@theokit/sdk 5.12.0 → 5.13.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { T as TheokitAgentError, E as ErrorMetadata } from './errors-base-B5g01neU.js';
 export { a as ErrorCode } from './errors-base-B5g01neU.js';
-import { A as AgentOptions, L as LocalOptions, S as SystemPromptResolver, C as CloudOptions, M as MemorySettings, a as AgentDefinition, b as SkillsSettings, c as ListAgentsOptions, d as ListResult, e as SDKAgentInfo, G as GetAgentOptions, f as ListRunsOptions, g as GetRunOptions, h as AgentOperationOptions, i as AgentDescription, P as Plugin$1, j as ProviderProfile, I as InlineSkill, k as Skill, B as BudgetTracker, l as MemoryProvider, m as PreToolCallDecision } from './agent-CVzDy_Oj.js';
-export { n as ActiveMemoryPassArgs, o as ActiveMemoryPassResult, p as AgentSubagentDescription, q as AgentToolDescription, r as BudgetCheck, s as BudgetTotal, t as BudgetUsageEvent, u as BuiltinToolName, v as CloudEnv, w as CloudRepo, x as CompatSource, y as CompatSourceAdapter, z as CompatSurface, D as CreateSkillSpec, H as HookApprovalGate, E as HookApprovalRequest, F as HookName, J as LlmCallContext, K as MemoryProviderAgentRef, N as MemoryProviderFactory, O as MemoryProviderHandle, Q as MemoryProviderInitOptions, R as PluginContext, T as PluginHookDisposer, U as PostAssistantReplyContext, V as PostToolCallContext, W as PreToolCallContext, X as PreUserSendContext, Y as PreUserSendResult, Z as ProviderTransform, _ as ProviderTransformContext, $ as RecordSessionSummaryArgs, a0 as SessionLifecycleContext, a1 as SessionRecord, a2 as SessionStore, a3 as SettingSource, a4 as Skill, a5 as SkillsResolver, a6 as SkillsResolverContext, a7 as SystemPromptContext, a8 as SystemPromptMemoryFact, a9 as TelemetrySettings, aa as ToolCallSummary, ab as ToolContext, ac as ToolResultTransformContext, ad as TransformContext } from './agent-CVzDy_Oj.js';
+import { A as AgentOptions, L as LocalOptions, B as BuiltinToolName, M as MemorySettings, S as SystemPromptResolver, C as CloudOptions, a as AgentDefinition, b as SkillsSettings, c as ListAgentsOptions, d as ListResult, e as SDKAgentInfo, G as GetAgentOptions, f as ListRunsOptions, g as GetRunOptions, h as AgentOperationOptions, i as AgentDescription, P as Plugin$1, j as ProviderProfile, I as InlineSkill, k as Skill, l as BudgetTracker, m as MemoryProvider, n as PreToolCallDecision } from './agent-DSMuwADp.js';
+export { o as ActiveMemoryPassArgs, p as ActiveMemoryPassResult, q as AgentSubagentDescription, r as AgentToolDescription, s as BudgetCheck, t as BudgetTotal, u as BudgetUsageEvent, v as CloudEnv, w as CloudRepo, x as CompatSource, y as CompatSourceAdapter, z as CompatSurface, D as CreateSkillSpec, H as HookApprovalGate, E as HookApprovalRequest, F as HookName, J as LlmCallContext, K as MemoryProviderAgentRef, N as MemoryProviderFactory, O as MemoryProviderHandle, Q as MemoryProviderInitOptions, R as PluginContext, T as PluginHookDisposer, U as PostAssistantReplyContext, V as PostToolCallContext, W as PreToolCallContext, X as PreUserSendContext, Y as PreUserSendResult, Z as ProviderTransform, _ as ProviderTransformContext, $ as RecordSessionSummaryArgs, a0 as SessionLifecycleContext, a1 as SessionRecord, a2 as SessionStore, a3 as SettingSource, a4 as Skill, a5 as SkillsResolver, a6 as SkillsResolverContext, a7 as SystemPromptContext, a8 as SystemPromptMemoryFact, a9 as TelemetrySettings, aa as ToolCallSummary, ab as ToolContext, ac as ToolResultTransformContext, ad as TransformContext } from './agent-DSMuwADp.js';
 import { ab as RunEvent, v as CostBreakdown, a_ as TokenUsage, R as RunResult, P as ProviderRoutingSettings, S as SDKAgent, M as McpServerConfig, C as ContextSettings, a as PluginsSettings, b as Run, c as Processor, J as JudgeResult, G as GoalOptions, d as GoalEvent, e as GoalResult, f as MemoryId, g as RunEventSink$1, h as SDKProvider, i as SDKMessage } from './sdk-agent-CTOJlWA_.js';
 export { A as AgentConversationTurn, j as AgentMemory, k as AgentOperation, l as AssistantMessage, m as CompletionCheck, n as CompletionCheckResult, o as ContextBudget, p as ContextManagerKind, q as ContextSnapshot, r as ContextSource, s as ContextSourceStatus, t as ConversationStep, u as ConversationTurn, v as CostBreakdown, w as CostSource, x as CostStatus, D as DoomLoopThresholds, E as EnvPolicy, F as ForkOptions, y as ForkResult, z as GenerateOptions, B as GenerateRunResult, I as InputProcessorContext, H as InteractionUpdate, K as InvalidateCacheOptions, L as McpAuthConfig, N as McpHttpServerConfig, O as McpOAuthConfig, Q as McpStdioServerConfig, T as MemoryAdapter, U as MemoryAdapterCapabilities, V as MemoryContext, W as MemoryFact, X as MemoryRevision, Y as MemoryToolSchema, Z as MemoryTurnMessage, _ as MessageOrigin, $ as OutputProcessorContext, a0 as PartialToolCallUpdate, a1 as PersonalityPreset, a2 as ProcessorControls, a3 as ProcessorTripwire, a4 as ProcessorViolation, a5 as ProviderCapability, a6 as ProviderRoute, a7 as ResolvedProviderRoute, a8 as RunCompactBoundaryEvent, a9 as RunCompletionCheckEvent, aa as RunErrorDetail, ab as RunEvent, ac as RunGitInfo, ad as RunMemoryDegradedEvent, ae as RunPermissionDeniedEvent, af as RunRateLimitEvent, ag as RunStatus, ah as RunTaskCompletedEvent, ai as RunTaskStartedEvent, aj as RunTaskUpdatedEvent, ak as RunTimelineEvent, al as RunToCompletionOptions, am as RunToCompletionResult, an as RunToolProgressEvent, ao as RunTripwireEvent, ap as RunUntilIterator, aq as SDKAgentPlugins, ar as SDKAgentSkillDetail, as as SDKAgentSkills, at as SDKArtifact, au as SDKAssistantMessage, av as SDKContextManager, aw as SDKImage, ax as SDKImageDimension, ay as SDKObjectDelta, az as SDKPluginMetadata, aA as SDKProvidersManager, aB as SDKRequestMessage, aC as SDKStatusMessage, aD as SDKSystemMessage, aE as SDKTaskMessage, aF as SDKThinkingMessage, aG as SDKToolUseMessage, aH as SDKUserMessage, aI as SDKUserMessageEvent, aJ as SendOptions, aK as ShellCommand, aL as ShellConversationTurn, aM as ShellOutput, aN as ShellOutputDeltaUpdate, aO as StepCompletedUpdate, aP as StepStartedUpdate, aQ as StreamToCompletionResult, aR as SummaryCompletedUpdate, aS as SummaryStartedUpdate, aT as SummaryUpdate, aU as SystemPromptSkillRef, aV as TextDeltaUpdate, aW as ThinkingCompletedUpdate, aX as ThinkingDeltaUpdate, aY as ThinkingMessage, aZ as TokenDeltaUpdate, a_ as TokenUsage, a$ as ToolCall, b0 as ToolCallCompletedUpdate, b1 as ToolCallStartedUpdate, b2 as ToolResult, b3 as ToolResultGuardOptions, b4 as ToolUseBlock, b5 as TurnEndedUpdate, b6 as UserMessage, b7 as UserMessageAppendedUpdate, b8 as Verdict } from './sdk-agent-CTOJlWA_.js';
 import * as zod from 'zod';
@@ -10,7 +10,7 @@ import { S as StructuredOutputError, B as BudgetOptions, a as BudgetHandle, b as
 export { A as AgentDisposedError, c as AgentRunError, d as AgentRunErrorCode, e as AuthenticationError, f as BudgetExceedEvent, g as BudgetExceededError, h as BudgetLimit, i as BudgetMode, j as BudgetScope, k as BudgetThresholdEvent, l as BudgetWindow, C as ConfigurationError, I as IntegrationNotConnectedError, m as InvalidTaskIdError, M as MemoryAdapterError, n as MemoryAdapterErrorCode, N as NetworkError, R as RateLimitError, T as TaskNotFoundError, U as UnknownAgentError, o as UnsupportedBudgetOperationError, p as UnsupportedRunOperationError, q as UnsupportedTaskOperationError, r as isTransientError } from './errors-Pf22PJJ-.js';
 import { M as ModelSelection, C as CustomTool, T as ToolResultContentBlock, P as PermissionMode } from './agent-prims-CZyxfCmS.js';
 export { I as ImageBlock, a as ModelParameterValue, R as RunOperation, b as TextBlock, c as ToolContextMessage } from './agent-prims-CZyxfCmS.js';
-export { C as Cron, a as CronCreateOptions, b as CronGetOptions, c as CronJob, d as CronJobStatus, e as CronListOptions, f as CronOperationOptions, g as CronRunOptions, h as CronRuntime, i as CronSchedulerStatus, j as CronStartOptions } from './cron-CHn-F0fC.js';
+export { C as Cron, a as CronCreateOptions, b as CronGetOptions, c as CronJob, d as CronJobStatus, e as CronListOptions, f as CronOperationOptions, g as CronRunOptions, h as CronRuntime, i as CronSchedulerStatus, j as CronStartOptions } from './cron-DdKzwJqK.js';
 import { StepResult } from './workflow.js';
 export { Workflow, agentStep, fn } from './workflow.js';
 
