Every release, cut in the open.

Minor Changes

• —

  d7c683e: Add lazy provider registration: ProviderRegistry.registerLazy(type, loader, options?) plus async construction via ProviderRegistry.createAsync() / createProviderAsync().

  Hosts that must not bundle every provider client into every entrypoint can now register a dynamic-import loader instead of an eagerly imported class — no more hand-rolled construction switches outside the registry. Registration never invokes the loader; the first createAsync() awaits it, validates the resolved { create } module, and caches the factory. Concurrent first-creates share a single in-flight load, and only success is cached: a rejected load surfaces as the new LazyProviderLoadError (original failure on cause) and the next create retries.

  Capabilities integrate with capability negotiation: an optional options.capabilities hint lets getCapabilities(type) answer before the provider is loaded (no hint ⇒ permissive default), the loaded module's declared capabilities replace the hint, and the constructed instance's own LLMProvider.capabilities remain what the query runtime negotiates against.

  Lazy types are deliberately not constructible through the sync create() / createProvider() — those throw the new LazyProviderSyncCreateError deterministically so sync behavior never depends on load timing. Existing eager register() / create() behavior is unchanged.

Minor Changes

• —

  cc6b5f3: Pluggable checkpoint persistence with cadence and growth controls.

  Iteration checkpoints now flow through a new CheckpointStore interface (types/run/checkpoint-store.ts) keyed by the full run scope (tenantId/projectId/sessionId/runId) instead of a filesystem path, so hosts can persist mid-turn resume state in a shared backend (e.g. Postgres) that survives machine loss:

  • —QueryParams.checkpointStore? injects a store per run (mirrors the existing pathBuilder? override); the disk layout under the run's output directory remains the default via the new exported DiskCheckpointStore conformance adapter over RunDiskStore.
  • —RunPersistenceConfig.checkpointStore? + RunPersistence.getCheckpointStore()/getRunScope() expose the same seam to embedded callers.
  • —The replay entry points (listCheckpoints, prepareReplayState) accept an optional checkpointStore + scope pair; their disk-addressed baseDir inputs are unchanged.
  • —CheckpointManager now takes (store: CheckpointStore, scope: CheckpointRunScope) — a breaking constructor change for direct constructions; the query pipeline threads it automatically.

  Growth control on the run config, byte-identical by default:

  • —AgentRunConfig.checkpointEvery? (default 1 = every tool-call iteration, today's behavior) checkpoints iterations 1, 1+N, 1+2N, … and skips the HITL iteration_checkpoint park on off-cadence iterations.
  • —AgentRunConfig.pruneKeepLast? (default undefined = never prune) prunes the run's checkpoint set down to the newest N after each iteration-checkpoint create.
• —

  f1f000c: Provider capability negotiation — degradation is now loud, not silent.

  LLMProvider gains an optional readonly capabilities?: ProviderCapabilities (with a new supportsVision? flag on the type) declaring what the DRIVER actually does with a request. Providers that declare nothing resolve to the exported PERMISSIVE_PROVIDER_CAPABILITIES constant (assume everything works — exactly the previous behavior), so third-party providers are unaffected. resolveProviderCapabilities(provider) performs the per-field permissive merge.

  query() consults the resolved capabilities before tooling bootstrap:

  • —Tools registered against a supportsTools: false driver → a loud log.warn, a new capability_warning run event, and every tool surface stripped (no <available_tools> prompt section, no tools request param) so the model is never told about tools it cannot call.
  • —Image attachments on user messages against a supportsVision: false driver → log.warn + a capability_warning run event so the host can surface that the images never reach the model.
  • —New QueryParams.strictCapabilities?: boolean (default false) throws on either mismatch instead of degrading.

  RunEvent gains the additive capability_warning variant (capability: 'tools' | 'vision', providerId, message); the SSE/A2A bridges intentionally do not map it to a wire event yet.

Patch Changes

• —

  30c755d: Remove the dead task-notification busy-wait that could hang a run for minutes.

  When the model ended its turn while the task gateway still listed a running agent task, the iteration loop polled an internal pendingNotifications queue every 250ms for up to runConfig.timeoutMs (120s default) — but nothing has pushed onto that queue since the onTaskCompleted listener was removed: every dispatch tool (create_task, continue_task, Agent) is blocking and already returns the worker's output as the dispatching tool_use's canonical tool_result. The wait always injected nothing, then re-invoked the model with an unchanged conversation, so runs with an orphaned task (an interrupted tool execution, a cancel race) sporadically stalled for multiples of the timeout before finishing with the answer they already had.

  The superseded <task-notification> envelope path is now fully torn out (waitAndInjectNotifications, injectOneTaskNotification, the pendingNotifications queue and its XML/CDATA helpers). End-of-turn semantics with orphan running tasks are explicit: the run ends normally (end_turn) and a warning is logged that the orphans have no delivery path. Runs without orphan tasks are byte-identical.

Minor Changes

• —

  ac85934: Add a model-authored ask_user_question HITL surface to the coordinator toolset. HITLDecisionRequest gains a user_question variant carrying UserQuestionData (questionId = the asking tool_use_id, question text, optional header, 2-4 model-authored options, multiSelect, allowFreeText), and HITLResumeDecision gains answer_question (selectedOptionIds, optional freeText, optional questionId echo as a misdirection guard). The tool registers only when buildCoordinatorTools receives BOTH a resumeHandler and a runId (SupervisorAgent threads its configured resumeHandler through automatically), parks the run through the same ResumeHandler channel as plan approvals, and returns the user's answer verbatim as the tool result — selections quote question and labels, free text is rendered "in their own words", and an empty/misdirected/ mismatched answer yields an explicit "the user did not answer" sentinel instead of fabricated consent. The tool is deliberately NOT concurrency-safe so multiple questions in one assistant turn park strictly one at a time against host run-keyed park registries. Headless callers degrade safely: autoApproveHandler answers user_question with the no-selection sentinel ("No user is available to answer. Proceed using your best judgment."), so runs without an interactive ResumeHandler never deadlock and never invent a choice. Existing ResumeHandler implementations compile unchanged (additive union widening); bare plan-approval and tool-review flows are byte-identical.

• —

  9df35d1: Make a Stop abort the IN-FLIGHT model turn, not only between turns.

  ChatCompletionParams gains an optional signal?: AbortSignal. The query runtime threads the run's abort signal into every provider call (the streaming turn and the forced-final summary) and now drives the provider stream through a MANUAL iterator that RACES each next() against the abort — so a cancellation tears the turn down within a tick even if a transport buffers or ignores the signal, with the abort propagating out of the generator so the run settles as cancelled. The stream consumer cleans up on every exit (removes the abort listener, calls iterator.return()), and the natural-completion break re-checks the signal so a Stop that lands exactly as the turn finishes is recorded as cancelled rather than a normal end-of-turn.

  Every provider now honours the signal at the transport: Anthropic (messages.create({ signal })), OpenAI (create(..., { signal })), Bedrock (send(..., { abortSignal })), OpenRouter + HTTP (compose with the request timeout via AbortSignal.any), Ollama (the returned iterator's .abort()), and LM Studio (respond(..., { signal }) → the SDK's websocket cancel) — each plus a cheap per-chunk signal.throwIfAborted() for promptness.

  Fully additive and inert when unset: a never-aborted signal is behaviourally identical to omitting it, so existing callers and uncancelled runs are byte-identical.

• —

  6c09394: Add an optional feedback channel to plan approvals: HITLResumeDecision's approve_plan variant now carries feedback?: string, the plan-approval resume handler forwards it as PlanApprovalResponse.feedback, and the coordinator approve_plan tool embeds approve-with-edits feedback in the model-visible tool result so the supervisor applies the user's edits atomically with the approval. Bare approvals are byte-identical to before; existing resume handlers compile and behave unchanged.

