ai-runtime-engine 2.9.0 → 3.0.1

package/CHANGELOG.md

@@ -5,6 +5,112 @@ All notable changes to `ai-runtime` are documented here. The format follows
 Versioning](https://semver.org/). Development history and rationale live in
 [docs/DECISIONS.md](docs/DECISIONS.md) and [docs/PROGRESS.md](docs/PROGRESS.md).
 
+## [3.0.1] — 2026-09-07
+
+**Hardening pass.** A correctness, security, test, documentation, and release-cleanup pass over a
+full-repo audit of 3.0. The architecture is unchanged — every change extends an existing seam and is
+backward compatible (with one documented downgrade caveat on the encryption format). The test suite grew
+from 892 to 971 and CI now runs a Node 22 + 24 matrix with a tarball-contents audit, a doc-link/anchor
+check, and a fail-closed test-count integrity floor.
+
+### Security
+
+- **Shell tool: eval-capable invocations now require approval, even when allowlisted.** Allowlisting a
+  binary like `npm` or `node` no longer silently permits arbitrary code through its arguments —
+  interpreters run with inline-code/preload flags (`node -e`/`-r`, `python -c/-m`, `perl -M`, the `awk`
+  family, …), package/script runners (`npx`, `npm exec`/`run`/`init`, `deno task`, …), container
+  `run`/`exec`, argv-indirection wrappers (`env`, `xargs`, `nice`, `timeout`, `find -exec`, …), and a
+  non-default `make -f` are escalated to interactive approval (headless runs fail closed). The allowlist
+  matches an absolute path by basename but never a relative or workspace-internal one (realpath-checked).
+  This backstop is best-effort; `docs/security.md` documents its limits and accepted residuals.
+- **Store files are created owner-only** (`0600` files, `0700` directories) on POSIX.
+- **Encryption at rest v2:** the AES-256-GCM key is now derived with **scrypt** over a per-record salt
+  (the `aienc2` envelope) instead of a bare SHA-256, so a passphrase key resists brute force. Legacy
+  `aienc1` and plaintext records still read and upgrade on rewrite. A decryption failure is a typed
+  `StoreDecryptError` — honestly "wrong key OR tampering OR corruption" — and now surfaces instead of
+  reading as a silently empty store. *Downgrade caveat: a pre-3.0.1 runtime cannot read `aienc2` records.*
+- Untrusted-content fencing neutralizes any fence label (not just its own); the verifier's model-authored
+  `reason` is flattened/clamped and its prompt inputs are fenced; the MCP schema sanitizer uses a
+  null-prototype object so a `__proto__` key cannot pollute.
+
+### Fixed
+
+- **Config schema accepted four documented keys it used to reject.** `parseConfig` (the public export) now
+  accepts `learning`, `verification`, `budget`, and `policy` at the root; before this a config using any of
+  them failed to load.
+- **Routing now always enforces context-fit**, not only when a cost/latency constraint is set; and
+  cost/context **estimates account for multimodal input parts** (an image is no longer estimated as zero).
+- **`models: 'auto'`** resolves deterministically offline (defaultModel → kind catalog); a zero-model
+  result is a loud CONFIG error, not a silently unroutable provider.
+- **Streaming fallback no longer garbles output**: a failed streamed attempt is explicitly abandoned via a
+  new `response.stream_abandoned` runtime event, and `response.streamed` is accurate under fallback.
+- **OTLP telemetry is flushed on close**, so short-lived runs no longer drop sub-batch events.
+- **Store lock** stale-steal is atomic (ownership token); **conversation metadata** writes serialize
+  through it; the **HTTP client** no longer sleeps out a backoff after the final retry; a stale provider
+  **cooldown** now reads as routable again; provider `listModels()`/`discover()` return copies.
+- **CLI `--json --yes`** on `cleanup` and `skills --scaffold` now applies the operation and reports the
+  result, instead of printing a preview and ignoring `--yes`. `ai-runtime mcp show <id>` was added.
+
+### Changed
+
+- **The four validated-but-ignored config fields are now enforced:** `ProviderConfig.weightOverrides`
+  (per-provider score weights; keys restricted to the scoring dimensions), `TaskDefinition.qualityFloor`
+  (excludes lower-tier models; a model with no tier is not excluded), `CapabilityRequirement.weight`
+  (weights capability fit and confidence alike), and `constraints.minimumConfidence` (raises the effective
+  confidence floor; it flags, it does not fail the run).
+- **The memory tokenizer is Unicode-aware** — accented Latin, Cyrillic, Arabic, and CJK are now
+  searchable; pure-ASCII tokenization is byte-identical. *Note: learned goal keys for non-ASCII goals
+  re-key (old degenerate records are orphaned, never mixed); session-cached embedding vectors shift.*
+
+### Notes for consumers
+
+- The `RuntimeEvent` union gained a `response.stream_abandoned` arm. New arms are additive at runtime but
+  break an exhaustive `switch` at compile time — carry a default case.
+
+## [3.0.0] — 2026-09-05
+
+**AI Runtime 3.0.** The 3.x arc set out to make the runtime reason about *what it can do*, talk to tools
+it did not ship with, delegate bounded work to agents, and survive being killed in the middle of it.
+That is now true end to end, and `tests/integration/runtime-3-demo.test.ts` runs the whole of it —
+derive, decompose, delegate, crash, resume — offline, inside a call budget, with a leak scan.
+
+Upgrading from 2.9.0 requires no config change. One documented default changes; see below.
+
+### Added
+
+- **Auto-decomposition** (`runtime.agents.decompose`, default OFF) — a goal can delegate to a bounded,
+  read-shaped agent with no operator-authored definition. Three roles ship in-tree; no model-authored
+  string ever becomes an objective, a tool id, or a permission, and `auto_` is a reserved config
+  namespace so a derived id can never shadow an authored one.
+- **Conflict supersession is wired.** `resolveConflicts` shipped in 3.4 with no caller, so two agents
+  reaching opposite conclusions about the same subject both stayed active and both reached the next
+  planning prompt. Resolution now runs when a task finishes, weighs evidence-based confidence, and
+  persists — and it is order-independent, so the answer does not depend on which agent happens to
+  finish first.
+
+### Changed
+
+- **`runtime.capabilities.catalog` now defaults to ON.** Set `catalog: false` to remove the block.
+  Before flipping it, the block was made to match its own documentation: three comments across three
+  files described it as fenced when nothing fenced it, and its blocked-skill half had no cap at all
+  (~24k characters with 300 blocked skills, silently, in every prompt). Both are fixed.
+
+### Fixed
+
+- **A throwing agent took down the whole run.** `executor.ts` returned the agent runner's promise from
+  inside a `try` — and an async function *adopts* a returned promise rather than awaiting it, so the
+  rejection escaped the executor's own catch. The plan failed instead of the step, and wave-mates were
+  left running unawaited. Present since 2.7.0.
+- Derived permissions are a ceiling rather than a default, so a synthesized definition cannot request
+  write access even when the parent has it.
+
+### Notes for consumers
+
+- The `RuntimeEvent` union gained agent arms in 2.9.0 and may gain more. New arms are additive at
+  runtime but break an exhaustive `switch` at compile time — carry a default case.
+- `capabilities.planning` is skipped whenever any call or cost budget is set, and a resumed run is
+  never re-derived. Both are deliberate and now asserted by tests rather than only documented.
+
 ## [2.9.0] — 2026-09-05
 
