@yanlinglabs/winter-agent-runtime 0.0.35 → 0.0.38

package/dist/{index-91rvsndj.js → index-8x4yjdg7.js}

@@ -9,14 +9,14 @@ import {
   resolveEngineSession2,
   resolveProductionWinterHome2,
   resolveProductionStoreHome
-} from "./index-q5jpx2mz.js";
+} from "./index-5xe59vkt.js";
 import {
   registerDefaultChildEngineFactory,
   loadResumedChain,
   buildProductionWiring,
   withAutoSkillPermissions,
   restoreChildRoster
-} from "./index-838n35xx.js";
+} from "./index-z3970wsj.js";
 
 // src/embedded.ts
 import { splitFrames, encodeFrame } from "@yanlinglabs/winter-agent-sdk";

package/dist/{index-838n35xx.js → index-z3970wsj.js}

@@ -15,6 +15,10 @@ import {
   mcpServerHasRegistrations,
   STRUCTURED_OUTPUT_TOOL_NAME,
   looksLikeCommand,
+  matchFileRule,
+  resolveFileRuleAbsolutePath,
+  resolveFileRuleAbsoluteGlobText,
+  resolvesWithinPluginRoot,
   capBytes,
   neutralizeReminderTags,
   readWhole,
@@ -22,12 +26,8 @@ import {
   registerAttachmentRenderer,
   attachmentsIn,
   registerChildEngineFactory,
-  matchFileRule,
   rawToRuleValue,
   sourceRule,
-  resolveFileRuleAbsolutePath,
-  resolveFileRuleAbsoluteGlobText,
-  resolvesWithinPluginRoot,
   parseFrontmatter,
   parseAgentDefinitionFile,
   allowedAgentTypesFromTools,
@@ -85,7 +85,7 @@ import {
   providerCredentialRef2,
   createModelClassifier2,
   selectClassifierRoute2
-} from "./index-q5jpx2mz.js";
+} from "./index-5xe59vkt.js";
 import {
   createKeychainCredentialStore,
   createKeychainSecretReader,
@@ -311,7 +311,7 @@ function applySubagentToolPool(tools, opts) {
       return true;
     if (policyName === BACKGROUND_AGENT_ALWAYS_ALLOWED_TOOL)
       return true;
-    if (name.startsWith("mcp__") && !twins.has(name))
+    if (!twins.has(name) && (name.startsWith("mcp__") || getRegisteredTool(name)?.descriptor.source === "mcp"))
       return true;
     return allow.has(policyName);
   });
@@ -492,12 +492,14 @@ function renameMcpReference(entry, renames) {
   }
   return;
 }
-function allocateChildScopedServers(declared, parentVisible, prefer, parentDeclared) {
+function allocateChildScopedServers(declared, parentVisible, prefer, parentDeclared, reserved) {
   const claimed = [];
-  const inUse = (name) => liveChildScopedServerNames.has(name) || parentVisible.has(name) || mcpServerHasRegistrations(name);
+  const reservedSet = new Set(reserved ?? []);
+  const inUse = (name) => liveChildScopedServerNames.has(name) || parentVisible.has(name) || mcpServerHasRegistrations(name) || reservedSet.has(name);
   const servers = {};
   const actual = new Map;
   const notes = [];
+  const reservedRenames = new Set;
   const claim = (name) => {
     liveChildScopedServerNames.add(name);
     claimed.push(name);
@@ -505,7 +507,7 @@ function allocateChildScopedServers(declared, parentVisible, prefer, parentDecla
   for (const [name, cfg] of Object.entries(declared)) {
     if (cfg.type === "sdk") {
       if (inUse(name)) {
-        notes.push(parentVisible.has(name) && parentDeclared?.[name]?.type === "sdk" ? `mcpServers declares the in-process server "${name}", which this session already has -- the session's "${name}" is used` : parentVisible.has(name) ? `mcpServers declares the in-process server "${name}", but this session's "${name}" is a different server -- this agent's own in-process "${name}" is not connected, and the session's is what this agent sees` : `mcpServers declares the in-process server "${name}", which another agent in this session is using -- this agent's own in-process "${name}" is not connected`);
+        notes.push(parentVisible.has(name) && parentDeclared?.[name]?.type === "sdk" ? `mcpServers declares the in-process server "${name}", which this session already has -- the session's "${name}" is used` : parentVisible.has(name) ? `mcpServers declares the in-process server "${name}", but this session's "${name}" is a different server -- this agent's own in-process "${name}" is not connected, and the session's is what this agent sees` : reservedSet.has(name) && !liveChildScopedServerNames.has(name) && !mcpServerHasRegistrations(name) ? `mcpServers declares the in-process server "${name}", a name this session's host reserves -- this agent's own in-process "${name}" is not connected` : `mcpServers declares the in-process server "${name}", which another agent in this session is using -- this agent's own in-process "${name}" is not connected`);