• —

  8c07556: Tool-loading economics: honor prompt caching in the Anthropic provider and make deferred-tool discovery ranked and bounded.

  @namzu/anthropic:

  • —cacheControl on ChatCompletionParams is now honored (it was silently dropped; cache_read_input_tokens was always 0). The provider emits up to three cache_control: {type:'ephemeral'} breakpoints per request: the tools-array tail, the last 'cache'-tagged system block, and the last message block (render order tools → system → messages).
  • —System messages are sent as a block array preserving SystemMessage.cacheHint segment boundaries instead of being joined into one string. The OAuth Claude Code identity block stays first.
  • —toolChoice: 'none' now maps to Anthropic's first-class tool_choice: {type:'none'} instead of {type:'auto'}, and tool_choice is only sent alongside a tools param.
  • —parallelToolCalls: false now maps to disable_parallel_tool_use: true on the tool_choice (previously unmapped).

  @namzu/sdk:

  • —The runtime keeps the tools param byte-stable on forced-final iterations (resource-limit finalization) and forbids tool use via toolChoice: 'none' instead of omitting tools — omitting busted the whole prompt-cache prefix and risked a 400 with tool_use/tool_result blocks in history.
  • —ToolRegistry.toPromptSection() lists active tools name-only (their descriptions and schemas already ride the runtime tools param every request) and gives deferred tools a first-sentence hint (≤100 chars) so the model can discover what a deferred name does before searching.
  • —ToolRegistry.searchDeferred() is now a ranked weighted search (exact name 12, name substring 8, description 5, argument names 3 — the ToolCatalog.searchTools weights) with generic CRUD verbs (list, read, create, update, get, find, delete, search) added to the stop-token set. search_tools activates only the top-5 ranked matches and reports up to 5 near-misses as name+hint WITHOUT activating them, so a retrieval miss becomes a cheap re-query instead of a dead end. The search_tools input wire shape ({query}) is unchanged.

Patch Changes

• —

  999e4be: Context-management correctness fixes (Vandal round-3 architecture audit).

  • —Compaction no longer orphans tool pairs. runCompactionCheck now snaps the recent-window boundary through findSafeTrimIndex (previously wired only to the unused ConversationManager strategy classes), so a compaction cut can never leave a tool_result at the head of the recent window whose tool_use was summarized away. That orphan otherwise makes the provider reject the very next turn with a 400 — compaction killing the long run it exists to keep alive.
  • —Resume preserves the compaction summary + working-memory slot. The checkpoint-restore path used to drop EVERY system message, silently losing the [COMPACTED CONTEXT] block (the only record of the older history a pass deleted) on resumeFromCheckpoint. It now re-pushes the fresh static/dynamic floor but preserves the compaction summary and the pinned working-memory slot.
  • —Within-turn usage is merged, not last-write-wins. mergeTokenUsage (per-field high-water mark) replaces usage = chunk.usage in collect() and the iteration stream reducer, so a late usage frame that omits input/cache tokens no longer zeroes the counts captured earlier in the stream.
  • —HITL parks are cancellable. awaitDecisionOrAbort races the tool-review and iteration-checkpoint resumeHandler parks against the run's abort signal, so a Stop that arrives while parked resolves the park as abort instead of hanging until the host answers. Degrades to a plain await when no controller is wired; fails closed to abort if the handler rejects.

  All changes are internal correctness fixes; the provider/message wire contract is unchanged and existing consumers stay behaviourally identical outside the buggy edge cases above.

• —

  42f577e: Recreate shared run workspace manifest directories before atomic writes.

• —

  9a0c5ee: Plan-rejection guidance now follows the user's feedback instead of baking in an unconditional revise loop. The old output told the supervisor to "revise your plan ... and call approve_plan again" even when the feedback explicitly asked it to stop, so a rejection meant to halt kept generating new plans. The output now instructs: follow the feedback — revise and re-submit only if changes were requested; acknowledge and end the turn if asked to stop; ask the user how to proceed when no feedback was given.

• —

  0d1fb7b: Harden file intake and ACI readiness failure handling.

  The built-in read tool now guides Office and PDF packages through extractor tooling instead of treating binary document containers as UTF-8 text. The ACI Standby Pool backend now deletes a claimed container group when IP or worker readiness polling fails before a Sandbox handle is returned.

• —

  2c5dd7a: The supervisor's task ledger no longer fabricates success for workers that produced no result. Previously, when a task handle had no result, the synthesized entry took its status from handle.state (cast to a terminal type) — so a handle reporting state: 'completed' but carrying no result was counted toward completedTasks. The supervisor then reported "workers done" with empty outputs when the workers never actually produced anything.

  An absent result is now always synthesized as a terminal 'failed', so it can never count as a completed task. Handles that carry a real result are preserved verbatim, so genuine workers are unaffected. The synthesis and tally are extracted into synthesizeTaskResults / countCompletedTasks and covered by unit tests.

• —

  271e6cf: Accept plain-text approve_plan step lists and normalize them into canonical step objects before execution. This keeps plan approval cards resilient when a provider emits numbered prose instead of an array-shaped argument.

• —

  b776acf: Make the package-version read bundle-safe. version.ts read ../package.json via createRequire(import.meta.url) at module-init with no guard. esbuild leaves createRequire calls as runtime requires and collapses the dist tree into a single file, so in a bundle ../package.json no longer resolves and the read threw at import time — crashing the whole process on any code path that touches the SDK runtime (Cannot find module '../package.json'). Wrap the read in try/catch with a 0.0.0 fallback, mirroring the CLI's existing readPackageVersion. Unbundled behaviour is unchanged (real version is read); a bundled build degrades the cosmetic version string instead of crashing.

Minor Changes

• —

  1df23b1: SupervisorAgentConfig accepts resumeHandler and verificationGate.

  The supervisor's existing tool-review pipeline (drainQuery's runToolReview phase) was reachable only by callers that constructed drainQuery arguments by hand — SupervisorAgent.run ignored them entirely and always fell back to autoApproveHandler. Hosts that wanted "Ask before acting" semantics had no way to plug in.

  SupervisorAgent.run now forwards both fields verbatim to drainQuery when the caller supplies them. Behaviour is unchanged for callers that omit them — the SDK still defaults to auto-approve.

  Migration:

  new SupervisorAgent({...}).run(input, {
    ...config,
    // surface tool_review_requested events to the user; resolve when
    // they approve / modify / reject.
    resumeHandler: async ({ runId, toolCalls, ... }) => {
      return await waitForUserDecision(runId, toolCalls)
    },
    // optionally pre-classify tools so trivial reads bypass review.
    verificationGate: { enabled: true, rules: [...] },
  })
  

Patch Changes

• —

  ffe516c: Probe layer (typed observation + narrow veto) over AgentBus + RunEvent stream — ses_007 phases 0–3.

