ai-runtime-engine 3.0.0 → 3.0.1

package/dist/core/router/scorer.js

@@ -13,10 +13,25 @@ function preferenceValue(candidate, options) {
     return options.preferences?.[candidate.providerId];
 }
 export function scoreCandidates(candidates, task, baseWeights, strategy, options = {}) {
-    const w = strategyWeights(strategy, baseWeights);
-    const total = weightSum(w) || 1;
+    // Resolve strategy-adjusted weights per PROVIDER: a provider with a weightOverrides block scores its
+    // candidates under (base ⊕ override); everyone else shares the base. Memoized so it is computed once
+    // per provider, not once per candidate.
+    const overrides = options.weightOverridesByProvider;
+    const weightCache = new Map();
+    const weightsFor = (providerId) => {
+        let entry = weightCache.get(providerId);
+        if (!entry) {
+            const override = overrides?.[providerId];
+            const merged = override ? { ...baseWeights, ...override } : baseWeights;
+            const w = strategyWeights(strategy, merged);
+            entry = { w, total: weightSum(w) || 1 };
+            weightCache.set(providerId, entry);
+        }
+        return entry;
+    };
     const scored = candidates.map((candidate) => {
         const m = candidate.model;
+        const { w, total } = weightsFor(candidate.providerId);
         const observed = options.history?.(candidate.providerId, m.id);
         const breakdown = {
             capabilityFit: dim.capabilityFit(m, task),

package/dist/discovery/openapi.js

@@ -57,15 +57,16 @@ export function analyzeOpenApi(spec) {
     // Suggest a config only when we found an OpenAI-compatible chat endpoint and a base URL.
     if (wireShape === 'openai' && baseUrl) {
         const base = baseUrl.replace(/\/chat\/completions$/i, '').replace(/\/+$/, '');
+        // No `models` is suggested: 'openai-compatible' has no built-in model catalog, so `models: 'auto'`
+        // would resolve to zero models (a load-time CONFIG error). The user must list models explicitly.
         analysis.suggestedProviderConfig = {
             id: 'openapi-provider',
             kind: 'openai-compatible',
             baseUrl: base,
             apiKeyEnv: 'OPENAPI_PROVIDER_API_KEY',
             wireShape: 'openai',
-            models: 'auto',
         };
-        notes.push('Suggested an openai-compatible provider config — review it, set models, and supply the key via OPENAPI_PROVIDER_API_KEY.');
+        notes.push('Suggested an openai-compatible provider config — review it, set `models` (this kind has no built-in catalog), and supply the key via OPENAPI_PROVIDER_API_KEY.');
     }
     return analysis;
 }

package/dist/executions/agentTasks.d.ts

@@ -213,11 +213,11 @@ export declare const persistedAgentTask: z.ZodObject<{
         total: z.ZodNumber;
         succeeded: z.ZodNumber;
     }, "strict", z.ZodTypeAny, {
-        succeeded: number;
         total: number;
-    }, {
         succeeded: number;
+    }, {
         total: number;
+        succeeded: number;
     }>;
     callsReserved: z.ZodNumber;
     callsUsed: z.ZodNumber;
@@ -366,8 +366,8 @@ export declare const persistedAgentTask: z.ZodObject<{
     callsUsed: number;
     agentId: string;
     innerSteps: {
-        succeeded: number;
         total: number;
+        succeeded: number;
     };
     toolCallsUsed: number;
     findings: z.objectOutputType<{
@@ -493,8 +493,8 @@ export declare const persistedAgentTask: z.ZodObject<{
     callsUsed: number;
     agentId: string;
     innerSteps: {
-        succeeded: number;
         total: number;
+        succeeded: number;
     };
     toolCallsUsed: number;
     findings: z.objectInputType<{

package/dist/generation/generateAdapter.js

@@ -22,7 +22,9 @@ export function generateProviderConfig(analysis, overrides = {}) {
         ...(overrides.models ? { models: overrides.models } : {}),
     };
     if (config.models === 'auto' && !overrides.models) {
-        // Discovery of the model list is not yet implemented; require an explicit model list to route.
+        // `models: 'auto'` resolves to the kind's built-in catalog, which is empty for baseUrl-based kinds
+        // (openai-compatible/custom) — so for a generated adapter it would fail at load. Drop it and require
+        // an explicit model list (buildProvider raises a clear CONFIG error if the user leaves it unset).
         delete config.models;
     }
     return config;