 Agent work becomes VISIBLE. Concurrent agent steps render as live lanes in the interactive terminal,
@@ -797,6 +903,8 @@ Initial release: the provider-agnostic AI **router** — capability-based routin
 scoring, evidence validation, fallback, health tracking, learning-based scoring, multi-model verification,
 budgets, MCP tools, OpenAPI-based adapter generation, and the `AI` class + CLI.
 
+[3.0.1]: https://github.com/pavankhandelwal21/ai-runtime/releases/tag/v3.0.1
+[3.0.0]: https://github.com/pavankhandelwal21/ai-runtime/releases/tag/v3.0.0
 [2.9.0]: https://github.com/pavankhandelwal21/ai-runtime/releases/tag/v2.9.0
 [2.8.0]: https://github.com/pavankhandelwal21/ai-runtime/releases/tag/v2.8.0
 [2.7.0]: https://github.com/pavankhandelwal21/ai-runtime/releases/tag/v2.7.0

package/README.md

@@ -80,10 +80,40 @@ You describe *what you want*; the runtime picks *which model* runs it. A few ide
   stateless mode).
 - **Add your own skills** — drop a manifest into `.ai-runtime/skills/`, or install a skill pack from npm.
 - **Steer routing** — hard-`exclude` or soft-`prefer` providers/models via config, per-run, or env vars.
+- **Connect MCP servers** — `mcp:` in the config brings a server's tools in as ordinary permission-gated
+  tools, deny-by-default per server. `ai-runtime mcp` and `/mcp` show what is connected.
+- **Delegate to agents** — a plan step can hand bounded work to an agent with its own narrowed catalog,
+  permissions and budget, which reports back structured findings. `/agents` lists them; `/agents stop`
+  stops one. Turn it on with `runtime.agents.enabled`.
+- **Survive a crash mid-run** — agent progress is committed as it happens, so resuming finishes the job
+  instead of redoing it. `ai-runtime resume-execution <id>`.
 - Everything that acts is **permission-gated and workspace-jailed** (see [Safety](#safety)).
 
