stitchkit 0.91.2 → 0.93.0

package/CHANGELOG.md

@@ -15,6 +15,143 @@ additive**; the first breaking change landed in 0.10.0. Grep the file for
 
 ## [Unreleased]
 
+## [0.93.0] — 2026-09-22
+
+### ⚠️ Breaking changes
+
+- **The surface snapshot records what an operation asks before it runs, and
+  `manifestVersion` is `3`.** `mcp.inputRequired` changes the contract a host is
+  coded against — an operation gains or loses a question — and the snapshot did
+  not move a byte for it. Measured on 0.92.0: the same operation with and
+  without a declared round produced byte-identical manifests, so a consumer was
+  holding the link "declared → state key configured" with a test of their own.
+  An operation row now carries `mcp`: `null`, a list of `{key, message, schema}`,
+  or `'resolved-per-call'` when a resolver decides them. A committed snapshot on
+  an older version is refused by name, with the remedy in the message.
+  `// before: manifest.operations[0]  // no trace of a declared round` →
+  `// after:  manifest.operations[0].mcp  // null | [{ key, message, schema }] | { inputRequired: 'resolved-per-call' }`
+  → ADR 0195
+
+**Who must act:** anyone with a committed surface snapshot — regenerate it once
+and review the diff, which is large because the field is added to every
+operation row, most of them `null`; and anyone whose own test held the link
+between a declared `inputRequired` and its configured state key, who can now
+drop it.
+
+### Added
+
+- **A native command that returns a result is invokable in process.**
+  `createCliInvoker` excluded `config.commands` wholesale, on the reasoning that
+  a native command prints by construction. That is true of the half declaring
+  `output?: never` and was applied to both halves; a consumer measured six of
+  their eight native commands declaring `output`, and a `describe` line that had
+  worked in their stream began answering `NOT_FOUND`. The invoker now admits a
+  native command if and only if it declares `output`. `present` is not called —
+  it is stdout formatting and there is no stdout — while `exitCode` is applied
+  through the same function the command line uses. Whatever a handler writes
+  comes back as `CliInvocationResult.written` instead of interleaving with the
+  caller's own output. A printing command is still outside, now for its own
+  reason. → ADR 0194
+
+- **`SURFACE_MANIFEST_VERSION`, `SurfaceManifestOperationMcp` and
+  `SurfaceManifestOperationMcpSchema`** from `stitchkit/testing`, for reading
+  and asserting the new row.
+
+### Changed
+
+- **`CliConfig.commands` moved to `CliInvokerConfig`.** One declaration for both
+  surfaces; `createCli` keeps the field it always had.
+
+- **An update check refused by the SSRF boundary names the field that lifts it.**
+  A self-hosted deployment serves its manifest from its own network, the check
+  has `allowPrivateHosts` for exactly that, and the refusal relayed the guard's
+  own sentence — which reads like a timeout, so the deployment goes quietly
+  stale. The reason now says the endpoint is not public, names the field, and
+  says why `applyCliUpdate` keeps its own setting: a manifest URL is
+  configuration you wrote, an asset URL arrives inside a document. Only
+  address-privacy refusals get this; a refusal the field cannot lift keeps its
+  own reason.
+
+## [0.92.0] — 2026-09-22
+
+### ⚠️ Breaking changes
+
+- **`RequestEvent.method`, `path` and `statusCode` are optional, and every event
+  carries `kind`.** Work that never arrived over a transport — an agent loop
+  started fire-and-forget, a scheduled broadcast — had to invent them, and what
+  it invented was `method: 'AGENT'`: not a verb, but the absence of one written
+  into the field for verbs. Their absence is now the record. `statusCode` went
+  with them deliberately: dropping the fabricated verb while still demanding an
+  HTTP status would have left a second invented transport field in the same row
+  for the same reason.
+
+**Who must act:** anyone whose `RequestEventSinkConfig.write` writes