package/dist/index.d.ts

@@ -85,7 +85,9 @@ export { RuntimeStore, STORE_VERSION } from './store/store.js';
 export type { RuntimeStoreOptions, StorePaths } from './store/store.js';
 export { FileArea, NullArea } from './store/area.js';
 export type { Area, IntegrityIssue, ContentCodec } from './store/area.js';
-export { makeCodec, deriveKey, encryptString, decryptString, ENVELOPE_PREFIX } from './store/crypto.js';
+export { makeCodec, deriveKey, encryptString, decryptString, encryptStringV2, ENVELOPE_PREFIX, ENVELOPE_PREFIX_V2 } from './store/crypto.js';
+export { StoreDecryptError } from './store/errors.js';
+export type { StoreDecryptCode } from './store/errors.js';
 export { resolveHome, projectId, repositoryId, organizationId, findRepoRoot } from './store/paths.js';
 export { deriveCapabilities, deriveCapabilitiesOffline, candidatesFrom, candidateSlate, DERIVE_MAX_CANDIDATES, DERIVE_MAX_IDS } from './runtime/planning/deriveCapabilities.js';
 export type { CapabilityCandidate, DeriveCapabilitiesInput, DeriveCapabilitiesResult } from './runtime/planning/deriveCapabilities.js';
@@ -145,7 +147,7 @@ export { resolveInJail, JailError } from './tools/jail.js';
 export { defaultRunner, safeEnv } from './tools/runner.js';
 export type { CommandRunner, RunOptions, RunResult } from './tools/runner.js';
 export { filesystemTool } from './tools/builtins/filesystem.js';
-export { shellTool, createShellTool, isDestructive } from './tools/builtins/shell.js';
+export { shellTool, createShellTool, isDestructive, isEvalCapable } from './tools/builtins/shell.js';
 export { gitTool, createGitTool } from './tools/builtins/git.js';
 export { wrapUntrusted, looksLikeInjection } from './tools/untrusted.js';
 export { SkillRegistry } from './skills/registry.js';

package/dist/index.js

@@ -66,7 +66,8 @@ export { deriveAccessState, buildProviderViews, ProviderViewCache } from './runt
 // ── Runtime (Phase 3) — local store, conversations, memory ──
 export { RuntimeStore, STORE_VERSION } from './store/store.js';
 export { FileArea, NullArea } from './store/area.js';
-export { makeCodec, deriveKey, encryptString, decryptString, ENVELOPE_PREFIX } from './store/crypto.js';
+export { makeCodec, deriveKey, encryptString, decryptString, encryptStringV2, ENVELOPE_PREFIX, ENVELOPE_PREFIX_V2 } from './store/crypto.js';
+export { StoreDecryptError } from './store/errors.js';
 export { resolveHome, projectId, repositoryId, organizationId, findRepoRoot } from './store/paths.js';
 // ── Capability-first planning (Phase 3.3) — offline BM25 derivation, one model rung under it ──
 export { deriveCapabilities, deriveCapabilitiesOffline, candidatesFrom, candidateSlate, DERIVE_MAX_CANDIDATES, DERIVE_MAX_IDS } from './runtime/planning/deriveCapabilities.js';
@@ -107,7 +108,7 @@ export { resolvePermissions } from './tools/permissions.js';
 export { resolveInJail, JailError } from './tools/jail.js';
 export { defaultRunner, safeEnv } from './tools/runner.js';
 export { filesystemTool } from './tools/builtins/filesystem.js';
-export { shellTool, createShellTool, isDestructive } from './tools/builtins/shell.js';
+export { shellTool, createShellTool, isDestructive, isEvalCapable } from './tools/builtins/shell.js';
 export { gitTool, createGitTool } from './tools/builtins/git.js';
 export { wrapUntrusted, looksLikeInjection } from './tools/untrusted.js';
 export { SkillRegistry } from './skills/registry.js';

package/dist/mcp/protocol.js

@@ -100,7 +100,10 @@ export function sanitizeSchema(raw, budget = { nodes: MCP_SCHEMA_MAX_NODES }, de
     }
     if (typeof raw !== 'object')
         return undefined;
-    const out = {};
+    // Null-prototype so a server key literally named `__proto__` (or `constructor`/`prototype`) becomes an
+    // OWN data property instead of hitting the inherited setter — which would silently drop it or mutate the
+    // object's prototype. JSON.stringify of a null-proto object is unaffected.
+    const out = Object.create(null);
     for (const [k, v] of Object.entries(raw).slice(0, 64)) {
         const key = clampText(k, 64);
         if (!key)

package/dist/memory/bm25.d.ts

@@ -3,6 +3,13 @@
  * deterministically. An `EmbeddingProvider` seam (memory/memory.ts) lets real embeddings replace this
  * later without changing the retrieval API.
  */
+/**
+ * Unicode-aware tokenizer. Matches letter/number runs across ALL scripts (`\p{L}\p{N}`), so accented
+ * Latin, Cyrillic, Arabic, Korean, etc. are searchable — the old `[a-z0-9]` dropped every non-ASCII
+ * character silently. A run containing an unsegmented-CJK character is split into single characters
+ * (length-1 allowed, since one Han character is meaningful); all other tokens keep the ≥2-length filter
+ * and the English stopword list. Pure-ASCII input tokenizes byte-identically to the previous behavior.
+ */
 export declare function tokenize(text: string): string[];
 export interface Bm25Doc {
     id: string;