 ---
 
+## What's new in 3.0
+
+The 3.x arc made the runtime reason about *what it can do*, work with tools it didn't ship with, delegate
+bounded work, and survive being killed in the middle of it.
+
+- **Action capabilities** — the runtime knows it can `read_file` or `run_tests` independently of which
+  tool or skill provides it, and tells you what's missing when a goal needs something it hasn't got.
+- **MCP** — a zero-dependency client over stdio and streamable HTTP. Server tools become ordinary tools,
+  with per-server grants that are off until you say otherwise.
+- **Agents** — a third kind of plan step. An agent gets an envelope narrowed from the parent's catalog and
+  permissions, a call budget it cannot exceed, and an output contract its findings must satisfy. Approving
+  a plan shows you that envelope, because approving a delegation blind is approving a blank cheque.
+- **Durable agent work** — plan, inner steps, findings and spend are on disk before the next wave starts,
+  so a `kill -9` costs you the step in flight and nothing else.
+- **Auto-decomposition** (opt-in) — a goal can delegate to read-shaped agents nobody configured. The roles
+  and their objectives ship in-tree; nothing the model writes becomes an objective, a tool, or a
+  permission.
+
+Upgrading from 2.x needs no config change. One default moved: the capability catalog is now included in
+planning prompts — set `runtime.capabilities.catalog: false` to remove it.
+
+---
+
 ## Configuration
 
 Three places, and only these:

package/dist/agents/admit.d.ts

@@ -65,5 +65,13 @@ export declare function admitFindings(input: AdmitFindingsInput): AdmissionResul
  * output contract: then a violation, or admitting nothing at all, is a contract failure. With no
  * declared contract findings are best-effort - rejections are diagnostics and the step's success is
  * decided by its inner plan alone.
+ *
+ * `emptyIsFailure: false` keeps the contract's SHAPE rules (types, cap, subject) while making "found
+ * nothing worth reporting" an ordinary outcome rather than a failure. Derived agents pass it: their
+ * contract is mandatory precisely so their output stays bounded, but none of the shipped tools emit
+ * `data.findings`, so requiring at least one finding would fail every derived task against the
+ * runtime's own toolset — a feature that cannot succeed out of the box.
  */
-export declare function contractFailed(result: AdmissionResult): boolean;
+export declare function contractFailed(result: AdmissionResult, opts?: {
+    emptyIsFailure?: boolean;
+}): boolean;

package/dist/agents/admit.js

@@ -121,9 +121,17 @@ function validateFinding(f) {
  * output contract: then a violation, or admitting nothing at all, is a contract failure. With no
  * declared contract findings are best-effort - rejections are diagnostics and the step's success is
  * decided by its inner plan alone.
+ *
+ * `emptyIsFailure: false` keeps the contract's SHAPE rules (types, cap, subject) while making "found
+ * nothing worth reporting" an ordinary outcome rather than a failure. Derived agents pass it: their
+ * contract is mandatory precisely so their output stays bounded, but none of the shipped tools emit
+ * `data.findings`, so requiring at least one finding would fail every derived task against the
+ * runtime's own toolset — a feature that cannot succeed out of the box.
  */
-export function contractFailed(result) {
+export function contractFailed(result, opts = {}) {
     if (!result.contractDeclared)
         return false;
-    return result.contractViolated || result.admitted.length === 0;
+    if (result.contractViolated)
+        return true;
+    return opts.emptyIsFailure !== false && result.admitted.length === 0;
 }

package/dist/agents/envelope.d.ts

@@ -49,5 +49,26 @@ export interface NarrowEnvelopeInput {
         maxDurationMs: number;
         maxInnerCalls: number;
     };
+    /**
+     * Where the definition came from (Phase 3.7). `authored` keeps the 3.4 rule that an omitted field
+     * INHERITS the parent's reach — an operator wrote that definition, and omission is their choice.
+     * `derived` INVERTS it: an omitted field means nothing at all.
+     *
+     * The inversion lives here rather than in the synthesizer on purpose. If the synthesizer did the
+     * bounding, a forgotten field there would silently hand a machine-generated agent the parent's whole
+     * catalog and every permission — it would fail OPEN. Here, a synthesizer bug produces an agent that
+     * can do nothing: loud, and safe. There is still exactly one enforcement point.
+     */
+    provenance?: 'authored' | 'derived';
 }
+/**
+ * What a DERIVED agent may do: read, and reason about what it read. Every other dimension is explicitly
+ * `false` rather than absent, because `clampPermissions` treats an absent field as "inherit" — so an
+ * explicit denial is the only thing that actually denies. Writes remain the province of a definition a
+ * human wrote and an operator configured.
+ */
+export declare const DERIVED_PERMISSIONS: PermissionPolicy;
+/** Tighter ceilings for an agent nobody authored. A definition may still only lower them. */
+export declare const DERIVED_MAX_TOOL_CALLS = 8;
+export declare const DERIVED_MAX_INNER_CALLS = 2;
 export declare function narrowEnvelope(input: NarrowEnvelopeInput): AgentEnvelope;