  Public surface additions:

  • —Typed probe observation. probe.on(kind | kind[], handler, opts?) registers a typed handler scoped to one or more event kinds. probe.onAny(handler, opts?) is the catch-all tier preserving legacy AgentBus.on semantics. Options: { where, priority, name, override }. Events are frozen at the registry boundary; throws are isolated per probe.
  • —Narrow veto on tool execution. probe.veto('tool_executing', handler, opts?) registers a veto handler. Handler returns 'allow' | 'deny' | { action: 'deny', reason }. VetoableEventKind = 'tool_executing' in v1 (additive minor adds more kinds later). First-deny wins by ascending priority; subsequent veto handlers still fire for audit. Tool executor short-circuits before tools.execute(...) on deny: returns a synthetic tool failure carrying ProbeVetoError.message so the LLM sees a normal tool-call failure with the probe name + reason.
  • —5 new bus event variants. provider_call_start, provider_call_completed, provider_call_failed, vault_lookup, sandbox_decision. Joined to the existing AgentBusEvent discriminated union. Snake_case real discriminants — no rename pass on existing events.
  • —Opt-in instrumentation wrappers. wrapProviderWithProbes(provider, opts?) returns an LLMProvider that emits provider_call_* around every chat/chatStream call (correlated by a pcall_${string} callId, with optional usage telemetry). wrapVaultWithProbes(vault, opts?) emits vault_lookup on every retrieve(); the secret value is never included in the event payload (covered by a "no leakage" test).
  • —First-time public exposure of bus event types. AgentBusEvent, AgentBusEventListener, CircuitBreakerSnapshot, FileLock, etc. were already reachable via AgentBus.on(listener) at runtime but couldn't be statically typed by consumers. Now in public-types.ts. Pre-existing duplicate LockId declaration in types/bus/ was deduplicated to a re-export from types/ids/ in passing.
  • —Replay-aware probe context. ProbeContext.isReplay: boolean flag wired through buildProbeContext({ runId?, isReplay? }) so probes that bill or call external services can opt out on replayed runs (ctx.isReplay === true). Replay-execution wiring lands in a future session; the accessor is ready.

  Integration:

  • —AgentBus.emit dispatches through ProbeRegistry first (typed-priority probes → legacy bus.on listeners → onAny catch-all). Existing bus.on(listener) consumers see every event in unchanged relative order.
  • —EventTranslator.emitEvent dispatches every RunEvent through the same registry before the existing pendingEvents push + persist flow.
  • —ToolExecutor.executeSingle calls probes.queryVeto({type: 'tool_executing', ...}) immediately after the existing tool_executing emit, before tools.execute(...).

  Not yet wired (follow-up commits):

  • —Per-run probes via createRun({ probes: [...] }) — the registry has the foundation; createRun plumbing lands in a follow-up.
  • —wrapProviderWithProbes / wrapVaultWithProbes are opt-in helpers; the SDK's own ProviderRegistry does not auto-wrap registered providers yet.
  • —sandbox_decision ships as a type only; emit site lands when a real sandbox provider exists (current LocalSandboxProvider is a stub).

  Public surface delta: 380 → 392 runtime keys (verified against the regenerated baseline). Net new symbols added by this changeset:

  • —probe, ProbeRegistry, createProbeRegistry, buildProbeContext, ProbeNameCollisionError, ProbeVetoError
  • —wrapProviderWithProbes, wrapVaultWithProbes

  Non-runtime (types-only) additions: ProbeEventKind, ProbeEventOf<K>, ProbeContext, ProbeHandler<K>, ProbeOptions<K>, Unsubscribe, VetoableEventKind, VetoDecision, VetoHandler<K>, VetoOutcome, DoctorStatus, DoctorCategory, DoctorCheck, DoctorCheckContext, DoctorCheckResult, DoctorCheckRecord, DoctorReport, ProviderCallId, ProviderCallUsage, SandboxDecisionAction, plus first-time exposure of all AgentBusEvent shape types.

  Doctor types ship in this release; the runtime registry + CLI command land in a subsequent ses_007 patch.

Patch Changes

• —

  ddd0aad: Test-side hardening from ses_006 pre-freeze fix.

  • —New test: runtime/query/iteration/phases/advisory.test.ts — pins the advisory-phase mutation boundary where fired advisories inject user messages via runMgr.pushMessage(createUserMessage(...)). 13 assertions covering early-return paths, happy-path exactly-once calls, envelope format, warnings + decisions rendering, and trigger-selection semantics. Before this test a regression removing the pushMessage call at advisory.ts:154 would pass typecheck, lint, the coverage gate, and every existing src/advisory/* test. It now fails deterministically.
  • —LogLevel gains 'silent' — purely additive; the value short-circuits every log() call. Used by the SDK's vitest setup to suppress unmocked getRootLogger() stderr writes so GitHub Actions stops annotating [ERROR]-level log lines as workflow errors. Consumer impact: zero unless you pass 'silent' to configureLogger() yourself.
  • —No runtime behavior change. No public surface additions beyond the one LogLevel union member.

Patch Changes

• —

  14ff062: Public-surface barrel split (ses_011-sdk-public-surface).

  Note on bump level. Originally classified as minor when ses_011 froze on 2026-04-21. Downgraded to patch post-freeze (2026-04-21) as part of a repo-wide release-cadence policy decision: the pre-1.0 SDK reserves minor/major for feature-delta releases, and internal refactors that keep the public-surface baseline intact ride patch. This changeset explicitly preserved all 380 pre-existing public names (verified by .github/scripts/verify-public-surface.mjs), so patch is semver-accurate at the name-set level. See .changeset/sdk-replay-primitive.md for the same-day rationale block.

  packages/sdk/src/index.ts splits from 357 lines of mixed re-exports into three focused bucket files, consumed through a thin 10-line root barrel:

  • —public-types.ts — every type a consumer type-checks against (branded IDs, wire shapes, domain entities, store contracts, event unions, config types).
  • —public-runtime.ts — every runtime value (classes, functions, constants, zod schemas, error classes, ID generators).
  • —public-tools.ts — agent-tool surface (defineTool primitive, built-in tools, domain builders, connector tool bridge, createRAGTool).

  No consumer-visible change. All 380 previously-exported names continue to be exported; none removed, none added. Verified by a baseline snapshot (.github/scripts/public-surface-baseline.json — captured at the tip of ses_010) plus a CI smoke test (.github/scripts/verify-public-surface.mjs) that loads @namzu/sdk at runtime and compares Object.keys() against the baseline.

  Additional cleanup:

  • —The ProjectId / RunId / MessageId / SessionId double-channel (reachable through both contracts/ and types/ids/) is closed. IDs come from types/ids/ uniformly; contracts/ids.ts is deleted; contracts/api.ts imports IDs from ../types/ids/ directly.
  • —The RunStatus carve-out is folded. Since ses_010 renamed the wire-side alias to WireRunStatus, the domain RunStatus can flow through types/run/index.ts with a plain export * — no explicit carve-out needed.
• —

  2eccadd: Replay primitive v1 — fork an existing run from any stored checkpoint with optional mutation at the fork point (ses_005-deterministic-replay).

  Note on bump level. This release adds new public exports (prepareReplayState, listCheckpoints, projectEmergencyToCheckpoint, MutationNotApplicableError, the Mutation / CheckpointListEntry / ReplayAttribution types, Run.replayOf?). In strict semver these would be a minor bump. Classified as patch here because the SDK is pre-1.0 and the project reserves minor/major for larger feature deltas — 0.5.0 should land with a more complete replay surface (5b end-to-end wrapper, reproduce mode, or similar) rather than just this state-preparation half. Decision logged 2026-04-21 post-freeze of ses_005.

  New public runtime values:

  • —prepareReplayState({ baseDir, runId, fromCheckpoint, mutate?, emergencyDir? }) — pure-read helper that resolves fromCheckpoint (CheckpointId | 'latest' | 'emergency'), applies mutations, and returns { messages, sourceCheckpoint, attribution } ready to thread into a query(...) call.
  • —listCheckpoints({ baseDir, runId }) — lists a run's checkpoints as lightweight CheckpointListEntry projections.
  • —projectEmergencyToCheckpoint(dump) — project an EmergencySaveData snapshot to an IterationCheckpoint shape with deterministic cp_emergency_* id.
  • —MutationNotApplicableError — thrown by prepareReplayState when a mutation targets a tool call that is not pending at the fork point; carries availableToolCallIds for recovery.

