network-ai 5.12.7 → 5.13.1

package/INTEGRATION_GUIDE.md

@@ -496,7 +496,7 @@ Run these before declaring the integration production-ready:
 - [ ] `npx ts-node test-phase4.ts` — 147 behavioral tests pass
 - [ ] `npx ts-node test-qa.ts` — 67 QA orchestrator tests pass
 - [ ] `npx ts-node test-phase7.ts` — 94 Phase 7 tests pass (hooks, flow control, composer, semantic search)
-- [ ] `npm run test:all` — all 3,269 tests pass across 33 suites
+- [ ] `npm run test:all` — all 3,373 tests pass across 37 suites
 - [ ] `npm run demo -- --08` runs to completion in < 10 seconds
 
 ### Race Condition Safety
@@ -564,4 +564,4 @@ Run these before declaring the integration production-ready:
 
 ---
 
-*Network-AI v5.12.4 · MIT License · https://github.com/Jovancoding/Network-AI*
+*Network-AI v5.13.0 · MIT License · https://github.com/Jovancoding/Network-AI*

package/README.md

@@ -5,9 +5,9 @@
 [![Website](https://img.shields.io/badge/website-network--ai.org-4b9df2?style=flat&logo=web&logoColor=white)](https://network-ai.org/)
 [![CI](https://github.com/Jovancoding/Network-AI/actions/workflows/ci.yml/badge.svg)](https://github.com/Jovancoding/Network-AI/actions/workflows/ci.yml)
 [![CodeQL](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml/badge.svg)](https://github.com/Jovancoding/Network-AI/actions/workflows/codeql.yml)
-[![Release](https://img.shields.io/badge/release-v5.12.7-blue.svg)](https://github.com/Jovancoding/Network-AI/releases)
+[![Release](https://img.shields.io/badge/release-v5.13.1-blue.svg)](https://github.com/Jovancoding/Network-AI/releases)
 [![npm](https://img.shields.io/npm/dw/network-ai.svg?label=npm%20downloads)](https://www.npmjs.com/package/network-ai)
-[![Tests](https://img.shields.io/badge/tests-3269%20passing-brightgreen.svg)](#testing)
+[![Tests](https://img.shields.io/badge/tests-3373%20passing-brightgreen.svg)](#testing)
 [![Adapters](https://img.shields.io/badge/frameworks-29%20supported-blueviolet.svg)](#adapter-system)
 [![License](https://img.shields.io/badge/license-MIT-brightgreen.svg)](LICENSE)
 [![Socket](https://socket.dev/api/badge/npm/package/network-ai)](https://socket.dev/npm/package/network-ai/overview)
@@ -34,6 +34,7 @@ Network-AI is a TypeScript/Node.js multi-agent orchestrator that adds coordinati
 - **29 adapters** — LangChain (+ streaming), AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, Custom (+ streaming), OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS, Copilot, LangGraph, Anthropic Computer Use, OpenAI Agents SDK, Vertex AI, Pydantic AI, Browser Agent, Hermes (NousResearch Hermes / any OpenAI-compatible endpoint), Orchestrator (hierarchical multi-orchestrator), and RLM (Recursive Language Model / any RLM-compatible HTTP endpoint) — no glue code, no lock-in
 - **Persistent project memory (Layer 3)** — `context_manager.py` injects decisions, goals, stack, milestones, and banned patterns into every system prompt so agents always have full project context
 - **v5.0 modules** — Agent VCR (record/replay), comparison runner, coverage reporter, goal DSL, approval inbox, job queue, gRPC/HTTP transport, playground REPL, adapter test harness, and more
+- **Model-interaction lifecycle governance (v5.13)** — `GovernedModelGateway` absorbs the model refusal → fallback → billing chain (cross-model fallback, fallback-credit repricing, effort governance, thinking-block handoff) behind one governed, budgeted, audited call
 
 > **The silent failure mode in multi-agent systems:** parallel agents writing to the same key
 > use last-write-wins by default — one agent's result silently overwrites another's mid-flight.
@@ -51,6 +52,58 @@ Network-AI is a TypeScript/Node.js multi-agent orchestrator that adds coordinati
 