         continue;
       }
       claim(name);
@@ -523,6 +525,8 @@ function allocateChildScopedServers(declared, parentVisible, prefer, parentDecla
     claim(pick);
     servers[pick] = cfg;
     actual.set(name, pick);
+    if (pick !== name && reservedSet.has(name))
+      reservedRenames.add(name);
     if (pick !== name)
       notes.push(`mcpServers declares "${name}", which is already in use in this session -- this agent's own "${name}" is connected as "${pick}" (its tools are named mcp__${pick}__<tool>)`);
   }
@@ -531,6 +535,7 @@ function allocateChildScopedServers(declared, parentVisible, prefer, parentDecla
     servers,
     actual,
     notes,
+    reservedRenames,
     release: () => {
       if (released)
         return;
@@ -775,7 +780,7 @@ async function spawnChildEngine(req, inherit, runCtx, deps) {
           ...!ownServers && parentMcp?.stateSource !== undefined ? { mcpServerStateSource: parentMcp.stateSource } : {},
           ...!ownServers && parentMcp?.controlSeam !== undefined ? { mcpControlSeam: parentMcp.controlSeam } : {},
           ...(() => {
-            const merged = { ...parentMcp?.serverRenames ?? {}, ...Object.fromEntries(renames.map(([declared, actual]) => [actual, declared])) };
+            const merged = { ...parentMcp?.serverRenames ?? {}, ...Object.fromEntries(renames.filter(([declared]) => !servers.reservedRenames.has(declared)).map(([declared, actual]) => [actual, declared])) };
             return Object.keys(merged).length > 0 ? { mcpServerRenames: merged } : {};
           })(),
           ...parentMcp?.visibleServerNames !== undefined ? { inheritedMcpServerNames: ownServerNames.size === 0 ? parentMcp.visibleServerNames : () => parentMcp.visibleServerNames().filter((name) => !ownServerNames.has(name)) } : {},
@@ -886,7 +891,12 @@ async function spawnChildEngine(req, inherit, runCtx, deps) {
     const complementDeny = allToolNames.filter((name) => !allowSet.has(name));
     const disallowedTools = [...new Set([...complementDeny, ...req.definition?.disallowedTools ?? []])];
     const allowedAgentTypes = allowedAgentTypesFromTools(req.definition?.tools);
-    const capabilities = [...new Set(effectiveTools.flatMap((name) => getRegisteredTool(name)?.descriptor.capabilityRequirements ?? []))];
+    const capabilities = [
+      ...new Set(effectiveTools.flatMap((name) => {
+        const descriptor = getRegisteredTool(name)?.descriptor;
+        return [...descriptor?.capabilityRequirements ?? [], ...descriptor?.availability.requiresAnyCapability ?? []];
+      }))
+    ];
     const definitionWarnings = req.definition !== undefined ? validateAgentDefinition(req.definition) : [];
     const parentMcp = runCtx.getParentMcpState?.();
     const parentAgents = runCtx.getParentAgents?.();
@@ -955,6 +965,8 @@ async function spawnChildEngine(req, inherit, runCtx, deps) {
       ...deps.parentBrand !== undefined ? { brand: deps.parentBrand } : {},
       ...deps.parentAutoMemory !== undefined ? { autoMemory: deps.parentAutoMemory } : {},
       ...deps.parentWeb !== undefined ? { web: deps.parentWeb } : {},
+      ...deps.parentReservedMcpServerNames !== undefined ? { reservedMcpServerNames: deps.parentReservedMcpServerNames } : {},
+      ...deps.parentLegacyToolNames !== undefined ? { legacyToolNames: deps.parentLegacyToolNames } : {},
       model: resolvedModel.effectiveModel,
       permissionMode: inherit.policy.effectiveMode,
       allowDangerouslySkipPermissions: inherit.policy.effectiveMode === "bypassPermissions",
@@ -965,6 +977,7 @@ async function spawnChildEngine(req, inherit, runCtx, deps) {
       ...req.fork === true && inherit.effectiveEffort !== undefined && typeof inherit.effectiveEffort !== "number" ? { effort: inherit.effectiveEffort } : {},
       ...req.fork === true && inherit.effectiveThinking !== undefined ? { thinking: inherit.effectiveThinking } : {},
       disallowedTools,
+      tools: [...effectiveTools],
       capabilities,
       ...allowedAgentTypes !== undefined ? { allowedAgentTypes } : {},
       forwardSubagentText: deps.forwardSubagentText === true,
@@ -980,7 +993,7 @@ async function spawnChildEngine(req, inherit, runCtx, deps) {
     const resolvedSystemPrompt = [inherit.systemPrompt, req.fork === true ? undefined : req.definition?.prompt].filter((s) => s !== undefined && s.length > 0).join(`
 