package/dist/agents/envelope.js

@@ -15,6 +15,26 @@ import { clampPermissions } from '../tools/permissions.js';
 import { flattenClamp } from '../util/flatten.js';
 /** The definition-authored objective reaches a model prompt, so it is bounded like any other source text. */
 export const OBJECTIVE_MAX = 240;
+/**
+ * What a DERIVED agent may do: read, and reason about what it read. Every other dimension is explicitly
+ * `false` rather than absent, because `clampPermissions` treats an absent field as "inherit" — so an
+ * explicit denial is the only thing that actually denies. Writes remain the province of a definition a
+ * human wrote and an operator configured.
+ */
+export const DERIVED_PERMISSIONS = {
+    fsRead: true,
+    fsWrite: false,
+    shell: false,
+    shellAllowedCommands: [],
+    gitWrite: false,
+    gitCommit: false,
+    gitPush: false,
+    network: false,
+    mcp: { servers: {} },
+};
+/** Tighter ceilings for an agent nobody authored. A definition may still only lower them. */
+export const DERIVED_MAX_TOOL_CALLS = 8;
+export const DERIVED_MAX_INNER_CALLS = 2;
 /** A cap a definition may only LOWER, never raise, and never below 1. */
 function lowerOnly(deflt, requested) {
     return Math.max(1, Math.min(deflt, requested ?? deflt));
@@ -25,17 +45,31 @@ export function narrowEnvelope(input) {
     // (1) Tools: intersect with the parent. A definition entry naming something the parent does not have
     // is simply absent — it can never ADD a tool.
     const parentTools = new Set(input.parentTools);
-    const tools = uniqSorted((def.tools ?? input.parentTools).filter((t) => parentTools.has(t)));
+    const derived = input.provenance === 'derived';
+    // A derived definition that names no tools gets NONE. An authored one inherits the parent's, which is
+    // the 3.4 behaviour and stays unchanged.
+    const tools = uniqSorted((def.tools ?? (derived ? [] : input.parentTools)).filter((t) => parentTools.has(t)));
     // (2) Skills: intersect with the parent, then drop any skill that needs a tool outside the envelope.
     // That second clause is load-bearing, not tidiness: a skill's own `callTool` resolves straight off the
     // Runtime's registry with no allowlist check, so admitting a skill whose declared tools escape the
     // envelope would be a hole. Excluding it is the structural fix; the worker's membership check is
     // defense in depth.
     const inner = new Set(tools);
-    const allowedSkills = def.skills ? new Set(def.skills) : undefined;
+    const allowedSkills = def.skills ? new Set(def.skills) : derived ? new Set() : undefined;
     const skills = uniqSorted(input.parentSkills.filter((s) => (!allowedSkills || allowedSkills.has(s.id)) && (s.tools ?? []).every((t) => inner.has(t))).map((s) => s.id));
     // (3) Permissions: minimum-merged and fully explicit (see `clampPermissions`).
-    const permissions = clampPermissions(input.parentPermissions, def.permissions);
+    // For a derived agent DERIVED_PERMISSIONS is a CEILING, not a default: the definition is clamped
+    // against it first, so even an explicit `fsWrite: true` in a synthesized definition cannot grant
+    // writing. Using it as a mere default would leave the guarantee resting on the synthesizer never
+    // setting the field — which is true today, and is exactly the kind of thing that stops being true.
+    const permissions = derived
+        ? clampPermissions(input.parentPermissions, clampPermissions(DERIVED_PERMISSIONS, def.permissions))
+        : clampPermissions(input.parentPermissions, def.permissions);
+    // MCP is the one non-boolean permission dimension, and its clamp is a PER-KEY minimum: an empty
+    // override map means "no opinion", i.e. inherit every server grant — the opposite of what an empty
+    // map reads like. So a derived agent's MCP access is set explicitly rather than clamped to nothing.
+    if (derived)
+        permissions.mcp = { servers: {} };
     // (6) Routing: exclusions only ever GROW, preferences only ever shrink, so an agent can never
     // re-admit a provider the parent excluded, nor reach past a privacy or policy decision.
     const pr = input.parentRouting;
@@ -55,10 +89,10 @@ export function narrowEnvelope(input) {
         skills,
         permissions,
         // (4) Caps: a definition may only lower.
-        maxToolCalls: lowerOnly(defaults.maxToolCalls, def.maxToolCalls),
+        maxToolCalls: lowerOnly(derived ? Math.min(defaults.maxToolCalls, DERIVED_MAX_TOOL_CALLS) : defaults.maxToolCalls, def.maxToolCalls),
         maxDurationMs: lowerOnly(defaults.maxDurationMs, def.maxDurationMs),
         // (5) The reservation is the same shape of number, and doubles as the hard inner-call ceiling.
-        reservation: lowerOnly(defaults.maxInnerCalls, def.maxInnerCalls),
+        reservation: lowerOnly(derived ? Math.min(defaults.maxInnerCalls, DERIVED_MAX_INNER_CALLS) : defaults.maxInnerCalls, def.maxInnerCalls),
         ...(routing && Object.keys(routing).length ? { routing } : {}),
         // Requirements ADD to the parent's — more requirements is a narrower candidate set.
         ...(def.model?.requirements?.length ? { requirements: [...def.model.requirements] } : {}),

