@9thprotocol/agent-core 0.1.0

package/dist/scripts/compaction-smoke.js

@@ -0,0 +1,143 @@
+import { applyCompaction, estimateTokens, findCutpoint, planCompaction, shouldCompact, } from "../compaction.js";
+let failures = 0;
+function check(label, actual, expected) {
+    const ok = actual === expected;
+    if (!ok)
+        failures++;
+    console.log(`${ok ? "✓" : "✗"} ${label}${ok ? "" : `: got ${actual}, want ${expected}`}`);
+}
+/** Every tool_call id must be answered, and no tool result may be orphaned. */
+function pairingIsValid(messages) {
+    const answered = new Set();
+    for (const m of messages)
+        if (m.role === "tool")
+            answered.add(m.tool_call_id);
+    const called = new Set();
+    for (const m of messages) {
+        if (m.role === "assistant")
+            for (const tc of m.tool_calls ?? [])
+                called.add(tc.id);
+    }
+    for (const id of called)
+        if (!answered.has(id))
+            return false; // dangling call
+    for (const id of answered)
+        if (!called.has(id))
+            return false; // orphaned result
+    return true;
+}
+/** A session with interleaved tool exchanges, like a real one. */
+function buildHistory(exchanges) {
+    const out = [{ role: "system", content: "system prompt" }];
+    for (let i = 0; i < exchanges; i++) {
+        out.push({ role: "user", content: `user message ${i} ${"x".repeat(200)}` });
+        out.push({
+            role: "assistant",
+            content: null,
+            tool_calls: [
+                { id: `call_${i}`, type: "function", function: { name: "read", arguments: `{"path":"f${i}"}` } },
+            ],
+        });
+        out.push({ role: "tool", tool_call_id: `call_${i}`, content: `file contents ${"y".repeat(300)}` });
+        out.push({ role: "assistant", content: `done with ${i}` });
+    }
+    return out;
+}
+console.log("- estimation -");
+check("empty history is 0 tokens", estimateTokens([]), 0);
+check("400 chars ≈ 100 tokens", estimateTokens([{ role: "user", content: "x".repeat(400) }]), 100);
+console.log("\n- threshold -");
+const small = buildHistory(2);
+check("small history under threshold", shouldCompact(small, 200_000), false);
+check("same history against a tiny window", shouldCompact(small, 100), true);
+console.log("\n- cut points -");
+const history = buildHistory(10);
+const body = history.slice(1); // drop the system prefix, as planCompaction does
+// Sized against a realistic window: with a 200k window this history is tiny
+// and correctly would not be compacted at all.
+const cut = findCutpoint(body, 2000);
+check("cut lands on a user message", body[cut]?.role, "user");
+check("cut is greater than zero", cut > 0, true);
+console.log("\n- pairing preserved -");
+check("fixture itself is well-formed", pairingIsValid(history), true);
+const plan = planCompaction(history, 2000);
+check("plan produced", plan !== null, true);
+if (plan) {
+    const compacted = applyCompaction(plan, "SUMMARY OF EARLIER WORK");
+    check("compacted history is well-formed", pairingIsValid(compacted), true);
+    check("system prompt survives", compacted[0]?.role, "system");
+    check("summary is inserted after system", compacted[1]?.role, "user");
+    check("compacted history is shorter", compacted.length < history.length, true);
+    check("summary text present", compacted[1].content.includes("SUMMARY OF EARLIER WORK"), true);
+}
+console.log("\n- pairing holds at every history length -");
+let badLength = null;
+for (let n = 1; n <= 40; n++) {
+    const h = buildHistory(n);
+    const p = planCompaction(h, 2000);
+    if (!p)
+        continue;
+    if (!pairingIsValid(applyCompaction(p, "S"))) {
+        badLength = n;
+        break;
+    }
+}
+check("no history length produces broken pairing", badLength, null);
+console.log("\n- few messages, huge content -");
+// The regression this guards: a fixed "keep the last N messages" rule could
+// never compact a session that is short but token-heavy (a few big file reads),
+// so it would overflow the window and every turn would fail.