 `);
-    let serverAllocation = allocateChildScopedServers(childScopedMcpServers, parentVisibleServers(), undefined, parentMcp?.declaredServers);
+    let serverAllocation = allocateChildScopedServers(childScopedMcpServers, parentVisibleServers(), undefined, parentMcp?.declaredServers, deps.parentReservedMcpServerNames);
     pendingServerRelease = serverAllocation.release;
     definitionWarnings.push(...serverAllocation.notes);
     const firstTurnText = req.fork === true ? buildForkDirectiveText({ prompt: req.prompt, ...req.isolation === "worktree" ? { worktree: { parentRoot: inherit.sessionRoot, worktreeRoot: workspace.root } } : {} }) : [req.definition?.initialPrompt, req.prompt, definitionWarnings.length > 0 ? `
@@ -1093,7 +1106,7 @@ async function spawnChildEngine(req, inherit, runCtx, deps) {
         pendingResume = undefined;
         if (ticket.stopped)
           return { status: "unavailable", messageId: msg.messageId, retryable: false, reason: `child ${agentId} was stopped while resuming` };
-        serverAllocation = allocateChildScopedServers(childScopedMcpServers, parentVisibleServers(), previous, parentMcp?.declaredServers);
+        serverAllocation = allocateChildScopedServers(childScopedMcpServers, parentVisibleServers(), previous, parentMcp?.declaredServers, deps.parentReservedMcpServerNames);
         const moved = [...serverAllocation.actual].filter(([declared, name]) => previous.get(declared) !== name).map(([declared, name]) => `this agent's own "${declared}" is now connected as "${name}" (its tools are named mcp__${name}__<tool>)`);
         startGeneration(generationConfig(resumeMode), rebuilt, moved.length > 0 ? `${msg.body}
 
@@ -1159,6 +1172,8 @@ function registerDefaultChildEngineFactory(opts) {
     ...config.brand !== undefined ? { parentBrand: config.brand } : {},
     ...config.autoMemory !== undefined ? { parentAutoMemory: config.autoMemory } : {},
     ...config.web !== undefined ? { parentWeb: config.web } : {},
+    ...config.reservedMcpServerNames !== undefined ? { parentReservedMcpServerNames: config.reservedMcpServerNames } : {},
+    ...config.legacyToolNames !== undefined ? { parentLegacyToolNames: config.legacyToolNames } : {},
     ...opts.systemPromptAssembler !== undefined ? { systemPromptAssembler: opts.systemPromptAssembler } : {},
     ...opts.skillRuntime !== undefined ? { skillRuntime: opts.skillRuntime } : {},
     ...opts.structuredOutput !== undefined ? { structuredOutput: opts.structuredOutput } : {},
@@ -1264,7 +1279,7 @@ function createToolSecretResolver(deps) {
 }
 
 // src/provider/bridge.ts
-import { normalizeThrown, shouldRequestSummary, stripOpaque } from "@yanlinglabs/winter-provider-runtime";
+import { imageBudgetFor, normalizeThrown, shouldRequestSummary, stripOpaque, withinImageBudget } from "@yanlinglabs/winter-provider-runtime";
 function createIdentityHistoryRenderer() {
   return {
     render(messages, _chain, target) {
@@ -1299,9 +1314,14 @@ function adapterAsProvider(resolved, ctx, opts = {}) {
     modelKey: resolved.modelKey,
     ...Array.isArray(resolved.descriptor?.inputModalities?.value) ? { readsImages: resolved.descriptor.inputModalities.value.includes("image") } : {}
   };
+  const imageBudget = imageBudgetFor({
+    family: adapter.family,
+    providerId: resolved.providerId,
+    ...typeof resolved.descriptor?.contextWindow?.value === "number" ? { contextWindow: resolved.descriptor.contextWindow.value } : {}
+  });
   return {
     async generate(input) {
-      const rendered = renderer.render(input.messages, opts.chain?.() ?? new Map, target);
+      const rendered = withinImageBudget(renderer.render(input.messages, opts.chain?.() ?? new Map, target), imageBudget);
       const request = {
         model: input.model === undefined || input.model === resolved.modelKey ? resolved.providerModelId : input.model,
         messages: rendered,
@@ -1452,7 +1472,7 @@ async function foldProviderStream(stream, sink) {
           emitter.messageStop(event.stopReason);
           break;
         case "error":
-          throw providerErrorToTurnError(event.error, committed && !(event.error.contextOverflow === true && ordered.length === 0));
+          throw providerErrorToTurnError(event.error, committed && !((event.error.contextOverflow === true || event.error.imageOverflow === true) && ordered.length === 0));
       }
     }
   } catch (err) {
@@ -1604,7 +1624,8 @@ function providerErrorToTurnError(error, committed = false) {
     code: error.code,
     retryable: error.retryable,
     committed,
-    ...error.contextOverflow === true ? { contextOverflow: true } : {}
+    ...error.contextOverflow === true ? { contextOverflow: true } : {},
+    ...error.imageOverflow === true ? { imageOverflow: true } : {}
   });
 }
 function toProviderTurnError(err, committed = false) {
@@ -1618,7 +1639,14 @@ function toProviderTurnError(err, committed = false) {
   const message = raw.length > MAX_ERROR_MESSAGE_CHARS ? `${raw.slice(0, MAX_ERROR_MESSAGE_CHARS)}...` : raw;
   const normalized = normalizeThrown(err);
   const status = typeof err === "object" && err !== null && typeof err.status === "number" ? err.status : normalized.status;
-  return new ProviderTurnError(`provider request failed: ${message}`, { ...status !== undefined ? { status } : {}, code: normalized.code, retryable: normalized.retryable, committed });
+  return new ProviderTurnError(`provider request failed: ${message}`, {
+    ...status !== undefined ? { status } : {},
+    code: normalized.code,
+    retryable: normalized.retryable,
+    committed,
+    ...normalized.contextOverflow === true ? { contextOverflow: true } : {},
+    ...normalized.imageOverflow === true ? { imageOverflow: true } : {}
+  });
 }
 function stampNativeState(turn, origin) {
   if (turn.nativeState === undefined)

