agent-afk 5.107.0 → 5.107.2

package/dist/agent/providers/anthropic-direct/provider-runtime.d.ts

@@ -3,6 +3,7 @@ export { resolveEffort, resolveMaxTokens, resolveThinkingParam } from './resolve
 import { type AnthropicDirectProviderOptions } from './provider-options.js';
 export { __setAnthropicClientFactory, type AnthropicClientFactory, type AnthropicDirectProviderOptions, } from './provider-options.js';
 export { resolveUserSystem } from './provider-query-setup.js';
+export declare const DEFAULT_MODEL = "claude-sonnet-4-6";
 export declare class AnthropicDirectProvider implements ModelProvider {
     readonly name = "anthropic-direct";
     private readonly externalTools;

package/dist/agent/tools/handlers/_rg-exit2.d.ts

@@ -0,0 +1,11 @@
+import type { ToolFailureClass } from '../../trace/types.js';
+export interface GrepSettleResult {
+    content: string;
+    isError?: boolean;
+    truncated?: boolean;
+    failureClass?: ToolFailureClass;
+}
+export type RgExit2Result = GrepSettleResult & {
+    isError: true;
+};
+export declare function classifyRgExit2(stderr: string, searchPath: string): RgExit2Result;

package/dist/agent/trace/events.d.ts

@@ -16,6 +16,7 @@ export declare const ToolFailureClassSchema: z.ZodEnum<{
     "elicitation-declined": "elicitation-declined";
     "denial-breaker": "denial-breaker";
     "repeat-failure": "repeat-failure";
+    "no-such-target": "no-such-target";
 }>;
 export declare const ToolCallCompletedPayloadSchema: z.ZodObject<{
     phase: z.ZodLiteral<"completed">;
@@ -38,6 +39,7 @@ export declare const ToolCallCompletedPayloadSchema: z.ZodObject<{
         "elicitation-declined": "elicitation-declined";
         "denial-breaker": "denial-breaker";
         "repeat-failure": "repeat-failure";
+        "no-such-target": "no-such-target";
     }>>;
     batchIndex: z.ZodOptional<z.ZodNumber>;
     batchSize: z.ZodOptional<z.ZodNumber>;
@@ -70,6 +72,7 @@ export declare const ToolCallPayloadSchema: z.ZodDiscriminatedUnion<[z.ZodObject
         "elicitation-declined": "elicitation-declined";
         "denial-breaker": "denial-breaker";
         "repeat-failure": "repeat-failure";
+        "no-such-target": "no-such-target";
     }>>;
     batchIndex: z.ZodOptional<z.ZodNumber>;
     batchSize: z.ZodOptional<z.ZodNumber>;
@@ -147,6 +150,7 @@ export declare const SubagentFailedPayloadSchema: z.ZodObject<{
         "elicitation-declined": "elicitation-declined";
         "denial-breaker": "denial-breaker";
         "repeat-failure": "repeat-failure";
+        "no-such-target": "no-such-target";
     }>>;
 }, z.core.$strip>;
 export declare const SubagentCancelledPayloadSchema: z.ZodObject<{
@@ -192,6 +196,7 @@ export declare const SubagentLifecyclePayloadSchema: z.ZodDiscriminatedUnion<[z.
         "elicitation-declined": "elicitation-declined";
         "denial-breaker": "denial-breaker";
         "repeat-failure": "repeat-failure";
+        "no-such-target": "no-such-target";
     }>>;
 }, z.core.$strip>, z.ZodObject<{
     transition: z.ZodLiteral<"cancelled">;
@@ -604,6 +609,7 @@ export declare const TraceEventInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject
             "elicitation-declined": "elicitation-declined";
             "denial-breaker": "denial-breaker";
             "repeat-failure": "repeat-failure";
+            "no-such-target": "no-such-target";
         }>>;
         batchIndex: z.ZodOptional<z.ZodNumber>;
         batchSize: z.ZodOptional<z.ZodNumber>;
@@ -674,6 +680,7 @@ export declare const TraceEventInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject
             "elicitation-declined": "elicitation-declined";
             "denial-breaker": "denial-breaker";
             "repeat-failure": "repeat-failure";
+            "no-such-target": "no-such-target";
         }>>;
     }, z.core.$strip>, z.ZodObject<{
         transition: z.ZodLiteral<"cancelled">;
@@ -936,6 +943,7 @@ export declare const TraceEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             "elicitation-declined": "elicitation-declined";
             "denial-breaker": "denial-breaker";
             "repeat-failure": "repeat-failure";
+            "no-such-target": "no-such-target";
         }>>;
         batchIndex: z.ZodOptional<z.ZodNumber>;
         batchSize: z.ZodOptional<z.ZodNumber>;
@@ -1010,6 +1018,7 @@ export declare const TraceEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             "elicitation-declined": "elicitation-declined";
             "denial-breaker": "denial-breaker";
             "repeat-failure": "repeat-failure";
+            "no-such-target": "no-such-target";
         }>>;
     }, z.core.$strip>, z.ZodObject<{
         transition: z.ZodLiteral<"cancelled">;