+const fewButHuge = [
+    { role: "system", content: "system prompt" },
+    { role: "user", content: "read the big files" },
+    {
+        role: "assistant",
+        content: null,
+        tool_calls: [
+            { id: "big1", type: "function", function: { name: "read", arguments: '{"path":"a"}' } },
+        ],
+    },
+    { role: "tool", tool_call_id: "big1", content: "A".repeat(200_000) },
+    { role: "user", content: "now the second one" },
+    {
+        role: "assistant",
+        content: null,
+        tool_calls: [
+            { id: "big2", type: "function", function: { name: "read", arguments: '{"path":"b"}' } },
+        ],
+    },
+    { role: "tool", tool_call_id: "big2", content: "B".repeat(200_000) },
+    { role: "assistant", content: "read both" },
+];
+check("fixture exceeds a 100k window", shouldCompact(fewButHuge, 100_000), true);
+const hugePlan = planCompaction(fewButHuge, 100_000);
+check("short-but-huge history IS compacted", hugePlan !== null, true);
+if (hugePlan) {
+    const out = applyCompaction(hugePlan, "S");
+    check("result stays well-formed", pairingIsValid(out), true);
+    check("result is meaningfully smaller", estimateTokens(out) <= estimateTokens(fewButHuge) * 0.55, true);
+}
+console.log("\n- refuses unsafe compaction -");
+check("short history is not compacted", planCompaction(buildHistory(1), 2000), null);
+check("system-only history is not compacted", planCompaction([{ role: "system", content: "s" }], 2000), null);
+// A history whose only boundary is inside a tool exchange must be left alone
+// rather than cut somewhere that strands a tool result.
+const noSafeCut = [
+    { role: "system", content: "s" },
+    { role: "user", content: "only user message" },
+    ...Array.from({ length: 20 }, (_, i) => [
+        {
+            role: "assistant",
+            content: null,
+            tool_calls: [
+                { id: `c${i}`, type: "function", function: { name: "read", arguments: "{}" } },
+            ],
+        },
+        { role: "tool", tool_call_id: `c${i}`, content: "result" },
+    ]).flat(),
+];
+const unsafePlan = planCompaction(noSafeCut, 1000);
+check("history with no safe boundary is left intact", unsafePlan === null || pairingIsValid(applyCompaction(unsafePlan, "S")), true);
+console.log(`\n${failures ? `${failures} failed` : "all compaction checks passed"}`);
+process.exit(failures ? 1 : 0);
+//# sourceMappingURL=compaction-smoke.js.map

package/dist/scripts/delegation-live.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/delegation-live.js

@@ -0,0 +1,122 @@
+/**
+ * Live delegation check: prove a real worker call works, and that a real agent
+ * turn routes a large file through it instead of into its own context.
+ *
+ * The offline checks prove the gate refuses and the corpus is well-formed.
+ * Only this proves a worker model actually answers, that the answer is usable,
+ * and that the burn lands on the session's totals.
+ *
+ *   OPENROUTER_API_KEY=... node dist/scripts/delegation-live.js            # BYOK
+ *   PLATFORM_URL=... PLATFORM_TOKEN=... node dist/scripts/delegation-live.js
+ *
+ * Run it from a directory with a file over the threshold; it picks the largest
+ * source file it can find under cwd.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { AgentSession } from "../session.js";
+import { DELEGATION_MIN_LINES, buildReadCorpus, delegate } from "../delegate.js";
+import { workerModel } from "../model/router.js";
+const platformUrl = process.env.PLATFORM_URL;
+const platformToken = process.env.PLATFORM_TOKEN;
+const byokKey = process.env.OPENROUTER_API_KEY;
+const apiKey = platformToken ?? byokKey;
+if (!apiKey) {
+    console.error("Set OPENROUTER_API_KEY, or PLATFORM_URL + PLATFORM_TOKEN");
+    process.exit(1);
+}
+const platform = platformUrl && platformToken ? { baseUrl: platformUrl } : undefined;
+const cwd = process.cwd();
+/** Largest source file under cwd, since the point is to exercise the gate. */
+function findLargest(dir, depth = 0) {
+    if (depth > 4)
+        return null;
