klyro 0.1.62 → 1.0.0

package/dist/agent/anthropic-adapter.d.ts

@@ -8,14 +8,15 @@
  *  1. `system` is a top-level field, not a message with role=system.
  *  2. Tool definitions use `input_schema` not `parameters`, and have no
  *     `type: 'function'` wrapper.
- *  3. `tool_use_id` becomes our `id`; the tool input is sent as a single
- *     `input_json_delta` block.
+ *  3. `tool_use_id` becomes our `id`; tool input arrives fragmented across
+ *     `input_json_delta` frames, assembled per content_block index (never
+ *     assumed whole, never silently dropped).
  *
  * Auth: `x-api-key: <key>`. Version header is sent as `anthropic-version`.
  * Auth can be a Bearer token (for proxies) — the adapter accepts either.
  */
 import type { Message } from './message.js';
-import type { ProviderAdapter, ToolDefinition } from './provider-adapter.js';
+import type { ProviderAdapter, StreamEvent, ToolDefinition } from './provider-adapter.js';
 export interface AnthropicAdapterOptions {
     baseURL?: string;
     apiKey: string;
@@ -50,17 +51,37 @@ interface AnthropicMessage {
         is_error?: boolean;
     }>;
 }
+interface AnthropicSseEvent {
+    type: string;
+    [key: string]: unknown;
+}
 export declare class AnthropicApiError extends Error {
     readonly status: number;
     readonly body: string;
     constructor(status: number, body: string);
 }
 export declare function anthropicAdapter(opts: AnthropicAdapterOptions): ProviderAdapter;
-/** Match an Anthropic content_block index to the tool_use id we emitted. */
-declare function findToolIdByIndex(index: number | undefined, buffers: Map<string, {
-    name: string;
-    argsJson: string;
-}>, indexToToolId?: Map<number, string>): string | undefined;
+/**
+ * Mutable per-stream assembly state. Blocks are keyed by content_block
+ * index; the tool id is carried inside the block entry. There is no global
+ * "current tool" — concurrent or interleaved blocks stay correctly routed.
+ */
+interface AnthropicStreamState {
+    blocks: Map<number, {
+        id: string;
+        name: string;
+        argsJson: string;
+        open: boolean;
+    }>;
+    /** Fragments for an index with no open block yet (flushed on block start). */
+    orphans: Map<number, string>;
+    thinkingIdx: number | null;
+    usage: {
+        input?: number;
+        output?: number;
+    };
+}
+declare function translateSse(event: string, parsed: AnthropicSseEvent, state: AnthropicStreamState): StreamEvent[];
 declare function toAnthropicMessages(messages: Message[]): AnthropicMessage[];
 declare function toAnthropicTool(t: ToolDefinition): {
     name: string;
@@ -70,6 +91,6 @@ declare function toAnthropicTool(t: ToolDefinition): {
 export declare const _internal: {
     toAnthropicMessages: typeof toAnthropicMessages;
     toAnthropicTool: typeof toAnthropicTool;
-    findToolIdByIndex: typeof findToolIdByIndex;
+    translateSse: typeof translateSse;
 };
 export {};

package/dist/agent/anthropic-adapter.js

@@ -8,13 +8,15 @@
  *  1. `system` is a top-level field, not a message with role=system.
  *  2. Tool definitions use `input_schema` not `parameters`, and have no
  *     `type: 'function'` wrapper.
- *  3. `tool_use_id` becomes our `id`; the tool input is sent as a single
- *     `input_json_delta` block.
+ *  3. `tool_use_id` becomes our `id`; tool input arrives fragmented across
+ *     `input_json_delta` frames, assembled per content_block index (never
+ *     assumed whole, never silently dropped).
  *
  * Auth: `x-api-key: <key>`. Version header is sent as `anthropic-version`.
  * Auth can be a Bearer token (for proxies) — the adapter accepts either.