 ---
 
+## 🛡️ Model-Interaction Lifecycle Governance
+
+Most governance tools stop at the agent boundary — they police which tools an agent may call *before* it acts. Network-AI also governs the layer underneath: **how an agent talks to the model.** When a frontier model declines a request with a classifier refusal, Network-AI absorbs the refusal → fallback → billing chain and presents one governed, budgeted, audited call.
+
+- **`GovernedModelGateway`** — detect `stop_reason:"refusal"`, audit which classifier fired, route to a fallback model, and redeem the fallback-credit token so the retry is repriced as a cache read.
+- **`ModelBudget`** — per-model USD accounting with fallback-credit repricing; never sums tokens across models.
+- **`RefusalTelemetry`** — a refusal is an HTTP 200, invisible to error-rate monitoring; emitted as a discrete non-error signal with an `unservedRefusalCount` gap to alert on.
+- **`EffortPolicy`** — turn the `effort` cost dial into a policy object: cap sub-agents at `low`, require justification for `xhigh`/`max`.
+- **`ThinkingBlockManager`** — keep thinking blocks unchanged on the same model; strip them on a cross-model fallback; guard prompts against `reasoning_extraction` refusals.
+- **Per-sub-agent fallback** — `FanOutFanIn` steps and `TeamRunner` tasks each carry their own fallback agent and per-request retry budget (`RetryBudget`), because a turn can refuse independently across an agent and its sub-agents.
+
+```typescript
+import { AnthropicMessagesAdapter, ModelBudget, RefusalTelemetry } from 'network-ai';
+
+const adapter = new AnthropicMessagesAdapter();
+await adapter.initialize({});
+adapter.registerModelAgent('analyst', {
+  client,                              // bring your own Anthropic client
+  model: 'claude-fable-5',
+  fallbackModels: ['claude-opus-4-8'], // classifier refusals fall through here
+  budget: new ModelBudget({
+    ceilingUsd: 5,
+    pricing: {
+      'claude-fable-5': { inputPerMTok: 10, outputPerMTok: 50 },
+      'claude-opus-4-8': { inputPerMTok: 5, outputPerMTok: 25 },
+    },
+  }),
+  telemetry: new RefusalTelemetry(),
+});
+const result = await adapter.executeAgent('analyst', { action: 'Summarize Q3 results', params: {} }, { agentId: 'cli' });
+// result.data: { servedModel, servedByFallback, refused, refusalCategories, attempts, totalCostUsd }
+```
+
+### OWASP Agentic AI Top 10 (2026) — engine coverage
+
+Verify programmatically with `verifyOwaspCoverage()` (exported from `network-ai`):
+
+| Risk | Status | Primary control |
+|---|---|---|
+| ASI-01 Agent Goal Hijack | ✅ Covered | AuthGuardian gating + JourneyFSM control plane |
+| ASI-02 Tool Misuse & Exploitation | ✅ Covered | AgentRuntime SandboxPolicy + ApprovalGate |
+| ASI-03 Identity & Privilege Abuse | ✅ Covered | HMAC / Ed25519 signed tokens + trust scoring |
+| ASI-04 Supply Chain Risks | ✅ Covered | 1 runtime dep + socket / clawhub / codeql gates |
+| ASI-05 Unsafe Code Execution | ✅ Covered | ShellExecutor `shell:false` argv + path guards |
+| ASI-06 Memory & Context Poisoning | ✅ Covered | LockedBlackboard + injection detection |
+| ASI-07 Insecure Inter-Agent Comms | 🟡 Partial | FS-mutex + signed handoffs (local-trust boundary) |
+| ASI-08 Cascading Failures | ✅ Covered | CircuitBreaker + budgets + RetryBudget |
+| ASI-09 Human-Agent Trust Exploitation | ✅ Covered | ApprovalGate + tamper-evident audit trail |
+| ASI-10 Rogue Agents | ✅ Covered | ComplianceMonitor + circuit-breaker kill switch |
+
+---
+
 ## ⚡ Try in 60 Seconds
 
 ```bash
@@ -489,7 +542,7 @@ npm run test:phase9       # Agent runtime, console, strategy agent
 npm run test:phase12      # Context Throttler, Partition Planner, Coverage Gate, Route Classifier
 ```
 
-**3,269 passing assertions across 33 test suites** (`npm run test:all`):
+**3,373 passing assertions across 37 test suites** (`npm run test:all`):
 
 | Suite | Assertions | Covers |
 |---|---|---|
@@ -525,6 +578,9 @@ npm run test:phase12      # Context Throttler, Partition Planner, Coverage Gate,
 | `test-transport.ts` | 117 | Basis transport tier: `TransportAgent` state machine, `LandscapeAgent` health tracking, `AgentPool` drain/pause, fleet coordination, canary, rollback |
 | `test-claim-verifier.ts` | 50 | ClaimVerifier: receipt generation/tamper/expiry, corroborated/unsupported/undisclosed, trust decay/reset/DoS protection |
 | `test-phase13.ts` | 58 | ESM dual-build config, McpStreamableServer dispatch + resources + prompts, PhasePipeline checkpoint/resume/clear, SemanticMemory save/load/autoSave/clearPersisted |
+| `test-phase14.ts` | 52 | Model lifecycle governance: `GovernedModelGateway` refusal→fallback, `ModelBudget` credit repricing, `RefusalTelemetry`, Anthropic Messages adapter |
+| `test-phase15.ts` | 31 | Orchestration resilience: `RetryBudget`, per-sub-agent fallback in `FanOutFanIn` + `TeamRunner`, `EffortPolicy` |
+| `test-phase16.ts` | 21 | `ThinkingBlockManager` lifecycle + reasoning-extraction guard, OWASP Agentic Top 10 coverage matrix |
 | `test.ts` | 39 | Core orchestrator smoke tests |
 
 ---
@@ -534,18 +590,18 @@ npm run test:phase12      # Context Throttler, Partition Planner, Coverage Gate,
 | Doc | Contents |
 |---|---|
 | [QUICKSTART.md](QUICKSTART.md) | Installation, first run, CLI reference, PowerShell guide, Python scripts CLI |
-| [ARCHITECTURE.md](ARCHITECTURE.md) | Race condition problem, FSM design, handoff protocol, module inventory, project structure |
+| [ARCHITECTURE.md](ARCHITECTURE.md) | Race condition problem, FSM design, handoff protocol, model-interaction lifecycle governance, module inventory, project structure |
 | [BENCHMARKS.md](BENCHMARKS.md) | Provider performance, rate limits, local GPU, `max_completion_tokens` guide |
-| [SECURITY.md](SECURITY.md) | Security module, permission system, trust levels, audit trail, disclosure SLA, ClawHub scan findings |
+| [SECURITY.md](SECURITY.md) | Security module, permission system, trust levels, audit trail, OWASP Agentic Top 10 coverage, disclosure SLA, ClawHub scan findings |
 | [THREAT_MODEL.md](THREAT_MODEL.md) | Adversary profiles, trust boundaries, explicit non-goals, security controls summary |
 | [DATA_LOCATIONS.md](DATA_LOCATIONS.md) | Every file Network-AI creates — path, purpose, data classification, operator responsibilities |
 | [SUPPLY_CHAIN.md](SUPPLY_CHAIN.md) | Runtime dependencies, what runs at install, network surface, SLSA/npm provenance verification |
 | [ENTERPRISE.md](ENTERPRISE.md) | Evaluation checklist, stability policy, security summary, integration entry points |
-| [AUDIT_LOG_SCHEMA.md](AUDIT_LOG_SCHEMA.md) | Audit log field reference, all event types, scoring formula |
+| [AUDIT_LOG_SCHEMA.md](AUDIT_LOG_SCHEMA.md) | Audit log field reference, all event types (including `model.refusal` / `model.attempt`), scoring formula |
 | [ADOPTERS.md](ADOPTERS.md) | Known adopters — open a PR to add yourself |
-| [INTEGRATION_GUIDE.md](INTEGRATION_GUIDE.md) | End-to-end integration walkthrough with v5.0 modules |
-| [SKILL.md](SKILL.md) | OpenClaw/ClawHub Python skill — setup, orchestrator protocol, security scan findings |
-| [references/adapter-system.md](references/adapter-system.md) | Adapter architecture, all 29 adapters, writing custom adapters |
+| [INTEGRATION_GUIDE.md](INTEGRATION_GUIDE.md) | End-to-end integration walkthrough with v5.13 modules |
+| [SKILL.md](SKILL.md) | OpenClaw/ClawHub Python skill — setup, orchestrator protocol, OWASP engine coverage, security scan findings |
+| [references/adapter-system.md](references/adapter-system.md) | Adapter architecture, all 29 adapters (incl. `AnthropicMessagesAdapter`), writing custom adapters |
 | [references/auth-guardian.md](references/auth-guardian.md) | Permission scoring, resource types, `scoreRequest()`, IAuthValidator interface |
 | [references/trust-levels.md](references/trust-levels.md) | Trust level configuration, APS delegation-chain mapping |
 