  New public types:

  • —Mutation — discriminated union; single injectToolResponse variant in v1.
  • —CheckpointListEntry — listing projection distinct from the pre-existing HITL CheckpointSummary.
  • —ReplayAttribution — { sourceRunId, fromCheckpointId, mutations, replayedAt } record.
  • —Run.replayOf?: ReplayAttribution — optional attribution field; undefined on original runs.

  Scope and non-scope — v1 ships forked execution from a captured checkpoint, not byte-for-byte reproduction. Past the fork point, provider calls and tool calls execute live. Deterministic reproduce mode is deferred to a follow-up session.

  A single-call replay({ runId, opts }) wrapper is intentionally not shipped in v1. Composing listCheckpoints → prepareReplayState → caller-owned query() is the v1 flow; the wrapper requires a ReplayEnvironment design (provider, tools, resume handler, session scope) that lands in a follow-up session.

  See docs/sdk/runtime/replay.md for the full primitive docs, determinism envelope, and non-scope.

• —

  9efae03: Type layering rationalised (ses_010-sdk-type-layering).

  Note on bump level. Originally classified as minor when ses_010 froze on 2026-04-21. Downgraded to patch post-freeze (2026-04-21) as part of a repo-wide release-cadence policy decision: the pre-1.0 SDK reserves minor/major for feature-delta releases, and internal refactors that keep the public-surface baseline intact ride patch. This changeset introduced no consumer-visible new names and renamed AgentRun → Run with a @deprecated alias, which the policy treats as a patch-level churn for 0.x. See .changeset/sdk-replay-primitive.md for the same-day rationale block.

  All pure shapes — entities, store contracts, wire types, events — now live under packages/sdk/src/types/. Feature folders (session/, manager/, store/, agent/, provider/) contain runtime code only.

  Public surface changes:

  • —AgentRun renamed to Run. AgentRun and AgentSession are kept as @deprecated type aliases for the 0.4.x compatibility window — existing code importing either continues to compile. New code should use Run.
  • —Wire-side Run interface renamed to WireRun, mirroring the existing WireRunStatus precedent. The root @namzu/sdk barrel now exports domain Run and wire WireRun with no collision.
  • —Internal folder packages/sdk/src/session/hierarchy/ removed. Only the @namzu/sdk root barrel (.) is a supported import surface; deep-imports were never supported and the old path no longer exists.

  No runtime behaviour change. Every entity previously exported (Project, Thread, Session, SubSession, ActorRef, Lineage, Tenant) continues to be exported from @namzu/sdk.

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2

Minor Changes

• —

  40eb841: Unblock BYO-provider use of AgentManager.spawn and capture the full 0.2.x → 0.3.0 window.

  Bug Fixes

  • —AgentManager.sendMessage no longer requires both configBuilder AND factoryOptions together. The configBuilder now runs whenever it is registered; factoryOptions defaults to {} when absent. This closes the silent crash path that consumers following README's "getting started" install hit with Bedrock (ERESOLVE → bare-config → ReactiveAgent null access).
  • —AgentFactoryOptions.apiKey is now optional. BYO-provider flows (Bedrock IAM, custom ProviderRegistry.create(...)) no longer need to fabricate a meaningless empty apiKey just to satisfy the type.

  Breaking Changes carried over from the 0.2.x → 0.3.0 window

  • —feat(sdk)!: propagate threadId through runtime + wire archive gate — childConfig now receives sessionId/threadId/projectId/tenantId automatically from the parent context (stamped by AgentManager after configBuilder returns). configBuilder implementations that previously emitted these fields manually are unaffected; implementations relying on the old 0.2.0 three-ID triple (sessionId/projectId/tenantId without threadId) will now see threadId populated on the child config.

  Other

  • —knip integrated as the dead-code detector (dev-only, no runtime surface change).
  • —ThreadManager.archive/delete primitives added to SessionStore; wire-side thread_id renamed during the Thread→Project wire refactor (internal rename).

  See commits since sdk-v0.2.0 for the full list; this changeset captures the visible-to-consumer summary.

All notable changes to Namzu are documented here.

Features

• —sdk: close Task 10 known deltas + expose session hierarchy (Phase 9) [BREAKING]
• —sdk: add retention + archival primitives with deleteSession close-out (Phase 8)
• —sdk: add migration utilities for 0.2.0 upgrade path (Phase 7)
• —sdk: refactor AgentManager to spawn SubSession triple with kernel summarization (Phase 6) [BREAKING]
• —sdk: add SessionSummaryMaterializer kernel terminalization primitive (Phase 5)
• —sdk: add handoff state machine with atomic broadcast rollback (Phase 4)
• —sdk: add SessionStore + PathBuilder + git-worktree workspace driver (Phase 3) [BREAKING]
• —sdk: add RunEvent schemaVersion + sub-session lifecycle events (Phase 2) [BREAKING]
• —sdk: introduce session hierarchy type foundation (Phase 1) [BREAKING]

Testing

• —sdk: add Task 10 integration test coverage matrix (Phase 10)

Documentation

• —changelog: update for sdk-v0.1.7
• —readme: rewrite root + fix sdk stale ProviderFactory refs

Documentation

• —changelog: add 0.1.6 (sdk) and 0.1.0 (computer-use) entries; fix cliff tag prefix + workflow race
• —changelog: update for sdk-v0.1.6-rc.1

Features

• —bedrock: extract BedrockProvider to @namzu/bedrock package (Phase I.3 pilot)
• —openrouter: extract OpenRouterProvider to @namzu/openrouter package (Phase I.4)

Refactor

• —sdk: address Codex review — scope providers/ subfolder, hide registry reset
• —sdk: replace ProviderFactory with ProviderRegistry for per-vendor extraction [BREAKING]

Stable release of @namzu/sdk 0.1.6 (promoted from 0.1.6-rc.1).

[sdk-v0.1.6-rc.1] — 2026-04-15

Documentation

• —changelog: update for v0.1.5

Features

• —sdk: add ComputerUseHost interface and computer_use tool

Miscellaneous

• —initialize namzu monorepo from sdk; add @namzu/computer-use capability package

[0.1.5] — 2026-04-15

Bug Fixes

• —emergency: uuid tmp suffix, outer try/catch, and explicit exit
• —store: resolve withLock race, delete deadlock, and atomic edge updates

Documentation

• —changelog: update for v0.1.5-rc.2

Refactor

• —barrels: route root barrel through sub-barrels (Path B)
• —connector: brand ConnectorId/TenantId on public interfaces [BREAKING]

Testing

• —store: add concurrency regression tests for DiskTaskStore

[0.1.5-rc.2] — 2026-04-14

Bug Fixes

• —plugin: wire MCP servers and fail fast on unsupported contributions
• —plugin: consume hook results and wire tool hooks in runtime
• —release: normalize pre-release counter to strip non-digit suffix

Documentation

• —changelog: update for v0.1.5-rc.1-fix
• —contracts: formalize wire/domain duality + refresh README
• —readme: rewrite code examples to match current SDK API

Refactor

• —plugin: remove duplicate PluginConfigSchema in types/
• —registry: migrate Agent/Connector/Tool registries to ManagedRegistry
• —run: remove legacy Session* aliases for run-centric classes

[0.1.5-rc.1] — 2026-04-12

Documentation

• —changelog: update for v0.1.4

Refactor

• —architectural cleanup and infrastructure improvements

[0.1.4] — 2026-04-11

Documentation

• —changelog: update for v0.1.4-rc.3

Features

• —sandbox isolation, new tools (edit/grep/ls), session-to-run migration

[0.1.4-rc.3] — 2026-04-10

Miscellaneous

• —release: derive version from git tag, no manual bump needed

[0.1.4-rc.2] — 2026-04-10

Bug Fixes

• —ci: remove duplicate --strip flag in git-cliff command
• —plugin: rename session hooks to run_start/run_end
• —release: use tag name as release title instead of prefixed name

Features

• —P3 + plugin architecture — emergency save, memory index, plugin system
• —P2 — AgentBus, prompt cache split, verification gate
• —integrate compaction loop and advisory phase into iteration pipeline

Miscellaneous

• —changelog: automate CHANGELOG.md via git-cliff in release workflow

[0.1.4-rc.1] — 2026-04-10

Bug Fixes

• —add description field to package.json, reorder README badges

Features

• —advisory: provider-agnostic advisory system with three-layer architecture
• —structured compaction, tool tiering, task router
• —output discipline, shell compression, pre-release workflow

Miscellaneous

• —remove BEFORE-RELEASE.md from repo

[0.1.3] — 2026-04-10

Bug Fixes

• —point entry fields to dist/ for bundler compatibility

Documentation

• —add npm, ci, license, typescript, node badges to README

[0.1.2] — 2026-04-10

Other

• —Namzu v0.1.1 — Wisdom, shared

Open-source AI agent framework by cogitave.