package/dist/index.js

@@ -2,11 +2,11 @@ import {
   createRpcBridge2,
   registerTool2,
   onCompaction2,
+  buildWorkflowWorkerSeatbeltProfile2,
   WinterPathsError2,
   sessionTempDir2,
   ensureTasksDir2,
   resolveProjectDirName2,
-  buildWorkflowWorkerSeatbeltProfile2,
   WORKFLOW_SANDBOX_REFUSED_EXIT_CODE2,
   DEFAULT_CONTEXT_WINDOW_TOKENS2,
   createContextAccountant2,
@@ -55,7 +55,7 @@ import {
   DEFAULT_CLASSIFIER_TIMEOUT_MS2,
   createModelClassifier2,
   selectClassifierRoute2
-} from "./index-q5jpx2mz.js";
+} from "./index-5xe59vkt.js";
 import"./index-1hef2gff.js";
 import"./index-mwew595z.js";
 import"./index-2wgfv0pa.js";

package/dist/mcp/control.d.ts

@@ -2,4 +2,5 @@ import type { McpControlSeam } from "./control-seam.js";
 import type { McpLifecycleInternals } from "./lifecycle.js";
 export declare function createMcpControlSeam(internals: McpLifecycleInternals, opts?: {
     reservedServerName?: string;
+    hostReservedServerNames?: readonly string[];
 }): McpControlSeam;

package/dist/mcp/lifecycle.d.ts

@@ -85,7 +85,10 @@ export declare function resolveMcpServerSources(sources: readonly McpServerSourc
     strictMcpConfig?: boolean;
     trustedWorkspace: boolean;
     reservedServerName?: string;
+    hostReservedServerNames?: readonly string[];
 }): ResolveMcpServerSourcesResult;
+/** The text budget of an MCP result that carries images (≈ the default `MAX_MCP_OUTPUT_TOKENS` of 25000 at 4 characters a token). */
+export declare const MCP_IMAGE_RESULT_TEXT_CHARS = 100000;
 export interface McpDiscoveryCache {
     get(key: string): McpToolInfo[] | undefined;
     set(key: string, tools: McpToolInfo[]): void;
@@ -109,6 +112,8 @@ export interface McpLifecycleDeps {
      * `addAndConnect` guard is the second door onto the same rule. Defaults to `WINTER_SERVER_NAME`.
      */
     reservedServerName?: string;
+    /** `RuntimeConfig.reservedMcpServerNames`, for the control seam's live `mcp_set_servers` guard: a non-sdk server is refused under any of them. */
+    hostReservedServerNames?: readonly string[];
     /** WS-23: the session cwd every stdio server of this lifecycle is spawned in (see `ConnectMcpServerOptions.cwd`). */
     cwd?: string;
     /**

package/dist/provider/mock.d.ts

@@ -27,7 +27,7 @@ export declare const P5_FIXTURE_SKILL_NAME = "p5probe";
  * `{"answer":"42","doubled":"4242"}` on every leg.
  */
 export declare const P5_WORKFLOW_SCRIPT: string;
-export type TestProviderName = "boom" | "tooluse" | "hang" | "reflect" | "modeswitch" | "bgtask" | "lanea" | "laneb" | "lanec" | "laned" | "lanee" | "mcpsdk" | "subagent" | "childmsg" | "subagentperm" | "toolsearch" | "p5compact" | "p5structured" | "p5structuredfail" | "p5skill" | "p5checkpoint" | "p5workflow";
+export type TestProviderName = "boom" | "tooluse" | "hang" | "reflect" | "modeswitch" | "bgtask" | "lanea" | "laneb" | "lanec" | "laned" | "lanee" | "mcpsdk" | "subagent" | "childmsg" | "subagentperm" | "toolsearch" | "p5compact" | "p5structured" | "p5structuredfail" | "p5skill" | "p5checkpoint" | "p5workflow" | "readimage" | "calls";
 export declare function isTestProviderName(v: string): v is TestProviderName;
 /**
  * The name the reserved `winter-test/<name>` namespace uses for the plain echo double.