@@ -242,6 +242,19 @@ interface StreamObjectOptions<T extends ZodType> {
      * when the right env key is set under a different provider name.
      */
     providers?: ProviderRoutingSettings;
+    /**
+     * Builtin tools removed from the transient agent's catalogue, forwarded to
+     * {@link AgentOptions.withheldBuiltinTools}. Absent ⇒ unchanged default: the agent holds
+     * `shell`. Pass `["shell"]` for a step that must only produce JSON. The `output` tool is
+     * never withheld.
+     */
+    withheldBuiltinTools?: readonly BuiltinToolName[];
+    /**
+     * Memory settings for the transient agent, forwarded to {@link AgentOptions.memory}.
+     * Absent ⇒ unchanged default (a session transcript is written). Pass `{ enabled: false }`
+     * for a step that must leave no transcript.
+     */
+    memory?: MemorySettings;
 }
 /**
  * Recursive partial — `T` where every nested field becomes optional.
@@ -340,6 +353,19 @@ interface GenerateObjectOptions<T extends ZodType> {
      *   to raw.
      */
     errorStrategy?: "throw" | "return-partial" | "return-raw";
+    /**
+     * Builtin tools removed from every transient agent's catalogue (the reasoning-phase agent of
+     * `structuringModel` included), forwarded to {@link AgentOptions.withheldBuiltinTools}.
+     * Absent ⇒ unchanged default: the agent holds `shell`. Pass `["shell"]` for a step that must
+     * only produce JSON. The `output` tool is never withheld.
+     */
+    withheldBuiltinTools?: readonly BuiltinToolName[];
+    /**
+     * Memory settings for every transient agent of the call, forwarded to {@link AgentOptions.memory}.
+     * Absent ⇒ unchanged default (a session transcript is written). Pass `{ enabled: false }`
+     * for a step that must leave no transcript.
+     */
+    memory?: MemorySettings;
 }
 /**
  * Successful return from {@link Agent.generateObject}.
@@ -4492,4 +4518,4 @@ interface WiringRecordInput<K extends string> {
  */
 declare function recordWiring<K extends string>(input: WiringRecordInput<K>): Readonly<Record<K, WiredEntity>>;
 