@@ -563,7 +619,7 @@ Three integration files are included in the repo root:
 |---|---|
 | [`claude-tools.json`](claude-tools.json) | Claude API tool use & OpenAI Codex — drop into the `tools` array |
 | [`openapi.yaml`](openapi.yaml) | Custom GPT Actions — import directly in the GPT editor |
-| [`claude-project-prompt.md`](claude-project-prompt.md) | Claude Projects — paste into Custom Instructions |
+| [`claude-project-prompt.md`](claude-project-prompt.md) | Claude Projects — paste into Custom Instructions (includes lifecycle governance context) |
 
 **Claude API / Codex:**
 ```js
@@ -600,7 +656,7 @@ MIT License — [LICENSE](LICENSE)  ·  [CHANGELOG](CHANGELOG.md) &nbs
 <details>
 <summary>Keywords</summary>
 
-multi-agent · agent orchestration · AI agents · agentic AI · agentic workflow · TypeScript · Node.js · LangGraph · CrewAI · AutoGen · MCP · model-context-protocol · LlamaIndex · Semantic Kernel · OpenAI Assistants · Haystack · DSPy · Agno · OpenClaw · ClawHub · shared state · blackboard pattern · atomic commits · guardrails · token budgets · permission gating · audit trail · agent coordination · agent handoffs · governance · cost-awareness
+multi-agent · agent orchestration · AI agents · agentic AI · agentic workflow · TypeScript · Node.js · LangGraph · CrewAI · AutoGen · MCP · model-context-protocol · LlamaIndex · Semantic Kernel · OpenAI Assistants · Haystack · DSPy · Agno · OpenClaw · ClawHub · shared state · blackboard pattern · atomic commits · guardrails · token budgets · permission gating · audit trail · agent coordination · agent handoffs · governance · cost-awareness · refusal handling · fallback routing · model lifecycle · OWASP agentic AI · effort policy · thinking blocks
 
 </details>
 

package/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: network-ai
-description: "Local Python orchestration skill: multi-agent workflows via shared blackboard file, permission gating, token budget scripts, and persistent project context. All bundled Python scripts run locally with zero network calls. The full npm package (npm install network-ai) additionally ships a TypeScript library, CLI, and an optional operator-started MCP SSE server that binds a TCP port."
+description: "Local Python orchestration skill: multi-agent workflows via shared blackboard file, permission gating, token budget scripts, and persistent project context. The bundled Python scripts make no network calls and have zero third-party dependencies. The parent repository also contains a TypeScript engine (not included in this skill bundle)."
 metadata:
   openclaw:
     emoji: "\U0001F41D"
     homepage: https://network-ai.org
     capabilities:
-      filesystem: "read/write — project root `swarm-blackboard.md` (blackboard state), `data/pending_changes/<id>.json` (WAL entries), `data/audit_log.jsonl`, `data/active_grants.json`, `data/.signing_key`, `data/project-context.json`, `data/task_tracking.json`, `data/agent_health.json`, `data/budget_tracking.json`. All paths are local; nothing is transmitted over the network. When NETWORK_AI_ENV is set, data paths are rooted at `data/<env>/` instead of `data/`. The `--path` argument in blackboard.py is validated against the project root at runtime — paths outside the project directory are rejected (CWE-22)."
+      filesystem: "read/write — project root `swarm-blackboard.md` (blackboard state), `data/pending_changes/<id>.json` (WAL entries), `data/audit_log.jsonl`, `data/active_grants.json`, `data/.signing_key`, `data/project-context.json`, `data/task_tracking.json`, `data/agent_health.json`, `data/budget_tracking.json`. All paths are local; no data leaves the local filesystem. When NETWORK_AI_ENV is set, data paths are rooted at `data/<env>/` instead of `data/`. The `--path` argument in blackboard.py is validated against the project root at runtime — paths outside the project directory are rejected (CWE-22)."
       env_vars: "read — NETWORK_AI_ENV (environment routing), NETWORK_AI_MCP_SECRET (MCP bearer auth), NETWORK_AI_MINIMAL (minimal-mode flag). No env vars are written."
       shell_exec: "optional — AgentRuntime (lib/agent-runtime.ts) with SandboxPolicy and ApprovalGate; disabled by default. Never auto-enabled by this skill. auto_approve must NOT be set in production (see auto_approve_warning below)."
       tcp_port: "optional — MCP SSE server (bin/mcp-server.ts) binds 127.0.0.1 only when explicitly started by the operator. Requires a non-empty bearer-token secret. Never auto-started by this skill or any bundled Python script."
@@ -35,7 +35,7 @@ metadata:
         path: data/
         scope: local-only
         files: ["audit_log.jsonl", "active_grants.json", ".signing_key", "project-context.json", "task_tracking.json", "agent_health.json", "budget_tracking.json", "pending_changes/<id>.json"]
-        description: "All persistent state is local-only. No files are transmitted over the network."
+        description: "All persistent state is local-only. No data leaves the local filesystem."
       blackboard_file:
         path: swarm-blackboard.md
         scope: local-only
@@ -535,7 +535,7 @@ Sequential processing - output of one feeds into next.
 
 **Every sensitive action MUST be logged to `data/audit_log.jsonl`** to maintain compliance and enable forensic analysis.
 
-> **Privacy note:** Audit log entries contain agent-provided free-text fields (justifications, descriptions). These are stored locally in `data/audit_log.jsonl` and never transmitted over the network by this skill. However, **do not put PII, passwords, or API keys in justification strings** — they persist on disk. Consider periodic log rotation and restricting OS file permissions on the `data/` directory.
+> **Privacy note:** Audit log entries contain agent-provided free-text fields (justifications, descriptions). These are stored locally in `data/audit_log.jsonl` and kept on this machine only by this skill — no audit data leaves the local filesystem. However, **do not put PII, passwords, or API keys in justification strings** — they persist on disk. Consider periodic log rotation and restricting OS file permissions on the `data/` directory.
 
