ai-runtime-engine 2.9.0 → 3.0.1

package/dist/conversations/conversations.js

@@ -16,10 +16,13 @@ function deriveTitle(text) {
 export class ConversationStore {
     area;
     clock;
+    withLock;
     counter = 0;
-    constructor(area, clock = systemClock) {
+    constructor(area, clock = systemClock, opts = {}) {
         this.area = area;
         this.clock = clock;
+        // Default is a plain pass-through, so a ConversationStore built without a lock behaves exactly as before.
+        this.withLock = opts.withLock ?? ((fn) => fn());
     }
     get enabled() {
         return this.area.enabled;
@@ -36,13 +39,17 @@ export class ConversationStore {
     append(id, role, text, runId) {
         const safe = redactString(text);
         const turn = { role, text: safe, ts: this.clock.now(), ...(runId ? { runId } : {}) };
-        this.area.appendLine(id, turn);
-        const meta = this.area.tryReadJson(id) ?? { id, title: 'Untitled', createdAt: turn.ts, updatedAt: turn.ts, turns: 0 };
-        meta.turns += 1;
-        meta.updatedAt = turn.ts;
-        if (meta.title === 'Untitled' && role === 'user')
-            meta.title = deriveTitle(safe);
-        this.area.writeJson(id, meta);
+        this.area.appendLine(id, turn); // JSONL append is atomic on its own
+        // Serialize the meta read-modify-write: two concurrent appends must not both read the same turn count
+        // and each write back turns+1 (losing one). The JSONL lines above are safe either way.
+        this.withLock(() => {
+            const meta = this.area.tryReadJson(id) ?? { id, title: 'Untitled', createdAt: turn.ts, updatedAt: turn.ts, turns: 0 };
+            meta.turns += 1;
+            meta.updatedAt = turn.ts;
+            if (meta.title === 'Untitled' && role === 'user')
+                meta.title = deriveTitle(safe);
+            this.area.writeJson(id, meta);
+        });
     }
     turns(id) {
         return this.area.readLines(id);

package/dist/core/fallback/fallback.d.ts

@@ -23,6 +23,13 @@ export interface FallbackInput {
     /** Phase-13 streaming: forwarded to each attempt's `executeOnce`; deltas ride this callback, the final
      *  aggregate rides the return value. Only meaningful when `template.stream` is set. */
     onDelta?: (chunk: string) => void;
+    /** Fired when an attempt that already emitted deltas fails (or is dropped by validation) and fallback
+     *  moves on: the partial stream just sent must be discarded, since the next attempt streams anew. This
+     *  keeps the live stream honest — provider B's answer is never a seamless continuation of provider A's. */
+    onStreamAbandoned?: (info: {
+        providerId: string;
+        model: string;
+    }) => void;
     /** Optional Phase-6 validation. A failing report drops this candidate and continues (no poisoning). */
     validate?: (response: AIResponse, model: string) => ValidationReport;
     /** Optional spend guardrail. When it cannot afford the next call, the run STOPS with BUDGET. */

package/dist/core/fallback/fallback.js

@@ -34,9 +34,18 @@ export async function runWithFallback(input) {
         tried += 1;
         const started = clock.now();
         const request = buildRequest(input.template, model.id, input.signal);
+        // Wrap onDelta per attempt so we know whether THIS attempt streamed anything. If it did and the
+        // attempt then fails or is dropped, we signal abandonment so the consumer discards the partial.
+        let sawDelta = false;
+        const onDelta = input.onDelta
+            ? (chunk) => {
+                sawDelta = true;
+                input.onDelta(chunk);
+            }
+            : undefined;
         const outcome = input.providerLimiter
-            ? await input.providerLimiter.run(providerId, () => executeOnce(provider, request, input.onDelta))
-            : await executeOnce(provider, request, input.onDelta);
+            ? await input.providerLimiter.run(providerId, () => executeOnce(provider, request, onDelta))
+            : await executeOnce(provider, request, onDelta);
         const latencyMs = clock.now() - started;
         input.budget?.recordCall(estCost);
         if (outcome.ok) {
@@ -47,6 +56,8 @@ export async function runWithFallback(input) {
                 const record = { providerId, model: model.id, outcome: 'non-retryable', category: 'RESPONSE_VALIDATION', latencyMs };
                 attempts.push(record);
                 input.onAttempt?.(record);
+                if (sawDelta)
+                    input.onStreamAbandoned?.({ providerId, model: model.id });
                 lastError = new AIError(`response failed validation: ${why}`, { category: 'RESPONSE_VALIDATION', retryable: false, providerId, model: model.id });
                 continue;
             }
@@ -63,6 +74,8 @@ export async function runWithFallback(input) {
         };
         attempts.push(record);
         input.onAttempt?.(record);
+        if (sawDelta)
+            input.onStreamAbandoned?.({ providerId, model: model.id });
         lastError = outcome.error;
         if (record.outcome === 'non-retryable')
             poisoned.add(providerId);