+`method` / `path` / `statusCode` into NOT NULL columns, or whose sink filter
+reads `event.method`; anyone adopting signature verification, who now passes the
+manifest to `applyCliUpdate`; and nobody for the continuation refusal, which
+resolves itself on the host's retry.
+
+  `// before: { method: event.method, path: event.path, status: event.statusCode }` →
+  `// after:  { kind: event.kind, method: event.method ?? null, path: event.path ?? null, status: event.statusCode ?? null }`
+  → ADR 0191
+
+- **`applyCliUpdate` requires the manifest when given a trust root.** The
+  signature covers the manifest's identity and every asset digest together, so
+  an asset on its own carries nothing to verify.
+  `// before: applyCliUpdate({ asset })` →
+  `// after:  applyCliUpdate({ asset, manifest: check.manifest, trust })`
+  → ADR 0193
+
+- **An MCP continuation minted before this release is refused once.** The signed
+  round state now carries a fingerprint of the question plan, checked every
+  round. A conversation in flight at deploy time has no fingerprint and gets
+  `INVALID_REQUEST_STATE`; the host re-asks and the retry succeeds. → ADR 0190
+
+### Added
+
+- **`ctx.reportProgress` — a tool call can tell the host what it is doing.**
+  The protocol's channel existed and the framework read neither end, so ten
+  minutes of work and a hang looked identical, including to the model deciding
+  whether to call again. Present on every tool call and a no-op where nobody is
+  listening; never throws. An omitted `progress` sends the ordinal of the update
+  rather than a synthesised percentage. The framework still sends nothing on its
+  own — except `mountWait`, which already polls and relays the phase and the
+  snapshot's own measured number. → ADR 0189
+- **`mcp.inputRequired` may be a function of the parsed call.** A tool whose
+  questions depend on its arguments — one model takes `aspect_ratio`, another
+  `duration` — could previously declare none, and taught the model to work
+  around the gap in its own description. Returning an empty list runs the call
+  as usual. → ADR 0190
+- **`runUnitOfWork`** — work with no transport gets one context and the same
+  completion record a request gets, with `kind: 'job'`, a `name`, its duration
+  and its outcome, and none of the transport fields it does not have.
+  `setRequestDimensions` inside it is no longer a silent no-op. → ADR 0191
+- **`createCliInvoker`, `cliExitCode`, `defineCliStreamCommand`,
+  `defineCliBatchCommand`** — run an already-parsed call in process and get the
+  typed output with the exit code the printed path would give, from the same
+  table. The stream answers each line as it arrives rather than after EOF, and
+  the batch resumes from a checkpoint written by atomic rename after every
+  successful line. Both are factories: the framework does not take `jsonl` or
+  `batch` out of the application's own namespace. → ADR 0192
+- **Signed build manifests.** `signature` is part of the schema (it used to be
+  stripped, so a signed install fetched the document twice), Ed25519 over
+  everything that acts before the digest can disagree — including
+  `compression`, whose expansion is now bounded by the signed `size`. Five
+  verdicts, `unenforced` among them so an unpinned build keeps updating while
+  the absence of a check stays visible. `applyCliUpdate({ backupPath })` keeps
+  the replaced binary with its own file mode and `rollbackCliUpdate` puts it
+  back against its digest. `assertCliPublishable` takes every manifest already
+  published, because one version published to two channels from two commits is
+  invisible to a check that sees one. → ADR 0193
+
+### Fixed
+
+- **`writeFileAtomic` stages under a random name and creates exclusively.** The
+  previous scheme built the staging name from pid and clock, and an ordinary
+  write follows a symlink — anyone able to write to the target's directory could
+  redirect a binary replacement, a backup or a checkpoint through a planted
+  link.
+
 ## [0.91.2] — 2026-09-22
 
