/** * traceToolpack — footprintjs trace evidence exposed as TOOLS an LLM calls * (RFC-003 Part C: the introspection toolpack). * * "The framework's internal tool for itself": after a run completes, a * debugging LLM (a cheap model in a SEPARATE session) navigates the run's * evidence by ids instead of reading dumps — the same just-in-time, * token-efficient loading pattern as `read_skill`. Feed the slice, not the * trace; the LLM ranks by navigating, so no embedder is needed. * * Pattern: Factory over frozen artifacts. `traceToolpack(artifacts)` returns * plain `Tool[]` — mount them on any Agent, or drive them scripted * via `callTraceTool` (the offline auditor pattern, like * examples/features/20). Nothing re-runs; every tool is a bounded * read-only VIEW over a COMPLETED run's snapshot + commit log. * * The toolpack's three contracts (B13 posture): * * 1. BOUNDED BY DEFAULT — every output is capped (previews, slice * depth/nodes, value chars, narrative lines). Per-call params raise * the budget only up to hard caps the LLM cannot exceed. * 2. HONEST — truncation and incompleteness are ALWAYS marked (⚠), never * silent: truncated slices, untracked sources (args/env/silent reads), * missing read tracking, missing control-dependence lookup, values the * commit log cannot see (pre-run state, closures). * 3. REDACTION-RESPECTING — the commit log already carries redacted * payloads (footprintjs scrubs at commit time); the toolpack passes * placeholders through verbatim and flags redacted keys. It never * reconstructs around a redaction. * * Why ids: every view names steps by `runtimeStageId` * (`stageId#executionIndex`) — the universal key linking the commit log, * the execution tree, and recorder events. The LLM drills like a debugger: * overview → slice → node → value, paying only for what it opens. */ import { type Tool } from '../../core/tools.js'; import { type TraceToolpackArtifacts, type TraceToolpackOptions } from './types.js'; /** * Build the introspection toolpack over a COMPLETED run's artifacts. * * Returns plain `Tool[]`: * * | Tool | Question it answers | * |------------------|-----------------------------------------------------------| * | `run_overview` | What happened, broadly? (the entry point) | * | `trace_node` | What did step X read/write, and where did its inputs come from? | * | `trace_slice` | Which chain of steps produced the data at X? (causal slice) | * | `backtrack` | Why is VARIABLE K what it is? (+ `element`: who made K[i]?) — variable-first | * | `who_wrote` | Which step last wrote key K? | * | `get_value` | The full value of K as of step X (capped, truncation-marked) | * | `read_narrative` | The human-readable story, paginated (only when narrative provided) | * * Mount on an Agent (`Agent.create({...}).tool(...tools)`) or drive scripted * via {@link callTraceTool}. The tools NEVER throw on bad ids/keys — they * return corrective, model-visible messages (the #9 philosophy), and their * strict input schemas give Agent-dispatched calls free arg validation. * * Security note (B13 posture): trace content can carry adversarial text from * the original run (tool results, user input). Serve these tools to a * SEPARATE debugging session over completed runs — not to the production * agent mid-run — and treat tool outputs as data, not instructions. */ export declare function traceToolpack(artifacts: TraceToolpackArtifacts, options?: TraceToolpackOptions): Tool[]; /** * Invoke a toolpack tool OUTSIDE an Agent (scripted debug sessions, tests, * offline auditors). Mirrors the Agent's #9 boundary: args are validated * against the tool's inputSchema first, and an invalid call returns the same * model-visible correction string instead of executing. */ export declare function callTraceTool(tools: readonly Tool[], name: string, args?: Record): Promise; //# sourceMappingURL=traceToolpack.d.ts.map