@yanlinglabs/winter-agent-runtime 0.0.38 → 0.0.40

package/dist/{index-8x4yjdg7.js → index-r7yjcppm.js}

@@ -9,14 +9,14 @@ import {
   resolveEngineSession2,
   resolveProductionWinterHome2,
   resolveProductionStoreHome
-} from "./index-5xe59vkt.js";
+} from "./index-a8j104mg.js";
 import {
   registerDefaultChildEngineFactory,
   loadResumedChain,
   buildProductionWiring,
   withAutoSkillPermissions,
   restoreChildRoster
-} from "./index-z3970wsj.js";
+} from "./index-rhxkckyn.js";
 
 // src/embedded.ts
 import { splitFrames, encodeFrame } from "@yanlinglabs/winter-agent-sdk";

package/dist/{index-z3970wsj.js → index-rhxkckyn.js}

@@ -60,6 +60,7 @@ import {
   autoSkillPermissionEntries,
   listWorkflowsForListing,
   buildWorkflowSkillPrompt,
+  createToolLaneTails,
   ProviderTurnError,
   isProviderTurnError,
   createContextAccountant2,
@@ -85,7 +86,7 @@ import {
   providerCredentialRef2,
   createModelClassifier2,
   selectClassifierRoute2
-} from "./index-5xe59vkt.js";
+} from "./index-a8j104mg.js";
 import {
   createKeychainCredentialStore,
   createKeychainSecretReader,
@@ -797,6 +798,7 @@ async function spawnChildEngine(req, inherit, runCtx, deps) {
           ...runCtx.budgetExceeded !== undefined ? { ancestorBudgetExceeded: () => runCtx.budgetExceeded() } : {},
           ...deps.resolveAuxiliaryModel !== undefined ? { resolveAuxiliaryModel: deps.resolveAuxiliaryModel } : {},
           ...deps.resolveToolSecret !== undefined ? { resolveToolSecret: deps.resolveToolSecret } : {},
+          ...deps.toolLaneTails !== undefined ? { toolLaneTails: deps.toolLaneTails } : {},
           ...deps.settingsRules !== undefined ? { settingsRules: deps.settingsRules } : {},
           ...childDurableRoot !== undefined ? { winterHome: childDurableRoot } : {},
           ...deps.structuredOutput !== undefined ? { structuredOutput: deps.structuredOutput } : {},
@@ -1186,7 +1188,8 @@ function registerDefaultChildEngineFactory(opts) {
     ...opts.priceUsage !== undefined ? { priceUsage: opts.priceUsage } : {},
     ...opts.usageRowFacts !== undefined ? { usageRowFacts: opts.usageRowFacts } : {},
     ...opts.resolveAuxiliaryModel !== undefined ? { resolveAuxiliaryModel: opts.resolveAuxiliaryModel } : {},
-    ...opts.resolveToolSecret !== undefined ? { resolveToolSecret: opts.resolveToolSecret } : {}
+    ...opts.resolveToolSecret !== undefined ? { resolveToolSecret: opts.resolveToolSecret } : {},
+    ...opts.toolLaneTails !== undefined ? { toolLaneTails: opts.toolLaneTails } : {}
   }));
 }
 
@@ -5888,6 +5891,7 @@ async function buildProductionWiring(opts) {
     ...pluginCacheDir !== undefined ? { pluginCacheDir } : {},
     ...mergedSandbox !== undefined ? { sandbox: mergedSandbox } : {}
   };
+  const toolLaneTails = createToolLaneTails();
   return {
     providerWiring,
     settingsEnv,
@@ -5944,6 +5948,7 @@ async function buildProductionWiring(opts) {
       ...providerWiring.resolveReviewer !== undefined ? { resolveReviewer: providerWiring.resolveReviewer } : {},
       ...providerWiring.resolveAuxiliaryModel !== undefined ? { resolveAuxiliaryModel: providerWiring.resolveAuxiliaryModel } : {},
       resolveToolSecret: providerWiring.resolveToolSecret,
+      toolLaneTails,
       ...providerWiring.providerSupportsToolSearch !== undefined ? { providerSupportsToolSearch: providerWiring.providerSupportsToolSearch } : {},
       ...providerWiring.classifier !== undefined ? { classifier: providerWiring.classifier } : {},
       systemPromptAssembler,
@@ -5973,6 +5978,7 @@ async function buildProductionWiring(opts) {
       priceUsage: (modelKey, usage) => providerWiring.priceUsage(modelKey, usage),
       usageRowFacts: (modelKey) => providerWiring.usageRowFacts(modelKey),
       resolveToolSecret: providerWiring.resolveToolSecret,
+      toolLaneTails,
       ...providerWiring.resolveAuxiliaryModel !== undefined ? { resolveAuxiliaryModel: providerWiring.resolveAuxiliaryModel } : {},
       settingsRules,
       structuredOutput,