-export { Agent, AgentBuilder, type AgentBuilderDeps, AgentDefinition, type AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type ApprovalDecision, type ApprovalInput, type ApprovalMode, type ApprovalOutcome, type ApprovalReason, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, type BlastRadiusDecision, type BlastRadiusInput, type BlastRadiusOutcome, type BlastRadiusReason, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, type BudgetTracker, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, type CredentialInput, type CredentialReport, type CustomTool, type DeclaredAction, type DeclaredLayer, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, type EffectiveToolCatalog, type EnvOptOut, type EnvReachabilityAudit, type EnvReachabilityInput, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, type JudgeResult, type KeepReason, type KeptArtifact, LayerOrderError, type LayerValues, ListAgentsOptions, ListResult, ListRunsOptions, type LiveAgentRegistry, LiveSessionError, type LiveSessionReason, LocalOptions, type ManagedSettings, McpServerConfig, Memory, MemoryId, type MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, type OTelSpan, type PermissionAction, PermissionEngine, type PermissionEngineOptions, type PermissionFloorContext, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, type PermissionRule, type PermissionRuleSet, Plugin, PluginsSettings, PreToolCallDecision, type Processor, Provider, type ProviderProfile, ProviderRoutingSettings, type ReadSessionMessagesOptions, type ReapPlan, type ReapPlanInput, type ReapableArtifact, type RetentionPolicy, RetentionPolicyError, Run, RunEventSink$1 as RunEventSink, RunResult, type SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, type TelemetryHandle, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, type ToolResultContentBlock, type TrustLevel, type TrustPosture, type TrustPostureInput, type TrustSource, UngatedCapabilityError, UnicodeNormalizer, type UnicodeNormalizerOptions, type UnresolvedToolSource, UsageAccumulator, type WiredEntity, type WiringRecordInput, type WithBlastRadius, applyMode, applySecurityFloor, auditEnvReachability, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, createTokenLimiter, createUnicodeNormalizer, decideApproval, describeAction, describeCredential, effectiveToolNames, emitRunEvent, estimateTokens, evaluateBlastRadius, extractRawId, foldLayers, getPricingEntry, guardSessionDestruction, inferApiMode, isInside, isValidTaskId, loadProjectEnv, managedSettingsPathFor, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, parsePermissionRules, permissionFloorReason, planReaping, preflightCheck, readManagedSettings, readSessionMessages, recordWiring, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, verifyLayerOrdering, withBlastRadius, withCwdMutex };
+export { Agent, AgentBuilder, type AgentBuilderDeps, AgentDefinition, type AgentDescription, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type ApprovalDecision, type ApprovalInput, type ApprovalMode, type ApprovalOutcome, type ApprovalReason, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, type BlastRadiusDecision, type BlastRadiusInput, type BlastRadiusOutcome, type BlastRadiusReason, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, type BudgetTracker, BuiltinToolName, CloudOptions, ContextSettings, type CounterBudgetTrackerOptions, type CredentialInput, type CredentialReport, type CustomTool, type DeclaredAction, type DeclaredLayer, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DiagnosticsSink, type DreamingSweepOptions, type DreamingSweepResult, type EffectiveToolCatalog, type EnvOptOut, type EnvReachabilityAudit, type EnvReachabilityInput, ErrorMetadata, EventBus, type EvictReason, GOAL_CONTINUATION_MARKER, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, GoalEvent, type GoalLoopAgent, GoalOptions, GoalResult, InlineSkill, JobQueue, type JobQueueOptions, JudgeCredentialError, type JudgeResult, type KeepReason, type KeptArtifact, LayerOrderError, type LayerValues, ListAgentsOptions, ListResult, ListRunsOptions, type LiveAgentRegistry, LiveSessionError, type LiveSessionReason, LocalOptions, type ManagedSettings, McpServerConfig, Memory, MemoryId, type MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, type OTelSpan, type PermissionAction, PermissionEngine, type PermissionEngineOptions, type PermissionFloorContext, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, type PermissionRule, type PermissionRuleSet, Plugin, PluginsSettings, PreToolCallDecision, type Processor, Provider, type ProviderProfile, ProviderRoutingSettings, type ReadSessionMessagesOptions, type ReapPlan, type ReapPlanInput, type ReapableArtifact, type RetentionPolicy, RetentionPolicyError, Run, RunEventSink$1 as RunEventSink, RunResult, type SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, SOVEREIGN_ENV_KEYS, Security, type SecurityFloorInput, type SessionMessage, type SessionMessagePart, type SessionScope, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, type SovereignEnvKey, Squad, type SquadOptions, type SquadRun, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, type TelemetryHandle, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, type ToolResultContentBlock, type TrustLevel, type TrustPosture, type TrustPostureInput, type TrustSource, UngatedCapabilityError, UnicodeNormalizer, type UnicodeNormalizerOptions, type UnresolvedToolSource, UsageAccumulator, type WiredEntity, type WiringRecordInput, type WithBlastRadius, applyMode, applySecurityFloor, auditEnvReachability, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, createTokenLimiter, createUnicodeNormalizer, decideApproval, describeAction, describeCredential, effectiveToolNames, emitRunEvent, estimateTokens, evaluateBlastRadius, extractRawId, foldLayers, getPricingEntry, guardSessionDestruction, inferApiMode, isInside, isValidTaskId, loadProjectEnv, managedSettingsPathFor, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, parsePermissionRules, permissionFloorReason, planReaping, preflightCheck, readManagedSettings, readSessionMessages, recordWiring, resolveTrustPosture, runGoalLoop, scopedConversationId, sessionScopePrefix, setDiagnosticsSink, toShareGptTrajectory, verifyLayerOrdering, withBlastRadius, withCwdMutex };