  */
 import { assertSafeBaseURL } from '../chat.js';
+import { parseRetryAfterMs } from './provider-adapter.js';
 const DEFAULT_VERSION = '2023-06-01';
 const DEFAULT_TIMEOUT_MS = 120_000;
 export class AnthropicApiError extends Error {
@@ -96,11 +98,15 @@ async function* streamAnthropic(req, opts) {
     clearTimeout(timer);
     if (!resp.ok || !resp.body) {
         const text = await resp.text().catch(() => '<unreadable>');
+        const retryable = resp.status >= 500 || resp.status === 429;
+        const retryAfterMs = retryable ? parseRetryAfterMs(resp.headers?.get('retry-after')) : undefined;
         yield {
             kind: 'error',
             code: `http_${resp.status}`,
             message: `Anthropic API returned ${resp.status}: ${text.slice(0, 500)}`,
-            retryable: resp.status >= 500 || resp.status === 429,
+            retryable,
+            status: String(resp.status),
+            ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
         };
         return;
     }
@@ -111,12 +117,14 @@ async function* streamAnthropic(req, opts) {
     const reader = resp.body.getReader();
     const decoder = new TextDecoder('utf-8');
     let buf = '';
-    // Track in-progress tool calls so we can emit start/delta/end.
-    const toolBuffers = new Map();
-    // Map content_block index → tool_use id (persists after tool completes to handle late deltas)
-    const indexToToolId = new Map();
-    // Active thinking-block index (Anthropic reasoning channel).
-    const thinkingState = { idx: null };
+    // Per-block assembly keyed by content_block index (tool input IS
+    // fragmented across input_json_delta frames — never assume otherwise).
+    const state = {
+        blocks: new Map(),
+        orphans: new Map(),
+        thinkingIdx: null,
+        usage: {},
+    };
     // message_stop already yields message_end — don't emit a second one at EOF.
     let sawMessageEnd = false;
     try {
@@ -155,7 +163,7 @@ async function* streamAnthropic(req, opts) {
                 catch {
                     continue;
                 }
-                const out = translateSse(e.event, parsed, toolBuffers, indexToToolId, thinkingState);
+                const out = translateSse(e.event, parsed, state);
                 for (const ev of out) {
                     if (ev.kind === 'message_end')
                         sawMessageEnd = true;
@@ -172,23 +180,69 @@ async function* streamAnthropic(req, opts) {
     finally {
         reader.releaseLock();
     }
-    if (!sawMessageEnd)
-        yield { kind: 'message_end', finishReason: 'stop' };
+    // Truncated stream: close open blocks so the runtime finalizes them as
+    // (malformed) structured errors instead of hanging, then terminate.
+    for (const b of state.blocks.values()) {
+        if (b.open) {
+            b.open = false;
+            yield { kind: 'tool_call_end', id: b.id };
+        }
+    }
+    state.blocks.clear();
+    // Fragments that could never be attributed to a tool block are a stream
+    // integrity failure — surface loudly, never silently drop.
+    if (state.orphans.size > 0 && !sawMessageEnd) {
+        const count = [...state.orphans.values()].reduce((n, s) => n + s.length, 0);
+        state.orphans.clear();
+        yield {
+            kind: 'error',
+            code: 'ORPHAN_TOOL_DELTAS',
+            message: `stream ended with ${count} chars of tool input that match no content block`,
+            retryable: false,
+        };
+        return;
+    }
+    state.orphans.clear();
+    if (!sawMessageEnd) {
+        yield {
+            kind: 'message_end',
+            finishReason: 'stop',
+            ...(state.usage.input !== undefined || state.usage.output !== undefined
+                ? { usage: { input: state.usage.input ?? 0, output: state.usage.output ?? 0 } }
+                : {}),
+        };
+    }
 }
-function translateSse(event, parsed, toolBuffers, indexToToolId, thinking) {
+function translateSse(event, parsed, state) {
     const out = [];
     switch (event) {
+        case 'message_start': {
+            const usage = parsed.message?.usage;
+            if (typeof usage?.input_tokens === 'number')
+                state.usage.input = usage.input_tokens;
+            return out;
+        }
+        case 'message_delta': {
+            const usage = parsed.usage;
+            if (typeof usage?.output_tokens === 'number') {
+                state.usage.output = (state.usage.output ?? 0) + usage.output_tokens;
+            }
+            return out;
+        }
         case 'content_block_start': {
             const block = parsed.content_block;
             const idx = parsed.index;
-            if (block?.type === 'tool_use' && block.id && block.name) {
-                toolBuffers.set(block.id, { name: block.name, argsJson: '' });
-                if (idx !== undefined)
-                    indexToToolId.set(idx, block.id);
+            if (block?.type === 'tool_use' && block.id && block.name && idx !== undefined) {
+                // Flush any fragments that arrived before the block start.