package/dist/index.js

@@ -55,7 +55,7 @@ import {
   DEFAULT_CLASSIFIER_TIMEOUT_MS2,
   createModelClassifier2,
   selectClassifierRoute2
-} from "./index-5xe59vkt.js";
+} from "./index-a8j104mg.js";
 import"./index-1hef2gff.js";
 import"./index-mwew595z.js";
 import"./index-2wgfv0pa.js";

package/dist/messaging/host-port.d.ts

@@ -0,0 +1,19 @@
+import { type HostMessagingPort } from "@yanlinglabs/winter-agent-sdk/messaging";
+import type { RpcBridge } from "../rpc/bridge.js";
+/**
+ * How long one delivery may take. Generous on purpose: a host may RESUME a finished session for the
+ * message (start its runtime, replay its transcript, connect its MCP servers) before it can answer. A
+ * timeout is `delivery_uncertain`, never `not_found` -- by then the host may well have delivered.
+ */
+export declare const HOST_MESSAGE_SEND_TIMEOUT_MS = 180000;
+/** How long a listing may take; a slow one lists nothing more (ListAgents still shows the subagents). */
+export declare const HOST_MESSAGE_LIST_TIMEOUT_MS = 15000;
+/** How long a session stop may take (an interrupt is quick; the host answers once it is requested). */
+export declare const HOST_SESSION_STOP_TIMEOUT_MS = 30000;
+/** Thrown for a malformed send answer, so the router core reports it as `delivery_uncertain`. */
+export declare class HostMessagingAnswerError extends Error {
+    constructor(message: string);
+}
+/** The bridge's own `request`, whose options carry the `signal` the host requests ride. */
+export type HostMessagingSender = Pick<RpcBridge, "request">;
+export declare function createHostMessagingPort(sender: HostMessagingSender): HostMessagingPort;

package/dist/messaging/reference-adapter.d.ts

@@ -1,5 +1,5 @@
 import type { PermissionMode } from "@yanlinglabs/winter-agent-sdk";
-import { type ChildLike, type RuntimeAddress, type DeliveryOutcome, type GlobalAgentMessage, type RuntimeMessagingAdapter, type CrossSessionInbound, type NotificationQueue, type MessagingRouterSeamWithRoster, type MessagingRuntimeDeps, type SubscriberDirectory } from "@yanlinglabs/winter-agent-sdk/messaging";
+import { type ChildLike, type RuntimeAddress, type DeliveryOutcome, type GlobalAgentMessage, type RuntimeMessagingAdapter, type CrossSessionInbound, type NotificationQueue, type MessagingRouterSeamWithRoster, type MessagingRuntimeDeps, type SubscriberDirectory, type HostMessagingPort } from "@yanlinglabs/winter-agent-sdk/messaging";
 export interface PeerSessionHandle {
     readonly address: RuntimeAddress;
     readonly name?: string;
@@ -41,6 +41,13 @@ export interface DefaultMessagingRuntime extends MessagingRuntimeDeps {
     adapter: ReferenceMessagingAdapter;
     peers: PeerDirectory;
     seam: MessagingRouterSeamWithRoster;
+    /**
+     * Host messaging: register `port` as the host line of the OWNING session `sessionId` (a top-level run
+     * whose config says `hostMessaging: true`). Returns the withdrawal, which removes only this exact
+     * registration. Keyed by session, never one process slot: the in-memory leg runs several sessions in
+     * one realm, and each must reach only its own host handler.
+     */
+    registerHostMessagingPort(sessionId: string, port: HostMessagingPort): () => void;
 }
 /**
  * R-7b-4: THIS RUNTIME's answer to "was that throw a policy refusal, or a crash window?"