package/dist/index.js

@@ -1,19 +1,19 @@
-export { StreamObjectError } from './chunk-XRPMZ7TO.js';
+export { StreamObjectError } from './chunk-CYWOJA6B.js';
 export { GOAL_CONTINUATION_MARKER } from './chunk-PY2RQOA7.js';
 export { JudgeCredentialError } from './chunk-XZKIAENA.js';
 import { migrateSqliteToLance, appendDiaryEntry } from './chunk-MSEL5E5P.js';
-export { GenerateObjectError } from './chunk-VVGFZQZC.js';
-import './chunk-AQW54OWQ.js';
-import { Workflow, agentStep } from './chunk-ZLFFDPXC.js';
-export { Workflow, agentStep, fn } from './chunk-ZLFFDPXC.js';
-import './chunk-BO3PV3OP.js';
+export { GenerateObjectError } from './chunk-3LMVJTNJ.js';
+import './chunk-DFBWYETS.js';
+import { Workflow, agentStep } from './chunk-73IITAF7.js';
+export { Workflow, agentStep, fn } from './chunk-73IITAF7.js';
+import './chunk-TDED5XES.js';
 import './chunk-HY66GLM6.js';
-export { Cron } from './chunk-NJBJ3CUG.js';
-import { MEMORY_EMBEDDING_ADAPTERS, resolveSessionDir, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-BJ7BPLQK.js';
-export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry, managedSettingsPathFor, readManagedSettings } from './chunk-BJ7BPLQK.js';
+export { Cron } from './chunk-ZTP6ZACR.js';
+import { MEMORY_EMBEDDING_ADAPTERS, resolveSessionDir, DEFAULT_AGENTIC_MODEL_ID, Agent } from './chunk-JX4LB6XO.js';
+export { Agent, AgentBuilder, Tool, ToolError, UsageAccumulator, computeCost, getPricingEntry, managedSettingsPathFor, readManagedSettings } from './chunk-JX4LB6XO.js';
 import { configure, submit, list, get, cancel, subscribe } from './chunk-HWMGR3HA.js';
 export { emitRunEvent } from './chunk-HWMGR3HA.js';
-import './chunk-4GUFNDZR.js';
+import './chunk-XOYNB3YN.js';
 import './chunk-K2BQQ445.js';
 import './chunk-2C24NSNV.js';
 import './chunk-HJ2LV464.js';
@@ -23,8 +23,8 @@ import './chunk-H73MEMQB.js';
 import './chunk-QK2ERTO3.js';
 import { resolveMemoryRoot, readFactsFromMarkdown } from './chunk-DF77RBF4.js';
 import { FsSessionStore } from './chunk-AB4OPJLD.js';
-import { discoverProviderPlugins, shouldUseFixtureMode, isFixtureApiKey, httpRequest, mapOllamaTransportError, readErrorResponseBody, mapOllamaHttpError } from './chunk-XJ4C4NFX.js';
-export { inferApiMode, normalizeUsage } from './chunk-XJ4C4NFX.js';
+import { discoverProviderPlugins, shouldUseFixtureMode, isFixtureApiKey, httpRequest, mapOllamaTransportError, readErrorResponseBody, mapOllamaHttpError } from './chunk-2PRGRYEQ.js';
+export { inferApiMode, normalizeUsage } from './chunk-2PRGRYEQ.js';
 import './chunk-5AR6O7GW.js';
 import './chunk-2XC6KDJM.js';
 import './chunk-ZJAYFSVI.js';
@@ -1929,7 +1929,7 @@ function isBuiltAgent(m) {
   return typeof m.send === "function";
 }
 async function materialize(def, index) {
-  const { Agent: Agent2 } = await import('./agent-IG7BP6GN.js');
+  const { Agent: Agent2 } = await import('./agent-5DSDDH7K.js');
   return Agent2.create({
     // `AgentDefinition.model` admits the sentinel `'inherit'`, which is not a model id. Inheriting
     // here means "declare nothing and let the default apply" — forwarding the literal would create

package/dist/{inject-session-THABTKJY.js → inject-session-75L3NCNL.js}

@@ -1,4 +1,4 @@
-import { enqueueSessionWrite } from './chunk-4GUFNDZR.js';
+import { enqueueSessionWrite } from './chunk-XOYNB3YN.js';
 import { invalidateSessionCache } from './chunk-2XC6KDJM.js';
 import './chunk-AGO5S5WD.js';
 import { SessionTranscript } from './chunk-XESYJ4JC.js';
@@ -23,5 +23,5 @@ async function injectSessionTurn(opts) {
 }
 
 export { injectSessionTurn };
-//# sourceMappingURL=inject-session-THABTKJY.js.map
-//# sourceMappingURL=inject-session-THABTKJY.js.map
+//# sourceMappingURL=inject-session-75L3NCNL.js.map
+//# sourceMappingURL=inject-session-75L3NCNL.js.map