Let's build the agent layer together.

Refactor

• —constants centralization, strict lint, release automation

Patch Changes

• —

  f1f000c: Declare honest driver capabilities on each provider instance.

  Every shipped driver now exposes readonly capabilities (and re-exports its *_CAPABILITIES constant from the client module) describing what the DRIVER does — not what the vendor API could do — so the SDK's capability negotiation can warn instead of silently degrading:

  • —@namzu/ollama: supportsTools: false, supportsVision: false (the driver never sends tool schemas and drops image attachments).
  • —@namzu/lmstudio: supportsTools corrected true → false and supportsFunctionCalling true → false — the driver folds tool messages into user text and never sends tool schemas; supportsVision: false.
  • —@namzu/anthropic: full (supportsVision: true — image attachments already mapped).
  • —@namzu/bedrock, @namzu/openrouter, @namzu/http: tools pass through (supportsTools: true) but supportsVision: false until their message translation maps attachments.

Minor Changes

• —

  8c07556: Tool-loading economics: honor prompt caching in the Anthropic provider and make deferred-tool discovery ranked and bounded.

  @namzu/anthropic:

  • —cacheControl on ChatCompletionParams is now honored (it was silently dropped; cache_read_input_tokens was always 0). The provider emits up to three cache_control: {type:'ephemeral'} breakpoints per request: the tools-array tail, the last 'cache'-tagged system block, and the last message block (render order tools → system → messages).
  • —System messages are sent as a block array preserving SystemMessage.cacheHint segment boundaries instead of being joined into one string. The OAuth Claude Code identity block stays first.
  • —toolChoice: 'none' now maps to Anthropic's first-class tool_choice: {type:'none'} instead of {type:'auto'}, and tool_choice is only sent alongside a tools param.
  • —parallelToolCalls: false now maps to disable_parallel_tool_use: true on the tool_choice (previously unmapped).

  @namzu/sdk:

  • —The runtime keeps the tools param byte-stable on forced-final iterations (resource-limit finalization) and forbids tool use via toolChoice: 'none' instead of omitting tools — omitting busted the whole prompt-cache prefix and risked a 400 with tool_use/tool_result blocks in history.
  • —ToolRegistry.toPromptSection() lists active tools name-only (their descriptions and schemas already ride the runtime tools param every request) and gives deferred tools a first-sentence hint (≤100 chars) so the model can discover what a deferred name does before searching.
  • —ToolRegistry.searchDeferred() is now a ranked weighted search (exact name 12, name substring 8, description 5, argument names 3 — the ToolCatalog.searchTools weights) with generic CRUD verbs (list, read, create, update, get, find, delete, search) added to the stop-token set. search_tools activates only the top-5 ranked matches and reports up to 5 near-misses as name+hint WITHOUT activating them, so a retrieval miss becomes a cheap re-query instead of a dead end. The search_tools input wire shape ({query}) is unchanged.

Patch Changes

• —

  9df35d1: Make a Stop abort the IN-FLIGHT model turn, not only between turns.

  ChatCompletionParams gains an optional signal?: AbortSignal. The query runtime threads the run's abort signal into every provider call (the streaming turn and the forced-final summary) and now drives the provider stream through a MANUAL iterator that RACES each next() against the abort — so a cancellation tears the turn down within a tick even if a transport buffers or ignores the signal, with the abort propagating out of the generator so the run settles as cancelled. The stream consumer cleans up on every exit (removes the abort listener, calls iterator.return()), and the natural-completion break re-checks the signal so a Stop that lands exactly as the turn finishes is recorded as cancelled rather than a normal end-of-turn.

  Every provider now honours the signal at the transport: Anthropic (messages.create({ signal })), OpenAI (create(..., { signal })), Bedrock (send(..., { abortSignal })), OpenRouter + HTTP (compose with the request timeout via AbortSignal.any), Ollama (the returned iterator's .abort()), and LM Studio (respond(..., { signal }) → the SDK's websocket cancel) — each plus a cheap per-chunk signal.throwIfAborted() for promptness.

  Fully additive and inert when unset: a never-aborted signal is behaviourally identical to omitting it, so existing callers and uncancelled runs are byte-identical.

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2

Patch Changes

• —

  40eb841: Widen @namzu/sdk peer range to >=0.1.6 <1.0.0.

  The previous peer range ^1 || ^0.1.6 resolved to >=0.1.6 <0.2.0 || >=1.0.0, which excluded the published @namzu/sdk@0.2.0 and caused npm install @namzu/sdk @namzu/<provider> to fail with ERESOLVE on a clean machine. The new range covers every pre-1.0 SDK minor from 0.1.6 onward; the 1.0 pledge will be the next explicit widening.

  This is the first release under the new Changesets-driven workflow and the wide-pre-1.0-peer convention. Consumers who followed the README's "getting started" install were previously blocked; after this release npm install @namzu/sdk@latest @namzu/<provider>@latest resolves cleanly.

All notable changes to @namzu/anthropic are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Release of @namzu/anthropic v0.1.0

Patch Changes

• —

  f1f000c: Declare honest driver capabilities on each provider instance.

  Every shipped driver now exposes readonly capabilities (and re-exports its *_CAPABILITIES constant from the client module) describing what the DRIVER does — not what the vendor API could do — so the SDK's capability negotiation can warn instead of silently degrading:

  • —@namzu/ollama: supportsTools: false, supportsVision: false (the driver never sends tool schemas and drops image attachments).
  • —@namzu/lmstudio: supportsTools corrected true → false and supportsFunctionCalling true → false — the driver folds tool messages into user text and never sends tool schemas; supportsVision: false.
  • —@namzu/anthropic: full (supportsVision: true — image attachments already mapped).
  • —@namzu/bedrock, @namzu/openrouter, @namzu/http: tools pass through (supportsTools: true) but supportsVision: false until their message translation maps attachments.

Patch Changes

• —

  9df35d1: Make a Stop abort the IN-FLIGHT model turn, not only between turns.

  ChatCompletionParams gains an optional signal?: AbortSignal. The query runtime threads the run's abort signal into every provider call (the streaming turn and the forced-final summary) and now drives the provider stream through a MANUAL iterator that RACES each next() against the abort — so a cancellation tears the turn down within a tick even if a transport buffers or ignores the signal, with the abort propagating out of the generator so the run settles as cancelled. The stream consumer cleans up on every exit (removes the abort listener, calls iterator.return()), and the natural-completion break re-checks the signal so a Stop that lands exactly as the turn finishes is recorded as cancelled rather than a normal end-of-turn.