package/dist/core/health/monitor.d.ts

@@ -15,6 +15,12 @@ export declare class HealthMonitor {
     constructor(telemetry?: TelemetrySink | undefined, clock?: Clock, cooldownMs?: number);
     get(providerId: string): HealthStatus | undefined;
     all(): HealthStatus[];
+    /**
+     * Recompute liveness on READ so an inspector (doctor/status) agrees with what `routable()` — and thus
+     * the router — will actually do: once a cooldown has elapsed the provider reads as routable again with
+     * the stale `cooldownUntil` cleared, instead of showing a long-expired cooldown as still down.
+     */
+    private withLiveness;
     /** Optimistic: an unseen provider is routable; a cooled-down one becomes routable again once elapsed. */
     routable(providerId: string): boolean;
     seed(status: HealthStatus): void;

package/dist/core/health/monitor.js

@@ -38,10 +38,23 @@ export class HealthMonitor {
         this.clock = clock;
     }
     get(providerId) {
-        return this.state.get(providerId);
+        const s = this.state.get(providerId);
+        return s ? this.withLiveness(s) : undefined;
     }
     all() {
-        return [...this.state.values()];
+        return [...this.state.values()].map((s) => this.withLiveness(s));
+    }
+    /**
+     * Recompute liveness on READ so an inspector (doctor/status) agrees with what `routable()` — and thus
+     * the router — will actually do: once a cooldown has elapsed the provider reads as routable again with
+     * the stale `cooldownUntil` cleared, instead of showing a long-expired cooldown as still down.
+     */
+    withLiveness(s) {
+        if (s.cooldownUntil !== undefined && this.clock.now() >= s.cooldownUntil) {
+            const { cooldownUntil: _elapsed, ...rest } = s;
+            return { ...rest, routable: true };
+        }
+        return s;
     }
     /** Optimistic: an unseen provider is routable; a cooled-down one becomes routable again once elapsed. */
     routable(providerId) {

package/dist/core/router/confidence.js

@@ -8,13 +8,18 @@ const clamp01 = (n) => (n < 0 ? 0 : n > 1 ? 1 : n);
 export function deriveConfidence(topScore, model, task) {
     let evFactor = 1;
     if (task.required.length > 0) {
-        const sum = task.required.reduce((acc, r) => {
+        // Same per-requirement weighting (weight ?? 1) as capabilityFit, so fit and confidence stay consistent.
+        let wsum = 0;
+        let sum = 0;
+        for (const r of task.required) {
+            const w = r.weight ?? 1;
+            wsum += w;
             if (!capabilitySatisfies(model.capabilities, r))
-                return acc; // pinned/unknown-capability model: penalize
+                continue; // pinned/unknown-capability model: penalize
             const cap = getCapability(model.capabilities, r.group, r.key);
-            return acc + rankOf(cap.evidence) / 4;
-        }, 0);
-        evFactor = sum / task.required.length;
+            sum += w * (rankOf(cap.evidence) / 4);
+        }
+        evFactor = wsum > 0 ? sum / wsum : 1;
     }
     return clamp01(topScore * (0.5 + 0.5 * evFactor) * task.confidence);
 }

package/dist/core/router/dimensions.d.ts

@@ -4,8 +4,10 @@
  * so `core/scoring` never imports vendor data. `historicalSuccess` is a static placeholder here and
  * is wired to telemetry in a later stage.
  */
-import type { ModelMetadata, NormalizedTask } from '../../types.js';
+import type { ModelMetadata, NormalizedTask, QualityTier } from '../../types.js';
 import type { ObservedPerf } from '../../learning/performanceStore.js';
+/** Quality-tier ordering, exported so the filter can enforce a task's qualityFloor with the same scale. */
+export declare const TIER_SCORE: Record<QualityTier, number>;
 /** How well the model meets required capabilities (evidence-weighted) plus a preferred-coverage bonus. */
 export declare function capabilityFit(model: ModelMetadata, task: NormalizedTask): number;
 export declare function quality(model: ModelMetadata): number;