package/dist/agents/finding.d.ts

@@ -72,8 +72,14 @@ export declare function executionCoverage(steps: PlanStep[]): number;
  */
 export declare function confidenceOf(ev: FindingEvidence[], override?: unknown): number;
 /**
- * Resolve conflicts among active findings, weighing ONLY `confidence`. Two findings conflict when they
- * share a `type` + `subject`: a differing verdict makes the loser `contradicted`, and otherwise the
- * loser is `superseded`. `executionCoverage` breaks a tie and never enters the weight.
+ * Resolve conflicts among findings, weighing ONLY `confidence`. Two findings conflict when they share a
+ * `type` + `subject`: a differing verdict makes the loser `contradicted`, and otherwise the loser is
+ * `superseded`. `executionCoverage` breaks a tie and never enters the weight.
+ *
+ * IDEMPOTENT AND TOTAL: pass the whole set every time, including findings already marked. The winner of
+ * each group is restored to `active`, so re-running over a set whose membership grew produces the same
+ * answer as running once over the final set. Resolving only the currently-`active` subset instead makes
+ * the outcome depend on the order results ARRIVE — and leaves `supersededBy` pointing at a finding that
+ * was itself later superseded, a chain nothing heals.
  */
 export declare function resolveConflicts(findings: Finding[]): Finding[];

package/dist/agents/finding.js

@@ -51,9 +51,15 @@ export function confidenceOf(ev, override) {
     return round2(c);
 }
 /**
- * Resolve conflicts among active findings, weighing ONLY `confidence`. Two findings conflict when they
- * share a `type` + `subject`: a differing verdict makes the loser `contradicted`, and otherwise the
- * loser is `superseded`. `executionCoverage` breaks a tie and never enters the weight.
+ * Resolve conflicts among findings, weighing ONLY `confidence`. Two findings conflict when they share a
+ * `type` + `subject`: a differing verdict makes the loser `contradicted`, and otherwise the loser is
+ * `superseded`. `executionCoverage` breaks a tie and never enters the weight.
+ *
+ * IDEMPOTENT AND TOTAL: pass the whole set every time, including findings already marked. The winner of
+ * each group is restored to `active`, so re-running over a set whose membership grew produces the same
+ * answer as running once over the final set. Resolving only the currently-`active` subset instead makes
+ * the outcome depend on the order results ARRIVE — and leaves `supersededBy` pointing at a finding that
+ * was itself later superseded, a chain nothing heals.
  */
 export function resolveConflicts(findings) {
     const groups = new Map();
@@ -69,6 +75,11 @@ export function resolveConflicts(findings) {
             continue;
         const ranked = [...group].sort((a, b) => b.confidence - a.confidence || b.executionCoverage - a.executionCoverage || (a.id < b.id ? -1 : 1));
         const winner = ranked[0];
+        // The winner is `active` by definition of having won — even if an earlier, smaller round had
+        // marked it a loser. This is what makes the function idempotent.
+        const top = out.get(winner.id);
+        top.status = 'active';
+        delete top.supersededBy;
         for (const loser of ranked.slice(1)) {
             const row = out.get(loser.id);
             const differingVerdict = loser.verdict !== undefined && winner.verdict !== undefined && loser.verdict !== winner.verdict;