 ### What Gets Logged Automatically
 
@@ -732,6 +732,8 @@ python {baseDir}/scripts/swarm_guard.py supervisor-review --task-id "task_001"
 
 The following findings are drawn from the **MAESTRO Agent Security Threat** framework (OWASP LLM / ASVS mapping). They are addressed by existing architectural controls in Network-AI — not open vulnerabilities.
 
+> **Engine-level OWASP Agentic AI Top 10 (2026):** the TypeScript orchestration engine maps all 10 OWASP Agentic risk categories (ASI-01 … ASI-10) to deterministic controls, verifiable programmatically via `verifyOwaspCoverage()` (`lib/owasp-compliance.ts`, exported from `network-ai`). See the coverage table in the README. The MAESTRO/AST findings below scope the bundled Python skill scripts.
+
 ### AST03 — Over-Privileged Skills · Severity: High
 
 > *Skills are granted broader permissions than their stated function requires, creating excessive blast radius if prompt-injected.*
@@ -751,7 +753,7 @@ The following findings are drawn from the **MAESTRO Agent Security Threat** fram
 
 | Control | How Network-AI addresses it |
 |---|---|
-| **Zero network calls (Python scripts)** | All bundled Python scripts use Python stdlib only, spawn no subprocesses, and make no network calls — declared in `metadata.openclaw.network_calls` and `bundle_scope`. The optional MCP SSE server (`bin/mcp-server.ts`) binds a TCP port only when explicitly started by the operator and requires a non-empty bearer-token secret. |
+| **Zero network calls (Python scripts)** | All bundled Python scripts use Python stdlib only, spawn no subprocesses, and make no network calls — declared in `metadata.openclaw.network_calls` and `bundle_scope`. The optional TypeScript MCP server (`bin/mcp-server.ts`) is not part of the ClawHub bundle; it must be explicitly started by the operator via `npx network-ai-server` and requires a non-empty bearer-token secret. |
 | **AgentRuntime sandbox** | `ShellExecutor` enforces per-command timeout and output-size limits; `SandboxPolicy` allowlist/blocklist prevents unapproved shell commands from running at all |
 | **ClaimVerifier (Tier 1 agent honesty)** | `AgentRuntime` issues HMAC-signed outcome-bound receipts (`ExecutionReceipt`) on every `exec()` and `writeFile()`; `ClaimVerifier` (`lib/claim-verifier.ts`) reconciles agent-declared manifests against the audit log — `UNSUPPORTED_CLAIM` and `UNDISCLOSED_ACTION` violations surface through `ComplianceMonitor`; repeated fabrication decays `AuthGuardian` trust and forces `ApprovalGate` supervision |
 | **Source protection** | `SandboxPolicy.sourceProtection` constrains `FileAccessor.read/write/list` to `data/<env>/` only; any attempt to read outside that boundary throws `SourceProtectionError` — the agent receives `{success: false}`, no path details leak |
@@ -765,7 +767,7 @@ The following findings are drawn from the **MAESTRO Agent Security Threat** fram
 
 | Control | How Network-AI addresses it |
 |---|---|
-| **Exact version pinning** | npm `package.json` uses exact `"version": "5.12.4"` — no semver range specifiers; `clawhub install network-ai` pins to a specific published version |
+| **Exact version pinning** | npm `package.json` uses exact `"version": "5.13.1"` — no semver range specifiers; `clawhub install network-ai` pins to a specific published version |
 | **Zero transitive dependency drift** | All bundled Python scripts use Python stdlib only — `pip install` is never required; there are no third-party packages to drift, be compromised upstream, or introduce CVEs |
 | **Signed, tagged releases** | Every release is committed with a signed Git tag (`v5.7.x`); commit hash is verifiable against CHANGELOG.md; GitHub releases link tag → diff → changelog entry |
 | **Supply chain monitoring** | npm package continuously scored by Socket.dev (score A); any new dependency or permission change triggers an alert |
@@ -791,6 +793,7 @@ This skill is scanned on every publish. The following Notes are flagged by desig
 | **SkillSpector** Context-Inappropriate Capability (MCP control surface breadth) | ~~Medium~~ Resolved | Same root cause — `comment.txt` enumerated the HTTP MCP server's 22 privileged tools (blackboard write, token ops, agent_spawn, fsm_transition, audit_query), which the scanner read as a broad remote-control surface inside a local skill. | Fixed in v5.12.7 — `comment.txt` excluded from the bundle (see row above) and enforced by the `clawhub:check` guard. The HTTP MCP server itself remains opt-in: it requires a non-empty bearer secret before `listen()` binds (fail-closed), runs only via `NETWORK_AI_MCP_SECRET=<secret> npx network-ai-server`, binds `127.0.0.1` by default, and is documented in `SUPPLY_CHAIN.md §5a`. |
 | **SkillSpector** Context-Inappropriate Capability (`_load_signing_key()` token minting) | Medium, 92% | `scripts/check_permission.py` mints, HMAC-signs, persists, and lists grant tokens — a de facto local authorization artifact that downstream components may be tempted to treat as real credentials. | Token advisory-only warnings appear in source, SKILL.md, and SECURITY.md. Every grant response includes the advisory notice. Tokens are labeled `grant_{uuid4().hex}`; the HMAC signature only proves local origin, not external identity. Platform-level authentication is required before any destructive action (PAYMENTS, DATABASE, FILE_EXPORT). See ASI03 rows above. |
 | **SkillSpector** Intent-Code Divergence (`FILE_EXPORT` missing from `HIGH_RISK_RESOURCES`) | ~~Low~~ Resolved | Comment stated `FILE_EXPORT` requires `--confirm-high-risk` but `HIGH_RISK_RESOURCES` only contained `PAYMENTS` and `DATABASE`; file export requests could receive advisory grants without the extra acknowledgment | Fixed in v5.11.0 — `FILE_EXPORT` added to `HIGH_RISK_RESOURCES` in `check_permission.py`; now requires `--confirm-high-risk` consistent with the documented policy |