package/dist/memory/bm25.js

@@ -6,10 +6,26 @@
 const STOPWORDS = new Set([
     'the', 'a', 'an', 'and', 'or', 'but', 'is', 'are', 'was', 'were', 'be', 'been', 'to', 'of', 'in', 'on', 'for', 'with', 'as', 'by', 'at', 'this', 'that', 'these', 'those', 'it', 'its', 'i', 'you', 'we', 'they', 'do', 'does', 'did', 'has', 'have', 'had', 'will', 'would', 'should', 'can', 'could',
 ]);
+// Chinese/Japanese scripts (Han/Hiragana/Katakana) are NOT space-delimited, so a whole clause matches as
+// one run; splitting it into single characters gives BM25 something to overlap on. Korean (Hangul) and
+// every other script ARE space-delimited, so their words tokenize whole (kept out of this set).
+const CJK_UNSEGMENTED = /[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}]/u;
+/**
+ * Unicode-aware tokenizer. Matches letter/number runs across ALL scripts (`\p{L}\p{N}`), so accented
+ * Latin, Cyrillic, Arabic, Korean, etc. are searchable — the old `[a-z0-9]` dropped every non-ASCII
+ * character silently. A run containing an unsegmented-CJK character is split into single characters
+ * (length-1 allowed, since one Han character is meaningful); all other tokens keep the ≥2-length filter
+ * and the English stopword list. Pure-ASCII input tokenizes byte-identically to the previous behavior.
+ */
 export function tokenize(text) {
     const out = [];
-    for (const m of text.toLowerCase().matchAll(/[a-z0-9]+/g)) {
+    for (const m of text.toLowerCase().matchAll(/[\p{L}\p{N}]+/gu)) {
         const tok = m[0];
+        if (CJK_UNSEGMENTED.test(tok)) {
+            for (const ch of tok)
+                out.push(ch); // one meaningful unit per character
+            continue;
+        }
         if (tok.length >= 2 && !STOPWORDS.has(tok))
             out.push(tok);
     }

package/dist/memory/memory.d.ts

@@ -59,8 +59,14 @@ export declare class MemoryStore {
     private readonly embedder?;
     private readonly clock;
     private counter;
-    /** Per-instance cache of fact-text → vector, so a stable fact isn't re-embedded on every query. */
+    /** Per-instance cache of fact-text → vector, so a stable fact isn't re-embedded on every query. Bounded
+     *  (see cacheVec) so a long-lived host process cannot grow it without limit. */
     private readonly vecCache;
+    /** Cap on distinct cached vectors. On overflow the cache is cleared wholesale — the only cost is
+     *  re-embedding, never correctness. A session touching more than this many distinct facts is rare. */
+    private static readonly VEC_CACHE_MAX;
+    /** Store a vector, clearing the cache first if it is at capacity (bounded growth). */
+    private cacheVec;
     constructor(store: RuntimeStore, clock?: Clock, embedder?: EmbeddingProvider | undefined);
     get enabled(): boolean;
     private area;

package/dist/memory/memory.js

@@ -25,8 +25,18 @@ export class MemoryStore {
     embedder;
     clock;
     counter = 0;
-    /** Per-instance cache of fact-text → vector, so a stable fact isn't re-embedded on every query. */
+    /** Per-instance cache of fact-text → vector, so a stable fact isn't re-embedded on every query. Bounded
+     *  (see cacheVec) so a long-lived host process cannot grow it without limit. */
     vecCache = new Map();
+    /** Cap on distinct cached vectors. On overflow the cache is cleared wholesale — the only cost is
+     *  re-embedding, never correctness. A session touching more than this many distinct facts is rare. */
+    static VEC_CACHE_MAX = 2000;
+    /** Store a vector, clearing the cache first if it is at capacity (bounded growth). */
+    cacheVec(text, vec) {
+        if (this.vecCache.size >= MemoryStore.VEC_CACHE_MAX && !this.vecCache.has(text))
+            this.vecCache.clear();
+        this.vecCache.set(text, vec);
+    }
     constructor(store, clock = systemClock, embedder) {
         this.store = store;
         this.embedder = embedder;
@@ -172,7 +182,7 @@ export class MemoryStore {
                 // Cache only USABLE vectors — a degenerate ([] or non-finite) embedding must never be treated as
                 // valid nor poison the cache (a poisoned entry silently excludes that fact for the rest of the session).
                 need.forEach((t, i) => { if (isUsableVec(vecs[i]))
-                    this.vecCache.set(t, vecs[i]); });
+                    this.cacheVec(t, vecs[i]); });
             }
             const [queryVec] = await this.embedder.embed([query]);
             const docs = candidates.filter((c) => this.vecCache.has(c.text)).map((c) => ({ id: c.id, vec: this.vecCache.get(c.text) }));
@@ -197,6 +207,8 @@ export class MemoryStore {
     removeCascade(id) {
         const target = this.get(id);
         const inheritor = target?.supersededBy; // if the removed record was itself superseded, heirs re-link to its head
+        // Invalidate the cached vector for the removed record's text (if any) — and report whether we did.
+        const cacheEvicted = target ? this.vecCache.delete(target.text) : false;
         let primary = false;
         let relationships = 0;
         for (const scope of this.physicalScopes()) {
@@ -232,8 +244,10 @@ export class MemoryStore {
                 }
             }
         }
-        // Indexes are derived from records at query time; nothing separate to purge (true once persisted).
-        return { id, primary, indexes: true, relationships, cache: true };
+        // Honest audit: `indexes` reflects the removal only when the primary was actually removed (indexes are
+        // query-time-derived, so they change iff the record did); `cache` reports whether a vector was evicted.
+        // A delete of a nonexistent id now reports all-false rather than a hardcoded success.
+        return { id, primary, indexes: primary, relationships, cache: cacheEvicted };
     }
     /** Remove expired records with full cascade, under the lock. Returns removed ids. */
     purgeExpired(now = this.clock.now()) {

