48d25cdd44
A Codex review pass on the draft caught four real gaps and two solid suggestions; all addressed except one pushed back on the merits: - hooks-claude/hooks-codex: stderrSummaryMaxChars was the one new knob with NO range validation — a negative/NaN cap would silently misbehave inside slice(). Both bridges now assert a positive integer at the TOP of apply() (before the config-file parse's early return, so a bad value fails the load loudly), with rejection tests. - tool-fs: the read caps count lines/chars/bytes, so positive-FINITE was too loose (a fractional readLimit would flow into windowing arithmetic and the schema description). All four now require a positive integer, matching tool-web's cap. - Doc drift the gates cannot catch: tool-web's README tools table still named WEB_SEARCH_MAX_RESULTS as the mechanism; compact-basic's README/module doc and the compaction-capability-seam RFC still described estimation as fixed char/4 rather than the charsPerToken default. - subagent-acp: the dispose graces were tested only at the startAcpRun level, so a regression that stopped threading plugin config into AcpRunSpec would have survived. A provider-path test now drives the trap-escalation scenario through ctx.subagents.start with small config graces and bounds dispose at 4s. Pushed back on: converting compact-basic's charsPerToken to a schemastery field. The package's whole config is deliberately hand-rolled (resolveConfig, every threshold REQUIRED with no default — a documented design posture); one schemastery field beside it would be incoherent. The knob is cordis.yml-reachable, defaulted, and validated, which is what the convention requires; migrating the package to schemastery wholesale is pre-existing config-surface hygiene out of this change's scope.
web/ - web capability family
The web access capability seam: an abstract web interface, search/fetch provider implementations, and the model-facing web tools. All product packages.
| Package | Role | ctx key |
|---|---|---|
web/ |
Abstract web seam (search/fetch provider registries + selection + vocabulary + WebError) |
ctx.web |
web-search-exa/ |
Exa-backed WebSearchProvider |
(registers on ctx.web) |
web-search-perplexity/ |
Perplexity-backed WebSearchProvider |
(registers on ctx.web) |
web-search-deepseek/ |
DeepSeek-backed WebSearchProvider using native web_search through the Anthropic-compatible API |
(registers on ctx.web) |
web-fetch-local/ |
Anonymous public HTTP(S) WebFetchProvider |
(registers on ctx.web) |
tool-web/ |
Model-facing web_search/web_fetch tool schemas |
(registers on ctx.tools) |
The interface lives at web/web/. Unlike bash/fs, the seam spans two capabilities (search and fetch) with potentially multiple providers each: ctx.web is one web-access middle layer with one provider-selection policy, one abort/error vocabulary, and one product-facing "how this harness reaches the web" config surface. Providers register capabilities, not tools; tool-web is the only owner of model-facing names, schemas, prompt guidance, and presentation. A search provider swap does not change how the model asks for a query, and a fetch implementation swap does not change how the model asks for a URL.
See the web capability seam RFC for the design rationale, including why search and fetch are deliberately one seam and why web_fetch's SSRF protection is deferred.