package/dist/{inject-session-THABTKJY.js.map → inject-session-75L3NCNL.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/session/inject-session.ts"],"names":[],"mappings":";;;;;;;;;AAWA,eAAsB,kBAAkB,IAAA,EAMtB;AAChB,EAAA,MAAM,oBAAoB,IAAA,CAAK,GAAA,CAAI,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,YAAY;AACpE,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,MAAM,WAAA,CAAY,IAAA,CAAK,IAAI,OAAO,CAAA;AAC3D,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,WAAA,CAAY,KAAA,EAAO;AAAA,MACtD,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,KAAA,EAAO,IAAA,CAAK,GAAA,CAAI,KAAA,IAAS;AAAA,KAC1B,CAAA;AACD,IAAA,UAAA,CAAW,cAAA,CAAe,KAAK,QAAQ,CAAA;AACvC,IAAA,UAAA,CAAW,mBAAA,CAAoB,EAAE,IAAA,EAAM,IAAA,CAAK,eAAe,CAAA;AAC3D,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,KAAA,CAAM,MAAM,CAAC,CAAA;AACzF,IAAA,sBAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,EACvD,CAAC,CAAA;AACH","file":"inject-session-THABTKJY.js","sourcesContent":["/**\n * M51 (agent-builder) — inject a SYNTHETIC user+assistant pair into a session's persisted transcript\n * WITHOUT running an LLM turn. This is the Codex review-exit mechanism (`exit_success.xml` appended to\n * the parent thread history so follow-ups like \"fix finding 2\" work): the pair chains onto the DAG\n * leaf (M50 pattern) and the in-memory cache is invalidated so the NEXT send re-hydrates with it.\n */\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { SessionTranscript } from \"../persistence/session-transcript.js\";\nimport { enqueueSessionWrite, invalidateSessionCache } from \"./agent-session.js\";\nimport type { CompactLocation } from \"./compact-session.js\";\n\nexport async function injectSessionTurn(opts: {\n  store: SessionStore;\n  loc: CompactLocation;\n  sessionId: string;\n  userText: string;\n  assistantText: string;\n}): Promise<void> {\n  await enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {\n    const prior = await opts.store.readRecords(opts.loc.agentId);\n    const transcript = SessionTranscript.fromRecords(prior, {\n      cwd: opts.loc.cwd,\n      sessionId: opts.sessionId,\n      model: opts.loc.model ?? \"unknown\",\n    });\n    transcript.appendUserTurn(opts.userText);\n    transcript.appendAssistantTurn({ text: opts.assistantText });\n    await opts.store.appendRecords(opts.loc.agentId, transcript.records().slice(prior.length));\n    invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);\n  });\n}\n"]}
+{"version":3,"sources":["../src/internal/session/inject-session.ts"],"names":[],"mappings":";;;;;;;;;AAWA,eAAsB,kBAAkB,IAAA,EAMtB;AAChB,EAAA,MAAM,oBAAoB,IAAA,CAAK,GAAA,CAAI,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,YAAY;AACpE,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,MAAM,WAAA,CAAY,IAAA,CAAK,IAAI,OAAO,CAAA;AAC3D,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,WAAA,CAAY,KAAA,EAAO;AAAA,MACtD,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,KAAA,EAAO,IAAA,CAAK,GAAA,CAAI,KAAA,IAAS;AAAA,KAC1B,CAAA;AACD,IAAA,UAAA,CAAW,cAAA,CAAe,KAAK,QAAQ,CAAA;AACvC,IAAA,UAAA,CAAW,mBAAA,CAAoB,EAAE,IAAA,EAAM,IAAA,CAAK,eAAe,CAAA;AAC3D,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,KAAA,CAAM,MAAM,CAAC,CAAA;AACzF,IAAA,sBAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,EACvD,CAAC,CAAA;AACH","file":"inject-session-75L3NCNL.js","sourcesContent":["/**\n * M51 (agent-builder) — inject a SYNTHETIC user+assistant pair into a session's persisted transcript\n * WITHOUT running an LLM turn. This is the Codex review-exit mechanism (`exit_success.xml` appended to\n * the parent thread history so follow-ups like \"fix finding 2\" work): the pair chains onto the DAG\n * leaf (M50 pattern) and the in-memory cache is invalidated so the NEXT send re-hydrates with it.\n */\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { SessionTranscript } from \"../persistence/session-transcript.js\";\nimport { enqueueSessionWrite, invalidateSessionCache } from \"./agent-session.js\";\nimport type { CompactLocation } from \"./compact-session.js\";\n\nexport async function injectSessionTurn(opts: {\n  store: SessionStore;\n  loc: CompactLocation;\n  sessionId: string;\n  userText: string;\n  assistantText: string;\n}): Promise<void> {\n  await enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {\n    const prior = await opts.store.readRecords(opts.loc.agentId);\n    const transcript = SessionTranscript.fromRecords(prior, {\n      cwd: opts.loc.cwd,\n      sessionId: opts.sessionId,\n      model: opts.loc.model ?? \"unknown\",\n    });\n    transcript.appendUserTurn(opts.userText);\n    transcript.appendAssistantTurn({ text: opts.assistantText });\n    await opts.store.appendRecords(opts.loc.agentId, transcript.records().slice(prior.length));\n    invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);\n  });\n}\n"]}

package/dist/{inject-session-JVTZNQF6.cjs → inject-session-WOH7TPDX.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkYOVZMN4P_cjs = require('./chunk-YOVZMN4P.cjs');
+var chunkDVP3YMDA_cjs = require('./chunk-DVP3YMDA.cjs');
 var chunkYJNYDJ2T_cjs = require('./chunk-YJNYDJ2T.cjs');
 require('./chunk-MSW7LB2V.cjs');
 var chunk3WKWBYPO_cjs = require('./chunk-3WKWBYPO.cjs');
@@ -10,7 +10,7 @@ require('./chunk-RNXXYF22.cjs');
 
 // src/internal/session/inject-session.ts
 async function injectSessionTurn(opts) {
-  await chunkYOVZMN4P_cjs.enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {
+  await chunkDVP3YMDA_cjs.enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {
     const prior = await opts.store.readRecords(opts.loc.agentId);
     const transcript = chunk3WKWBYPO_cjs.SessionTranscript.fromRecords(prior, {
       cwd: opts.loc.cwd,
@@ -25,5 +25,5 @@ async function injectSessionTurn(opts) {
 }
 
 exports.injectSessionTurn = injectSessionTurn;
-//# sourceMappingURL=inject-session-JVTZNQF6.cjs.map
-//# sourceMappingURL=inject-session-JVTZNQF6.cjs.map
+//# sourceMappingURL=inject-session-WOH7TPDX.cjs.map
+//# sourceMappingURL=inject-session-WOH7TPDX.cjs.map