package/dist/core/router/dimensions.js

@@ -7,17 +7,27 @@
 import { rankOf } from '../capabilities/evidence.js';
 import { capabilitySatisfies, getCapability } from '../capabilities/evidence.js';
 const clamp01 = (n) => (n < 0 ? 0 : n > 1 ? 1 : n);
-const TIER_SCORE = { frontier: 1, strong: 0.8, mid: 0.6, small: 0.4 };
+/** Quality-tier ordering, exported so the filter can enforce a task's qualityFloor with the same scale. */
+export const TIER_SCORE = { frontier: 1, strong: 0.8, mid: 0.6, small: 0.4 };
 /** How well the model meets required capabilities (evidence-weighted) plus a preferred-coverage bonus. */
 export function capabilityFit(model, task) {
     const evFactor = (key, group) => {
         const cap = getCapability(model.capabilities, group, key);
         return cap.value ? rankOf(cap.evidence) / 4 : 0;
     };
-    const requiredScore = task.required.length === 0
-        ? 1
-        : task.required.reduce((acc, r) => acc + (capabilitySatisfies(model.capabilities, r) ? evFactor(r.key, r.group) : 0), 0) /
-            task.required.length;
+    // Per-requirement weighting (CapabilityRequirement.weight, default 1): a requirement's contribution to
+    // the mean is proportional to its weight. With all weights defaulting to 1 this is the plain mean.
+    let requiredScore = 1;
+    if (task.required.length > 0) {
+        let wsum = 0;
+        let acc = 0;
+        for (const r of task.required) {
+            const w = r.weight ?? 1;
+            wsum += w;
+            acc += w * (capabilitySatisfies(model.capabilities, r) ? evFactor(r.key, r.group) : 0);
+        }
+        requiredScore = wsum > 0 ? acc / wsum : 1;
+    }
     if (task.preferred.length === 0)
         return clamp01(requiredScore);
     const preferredScore = task.preferred.filter((r) => capabilitySatisfies(model.capabilities, r)).length / task.preferred.length;

package/dist/core/router/filter.js

@@ -8,6 +8,7 @@
  * it, so high-sensitivity input can never reach a cloud provider without an explicit allowance.
  */
 import { capabilitySatisfies } from '../capabilities/evidence.js';
+import { TIER_SCORE } from './dimensions.js';
 import { buildRequest } from './request.js';
 import { isExcluded } from './routingPrefs.js';
 function privacyFloor(task, p) {
@@ -78,6 +79,13 @@ export async function filterCandidates(input) {
             exclude(`context window ${candidate.model.contextWindow} < required ${task.minContextWindow}`);
             continue;
         }
+        // quality floor — exclude a model whose declared tier is below the task's floor. A model with NO
+        // quality tier is NOT excluded (metadata coverage is sparse; a floor is a preference gate, not a
+        // safety gate — excluding unrated models would silently empty a custom provider's pool).
+        if (task.qualityFloor !== undefined && candidate.model.quality?.tier !== undefined && TIER_SCORE[candidate.model.quality.tier] < TIER_SCORE[task.qualityFloor]) {
+            exclude(`model quality tier '${candidate.model.quality.tier}' is below the required floor '${task.qualityFloor}'`);
+            continue;
+        }
         // privacy (unconditional)
         if (requireLocal && provider.privacyClass !== 'local') {
             exclude(`privacy: high/undeclared sensitivity may not use cloud provider (privacyClass=${provider.privacyClass})`);
@@ -91,9 +99,24 @@ export async function filterCandidates(input) {
             exclude(`local providers disabled by policy`);
             continue;
         }
-        // hard cost / latency constraints
+        // estimate — a cheap, local (no-network) computation for built-in providers. Context-fit is ALWAYS
+        // enforced: an input that cannot fit a model's window must never be routed there merely because no
+        // cost/latency constraint was supplied. Cost/latency remain conditional on declared constraints. A
+        // third-party provider's estimate() could still throw; contain it so one bad candidate is excluded
+        // with a reason, not the whole route.
+        let estimate;
+        try {
+            estimate = await provider.estimate(buildRequest(input.template, modelId));
+        }
+        catch {
+            exclude(`estimate failed`);
+            continue;
+        }
+        if (!estimate.contextFits) {
+            exclude(`input does not fit model context window`);
+            continue;
+        }
         if (wantCostLatency) {
-            const estimate = await provider.estimate(buildRequest(input.template, modelId));
             if (constraints?.maxCostUsd !== undefined && estimate.estCost && estimate.estCost.amount > constraints.maxCostUsd) {
                 exclude(`estimated cost ${estimate.estCost.amount} > maxCostUsd ${constraints.maxCostUsd}`);
                 continue;
@@ -102,10 +125,6 @@ export async function filterCandidates(input) {
                 exclude(`estimated latency ${estimate.estLatencyMs.p50}ms > maxLatencyMs ${constraints.maxLatencyMs}`);
                 continue;
             }
-            if (!estimate.contextFits) {
-                exclude(`input does not fit model context window`);
-                continue;
-            }
         }
         eligible.push(candidate);
     }