+                const stashed = state.orphans.get(idx);
+                state.orphans.delete(idx);
+                state.blocks.set(idx, { id: block.id, name: block.name, argsJson: stashed ?? '', open: true });
                 out.push({ kind: 'tool_call_start', id: block.id, name: block.name });
+                if (stashed)
+                    out.push({ kind: 'tool_call_delta', id: block.id, argsJson: stashed });
             }
-            else if ((block?.type === 'thinking' || block?.type === 'redacted_thinking') && thinking && idx !== undefined) {
-                thinking.idx = idx;
+            else if ((block?.type === 'thinking' || block?.type === 'redacted_thinking') && idx !== undefined) {
+                state.thinkingIdx = idx;
             }
             return out;
         }
@@ -202,31 +256,50 @@ function translateSse(event, parsed, toolBuffers, indexToToolId, thinking) {
                 out.push({ kind: 'thinking_delta', text: delta.thinking });
             }
             else if (delta?.type === 'input_json_delta' && typeof delta.partial_json === 'string') {
-                const id = findToolIdByIndex(index, toolBuffers, indexToToolId);
-                if (id) {
-                    const buf = toolBuffers.get(id);
-                    if (buf) {
-                        buf.argsJson += delta.partial_json;
-                        out.push({ kind: 'tool_call_delta', id, argsJson: delta.partial_json });
+                const entry = index !== undefined ? state.blocks.get(index) : undefined;
+                if (entry && entry.open) {
+                    entry.argsJson += delta.partial_json;
+                    out.push({ kind: 'tool_call_delta', id: entry.id, argsJson: delta.partial_json });
+                }
+                else if (index !== undefined) {
+                    const open = [...state.blocks.values()].filter((b) => b.open);
+                    if (open.length === 1) {
+                        // Single in-flight tool: attribute here (documented heuristic).
+                        open[0].argsJson += delta.partial_json;
+                        out.push({ kind: 'tool_call_delta', id: open[0].id, argsJson: delta.partial_json });
+                    }
+                    else {
+                        // No safe attribution — stash for a later block start, or
+                        // surface as ORPHAN_TOOL_DELTAS at stream end. Never drop.
+                        state.orphans.set(index, (state.orphans.get(index) ?? '') + delta.partial_json);
                     }
                 }
+                else {
+                    state.orphans.set(-1, (state.orphans.get(-1) ?? '') + delta.partial_json);
+                }
             }
             return out;
         }
         case 'content_block_stop': {
             const index = parsed.index;
-            if (thinking && index !== undefined && index === thinking.idx)
-                thinking.idx = null;
-            const id = findToolIdByIndex(index, toolBuffers, indexToToolId);
-            if (id) {
-                toolBuffers.delete(id);
-                // Keep index mapping for late deltas that may arrive after stop (rare)
-                out.push({ kind: 'tool_call_end', id });
+            if (index !== undefined && index === state.thinkingIdx)
+                state.thinkingIdx = null;
+            const entry = index !== undefined ? state.blocks.get(index) : undefined;
+            if (entry && entry.open) {
+                entry.open = false;
+                state.blocks.delete(index);
+                out.push({ kind: 'tool_call_end', id: entry.id });
             }
             return out;
         }
         case 'message_stop': {
-            out.push({ kind: 'message_end', finishReason: 'stop' });
+            out.push({
+                kind: 'message_end',
+                finishReason: 'stop',
+                ...(state.usage.input !== undefined || state.usage.output !== undefined
+                    ? { usage: { input: state.usage.input ?? 0, output: state.usage.output ?? 0 } }
+                    : {}),
+            });
             return out;
         }
         case 'error': {
@@ -243,21 +316,6 @@ function translateSse(event, parsed, toolBuffers, indexToToolId, thinking) {
             return out;
     }
 }
-/** Match an Anthropic content_block index to the tool_use id we emitted. */
-function findToolIdByIndex(index, buffers, indexToToolId) {
-    if (index === undefined)
-        return undefined;
-    if (indexToToolId) {
-        const direct = indexToToolId.get(index);
-        if (direct)
-            return direct;
-    }
-    // Single-buffer fallback: if only one in-flight tool, any delta belongs to it
-    if (buffers.size === 1)
-        return buffers.keys().next().value;
-    // No reliable mapping — drop the delta rather than misroute to wrong tool (prevents _parse_error loops)
-    return undefined;
-}
 function toAnthropicMessages(messages) {
     return messages.map((m) => {
         if (m.role === 'user') {
@@ -320,4 +378,4 @@ function toAnthropicTool(t) {
     };
 }
 // Re-export for testability.
