdleMachineKey, type PeerIdleSubscriber, type PeerIdleTargetNotice, type PeerIdleTargetSink, type PeerIdleSubscribeOutcome, type PeerIdleTarget, type PeerIdleOutstanding, type PeerIdleRequesterSink, type PeerIdleRequester, type PeerIdleMachine, } from "./agents/peer-idle.js";
 export { routePeerDeliveryReceipt, routePeerDroppedReceipt, routePeerIdleNotice, type PeerNoticeRoute } from "./agents/peer-notice-route.js";
 export { type PeerAdmissionStage } from "./agents/peer-admission.js";

package/dist/index.js

@@ -49,6 +49,7 @@ export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
 export { mcpStartupTimeoutMs } from "./core/mcp.js";
 export { McpConnectionPool } from "./core/mcp-connection-pool.js";
 export { probeMcpServers } from "./core/mcp-probe.js";
+export { judgeMcpNames, describeMcpNameConflict } from "./core/mcp-name-judge.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classifyMcpFailure } from "./core/mcp-failure.js";
 export { MCP_INJECTION_DROP_REASONS, MCP_INJECTION_DROP_TEXT, mcpInjectionDroppedNotice } from "./core/mcp-injection-drop.js";
 export { askUnresolvableNotice } from "./core/ask-unresolvable-notice.js";
@@ -104,7 +105,7 @@ export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY
 export { deploymentFaceClampNotice, resolveContainmentFace, } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, WRITE_PROTECTION_TARGET_VIEWS, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
-export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreExecutionUndeclared, } from "./core/checkpoint-store.js";
+export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpointToken, checkpointVersionOf, CURRENT_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, debitLedger, remainingBudgetMicroUsd, remainingTokens, winnerFromOutcome, validatePendingSteer, readPendingSteerQueue, appendPendingSteer, MAX_PENDING_STEER_CHARS, MAX_PENDING_STEER_ENTRIES, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, PENDING_STEER_FROZEN_FIELDS, ACTOR_ASSERTION_FROZEN_FIELDS, MAX_ACTOR_FIELD_CHARS, MAX_STEER_INPUT_ID_CHARS, riskSeverity, buildRiskDescriptor, summarizeCheckpoint, realApprovalOrgFact, resolveCheckpointStore, checkpointStoreIncomplete, } from "./core/checkpoint-store.js";
 export { REOPEN_REASONS, RESUME_STARTUP_CAUSES, resumeStartupCauseOf, reopenReasonOf } from "./core/resume-startup-cause.js";
 export { EXECUTION_OUTCOME_RECORD_WORDS, EXECUTION_RECORD_LEAVES_ROW_UNRECORDED, ExecutionOutcomeConflictError, checkpointExecutionRecorded, executionRecordDisposition, sameExecutionRecord, executionVerdict, } from "./core/checkpoint-execution-record.js";
 export { PAUSE_REGISTRY, isGateKind, resumeGateMatches, pauseOf, checkpointFrom, facetOf } from "./core/pause-registry.js";
@@ -157,8 +158,8 @@ export {} from "./core/checkpoint-store.js";
 export {} from "./core/checkpoint-store.js";
 export { projectHumanInput, buildHumanInputEvent, } from "./core/human-input-projection.js";
 export { USER_ATTACHMENT_SEAT, USER_ATTACHMENT_KINDS, USER_ATTACHMENT_SUPPLIES, USER_ATTACHMENT_OUTCOMES, USER_ATTACHMENTS_MAX, USER_ATTACHMENT_LABEL_MAX, } from "./core/user-attachment.js";
-export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, } from "./core/task-registry.js";
-export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MAILBOX_PEER_NOTICE_STATES, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, } from "./core/mailbox-store.js";
+export { TaskRegistry, defaultTaskRegistry, createTaskOutputTool, createTaskStopTool, MONITOR_BATCH_WINDOW_MS, MONITOR_DEFAULT_TIMEOUT_MS, MONITOR_MAX_TIMEOUT_MS, MONITOR_MAX_BATCHES_PER_MINUTE, canAccessWorkflowRun, DURABLE_AGENT_HANDLE_RE, engineAgentName, } from "./core/task-registry.js";
+export { InMemoryMailboxStore, MailboxStoreError, MAILBOX_TOMBSTONED_RECIPIENT_CODE, MAILBOX_PEER_NOTICE_STATES, MAILBOX_PEER_FROM_MODES, MAILBOX_PEER_RECORD_KINDS, MAILBOX_INVALID_PEER_META_CODE, MAILBOX_CROSS_PROCESS_UNSAFE_CODE, readMailboxPeerMeta, mailboxCrossProcessMountVerdict, MAILBOX_DECISIONS, MAILBOX_INVALID_DECISION_MOVE_CODE, isMailboxDecision, isMailboxDecisionFinal, isMailboxDecisionDeliverable, mailboxDecisionEdgeAllowed, assertMailboxDecisionMove, moveMailboxDecision, readStoredMailboxDecision, } from "./core/mailbox-store.js";
 export { FileMailboxStore } from "./stores/file/mailbox-store.js";
 export { createFileTaskListStore } from "./stores/file/task-list-store.js";
 export { createMonitorTool } from "./tools/monitor.js";
@@ -196,7 +197,7 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isCoveringRuleName, ruleNameCovers, } from "./core/permission-rules.js";
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, PERSISTED_RULE_MATCHES, RULE_OFFER_KINDS, RULE_OFFER_BATCH_MEMBER_KINDS, UNCOVERED_SEGMENT_REASONS, EDITED_RULE_BREADTH_WARNING_CODES, RULE_ADD_ORIGINS, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, adjudicatePersistedToolRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, PERSISTED_RULE_MATCHES, RULE_OFFER_KINDS, RULE_OFFER_BATCH_MEMBER_KINDS, UNCOVERED_SEGMENT_REASONS, EDITED_RULE_BREADTH_WARNING_CODES, RULE_ADD_ORIGINS, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
 export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, PERMISSION_RULES_LATER_GRAMMAR_CODE, } from "./core/permission-rule-store.js";
 export { readRuleOwner, sameRuleOwner, RULE_OWNER_KINDS, } from "./core/rule-owner.js";
 export { principalNameOf } from "./core/principal-name.js";
@@ -216,6 +217,7 @@ export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdopt
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { KERNEL_CONTRACT_VERSION, MOD_TIERS, MOD_SEATS, MOD_EVENT_SIDES, MOD_EVENT_TABLE, MODS_INVALID_CODE, MODS_REGISTRATION_REFUSED_CODE, } from "./core/mods/kernel/index.js";
 export { admitModChain } from "./core/mods/stations.js";
+export { CREDENTIAL_REF_KINDS, CREDENTIAL_REF_TRUST, CREDENTIAL_REF_TEXT_MAX, CREDENTIAL_REF_MAP_MAX, CREDENTIAL_REF_PROBLEM_REASONS, readCredentialRef, } from "./primitives/index.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, MemoryProjectionError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, MEMORY_PROJECT_KEY_ABSENT_REASONS, } from "./core/memory.js";
 export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, writableRootOf, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, deriveShadowedSet, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, CONSOLIDATION_WRITE_REFUSED_CODE, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, isOrgScopeKey, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { createConsolidationWriteJudge, deliverWriteRefusal } from "./core/runner/memory-consolidation-write-judge.js";
@@ -229,6 +231,7 @@ export { encodeSurfacedKey, buildManifestText, validateSelectedIds, composeSelec
 export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDATION_BAND, DEFAULT_CONSOLIDATION_SEARCH_LIMIT, DEFAULT_CONSOLIDATION_MAX_NOTES, normalizeForExactMatch, } from "./core/runner/memory-consolidation.js";
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
 export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, } from "./core/runner/memory-consolidation-driver.js";
+export { teardownLegBudget } from "./core/runner/teardown-bounded.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
 export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";

