@wenathlan/extension 1.1.59 → 1.1.60

package/README.md

@@ -2,11 +2,11 @@
 
 Devthink is a **consent-first browser-agent bridge** distributed as a TypeScript library and a Chromium Manifest V3 extension. It turns a user-provided browser objective into a bounded, reviewable plan. The user must start the active-tab session and approve the plan before any page action reaches the browser.
 
-Version: **1.1.59**. License: **GPL-3.0-only**. The repository is `wenathlan/extension`; the npm-compatible scoped package identifier is `@wenathlan/extension`.
+Version: **1.1.60**. License: **GPL-3.0-only**. The repository is `wenathlan/extension`; the npm-compatible scoped package identifier is `@wenathlan/extension`.
 
 ## What it does
 
-| Capability | Behavior in 1.1.59 |
+| Capability | Behavior in 1.1.60 |
 | --- | --- |
 | Active-tab session | The user starts a short-lived session for one HTTPS tab and one origin; the session records its origin grants. |
 | Page observation | The extension captures the complete semantic inventory: every interactive element, every form control, every select option and the full page text. |
@@ -29,6 +29,7 @@ Version: **1.1.59**. License: **GPL-3.0-only**. The repository is `wenathlan/ext
 | Workflow editor | Reviewed workflows get a visual home with consent: the canvas renders steps as nodes with typed binding sockets and blocks as containers with nested child steps, drag and drop snaps onto the reviewed grid and the nearest block column, the palette lists curated drop blocks across actions, control flow, waits, variables and triggers with search, the step library browses every reviewed kind grouped by category with its option schema, the step inspector edits options, bindings and nested params, the variable inspector lists scopes and values, the mini map projects the full canvas with click navigation and the zoom keeps step labels readable, undo and redo cover every canvas edit, and every save passes the editorsavegate of a live session, an approved plan, unique node ids, forward only edges and the full composeworkflow grammar so no editor artifact bypasses review — breakpoints mark any step for debug runs that pause before it and resume exactly there, version timelines carry change notes with diffs of added, removed and changed steps and rollbacks that grade unreviewed until the rollback review approves them, imports grade unreviewed until the import review approves the expanded step list, exports and share bundles ship as json or yaml with the export content review refusing any secret, token, api key, password or authorization field so secrets never leave the browser, background runs keep executing with the panel closed while every step checkpoints and every worker wake restores them through the same gates, the watchdog recovers stalled runs by the user configured retry, pause or cancel and reaps zombie runs of browser shutdowns with thresholds and windows as pure user choices with no code ceiling, run history keeps outcome, duration and trigger cause under a user configured retention, and per site overrides adjust only the reviewed knobs of loop bounds, step and run timeouts, element wait timeouts and delay bases per https origin pattern or subdomain glob — no new action kinds, the manifest permissions stay unchanged. |
 | Multi agent swarm | Several agents work at once over one shared context with consent: each agent binds to its own tab with its own role (planner, worker, observer, critic, verifier or any custom role, one agent per tab), the shared task queue carries user configured lanes, priorities, claims and work stealing inside one approved swarm with lane ownership rules, dead agents release their tasks through claim heartbeat expiry and requeue, agent mailboxes route direct, broadcast and role addressed messages, the blackboard holds the goals, facts, findings and scratch sections every agent reads with the consent class of the source extraction, per agent budgets halt at the user configured token, cost and step ceilings, per agent scopes stay inside the session grants, sub agents spawn under a user configured depth limit, and the killswitch halts every agent at once with no configuration barrier — no agent count, lane or ceiling is hardcoded and every agent proposal passes the same human review. |