package/dist/core/router/normalize.js

@@ -113,6 +113,8 @@ export function normalize(req, tasks, config) {
     };
     if (minContextWindow !== undefined)
         task.minContextWindow = minContextWindow;
+    if (def?.qualityFloor !== undefined)
+        task.qualityFloor = def.qualityFloor;
     if (output !== undefined)
         task.output = output;
     return { task, template };

package/dist/core/router/router.js

@@ -80,7 +80,18 @@ export class Router {
         const history = this.deps.performance
             ? (pid, mid) => this.deps.performance.forTask(task.id, pid, mid)
             : undefined;
-        const scored = scoreCandidates(eligible, task, config.weights, task.strategy, { ...(history ? { history } : {}), ...(req.routing ? { prefer: req.routing } : {}) });
+        // Per-provider score-weight overrides (ProviderConfig.weightOverrides), applied to that provider's
+        // candidates only. Built once here; empty ⇒ every provider scores under the base weights.
+        const weightOverridesByProvider = {};
+        for (const p of config.providers)
+            if (p.weightOverrides)
+                weightOverridesByProvider[p.id] = p.weightOverrides;
+        const hasOverrides = Object.keys(weightOverridesByProvider).length > 0;
+        const scored = scoreCandidates(eligible, task, config.weights, task.strategy, {
+            ...(history ? { history } : {}),
+            ...(req.routing ? { prefer: req.routing } : {}),
+            ...(hasOverrides ? { weightOverridesByProvider } : {}),
+        });
         const ranked = scored.map((s) => ({
             providerId: s.candidate.providerId,
             model: s.candidate.model.id,
@@ -142,6 +153,7 @@ export class Router {
             clock: this.clock,
             onAttempt,
             ...(template.stream && req.onDelta ? { onDelta: req.onDelta } : {}),
+            ...(template.stream && req.onStreamAbandoned ? { onStreamAbandoned: req.onStreamAbandoned } : {}),
             validate: (response) => validateResponse({ response, ...(template.output ? { output: template.output } : {}), ...(template.tools ? { tools: template.tools } : {}) }),
             ...(budget ? { budget, costOf } : {}),
             ...(this.deps.providerLimiter ? { providerLimiter: this.deps.providerLimiter } : {}),
@@ -176,7 +188,9 @@ export class Router {
                     confidence = Math.min(1, confidence + 0.05);
             }
         }
-        baseReport.belowConfidenceThreshold = confidence < config.minConfidence;
+        // The effective floor honors BOTH the config default and a stricter per-run constraints.minimumConfidence.
+        const effectiveMinConfidence = Math.max(config.minConfidence, req.constraints?.minimumConfidence ?? 0);
+        baseReport.belowConfidenceThreshold = confidence < effectiveMinConfidence;
         telemetry.emit({ type: 'route.result', ts: this.clock.now(), taskId: task.id, ok: true, confidence, totalLatencyMs: this.clock.now() - runStarted, fallbackCount });
         return { ok: true, response: fb.response, confidence, routing: baseReport };
     }

package/dist/core/router/scorer.d.ts

@@ -15,5 +15,8 @@ export interface ScoreOptions {
     /** User prefer routing — a SOFT nudge to the userPreference dimension (never a hard override). */
     prefer?: RoutingPreferences;
     history?: HistoryLookup;
+    /** Per-provider score-weight overrides (ProviderConfig.weightOverrides), merged over the base weights
+     *  for that provider's candidates only. Absent → every provider uses the base weights. */
+    weightOverridesByProvider?: Record<string, Partial<ScoreWeights>>;
 }
 export declare function scoreCandidates(candidates: Candidate[], task: NormalizedTask, baseWeights: ScoreWeights, strategy: Strategy, options?: ScoreOptions): ScoredCandidate[];