  Every provider now honours the signal at the transport: Anthropic (messages.create({ signal })), OpenAI (create(..., { signal })), Bedrock (send(..., { abortSignal })), OpenRouter + HTTP (compose with the request timeout via AbortSignal.any), Ollama (the returned iterator's .abort()), and LM Studio (respond(..., { signal }) → the SDK's websocket cancel) — each plus a cheap per-chunk signal.throwIfAborted() for promptness.

  Fully additive and inert when unset: a never-aborted signal is behaviourally identical to omitting it, so existing callers and uncancelled runs are byte-identical.

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2

Patch Changes

• —

  40eb841: Widen @namzu/sdk peer range to >=0.1.6 <1.0.0.

  The previous peer range ^1 || ^0.1.6 resolved to >=0.1.6 <0.2.0 || >=1.0.0, which excluded the published @namzu/sdk@0.2.0 and caused npm install @namzu/sdk @namzu/<provider> to fail with ERESOLVE on a clean machine. The new range covers every pre-1.0 SDK minor from 0.1.6 onward; the 1.0 pledge will be the next explicit widening.

  This is the first release under the new Changesets-driven workflow and the wide-pre-1.0-peer convention. Consumers who followed the README's "getting started" install were previously blocked; after this release npm install @namzu/sdk@latest @namzu/<provider>@latest resolves cleanly.

All notable changes to @namzu/bedrock are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Release of @namzu/bedrock v0.1.0

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2

Minor Changes

• —

  40eb841: Move @namzu/sdk from dependencies to peerDependencies.

  Previously, @namzu/computer-use@0.1.0 declared @namzu/sdk as a direct runtime dependency (workspace:^), which meant a consumer installing both packages would end up with two concurrent copies of @namzu/sdk in node_modules — the one they installed themselves and the one computer-use resolved. This produces symbol-identity bugs (two separate AgentManager classes, two separate RunEvent schemas, etc.) that surface as hard-to-diagnose "instanceof fails" at runtime.

  The correct shape, matching the 7 provider packages, is peer + dev:

  • —peerDependencies: @namzu/sdk: ">=0.1.6 <1.0.0" — consumer provides, resolved once.
  • —devDependencies: @namzu/sdk: workspace:^ — for local dev and type-checking.

  Consumer migration: if you previously relied on @namzu/computer-use pulling @namzu/sdk in transitively, install it explicitly:

  npm install @namzu/sdk @namzu/computer-use
  

  This is technically a breaking change (the transitive resolution no longer works), but pre-1.0 SDK context and the runtime-corruption risk of the old shape justify correcting it as a minor bump.

All notable changes to @namzu/computer-use are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Release of @namzu/computer-use v0.1.0

Release of @namzu/computer-use v0.0.2-rc.1

Patch Changes

• —

  f1f000c: Declare honest driver capabilities on each provider instance.

  Every shipped driver now exposes readonly capabilities (and re-exports its *_CAPABILITIES constant from the client module) describing what the DRIVER does — not what the vendor API could do — so the SDK's capability negotiation can warn instead of silently degrading:

  • —@namzu/ollama: supportsTools: false, supportsVision: false (the driver never sends tool schemas and drops image attachments).
  • —@namzu/lmstudio: supportsTools corrected true → false and supportsFunctionCalling true → false — the driver folds tool messages into user text and never sends tool schemas; supportsVision: false.
  • —@namzu/anthropic: full (supportsVision: true — image attachments already mapped).
  • —@namzu/bedrock, @namzu/openrouter, @namzu/http: tools pass through (supportsTools: true) but supportsVision: false until their message translation maps attachments.

Patch Changes

• —

  9df35d1: Make a Stop abort the IN-FLIGHT model turn, not only between turns.

  ChatCompletionParams gains an optional signal?: AbortSignal. The query runtime threads the run's abort signal into every provider call (the streaming turn and the forced-final summary) and now drives the provider stream through a MANUAL iterator that RACES each next() against the abort — so a cancellation tears the turn down within a tick even if a transport buffers or ignores the signal, with the abort propagating out of the generator so the run settles as cancelled. The stream consumer cleans up on every exit (removes the abort listener, calls iterator.return()), and the natural-completion break re-checks the signal so a Stop that lands exactly as the turn finishes is recorded as cancelled rather than a normal end-of-turn.

  Every provider now honours the signal at the transport: Anthropic (messages.create({ signal })), OpenAI (create(..., { signal })), Bedrock (send(..., { abortSignal })), OpenRouter + HTTP (compose with the request timeout via AbortSignal.any), Ollama (the returned iterator's .abort()), and LM Studio (respond(..., { signal }) → the SDK's websocket cancel) — each plus a cheap per-chunk signal.throwIfAborted() for promptness.

  Fully additive and inert when unset: a never-aborted signal is behaviourally identical to omitting it, so existing callers and uncancelled runs are byte-identical.

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2

Patch Changes

• —

  40eb841: Widen @namzu/sdk peer range to >=0.1.6 <1.0.0.

  The previous peer range ^1 || ^0.1.6 resolved to >=0.1.6 <0.2.0 || >=1.0.0, which excluded the published @namzu/sdk@0.2.0 and caused npm install @namzu/sdk @namzu/<provider> to fail with ERESOLVE on a clean machine. The new range covers every pre-1.0 SDK minor from 0.1.6 onward; the 1.0 pledge will be the next explicit widening.

  This is the first release under the new Changesets-driven workflow and the wide-pre-1.0-peer convention. Consumers who followed the README's "getting started" install were previously blocked; after this release npm install @namzu/sdk@latest @namzu/<provider>@latest resolves cleanly.

All notable changes to @namzu/http are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Release of @namzu/http v0.1.0

Patch Changes

• —

  f1f000c: Declare honest driver capabilities on each provider instance.

  Every shipped driver now exposes readonly capabilities (and re-exports its *_CAPABILITIES constant from the client module) describing what the DRIVER does — not what the vendor API could do — so the SDK's capability negotiation can warn instead of silently degrading:

  • —@namzu/ollama: supportsTools: false, supportsVision: false (the driver never sends tool schemas and drops image attachments).
  • —@namzu/lmstudio: supportsTools corrected true → false and supportsFunctionCalling true → false — the driver folds tool messages into user text and never sends tool schemas; supportsVision: false.
  • —@namzu/anthropic: full (supportsVision: true — image attachments already mapped).
  • —@namzu/bedrock, @namzu/openrouter, @namzu/http: tools pass through (supportsTools: true) but supportsVision: false until their message translation maps attachments.

Patch Changes

• —

  9df35d1: Make a Stop abort the IN-FLIGHT model turn, not only between turns.

  ChatCompletionParams gains an optional signal?: AbortSignal. The query runtime threads the run's abort signal into every provider call (the streaming turn and the forced-final summary) and now drives the provider stream through a MANUAL iterator that RACES each next() against the abort — so a cancellation tears the turn down within a tick even if a transport buffers or ignores the signal, with the abort propagating out of the generator so the run settles as cancelled. The stream consumer cleans up on every exit (removes the abort listener, calls iterator.return()), and the natural-completion break re-checks the signal so a Stop that lands exactly as the turn finishes is recorded as cancelled rather than a normal end-of-turn.

  Every provider now honours the signal at the transport: Anthropic (messages.create({ signal })), OpenAI (create(..., { signal })), Bedrock (send(..., { abortSignal })), OpenRouter + HTTP (compose with the request timeout via AbortSignal.any), Ollama (the returned iterator's .abort()), and LM Studio (respond(..., { signal }) → the SDK's websocket cancel) — each plus a cheap per-chunk signal.throwIfAborted() for promptness.

  Fully additive and inert when unset: a never-aborted signal is behaviourally identical to omitting it, so existing callers and uncancelled runs are byte-identical.