 | Multi agent orchestration | The swarm organizes itself under consent: a leader worker topology elects its leader by the user rule (first registration or one named agent) with worker, critic and verifier lanes, the leader slices tasks across workers and scales the worker lane by load under the user configured bound with no engine cap, the planner executor split keeps plan drafting and execution in different agents while the executor reports every step outcome back, critics review agent outputs read only with verdicts and required changes, verifiers mark result claims pass or fail with the method they used, tab handoffs move a task between agents mid run from its packaged state while preserving the original session grants, resource locks keyed by one origin and one selector serialize parallel writes with exclusive and shared kinds and expiry sweeps, conflict scans detect overlapping writes with a suggested ordering, parallel results merge into one report under first, last, preferagent or fail rules with provenance for every merged value, escalations lift stalled decisions to the user who alone decides them, arbitration orders competing lock claims by the user rule, consensus rounds carry at the user configured quorum, verified lessons land on the blackboard, shared cost accounting sums the per agent usage, and the progressboard shows every agent at once with the interleaved timeline and replay — coordination never bypasses the review. |
+| Execution environments | Every reviewed step names where it runs with consent: the pagecontext keeps dom actions inside the live page because page events only fire there, the isolatedworld runs evaluate steps through the scripting api with reviewed arguments only while page globals stay unreachable from step code, the offscreenworker moves the six heavy parse families (html snapshots, network json payloads, table row reductions, accessibility tree shaping, complex selector evaluation and screenshot stitching) into an offscreen document worker pool behind the optional user granted offscreen capability with an inline fallback inside the page, and the sandboxframe renders untrusted markup inside a sandboxed page with no extension privileges after stripping scripts and event handlers and answering only per render nonces — the environment grants join the origin grants of the session, a keepalive port holds the service worker alive for the whole run of an approved plan with a heartbeat every user configured interval, the persisted run state resumes exactly the pending step after a service worker restart, zombie runs whose heartbeat fell silent reap past the tolerated intervals, a storage level run lock holds one session against concurrent runs, steps sharing one tab serialize across parallel branches, and every navigation lands a url history entry — no pool size, interval or tolerance is hardcoded and no environment ever bypasses the review. |
 | Any LLM connection | Any model drives the extension with consent: the user connects a gateway, a base url, an api key and any model — nothing is hardcoded, no provider allowlist exists and the openai chat completions, openai responses, anthropic messages and google gemini shapes are protocol styles the user picks; model routes map task kinds to provider and model pairs with user configured fallbacks, a local loopback endpoint keeps sensitive work on the machine, natural language commands parse into intents with entities and confidence, model drafted plans lint against the action grammar and pass the same human review (draft review plus plan review) local plans pass, failed runs replan their tail under a fresh review, executed steps reflect their lessons into the next prompt, cost budgets halt at the user configured token and currency ceilings and ask, the prompt library versions user templates with consent notices, and the guardrails strip code fences, validate model text against the schema, retry and refuse invalid output before anything executes. |
 | Agent protocol | The browser becomes a tool server with consent: the mcp server of the agent protocol lists every reviewed browser, workflow, memory and system tool over `tools/list` with its version, json schema inputs, risk grade and full consent metadata, negotiates capabilities and the per client tool floor with any client the user pairs, frames messages in json rpc with newline delimited and http post envelopes, and answers parse, method, params, internal and consentrefused errors with their codes — read only tools run under the dryrun risk class once the session is approved while every tool with side effects executes exactly the approved plan step it names, so no paired client widens what the human approved; the stdio bridge relays frames for local client processes through the native messaging host manifest with restart on demand, the http listener binds localhost by default with any other bind graded sensitive behind the explicit remote review, the server starts only after the user enables it, and the bind, port, transports, frame size, queue depth and call retention all stay user configured with no code ceiling. Since 1.1.55 the stream http transport opens for remote clients behind the full remote gates: one time pairing codes exchanged for session tokens that persist only as sha-256 digests, token scopes per namespace, a client allowlist with grant history, tls required for any non localhost transport with user configured certificate fingerprints, an ordered frame intake where tls terminates before token verification and namespace checks run before consent checks, auth failures that answer with one fixed message leaking no pairing state, a user configured client ceiling, and approval gates that hold every sensitive remote call with its full arguments (secret fields redacted) until the user decides — refusing by default when the configurable window closes. |