package/dist/core/router/scorer.js

@@ -13,10 +13,25 @@ function preferenceValue(candidate, options) {
     return options.preferences?.[candidate.providerId];
 }
 export function scoreCandidates(candidates, task, baseWeights, strategy, options = {}) {
-    const w = strategyWeights(strategy, baseWeights);
-    const total = weightSum(w) || 1;
+    // Resolve strategy-adjusted weights per PROVIDER: a provider with a weightOverrides block scores its
+    // candidates under (base ⊕ override); everyone else shares the base. Memoized so it is computed once
+    // per provider, not once per candidate.
+    const overrides = options.weightOverridesByProvider;
+    const weightCache = new Map();
+    const weightsFor = (providerId) => {
+        let entry = weightCache.get(providerId);
+        if (!entry) {
+            const override = overrides?.[providerId];
+            const merged = override ? { ...baseWeights, ...override } : baseWeights;
+            const w = strategyWeights(strategy, merged);
+            entry = { w, total: weightSum(w) || 1 };
+            weightCache.set(providerId, entry);
+        }
+        return entry;
+    };
     const scored = candidates.map((candidate) => {
         const m = candidate.model;
+        const { w, total } = weightsFor(candidate.providerId);
         const observed = options.history?.(candidate.providerId, m.id);
         const breakdown = {
             capabilityFit: dim.capabilityFit(m, task),

package/dist/discovery/openapi.js

@@ -57,15 +57,16 @@ export function analyzeOpenApi(spec) {
     // Suggest a config only when we found an OpenAI-compatible chat endpoint and a base URL.
     if (wireShape === 'openai' && baseUrl) {
         const base = baseUrl.replace(/\/chat\/completions$/i, '').replace(/\/+$/, '');
+        // No `models` is suggested: 'openai-compatible' has no built-in model catalog, so `models: 'auto'`
+        // would resolve to zero models (a load-time CONFIG error). The user must list models explicitly.
         analysis.suggestedProviderConfig = {
             id: 'openapi-provider',
             kind: 'openai-compatible',
             baseUrl: base,
             apiKeyEnv: 'OPENAPI_PROVIDER_API_KEY',
             wireShape: 'openai',
-            models: 'auto',
         };
-        notes.push('Suggested an openai-compatible provider config — review it, set models, and supply the key via OPENAPI_PROVIDER_API_KEY.');
+        notes.push('Suggested an openai-compatible provider config — review it, set `models` (this kind has no built-in catalog), and supply the key via OPENAPI_PROVIDER_API_KEY.');
     }
     return analysis;
 }

package/dist/executions/agentTasks.d.ts

@@ -213,11 +213,11 @@ export declare const persistedAgentTask: z.ZodObject<{
         total: z.ZodNumber;
         succeeded: z.ZodNumber;
     }, "strict", z.ZodTypeAny, {
-        succeeded: number;
         total: number;
-    }, {
         succeeded: number;
+    }, {
         total: number;
+        succeeded: number;
     }>;
     callsReserved: z.ZodNumber;
     callsUsed: z.ZodNumber;
@@ -366,8 +366,8 @@ export declare const persistedAgentTask: z.ZodObject<{
     callsUsed: number;
     agentId: string;
     innerSteps: {
-        succeeded: number;
         total: number;
+        succeeded: number;
     };
     toolCallsUsed: number;
     findings: z.objectOutputType<{
@@ -493,8 +493,8 @@ export declare const persistedAgentTask: z.ZodObject<{
     callsUsed: number;
     agentId: string;
     innerSteps: {
-        succeeded: number;
         total: number;
+        succeeded: number;
     };
     toolCallsUsed: number;
     findings: z.objectInputType<{

package/dist/generation/generateAdapter.js

@@ -22,7 +22,9 @@ export function generateProviderConfig(analysis, overrides = {}) {
         ...(overrides.models ? { models: overrides.models } : {}),
     };
     if (config.models === 'auto' && !overrides.models) {
-        // Discovery of the model list is not yet implemented; require an explicit model list to route.
+        // `models: 'auto'` resolves to the kind's built-in catalog, which is empty for baseUrl-based kinds
+        // (openai-compatible/custom) — so for a generated adapter it would fail at load. Drop it and require
+        // an explicit model list (buildProvider raises a clear CONFIG error if the user leaves it unset).
         delete config.models;
     }
     return config;