package/dist/agents/worker.d.ts

@@ -79,6 +79,9 @@ export interface AgentWorkerDeps {
      *  `finish()` — the inner plan, every completed inner step, every inner model call — is lost to a
      *  crash, and the resume has nothing to skip. Synchronous; must not throw. */
     onRecord?: (record: AgentTaskRecord) => void;
+    /** Phase 3.7: this agent was SYNTHESIZED, not authored. Its output contract bounds what it may
+     *  report without obliging it to report anything. */
+    derived?: boolean;
     /** Phase 3.5: a persisted record to CONTINUE instead of minting a fresh one. The caller proves it
      *  belongs to THIS step by step-input hash before passing it. */
     resume?: AgentTaskRecord;

package/dist/agents/worker.js

@@ -372,7 +372,10 @@ export async function runAgentTask(step, envelope, definition, deps) {
     // Bounded: diagnostics accumulate across attempts, and every one of them is rewritten to disk on
     // every commit. Keeping the most recent is the useful half.
     record.diagnostics = [...record.diagnostics, ...admission.rejected].slice(-DIAGNOSTICS_KEPT);
-    if (contractFailed(admission)) {
+    // A DERIVED agent's contract bounds what it may report; it does not oblige it to report. Nothing in
+    // the shipped toolset emits `data.findings`, so demanding at least one would fail every derived task
+    // against the runtime's own tools — the feature would be unusable without a bespoke tool.
+    if (contractFailed(admission, { emptyIsFailure: !deps.derived })) {
         return finish('failed', { code: 'finding-contract', message: 'the agent did not satisfy its declared output contract' });
     }
     if (expired())

package/dist/cli/cli.js

@@ -21,7 +21,7 @@ import { mcpCommand, mcpAddCommand, mcpRemoveCommand, mcpEnableCommand, mcpTestC
 import { startRepl } from './interactive/repl.js';
 import { printError } from './render.js';
 const program = new Command();
-program.name('ai-runtime').description('Universal, provider-agnostic AI Runtime & Orchestration Platform').version('2.9.0');
+program.name('ai-runtime').description('Universal, provider-agnostic AI Runtime & Orchestration Platform').version('3.0.1');
 const configOpt = ['-c, --config <path>', 'path to an ai-runtime config file'];
 // Bare `ai-runtime` (no subcommand) opens the interactive terminal. `allowExcessArguments(false)` keeps
 // a mistyped subcommand (e.g. `ai-runtime porviders`) failing fast instead of silently opening the REPL.
@@ -77,6 +77,13 @@ mcp
     .option(...configOpt)
     .option('--json', 'print as JSON')
     .action((id, o) => mcpCommand(id, o));
+mcp
+    .command('show')
+    .argument('<id>', 'server id')
+    .description('Show one server in detail — the unambiguous form for an id that collides with a subcommand name (add/remove/enable/disable/test)')
+    .option(...configOpt)
+    .option('--json', 'print as JSON')
+    .action((id, o) => mcpCommand(id, o));
 mcp
     .command('add')
     .argument('<id>', 'a short id for the server (lowercase, kebab/snake)')

package/dist/cli/commands/cleanup.js

@@ -74,11 +74,19 @@ export async function cleanupCommand(opts) {
             return;
         }
         const plan = planCleanup(rt, Date.now());
-        if (opts.json)
-            return print(JSON.stringify(plan, null, 2));
+        const removable = toRemove(plan);
+        // `--json` changes the OUTPUT FORMAT only; it does not suppress `--yes`. Without `--yes` (or with
+        // `--dry-run`) it emits a plan preview; with `--yes` it applies and reports the result. It never
+        // prompts (machine-facing). The JSON always carries `mode` so a caller can tell plan from applied.
+        if (opts.json) {
+            if (opts.yes && !opts.dryRun && removable > 0) {
+                const applied = applyCleanup(rt, plan);
+                return print(JSON.stringify({ mode: 'applied', plan, applied }, null, 2));
+            }
+            return print(JSON.stringify({ mode: 'plan', plan }, null, 2));
+        }
         for (const line of renderPlan(plan))
             print(line);
-        const removable = toRemove(plan);
         if (removable === 0) {
             print('\nNothing to remove.');
             return;

package/dist/cli/commands/doctor.js

@@ -75,7 +75,7 @@ export function renderDoctor(r) {
     if (!r.providers.length)
         lines.push('  (none configured — run `ai-runtime setup`)');
     for (const p of r.providers)
-        lines.push(`  ${p.authenticated ? '✓' : '✗'} ${p.id.padEnd(14)} ${p.authenticated ? 'authenticated' : 'not configured'}  [${p.state}]  ${p.models} models`);
+        lines.push(`  ${p.authenticated ? '✓' : '✗'} ${p.id.padEnd(14)} ${p.authenticated ? 'authenticated' : 'not configured'}  [${p.state}]  ${p.models} models${p.models === 0 ? '  ⚠ no routable models — list models explicitly or set defaultModel' : ''}`);
     lines.push(`Models:   ${r.models.total} known, ${r.models.usableProviders} provider(s) usable`);
     lines.push('', 'Store:');
     if (!r.store.enabled)