-export const _internal = { toAnthropicMessages, toAnthropicTool, findToolIdByIndex };
+export const _internal = { toAnthropicMessages, toAnthropicTool, translateSse };

package/dist/agent/capabilities.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Agent capability enforcement (P0.2 from r-6-10.fix.md).
+ *
+ * Resolves the **effective tool set** for a (child) agent by intersecting:
+ *
+ *   1. the parent's effective tools — a child can never receive more tools than its parent
+ *   2. the agent definition's `allowedTools` (if specified)
+ *   3. the runtime policy's allowed tools (e.g. `--allow-write` flags)
+ *
+ * Then applies safety modifiers:
+ *
+ *   - `readonly: true` strips every tool classified as write or mutation.
+ *   - `canSpawn: false` (default for children) removes any spawn_agent-like tools.
+ *   - A deny-list always wins, regardless of what the agent declares.
+ *
+ * This is a pure function — no I/O, no side effects. It exists so the runtime
+ * can decide which tools to expose to the model BEFORE the model picks one.
+ *
+ * Wiring lives in src/agent/runtime.ts (see the tool-filter hook).
+ */
+export interface AgentCapabilities {
+    /** Tools the agent definition explicitly allows. `undefined` means "no allow-list". */
+    allowedTools?: string[];
+    /** If true, write/mutation tools are stripped. */
+    readonly?: boolean;
+    /** If false (or unset), tools that can spawn new agents are stripped. */
+    canSpawn?: boolean;
+    /** Model override — if the provider cannot satisfy it, callers must error rather than fall back. */
+    model?: string;
+    /** Recursion depth cap. Beyond this, spawn attempts are blocked. */
+    maxDepth?: number;
+}
+export interface ResolveToolsInput {
+    /** Tools the parent is allowed to use (or `null` for the root agent = all registered tools). */
+    parentTools: ReadonlySet<string> | null;
+    /** The agent's declared capability profile. */
+    agent: AgentCapabilities;
+    /** Tools currently allowed by runtime policy (e.g. user-permission flags). */
+    policyAllowed: ReadonlySet<string>;
+    /** All tools known to the registry (used when parentTools is null). */
+    registryTools: ReadonlySet<string>;
+    /** Tools that mutate state — stripped under `readonly`. */
+    writeTools: ReadonlySet<string>;
+    /** Tools that spawn other agents — stripped when `canSpawn` is false. */
+    spawnTools: ReadonlySet<string>;
+    /** Tools that are NEVER allowed, even if explicitly requested. */
+    denied: ReadonlySet<string>;
+    /** If true, spawn tools are kept even when agent.canSpawn is false/unset. */
+    canSpawnOverride?: boolean;
+}
+export interface ResolveToolsResult {
+    /** Tools the child agent is permitted to call. */
+    allowed: string[];
+    /** Tools that were denied (debugging/observability). */
+    dropped: {
+        tool: string;
+        reason: 'denied' | 'readonly' | 'no-spawn' | 'not-in-parent' | 'not-in-policy' | 'unknown';
+    }[];
+}
+/**
+ * Resolve the effective tool set for an agent.
+ *
+ * Order of operations:
+ *   1. Start from `parentTools ?? registryTools`.
+ *   2. Intersect with `policyAllowed`.
+ *   3. If `allowedTools` is set, intersect again.
+ *   4. Strip `writeTools` if `readonly`.
+ *   5. Strip `spawnTools` if `!canSpawn`.
+ *   6. Remove `denied` last (always wins).
+ */
+export declare function resolveAgentTools(input: ResolveToolsInput): ResolveToolsResult;
+/**
+ * Reason a tool was dropped from the resolved capability set. Mirrors
+ * `ResolveToolsResult.dropped[].reason`.