package/dist/plugin/ai.d.ts

@@ -70,6 +70,12 @@ export declare class AI {
     providers(): ProviderInfo[];
     tasksList(): TaskDefinition[];
     telemetryEvents(): TelemetryEvent[];
+    /**
+     * Release AI-level resources. Today: flush any batching telemetry sink (e.g. OTLP) so a short-lived
+     * process does not drop events buffered below the batch threshold. Safe to call more than once, and a
+     * failing flush never throws (telemetry must not fail shutdown). Runtime.close() calls this.
+     */
+    close(): Promise<void>;
     /** Run each provider's healthCheck(), seed the monitor, and return the statuses (for `doctor`). */
     checkHealth(): Promise<HealthStatus[]>;
     /** Discover provider identity, models, and capabilities (for `providers`/`models`/`capabilities`). */

package/dist/plugin/ai.js

@@ -71,8 +71,10 @@ export class AI {
         for (const providerCfg of this.config.providers) {
             if (providerCfg.kind === 'mock')
                 continue;
-            const provider = buildProvider(providerCfg, this.buildOpts);
-            this.registry.register(provider, providerCfg.enabled ?? true);
+            const enabled = providerCfg.enabled ?? true;
+            // A disabled provider never routes, so a zero-model config must not abort the whole runtime at load.
+            const provider = buildProvider(providerCfg, enabled ? this.buildOpts : { ...this.buildOpts, allowZeroModels: true });
+            this.registry.register(provider, enabled);
         }
     }
     /** Build an AI from a local config file/path or a remote http(s) URL. */
@@ -138,6 +140,19 @@ export class AI {
     telemetryEvents() {
         return this.telemetry.events?.() ?? [];
     }
+    /**
+     * Release AI-level resources. Today: flush any batching telemetry sink (e.g. OTLP) so a short-lived
+     * process does not drop events buffered below the batch threshold. Safe to call more than once, and a
+     * failing flush never throws (telemetry must not fail shutdown). Runtime.close() calls this.
+     */
+    async close() {
+        try {
+            await this.telemetry.flush?.();
+        }
+        catch {
+            /* a telemetry flush must never break shutdown */
+        }
+    }
     /** Run each provider's healthCheck(), seed the monitor, and return the statuses (for `doctor`). */
     async checkHealth() {
         const out = [];

package/dist/providers/estimate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Input-size estimation for routing, context-fit, and budget guardrails.
+ *
+ * This is a deterministic, conservative, LOCAL heuristic — it is deliberately NOT a reproduction of any
+ * provider's exact billing or tokenization. Its only guarantees are the ones the router needs:
+ *   - monotonic in payload size (a larger input never estimates fewer tokens),
+ *   - binary/multimodal parts contribute a nonzero estimate (an image is never "free"),
+ *   - text is counted exactly once (input.text and any `kind:'text'` parts, never double-counted).
+ *
+ * Text is ≈ chars/4 (the same ratio TokenEstimator uses; reimplemented here to avoid a providers→context
+ * dependency). Binary parts are sized from their decoded byte length at ~1 token per KiB with a 64-token
+ * floor per attachment, so a request with a large image cannot slip through context/budget checks as if
+ * it were empty. The floor and ratio are heuristic constants, not provider truth.
+ */
+import type { InputPart } from '../types.js';
+/** Tokens contributed by one input part. Text parts are chars/4; binary parts are bytes-derived. */
+export declare function estimatePartTokens(part: InputPart): number;
+/**
+ * Estimate the input token count of a request's `{ text, parts }`. Text from `input.text` and from any
+ * `kind:'text'` parts is summed and converted once; each binary part adds its own bytes-derived estimate.
+ */
+export declare function estimateInputTokens(input: {
+    text?: string;
+    parts?: InputPart[];
+}): number;

