zidane 7.0.31 → 7.1.1

package/README.md

@@ -82,7 +82,7 @@ createAgent({
     mediaKeepTurns: undefined,       // age old image/document base64 off the wire; chat profiles use 8
     autoCompact: false,              // loop-native LLM summary at N% of the window; chat profiles enable it
     toolDisclosure: 'eager',         // 'eager' | 'lazy' (hide MCP schemas behind tool_search)
-    toolSearch: { tool: true, limit: 20 },
+    toolSearch: { tool: true, limit: 20, mode: 'unlock' }, // 'dispatch' = stable tool list via call_tool
   },
   execution: createProcessContext(),
   mcpServers: [],
@@ -669,7 +669,7 @@ const agent = createAgent({
 
 System prompt gains `<searchable_tools>` with `name + description` per lazy tool. `tool_search` accepts `query` (substring), `names`, `server`, `limit` — matches unlock for the rest of the run. A `tool:gate` middleware refuses dispatch on un-surfaced lazy tools (covers custom/mock providers; production providers also refuse server-side). Catalog + search results show the **wire** name; the unlock set keys on canonical so dispatch and `session.turns` stay alias-stable.
 
-Cost: one cache miss per discovery wave (the tool list grows); subsequent turns hit cache. Opt out via `behavior.toolSearch.tool: false` (catalog still emits, call-to-action drops). A pre-existing host tool named `tool_search` shadows the auto-injection.
+Cost in the default `toolSearch.mode: 'unlock'`: one **full** prompt-cache rewrite per discovery wave. Providers hash `tools → system → messages`, so growing the tool list (even at the tail) re-bills the system prompt and every message. `toolSearch.mode: 'dispatch'` removes that: surfaced tools are never added to the tool list. A fixed native `call_tool { name, arguments }` is added to the eager set instead, `tool_search` still returns the schema into the transcript, and the loop unwraps the envelope before dispatch, so gating, argument validation against the inner tool's schema, hooks, telemetry and transcript events all see the inner tool exactly as a direct call (the persisted assistant turn keeps the wire-valid envelope). Only lazy catalog tools ride the envelope; eager tools are always called directly. In the chat hosts this is `Settings.stableToolList`. Opt out of discovery via `behavior.toolSearch.tool: false` (catalog still emits, call-to-action drops). A pre-existing host tool named `tool_search` shadows the auto-injection; a pre-existing `call_tool` disables dispatch mode.
 
 ## Skills
 
@@ -739,6 +739,25 @@ createDockerContext({ image: 'node:22', cwd: '/workspace', limits: { memory: 512
 createSandboxContext(myProvider)  // implement SandboxProvider
 ```
 
+### OS sandbox for the process context
+
+The in-process context can wrap the model's shell commands in the OS sandbox
+(macOS Seatbelt via `sandbox-exec`, Linux bubblewrap) — the same boundary
+Claude Code and Codex use. Writes are confined to `cwd`, temp dirs, a
+worktree's git dir and any extra roots; `~/.ssh`, `~/.aws`, credential files
+are unreadable; network is allow-all or deny-all. `write_file` / `edit` honor
+the same roots in-process. Fails closed when the backend is missing.
+
+```ts
+import { createProcessContext, resolveWritableRoots } from 'zidane'
+
+createProcessContext({ cwd, isolation: { writableRoots: resolveWritableRoots(cwd), network: 'allow' } })
+```
+
+In the TUI / GUI: Settings → Agent → **Sandbox shell commands** (+ **Sandbox
+network**, **Sandbox writable paths**). See `docs/EXECUTION_CONTEXT.md` for
+scope and limits.
+
 ### E2B
 
 A ready-made `SandboxProvider` backed by [E2B](https://e2b.dev) ships behind its

package/dist/{acp-m3TLCY_C.js → acp-B5UfEhMd.js}

@@ -1,9 +1,9 @@
 import { P as defaultPromptMessage } from "./openai-compat-Dy56weK8.js";
 import { u as toolResultToText } from "./types-CWgENVLY.js";
-import { cr as resolveReadStateMap, ir as hashContent, sr as readStateKey, t as createAgent, xt as basic_default } from "./agent-9gf8ZlBR.js";
-import { r as createProcessContext } from "./contexts-BSFQVclW.js";
+import { Ct as basic_default, lr as readStateKey, or as hashContent, t as createAgent, ur as resolveReadStateMap } from "./agent-_xxElOgH.js";
+import { r as createProcessContext } from "./contexts-CRE9pw07.js";
 import { u as errorMessage } from "./errors-DKiMrOKq.js";
-import { o as loadSession, t as createSession } from "./session-CVy-2mAy.js";
+import { o as loadSession, t as createSession } from "./session-BqRP1hS7.js";
 import { t as effectiveInputFromTurn } from "./stats-DAKBEKjc.js";
 import { a as successResponse, i as errorResponse, r as createJsonRpcConnection } from "./json-rpc-rSWMUh9b.js";
 import { r as fetchUrl } from "./fetch-url-ma-5_p0p.js";
@@ -1764,4 +1764,4 @@ function runAcpStdioServer(options) {
 //#endregion
 export { wrapToolsForAcpClient as a, sessionBlocksToAcp as c, StartUsageError as d, buildStartLocalOptions as f, startProviderNames as h, withAcpDefaultTools as i, stopReasonFromRun as l, startLocalArgOptions as m, AcpProtocolError as n, acpMcpServersToZidane as o, parseStartArgValues as p, createAcpServer as r, acpPromptToPromptParts as s, runAcpStdioServer as t, toolResultToAcpContent as u };
 
-//# sourceMappingURL=acp-m3TLCY_C.js.map
+//# sourceMappingURL=acp-B5UfEhMd.js.map