package/dist/internal/harness.d.ts

@@ -11,7 +11,7 @@
  */
 export * from "./harness-types.js";
 export { AgentHarness } from "../engine/harness/agent-harness.js";
-export type { HaltConsumption, PromptDeliveredCallback, SeatCutSource, StopRequestSource, TrailingToolBatchOptions } from "../engine/harness/agent-harness.js";
+export type { HaltConsumption, PromptCommittedCallback, SeatCutSource, StopRequestSource, TrailingToolBatchOptions } from "../engine/harness/agent-harness.js";
 export { CompactionError, ExecutionError, FileError, isTimeCutCode, ok, err } from "../engine/harness/types.js";
 export { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, prepareCompaction, shouldCompact, summaryOutputBudgetTokens, } from "../engine/compaction/compaction.js";
 export { SKILL_RETENTION_PER_SKILL_MAX_CHARS, SKILL_RETENTION_TOTAL_MAX_CHARS, SKILL_RETENTION_TRUNCATION_MARKER, formatFileOperations, formatPersistedOutputRefs, readCompactionActiveTools, readRetainedInvokedSkills, renderInvokedSkillsRetention, } from "../engine/compaction/utils.js";
@@ -30,3 +30,4 @@ export type { AnnouncedAdvisorState, AnnouncedListingSnapshot, AnnouncedListingS
 export { normalizeGitAnnouncement } from "../engine/harness/types.js";
 export { gitFrameContextVisible } from "../engine/session/session.js";
 export { isSyntheticApiErrorMessage } from "../engine/harness/types.js";
+export { convertToLlm } from "../engine/harness/messages.js";

package/dist/internal/harness.js

@@ -17,3 +17,4 @@ export { SessionError } from "../engine/harness/types.js";
 export { normalizeGitAnnouncement } from "../engine/harness/types.js";
 export { gitFrameContextVisible } from "../engine/session/session.js";
 export { isSyntheticApiErrorMessage } from "../engine/harness/types.js";
+export { convertToLlm } from "../engine/harness/messages.js";