package/dist/providers/estimate.js

@@ -0,0 +1,55 @@
+/**
+ * Input-size estimation for routing, context-fit, and budget guardrails.
+ *
+ * This is a deterministic, conservative, LOCAL heuristic — it is deliberately NOT a reproduction of any
+ * provider's exact billing or tokenization. Its only guarantees are the ones the router needs:
+ *   - monotonic in payload size (a larger input never estimates fewer tokens),
+ *   - binary/multimodal parts contribute a nonzero estimate (an image is never "free"),
+ *   - text is counted exactly once (input.text and any `kind:'text'` parts, never double-counted).
+ *
+ * Text is ≈ chars/4 (the same ratio TokenEstimator uses; reimplemented here to avoid a providers→context
+ * dependency). Binary parts are sized from their decoded byte length at ~1 token per KiB with a 64-token
+ * floor per attachment, so a request with a large image cannot slip through context/budget checks as if
+ * it were empty. The floor and ratio are heuristic constants, not provider truth.
+ */
+const CHARS_PER_TOKEN = 4;
+const BYTES_PER_TOKEN = 1024;
+const MIN_PART_TOKENS = 64;
+/** Decoded byte length of a base64 string (ignoring padding), without allocating a Buffer. */
+function base64Bytes(data) {
+    if (!data)
+        return 0;
+    let len = data.length;
+    // Strip a possible data: URI prefix's base64 marker if present (defensive; `data` is base64 by convention).
+    const comma = data.indexOf(',');
+    if (data.startsWith('data:') && comma >= 0)
+        len = data.length - comma - 1;
+    let padding = 0;
+    if (len >= 1 && data.endsWith('='))
+        padding += 1;
+    if (len >= 2 && data.endsWith('=='))
+        padding += 1;
+    return Math.max(0, Math.floor((len * 3) / 4) - padding);
+}
+/** Tokens contributed by one input part. Text parts are chars/4; binary parts are bytes-derived. */
+export function estimatePartTokens(part) {
+    if (part.kind === 'text')
+        return Math.ceil(part.text.length / CHARS_PER_TOKEN);
+    const bytes = base64Bytes(part.data);
+    return Math.max(MIN_PART_TOKENS, Math.ceil(bytes / BYTES_PER_TOKEN));
+}
+/**
+ * Estimate the input token count of a request's `{ text, parts }`. Text from `input.text` and from any
+ * `kind:'text'` parts is summed and converted once; each binary part adds its own bytes-derived estimate.
+ */
+export function estimateInputTokens(input) {
+    let textChars = input.text?.length ?? 0;
+    let binaryTokens = 0;
+    for (const part of input.parts ?? []) {
+        if (part.kind === 'text')
+            textChars += part.text.length;
+        else
+            binaryTokens += estimatePartTokens(part);
+    }
+    return Math.ceil(textChars / CHARS_PER_TOKEN) + binaryTokens;
+}

package/dist/providers/factory.d.ts

@@ -14,5 +14,8 @@ export interface BuildOptions {
     fetchImpl?: FetchLike;
     clock?: Clock;
     env?: NodeJS.ProcessEnv;
+    /** Tolerate a zero-model result instead of throwing. Set only for providers that will not route (a
+     *  `enabled: false` provider), so a work-in-progress catalog-less block cannot abort runtime load. */
+    allowZeroModels?: boolean;
 }
 export declare function buildProvider(cfg: ProviderConfig, opts?: BuildOptions): AIProvider;