+| **SkillSpector** YARA `agent_skill_mcp_tool_poisoning_metadata` (MCP/tool metadata poisoning indicators) | ~~High~~ Resolved | SKILL.md frontmatter `description:` retained an older phrasing that referenced the optional TypeScript network server alongside "zero network calls" — a combination the YARA rule flags. A privacy-note sentence also used wording adjacent to file/data references that the exfiltration sub-rule flagged. | Fixed in v5.13.1 — frontmatter `description:` confirmed clean (server reference removed; TypeScript engine noted as parent repository only). Privacy note reworded to remove the flagged phrase. VirusTotal 64/64 clean throughout. |
 | **SkillSpector** Description-Behavior Mismatch (`ensure_data_dir()` ignoring env scope) | ~~Medium~~ Resolved | `ensure_data_dir()` always created the fixed top-level `data/` directory instead of the active env-specific path, breaking environment isolation when `NETWORK_AI_ENV` is set | Fixed in v5.11.0 — `ensure_data_dir()` now delegates to `_resolve_data_dir()` so audit log and grant files are always written to the correct env-scoped directory |
 
 ## References

package/dist/adapters/anthropic-messages-adapter.d.ts

@@ -0,0 +1,141 @@
+/**
+ * AnthropicMessagesAdapter — governed Anthropic Messages binding.
+ *
+ * The concrete provider binding for {@link ../lib/model-gateway!GovernedModelGateway}.
+ * It maps the Anthropic Messages API (refusals, `output_config.effort`,
+ * fallback-credit redemption) to the gateway's normalized shapes, then exposes
+ * one governed `executeAgent` that absorbs the refusal → fallback → billing
+ * chain behind the standard adapter interface.
+ *
+ * Dependency-free (BYOC): you inject an `AnthropicMessagesClient`; the adapter
+ * never imports the Anthropic SDK. Build and test it against Claude Opus 4.8,
+ * which is also Claude Fable 5's fallback target.
+ *
+ * @module AnthropicMessagesAdapter
+ * @version 1.0.0
+ */
+import type { AgentPayload, AgentContext, AgentResult, AdapterCapabilities } from '../types/agent-adapter';
+import { BaseAdapter } from './base-adapter';
+import { type ModelCaller, type ModelResponse, type EffortLevel, type BudgetSink, type AuditSink, type RefusalTelemetrySink, type ThinkingSink, type EffortSink } from '../lib/model-gateway';
+/** Raw Anthropic Messages response (the subset this adapter reads). */
+export interface AnthropicRawResponse {
+    id?: string;
+    model: string;
+    content: Array<{
+        type: string;
+        text?: string;
+        thinking?: string;
+        signature?: string;
+        [k: string]: unknown;
+    }>;
+    stop_reason: string | null;
+    stop_details?: {
+        type?: string;
+        category?: string | null;
+        explanation?: string;
+        fallback_credit_token?: string | null;
+        fallback_has_prefill_claim?: boolean | null;
+        recommended_model?: string | null;
+    } | null;
+    usage?: {
+        input_tokens?: number;
+        output_tokens?: number;
+        cache_read_input_tokens?: number;
+        cache_creation_input_tokens?: number;
+    };
+}
+/** Bring-your-own Anthropic Messages client (e.g. `client.beta.messages`). */
+export interface AnthropicMessagesApiClient {
+    create(params: {
+        model: string;
+        max_tokens: number;
+        system?: string;
+        messages: Array<{
+            role: string;
+            content: unknown;
+        }>;
+        tools?: Array<Record<string, unknown>>;
+        output_config?: {
+            effort?: string;
+        };
+        fallback_credit_token?: string;
+        betas?: string[];
+    }): Promise<AnthropicRawResponse>;
+}
+/** Per-agent configuration for {@link AnthropicMessagesAdapter.registerModelAgent}. */
+export interface AnthropicMessagesAgentConfig {
+    /** The injected Anthropic Messages client. */
+    client: AnthropicMessagesApiClient;
+    /** Primary model (default: `claude-fable-5`). */
+    model?: string;
+    /** Ordered fallback models (default: `['claude-opus-4-8']`). */
+    fallbackModels?: string[];
+    /** System prompt. */
+    systemPrompt?: string;
+    /** Max tokens per call (default: 1024). */
+    maxTokens?: number;
+    /** Default effort level. */
+    effort?: EffortLevel;
+    /** Cross-model budget. */
+    budget?: BudgetSink;
+    /** Audit destination. */
+    audit?: AuditSink;
+    /** Refusal/fallback telemetry. */
+    telemetry?: RefusalTelemetrySink;
+    /** Thinking-block lifecycle manager. */
+    thinking?: ThinkingSink;
+    /** Effort governance policy. */
+    effortPolicy?: EffortSink;
+}
+/**
+ * Map a raw Anthropic response to the gateway's normalized {@link ModelResponse}.
+ *
+ * @param raw             The native response.
+ * @param requestedModel  The model that was requested (fallback when `raw.model` is absent).
+ */
+export declare function normalizeAnthropicResponse(raw: AnthropicRawResponse, requestedModel: string): ModelResponse;
+/**
+ * Build a normalized {@link ModelCaller} from an Anthropic Messages client.
+ *
+ * Uses **client-side** fallback (the gateway drives the chain), so it never
+ * sets the server-side `fallbacks` parameter. When a fallback-credit token is
+ * present it is forwarded with the `fallback-credit-2026-06-01` beta header so
+ * the retry is repriced as a cache read.
+ *
+ * @param client  The injected Anthropic Messages client.
+ * @returns       A `ModelCaller` the gateway can drive.
+ */
+export declare function createAnthropicCaller(client: AnthropicMessagesApiClient): ModelCaller;
+/**
+ * Governed Anthropic Messages adapter.
+ *
+ * Each registered agent runs through its own {@link GovernedModelGateway}, so a
+ * single `executeAgent` call transparently handles refusals, cross-model
+ * fallback, fallback-credit billing, and thinking-block handoff.