 | Files and downloads | The agent moves bytes with review: `batchdownload` downloads reviewed url lists in waves under a user configured concurrent window with per file states and sequence suffixes for filename conflicts, `pausedownload` and `resumedownload` walk the queue through the downloads api, `verifydownload` compares state, size and checksum against reviewed expectations, `interceptmime` arms include, exclude and deny default mime filters that reroute matching downloads into quarantine, `exportnetlog` exports the step correlated network log with every header value redacted, `readclipboard` needs an approved single use consent prompt per read and never persists the payload text, `writeclipboard` writes reviewed text through the page bridge with payload hashes for audit, `copyscreen` copies the visible tab to the clipboard, `quarantinedownload` and `scanvirus` keep files outside the downloads folder until a clean scan verdict releases them, `namecaptures` stamps task, step and sequence filenames with per task counters, and `cleanupartifacts` sweeps artifacts by reviewed age and kind rules while keeping open review references. |
@@ -70,7 +71,7 @@ The endpoint field intentionally has no default URL. Enter a URL such as `https:
 
 ```json
 {
-  "version": "1.1.59",
+  "version": "1.1.60",
   "objective": "User supplied objective",
   "session": { "id": "uuid", "tabid": 1, "origin": "https://example.com" },
   "observation": { "schemaversion": 3, "url": "https://example.com/path", "interactive": [] },

package/dist/cli.js

@@ -5,7 +5,8 @@ import { readFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 var forbidden = /* @__PURE__ */ new Set(["debugger", "cookies", "webRequest", "history", "bookmarks", "nativeMessaging", "proxy", "management"]);
-var allowedoptional = /* @__PURE__ */ new Set(["tabs", "downloads", "clipboardRead", "clipboardWrite"]);
+var allowedoptional = /* @__PURE__ */ new Set(["tabs", "downloads", "clipboardRead", "clipboardWrite", "offscreen"]);
+var privilegedpages = /* @__PURE__ */ new Set(["background.html", "popup.html", "sidepanel.html", "offscreen.html"]);
 var pinnedidentitykey = "58e21373cec5ade3e6698da5b36ecc2bf7e7e2f755c6fb5e3a6605b535b93985";
 function decodeidentitykey(key) {
   if (!/^[A-Za-z0-9+/]+={0,2}$/.test(key)) throw new Error("The manifest key must be strict base64 without whitespace.");
@@ -35,7 +36,23 @@ async function main() {
     if ((manifest.host_permissions ?? []).length) throw new Error("Mandatory host permissions are not allowed.");
     if (denied.length) throw new Error(`Forbidden permissions: ${denied.join(", ")}`);
     if (deniedoptional.length) throw new Error(`Forbidden optional permissions: ${deniedoptional.join(", ")}`);
-    console.log(JSON.stringify({ valid: true, version: manifest.version, identitykeybytes: identitykey.length, permissions, optionalpermissions: optional }, null, 2));
+    const sandboxpages = manifest.sandbox?.pages ?? [];
+    if (manifest.sandbox !== void 0) {
+      if (sandboxpages.length === 0) throw new Error("The sandbox key needs at least one sandbox page.");
+      if (sandboxpages.some((page) => !/^([a-z0-9-]+)\.html$/.test(page))) throw new Error("Every sandbox page needs its plain html file name.");
+      if (new Set(sandboxpages).size !== sandboxpages.length) throw new Error("The sandbox page names must stay unique.");
+      const privileged = sandboxpages.filter((page) => privilegedpages.has(page));
+      if (privileged.length) throw new Error(`The sandbox pages ${privileged.join(", ")} hold extension privileges and must never run untrusted markup.`);
+    }
+    if (manifest.offscreen !== void 0) {
+      if (!manifest.offscreen.document || !/^[a-z0-9-]+\.html$/.test(manifest.offscreen.document)) throw new Error("The offscreen declaration needs its document path.");
+      if (!manifest.offscreen.reasons?.length) throw new Error("The offscreen declaration needs the reasons the user reviewed.");
+      if (!manifest.offscreen.justification?.trim()) throw new Error("The offscreen declaration needs its justification in plain language.");
+    }
+    const worlds = (manifest.content_scripts ?? []).map((script) => script.world ?? "ISOLATED");