+ */
+export type DropReason = 'denied' | 'readonly' | 'no-spawn' | 'not-in-parent' | 'not-in-policy' | 'unknown';
+/**
+ * Fully-resolved capability profile for a child agent — tool set plus
+ * non-tool knobs (model override, recursion cap). Computed once at spawn
+ * time and threaded through the runtime as `parentContext`.
+ */
+export interface ResolvedCapabilities {
+    /** Sorted tool names the child is allowed to invoke. */
+    allowed: ReadonlySet<string>;
+    /** Per-tool drop reasons — surfaced in ChildSummary for parent visibility. */
+    dropped: {
+        tool: string;
+        reason: DropReason;
+    }[];
+    /** Model override to send to the provider (or undefined to inherit parent). */
+    model?: string;
+    /** Effective recursion depth cap. Caller MUST reject spawn when depth + 1 > maxDepth. */
+    maxDepth: number;
+    readonly: boolean;
+    canSpawn: boolean;
+}
+/** Extra knobs consumed by `resolveCapabilities` on top of `ResolveToolsInput`. */
+export interface ResolveCapabilitiesExtra {
+    /** Caller-provided maxDepth (e.g. from CLI `--max-depth` or a parent's maxDepth). Required. */
+    maxDepth: number;
+    /** If true, the resolved `allowed` set may include tools that themselves spawn agents. */
+    canSpawnOverride?: boolean;
+}
+/** Combined input for the one-shot resolver used by the orchestrator. */
+export interface ResolveCapabilitiesInput extends ResolveToolsInput, ResolveCapabilitiesExtra {
+}
+/**
+ * One-shot capability resolver: tool intersection + per-agent model/maxDepth.
+ *
+ * `maxDepth` precedence (most specific wins):
+ *   1. `agent.maxDepth` (if set on the definition)
+ *   2. `extra.maxDepth` (parent / CLI cap)
+ * `model` is propagated only when the agent declares one; we do not silently
+ * override a parent's chosen model.
+ */
+export declare function resolveCapabilities(input: ResolveCapabilitiesInput): ResolvedCapabilities;
+/** Sensible defaults for "what counts as a write tool" if a caller doesn't override. */
+export declare const DEFAULT_WRITE_TOOLS: ReadonlySet<string>;
+/** Default spawn tools — removed from children by default. */
+export declare const DEFAULT_SPAWN_TOOLS: ReadonlySet<string>;
+/** Default deny-list — these are NEVER allowed, even if explicitly requested. */
+export declare const DEFAULT_DENIED_TOOLS: ReadonlySet<string>;

package/dist/agent/capabilities.js

@@ -0,0 +1,150 @@
+/**
+ * Agent capability enforcement (P0.2 from r-6-10.fix.md).
+ *
+ * Resolves the **effective tool set** for a (child) agent by intersecting:
+ *
+ *   1. the parent's effective tools — a child can never receive more tools than its parent
+ *   2. the agent definition's `allowedTools` (if specified)
+ *   3. the runtime policy's allowed tools (e.g. `--allow-write` flags)
+ *
+ * Then applies safety modifiers:
+ *
+ *   - `readonly: true` strips every tool classified as write or mutation.
+ *   - `canSpawn: false` (default for children) removes any spawn_agent-like tools.
+ *   - A deny-list always wins, regardless of what the agent declares.
+ *
+ * This is a pure function — no I/O, no side effects. It exists so the runtime
+ * can decide which tools to expose to the model BEFORE the model picks one.
+ *
+ * Wiring lives in src/agent/runtime.ts (see the tool-filter hook).
+ */
+/**
+ * Resolve the effective tool set for an agent.
+ *
+ * Order of operations:
+ *   1. Start from `parentTools ?? registryTools`.
+ *   2. Intersect with `policyAllowed`.
+ *   3. If `allowedTools` is set, intersect again.
+ *   4. Strip `writeTools` if `readonly`.
+ *   5. Strip `spawnTools` if `!canSpawn`.
+ *   6. Remove `denied` last (always wins).
+ */
+export function resolveAgentTools(input) {
+    const { parentTools, agent, policyAllowed, registryTools, writeTools, spawnTools, denied, } = input;
+    const allowed = new Set();
+    const dropped = [];
+    // 1. Baseline: parent's tools, or all registered tools for the root agent.
+    // Record narrowing for observability: registry tools outside the parent's
+    // set are reported as 'not-in-parent' drops (child can never exceed parent).