 ### Fixed

package/dist/agent-runtime-coding-tools.js

@@ -3,14 +3,14 @@ import {
   AgentCodingToolLimitsSchema,
   AgentCodingToolPathAuthorizationSchema,
   createAgentCodingTools
-} from "./index-qjeyx5t2.js";
+} from "./index-fq77yfzc.js";
 import"./index-bn2cjajt.js";
 import"./index-qmy6zq75.js";
 import"./index-0a349c33.js";
 import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
-import"./index-8z9we758.js";
-import"./index-fenaekmk.js";
+import"./index-vjpvjqpn.js";
+import"./index-h9etkkyk.js";
 import"./index-cby4ar3v.js";
 import"./index-2vtcmrj9.js";
 import"./index-kzfs85xp.js";

package/dist/agent-runtime-harness.js

@@ -6,7 +6,7 @@ import {
   composeAgentPrompt,
   createAgentRuntime,
   createAgentRuntimeEventSink
-} from "./index-7hz88dy8.js";
+} from "./index-vk3kq9sb.js";
 import"./index-p13mwz16.js";
 import"./index-y64k3s0h.js";
 import {
@@ -19,8 +19,8 @@ import {
   walkContainedFiles
 } from "./index-bn2cjajt.js";
 import"./index-kw9t5ayn.js";
-import"./index-s3dssqxp.js";
-import"./index-vsbzgd7b.js";
+import"./index-yn8remb1.js";
+import"./index-tmwcrptx.js";
 import"./index-f9mb610r.js";
 import"./index-e0znv5gn.js";
 import"./index-0a349c33.js";
@@ -30,8 +30,8 @@ import"./index-zcgf3gqf.js";
 import"./index-7zbps32p.js";
 import {
   defineRuntimeTool
-} from "./index-8z9we758.js";
-import"./index-fenaekmk.js";
+} from "./index-vjpvjqpn.js";
+import"./index-h9etkkyk.js";
 import"./index-cby4ar3v.js";
 import"./index-2vtcmrj9.js";
 import"./index-kzfs85xp.js";

package/dist/agent-runtime-sandbox.js

@@ -1,6 +1,6 @@
 import {
   createAgentCodingTools
-} from "./index-qjeyx5t2.js";
+} from "./index-fq77yfzc.js";
 import"./index-bn2cjajt.js";
 import {
   codingRefusal,
@@ -10,8 +10,8 @@ import {
 import"./index-0a349c33.js";
 import"./index-rxfy4cq7.js";
 import"./index-6k1937bx.js";
-import"./index-8z9we758.js";
-import"./index-fenaekmk.js";
+import"./index-vjpvjqpn.js";
+import"./index-h9etkkyk.js";
 import"./index-cby4ar3v.js";
 import"./index-2vtcmrj9.js";
 import"./index-kzfs85xp.js";

package/dist/agent-runtime.js

@@ -24,7 +24,7 @@ import {
   renderAgentStateSlots,
   repairedSearchCall,
   selectAgentHistory
-} from "./index-7hz88dy8.js";
+} from "./index-vk3kq9sb.js";
 import"./index-p13mwz16.js";
 import {
   AgentAdmissionEventSchema,
@@ -162,7 +162,7 @@ import {
 import {
   buildToolManifest,
   mountAgent
-} from "./index-pena034b.js";
+} from "./index-e42wzzz5.js";
 import {
   DURABILITY_STEP_EVENT_KIND,
   ParkAbortedError,
@@ -172,10 +172,10 @@ import {
   StepResultNotSerializableError,
   createLocalStepDurability
 } from "./index-kw9t5ayn.js";
-import"./index-a2nzz56k.js";
-import"./index-4x809vqd.js";
-import"./index-s3dssqxp.js";
-import"./index-vsbzgd7b.js";
+import"./index-2c2bjw3s.js";
+import"./index-mzvgxp0n.js";
+import"./index-yn8remb1.js";
+import"./index-tmwcrptx.js";
 import"./index-f9mb610r.js";
 import"./index-e0znv5gn.js";
 import"./index-0a349c33.js";
@@ -188,8 +188,8 @@ import {
 import"./index-7zbps32p.js";
 import {
   defineRuntimeTool
-} from "./index-8z9we758.js";
-import"./index-fenaekmk.js";
+} from "./index-vjpvjqpn.js";
+import"./index-h9etkkyk.js";
 import"./index-cby4ar3v.js";
 import"./index-2vtcmrj9.js";
 import"./index-kzfs85xp.js";