+    if (worlds.some((world) => world !== "ISOLATED")) throw new Error("Content scripts stay registered in the isolated world by default; no main world registration exists.");
+    if ((manifest.content_scripts ?? []).some((script) => (script.matches ?? []).length > 0)) throw new Error("Content script registrations carry no matches because injection stays behind the granted scripting calls on reviewed origins.");
+    console.log(JSON.stringify({ valid: true, version: manifest.version, identitykeybytes: identitykey.length, permissions, optionalpermissions: optional, ...sandboxpages.length > 0 ? { sandboxpages } : {}, ...manifest.offscreen !== void 0 ? { offscreendocument: manifest.offscreen.document, offscreenreasons: manifest.offscreen.reasons } : {} }, null, 2));
     return;
   }
   console.log("Usage: devthink manifest");

package/dist/environments.d.ts

@@ -0,0 +1,96 @@
+import type { actionkind, environmentkind, environmentrequirement, offscreenregistryentry, toolstep, workerrequest, workerresponse } from "./types.js";
+/** Reads the parse family of one offload eligible kind; a kind outside the families returns undefined. */
+export declare function offfamilyof(kind: actionkind): string | undefined;
+/** Reads the environments one action kind may run in: evaluate runs in the isolated world only, a step carrying untrusted markup renders inside the sandboxframe only, the parse heavy kinds may offload into the offscreen worker pool beside the live page and every other kind keeps the pagecontext of the page bridge. */
+export declare function environmentsof(step: Pick<toolstep, "kind" | "options">): environmentkind[];
+/** Reads the default environment of one step: the absent environment field routes to the isolated world for evaluate, the sandboxframe for untrusted markup and the pagecontext for everything else including the parse offload candidates until the user turns the offload on. */
+export declare function defaultenvironment(step: Pick<toolstep, "kind" | "options">): environmentkind;
+/** Lists the parse heavy kinds the offscreen worker pool may take over, grouped by their parse family. */
+export declare function offloadkinds(): Array<{
+    task: string;
+    kinds: string[];
+}>;
+/** Reads whether one step carries untrusted markup for rendering: a reviewed options object with a markup string renders inside the sandboxframe only, so the untrusted markup never reenters the page dom. */
+export declare function markuprenderstep(step: Pick<toolstep, "kind" | "options">): boolean;
+/** Builds the per kind environment requirement table the policy exposes: one profile per action kind with its allowed environments and its default. */
+export declare function environmentrequirementsof(kinds: actionkind[]): environmentrequirement[];
+/** Maps every environmentkind to its runtime adapter: pagecontext rides the page bridge in the live page, isolatedworld rides the scripting api world page scripts cannot touch, offscreenworker rides the offscreen document worker pool and sandboxframe rides the sandboxed page with no extension privileges. */
+export declare function executorregistry(): Array<{
+    environment: environmentkind;
+    adapter: string;
+    description: string;
+}>;
+/** Routes one step to its environment: the reviewed environment field wins when it sits inside the requirement table, the offload toggle moves parse heavy kinds into the offscreen worker pool, and a missing offscreen capability grant falls the step back to inline parsing inside the page instead of refusing the reviewed work. */
+export declare function routeenvironment(step: toolstep, input: {
+    offload: boolean;
+    granted: boolean;
+}): {
+    environment: environmentkind;
+    fallback: boolean;
+    reason: string;
+};
+/** Builds one executor traffic envelope for the offscreen worker pool: the parse family of the kind, the payload reference and the transferable keys the payload carries. */
+export declare function workerrequestof(input: {
+    id: string;
+    runid: string;
+    stepid: string;
+    kind: actionkind;
+    payload: string;
+    options?: Record<string, unknown>;
+    sentat: number;
+}): workerrequest;
+/** Reads the payload keys the executor moves as transferable buffers where possible: every ArrayBuffer value travels as a transferable so the worker owns its bytes without a copy. */
+export declare function transferablekeys(options: Record<string, unknown>): string[];
+/** Builds one worker answer to the executor: the finished result or one streamed partial chunk with its sequence number. */
+export declare function workerresponseof(input: {
+    id: string;
+    requestid: string;
+    ok: boolean;
+    result?: string;
+    partial?: number;
+    summary: string;