package/dist/sandbox/profile.d.ts

@@ -43,6 +43,43 @@ export declare class SandboxConfigError extends Error {
 }
 export declare function resolveNetworkPosture(network: SandboxNetworkSettings | undefined): boolean;
 export declare function canonicalizePath(p: string): string;
+/**
+ * Fix round 14 (Winter-specific hardening, NOT itself a claude port -- empirically discovered and
+ * verified while implementing `buildReadDenyWritePermitBlock` above, disclosed prominently rather
+ * than smoothed over): `pR`'s own trailing re-permit is a BLANKET, UNCONDITIONAL
+ * `(allow file-write-unlink file-write-create (subpath <every write root>))`, ported faithfully per
+ * the controller's own explicit instruction. Real `sandbox-exec` runs proved this is not merely
+ * "narrower than a later wildcard deny wins" (round 13's own finding, about an EARLIER explicit deny
+ * surviving a LATER broad `file-write*` allow) -- it runs the OTHER direction too: an EARLIER
+ * EXPLICIT `file-write-unlink`/`file-write-create` ALLOW is not overridden by a LATER, broader
+ * `(deny file-write* ...)` for the SAME target either. Seatbelt appears to give a clause naming
+ * `file-write-unlink`/`file-write-create` explicitly priority over one that only reaches those
+ * operations via the `file-write*` wildcard, independent of which clause is textually first or last.
+ *
+ * Every OTHER Winter-owned write-protection floor in this module that used only the `file-write*`
+ * wildcard was therefore silently punched through for CREATE and UNLINK/RENAME specifically (never
+ * for `file-write-data`, `file-write-mode`, etc., which this re-permit never names) by this ONE new
+ * block: the control-plane carve-outs (WS-12 §5.2's own "the seatbelt is the only enforcement point
+ * left" floor -- verified empirically: `mkdir -p .winter && echo '{}' > .winter/permissions.local.json`
+ * and `rm .winter/settings.json` both SUCCEEDED against the unpatched fix), the checkpoint/backup
+ * store write-deny (T8 rider 25's own identical floor), and a GLOB-shaped `denyWrite` entry (a plain
+ * `denyWritePaths` entry was already safe -- `Ch`'s own write-side ancestor-rename block, round 12,
+ * already emits an explicit `(subpath <path>)` deny for it; `Ch`'s own GLOB branch, by contrast, only
+ * ever emits a `(literal <fixedPrefix>)` -- protecting the prefix DIRECTORY's own identity against a
+ * rename-shuffle, never the glob-matched files themselves).
+ *
+ * The fix, verified against real `sandbox-exec` (a `(deny file-write* file-write-unlink
+ * file-write-create (regex ...))` clause DOES win back the CREATE it needs to, confirmed by a direct
+ * before/after run rather than assumed): every one of those floors now names
+ * `file-write-unlink`/`file-write-create` EXPLICITLY, alongside the `file-write*` wildcard it already
+ * carried (for the OTHER write operations the wildcard alone still covers correctly) -- this constant
+ * is that shared operation-name list, applied wherever `file-write*` ALONE previously appeared on a
+ * deny this round's own re-permit could otherwise reach. `fR` (`buildReadDenyKeepInPlaceBlock`) is
+ * deliberately NOT touched here: it already names `file-write-unlink` explicitly (never `create`, by
+ * claude's own design -- see that function's own header), so it was never in the affected set.
+ */
+/** The runtime's image working directory under the winter/store home (tools/image-prep.ts) -- write-denied to the shell. */
+export declare const IMAGE_PREP_DIRNAME = "image-prep";
 /**
  * P7a fix r1 (Important-1): render ONE brand token as a case-insensitive, regex-escaped SBPL literal.
  *

package/dist/store/dialect.d.ts

@@ -478,7 +478,7 @@ export declare class TranscriptWriter implements SessionPersistence {
     private dialectRecord;
     static readBack(store: SessionStore, key: SessionKey): Promise<SessionStoreEntry[]>;
 }
-export declare const RUNTIME_ENGINE_VERSION = "0.0.35";
+export declare const RUNTIME_ENGINE_VERSION = "0.0.38";
 export interface ResolvedEngineSession {
     config: RuntimeConfig;
     store: SessionPersistence | undefined;