package/dist/providers/factory.js

@@ -28,11 +28,32 @@ export function buildProvider(cfg, opts = {}) {
     const credential = new Credential(apiKeyEnv, opts.env);
     const privacyClass = cfg.privacyClass ?? def.privacyClass;
     const wireShape = cfg.wireShape ?? def.wireShape;
-    const modelIds = Array.isArray(cfg.models) && cfg.models.length > 0
-        ? cfg.models
-        : cfg.defaultModel
-            ? [cfg.defaultModel]
-            : def.defaultModels;
+    // Resolve the model id list. `models: 'auto'` (and an omitted `models`) fall back to the caller's
+    // `defaultModel`, then to the kind's built-in catalog. An explicit `models: []` is an intentional
+    // "no models" statement and is treated as a config error, never a silent fallback.
+    let modelIds;
+    if (Array.isArray(cfg.models)) {
+        modelIds = cfg.models; // may be [] — caught by the zero-model guard below
+    }
+    else if (cfg.defaultModel) {
+        modelIds = [cfg.defaultModel];
+    }
+    else {
+        modelIds = def.defaultModels; // 'auto' or omitted → the kind's catalog (empty for openai-compatible/custom)
+    }
+    // Never silently register an ENABLED provider with zero routable models — that is a deterministic
+    // CONFIG problem (no model could be resolved), distinct from a provider being unavailable at runtime
+    // (health). A disabled provider (opts.allowZeroModels) is exempt: it will not route, so a missing model
+    // list must not abort construction of the whole runtime.
+    if (modelIds.length === 0 && !opts.allowZeroModels) {
+        const detail = Array.isArray(cfg.models)
+            ? 'an explicit empty models list'
+            : `'${cfg.kind}' has no built-in model catalog`;
+        const fix = Array.isArray(cfg.models)
+            ? 'remove the empty list or populate it (models: [...])'
+            : 'list models explicitly (models: [...]) or set defaultModel';
+        throw new AIError(`provider '${cfg.id}': no models resolved — ${detail}. ${fix}.`, { category: 'CONFIG' });
+    }
     const models = modelIds.map((id) => resolveModelMetadata(cfg.id, cfg.kind, id, cfg.capabilities));
     const config = {
         id: cfg.id,

package/dist/providers/httpClient.js

@@ -45,6 +45,10 @@ export async function callHttp(input) {
                 if (!retryable)
                     throw err;
                 lastError = err;
+                // No retry left ⇒ give up now; do not sleep out a backoff (up to 30s of Retry-After) before a
+                // failure that will happen regardless. Mirrors the network/timeout branch's last-attempt guard.
+                if (attempt > input.maxRetries)
+                    break;
                 const retryAfter = Number(res.headers.get('retry-after'));
                 await clock.sleep(Number.isFinite(retryAfter) && retryAfter > 0 ? Math.min(retryAfter * 1000, 30_000) : attempt * 2000);
                 continue;

package/dist/providers/httpProvider.js

@@ -13,6 +13,7 @@ import { emptyProfile } from '../core/capabilities/evidence.js';
 import { extractJson } from '../util/extractJson.js';
 import { getWire } from './wire/registry.js';
 import { callHttp, callHttpStream } from './httpClient.js';
+import { estimateInputTokens } from './estimate.js';
 function originOf(url) {
     try {
         return new URL(url).origin;
@@ -44,7 +45,7 @@ export class HttpProvider {
             authMode: this.cfg.requiresKey === false ? 'none' : 'env',
             supportsModelListing: this.cfg.supportsModelListing ?? false,
             privacyClass: this.privacyClass,
-            models: this.cfg.models,
+            models: [...this.cfg.models], // defensive copy — never hand out the internal array by reference
             ...(this.cfg.defaultModel ? { defaultModel: this.cfg.defaultModel } : {}),
         };
     }
@@ -56,14 +57,14 @@ export class HttpProvider {
         return { providerId: this.id, state: 'AVAILABLE', routable: true, checkedAt: 0 };
     }
     async listModels() {
-        return this.cfg.models;
+        return [...this.cfg.models]; // defensive copy — a caller mutating the result must not corrupt config
     }
     async getCapabilities(model) {
         return this.cfg.models.find((m) => m.id === model)?.capabilities ?? emptyProfile();
     }
     async estimate(request) {
         const model = this.cfg.models.find((m) => m.id === request.model);
-        const inTokens = Math.ceil((request.input.text?.length ?? 0) / 4);
+        const inTokens = estimateInputTokens(request.input);
         const estimate = {
             providerId: this.id,
             model: request.model,

package/dist/providers/mock/mockProvider.js

@@ -5,6 +5,7 @@
  */
 import { AIError } from '../../core/fallback/errors.js';
 import { emptyProfile } from '../../core/capabilities/evidence.js';
+import { estimateInputTokens } from '../estimate.js';
 export class MockProvider {
     id;
     name;
@@ -31,7 +32,7 @@ export class MockProvider {
             authMode: 'none',
             supportsModelListing: true,
             privacyClass: this.privacyClass,
-            models: this.models,
+            models: [...this.models],
             ...(this.models[0] ? { defaultModel: this.models[0].id } : {}),
         };
     }
@@ -39,14 +40,14 @@ export class MockProvider {
         return { providerId: this.id, state: 'AVAILABLE', routable: true, checkedAt: 0 };
     }
     async listModels() {
-        return this.models;
+        return [...this.models];
     }
     async getCapabilities(model) {
         return this.models.find((m) => m.id === model)?.capabilities ?? emptyProfile();
     }
     async estimate(request) {
         const model = this.models.find((m) => m.id === request.model);
-        const inTokens = Math.ceil((request.input.text?.length ?? 0) / 4);
+        const inTokens = estimateInputTokens(request.input);
         const estimate = {
             providerId: this.id,
             model: request.model,