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2

Patch Changes

• —

  40eb841: Widen @namzu/sdk peer range to >=0.1.6 <1.0.0.

  The previous peer range ^1 || ^0.1.6 resolved to >=0.1.6 <0.2.0 || >=1.0.0, which excluded the published @namzu/sdk@0.2.0 and caused npm install @namzu/sdk @namzu/<provider> to fail with ERESOLVE on a clean machine. The new range covers every pre-1.0 SDK minor from 0.1.6 onward; the 1.0 pledge will be the next explicit widening.

  This is the first release under the new Changesets-driven workflow and the wide-pre-1.0-peer convention. Consumers who followed the README's "getting started" install were previously blocked; after this release npm install @namzu/sdk@latest @namzu/<provider>@latest resolves cleanly.

All notable changes to @namzu/lmstudio are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Release of @namzu/lmstudio v0.1.0

Patch Changes

• —

  f1f000c: Declare honest driver capabilities on each provider instance.

  Every shipped driver now exposes readonly capabilities (and re-exports its *_CAPABILITIES constant from the client module) describing what the DRIVER does — not what the vendor API could do — so the SDK's capability negotiation can warn instead of silently degrading:

  • —@namzu/ollama: supportsTools: false, supportsVision: false (the driver never sends tool schemas and drops image attachments).
  • —@namzu/lmstudio: supportsTools corrected true → false and supportsFunctionCalling true → false — the driver folds tool messages into user text and never sends tool schemas; supportsVision: false.
  • —@namzu/anthropic: full (supportsVision: true — image attachments already mapped).
  • —@namzu/bedrock, @namzu/openrouter, @namzu/http: tools pass through (supportsTools: true) but supportsVision: false until their message translation maps attachments.

Patch Changes

• —

  9df35d1: Make a Stop abort the IN-FLIGHT model turn, not only between turns.

  ChatCompletionParams gains an optional signal?: AbortSignal. The query runtime threads the run's abort signal into every provider call (the streaming turn and the forced-final summary) and now drives the provider stream through a MANUAL iterator that RACES each next() against the abort — so a cancellation tears the turn down within a tick even if a transport buffers or ignores the signal, with the abort propagating out of the generator so the run settles as cancelled. The stream consumer cleans up on every exit (removes the abort listener, calls iterator.return()), and the natural-completion break re-checks the signal so a Stop that lands exactly as the turn finishes is recorded as cancelled rather than a normal end-of-turn.

  Every provider now honours the signal at the transport: Anthropic (messages.create({ signal })), OpenAI (create(..., { signal })), Bedrock (send(..., { abortSignal })), OpenRouter + HTTP (compose with the request timeout via AbortSignal.any), Ollama (the returned iterator's .abort()), and LM Studio (respond(..., { signal }) → the SDK's websocket cancel) — each plus a cheap per-chunk signal.throwIfAborted() for promptness.

  Fully additive and inert when unset: a never-aborted signal is behaviourally identical to omitting it, so existing callers and uncancelled runs are byte-identical.

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2

Patch Changes

• —

  40eb841: Widen @namzu/sdk peer range to >=0.1.6 <1.0.0.

  The previous peer range ^1 || ^0.1.6 resolved to >=0.1.6 <0.2.0 || >=1.0.0, which excluded the published @namzu/sdk@0.2.0 and caused npm install @namzu/sdk @namzu/<provider> to fail with ERESOLVE on a clean machine. The new range covers every pre-1.0 SDK minor from 0.1.6 onward; the 1.0 pledge will be the next explicit widening.

  This is the first release under the new Changesets-driven workflow and the wide-pre-1.0-peer convention. Consumers who followed the README's "getting started" install were previously blocked; after this release npm install @namzu/sdk@latest @namzu/<provider>@latest resolves cleanly.

All notable changes to @namzu/ollama are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Release of @namzu/ollama v0.1.0

Patch Changes

• —

  f1f000c: Map user-message image attachments to OpenAI image_url content parts.

  toOpenAIMessages now converts UserMessage.attachments into multimodal content parts (text first, then each image as an image_url part carrying a data:<mediaType>;base64,<data> URI), mirroring the Anthropic driver's image-block mapping. Previously attachments were silently dropped. The driver declares supportsVision: true and exposes its capabilities on the provider instance for the SDK's capability negotiation.

Patch Changes

• —

  9df35d1: Make a Stop abort the IN-FLIGHT model turn, not only between turns.

  ChatCompletionParams gains an optional signal?: AbortSignal. The query runtime threads the run's abort signal into every provider call (the streaming turn and the forced-final summary) and now drives the provider stream through a MANUAL iterator that RACES each next() against the abort — so a cancellation tears the turn down within a tick even if a transport buffers or ignores the signal, with the abort propagating out of the generator so the run settles as cancelled. The stream consumer cleans up on every exit (removes the abort listener, calls iterator.return()), and the natural-completion break re-checks the signal so a Stop that lands exactly as the turn finishes is recorded as cancelled rather than a normal end-of-turn.

  Every provider now honours the signal at the transport: Anthropic (messages.create({ signal })), OpenAI (create(..., { signal })), Bedrock (send(..., { abortSignal })), OpenRouter + HTTP (compose with the request timeout via AbortSignal.any), Ollama (the returned iterator's .abort()), and LM Studio (respond(..., { signal }) → the SDK's websocket cancel) — each plus a cheap per-chunk signal.throwIfAborted() for promptness.

  Fully additive and inert when unset: a never-aborted signal is behaviourally identical to omitting it, so existing callers and uncancelled runs are byte-identical.

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2

Patch Changes

• —

  40eb841: Widen @namzu/sdk peer range to >=0.1.6 <1.0.0.

  The previous peer range ^1 || ^0.1.6 resolved to >=0.1.6 <0.2.0 || >=1.0.0, which excluded the published @namzu/sdk@0.2.0 and caused npm install @namzu/sdk @namzu/<provider> to fail with ERESOLVE on a clean machine. The new range covers every pre-1.0 SDK minor from 0.1.6 onward; the 1.0 pledge will be the next explicit widening.

  This is the first release under the new Changesets-driven workflow and the wide-pre-1.0-peer convention. Consumers who followed the README's "getting started" install were previously blocked; after this release npm install @namzu/sdk@latest @namzu/<provider>@latest resolves cleanly.

All notable changes to @namzu/openai are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Release of @namzu/openai v0.1.0

Patch Changes

• —

  f1f000c: Declare honest driver capabilities on each provider instance.

  Every shipped driver now exposes readonly capabilities (and re-exports its *_CAPABILITIES constant from the client module) describing what the DRIVER does — not what the vendor API could do — so the SDK's capability negotiation can warn instead of silently degrading:

  • —@namzu/ollama: supportsTools: false, supportsVision: false (the driver never sends tool schemas and drops image attachments).
  • —@namzu/lmstudio: supportsTools corrected true → false and supportsFunctionCalling true → false — the driver folds tool messages into user text and never sends tool schemas; supportsVision: false.
  • —@namzu/anthropic: full (supportsVision: true — image attachments already mapped).
  • —@namzu/bedrock, @namzu/openrouter, @namzu/http: tools pass through (supportsTools: true) but supportsVision: false until their message translation maps attachments.

Patch Changes

• —

  9df35d1: Make a Stop abort the IN-FLIGHT model turn, not only between turns.

  ChatCompletionParams gains an optional signal?: AbortSignal. The query runtime threads the run's abort signal into every provider call (the streaming turn and the forced-final summary) and now drives the provider stream through a MANUAL iterator that RACES each next() against the abort — so a cancellation tears the turn down within a tick even if a transport buffers or ignores the signal, with the abort propagating out of the generator so the run settles as cancelled. The stream consumer cleans up on every exit (removes the abort listener, calls iterator.return()), and the natural-completion break re-checks the signal so a Stop that lands exactly as the turn finishes is recorded as cancelled rather than a normal end-of-turn.