package/dist/index.d.ts

@@ -85,7 +85,9 @@ export { RuntimeStore, STORE_VERSION } from './store/store.js';
 export type { RuntimeStoreOptions, StorePaths } from './store/store.js';
 export { FileArea, NullArea } from './store/area.js';
 export type { Area, IntegrityIssue, ContentCodec } from './store/area.js';
-export { makeCodec, deriveKey, encryptString, decryptString, ENVELOPE_PREFIX } from './store/crypto.js';
+export { makeCodec, deriveKey, encryptString, decryptString, encryptStringV2, ENVELOPE_PREFIX, ENVELOPE_PREFIX_V2 } from './store/crypto.js';
+export { StoreDecryptError } from './store/errors.js';
+export type { StoreDecryptCode } from './store/errors.js';
 export { resolveHome, projectId, repositoryId, organizationId, findRepoRoot } from './store/paths.js';
 export { deriveCapabilities, deriveCapabilitiesOffline, candidatesFrom, candidateSlate, DERIVE_MAX_CANDIDATES, DERIVE_MAX_IDS } from './runtime/planning/deriveCapabilities.js';
 export type { CapabilityCandidate, DeriveCapabilitiesInput, DeriveCapabilitiesResult } from './runtime/planning/deriveCapabilities.js';
@@ -145,7 +147,7 @@ export { resolveInJail, JailError } from './tools/jail.js';
 export { defaultRunner, safeEnv } from './tools/runner.js';
 export type { CommandRunner, RunOptions, RunResult } from './tools/runner.js';
 export { filesystemTool } from './tools/builtins/filesystem.js';
-export { shellTool, createShellTool, isDestructive } from './tools/builtins/shell.js';
+export { shellTool, createShellTool, isDestructive, isEvalCapable } from './tools/builtins/shell.js';
 export { gitTool, createGitTool } from './tools/builtins/git.js';
 export { wrapUntrusted, looksLikeInjection } from './tools/untrusted.js';
 export { SkillRegistry } from './skills/registry.js';

package/dist/index.js

@@ -66,7 +66,8 @@ export { deriveAccessState, buildProviderViews, ProviderViewCache } from './runt
 // ── Runtime (Phase 3) — local store, conversations, memory ──
 export { RuntimeStore, STORE_VERSION } from './store/store.js';
 export { FileArea, NullArea } from './store/area.js';
-export { makeCodec, deriveKey, encryptString, decryptString, ENVELOPE_PREFIX } from './store/crypto.js';
+export { makeCodec, deriveKey, encryptString, decryptString, encryptStringV2, ENVELOPE_PREFIX, ENVELOPE_PREFIX_V2 } from './store/crypto.js';
+export { StoreDecryptError } from './store/errors.js';
 export { resolveHome, projectId, repositoryId, organizationId, findRepoRoot } from './store/paths.js';
 // ── Capability-first planning (Phase 3.3) — offline BM25 derivation, one model rung under it ──
 export { deriveCapabilities, deriveCapabilitiesOffline, candidatesFrom, candidateSlate, DERIVE_MAX_CANDIDATES, DERIVE_MAX_IDS } from './runtime/planning/deriveCapabilities.js';
@@ -107,7 +108,7 @@ export { resolvePermissions } from './tools/permissions.js';
 export { resolveInJail, JailError } from './tools/jail.js';
 export { defaultRunner, safeEnv } from './tools/runner.js';
 export { filesystemTool } from './tools/builtins/filesystem.js';
-export { shellTool, createShellTool, isDestructive } from './tools/builtins/shell.js';
+export { shellTool, createShellTool, isDestructive, isEvalCapable } from './tools/builtins/shell.js';
 export { gitTool, createGitTool } from './tools/builtins/git.js';
 export { wrapUntrusted, looksLikeInjection } from './tools/untrusted.js';
 export { SkillRegistry } from './skills/registry.js';

package/dist/mcp/protocol.js

@@ -100,7 +100,10 @@ export function sanitizeSchema(raw, budget = { nodes: MCP_SCHEMA_MAX_NODES }, de
     }
     if (typeof raw !== 'object')
         return undefined;
-    const out = {};
+    // Null-prototype so a server key literally named `__proto__` (or `constructor`/`prototype`) becomes an
+    // OWN data property instead of hitting the inherited setter — which would silently drop it or mutate the
+    // object's prototype. JSON.stringify of a null-proto object is unaffected.
+    const out = Object.create(null);
     for (const [k, v] of Object.entries(raw).slice(0, 64)) {
         const key = clampText(k, 64);
         if (!key)