package/dist/agent/trace/receipt.d.ts

@@ -1,5 +1,5 @@
 import type { HookHandler } from '../hooks.js';
-import type { ClosureReason, ToolFailureClass, TraceEvent, TraceEventKind } from './types.js';
+import { type ClosureReason, type ToolFailureClass, type TraceEvent, type TraceEventKind } from './types.js';
 export declare const RECEIPT_SCHEMA_VERSION: 1;
 export interface ReceiptToolFailure {
     toolUseId: string;

package/dist/agent/trace/types.d.ts

@@ -6,7 +6,7 @@ export interface ToolCallStartedPayload {
     inputBytes: number;
     subagentId?: string;
 }
-export declare const TOOL_FAILURE_CLASSES: readonly ["policy-refusal", "timeout", "budget", "permission-denied", "hook-block", "abort", "elicitation-declined", "denial-breaker", "repeat-failure"];
+export declare const TOOL_FAILURE_CLASSES: readonly ["policy-refusal", "timeout", "budget", "permission-denied", "hook-block", "abort", "elicitation-declined", "denial-breaker", "repeat-failure", "no-such-target"];
 export type ToolFailureClass = (typeof TOOL_FAILURE_CLASSES)[number];
 export declare const BENIGN_FAILURE_CLASSES: ReadonlySet<ToolFailureClass>;
 export interface ToolCallCompletedPayload {

package/dist/bundled-plugins/awa-bundled/skills/shadow-verify/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: shadow-verify
-description: "Dispatch a parallel adversarial verifier wave after any high-stakes sub-agent investigation (code reviews, audits, findings reports, large refactors) — or whenever a sub-agent asserts a claim with high-confidence language (confident, certain, clearly, ≥80%), since confidence is a trigger, not a verdict. Shadow verifiers independently re-derive 2–3 key claims from scratch using tool calls only, returning CONFIRMED/REFUTED/UNVERIFIABLE, and flag disagreements before the user acts. Use when sub-agent output will drive decisions, file changes, commits, or external side-effects."
+description: "Dispatch a parallel adversarial verifier wave after any high-stakes sub-agent investigation (code reviews, audits, findings reports, large refactors) — or whenever a sub-agent asserts a claim with high-confidence language (\"confident\", \"certain\", \"clearly\", \u226580%), since confidence is a trigger, not a verdict. Shadow verifiers independently re-derive 2–3 key claims from scratch using tool calls only, returning CONFIRMED/REFUTED/UNVERIFIABLE, and flag disagreements before the user acts. Use when sub-agent output will drive decisions, file changes, commits, or external side-effects."
 context: load
 ---
 
@@ -11,13 +11,17 @@ When a sub-agent (or wave) returns investigation findings, code-review conclusio
 