package/dist/permissions/bash-read-only.d.ts

@@ -0,0 +1,26 @@
+type Platform = typeof process.platform;
+export interface BashReadOnlyContext {
+    /** The session's current working directory (where the command runs). */
+    cwd: string;
+    /** The directory the session started in. */
+    originalCwd: string;
+    /** Whether the Bash sandbox is on for this call. */
+    sandboxEnabled: boolean;
+}
+/** True when `command` is provably read-only, which is exactly when a Bash call may run concurrently. */
+export declare function isBashCommandReadOnly(command: string, ctx: BashReadOnlyContext): boolean;
+/**
+ * True when `cwd` holds a bare repository's own markers -- a `HEAD` file, an `objects/` or a `refs/`
+ * directory -- and no working `.git` (a `.git` FILE, as in a worktree or submodule, or a `.git`
+ * directory with a regular `HEAD` file) that git would find first. git would then use `cwd` itself as
+ * the repository and could run hooks planted there.
+ */
+export declare function isCurrentDirectoryBareGitRepo(cwd: string): boolean;
+/**
+ * True on Windows when `text` names a UNC or WebDAV location, which Windows opens by reaching out over
+ * the network (and authenticating). Any run of two or more path separators -- `\\`, `//`, or a mix
+ * such as `/\\` -- followed directly by a host-like character counts, except the `//` of a URL scheme
+ * (`https://…`). STRICTER: a mixed pair such as `/\host` counts too.
+ */
+export declare function containsVulnerableUncPath(text: string, platform?: Platform): boolean;
+export {};

package/dist/permissions/grammar.d.ts

@@ -36,6 +36,13 @@ export declare function leadingWord(s: string): {
  */
 export declare function joinLineContinuations(command: string): string;
 export declare function splitCompound(rawCommand: string): string[] | null;
+/**
+ * The command a wrapper-prefixed (sub)command really runs: leading assignments and the fixed wrappers
+ * (`timeout 5`, `nice -n 5`, flag-free `xargs`, ...) looked through, per `direction` (see the module
+ * header). Any file-writing redirection that was part of the looked-through words is appended, so
+ * every redirect scan of the result still sees it. For an allow whose wrapper word is spelled so that
+ * only the broad reading names a wrapper (`"\timeout" …`), the command is returned as written.
+ */
 export declare function stripWrappers(rawCmd: string, direction: "allow" | "denyAsk"): string;
 /** One word of a command: its text after quote removal, as written, and whether any of it was quoted. */
 export interface ShellWord {
@@ -43,16 +50,35 @@ export interface ShellWord {
     raw: string;
     quoted: boolean;
 }
+/**
+ * How a backslash inside double quotes is read.
+ *
+ * - `"bash"`: exactly as bash does. Inside `"…"` a backslash escapes only `$`, `` ` ``, `"`, `\` and a
+ *   newline (backslash-newline is a line continuation: both characters vanish); before any other
+ *   character the backslash is kept, so `"\-o"` is the word `\-o` and `"a\b"` is `a\b`.
+ * - `"broad"`: the backslash is dropped before every character, so `"\-o"` reads `-o`. Not what bash
+ *   runs, but a superset view for the permission layer's deny rules and write floors: a spelling
+ *   like `"\.git/config"` or `sort "\-o"` is still matched against `.git/config` / `sort -o`.
+ *
+ * Outside quotes a backslash escapes the next character (backslash-newline vanishes) and inside single
+ * quotes nothing is special, in both readings.
+ */
+export type QuoteReading = "bash" | "broad";
 /**
  * bash's quote removal (and, with `split`, its word splitting at unquoted blanks) over one command's
- * text: single quotes, double quotes (a backslash there drops -- stricter than bash, which keeps it
- * before an ordinary character, and never naming a DIFFERENT protected file), backslash escapes,
- * ANSI-C `$'…'` (decoded) and locale `$"…"` (as double quotes). Expansions are left as written. An
- * unterminated quote runs to the end.
+ * text: single quotes, double quotes (a backslash inside them per `reading` -- see `QuoteReading`;
+ * the default `"broad"` is what the permission layer's deny rules and write floors read), backslash
+ * escapes, ANSI-C `$'…'` (decoded) and locale `$"…"` (as double quotes). Expansions are left as
+ * written. An unterminated quote runs to the end.
  */
-export declare function shellWords(s: string, split?: boolean): ShellWord[];
-/** `word` after bash's quote removal, as ONE word (blanks inside it are kept). */
+export declare function shellWords(s: string, split?: boolean, reading?: QuoteReading): ShellWord[];
+/** `word` after bash's quote removal, exactly as bash reads it, as ONE word (blanks inside it are kept). */
 export declare function dequoteShellWord(word: string): string;
+/**
+ * `word` in bash's reading and, when it differs, the broad one (see `QuoteReading`) -- for deny-side
+ * checks and write floors, which must judge every file the word could be taken to name.
+ */
+export declare function shellWordReadings(word: string): string[];
 /** One file-writing redirection: the target word as written (`raw`) and after bash's quote removal. */
 export interface RedirectWrite {
     raw: string;