+ *
+ * @example
+ * ```typescript
+ * const adapter = new AnthropicMessagesAdapter();
+ * await adapter.initialize({});
+ * adapter.registerModelAgent('analyst', {
+ *   client,                                  // your Anthropic client
+ *   model: 'claude-fable-5',
+ *   fallbackModels: ['claude-opus-4-8'],
+ *   budget, audit, telemetry,
+ * });
+ * const result = await adapter.executeAgent('analyst', { action: 'Summarize…', params: {} }, ctx);
+ * ```
+ */
+export declare class AnthropicMessagesAdapter extends BaseAdapter {
+    readonly name = "anthropic-messages";
+    readonly version = "1.0.0";
+    private agents;
+    get capabilities(): AdapterCapabilities;
+    /**
+     * Register a model-backed agent. Builds a {@link GovernedModelGateway} wired
+     * with the supplied budget/audit/telemetry/thinking/effort collaborators.
+     */
+    registerModelAgent(agentId: string, config: AnthropicMessagesAgentConfig): void;
+    executeAgent(agentId: string, payload: AgentPayload, _context: AgentContext): Promise<AgentResult>;
+}
+//# sourceMappingURL=anthropic-messages-adapter.d.ts.map

package/dist/adapters/anthropic-messages-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-messages-adapter.d.ts","sourceRoot":"","sources":["../../adapters/anthropic-messages-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC3G,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,aAAa,EAElB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,UAAU,EAEhB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IAC7G,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtC,0BAA0B,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QAC5C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,GAAG,IAAI,CAAC;IACT,KAAK,CAAC,EAAE;QACN,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,2BAA2B,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;CACH;AAED,8EAA8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,MAAM,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACpD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,aAAa,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnC;AAED,uFAAuF;AACvF,MAAM,WAAW,4BAA4B;IAC3C,8CAA8C;IAC9C,MAAM,EAAE,0BAA0B,CAAC;IACnC,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,qBAAqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,0BAA0B;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,yBAAyB;IACzB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,kCAAkC;IAClC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,wCAAwC;IACxC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,gCAAgC;IAChC,YAAY,CAAC,EAAE,UAAU,CAAC;CAC3B;AAQD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa,CAgC3G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,0BAA0B,GAAG,WAAW,CAiBrF;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,wBAAyB,SAAQ,WAAW;IACvD,QAAQ,CAAC,IAAI,wBAAwB;IACrC,QAAQ,CAAC,OAAO,WAAW;IAE3B,OAAO,CAAC,MAAM,CAA8F;IAE5G,IAAI,YAAY,IAAI,mBAAmB,CAStC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,GAAG,IAAI;IA+BzE,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;CA6DzG"}

package/dist/adapters/anthropic-messages-adapter.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * AnthropicMessagesAdapter — governed Anthropic Messages binding.
+ *
+ * The concrete provider binding for {@link ../lib/model-gateway!GovernedModelGateway}.
+ * It maps the Anthropic Messages API (refusals, `output_config.effort`,
+ * fallback-credit redemption) to the gateway's normalized shapes, then exposes
+ * one governed `executeAgent` that absorbs the refusal → fallback → billing
+ * chain behind the standard adapter interface.
+ *
+ * Dependency-free (BYOC): you inject an `AnthropicMessagesClient`; the adapter
+ * never imports the Anthropic SDK. Build and test it against Claude Opus 4.8,
+ * which is also Claude Fable 5's fallback target.
+ *
+ * @module AnthropicMessagesAdapter
+ * @version 1.0.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AnthropicMessagesAdapter = void 0;
+exports.normalizeAnthropicResponse = normalizeAnthropicResponse;
+exports.createAnthropicCaller = createAnthropicCaller;
+const base_adapter_1 = require("./base-adapter");
+const thinking_blocks_1 = require("../lib/thinking-blocks");
+const model_gateway_1 = require("../lib/model-gateway");
+// ---------------------------------------------------------------------------
+// Beta header for fallback-credit redemption
+// ---------------------------------------------------------------------------
+const FALLBACK_CREDIT_BETA = 'fallback-credit-2026-06-01';
+/**
+ * Map a raw Anthropic response to the gateway's normalized {@link ModelResponse}.
+ *
+ * @param raw             The native response.
+ * @param requestedModel  The model that was requested (fallback when `raw.model` is absent).
+ */
+function normalizeAnthropicResponse(raw, requestedModel) {
+    const content = (raw.content ?? []).map((b) => ({ ...b }));
+    const isRefusal = raw.stop_reason === 'refusal';
+    const usage = raw.usage ?? {};
+    const response = {
+        id: raw.id,
+        model: raw.model || requestedModel,
+        content,
+        stopReason: raw.stop_reason,
+        usage: {
+            inputTokens: usage.input_tokens ?? 0,
+            outputTokens: usage.output_tokens ?? 0,
+            cacheReadInputTokens: usage.cache_read_input_tokens ?? 0,
+            cacheCreationInputTokens: usage.cache_creation_input_tokens ?? 0,
+        },
+    };
+    if (isRefusal) {
+        const d = raw.stop_details ?? {};
+        response.refusal = {
+            category: (d.category ?? null),
+            explanation: d.explanation,
+            fallbackCreditToken: d.fallback_credit_token ?? null,
+            fallbackHasPrefillClaim: d.fallback_has_prefill_claim ?? null,
+            recommendedModel: d.recommended_model ?? null,
+        };
+    }
+    else {
+        response.refusal = null;
+    }
+    return response;
+}
+/**