package/dist/memory/bm25.d.ts

@@ -3,6 +3,13 @@
  * deterministically. An `EmbeddingProvider` seam (memory/memory.ts) lets real embeddings replace this
  * later without changing the retrieval API.
  */
+/**
+ * Unicode-aware tokenizer. Matches letter/number runs across ALL scripts (`\p{L}\p{N}`), so accented
+ * Latin, Cyrillic, Arabic, Korean, etc. are searchable — the old `[a-z0-9]` dropped every non-ASCII
+ * character silently. A run containing an unsegmented-CJK character is split into single characters
+ * (length-1 allowed, since one Han character is meaningful); all other tokens keep the ≥2-length filter
+ * and the English stopword list. Pure-ASCII input tokenizes byte-identically to the previous behavior.
+ */
 export declare function tokenize(text: string): string[];
 export interface Bm25Doc {
     id: string;

package/dist/memory/bm25.js

@@ -6,10 +6,26 @@
 const STOPWORDS = new Set([
     'the', 'a', 'an', 'and', 'or', 'but', 'is', 'are', 'was', 'were', 'be', 'been', 'to', 'of', 'in', 'on', 'for', 'with', 'as', 'by', 'at', 'this', 'that', 'these', 'those', 'it', 'its', 'i', 'you', 'we', 'they', 'do', 'does', 'did', 'has', 'have', 'had', 'will', 'would', 'should', 'can', 'could',
 ]);
+// Chinese/Japanese scripts (Han/Hiragana/Katakana) are NOT space-delimited, so a whole clause matches as
+// one run; splitting it into single characters gives BM25 something to overlap on. Korean (Hangul) and
+// every other script ARE space-delimited, so their words tokenize whole (kept out of this set).
+const CJK_UNSEGMENTED = /[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}]/u;
+/**
+ * Unicode-aware tokenizer. Matches letter/number runs across ALL scripts (`\p{L}\p{N}`), so accented
+ * Latin, Cyrillic, Arabic, Korean, etc. are searchable — the old `[a-z0-9]` dropped every non-ASCII
+ * character silently. A run containing an unsegmented-CJK character is split into single characters
+ * (length-1 allowed, since one Han character is meaningful); all other tokens keep the ≥2-length filter
+ * and the English stopword list. Pure-ASCII input tokenizes byte-identically to the previous behavior.
+ */
 export function tokenize(text) {
     const out = [];
-    for (const m of text.toLowerCase().matchAll(/[a-z0-9]+/g)) {
+    for (const m of text.toLowerCase().matchAll(/[\p{L}\p{N}]+/gu)) {
         const tok = m[0];
+        if (CJK_UNSEGMENTED.test(tok)) {
+            for (const ch of tok)
+                out.push(ch); // one meaningful unit per character
+            continue;
+        }
         if (tok.length >= 2 && !STOPWORDS.has(tok))
             out.push(tok);
     }

package/dist/memory/memory.d.ts

@@ -59,8 +59,14 @@ export declare class MemoryStore {
     private readonly embedder?;
     private readonly clock;
     private counter;
-    /** Per-instance cache of fact-text → vector, so a stable fact isn't re-embedded on every query. */
+    /** Per-instance cache of fact-text → vector, so a stable fact isn't re-embedded on every query. Bounded
+     *  (see cacheVec) so a long-lived host process cannot grow it without limit. */
     private readonly vecCache;
+    /** Cap on distinct cached vectors. On overflow the cache is cleared wholesale — the only cost is
+     *  re-embedding, never correctness. A session touching more than this many distinct facts is rare. */
+    private static readonly VEC_CACHE_MAX;
+    /** Store a vector, clearing the cache first if it is at capacity (bounded growth). */
+    private cacheVec;
     constructor(store: RuntimeStore, clock?: Clock, embedder?: EmbeddingProvider | undefined);
     get enabled(): boolean;
     private area;