package/dist/production-wiring.d.ts

@@ -241,6 +241,8 @@ export interface ProductionWiring {
          */
         resolveAuxiliaryModel?: NonNullable<EngineOptions["resolveAuxiliaryModel"]>;
         resolveToolSecret: NonNullable<EngineOptions["resolveToolSecret"]>;
+        /** SDK 0.0.40: the session's concurrency lanes -- the SAME map `childFactoryOptions.toolLaneTails` carries. */
+        toolLaneTails: NonNullable<EngineOptions["toolLaneTails"]>;
     };
     /**
      * Mirrors handed to `registerDefaultChildEngineFactory`, so a CHILD engine gets the same context
@@ -261,7 +263,7 @@ export interface ProductionWiring {
      * Adding a mirror is therefore now a two-file edit by construction: declare it on
      * `DefaultChildEngineFactoryOptions` first, then produce it here.
      */
-    childFactoryOptions: Required<Pick<DefaultChildEngineFactoryOptions, "systemPromptAssembler" | "skillRuntime" | "skillListing" | "settingsRules" | "structuredOutput" | "extraHookEntries" | "compactionControllerFactory" | "resolveChildProvider" | "describeModel" | "priceUsage" | "usageRowFacts" | "resolveToolSecret">> & Pick<DefaultChildEngineFactoryOptions, "resolveAuxiliaryModel">;
+    childFactoryOptions: Required<Pick<DefaultChildEngineFactoryOptions, "systemPromptAssembler" | "skillRuntime" | "skillListing" | "settingsRules" | "structuredOutput" | "extraHookEntries" | "compactionControllerFactory" | "resolveChildProvider" | "describeModel" | "priceUsage" | "usageRowFacts" | "resolveToolSecret" | "toolLaneTails">> & Pick<DefaultChildEngineFactoryOptions, "resolveAuxiliaryModel">;
     /**
      * Phase 6 Task 10: the session's provider, and everything resolved with it.
      *

package/dist/rpc/bridge.d.ts

@@ -5,6 +5,7 @@ export interface RpcBridge {
         timeoutMs?: number;
         requestId?: string;
         signal?: AbortSignal;
+        cancelGraceMs?: number;
     }): Promise<T>;
     handleResponse(frame: ControlResponseFrame): boolean;
     ownsRequest(requestId: string): boolean;

package/dist/store/dialect.d.ts

@@ -478,7 +478,7 @@ export declare class TranscriptWriter implements SessionPersistence {
     private dialectRecord;
     static readBack(store: SessionStore, key: SessionKey): Promise<SessionStoreEntry[]>;
 }
-export declare const RUNTIME_ENGINE_VERSION = "0.0.38";
+export declare const RUNTIME_ENGINE_VERSION = "0.0.40";
 export interface ResolvedEngineSession {
     config: RuntimeConfig;
     store: SessionPersistence | undefined;