package/dist/{inject-session-JVTZNQF6.cjs.map → inject-session-WOH7TPDX.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/session/inject-session.ts"],"names":["enqueueSessionWrite","SessionTranscript","invalidateSessionCache"],"mappings":";;;;;;;;;;;AAWA,eAAsB,kBAAkB,IAAA,EAMtB;AAChB,EAAA,MAAMA,sCAAoB,IAAA,CAAK,GAAA,CAAI,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,YAAY;AACpE,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,MAAM,WAAA,CAAY,IAAA,CAAK,IAAI,OAAO,CAAA;AAC3D,IAAA,MAAM,UAAA,GAAaC,mCAAA,CAAkB,WAAA,CAAY,KAAA,EAAO;AAAA,MACtD,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,KAAA,EAAO,IAAA,CAAK,GAAA,CAAI,KAAA,IAAS;AAAA,KAC1B,CAAA;AACD,IAAA,UAAA,CAAW,cAAA,CAAe,KAAK,QAAQ,CAAA;AACvC,IAAA,UAAA,CAAW,mBAAA,CAAoB,EAAE,IAAA,EAAM,IAAA,CAAK,eAAe,CAAA;AAC3D,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,KAAA,CAAM,MAAM,CAAC,CAAA;AACzF,IAAAC,wCAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,EACvD,CAAC,CAAA;AACH","file":"inject-session-JVTZNQF6.cjs","sourcesContent":["/**\n * M51 (agent-builder) — inject a SYNTHETIC user+assistant pair into a session's persisted transcript\n * WITHOUT running an LLM turn. This is the Codex review-exit mechanism (`exit_success.xml` appended to\n * the parent thread history so follow-ups like \"fix finding 2\" work): the pair chains onto the DAG\n * leaf (M50 pattern) and the in-memory cache is invalidated so the NEXT send re-hydrates with it.\n */\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { SessionTranscript } from \"../persistence/session-transcript.js\";\nimport { enqueueSessionWrite, invalidateSessionCache } from \"./agent-session.js\";\nimport type { CompactLocation } from \"./compact-session.js\";\n\nexport async function injectSessionTurn(opts: {\n  store: SessionStore;\n  loc: CompactLocation;\n  sessionId: string;\n  userText: string;\n  assistantText: string;\n}): Promise<void> {\n  await enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {\n    const prior = await opts.store.readRecords(opts.loc.agentId);\n    const transcript = SessionTranscript.fromRecords(prior, {\n      cwd: opts.loc.cwd,\n      sessionId: opts.sessionId,\n      model: opts.loc.model ?? \"unknown\",\n    });\n    transcript.appendUserTurn(opts.userText);\n    transcript.appendAssistantTurn({ text: opts.assistantText });\n    await opts.store.appendRecords(opts.loc.agentId, transcript.records().slice(prior.length));\n    invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);\n  });\n}\n"]}
+{"version":3,"sources":["../src/internal/session/inject-session.ts"],"names":["enqueueSessionWrite","SessionTranscript","invalidateSessionCache"],"mappings":";;;;;;;;;;;AAWA,eAAsB,kBAAkB,IAAA,EAMtB;AAChB,EAAA,MAAMA,sCAAoB,IAAA,CAAK,GAAA,CAAI,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,YAAY;AACpE,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,MAAM,WAAA,CAAY,IAAA,CAAK,IAAI,OAAO,CAAA;AAC3D,IAAA,MAAM,UAAA,GAAaC,mCAAA,CAAkB,WAAA,CAAY,KAAA,EAAO;AAAA,MACtD,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,KAAA,EAAO,IAAA,CAAK,GAAA,CAAI,KAAA,IAAS;AAAA,KAC1B,CAAA;AACD,IAAA,UAAA,CAAW,cAAA,CAAe,KAAK,QAAQ,CAAA;AACvC,IAAA,UAAA,CAAW,mBAAA,CAAoB,EAAE,IAAA,EAAM,IAAA,CAAK,eAAe,CAAA;AAC3D,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,KAAA,CAAM,MAAM,CAAC,CAAA;AACzF,IAAAC,wCAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,EACvD,CAAC,CAAA;AACH","file":"inject-session-WOH7TPDX.cjs","sourcesContent":["/**\n * M51 (agent-builder) — inject a SYNTHETIC user+assistant pair into a session's persisted transcript\n * WITHOUT running an LLM turn. This is the Codex review-exit mechanism (`exit_success.xml` appended to\n * the parent thread history so follow-ups like \"fix finding 2\" work): the pair chains onto the DAG\n * leaf (M50 pattern) and the in-memory cache is invalidated so the NEXT send re-hydrates with it.\n */\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { SessionTranscript } from \"../persistence/session-transcript.js\";\nimport { enqueueSessionWrite, invalidateSessionCache } from \"./agent-session.js\";\nimport type { CompactLocation } from \"./compact-session.js\";\n\nexport async function injectSessionTurn(opts: {\n  store: SessionStore;\n  loc: CompactLocation;\n  sessionId: string;\n  userText: string;\n  assistantText: string;\n}): Promise<void> {\n  await enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {\n    const prior = await opts.store.readRecords(opts.loc.agentId);\n    const transcript = SessionTranscript.fromRecords(prior, {\n      cwd: opts.loc.cwd,\n      sessionId: opts.sessionId,\n      model: opts.loc.model ?? \"unknown\",\n    });\n    transcript.appendUserTurn(opts.userText);\n    transcript.appendAssistantTurn({ text: opts.assistantText });\n    await opts.store.appendRecords(opts.loc.agentId, transcript.records().slice(prior.length));\n    invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);\n  });\n}\n"]}

package/dist/internal/providers/discovery.d.ts

@@ -3,8 +3,8 @@
  *
  * Scans `~/.theokit/plugins/model-providers/<name>/index.{js,mjs}` and
  * imports each as a Plugin. Plugins with `kind: "model-provider"` register
- * their profile. Errors per plugin are logged + skipped. Idempotent per
- * process.
+ * their profile. Errors per plugin are logged + skipped. Each plugin is
+ * imported at most once per process; the trust gate is read on every call.
  *
  * EC-9: dynamic `import()` in Node 22 needs `file://` URL for absolute
  * paths in ESM contexts. `pathToFileURL` handles both.