package/dist/subagents/child-engine.d.ts

@@ -130,6 +130,10 @@ export interface ChildEngineFactoryDeps {
      */
     parentAutoMemory?: RuntimeConfig["autoMemory"];
     parentWeb?: RuntimeConfig["web"];
+    /** `RuntimeConfig.reservedMcpServerNames`: an agent's own inline server never takes one (it is connected under a free name instead). */
+    parentReservedMcpServerNames?: RuntimeConfig["reservedMcpServerNames"];
+    /** `RuntimeConfig.legacyToolNames`, so a child resolves the host's old tool names as its parent does. */
+    parentLegacyToolNames?: RuntimeConfig["legacyToolNames"];
     /**
      * The session's pricing, stated-model and tool-secret seams, so a CHILD's engine has what its
      * parent's has. `priceUsage` is what makes a child's generations priced at all; the cost then
@@ -189,6 +193,27 @@ export interface ChildEngineFactoryDeps {
      */
     compactionControllerFactory?: () => CompactionController;
 }
+type ChildMcpServers = NonNullable<RuntimeConfig["mcpServers"]>;
+interface ChildServerAllocation {
+    /** The servers this generation connects itself, under the names it holds. */
+    servers: ChildMcpServers;
+    /** Declared name -> the name it is connected under (only for servers this generation connects). */
+    actual: Map<string, string>;
+    /** One legible line per server not connected under its declared name. */
+    notes: string[];
+    /**
+     * Declared names renamed because the HOST reserves them (`RuntimeConfig.reservedMcpServerNames`). Such a
+     * server is NOT "the server the definition named" for permission purposes: its declared spelling is the
+     * host's own server's, so it never becomes an extra identity (`mcpServerRenames`) — a saved rule on the
+     * host's `mcp__<reserved>__<tool>` must not reach it. Only its connected name governs it.
+     */
+    reservedRenames: Set<string>;
+    /** Releases every name this allocation claimed. Idempotent. */
+    release: () => void;
+}
+export declare function allocateChildScopedServers(declared: ChildMcpServers, parentVisible: ReadonlySet<string>, prefer?: ReadonlyMap<string, string>, parentDeclared?: Readonly<Record<string, {
+    type?: string;
+}>>, reserved?: readonly string[]): ChildServerAllocation;
 export declare function createChildEngineFactory(deps: ChildEngineFactoryDeps): ChildEngineFactory;
 /**
  * What a child reports when the SPENDING CEILING ended it (whole-branch review MINOR 9). One constant,
@@ -196,3 +221,4 @@ export declare function createChildEngineFactory(deps: ChildEngineFactoryDeps):
  * not be told a retry is worth trying: the ceiling is the session's, so a retry hits it again.
  */
 export declare const CHILD_BUDGET_STOP_TEXT = "The agent stopped because the session reached its spending limit (maxBudgetUsd), so no further model calls could be made. Retrying will not help -- continue with what it produced, or ask the user to raise the session's budget.";
+export {};

package/dist/testing.js

@@ -3,7 +3,7 @@ import {
   runEngine2,
   echoProvider2,
   resolveEngineSession2
-} from "./index-q5jpx2mz.js";
+} from "./index-5xe59vkt.js";
 import"./index-1hef2gff.js";
 import"./index-mwew595z.js";
 import"./index-2wgfv0pa.js";
@@ -14,7 +14,7 @@ import {
   buildProductionWiring,
   withAutoSkillPermissions,
   restoreChildRoster
-} from "./index-838n35xx.js";
+} from "./index-z3970wsj.js";
 import {
   Queue
 } from "./index-97t2rmtf.js";

package/dist/tools/descriptors/index.d.ts

@@ -48,6 +48,7 @@ import "./task-output.ts";
 import "./task-stop.ts";
 import "./task-update.ts";
 import "./todo-write.ts";
+import "./search.ts";
 import "./tool-search.ts";
 import "./wait-for-mcp-servers.ts";
 import "./web-fetch.ts";

package/dist/tools/descriptors/search.d.ts

@@ -0,0 +1,4 @@
+export declare const SEARCH_CANONICAL_NAME = "Search";
+export declare const SEARCH_ANSWER_CAPABILITY = "winter.search-answer";
+/** The Winter daemon's own description, verbatim (it is the interface the models were shown). */
+export declare const SEARCH_DESCRIPTION = "Search the web and get back a written answer with its sources, in a single call. Ask a real question, not keywords \u2014 a search engine answers it and the answer comes back already synthesized, followed by the pages it came from. Use it freely whenever a fact might be newer than you are, or when the user asks about something current, and cite the URLs you used.";