 **Wave 2 — Adversarial verifiers (parallel, independent):**
 1. Extract 2–3 concrete, re-checkable claims from the returned report (e.g., "X function is unused", "file Y exceeds 300 lines", "PR targets main", "no tests cover Z").
-2. Dispatch one shadow sub-agent per claim, in parallel. Each receives ONLY the claim + the user's original goal — never the original agent's reasoning or cited evidence. **Default to `subagent_type: "research-agent"` (mechanically locked to Read/Grep/Glob/WebFetch/WebSearch — cannot Edit/commit/push).** If the claim requires Bash to verify (running a failing test, `gh pr view`, `git log origin/...`), fall back to a Bash-capable subagent type with `isolation: "worktree"` and prepend this prefix to the prompt: *"Verifier sub-agent — do not Edit, Write, commit, push, `gh pr create`, or `curl`. Return findings only."*
+2. Dispatch one shadow sub-agent per claim, in parallel. Each receives the claim + the user's original goal + **the search surface** — the inventory of files, directories, or URLs the original investigation touched. It must NOT receive the original agent's reasoning, verdict, confidence language, or the specific line/region it concluded from. **Withhold the conclusion, not the map.** Withholding the map too does not buy extra independence — the verifier still has to reach the same evidence, it just spends its budget guessing paths to get there. Measured: one verifier denied the inventory spent 70 `grep` + 18 `read_file` calls re-locating files the parent already had paths for, guessed 5 nonexistent paths on the way, and hit its tool-loop ceiling before finishing. The independence that matters is epistemic (re-deriving the verdict), not navigational.
+   - The inventory is a **starting surface, not a boundary**: it does not satisfy the composition-axis guard below, and a verifier that reads only inside it still returns `evidence_base: artifact-internal`. At least one primary source outside that surface is still required for `independent-rederivation`.
+   - **Default to `subagent_type: "research-agent"` (mechanically locked to Read/Grep/Glob/WebFetch/WebSearch — cannot Edit/commit/push).** If the claim requires Bash to verify (running a failing test, `gh pr view`, `git log origin/...`), fall back to a Bash-capable subagent type with `isolation: "worktree"` and prepend this prefix to the prompt: *"Verifier sub-agent — do not Edit, Write, commit, push, `gh pr create`, or `curl`. Return findings only."*
+   - **Every verifier dispatch carries an explicit budget** — `max_tool_use_iterations` (a wave of 2–3 claim checks needs ~15–25 rounds each, not 50) plus the cheapest sufficient model. An unbudgeted verifier does not fail loudly: it exhausts the default tool-round ceiling, terminates `stopReason: "tool_use_loop_capped"`, and emits its verdict from a tools-stripped wind-down round built on partial evidence. A `CONFIRMED` produced that way is indistinguishable from a real one and silently defeats the entire point of the wave. Check each returned verifier's stop reason before merging its verdict; treat a capped or wind-down verifier as `UNVERIFIABLE`, not as a verdict.
 3. Each verifier re-derives the verdict independently using tool calls only — never re-reading the original report's reasoning. Returns `{claim, verifier_verdict, evidence_pointer, evidence_base}`, where `verifier_verdict` is one of `CONFIRMED`, `REFUTED`, or `UNVERIFIABLE`, and `evidence_base` is `independent-rederivation` (read primary sources *outside* the cited artifact's boundary) or `artifact-internal` (re-read only the cited file/region). On `REFUTED`, the verifier also emits a corrected finding.
 
 **Merge:**
 - `CONFIRMED` → surface the claim as validated.
 - `REFUTED` → replace the claim with the verifier's corrected finding, annotated `[was: confident, now: refuted]`, and show it alongside the original with evidence. Do not act until the conflict is resolved.
 - `UNVERIFIABLE` → surface with a `[needs-human-review]` tag rather than passing it through silently.
+- **Budget-exhausted verifier** (`stopReason` of `tool_use_loop_capped` / `soft_deadline_wind_down`, or a `timeout`/`429` failure) → its verdict was produced without finishing the evidence gathering, so it is not a verdict. Downgrade to `UNVERIFIABLE [budget-exhausted]` and re-dispatch that one claim with a narrower scope and the search surface attached; this re-dispatch counts as the next verification round (and must respect the invoking workflow's round budget — e.g. `/review` permits one round with no repeats). If the loop cap (3 rounds total) is already reached, or the caller's budget forbids another round, escalate to the user instead of re-dispatching. Never merge a capped `CONFIRMED`.
 
 *The two verdicts below are **not** emitted by individual verifiers — they are produced by the Composition-axis guard (defined below) and handled here:*
 - `UNVERIFIED-COMPOSITION` → surface with `[needs-human-review: composition boundary unchecked]`; do not act until a boundary read confirms or refutes the claim.