package/dist/runtime/config.d.ts

@@ -1,9 +1,10 @@
 /**
  * Runtime configuration loader. Canonical file: `.ai-runtime/config.yaml` (runtime settings + the
  * router config). WRAPS, never forks, the existing strict `parseConfig`: a small strict zod fragment
- * validates/plucks the runtime-level keys (runtime:, and learning/verification/budget/policy — which
- * the root schema rejects), then delegates the remainder to parseConfig so its strictness and
- * inline-secret rejection are preserved. Root `ai-runtime.yaml` remains a supported fallback.
+ * validates/plucks the purely runtime-level keys (runtime:, permissions:, routing:, mcp:), then delegates
+ * the remainder — including learning/verification/budget/policy, which became first-class RouterConfig
+ * keys on the root schema in 3.0.1 — to parseConfig so its strictness and inline-secret rejection are
+ * preserved. Root `ai-runtime.yaml` remains a supported fallback.
  *
  * NOTE: `src/config/load.ts` and `AI.load()` are intentionally untouched — the CLI's existing behavior
  * is frozen until Phase 2 migrates it.

package/dist/runtime/config.js

@@ -1,9 +1,10 @@
 /**
  * Runtime configuration loader. Canonical file: `.ai-runtime/config.yaml` (runtime settings + the
  * router config). WRAPS, never forks, the existing strict `parseConfig`: a small strict zod fragment
- * validates/plucks the runtime-level keys (runtime:, and learning/verification/budget/policy — which
- * the root schema rejects), then delegates the remainder to parseConfig so its strictness and
- * inline-secret rejection are preserved. Root `ai-runtime.yaml` remains a supported fallback.
+ * validates/plucks the purely runtime-level keys (runtime:, permissions:, routing:, mcp:), then delegates
+ * the remainder — including learning/verification/budget/policy, which became first-class RouterConfig
+ * keys on the root schema in 3.0.1 — to parseConfig so its strictness and inline-secret rejection are
+ * preserved. Root `ai-runtime.yaml` remains a supported fallback.
  *
  * NOTE: `src/config/load.ts` and `AI.load()` are intentionally untouched — the CLI's existing behavior
  * is frozen until Phase 2 migrates it.
@@ -17,8 +18,12 @@ import { parseConfig, STRATEGIES, KEY_LIKE } from '../config/schema.js';
 import { findConfigFile } from '../config/load.js';
 import { AIError } from '../core/fallback/errors.js';
 import { RUNTIME_MODES } from './types.js';
-/** Runtime-level keys that live in `.ai-runtime/config.yaml` but are NOT part of the strict root schema. */
-const RUNTIME_ONLY_KEYS = ['runtime', 'learning', 'verification', 'budget', 'policy', 'permissions', 'routing', 'mcp'];
+/**
+ * Runtime-level keys that live in `.ai-runtime/config.yaml` but are NOT part of the strict root schema.
+ * `learning`/`verification`/`budget`/`policy` moved to the root schema in 3.0.1 (they are RouterConfig
+ * fields), so they now flow through `parseConfig(rest)` directly instead of being folded back here.
+ */
+const RUNTIME_ONLY_KEYS = ['runtime', 'permissions', 'routing', 'mcp'];
 const capabilityRequirementShape = z.object({ group: z.enum(['input', 'output', 'intelligence', 'agent']), key: z.string().min(1), minEvidence: z.enum(['unsupported', 'unknown', 'inferred', 'documented', 'verified']).optional(), weight: z.number().optional() }).strict();
 const routingShape = z.object({ excludeProviders: z.array(z.string()).optional(), excludeModels: z.array(z.string()).optional(), preferProviders: z.array(z.string()).optional(), preferModels: z.array(z.string()).optional() }).strict();
 /**
@@ -41,12 +46,6 @@ const agentDefinition = z
 /** An agent definition id: the same prompt-safe shape an MCP server id must have. */
 const AGENT_ID_RE = /^[a-z0-9][a-z0-9_-]{0,32}$/;
 const runtimeSettings = z.object({ defaultMode: z.enum(RUNTIME_MODES).optional(), defaultStrategy: z.enum(STRATEGIES).optional(), context: z.object({ maxTokens: z.number().optional(), verifyLoss: z.boolean().optional(), summarize: z.boolean().optional() }).strict().optional(), skills: z.object({ paths: z.array(z.string()).optional(), packages: z.array(z.string()).optional(), autoload: z.boolean().optional() }).strict().optional(), embedding: z.object({ provider: z.enum(['local', 'openai-compatible']), baseUrl: z.string().optional(), apiKeyEnv: z.string().optional(), model: z.string().optional() }).strict().optional(), intent: z.object({ aiFallback: z.boolean().optional() }).strict().optional(), organization: z.string().optional(), storage: z.object({ encrypt: z.boolean(), keyEnv: z.string() }).strict().optional(), capabilities: z.object({ catalog: z.boolean().optional(), planning: z.boolean().optional(), aliases: z.record(z.string(), z.string()).optional(), pins: z.record(z.string(), z.string()).optional() }).strict().optional(), concurrency: z.object({ maxParallelSteps: z.number().optional(), perTool: z.record(z.string(), z.number()).optional(), perSkill: z.record(z.string(), z.number()).optional(), perProvider: z.record(z.string(), z.number()).optional(), perAgent: z.record(z.string(), z.number()).optional() }).strict().optional(), agents: z.object({ enabled: z.boolean().optional(), decompose: z.boolean().optional(), maxToolCalls: z.number().optional(), maxDurationMs: z.number().optional(), maxInnerCalls: z.number().optional(), definitions: z.record(z.string().regex(AGENT_ID_RE, 'an agent definition id must be lowercase kebab/snake (max 33 chars)').refine((id) => !id.startsWith('auto_'), 'the `auto_` prefix is reserved for agents the runtime derives — pick another id'), agentDefinition).optional() }).strict().optional() }).strict();
-const learning = z.object({ enabled: z.boolean().optional() }).strict();
-const verification = z.object({ enabled: z.boolean().optional() }).strict();
-const budget = z.object({ maxCostUsd: z.number().optional(), maxCalls: z.number().optional() }).strict();
-const policy = z
-    .object({ allowProviders: z.array(z.string()).optional(), denyProviders: z.array(z.string()).optional(), requireLocal: z.boolean().optional(), maxCostUsd: z.number().optional(), strategy: z.enum(STRATEGIES).optional() })
-    .strict();
 const permissions = z
     .object({ fsRead: z.boolean().optional(), fsWrite: z.boolean().optional(), shell: z.boolean().optional(), shellAllowedCommands: z.array(z.string()).optional(), gitWrite: z.boolean().optional(), gitCommit: z.boolean().optional(), gitPush: z.boolean().optional(), network: z.boolean().optional(), mcp: z.object({ servers: z.record(z.string(), z.union([z.enum(['off', 'read', 'full']), z.boolean()])).optional() }).strict().optional() })
     .strict();
@@ -77,7 +76,7 @@ const mcpServer = z
 });
 const mcp = z.object({ servers: z.record(z.string().regex(/^[a-z0-9][a-z0-9_-]{0,32}$/, 'an MCP server id must be lowercase kebab/snake (max 33 chars)'), mcpServer).optional() }).strict();
 const runtimeFragment = z
-    .object({ runtime: runtimeSettings.optional(), learning: learning.optional(), verification: verification.optional(), budget: budget.optional(), policy: policy.optional(), permissions: permissions.optional(), routing: routing.optional(), mcp: mcp.optional() })
+    .object({ runtime: runtimeSettings.optional(), permissions: permissions.optional(), routing: routing.optional(), mcp: mcp.optional() })
     .partial();
 /**
  * Parse a runtime config object (from `.ai-runtime/config.yaml` or a legacy root file). Runtime-level
@@ -94,20 +93,12 @@ export function parseRuntimeConfig(raw) {
         throw new AIError(`invalid ai-runtime config:\n${issues}`, { category: 'CONFIG' });
     }
     const frag = fragResult.data;
-    // Delegate the remainder (providers, strategy, weights, defaults, privacy, telemetry, tasks) to the strict router schema.
+    // Delegate the remainder to the strict router schema. This now includes learning/verification/budget/
+    // policy (root-schema keys since 3.0.1), so they land on the RouterConfig directly — no fold-back needed.
     const rest = omit(obj, RUNTIME_ONLY_KEYS);
     if (!('providers' in rest))
         rest.providers = [];
     const router = parseConfig(rest);
-    // Fold the runtime-only router keys back onto the RouterConfig (they exist on the type; resolveConfig reads them).
-    if (frag.learning)
-        router.learning = frag.learning;
-    if (frag.verification)
-        router.verification = frag.verification;
-    if (frag.budget)
-        router.budget = frag.budget;
-    if (frag.policy)
-        router.policy = frag.policy;
     // Top-level `routing:` is folded into the runtime settings (a runtime concern, resolved with env + per-run).
     const runtimeOut = { ...(frag.runtime ?? {}), ...(frag.routing ? { routing: frag.routing } : {}) };
     return { ...(Object.keys(runtimeOut).length ? { runtime: runtimeOut } : {}), ...(frag.permissions ? { permissions: frag.permissions } : {}), ...(frag.mcp ? { mcp: frag.mcp } : {}), router };

package/dist/runtime/events.d.ts

@@ -59,6 +59,12 @@ export type RuntimeEvent = {
     ts: number;
     runId: string;
     text: string;
+} | {
+    type: 'response.stream_abandoned';
+    ts: number;
+    runId: string;
+    providerId: string;
+    model: string;
 } | {
     type: 'agent.task.started';
     ts: number;