package/dist/tools/image-prep.d.ts

@@ -0,0 +1,208 @@
+import type { ToolResultBlock } from "./registry.js";
+/**
+ * The exact refusal a model with no image input gets (the host's composer shows the same words). Exported
+ * so a host or a test matches it rather than retyping it.
+ */
+export declare const MODEL_DOES_NOT_SUPPORT_IMAGES = "The selected model doesn't support images";
+/** The image types every provider adapter can carry (Anthropic, Bedrock, Gemini and OpenAI all accept exactly these four). */
+export declare const DELIVERABLE_IMAGE_TYPES: ReadonlySet<string>;
+/**
+ * The largest image handed to a model, in raw bytes: 3.75 MiB, whose base64 is exactly 5 MiB.
+ *
+ * The strictest per-image limit among the providers Winter drives: "5 MB (base64-encoded) on Amazon
+ * Bedrock and Google Cloud" for Claude (https://platform.claude.com/docs/en/build-with-claude/vision,
+ * "Request limits"; the Claude API itself takes 10 MB). An image over a provider's limit stays in the
+ * conversation and fails EVERY later request, so the limit is applied here, before the image enters
+ * history, not in an adapter. A SOURCE file may be larger (up to `IMAGE_MAX_INPUT_BYTES`): it is shrunk
+ * and, if it must be, re-encoded as JPEG to fit (`prepareImageForModel`).
+ */
+export declare const READ_IMAGE_MAX_BYTES = 3932160;
+/** The largest width or height any provider accepts: "The maximum dimensions per image are 8000x8000 px" (same page). */
+export declare const READ_IMAGE_MAX_DIMENSION = 8000;
+/** What the bytes actually are, from their magic numbers -- never trusting the extension. `undefined` when none matches. */
+export declare function sniffImageType(buf: Uint8Array): string | undefined;
+export declare function parsePngDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+export declare function parseGifDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+export declare function parseBmpDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+export declare function parseJpegDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/** WebP's canvas size from its VP8 (lossy), VP8L (lossless) or VP8X (extended) header. */
+export declare function parseWebpDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/** A TIFF's first image size, from its first IFD's ImageWidth (256) / ImageLength (257) tags (SHORT or LONG). */
+export declare function parseTiffDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/**
+ * A HEIC's size from its `ispe` (image spatial extents) boxes: the LARGEST one, since a grid image carries
+ * a small `ispe` per tile and one for the whole picture. A scan for well-formed `ispe` boxes (size 20,
+ * version/flags 0), not a full box walk; `sips -g`'s answer is taken too and the larger wins.
+ */
+export declare function parseHeicDimensions(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/**
+ * A GIF's size for the PIXEL CHECK: the larger of its logical screen and every frame's own descriptor --
+ * a tiny logical screen can front a frame that declares 60000x60000 px, and the decoder allocates for the
+ * frame.
+ */
+export declare function parseGifExtent(buf: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+export declare function parseImageDimensions(mediaType: string, bytes: Uint8Array): {
+    width: number;
+    height: number;
+} | undefined;
+/**
+ * The long edge an image is shrunk to before a model sees it: 1568 px, the size above which Claude's
+ * standard tier downsizes an image anyway ("Resolution and token cost",
+ * https://platform.claude.com/docs/en/build-with-claude/vision). Sending more only costs request bytes:
+ * the per-request limits (32 MB on the Claude API, 20 MB of inline data on Gemini) fill up after a few
+ * full-size screenshots, and past 20 images Anthropic refuses any image over 2000 px. At 1568 none of
+ * that is reached by an ordinary session.
+ */
+export declare const IMAGE_MAX_LONG_EDGE = 1568;
+/** The largest file Read or an MCP result may hand the resizer at all (a guard against absurd inputs, not a provider limit). */
+export declare const IMAGE_MAX_INPUT_BYTES: number;
+/**
+ * The most pixels an image may DECLARE before anything decodes it: 100 megapixels. A few-kilobyte PNG can
+ * declare 40000x40000 px, and decoding that (sips does, to resize it) takes gigabytes; a declared size is
+ * all a header costs. 100 MP is above any camera or screenshot in ordinary use (a 12K frame is ~80 MP).
+ */
+export declare const IMAGE_MAX_PIXELS = 100000000;
+/** An image ready for a model: the bytes to send, and what happened to them on the way. */
+export interface PreparedImage {
+    ok: true;
+    mediaType: string;
+    bytes: Buffer;
+    width?: number;
+    height?: number;
+    /** The source as found. */
+    original: {
+        mediaType: string;
+        bytes: number;
+        width?: number;
+        height?: number;
+    };
+    /** True when the pixels were scaled down. */
+    resized: boolean;
+    /** Set when the format changed (a conversion, or a JPEG re-encode to fit the byte limit): the quality used for a JPEG. */
+    jpegQuality?: number;
+}
+export type ImagePreparation = PreparedImage | {
+    ok: false;
+    reason: string;
+};
+export interface PrepareImageOptions {
+    /**
+     * The runtime-owned directory the per-call working directory is made in: `<winter or store home>/
+     * image-prep` (`imagePrepWorkRoot`), which the Bash sandbox's seatbelt profile write-denies
+     * (sandbox/profile.ts, `IMAGE_PREP_DIRNAME`) -- NEVER the session temp dir, which a sandboxed shell can
+     * write (a link planted there would make `sips` write through it). A getter, read only when `sips`
+     * actually runs. `undefined`: no private place to work, so nothing is converted or resized.
+     */
+    workRoot: () => string | undefined;
+    /** Test seam: the `sips` binary (a missing path simulates a platform without it). Default `/usr/bin/sips`. */
+    sipsPath?: string;
+    /** Test seam: the byte limit. Default `READ_IMAGE_MAX_BYTES`. */
+    maxBytes?: number;
+    /** The turn's abort: an interrupt kills a running `sips`. */