package/dist/internal/providers/trust-gate.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The trust gate for provider plugins loaded from disk (M47, B-686).
+ *
+ * Provider discovery (`discovery.ts`) reads this list of NAMES; it authorizes only
+ * `~/.theokit/plugins/model-providers/<name>/`, a folder in the operator's own home. Workspace
+ * manifest plugins never consult it: a cloned workspace chooses its folder names, so they are
+ * trusted by realpath in a record of their own (`runtime/plugin-loader/workspace-plugin-trust.ts`),
+ * which shares the fail-closed file reader below. Both are read on every call and never cached, so
+ * an entry the operator adds takes effect on the next `Agent.create` rather than after a restart.
+ *
+ * @internal
+ */
+/** The explicit trust allowlist the human edits (M47). Fail-closed: missing/malformed ⇒ empty. */
+export declare function trustFilePath(): string;
+/**
+ * M47 — the trust gate for the dynamic-import surface. A plugin's entry executes arbitrary code
+ * at import time, so NOTHING is imported unless the human explicitly trusted the name: either in
+ * `~/.theokit/plugins/trusted-providers.json` (a JSON string array — the auditable primary, mirroring the
+ * approved-hooks posture) or the additive `THEOKIT_TRUSTED_PROVIDERS` env (comma-separated convenience).
+ * Fail-closed: a missing or malformed trust file trusts NOTHING (a malformed file WARNs).
+ */
+export declare function readTrustedNames(): Set<string>;
+/** What a trust file holds, as its fail-closed warnings name it. */
+export interface TrustArrayShape {
+    /** What a malformed file leaves untrusted, e.g. "provider plugins". */
+    readonly subject: string;
+    /** What each entry must be, e.g. "plugin-name strings". */
+    readonly entries: string;
+}
+/**
+ * The non-empty strings in a JSON-array trust file. Fail-closed: a missing file is empty, and a
+ * malformed one (not JSON, not an array) is empty with a WARN; non-string entries are discarded
+ * with a WARN.
+ */
+export declare function readTrustArray(path: string, shape: TrustArrayShape): string[];

package/dist/internal/runtime/plugin-loader/manifest-entry-import.d.ts

@@ -0,0 +1,17 @@
+/**
+ * B-686 — import the `entry` of each trusted workspace manifest plugin.
+ *
+ * `PluginsManager` lists a folder under `<cwd>/.theokit/plugins/<folder>/` whose `PLUGIN.md` names an
+ * `entry`; this step decides whether that code runs. The folder's realpath is checked against the
+ * workspace trust record (`workspace-plugin-trust.ts`) before any `import()`, never its name: a
+ * cloned workspace chooses its folder names, so a name in the provider trust list authorizes
+ * nothing here (review round 1, CWE-829). An untrusted folder's code is never evaluated, and it is
+ * diagnosed once per folder per process. A trusted entry whose import throws,
+ * or whose default export is not a general plugin, fails `Agent.create` with a typed error rather
+ * than being skipped: the operator trusted that code, so dropping it silently would hide a bug.
+ *
+ * @internal
+ */
+import type { Plugin } from "../../plugins/types.js";
+import type { ManifestEntryCandidate } from "./plugins-manager.js";
+export declare function importTrustedManifestPlugins(candidates: ReadonlyArray<ManifestEntryCandidate>, trustedFolders: ReadonlySet<string>): Promise<Plugin[]>;

package/dist/internal/runtime/plugin-loader/workspace-plugin-trust.d.ts

@@ -0,0 +1,16 @@
+/**
+ * B-686 — the trust record for workspace manifest plugins.
+ *
+ * A folder under `<cwd>/.theokit/plugins/<folder>/` is code a cloned repository ships, and the
+ * repository chooses the folder's name. So the record is keyed on what the workspace cannot
+ * choose: the folder's absolute realpath, in `~/.theokit/plugins/trusted-workspace-plugins.json`
+ * (a JSON array). It is a record of its own: a name in the provider trust list
+ * (`providers/trust-gate.ts`) authorizes no workspace folder. Read on every call, never cached;
+ * fail-closed like the provider list, whose reader it shares.
+ *
+ * @internal
+ */
+/** Beside the provider trust file, in `~/.theokit/plugins/`. */
+export declare function workspaceTrustRecordPath(): string;
+/** The folder realpaths the operator trusted; a relative entry is discarded with a WARN. */
+export declare function readTrustedWorkspaceFolders(): Set<string>;

package/dist/internal/structured-output-helpers.d.ts

@@ -1,5 +1,5 @@
 import type { z as ZodNamespace, ZodType } from "zod";
-import type { AgentOptions, CustomTool, LocalOptions, ModelSelection } from "../types/agent.js";
+import type { AgentOptions, BuiltinToolName, CustomTool, LocalOptions, MemorySettings, ModelSelection } from "../types/agent.js";
 import type { ProviderRoutingSettings } from "../types/providers.js";
 /**
  * Load Zod via createRequire (it's an optional peer dep). Throws a typed
@@ -15,7 +15,8 @@ export declare function requireZod(): typeof ZodNamespace;
 export declare function makeOutputTool(jsonSchema: Record<string, unknown>, onCapture: (input: unknown) => string | Promise<string> | undefined): CustomTool;
 /**
  * Assemble the AgentOptions for the transient agent. Shared shape:
- * model + local + tools[output] + systemPrompt + apiKey.
+ * model + local + tools[output] + systemPrompt + apiKey, plus the caller's withheld builtins
+ * and memory settings when supplied (B-678).
  */
 export declare function buildTransientAgentOptions(params: {
     model: string | ModelSelection;
@@ -24,6 +25,8 @@ export declare function buildTransientAgentOptions(params: {
     systemPrompt?: string;
     apiKey?: string;
     providers?: ProviderRoutingSettings;
+    withheldBuiltinTools?: readonly BuiltinToolName[];
+    memory?: MemorySettings;
 }): AgentOptions;
 /**
  * Best-effort extraction of token usage from a run result. Local runtimes