package/dist/memory/memory.js

@@ -25,8 +25,18 @@ export class MemoryStore {
     embedder;
     clock;
     counter = 0;
-    /** Per-instance cache of fact-text → vector, so a stable fact isn't re-embedded on every query. */
+    /** Per-instance cache of fact-text → vector, so a stable fact isn't re-embedded on every query. Bounded
+     *  (see cacheVec) so a long-lived host process cannot grow it without limit. */
     vecCache = new Map();
+    /** Cap on distinct cached vectors. On overflow the cache is cleared wholesale — the only cost is
+     *  re-embedding, never correctness. A session touching more than this many distinct facts is rare. */
+    static VEC_CACHE_MAX = 2000;
+    /** Store a vector, clearing the cache first if it is at capacity (bounded growth). */
+    cacheVec(text, vec) {
+        if (this.vecCache.size >= MemoryStore.VEC_CACHE_MAX && !this.vecCache.has(text))
+            this.vecCache.clear();
+        this.vecCache.set(text, vec);
+    }
     constructor(store, clock = systemClock, embedder) {
         this.store = store;
         this.embedder = embedder;
@@ -172,7 +182,7 @@ export class MemoryStore {
                 // Cache only USABLE vectors — a degenerate ([] or non-finite) embedding must never be treated as
                 // valid nor poison the cache (a poisoned entry silently excludes that fact for the rest of the session).
                 need.forEach((t, i) => { if (isUsableVec(vecs[i]))
-                    this.vecCache.set(t, vecs[i]); });
+                    this.cacheVec(t, vecs[i]); });
             }
             const [queryVec] = await this.embedder.embed([query]);
             const docs = candidates.filter((c) => this.vecCache.has(c.text)).map((c) => ({ id: c.id, vec: this.vecCache.get(c.text) }));
@@ -197,6 +207,8 @@ export class MemoryStore {
     removeCascade(id) {
         const target = this.get(id);
         const inheritor = target?.supersededBy; // if the removed record was itself superseded, heirs re-link to its head
+        // Invalidate the cached vector for the removed record's text (if any) — and report whether we did.
+        const cacheEvicted = target ? this.vecCache.delete(target.text) : false;
         let primary = false;
         let relationships = 0;
         for (const scope of this.physicalScopes()) {
@@ -232,8 +244,10 @@ export class MemoryStore {
                 }
             }
         }
-        // Indexes are derived from records at query time; nothing separate to purge (true once persisted).
-        return { id, primary, indexes: true, relationships, cache: true };
+        // Honest audit: `indexes` reflects the removal only when the primary was actually removed (indexes are
+        // query-time-derived, so they change iff the record did); `cache` reports whether a vector was evicted.
+        // A delete of a nonexistent id now reports all-false rather than a hardcoded success.
+        return { id, primary, indexes: primary, relationships, cache: cacheEvicted };
     }
     /** Remove expired records with full cascade, under the lock. Returns removed ids. */
     purgeExpired(now = this.clock.now()) {

package/dist/orchestration/orchestrator.d.ts

@@ -43,7 +43,8 @@ export interface OrchestrateInput {
     routing?: RoutingPreferences;
     /** Phase 22: run the phases that fit the call budget and pause resumably (vs. the default notify-and-wait). */
     partial?: boolean;
-    /** Phase 3.1: pre-rendered action-capability snapshot for the planner prompt (opt-in). */
+    /** Phase 3.1: pre-rendered, fenced action-capability snapshot for the planner prompt. Present by
+     *  default from 3.0.0; `runtime.capabilities.catalog: false` removes it. */
     capabilityCatalog?: string;
     /** Phase 3.3: pre-rendered "Required capabilities" block for the planner prompt (opt-in). */
     requiredCapabilities?: string;

package/dist/orchestration/planner.d.ts

@@ -18,7 +18,8 @@ export interface PlannerInput {
     reason?: string;
     /** Observations from a prior attempt, to inform a replan. */
     priorObservations?: string[];
-    /** Phase 3.1: a pre-rendered, capped, fenced action-capability snapshot. Absent ⇒ the prompt is
+    /** Phase 3.1: a pre-rendered, capped, fenced action-capability snapshot (fenced for real as of
+     *  3.0.0, and present by default from it). Absent ⇒ the prompt is
      *  byte-identical to 2.3.0 (the catalog flag is off by default). */
     capabilityCatalog?: string;
     /** Phase 3.3: a pre-rendered, clamped block naming the capabilities the goal was derived to need and

package/dist/plugin/ai.d.ts

@@ -70,6 +70,12 @@ export declare class AI {
     providers(): ProviderInfo[];
     tasksList(): TaskDefinition[];
     telemetryEvents(): TelemetryEvent[];
+    /**
+     * Release AI-level resources. Today: flush any batching telemetry sink (e.g. OTLP) so a short-lived
+     * process does not drop events buffered below the batch threshold. Safe to call more than once, and a
+     * failing flush never throws (telemetry must not fail shutdown). Runtime.close() calls this.
+     */
+    close(): Promise<void>;
     /** Run each provider's healthCheck(), seed the monitor, and return the statuses (for `doctor`). */
     checkHealth(): Promise<HealthStatus[]>;
     /** Discover provider identity, models, and capabilities (for `providers`/`models`/`capabilities`). */