package/dist/cli/commands/run.js

@@ -32,6 +32,12 @@ async function runWith(rt, input, options) {
                 printChunk(e.text);
                 streamedAny = true;
             }
+            else if (e.type === 'response.stream_abandoned') {
+                // Mark a boundary so the discarded partial is not read as part of what follows. Do not promise a
+                // retry — abandonment also fires when the failed attempt was the last candidate.
+                printChunk('\n↩ discarded incomplete response\n');
+                streamedAny = false;
+            }
         });
     }
     if (options.mode) {

package/dist/cli/commands/skills.js

@@ -51,8 +51,15 @@ export async function skillsCommand(opts) {
                     return print(JSON.stringify({ ok: false, error: draft.error }, null, 2));
                 return print(`Could not scaffold a skill: ${draft.error}`);
             }
-            if (opts.json)
-                return print(JSON.stringify({ ok: true, manifest: draft.manifest, yaml: draft.yaml }, null, 2));
+            // `--json` changes the OUTPUT FORMAT only; with `--yes` it SAVES and reports the path, without it
+            // returns the draft. It never prompts (machine-facing). `mode` distinguishes draft from saved.
+            if (opts.json) {
+                if (opts.yes) {
+                    const savedPath = rt.saveScaffoldedSkill(draft.manifest);
+                    return print(JSON.stringify({ ok: true, mode: 'saved', path: savedPath, manifest: draft.manifest }, null, 2));
+                }
+                return print(JSON.stringify({ ok: true, mode: 'draft', manifest: draft.manifest, yaml: draft.yaml }, null, 2));
+            }
             print(`Drafted skill "${draft.manifest.id}":\n`);
             print(draft.yaml);
             const proceed = opts.yes || (await confirm(`Save to .ai-runtime/skills/${draft.manifest.id}.skill.yaml?`));

package/dist/cli/interactive/repl.js

@@ -88,8 +88,10 @@ export async function startRepl(configPath) {
         if (!line.trim())
             return;
         try {
-            mkdirSync(dirname(historyPath), { recursive: true });
-            appendFileSync(historyPath, `${line}\n`);
+            // Owner-only: history holds raw prompt lines under the store home (0700 dir / 0600 file, matching
+            // the store's own record hardening). Mode applies only on creation; POSIX-only, a no-op on Windows.
+            mkdirSync(dirname(historyPath), { recursive: true, mode: 0o700 });
+            appendFileSync(historyPath, `${line}\n`, { mode: 0o600 });
         }
         catch {
             /* history is a convenience; a write failure must never break the REPL */
@@ -121,6 +123,14 @@ export async function startRepl(configPath) {
             streamedThisRun = true;
             return;
         }
+        if (e.type === 'response.stream_abandoned') {
+            // The partial answer just streamed from this provider is being discarded; mark a clear boundary so
+            // whatever follows is not read as a seamless continuation of it. Not necessarily a retry — this also
+            // fires when the failed attempt was the last candidate.
+            printChunk('\n↩ discarded incomplete response\n');
+            streamedThisRun = false;
+            return;
+        }
         const lane = lanes.observe(e);
         if (lane) {
             if (!runInFlight)

package/dist/cli/interactive/session.d.ts

@@ -22,8 +22,10 @@ export declare class ReplSession {
     private conversationId?;
     private dryRunMode;
     private streaming;
+    private readonly env;
     constructor(runtime: Runtime, opts?: {
         streaming?: boolean;
+        env?: NodeJS.ProcessEnv;
     });
     currentMode(): RuntimeMode;
     private views;

package/dist/cli/interactive/session.js

@@ -76,9 +76,13 @@ export class ReplSession {
     conversationId;
     dryRunMode = false;
     streaming;
+    env;
     constructor(runtime, opts = {}) {
         this.runtime = runtime;
         this.streaming = opts.streaming ?? false;
+        // The env the /budget display reads. Injectable so tests need not mutate the real process.env; the
+        // enforcement path already resolves budgets from the runtime's injected env.
+        this.env = opts.env ?? process.env;
     }
     currentMode() {
         return this.mode;
@@ -202,8 +206,8 @@ export class ReplSession {
             case 'budget':
                 return {
                     lines: [
-                        `call budget (AI_MAX_CALLS):    ${process.env.AI_MAX_CALLS ?? '(unset — no limit)'}`,
-                        `cost budget (AI_MAX_COST_USD): ${process.env.AI_MAX_COST_USD ?? '(unset — no limit)'}`,
+                        `call budget (AI_MAX_CALLS):    ${this.env.AI_MAX_CALLS ?? '(unset — no limit)'}`,
+                        `cost budget (AI_MAX_COST_USD): ${this.env.AI_MAX_COST_USD ?? '(unset — no limit)'}`,
                         'over budget: notify-and-wait by default; add --partial (one-shot) to run the phases that fit and pause.',
                     ],
                 };