package/dist/cli.d.ts

@@ -16,15 +16,18 @@
  *
  * and point your app's `package.json` `bin` at it.
  */
-export { type CliConfig, type CliSurfaceSource, createCli } from './tools/cli.js';
+export { type CliConfig, type CliInvocationResult, type CliInvoker, type CliInvokerCommand, type CliInvokerConfig, type CliSurfaceSource, cliInvocationResult, createCli, createCliInvoker, } from './tools/cli.js';
 export { CliArgumentError, type CliArgvRoute, type CliGlobalOptionsParse, type CliResultView, type CliRunOptions, extractCliGlobalOptions, type ParsedCliArgs, parseCliArgs, routeCliArgv, } from './tools/cli-args.js';
+export { type CliCheckpoint, type CliCheckpointEntry, readCliCheckpoint, writeCliCheckpoint, } from './tools/cli-checkpoint.js';
 export { type CliCommandContext, type CliCommandDefinition, type CliCommandDefinitionBase, type CliCommandDefinitionWithOutput, type CliCommandDefinitionWithoutOutput, defineCliCommand, } from './tools/cli-command.js';
-export { type CliWriters, DEFAULT_EXIT_CODES, type EmitOptions, type ExitCodeMap, emitResult, } from './tools/cli-format.js';
+export { type CliWriters, cliExitCode, DEFAULT_EXIT_CODES, type EmitOptions, type ExitCodeMap, emitResult, } from './tools/cli-format.js';
 export { type CliInstallerConfig, renderCliInstaller, } from './tools/cli-installer.js';
 export { assertCliPublishable, type CliBuildAsset, CliBuildAssetSchema, type CliBuildManifest, CliBuildManifestSchema, type CliBuildStamp, CliBuildStampSchema, type CliBuildTarget, CliBuildTargetSchema, currentCliBuildTarget, formatCliBuildStamp, selectCliBuildAsset, } from './tools/cli-manifest.js';
 export type { CliPresentationPolicyConfig } from './tools/cli-policy.js';
 export { CliProfileError, type CliProfileStore, type CliProfileStoreConfig, createCliProfileStore, type ResolvedCliProfile, } from './tools/cli-profile.js';
-export { type AppliedCliUpdate, applyCliUpdate, type CliUpdateApplyConfig, type CliUpdateCheck, type CliUpdateCheckConfig, checkCliUpdate, compareCliVersions, } from './tools/cli-update.js';
+export { type CliBuildSignature, CliBuildSignatureSchema, type CliSignatureVerdict, type CliSigningKey, type CliTrustRoot, cliManifestSigningPayload, cliSignatureAccepted, signCliManifest, verifyCliManifest, } from './tools/cli-signature.js';
+export { type CliBatchCommandConfig, type CliStreamAnswer, type CliStreamCommandConfig, type CliStreamHooks, defineCliBatchCommand, defineCliStreamCommand, runCliStream, } from './tools/cli-stream.js';
+export { type AppliedCliUpdate, applyCliUpdate, type CliRollbackConfig, type CliUpdateApplyConfig, type CliUpdateCheck, type CliUpdateCheckConfig, checkCliUpdate, compareCliVersions, type RolledBackCliUpdate, rollbackCliUpdate, } from './tools/cli-update.js';
 export { type CliViewOutput, renderCliView } from './tools/cli-view.js';
 export { type CliWaitConfig, type PollParams, pollUntilDone } from './tools/cli-wait.js';
 /**

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,uBAAuB,EACvB,KAAK,aAAa,EAClB,YAAY,EACZ,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,UAAU,EACf,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,kBAAkB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,gBAAgB,EACrB,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,cAAc,EACd,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtF;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EACL,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,SAAS,EACT,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,uBAAuB,EACvB,KAAK,aAAa,EAClB,YAAY,EACZ,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,kBAAkB,EAClB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,kBAAkB,EACvB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,cAAc,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,gBAAgB,EACrB,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,cAAc,EACd,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtF;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC"}