+    let best = null;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "dist")
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            const inner = findLargest(full, depth + 1);
+            if (inner && (!best || inner.lines > best.lines))
+                best = inner;
+        }
+        else if (/\.(ts|tsx|js|md|py|go|java)$/.test(entry.name)) {
+            const lines = fs.readFileSync(full, "utf8").split("\n").length;
+            if (!best || lines > best.lines)
+                best = { file: full, lines };
+        }
+    }
+    return best;
+}
+const target = findLargest(cwd);
+if (!target) {
+    console.error(`No source files under ${cwd}`);
+    process.exit(1);
+}
+console.log(`transport: ${platform ? `platform (${platform.baseUrl})` : "BYOK direct"}`);
+console.log(`target:    ${target.file} (${target.lines} lines, threshold ${DELEGATION_MIN_LINES})`);
+if (target.lines <= DELEGATION_MIN_LINES) {
+    console.log("note: under the threshold, so the gate will not fire on it this run");
+}
+let failures = 0;
+function check(label, ok, detail = "") {
+    if (!ok)
+        failures++;
+    console.log(`${ok ? "✓" : "✗"} ${label}${detail ? `: ${detail}` : ""}`);
+}
+// 1. the worker itself
+console.log("\n- worker call -");
+const content = fs.readFileSync(target.file, "utf8");
+const corpus = buildReadCorpus([{ path: target.file, content }], "What does this file do, and what are its main exports? Cite path:line.");
+const model = workerModel();
+const started = Date.now();
+const result = await delegate({
+    apiKey,
+    model,
+    mode: "bulk-reader",
+    message: corpus,
+    cwd,
+    sessionId: "delegation-live",
+    ...(platform ? { platform } : {}),
+});
+const ms = Date.now() - started;
+check("worker answered", result.text.length > 0);
+check("answer is bullets, not prose", /^[-*•]/m.test(result.text));
+check("worker burn was reported", result.usage.inputTokens > 0, `${result.usage.inputTokens} in / ${result.usage.outputTokens} out`);
+console.log(`  ${model} · ${ms}ms · corpus ${Math.ceil(corpus.length / 4)} tok → answer ${Math.ceil(result.text.length / 4)} tok ` +
+    `(${Math.round((1 - result.text.length / corpus.length) * 100)}% smaller)`);
+console.log(result.text.split("\n").slice(0, 6).map((l) => `  | ${l}`).join("\n"));
+// 2. a real agent turn, which must not read the file into its own context
+console.log("\n- agent turn -");
+const session = new AgentSession({
+    apiKey,
+    model: "auto",
+    cwd,
+    mode: "bypass",
+    ...(platform ? { platform } : {}),
+});
+let text = "";
+const toolCalls = [];
+let error = null;
+for await (const ev of session.send(`Read ${target.file} and tell me in one sentence what it is for. Do not edit anything.`)) {
+    if (ev.type === "text_delta")
+        text += ev.text;
+    if (ev.type === "tool_end")
+        toolCalls.push(ev.call.name);
+    if (ev.type === "error")
+        error = ev.message;
+}
+check("turn completed", !error, error ?? "");
+check("the agent answered", text.trim().length > 0);
+console.log(`  tools used: ${toolCalls.join(", ") || "(none)"}`);
+console.log(`  delegated:  ${session.delegated.calls} call(s), ${session.delegated.contextTokensSaved} tokens kept out of context`);
+console.log(`  session:    ${session.usage.inputTokens} in / ${session.usage.outputTokens} out over ${session.usage.requests} request(s)`);
+if (target.lines > DELEGATION_MIN_LINES) {
+    check("a large file was delegated, not read whole", session.delegated.calls > 0);
+    check("worker burn rolled into the session total", session.usage.requests > session.delegated.workerUsage.requests);
+}
+console.log(`  answer: ${text.trim().slice(0, 200)}`);
+console.log(`\n${failures ? `${failures} failed` : "all live delegation checks passed"}`);
+process.exit(failures ? 1 : 0);
+//# sourceMappingURL=delegation-live.js.map

package/dist/scripts/delegation-smoke.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/delegation-smoke.js

@@ -0,0 +1,140 @@
+/**
+ * Delegation checks, pure, no network.
