Skip to content

chore: sync public mirror from internal #1328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
evalops-mirror merged 1 commit into from
Oct 3, 2026
Merged

chore: sync public mirror from internal #1328

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .repository-projection.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@
"projection": "deixic-code",
"projectionSchemaVersion": 1,
"sourceRepository": "dx-corp/mono",
"sourceSha": "a69c1b529a97b14a03400ba6da3c7638e731bed7",
"sourceSha": "eb0ec94780d951b21cd54c7de3380ac3624791ac",
"destinationRepository": "dx-corp/code",
"priorProjectedBase": "b559b7489e7be5106525ee575859f5ddef1f21d8",
"priorProjectedBase": "504ba52e32b5b99544a3c8a5c1a546f299ef9cf0",
"definitionDigest": "cb9d429542ebb0a2de9b42a7aad60d9d8696a648ceba47c30f05c0b285ca0db7",
"toolDigest": "f8cb071b0f27267120ccf45a00d0982f45113bd23535bef6a1555b4933f99f13",
"contentDigest": "4676d676f45ea745c21a6ebb2d20aedcf3d83bcf978ca61d2f303c5ca4a09c82",
"contentDigest": "cd768ddf8f8c6ff66d5b037a18b20f30adebed7ee3ef2169c0b68843d84b839f",
"publicationEligible": true
}
4 changes: 4 additions & 0 deletions packages/ai-rs/src/types.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,9 @@ pub enum ImageSource {
/// Tool definition
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Tool {
/// Untrusted namespace guidance exposed only through explicit discovery.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub namespace_instructions: Option<String>,
pub name: String,
pub description: String,
pub input_schema: serde_json::Value,
Expand Down Expand Up @@ -158,6 +161,7 @@ impl ToolSchemaEnforcement {
impl Tool {
pub fn new(name: impl Into<String>, description: impl Into<String>) -> Self {
Self {
namespace_instructions: None,
name: name.into(),
description: description.into(),
input_schema: serde_json::json!({
Expand Down
53 changes: 44 additions & 9 deletions packages/codemode-rs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,11 @@ to the existing Rust tool boundaries. It does not own tool permissions,
credentials, effect admission, approvals, or durable receipts.

The model calls `codemode` with a `code` string containing the body of an async
JavaScript function. Independent reads can run in one wave; their results can
feed subsequent calls without another model request. Only `text()` output and
the returned value enter the model's tool-result context.
JavaScript function. Admitted reads settle individually after their owner
controls. A fast result can feed another read while unrelated reads remain
pending, and `Promise.race` can finish without waiting for its losing reads.
Only selected `text()`/`image()` output and the returned value enter the
model's tool-result context.

```javascript
const matches = ALL_TOOLS.filter(tool => /search/.test(tool.name));
Expand All @@ -34,6 +36,12 @@ core or already-discovered tools; Maestro preserves its allowed-tool set and
profile restrictions. Conversational questions and confirmations use direct
tool calls. Recursive scripts are unavailable.

`searchTools` includes parameter names and descriptions. `describeTool` renders
bounded property guidance with its declaration. `describeNamespace` accepts
unambiguous namespace aliases and returns bounded server instructions only on
demand, marked as untrusted guidance. Instructions grant no executable authority.
Direct tool declarations remain separate from the script's callable catalog.

Each script gets a fresh QuickJS VM embedded in the native binary. There is no
Node/Bun subprocess, host filesystem, network, module loader, process API, or
timer API. The host bridge emits tool requests; the composing agent applies
Expand All @@ -42,20 +50,47 @@ run concurrently, while effects retain their existing ordered execution and
effect receipts. A script cannot authorize its own nested calls.

The VM has a 32 MiB heap, a 256 KiB stack, a maximum of 64 nested calls,
64 KiB of output, and a hard 60-second deadline. Existing host deadlines and
64 KiB of projected text including separators, and a hard 60-second deadline. Existing host deadlines and
cancellation may stop it sooner. Output-limit violations remain failures even
when the script catches the exception. A promise with no pending tool call
fails immediately. Unawaited requests are discarded when the script finishes.

Failed tool calls reject their JavaScript promises. A script failure preserves
Refused calls and execution failures reject their JavaScript promises. Maestro
preserves accepted MCP server results as `{content, isError, structuredContent}`,
including mixed media and structured server errors. The typed value remains
separate from display context; hook rejection and result transformations still
apply before delivery. Credentials are scrubbed in both projections.

A script failure preserves
partial output; completed effects are not undone. Each composing agent retains
the underlying call evidence separately from the script's model-facing summary.
Restart handling preserves the existing refusal to replay an uncertain effect.
Failure diagnostics take priority over partial text at the projection limit;
any shortening is explicitly marked. Finishing a script cancels its child read
token, while accepted effects and inference retain owner settlement.

`store`/`load` provide bounded untrusted JSON scratch state through the existing
agent journals, committed only after known successful host acceptance. The VM
owns no durable store or tool execution authority.

Classifier waves admit at most four concurrent requests. Maestro reserves its
remaining output budget before polling a wave; Dex derives argument-specific
reservations from the gateway's exact reviewed route, price and token-bound
contract. Unknown routes remain unavailable under finite Dex budgets. Reservations
are separate from reported usage, and unresolved usage stops subsequent spend
or effects. Specialist routes come from trusted host configuration, with the
active chat route as the compatibility default.

Maestro uses `model_dynamics.classifier_model` for the optional specialist model.
Dex uses `DEX_CLASSIFIER_PROVIDER_BINDING_JSON` with the existing managed-provider
binding shape. Both resolve through their existing governed connection owner;
scripts cannot supply endpoints or credentials.

The VM has no durable store. Script-local variables cover dependencies within
one call; existing agent journals remain the owners of execution state. This
change does not import Pi's provider transports, model-running helpers, or
session-storage format.
Qualification fixtures capture actual gateway request bytes and exactly one
reported usage settlement. Fixed fixture usage and prepared histories do not
measure model quality or full-loop savings. The ignored configured-owner test
in `dex-runtime` measures real answer selection only when explicitly enabled
with authorized tenant coordinates and the existing gateway configuration.

The native engine is pinned to `rquickjs` 0.13.0, published September 8, 2026,
to retain the repository's fourteen-day dependency cooling period. Independent
Expand Down
Loading
Loading