package/dist/subagents/child-engine.d.ts

@@ -146,6 +146,8 @@ export interface ChildEngineFactoryDeps {
     usageRowFacts?: EngineOptions["usageRowFacts"];
     resolveAuxiliaryModel?: EngineOptions["resolveAuxiliaryModel"];
     resolveToolSecret?: EngineOptions["resolveToolSecret"];
+    /** SDK 0.0.40: the SESSION's concurrency lanes, the same map the top-level engine runs with -- see `EngineOptions.toolLaneTails`. */
+    toolLaneTails?: EngineOptions["toolLaneTails"];
     getParentPolicy?: () => {
         mode: PermissionMode;
         version: number;

package/dist/subagents/register-default-factory.d.ts

@@ -62,5 +62,7 @@ export interface DefaultChildEngineFactoryOptions {
     usageRowFacts?: EngineOptions["usageRowFacts"];
     resolveAuxiliaryModel?: EngineOptions["resolveAuxiliaryModel"];
     resolveToolSecret?: EngineOptions["resolveToolSecret"];
+    /** SDK 0.0.40: the session's concurrency lanes -- see `ChildEngineFactoryDeps.toolLaneTails`. */
+    toolLaneTails?: EngineOptions["toolLaneTails"];
 }
 export declare function registerDefaultChildEngineFactory(opts: DefaultChildEngineFactoryOptions): void;

package/dist/testing.js

@@ -3,7 +3,7 @@ import {
   runEngine2,
   echoProvider2,
   resolveEngineSession2
-} from "./index-5xe59vkt.js";
+} from "./index-a8j104mg.js";
 import"./index-1hef2gff.js";
 import"./index-mwew595z.js";
 import"./index-2wgfv0pa.js";
@@ -14,7 +14,7 @@ import {
   buildProductionWiring,
   withAutoSkillPermissions,
   restoreChildRoster
-} from "./index-z3970wsj.js";
+} from "./index-rhxkckyn.js";
 import {
   Queue
 } from "./index-97t2rmtf.js";

package/dist/tools/concurrency.d.ts

@@ -0,0 +1,48 @@
+/** At most this many concurrent/lane calls of one round run at once (claude's default). */
+export declare const MAX_TOOL_CONCURRENCY = 10;
+/** The built-ins that always run concurrently, by canonical name. */
+export declare const CONCURRENCY_SAFE_BUILTINS: ReadonlySet<string>;
+/** What `Bash`'s read-only classification needs to know about the session (claude reads the same three). */
+export interface BashReadOnlyContext {
+    cwd: string;
+    originalCwd: string;
+    sandboxEnabled: boolean;
+}
+export type CallScheduling = {
+    kind: "concurrent";
+} | {
+    kind: "lane";
+    lane: string;
+} | {
+    kind: "serial";
+};
+/** How a call to `name` (the registered name it will run as) with `input` is scheduled. */
+export declare function schedulingForCall(name: string, input: unknown, bash?: BashReadOnlyContext): CallScheduling;
+/**
+ * A SESSION's lanes: for each lane, the last call that entered it (settling once that call is done).
+ *
+ * One map per session, shared by the top-level engine and every subagent engine of the session (it rides
+ * `EngineOptions.toolLaneTails` and the child-engine factory's deps), so a lane is exclusive across the
+ * whole session -- two concurrent subagents, or a parent and its subagent, never run the same lane at once.
+ * A call enters its lane only once its OWN checks are done -- hook stop, permission, any approval card --
+ * so a call parked on a card holds no lane. One engine's calls finish their checks one at a time in call
+ * order, so they enter a lane in call order; across engines, in the order their calls became ready. A call
+ * holds its lane until it is done AND its execution has really stopped: an interrupted in-process host tool
+ * keeps the lane until the host answers the cancel, or `SDK_MCP_CANCEL_GRACE_MS` runs out. Never rejects.
+ */
+export type ToolLaneTails = Map<string, Promise<unknown>>;
+/**
+ * How long an interrupted `sdk_mcp_call` stays pending after its `control_cancel_request`, waiting for the
+ * host to answer that the tool stopped (a host that answers nothing after a cancel -- an older SDK -- costs
+ * the lane this long). Until it settles, the call's concurrency lane stays held.
+ */
+export declare const SDK_MCP_CANCEL_GRACE_MS = 5000;
+/** A fresh, empty set of lanes for one session. */
+export declare function createToolLaneTails(): ToolLaneTails;
+/**
+ * Enter `lane` with `tail` (a call's never-rejecting settle): returns the previous tail to wait for, if any,
+ * and drops the entry once `tail` settles while it is still the lane's last call (no unbounded growth).
+ */
+export declare function enterToolLane(lanes: ToolLaneTails, lane: string, tail: Promise<unknown>): Promise<unknown> | undefined;
+/** Whether a call to `name` always runs beside other concurrent calls (no lane, no input-dependence). */
+export declare function isConcurrencySafeTool(name: string): boolean;