+ *   node dist/scripts/delegation-smoke.js
+ *
+ * Covers the two things that decide whether delegation is safe rather than just
+ * cheap: the read gate refuses without ever marking a file as read, and the
+ * tools appear only where delegating actually saves something.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { AgentSession } from "../session.js";
+import { readTool } from "../tools/fs-tools.js";
+import { workerModel } from "../model/router.js";
+import { DELEGATION_MIN_LINES, MAX_CORPUS_CHARS, buildReadCorpus, buildWriteCorpus, delegate, estimateCorpusTokens, stripFences, } from "../delegate.js";
+let failures = 0;
+function check(label, actual, expected) {
+    const ok = actual === expected;
+    if (!ok)
+        failures++;
+    console.log(`${ok ? "✓" : "✗"} ${label}${ok ? "" : `: got ${actual}, want ${expected}`}`);
+}
+const dir = fs.mkdtempSync(path.join(os.tmpdir(), "9p-delegation-"));
+const big = path.join(dir, "big.ts");
+const small = path.join(dir, "small.ts");
+fs.writeFileSync(big, Array.from({ length: 900 }, (_, i) => `const line${i} = ${i};`).join("\n"));
+fs.writeFileSync(small, "const a = 1;\nconst b = 2;\n");
+function ctx(armed) {
+    return {
+        cwd: dir,
+        readFiles: new Set(),
+        ...(armed ? { delegation: { minLines: DELEGATION_MIN_LINES } } : {}),
+    };
+}
+console.log("- read gate -");
+{
+    const c = ctx(true);
+    const out = await readTool.run({ file_path: big }, c);
+    check("900-line whole-file read is refused", out.startsWith("Refused:"), true);
+    check("refusal names bulk_read", out.includes("bulk_read"), true);
+    check("refusal offers the targeted-read escape hatch", out.includes("offset/limit"), true);
+    // The invariant that keeps write/edit honest: a refused read must not count
+    // as having seen the file, or read-before-modify passes on a body nobody saw.
+    check("refused read does NOT mark the file as read", c.readFiles.has(big), false);
+}
+{
+    const c = ctx(true);
+    const out = await readTool.run({ file_path: big, offset: 10, limit: 5 }, c);
+    check("targeted read passes", out.startsWith("Refused:"), false);
+    check("targeted read returns 5 lines", out.split("\n").filter((l) => /^\d+\t/.test(l)).length, 5);
+    check("targeted read marks the file as read", c.readFiles.has(big), true);
+}
+{
+    const c = ctx(true);
+    const out = await readTool.run({ file_path: big, limit: 5 }, c);
+    check("limit alone counts as targeted", out.startsWith("Refused:"), false);
+}
+{
+    const c = ctx(true);
+    const out = await readTool.run({ file_path: small }, c);
+    check("small file passes whole", out.startsWith("Refused:"), false);
+}
+{
+    const c = ctx(false);
+    const out = await readTool.run({ file_path: big }, c);
+    check("gate is disarmed when delegation is off", out.startsWith("Refused:"), false);
+    check("disarmed read marks the file as read", c.readFiles.has(big), true);
+}
+console.log("\n- corpus building -");
+{
+    const corpus = buildReadCorpus([{ path: "a.ts", content: "x\ny" }], "what?");
+    check("wraps files in a tagged block", corpus.includes('<file path="a.ts">'), true);
+    check("numbers lines from 1", corpus.includes("1\tx"), true);
+    check("numbers the second line", corpus.includes("2\ty"), true);
+    check("appends the question", corpus.trimEnd().endsWith("Question: what?"), true);
+    const write = buildWriteCorpus("make tests", [{ path: "r.ts", content: "ref" }]);
+    check("write corpus leads with the spec", write.startsWith("Spec: make tests"), true);
+    check("write corpus tags the reference", write.includes('<reference path="r.ts">'), true);
+}
+console.log("\n- fence stripping -");
+check("strips a wrapping fence", stripFences("```ts\nconst a = 1;\n```"), "const a = 1;");
+check("strips a bare fence", stripFences("```\nx\n```"), "x");
+check("leaves unfenced code alone", stripFences("const a = 1;"), "const a = 1;");
+// A fence inside a template literal is content, not formatting; only whole
+// fence lines go, so indented ones survive.