+    receivedat: number;
+}): workerresponse;
+/** Reads one worker answer: a partial chunk streams on while the final answer without a partial sequence completes the request, and a failed answer refuses without a result. */
+export declare function acceptworkerresponse(response: workerresponse): {
+    done: boolean;
+    partial: boolean;
+    result?: string;
+    reason: string;
+};
+/** Plans the worker pool against the pending parse queue: the pool grows with the pending parses and shrinks with the idle workers, a user configured size pins the pool with no engine cap, and an absent size lets the queue alone decide. */
+export declare function poolplan(input: {
+    pending: number;
+    current: number;
+    size?: number;
+}): {
+    workers: number;
+    added: number;
+    retired: number;
+    reason: string;
+};
+/** Spawns the offscreen document of one run on first use and reuses the same document across the steps of the run: a registry entry already open for the run carries on while the first need records its reasons and justification. */
+export declare function openoffscreen(input: {
+    registry: offscreenregistryentry[];
+    document: string;
+    runid: string;
+    reasons: string[];
+    justification: string;
+    now: number;
+}): {
+    registry: offscreenregistryentry[];
+    entry: offscreenregistryentry;
+    reused: boolean;
+};
+/** Closes the offscreen document of one run when the run completes: the registry entry records its close time so the audit reads every spawn with its teardown. */
+export declare function closeoffscreen(registry: offscreenregistryentry[], runid: string, now: number): {
+    registry: offscreenregistryentry[];
+    closed: boolean;
+};
+/** Builds the isolated world injection of one evaluate step: the scripting api injects the reviewed code inside the isolated world where page globals stay unreachable from step code, and the injection carries reviewed arguments only. */
+export declare function isolatedinjection(step: toolstep): {
+    world: "ISOLATED";
+    code: string;
+    args: string[];
+};
+//# sourceMappingURL=environments.d.ts.map

package/dist/environments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../environments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkBvJ,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED,+TAA+T;AAC/T,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,eAAe,EAAE,CAK1F;AAED,mRAAmR;AACnR,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,eAAe,CAI5F;AAMD,0GAA0G;AAC1G,wBAAgB,YAAY,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAEvE;AAED,+MAA+M;AAC/M,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAMlF;AAED,uJAAuJ;AACvJ,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,sBAAsB,EAAE,CAMvF;AAED,qTAAqT;AACrT,wBAAgB,gBAAgB,IAAI,KAAK,CAAC;IAAE,WAAW,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAOhH;AAED,0UAA0U;AAC1U,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAenK;AAED,6KAA6K;AAC7K,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAKzL;AAED,uLAAuL;AACvL,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAE3E;AAED,4HAA4H;AAC5H,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAG9K;AAED,iLAAiL;AACjL,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAInI;AAED,gPAAgP;AAChP,wBAAgB,QAAQ,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAWxJ;AAED,uOAAuO;AACvO,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IAAC,KAAK,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAQ3P;AAED,mKAAmK;AACnK,wBAAgB,cAAc,CAAC,QAAQ,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAItJ;AAED,6OAA6O;AAC7O,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAWrG"}

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export * from "./clientauth.js";
 export * from "./controlflow.js";
 export * from "./coordination.js";
 export * from "./emulation.js";
+export * from "./environments.js";
 export * from "./httpclient.js";
 export * from "./llm.js";
 export * from "./httpstream.js";
@@ -21,6 +22,8 @@ export * from "./netwatch.js";
 export * from "./orchestration.js";
 export * from "./profilers.js";
 export * from "./promptlibrary.js";
+export * from "./runstate.js";
+export * from "./sandboxframe.js";
 export * from "./sessions.js";
 export * from "./taskqueue.js";
 export * from "./trigger.js";
@@ -28,7 +31,7 @@ export * from "./toolcatalog.js";
 export * from "./workflow.js";
 export * from "./workfloweditor.js";
 export { argkind, attachtimeline, blockingduration, consolecapture, consolediff, errorcapture, filterentries, levelrank, loglevels, longtaskcapture, netfailureentryof, redactconsoletext, rejectioncapture, rotatelogs, serializearg, spamdetect, stackframes, timelinecounts, timelinekinds, timelinesources, watcherdetached, type timeline } from "./runtimeline.js";