package/dist/primitives/credential-ref.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The credential reference: how a declaration names a credential without carrying one. This module says which references
+ * exist and whether a value is one, so the engine's door, an acceptance gate, a settings validator and an admin form read
+ * one closed set through one function. It resolves nothing, reads no environment and holds no state.
+ * Zero dependencies: no builtin, no import, so the same file runs in Node and in a browser.
+ */
+/** The closed set of kinds. A value whose `kind` is not in it is refused, never guessed at. */
+export declare const CREDENTIAL_REF_KINDS: readonly ["env", "vault", "handle", "assertion"];
+export type CredentialRefKind = (typeof CREDENTIAL_REF_KINDS)[number];
+/**
+ * A reference, by kind. `env` names variables of the resolver's environment (header name → variable name for an http
+ * peer, child variable → variable name for a stdio peer; the maps have no prototype); `vault` names a stored entry;
+ * `handle` is an opaque id the deployment minted; `assertion` names the audience a short-lived assertion is requested for.
+ */
+export type CredentialRef = {
+    readonly kind: "env";
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly env?: Readonly<Record<string, string>>;
+} | {
+    readonly kind: "vault";
+    readonly entry: string;
+} | {
+    readonly kind: "handle";
+    readonly id: string;
+} | {
+    readonly kind: "assertion";
+    readonly audience: string;
+};
+/** What an acceptance gate may do with a reference that arrives on the request surface (the deployment may write any kind). */
+export type CredentialRefRequestAdmission = "refused" | "own_entry";
+type TrustRow = {
+    readonly request: CredentialRefRequestAdmission;
+};
+/**
+ * Where each kind may come from. `refused`: a request surface may not carry it (an environment name would read any
+ * variable of the resolver's process, a handle names someone else's credential, an assertion is minted by the deployment);
+ * `own_entry`: only for an entry that belongs to the submitting principal. A row per kind and nothing else (no prototype);
+ * look a kind up only after `readCredentialRef` accepted the value. A shape for a gate to read; it authenticates nothing.
+ */
+export declare const CREDENTIAL_REF_TRUST: Readonly<Record<CredentialRefKind, TrustRow>>;
+/** The longest text member (entry, id, audience, header name, variable name) a reference may carry, in UTF-16 code units. */
+export declare const CREDENTIAL_REF_TEXT_MAX = 2048;
+/** The most entries one name map (`headers`, `env`) of an `env` reference may hold. */
+export declare const CREDENTIAL_REF_MAP_MAX = 64;
+/** Why a value is not a reference; each reason is its own exit. */
+export declare const CREDENTIAL_REF_PROBLEM_REASONS: readonly ["not_a_record", "unknown_kind", "missing_field", "extra_field", "bad_value"];
+export type CredentialRefProblemReason = (typeof CREDENTIAL_REF_PROBLEM_REASONS)[number];
+/**
+ * The first fault found, in this order: not an ordinary record; `kind` missing, not text or outside the set; a member the
+ * kind does not have; a member it needs (for `env`, one of `headers` and `env`, written `headers|env`); a member of the
+ * wrong form. A `kind` or `field` read off the caller's value is untrusted text, cut to 64 characters with unsafe
+ * characters replaced; fence it before rendering it where markup is interpreted.
+ */
+export type CredentialRefProblem = {
+    readonly reason: "not_a_record";
+} | {
+    readonly reason: "unknown_kind";
+    readonly kind: string;
+} | {
+    readonly reason: "missing_field";
+    readonly kind?: CredentialRefKind;
+    readonly field: string;
+} | {
+    readonly reason: "extra_field";
+    readonly kind: CredentialRefKind;
+    readonly field: string;
+} | {
+    readonly reason: "bad_value";
+    readonly kind?: CredentialRefKind;
+    readonly field: string;
+};
+export type CredentialRefReading = {
+    readonly ok: true;
+    readonly ref: CredentialRef;
+} | {
+    readonly ok: false;
+    readonly problem: CredentialRefProblem;
+};
+/**
+ * The one reader of a credential reference: a fresh frozen copy that the caller's later writes cannot reach (forward the
+ * copy, never the value read), or the first problem. Nothing inside it throws: a value whose members cannot be read (a
+ * revoked or throwing Proxy) is `not_a_record`, or the `bad_value` of the map that holds it. A getter is refused and never
+ * called, no prototype is read for a member, and a Proxy's own traps (on the value, its maps or its prototype) are the
+ * caller's code and run as for any property read. Text is compared as written: nothing is normalised, and visually
+ * confusable text is not judged. With no stack left a valid value may be refused (any reason), never an invalid one
+ * accepted, and the call itself may throw a `RangeError` before it is entered.
+ */
+export declare function readCredentialRef(value: unknown): CredentialRefReading;
+export {};