+check("keeps an indented fence inside code", stripFences("const s = `\n  ```\n`;").includes("  ```"), true);
+console.log("\n- worker model -");
+{
+    const corePlan = [
+        { id: "z-ai/glm-4.7-flash", tier: "economy" },
+        { id: "anthropic/claude-sonnet-5", tier: "standard" },
+    ];
+    check("picks the cheapest economy model", workerModel(corePlan), "z-ai/glm-4.7-flash");
+    check("skips a locked economy model", workerModel([{ id: "z-ai/glm-4.7-flash", tier: "economy", locked: true }, ...corePlan.slice(1)]), "moonshotai/kimi-k2.7-code");
+    check("BYOK with no catalog takes the ladder head", workerModel(), "z-ai/glm-4.7-flash");
+}
+console.log("\n- oversized corpus is refused before any request -");
+{
+    let message = "";
+    try {
+        await delegate({
+            apiKey: "unused",
+            model: "z-ai/glm-4.7-flash",
+            mode: "bulk-reader",
+            message: "x".repeat(MAX_CORPUS_CHARS + 1),
+            cwd: dir,
+            sessionId: "smoke",
+        });
+    }
+    catch (err) {
+        message = err instanceof Error ? err.message : String(err);
+    }
+    check("oversized corpus throws", message.includes("over the"), true);
+    check("and never reached the network", message.includes("fetch"), false);
+}
+console.log("\n- tool availability -");
+{
+    const base = { apiKey: "k", model: "auto", cwd: dir };
+    const on = new AgentSession({ ...base });
+    check("bulk_read is on by default", on.toolNames.includes("bulk_read"), true);
+    check("code_write is on by default", on.toolNames.includes("code_write"), true);
+    const off = new AgentSession({ ...base, delegation: { enabled: false } });
+    check("delegation can be turned off", off.toolNames.includes("bulk_read"), false);
+    // An explore sub-agent already runs on the worker tier; delegating from it
+    // would pay a round trip to move work from a flash model to a flash model.
+    const explore = new AgentSession({ ...base, subagent: "explore", toolset: "read-only" });
+    check("explore sub-agents do not delegate", explore.toolNames.includes("bulk_read"), false);
+    const general = new AgentSession({ ...base, subagent: "general" });
+    check("general sub-agents do delegate", general.toolNames.includes("bulk_read"), true);
+    const readOnly = new AgentSession({ ...base, toolset: "read-only" });
+    check("read-only keeps bulk_read", readOnly.toolNames.includes("bulk_read"), true);
+    check("read-only drops code_write", readOnly.toolNames.includes("code_write"), false);
+    check("nothing delegated yet", on.delegated.calls, 0);
+}
+console.log("\n- token estimate matches compaction's -");
+check("4 chars per token", estimateCorpusTokens(400), 100);
+fs.rmSync(dir, { recursive: true, force: true });
+console.log(`\n${failures ? `${failures} failed` : "all delegation checks passed"}`);
+process.exit(failures ? 1 : 0);
+//# sourceMappingURL=delegation-smoke.js.map

package/dist/scripts/router-live.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/router-live.js

@@ -0,0 +1,73 @@
+/**
+ * Live check that Auto routing picks a model AND that the pick actually runs
+ * through the metered proxy (PLAN.md §5.5).
+ *   PLATFORM_URL=http://localhost:4009/v1 PLATFORM_TOKEN=<jwt> node dist/scripts/router-live.js
+ */
+import { AgentSession } from "../session.js";
+import { AUTO_MODEL } from "../model/router.js";
+const platformUrl = process.env.PLATFORM_URL;
+const token = process.env.PLATFORM_TOKEN;
+if (!platformUrl || !token) {
+    console.error("Set PLATFORM_URL + PLATFORM_TOKEN");
+    process.exit(1);
+}
+const res = await fetch(`${platformUrl}/models`, {
+    headers: { Authorization: `Bearer ${token}` },
+});
+const catalog = (await res.json()).models.map((m) => ({ id: m.id, tier: m.tier, locked: m.locked }));
+console.log(`catalog: ${catalog.length} models, ${catalog.filter((m) => m.locked).length} locked\n`);
+// One prompt per complexity band; each must route differently and still answer.
+const cases = [
+    { label: "trivial", prompt: "what is 2+2? reply with just the number.", want: "z-ai/glm-4.7-flash" },
+    {
+        label: "normal",
+        prompt: "add a logout button to the settings page please",
+        want: "moonshotai/kimi-k2.7-code",
+    },
+    {
+        label: "complex",
+        prompt: "refactor the auth module to remove duplicated token parsing",
+        want: "anthropic/claude-sonnet-5",
+    },
+];
+let failures = 0;
+for (const c of cases) {
+    const session = new AgentSession({
+        apiKey: token,
+        model: AUTO_MODEL,
+        autoRouter: { bias: "balanced", catalog },
+        cwd: process.cwd(),
+        // NOT plan mode: plan mode forces every turn to "complex" by design, which
+        // would collapse all three cases onto the same model and prove nothing.