package/dist/tools/impl/task-stop.d.ts

@@ -8,4 +8,6 @@ declare function parseTaskStopInput(input: unknown): TaskStopInput | {
     error: string;
 };
 declare const taskStopExecutor: ToolExecutor;
+/** `task_type` for a host session in TaskStop's pinned result shape. */
+export declare const HOST_SESSION_TASK_TYPE = "session";
 export { parseTaskStopInput, taskStopExecutor };

package/dist/tools/registry.d.ts

@@ -62,6 +62,7 @@ export interface ToolDescriptor {
     disposition: ToolDisposition;
     versionIntroduced?: string;
     deferred?: boolean | readonly PermissionMode[];
+    concurrencyLane?: string;
     alwaysLoad?: boolean;
     _meta?: Record<string, unknown>;
     interaction?: "required";
@@ -351,10 +352,22 @@ export declare function rebrandStandingServerTools(renames: ReadonlyArray<{
     from: string;
     to: string;
 }>, serverName: string): () => void;
+/**
+ * SDK 0.0.40: a HOST's concurrency lanes for some of one in-process server's tools
+ * (`McpSdkServerConfig.toolLanes`): server tool name -> lane key. A tool in a lane runs BESIDE the round's
+ * other calls (it is not a barrier) but one at a time WITHIN its lane, in call order -- e.g. two `Computer`
+ * calls never overlap, while a `Computer` call and a `Browser` call (another lane) and any read-only call
+ * may. Only an in-process (`sdk`) server carries lanes: the host vouches for its own tools. A lane key is
+ * 1-64 characters of `[A-Za-z0-9_.:-]`; anything else is ignored (the tool stays serial).
+ */
+export type McpServerToolLanes = Readonly<Record<string, string>>;
+/** Whether `lane` is a usable concurrency-lane key. */
+export declare function isValidConcurrencyLane(lane: unknown): lane is string;
 export declare function registerMcpServerTools(server: string, incomingTools: readonly McpToolDefinition[], opts: {
     alwaysLoad?: boolean;
     deferredDefault: boolean | readonly PermissionMode[];
     toolNames?: McpServerToolNames;
+    toolLanes?: McpServerToolLanes;
 }): void;
 /**
  * Fix round 20: the live MCP server that registered `canonicalName` through `registerMcpServerTools`,

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.0.38";
+export declare const RUNTIME_VERSION = "0.0.40";

package/dist/version.js

@@ -1,5 +1,5 @@
 // src/version.ts
-var RUNTIME_VERSION = "0.0.38";
+var RUNTIME_VERSION = "0.0.40";
 export {
   RUNTIME_VERSION
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yanlinglabs/winter-agent-runtime",
-  "version": "0.0.38",
+  "version": "0.0.40",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -73,9 +73,9 @@
     "@modelcontextprotocol/client": "^2.1.0",
     "ajv": "^8.20.0",
     "ignore": "7.0.5",
-    "@yanlinglabs/winter-agent-sdk": "0.0.38",
-    "@yanlinglabs/winter-provider-runtime": "0.0.38",
-    "@yanlinglabs/winter-provider-catalog": "0.0.38"
+    "@yanlinglabs/winter-provider-catalog": "0.0.40",
+    "@yanlinglabs/winter-provider-runtime": "0.0.40",
+    "@yanlinglabs/winter-agent-sdk": "0.0.40"
   },
   "devDependencies": {
     "@modelcontextprotocol/server": "^2.1.0"