  Every provider now honours the signal at the transport: Anthropic (messages.create({ signal })), OpenAI (create(..., { signal })), Bedrock (send(..., { abortSignal })), OpenRouter + HTTP (compose with the request timeout via AbortSignal.any), Ollama (the returned iterator's .abort()), and LM Studio (respond(..., { signal }) → the SDK's websocket cancel) — each plus a cheap per-chunk signal.throwIfAborted() for promptness.

  Fully additive and inert when unset: a never-aborted signal is behaviourally identical to omitting it, so existing callers and uncancelled runs are byte-identical.

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2

Patch Changes

• —

  40eb841: Widen @namzu/sdk peer range to >=0.1.6 <1.0.0.

  The previous peer range ^1 || ^0.1.6 resolved to >=0.1.6 <0.2.0 || >=1.0.0, which excluded the published @namzu/sdk@0.2.0 and caused npm install @namzu/sdk @namzu/<provider> to fail with ERESOLVE on a clean machine. The new range covers every pre-1.0 SDK minor from 0.1.6 onward; the 1.0 pledge will be the next explicit widening.

  This is the first release under the new Changesets-driven workflow and the wide-pre-1.0-peer convention. Consumers who followed the README's "getting started" install were previously blocked; after this release npm install @namzu/sdk@latest @namzu/<provider>@latest resolves cleanly.

All notable changes to @namzu/openrouter are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Release of @namzu/openrouter v0.1.0

Patch Changes

• —Updated dependencies [cc6b5f3]
• —Updated dependencies [f1f000c]
• —Updated dependencies [30c755d]
• —Updated dependencies [f1f000c]
• —Updated dependencies [f1f000c]
  • —@namzu/sdk@1.2.0
  • —@namzu/openai@1.0.2
  • —@namzu/ollama@1.0.2
  • —@namzu/anthropic@1.1.1
  • —@namzu/openrouter@1.0.2

Minor Changes

• —11e1a70: run-stream gains --session <key> and a new history --session <key> command: bind a headless turn to a persisted conversation in the cwd's .namzu store (keyed by an embedder's own session id), so prior turns load as context and the turn is appended. history prints that conversation's {role,content}[] as JSON. This lets a host UI (the clawtool desktop) resume a session's transcript and keep multi-turn context across separate one-shot invocations.
• —022b082: run-stream gains a --provider flag (override the persona's configured provider for the turn, alongside --model). New providers-json command prints every registry provider with its detection state, default model, and a best-effort live model list ({provider,label,detected,default,models[]}[]) so a host UI can build a dynamic provider/model picker instead of a hardcoded list. listModels is probed per detected provider with a 3s race + free-text fallback. The listing path registers the vendor package (ensureRegistered) before constructing the provider, so a detected provider returns its real model catalog instead of an empty list — without it ProviderRegistry.create throws "Unsupported provider type" and the picker silently degrades to free-text for every provider.
• —02f37e1: run-stream gains --model, --instance, and --skills <a,b,c> flags so a host UI can drive which model answers, attribute the run to a named instance, and load specific skills' bodies into the turn (via the same extra-system channel the TUI's /skill uses). Adds a skills-json command that prints discovered skills as {name, description, source}[] for a host's skill picker.
• —1032736: Add namzu run-stream — a headless streaming one-shot that runs the same agent as the TUI but emits one compact NDJSON line per AgentEvent (delta / tool-start / tool-end / error / done) to stdout, instead of buffering the final text like run. Prior conversation history is read from stdin as a JSON Message[]. This lets a host process (e.g. a desktop UI) line-scan stdout and render a turn live, with the host owning persistence — the equivalent of the TUI driven from another runtime.

Patch Changes

• —Updated dependencies [ac85934]
• —Updated dependencies [999e4be]
• —Updated dependencies [9df35d1]
• —Updated dependencies [42f577e]
• —Updated dependencies [6c09394]
• —Updated dependencies [9a0c5ee]
• —Updated dependencies [0d1fb7b]
• —Updated dependencies [2c5dd7a]
• —Updated dependencies [271e6cf]
• —Updated dependencies [8c07556]
• —Updated dependencies [b776acf]
  • —@namzu/sdk@1.1.0
  • —@namzu/anthropic@1.1.0
  • —@namzu/openai@1.0.1
  • —@namzu/openrouter@1.0.1
  • —@namzu/ollama@1.0.1

Patch Changes

• —Updated dependencies [1df23b1]
  • —@namzu/sdk@0.6.0

Bug Fixes

• —emergency: uuid tmp suffix, outer try/catch, and explicit exit
• —store: resolve withLock race, delete deadlock, and atomic edge updates

Documentation

• —changelog: update for v0.1.5-rc.2

Refactor

• —barrels: route root barrel through sub-barrels (Path B)
• —connector: brand ConnectorId/TenantId on public interfaces [BREAKING]

Testing

• —store: add concurrency regression tests for DiskTaskStore

Bug Fixes

• —plugin: wire MCP servers and fail fast on unsupported contributions
• —plugin: consume hook results and wire tool hooks in runtime
• —release: normalize pre-release counter to strip non-digit suffix

Documentation

• —changelog: update for v0.1.5-rc.1-fix
• —contracts: formalize wire/domain duality + refresh README
• —readme: rewrite code examples to match current SDK API

Refactor

• —plugin: remove duplicate PluginConfigSchema in types/
• —registry: migrate Agent/Connector/Tool registries to ManagedRegistry
• —run: remove legacy Session* aliases for run-centric classes

Documentation

• —changelog: update for v0.1.4-rc.3

Features

• —sandbox isolation, new tools (edit/grep/ls), session-to-run migration

Miscellaneous

• —release: derive version from git tag, no manual bump needed

9d4c180 chore(release): 0.1.4-rc.1 3658715 feat(advisory): provider-agnostic advisory system with three-layer architecture 53404c6 feat: structured compaction, tool tiering, task router efd2936 fix: add description field to package.json, reorder README badges b8abff8 feat: output discipline, shell compression, pre-release workflow c081c46 chore: remove BEFORE-RELEASE.md from repo

f832ce0 fix: point entry fields to dist/ for bundler compatibility e06b3b4 docs: add npm, ci, license, typescript, node badges to README

Patch Changes

• —b776acf: Make the package-version read bundle-safe. version.ts read ../package.json via createRequire(import.meta.url) at module-init with no guard. esbuild leaves createRequire calls as runtime requires and collapses the dist tree into a single file, so in a bundle ../package.json no longer resolves and the read threw at import time — crashing the whole process on any code path that touches the SDK runtime (Cannot find module '../package.json'). Wrap the read in try/catch with a 0.0.0 fallback, mirroring the CLI's existing readPackageVersion. Unbundled behaviour is unchanged (real version is read); a bundled build degrades the cosmetic version string instead of crashing.

Patch Changes

• —

  c9b180d: Coordinated patch bump across all publishable packages after the @namzu/telemetry@0.1.0 extraction landed. No functional changes — this is a compatibility and release-pipeline validation cut to (a) exercise the Trusted Publisher binding for @namzu/telemetry that was configured after the 0.1.0 bootstrap publish, and (b) give consumers a single aligned set of patch versions that all know about the new telemetry package.

  Resulting versions:

  • —@namzu/sdk → 0.4.1
  • —@namzu/telemetry → 0.1.1
  • —@namzu/computer-use → 0.2.1
  • —@namzu/anthropic, @namzu/bedrock, @namzu/http, @namzu/lmstudio, @namzu/ollama, @namzu/openai, @namzu/openrouter → 0.1.2