car-runtime 0.45.0 → 0.46.1

package/index.d.ts

@@ -73,6 +73,14 @@ export class CarRuntime {
    * 2026-05 audit boundary). Relative paths land under the base;
    * absolute paths must already be under the base; `..` segments and
    * symlinks pointing out of the sandbox are rejected.
+   *
+   * **`path` names a file, not a namespace.** This REPLACES the graph the
+   * connection is bound to — and by default that is the daemon's SHARED graph,
+   * common to every unbound session and to facts ingested over MCP. So on a
+   * multi-project host this both discards other projects' in-memory facts and
+   * leaves the loaded ones visible to them. Set `CAR_MEMORY_NAMESPACE` in the host process to bind a private graph
+   * (car-releases#79/#80); the shared daemon transport puts it on the
+   * `session.auth` handshake for you.
    */
   loadMemory(path: string): Promise<number>;
 
@@ -94,6 +102,12 @@ export class CarRuntime {
    * Returns the number of records written.
    *
    * Daemon-side write: same `~/.car/memory/` sandbox as `loadMemory`.
+   *
+   * **Writes the whole graph, not a subset.** `path` chooses the destination
+   * file; it does not select the contents. On an unbound session that graph is
+   * the daemon-wide shared one, so per-project files each end up holding every
+   * project's facts. Set `CAR_MEMORY_NAMESPACE` for a file that contains only one project's
+   * facts (car-releases#79/#80).
    */
   persistMemory(path: string): Promise<number>;
 
@@ -609,6 +623,14 @@ export class CarRuntime {
    * field optional except `prompt`). Exposes every field on the
    * Rust struct including `intent`. Same pattern as
    * {@link verifyProposal}. Closes #107.
+   *
+   * `client_ref` is an opaque correlation token echoed verbatim in the
+   * `inference.runner.invoke` payload and otherwise ignored by CAR. A
+   * delegated-inference host with several calls in flight uses it to map an
+   * invoke back to its own request state — `call_id` is minted by the daemon
+   * only after this call, so it cannot serve that purpose. Hosts previously
+   * had to smuggle an id through `prompt`, which worked only because
+   * delegated models ignore it (car-releases#78).
    */
   inferTrackedWithRequest(requestJson: string): Promise<string>;
 
@@ -2141,6 +2163,50 @@ export function simulate(
   initialStateJson?: string | null,
 ): string;
 
+/**
+ * Sample N rollouts of a proposal with tools allowed to fail.
+ *
+ * `simulate` answers "what state does this plan leave behind, assuming every
+ * dispatched tool succeeds?" This answers "how often does it actually work,
+ * and when it doesn't, what breaks first?" Each `tool_call` succeeds with the
+ * probability given in `toolSuccessRatesJson` (a JSON object mapping tool name
+ * to a rate in `0.0..=1.0` — the shape produced by the planner's per-tool
+ * trajectory feedback). Failures cascade through the dependency graph exactly
+ * as they would at runtime: an action whose dependency never landed is
+ * rejected before dispatch, not retried.
+ *
+ * `goalJson` is an optional `GoalCondition` evaluated against each trial's
+ * final state. Conditions a simulation cannot decide — tool receipts, command
+ * exits, model judges — fail closed and are named in
+ * `goal_underivable_conditions`, so a `p_goal_reached` of 0 is never silently
+ * mistaken for "this plan cannot work".
+ *
+ * `configJson` is an optional `{ trials?, seed?, defaultSuccessRate?,
+ * retryAttempts? }` — note these are **snake_case** on the wire
+ * (`default_success_rate`, `retry_attempts`), since the payload is serde JSON
+ * rather than a napi-converted object. Defaults: 1000 trials, a fixed seed,
+ * 0.5 for tools with no recorded history, no retries. The seed is fixed rather
+ * than time-derived so runs are reproducible, and is echoed back in the result.
+ *
+ * Returns JSON:
+ * `{ trials, seed, p_goal_reached, goal_underivable_conditions,
+ * p_all_effects_landed, tool_calls: {mean, min, p50, p95, max},
+ * actions_executed: {...}, state_distribution: [{key, p_present,
+ * values: [{value, probability}]}], action_outcomes: [{action_id, p_rejected,
+ * p_failed, p_effects_landed, mean_blast_radius}] }`.
+ *
+ * Independence caveat: draws are uncorrelated, so a plan that calls one flaky
+ * tool repeatedly reads more optimistically here than it will behave when that
+ * tool's backing service is down.
+ */
+export function simulateMonteCarlo(
+  proposalJson: string,
+  initialStateJson?: string | null,
+  toolSuccessRatesJson?: string | null,
+  goalJson?: string | null,
+  configJson?: string | null,
+): string;
+
 export function optimize(proposalJson: string): string;
 
 export function equivalent(proposal1Json: string, proposal2Json: string): boolean;
@@ -2319,7 +2385,16 @@ export function enforceInformationFlow(
  * `{ level: "l0" | "l1" | "l2" | "l3" | "l4", serializable, anomalies: [{
  * anomaly: "stale_generation" | "phantom_tool" | "causal_cascade" |
  * "tool_effect_reorder", key, ops, explanation }] }` — `level` is set by the
- * most severe anomaly present (causal-cascade → l0 … none → l4 serializable).
+ * most severe *named* anomaly present (causal-cascade → l0 … none → l4).
+ *
+ * `serializable` is a separate, real conflict-serializability decision: the
+ * schedule's serialization graph (write-write, write-read, anti-dependency, and
+ * declared `depends_on` edges) is tested for a cycle. It is NOT `level === "l4"`.
+ * The two deliberately disagree on write skew — concurrent ops reading
+ * overlapping state and writing disjoint keys match no named anomaly, so such a
+ * schedule reports `level: "l4"` with `serializable: false`. Read `level` for
+ * which anomaly to remediate, `serializable` for whether an equivalent serial
+ * order exists.
  */
 export function analyzeConcurrency(opsJson: string): string;
 
@@ -3055,6 +3130,24 @@ export function rankProposals(
  */
 export function runApplescript(argsJson: string): Promise<string>;
 
+/**
+ * Run a Windows PowerShell script via `powershell.exe` — the Windows analog
+ * of `runApplescript`. Drives the host desktop and its apps (toast, clipboard,
+ * COM, UI Automation).
+ *
+ * `argsJson` shape:
+ * ```jsonc
+ * {
+ *   "script": "Get-Date",
+ *   "timeout_ms": 5000   // optional
+ * }
+ * ```
+ *
+ * Returns JSON `{stdout, stderr, exit_code}`. Rejects with a
+ * PlatformUnsupported error on non-Windows hosts.
+ */
+export function runPowershell(argsJson: string): Promise<string>;
+
 /**
  * Enumerate Shortcuts (user-authored *and* AppShortcuts donated by
  * apps via the App Intents framework). Returns an array of

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "car-runtime",
-  "version": "0.45.0",
+  "version": "0.46.1",
   "description": "Common Agent Runtime — a deterministic execution layer for AI agents",
   "main": "index.js",
   "types": "index.d.ts",