+ * Build a normalized {@link ModelCaller} from an Anthropic Messages client.
+ *
+ * Uses **client-side** fallback (the gateway drives the chain), so it never
+ * sets the server-side `fallbacks` parameter. When a fallback-credit token is
+ * present it is forwarded with the `fallback-credit-2026-06-01` beta header so
+ * the retry is repriced as a cache read.
+ *
+ * @param client  The injected Anthropic Messages client.
+ * @returns       A `ModelCaller` the gateway can drive.
+ */
+function createAnthropicCaller(client) {
+    return async (req) => {
+        const params = {
+            model: req.model,
+            max_tokens: req.maxTokens ?? 1024,
+            messages: req.messages.map((m) => ({ role: m.role, content: m.content })),
+        };
+        if (req.system)
+            params.system = req.system;
+        if (req.tools)
+            params.tools = req.tools;
+        if (req.effort)
+            params.output_config = { effort: req.effort };
+        if (req.fallbackCreditToken) {
+            params.fallback_credit_token = req.fallbackCreditToken;
+            params.betas = [FALLBACK_CREDIT_BETA];
+        }
+        const raw = await client.create(params);
+        return normalizeAnthropicResponse(raw, req.model);
+    };
+}
+// ---------------------------------------------------------------------------
+// Adapter
+// ---------------------------------------------------------------------------
+/**
+ * Governed Anthropic Messages adapter.
+ *
+ * Each registered agent runs through its own {@link GovernedModelGateway}, so a
+ * single `executeAgent` call transparently handles refusals, cross-model
+ * fallback, fallback-credit billing, and thinking-block handoff.
+ *
+ * @example
+ * ```typescript
+ * const adapter = new AnthropicMessagesAdapter();
+ * await adapter.initialize({});
+ * adapter.registerModelAgent('analyst', {
+ *   client,                                  // your Anthropic client
+ *   model: 'claude-fable-5',
+ *   fallbackModels: ['claude-opus-4-8'],
+ *   budget, audit, telemetry,
+ * });
+ * const result = await adapter.executeAgent('analyst', { action: 'Summarize…', params: {} }, ctx);
+ * ```
+ */
+class AnthropicMessagesAdapter extends base_adapter_1.BaseAdapter {
+    name = 'anthropic-messages';
+    version = '1.0.0';
+    agents = new Map();
+    get capabilities() {
+        return {
+            streaming: false,
+            parallel: true,
+            bidirectional: false,
+            discovery: true,
+            authentication: false,
+            statefulSessions: false,
+        };
+    }
+    /**
+     * Register a model-backed agent. Builds a {@link GovernedModelGateway} wired
+     * with the supplied budget/audit/telemetry/thinking/effort collaborators.
+     */
+    registerModelAgent(agentId, config) {
+        if (!agentId || typeof agentId !== 'string') {
+            throw new TypeError('AnthropicMessagesAdapter.registerModelAgent: agentId must be a non-empty string');
+        }
+        if (!config || typeof config.client?.create !== 'function') {
+            throw new TypeError('AnthropicMessagesAdapter.registerModelAgent: config.client.create must be a function');
+        }
+        const primaryModel = config.model ?? 'claude-fable-5';
+        const gateway = new model_gateway_1.GovernedModelGateway({
+            caller: createAnthropicCaller(config.client),
+            primaryModel,
+            fallbackModels: config.fallbackModels ?? ['claude-opus-4-8'],
+            defaultEffort: config.effort,
+            budget: config.budget,
+            audit: config.audit,
+            telemetry: config.telemetry,
+            thinking: config.thinking ?? new thinking_blocks_1.ThinkingBlockManager(),
+            effort: config.effortPolicy,
+        });
+        this.agents.set(agentId, { gateway, config });
+        this.registerLocalAgent({
+            id: agentId,
+            name: agentId,
+            status: 'available',
+            capabilities: ['text', 'governed-fallback'],
+            metadata: { adapter: this.name, model: primaryModel },
+        });
+    }
+    async executeAgent(agentId, payload, _context) {
+        this.ensureReady();
+        const entry = this.agents.get(agentId);
+        if (!entry) {
+            return this.errorResult('MODEL_AGENT_NOT_FOUND', `No agent registered as '${agentId}'`, false);
+        }
+        const instruction = payload.handoff?.instruction ?? payload.params?.['instruction'] ?? payload.action;
+        const start = Date.now();
+        try {
+            const result = await entry.gateway.send({
+                messages: [{ role: 'user', content: instruction }],
+                system: entry.config.systemPrompt,
+                maxTokens: entry.config.maxTokens,
+                effort: entry.config.effort,
+                agentId,
+            });
+            const durationMs = Date.now() - start;
+            const text = result.response.content
+                .filter((b) => b.type === 'text')
+                .map((b) => b.text ?? '')
+                .join('\n');
+            const data = {
+                response: text,
+                servedModel: result.servedModel,
+                servedByFallback: result.servedByFallback,
+                refused: result.refused,
+                refusalCategories: result.refusalCategories,
+                attempts: result.attempts,
+                totalCostUsd: result.totalCostUsd,
+            };
+            if (result.refused) {
+                const category = result.refusalCategories[result.refusalCategories.length - 1] ?? null;
+                return {
+                    success: false,
+                    data,
+                    error: {
+                        code: 'MODEL_REFUSED',
+                        message: `All models declined the request${category ? ` (category: ${category})` : ''}`,
+                        recoverable: false,