+    signal?: AbortSignal;
+}
+/** A short, model-facing description of what happened, e.g. `image/png, 25856 bytes, 1568x1018, resized from 3024x1964`. */
+export declare function describePreparedImage(image: PreparedImage): string;
+/**
+ * Reads `path` only if it is a regular file, and never through a link: `O_NOFOLLOW` refuses a symlink at
+ * open time, and the type is checked on the OPENED descriptor, so nothing can be swapped in between the
+ * check and the read. `undefined` for anything else (a link, a directory, a missing file).
+ */
+export declare function readRegularFileNoFollow(path: string): Buffer | undefined;
+/**
+ * Where image work happens for a session: `<store home or winter home>/image-prep` -- the two anchors the
+ * seatbelt profile write-denies `image-prep` under, both handed to a session EXPLICITLY by its host. With
+ * neither, `undefined`: nothing is resized or converted (an image already within every limit is still
+ * sent as it is). There is deliberately NO fallback, and here is why each candidate is unsafe:
+ *   - `~/<homeDirName>`: a guess at the user's real winter home, which a process given no home must not
+ *     write into (and which a test would reach);
+ *   - the session temp dir, the cwd, the outputs dir and any `allowWrite` entry: sandbox-WRITABLE roots,
+ *     where a sandboxed command could plant a link;
+ *   - `$TMPDIR` (the per-user temp dir): its DIRECT children are sandbox-writable (the profile's mktemp
+ *     allowance), so a folder made there could be renamed away and replaced by a link mid-run.
+ */
+export declare function imagePrepWorkRoot(ctx: {
+    storeHome?: string;
+    winterHome?: string;
+}): string | undefined;
+/**
+ * How many frames a GIF holds (image descriptors), walking its block structure; `undefined` when the
+ * structure cannot be walked. OpenAI takes only a "non-animated GIF"
+ * (https://developers.openai.com/api/docs/guides/images-vision) and Claude reads only the first frame.
+ */
+export declare function gifFrameCount(buf: Uint8Array): number | undefined;
+/** Every frame's own size (its image descriptor), in order; `undefined` when the structure cannot be walked to its end. */
+export declare function gifFrameSizes(buf: Uint8Array): Array<{
+    width: number;
+    height: number;
+}> | undefined;
+/**
+ * Makes `source` ready for a model, or says why it cannot be.
+ *
+ * - The type is SNIFFED from the bytes; something that is none of PNG/JPEG/GIF/WebP/BMP/TIFF/HEIC is refused.
+ * - An image whose long edge is over `IMAGE_MAX_LONG_EDGE` is scaled down to it (aspect kept).
+ * - The format is kept where a provider takes it: PNG stays PNG and JPEG stays JPEG (quality 85 when
+ *   re-encoded). `sips` cannot WRITE WebP, so a WebP that has to be rewritten becomes PNG. EVERY GIF
+ *   becomes PNG (its first frame): Gemini reads no GIF, OpenAI no animated one, Claude only the first
+ *   frame. BMP and TIFF, which no provider takes, become PNG; HEIC (a camera photo) becomes JPEG. A WebP
+ *   that needs no rewrite is sent as it is.
+ * - An image DECLARING more than `IMAGE_MAX_PIXELS` is refused before anything decodes it.
+ * - Still over `READ_IMAGE_MAX_BYTES`? Re-encoded as JPEG at quality 85, 70, 55, then 40; still over,
+ *   refused. Never truncated.
+ * - Without `sips`, or when it fails: the image as it is if it is already a deliverable type within the
+ *   byte limit and `READ_IMAGE_MAX_DIMENSION` (and, for a GIF, a single frame), else a refusal naming the
+ *   reason.
+ * - `sips` works in a FRESH private directory per call (`mkdtemp`) under `imagePrepWorkRoot` -- a tree
+ *   the Bash sandbox is denied writing to, so no link can be planted where `sips` writes -- its input is
+ *   written with `wx`, and its output is read through `readRegularFileNoFollow` (no link, no swap).
+ */
+export declare function prepareImageForModel(source: Buffer, opts: PrepareImageOptions): Promise<ImagePreparation>;
+/** One part of a result before it is made model-ready: text, or an image's raw bytes. */
+export type RawResultPart = {
+    type: "text";
+    text: string;
+} | {
+    type: "image";
+    bytes: Buffer;
+};
+export interface ModelResult {
+    /** The model-facing blocks, in order (adjacent text merged). */
+    blocks: ToolResultBlock[];
+    /** A text rendering of the same result (each image as `[image: …]`) -- for hooks, logs and a text-only reader. */
+    text: string;
+    /** True when at least one image block survived. */
+    hasImage: boolean;
+}
+/**
+ * Makes a mixed text/image result model-ready: every image goes through `prepareImageForModel`, and an
+ * image that cannot be shown -- a text-only model (`readsImages: false`), a refusal, or images past the
+ * result's total of `maxBytes` -- becomes a one-line `[image omitted: …]` note IN ITS PLACE, never
+ * dropped and never base64 text.
+ */
+export declare function resultBlocksForModel(parts: readonly RawResultPart[], opts: PrepareImageOptions & {
+    readsImages: boolean;
+}): Promise<ModelResult>;

package/dist/tools/image-test-fixtures.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A real, decodable 8-bit RGB PNG of `width` x `height`. `noise: true` fills it with random pixels (it
+ * does not compress, so it is large); otherwise a repeating gradient (tiny once compressed).
+ */
+export declare function realPng(width: number, height: number, opts?: {
+    noise?: boolean;
+}): Buffer;

package/dist/tools/impl/_exa-client.d.ts

@@ -31,6 +31,8 @@ export interface ExaSearchHit {
     /** The result's highlight text, capped at `EXA_HIGHLIGHTS_MAX_CHARACTERS`. Empty when the backend sent none. */
     highlight: string;
     publishedDate?: string;
+    /** The result's `favicon` when the backend sent one (Exa's /search reference: "The URL of the favicon for the search result's domain"), https only. Never model-visible: `WebSearch` hands it to the HOST as `ToolResultPayload.siteIcons`. Absent from the basic text form and, as measured 2026-09-18, from the advanced JSON form too -- read when present. */
+    favicon?: string;
 }
 export interface ExaSearchParams {
     query: string;