package/dist/sandbox/bwrap.d.cts

@@ -1,9 +1,10 @@
+import type { BwrapDetection, SandboxMode } from "./types.js";
 /**
  * Codex's three canonical modes. Defined HERE because they are sandbox vocabulary, not consumer
  * configuration: `danger-full-access` means "do not wrap", and that is a decision belonging to the
  * confinement subsystem.
  */
-export type SandboxMode = "read-only" | "workspace-write" | "danger-full-access";
+export type { SandboxMode } from "./types.js";
 /**
  * U-6 — the roots a mode may write to, answerable WITHOUT spawning anything.
  *
@@ -40,6 +41,13 @@ export interface BwrapArgvOptions {
      * sandboxed child. Omitted ⇒ inherit the parent env (backward-compatible; SDK scrub still applies).
      */
     env?: Record<string, string>;
+    /**
+     * Absolute paths the confined command must not read. Each is resolved through symlinks and masked
+     * after the writable binds: a directory becomes empty, a file reads as permission denied. A masked
+     * file still shows in the listing of its directory. Throws `TypeError` for a relative or missing
+     * path, one that contains the workspace, `/tmp` or `/`, and any list under `danger-full-access`.
+     */
+    denyReadPaths?: readonly string[];
 }
 /**
  * Pure argv builder. Returns the bwrap flags ending in `--` (caller appends `/bin/sh -c <cmd>`),
@@ -73,13 +81,7 @@ export interface BwrapProbes {
  * `try`/`catch` catches nothing; callers warn and fall back to an unconfined
  * `LocalSandbox`.
  */
-export type BwrapDetection = {
-    ok: true;
-    bin: string;
-} | {
-    ok: false;
-    reason: string;
-};
+export type { BwrapDetection } from "./types.js";
 /** Honest detection — fail-closed on every probe; NEVER throws (callers WARN + fall back). */
 export declare function detectBwrap(probes?: BwrapProbes): BwrapDetection;
 /** How many real probes ran. TEST seam — the performance gate counts this. */

package/dist/sandbox/bwrap.d.ts

@@ -1,9 +1,10 @@
+import type { BwrapDetection, SandboxMode } from "./types.js";
 /**
  * Codex's three canonical modes. Defined HERE because they are sandbox vocabulary, not consumer
  * configuration: `danger-full-access` means "do not wrap", and that is a decision belonging to the
  * confinement subsystem.
  */
-export type SandboxMode = "read-only" | "workspace-write" | "danger-full-access";
+export type { SandboxMode } from "./types.js";
 /**
  * U-6 — the roots a mode may write to, answerable WITHOUT spawning anything.
  *
@@ -40,6 +41,13 @@ export interface BwrapArgvOptions {
      * sandboxed child. Omitted ⇒ inherit the parent env (backward-compatible; SDK scrub still applies).
      */
     env?: Record<string, string>;
+    /**
+     * Absolute paths the confined command must not read. Each is resolved through symlinks and masked
+     * after the writable binds: a directory becomes empty, a file reads as permission denied. A masked
+     * file still shows in the listing of its directory. Throws `TypeError` for a relative or missing
+     * path, one that contains the workspace, `/tmp` or `/`, and any list under `danger-full-access`.
+     */
+    denyReadPaths?: readonly string[];
 }
 /**
  * Pure argv builder. Returns the bwrap flags ending in `--` (caller appends `/bin/sh -c <cmd>`),
@@ -73,13 +81,7 @@ export interface BwrapProbes {
  * `try`/`catch` catches nothing; callers warn and fall back to an unconfined
  * `LocalSandbox`.
  */
-export type BwrapDetection = {
-    ok: true;
-    bin: string;
-} | {
-    ok: false;
-    reason: string;
-};
+export type { BwrapDetection } from "./types.js";
 /** Honest detection — fail-closed on every probe; NEVER throws (callers WARN + fall back). */
 export declare function detectBwrap(probes?: BwrapProbes): BwrapDetection;
 /** How many real probes ran. TEST seam — the performance gate counts this. */

package/dist/sandbox/deny-read.d.cts

@@ -0,0 +1,24 @@
+import type { BwrapDetection, SandboxMode } from "./types.js";
+/**
+ * The bwrap flags that make each path in `paths` unreadable inside the sandbox: `--tmpfs` for a
+ * directory, `--ro-bind /dev/null` for a file. Callers place them after the writable binds so the
+ * mask wins over a path inside the workspace or `/tmp`.
+ *
+ * Every entry is resolved through symlinks first, so reading through a link is denied too, and
+ * duplicates collapse in list order. A masked file is still listed in its directory; only reading it
+ * fails.
+ *
+ * Throws `TypeError` (never skips) for a relative or missing entry, an entry that equals or contains
+ * the working directory, `/tmp` or `/`, and any non-empty list under `danger-full-access`, where no
+ * mask can be applied.
+ */
+export declare function denyReadFlags(paths: readonly string[] | undefined, policy: {
+    mode: SandboxMode;
+    cwd: string;
+}): string[];
+/**
+ * Refuses a non-empty deny list that no confinement can honour, before a backend or a wrap exists:
+ * `danger-full-access` applies no sandbox (`TypeError`), and an undetected bubblewrap would fall back
+ * to an unconfined run, which is the leak the list exists to stop (`SandboxNotAvailableError`).
+ */
+export declare function refuseUnhonourableDenyRead(paths: readonly string[] | undefined, mode: SandboxMode, detect: () => BwrapDetection): void;

package/dist/sandbox/deny-read.d.ts

@@ -0,0 +1,24 @@
+import type { BwrapDetection, SandboxMode } from "./types.js";
+/**
+ * The bwrap flags that make each path in `paths` unreadable inside the sandbox: `--tmpfs` for a
+ * directory, `--ro-bind /dev/null` for a file. Callers place them after the writable binds so the
+ * mask wins over a path inside the workspace or `/tmp`.
+ *
+ * Every entry is resolved through symlinks first, so reading through a link is denied too, and
+ * duplicates collapse in list order. A masked file is still listed in its directory; only reading it
+ * fails.
+ *
+ * Throws `TypeError` (never skips) for a relative or missing entry, an entry that equals or contains
+ * the working directory, `/tmp` or `/`, and any non-empty list under `danger-full-access`, where no
+ * mask can be applied.
+ */
+export declare function denyReadFlags(paths: readonly string[] | undefined, policy: {
+    mode: SandboxMode;
+    cwd: string;
+}): string[];
+/**
+ * Refuses a non-empty deny list that no confinement can honour, before a backend or a wrap exists:
+ * `danger-full-access` applies no sandbox (`TypeError`), and an undetected bubblewrap would fall back
+ * to an unconfined run, which is the leak the list exists to stop (`SandboxNotAvailableError`).
+ */
+export declare function refuseUnhonourableDenyRead(paths: readonly string[] | undefined, mode: SandboxMode, detect: () => BwrapDetection): void;