+                    },
+                    metadata: { adapter: this.name, executionTimeMs: durationMs },
+                };
+            }
+            return this.successResult(data, durationMs);
+        }
+        catch (error) {
+            return this.errorResult('MODEL_EXECUTION_ERROR', error instanceof Error ? error.message : String(error), true, error);
+        }
+    }
+}
+exports.AnthropicMessagesAdapter = AnthropicMessagesAdapter;
+//# sourceMappingURL=anthropic-messages-adapter.js.map

package/dist/adapters/anthropic-messages-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-messages-adapter.js","sourceRoot":"","sources":["../../adapters/anthropic-messages-adapter.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAiGH,gEAgCC;AAaD,sDAiBC;AA5JD,iDAA6C;AAC7C,4DAA8D;AAC9D,wDAY8B;AAoE9B,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAE1D;;;;;GAKG;AACH,SAAgB,0BAA0B,CAAC,GAAyB,EAAE,cAAsB;IAC1F,MAAM,OAAO,GAAwB,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAkB;QAC9B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,cAAc;QAClC,OAAO;QACP,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,KAAK,EAAE;YACL,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC;YACpC,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC;YACtC,oBAAoB,EAAE,KAAK,CAAC,uBAAuB,IAAI,CAAC;YACxD,wBAAwB,EAAE,KAAK,CAAC,2BAA2B,IAAI,CAAC;SACjE;KACF,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QACjC,QAAQ,CAAC,OAAO,GAAG;YACjB,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAoB;YACjD,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,mBAAmB,EAAE,CAAC,CAAC,qBAAqB,IAAI,IAAI;YACpD,uBAAuB,EAAE,CAAC,CAAC,0BAA0B,IAAI,IAAI;YAC7D,gBAAgB,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;SAC9C,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CAAC,MAAkC;IACtE,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,MAAM,GAAwD;YAClE,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,UAAU,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;YACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;SAC1E,CAAC;QACF,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3C,IAAI,GAAG,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAuC,CAAC;QAC1E,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,aAAa,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAC9D,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAC5B,MAAM,CAAC,qBAAqB,GAAG,GAAG,CAAC,mBAAmB,CAAC;YACvD,MAAM,CAAC,KAAK,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,0BAA0B,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,wBAAyB,SAAQ,0BAAW;IAC9C,IAAI,GAAG,oBAAoB,CAAC;IAC5B,OAAO,GAAG,OAAO,CAAC;IAEnB,MAAM,GAAG,IAAI,GAAG,EAAmF,CAAC;IAE5G,IAAI,YAAY;QACd,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,IAAI;YACd,aAAa,EAAE,KAAK;YACpB,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK;SACxB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAe,EAAE,MAAoC;QACtE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,iFAAiF,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;YAC3D,MAAM,IAAI,SAAS,CAAC,sFAAsF,CAAC,CAAC;QAC9G,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,IAAI,gBAAgB,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,oCAAoB,CAAC;YACvC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5C,YAAY;YACZ,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,CAAC,iBAAiB,CAAC;YAC5D,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,sCAAoB,EAAE;YACvD,MAAM,EAAE,MAAM,CAAC,YAAY;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,kBAAkB,CAAC;YACtB,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW;YACnB,YAAY,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC;YAC3C,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,OAAqB,EAAE,QAAsB;QAC/E,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,CAAC,uBAAuB,EAAE,2BAA2B,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,WAAW,GACf,OAAO,CAAC,OAAO,EAAE,WAAW,IAAK,OAAO,CAAC,MAAM,EAAE,CAAC,aAAa,CAAY,IAAI,OAAO,CAAC,MAAM,CAAC;QAChG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACtC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;gBAClD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;gBACjC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;gBAC3B,OAAO;aACR,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO;iBACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;iBACxB,IAAI,CAAC,IAAI,CAAC,CAAC;YAEd,MAAM,IAAI,GAAG;gBACX,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;YAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;gBACvF,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,IAAI;oBACJ,KAAK,EAAE;wBACL,IAAI,EAAE,eAAe;wBACrB,OAAO,EAAE,kCAAkC,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;wBACvF,WAAW,EAAE,KAAK;qBACnB;oBACD,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE;iBAC9D,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,WAAW,CACrB,uBAAuB,EACvB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,IAAI,EACJ,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAjHD,4DAiHC"}

package/dist/adapters/index.d.ts

@@ -66,6 +66,8 @@ export { LangGraphAdapter } from './langgraph-adapter';
 export type { LangGraphRunnable, LangGraphStreamable, LangGraphAgentConfig } from './langgraph-adapter';
 export { AnthropicComputerUseAdapter } from './anthropic-computer-use-adapter';
 export type { ComputerAction, ComputerToolCall, ComputerToolResult, ComputerActionHandler, AnthropicMessagesClient, ComputerUseAgentConfig, } from './anthropic-computer-use-adapter';
+export { AnthropicMessagesAdapter, createAnthropicCaller, normalizeAnthropicResponse } from './anthropic-messages-adapter';
+export type { AnthropicMessagesApiClient, AnthropicRawResponse, AnthropicMessagesAgentConfig } from './anthropic-messages-adapter';
 export { OpenAIAgentsAdapter } from './openai-agents-adapter';
 export type { OAIAgentTool, OAIAgentRunResult, OAIAgentRunner, OAIAgentsConfig, } from './openai-agents-adapter';
 export { VertexAIAdapter } from './vertex-ai-adapter';