+    const baseline = parentTools ?? registryTools;
+    if (parentTools !== null) {
+        for (const name of registryTools) {
+            if (!parentTools.has(name)) {
+                dropped.push({ tool: name, reason: 'not-in-parent' });
+            }
+        }
+    }
+    for (const name of baseline) {
+        if (!registryTools.has(name)) {
+            dropped.push({ tool: name, reason: 'unknown' });
+            continue;
+        }
+        if (!policyAllowed.has(name)) {
+            dropped.push({ tool: name, reason: 'not-in-policy' });
+            continue;
+        }
+        allowed.add(name);
+    }
+    // 3. Apply the agent's allow-list (if any). Anything not in the list is dropped.
+    if (agent.allowedTools) {
+        const explicit = new Set(agent.allowedTools);
+        for (const name of [...allowed]) {
+            if (!explicit.has(name)) {
+                allowed.delete(name);
+                dropped.push({ tool: name, reason: 'not-in-parent' });
+            }
+        }
+        // Tools requested in allowedTools but not in the baseline cannot be granted.
+        for (const name of agent.allowedTools) {
+            if (!allowed.has(name) && registryTools.has(name) && policyAllowed.has(name)) {
+                dropped.push({ tool: name, reason: 'not-in-parent' });
+            }
+        }
+    }
+    // 4. readonly → strip write tools.
+    if (agent.readonly) {
+        for (const name of [...allowed]) {
+            if (writeTools.has(name)) {
+                allowed.delete(name);
+                dropped.push({ tool: name, reason: 'readonly' });
+            }
+        }
+    }
+    // 5. canSpawn=false → strip spawn tools. Default: root agent (parentTools
+    // === null) may spawn; children strip unless explicitly enabled. An explicit
+    // canSpawnOverride=true (via resolveCapabilities) also keeps them.
+    const canSpawnEffective = input.canSpawnOverride ?? input.agent.canSpawn ?? (input.parentTools === null);
+    if (!canSpawnEffective) {
+        for (const name of [...allowed]) {
+            if (spawnTools.has(name)) {
+                allowed.delete(name);
+                dropped.push({ tool: name, reason: 'no-spawn' });
+            }
+        }
+    }
+    // 6. Deny-list always wins.
+    for (const name of [...allowed]) {
+        if (denied.has(name)) {
+            allowed.delete(name);
+            dropped.push({ tool: name, reason: 'denied' });
+        }
+    }
+    return {
+        allowed: [...allowed].sort(),
+        dropped: dropped.sort((a, b) => a.tool.localeCompare(b.tool)),
+    };
+}
+/**
+ * One-shot capability resolver: tool intersection + per-agent model/maxDepth.
+ *
+ * `maxDepth` precedence (most specific wins):
+ *   1. `agent.maxDepth` (if set on the definition)
+ *   2. `extra.maxDepth` (parent / CLI cap)
+ * `model` is propagated only when the agent declares one; we do not silently
+ * override a parent's chosen model.
+ */
+export function resolveCapabilities(input) {
+    const resolved = resolveAgentTools(input);
+    const allowed = new Set(resolved.allowed);
+    const model = input.agent.model;
+    const maxDepth = input.agent.maxDepth ?? input.maxDepth;
+    const canSpawn = input.canSpawnOverride ?? input.agent.canSpawn ?? false;
+    return {
+        allowed,
+        dropped: resolved.dropped,
+        ...(model !== undefined ? { model } : {}),
+        maxDepth,
+        readonly: input.agent.readonly ?? false,
+        canSpawn,
+    };
+}
+/** Sensible defaults for "what counts as a write tool" if a caller doesn't override. */
+export const DEFAULT_WRITE_TOOLS = new Set([
+    'write_file',
+    'edit_file',
+    'multi_edit',
+    'apply_patch',
+    'shell_exec',
+    'memory_write',
+    'background_shell',
+    'todo_write',
+]);
+/** Default spawn tools — removed from children by default. */
+export const DEFAULT_SPAWN_TOOLS = new Set([
+    'spawn_agent',
+    'subtask',
+]);
+/** Default deny-list — these are NEVER allowed, even if explicitly requested. */
+export const DEFAULT_DENIED_TOOLS = new Set([
+// Add dangerous tools here. Empty by default — extend as policy matures.
+]);