package/dist/config/schema.js

@@ -11,6 +11,8 @@ const EVIDENCE = ['unsupported', 'unknown', 'inferred', 'documented', 'verified'
 const GROUPS = ['input', 'output', 'intelligence', 'agent'];
 const KINDS = ['openai-compatible', 'gemini', 'groq', 'anthropic', 'ollama', 'custom', 'mock'];
 export const KEY_LIKE = /^(sk-|gsk_|Bearer\s|[A-Za-z0-9_-]{40,}$)/;
+/** The seven scoring-weight dimensions. A `weightOverrides` block may only name these keys. */
+const SCORE_WEIGHT_KEYS = ['capabilityFit', 'quality', 'reliability', 'historicalSuccess', 'latency', 'cost', 'userPreference'];
 const capabilityRequirement = z.object({
     group: z.enum(GROUPS),
     key: z.string().min(1),
@@ -50,10 +52,22 @@ const providerConfig = z
     privacyClass: z.enum(['local', 'cloud']).optional(),
     wireShape: z.enum(['openai', 'anthropic']).optional(),
     headers: z.record(z.string()).optional(),
-    weightOverrides: z.record(z.number()).optional(),
+    weightOverrides: z.record(z.enum(SCORE_WEIGHT_KEYS), z.number()).optional(),
 })
     .strict()
     .refine((p) => !(['openai-compatible', 'custom'].includes(p.kind) && !p.baseUrl), { message: 'openai-compatible/custom providers require a baseUrl' });
+/**
+ * The four router-level blocks that Runtime settings also accept. Defined once here — the single source
+ * of truth used by `routerConfig` below — so `parseConfig` (the public export) accepts them. Before 3.0.1
+ * the root schema rejected them and they were only tolerated via parseRuntimeConfig's fold-back; that
+ * fold-back is gone, and the runtime-config layer now receives them transitively through parseConfig.
+ */
+const learningConfig = z.object({ enabled: z.boolean().optional() }).strict();
+const verificationConfig = z.object({ enabled: z.boolean().optional() }).strict();
+const budgetConfig = z.object({ maxCostUsd: z.number().optional(), maxCalls: z.number().optional() }).strict();
+const policyConfig = z
+    .object({ allowProviders: z.array(z.string()).optional(), denyProviders: z.array(z.string()).optional(), requireLocal: z.boolean().optional(), maxCostUsd: z.number().optional(), strategy: z.enum(STRATEGIES).optional() })
+    .strict();
 const routerConfig = z
     .object({
     providers: z.array(providerConfig),
@@ -65,6 +79,10 @@ const routerConfig = z
         .strict()
         .optional(),
     telemetry: z.object({ enabled: z.boolean().optional(), sink: z.enum(['memory', 'file', 'otlp']).optional(), storePrompts: z.literal(false).optional(), path: z.string().optional(), endpoint: z.string().optional(), headersEnv: z.string().refine((v) => v === undefined || !KEY_LIKE.test(v), { message: 'headersEnv must be an env-var NAME, not a header/token value' }).optional() }).strict().optional(),
+    learning: learningConfig.optional(),
+    verification: verificationConfig.optional(),
+    budget: budgetConfig.optional(),
+    policy: policyConfig.optional(),
     tasks: z.array(taskDefinition).optional(),
 })
     .strict();

package/dist/conversations/conversations.d.ts

@@ -20,11 +20,16 @@ export interface ConversationMeta {
     updatedAt: number;
     turns: number;
 }
+/** Serializes a critical section. Injected from the RuntimeStore's advisory lock; defaults to a no-op. */
+export type WithLock = <T>(fn: () => T) => T;
 export declare class ConversationStore {
     private readonly area;
     private readonly clock;
+    private readonly withLock;
     private counter;
-    constructor(area: Area, clock?: Clock);
+    constructor(area: Area, clock?: Clock, opts?: {
+        withLock?: WithLock;
+    });
     get enabled(): boolean;
     /** Start a conversation; returns its id. */
     start(id?: string): string;