-export { actionrisk as deriveactionrisk, agentbudgetvalid, agentscopevalid, apikeyconsentgranted, authconsentgranted, blackboardconsentgrade, blockgate, breakpointbudgetallowed, breakpointceilingof, canexecute, consoleconsentcovers, controltarget, cookiegate, debuggate, debuggerconsentcovers, debugwaitbudgetallowed, diffreviewgrade, dryrunprojection, editorsavegate, emugate, emulationretentionwindow, emulationstackallowed, exportcontentreview, generatedvalueallowed, hostpattern, iscdpkind, isdebugkind, isformkind, isnetwatchkind, iscontrolkind, isprofilekind, issocketkind, iswatchkind, issessionkind, isworkflowkind, istriggeraction, killswitchgate, messageegressgrade, normalizeendpoint, observationmodeof, pauseretentionwindow, passwordconsentgranted, permissionnamevalid, permissionstatevalid, planallowlist, profilegrantgranted, profileretentionwindow, proxygate, queuelanesvalid, ratelimitbudgetallowed, resolvedrisk, resolutionverdict, restoreoriginsgranted, restorereviewgranted, reviewedkinds, rotationruleof, runreviewgranted, serverbindgate, serverenablementgate, sessionfolderunique, sessionnameunique, sessionrestoregate, snapshotretentionwindow, socketgate, sourcemapconsentcovers, spamruleof, spawngrade, stackgate, submitreviewgranted, targetgate, toolconsentrequired, tooldispatchgate, toolnamespacegate, toolriskgrade, toolversionfloor, validatetoolcatalog, workstealgrade, isemulationkind, locationconsentgate, timelinegate, costbudgetvalid, egressconsentgate, guardverdictgate, localsensitivegrade, planlint, plandraftreviewgate, provideregressgrade, providervalid, replanreviewgate, timelineretentionwindow, traceceilingof, triggergate, triggerorigins, validatebreakpointcondition, validatefieldmatch, validateformrecord, validatestep, validatesiteoverride, validateregexrule, validatetargetref, validatevaluegen, watchdogconfigvalid, watchgate, workflowgate } from "./policy.js";
+export { actionrisk as deriveactionrisk, agentbudgetvalid, agentscopevalid, apikeyconsentgranted, authconsentgranted, blackboardconsentgrade, blockgate, breakpointbudgetallowed, breakpointceilingof, canexecute, consoleconsentcovers, controltarget, cookiegate, debuggate, debuggerconsentcovers, debugwaitbudgetallowed, diffreviewgrade, dryrunprojection, editorsavegate, emugate, emulationretentionwindow, emulationstackallowed, environmentgrantgate, environmentrequirements, exportcontentreview, generatedvalueallowed, hostpattern, iscdpkind, isdebugkind, isformkind, isnetwatchkind, iscontrolkind, isprofilekind, issocketkind, iswatchkind, issessionkind, isworkflowkind, istriggeraction, keepalivegate, keepaliveintervalvalid, killswitchgate, messageegressgrade, normalizeendpoint, observationmodeof, offscreencapabilitygate, pauseretentionwindow, passwordconsentgranted, permissionnamevalid, permissionstatevalid, planallowlist, profilegrantgranted, profileretentionwindow, proxygate, queuelanesvalid, ratelimitbudgetallowed, resolvedrisk, resolutionverdict, restoreoriginsgranted, restorereviewgranted, reviewedkinds, rotationruleof, runreviewgranted, sandboxorigingate, serverbindgate, serverenablementgate, sessionfolderunique, sessionnameunique, sessionrestoregate, snapshotretentionwindow, socketgate, sourcemapconsentcovers, spamruleof, spawngrade, stackgate, stepenvironmentvalid, submitreviewgranted, targetgate, toolconsentrequired, tooldispatchgate, toolnamespacegate, toolriskgrade, toolversionfloor, validatetoolcatalog, workstealgrade, workerpoolsizevalid, isemulationkind, locationconsentgate, timelinegate, costbudgetvalid, egressconsentgate, guardverdictgate, localsensitivegrade, planlint, plandraftreviewgate, provideregressgrade, providervalid, replanreviewgate, timelineretentionwindow, traceceilingof, triggergate, triggerorigins, validatebreakpointcondition, validatefieldmatch, validateformrecord, validatestep, validatesiteoverride, validateregexrule, validatetargetref, validatevaluegen, watchdogconfigvalid, watchgate, workflowgate } from "./policy.js";
 export * from "./protocol.js";
 export * from "./socketbus.js";
 export * from "./types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzW,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,SAAS,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,UAAU,EAAE,oBAAoB,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,UAAU,EAAE,sBAAsB,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACn3D,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzW,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,SAAS,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,UAAU,EAAE,oBAAoB,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,sBAAsB,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,UAAU,EAAE,sBAAsB,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChiE,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}