+        mode: "default",
+        platform: { baseUrl: platformUrl },
+        maxTurnsPerMessage: 1,
+    });
+    let picked = "";
+    let text = "";
+    let error = "";
+    for await (const ev of session.send(c.prompt)) {
+        if (ev.type === "model_selected")
+            picked = ev.model;
+        if (ev.type === "text_delta")
+            text += ev.text;
+        if (ev.type === "error")
+            error = ev.message;
+    }
+    const routedRight = picked === c.want;
+    if (!routedRight)
+        failures++;
+    // Upstream 402s (our OpenRouter balance) are reported but don't fail the
+    // routing check. The pick is what this script exists to verify.
+    const upstreamBroke = error.includes('"code":402');
+    const detail = error
+        ? upstreamBroke
+            ? "upstream 402 (OpenRouter account balance)"
+            : `ERROR ${error.slice(0, 90)}`
+        : `replied ${text.trim().slice(0, 40).replace(/\n/g, " ")}…`;
+    console.log(`${routedRight ? "✓" : "✗"} ${c.label.padEnd(8)} → ${picked || "(no pick)"}` +
+        `${routedRight ? "" : ` (want ${c.want})`}, ${detail}`);
+}
+console.log(`\n${failures ? `${failures} failed` : "live routing OK"}`);
+process.exit(failures ? 1 : 0);
+//# sourceMappingURL=router-live.js.map

package/dist/scripts/router-smoke.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/router-smoke.js

@@ -0,0 +1,58 @@
+/**
+ * Auto router checks, pure, no network (PLAN.md §5.5).
+ *   node dist/scripts/router-smoke.js
+ */
+import { classify, route } from "../model/router.js";
+let failures = 0;
+function check(label, actual, expected) {
+    const ok = actual === expected;
+    if (!ok)
+        failures++;
+    console.log(`${ok ? "✓" : "✗"} ${label}${ok ? "" : `: got ${actual}, want ${expected}`}`);
+}
+// A Core-plan catalog: economy + standard usable, premium locked.
+// K3 is premium as of 2026-08-14, priced above Sonnet 5 per heavy session.
+const corePlan = [
+    { id: "z-ai/glm-4.7-flash", tier: "economy" },
+    { id: "z-ai/glm-4.7", tier: "economy" },
+    { id: "moonshotai/kimi-k2.7-code", tier: "economy" },
+    { id: "anthropic/claude-sonnet-5", tier: "standard" },
+    { id: "moonshotai/kimi-k3", tier: "premium", locked: true },
+    { id: "anthropic/claude-fable-5", tier: "premium", locked: true },
+    { id: "anthropic/claude-opus-4.8", tier: "premium", locked: true },
+];
+const freePlan = corePlan.map((m) => m.tier === "economy" ? m : { ...m, locked: true });
+console.log("- classification -");
+check("typo fix is trivial", classify("fix the typo in the README"), "trivial");
+check("short question is trivial", classify("what is this repo?"), "trivial");
+check("plain feature ask is normal", classify("add a logout button to the settings page please"), "normal");
+check("refactor is complex", classify("refactor the auth module"), "complex");
+check("short debug ask is complex", classify("debug this"), "complex");
+check("long prompt is complex", classify("a".repeat(700)), "complex");
+check("plan mode forces complex", classify("rename x to y", true), "complex");
+console.log("\n- routing (Core plan) -");
+check("trivial → cheapest economy", route({ text: "fix the typo", available: corePlan }).model, "z-ai/glm-4.7-flash");
+check("normal → K2.7-code anchor", route({ text: "add a logout button to the settings page please", available: corePlan }).model, "moonshotai/kimi-k2.7-code");
+check("complex → Sonnet 5 (cheaper per heavy session than K3)", route({ text: "refactor the auth module", available: corePlan }).model, "anthropic/claude-sonnet-5");
+check("Auto never routes to K3, even when fully unlocked", route({
+    text: "refactor the auth module",
+    available: corePlan.map((m) => ({ ...m, locked: false })),
+}).model !== "moonshotai/kimi-k3", true);
+console.log("\n- bias -");
+check("economy bias downgrades a complex turn", route({ text: "refactor the auth module", bias: "economy", available: corePlan }).model, "moonshotai/kimi-k2.7-code");
+check("quality bias on a complex turn wants premium, but Core is locked out", route({ text: "refactor the auth module", bias: "quality", available: corePlan }).model, "anthropic/claude-sonnet-5");
+check("quality bias reaches premium when unlocked", route({
+    text: "refactor the auth module",
+    bias: "quality",
+    available: corePlan.map((m) => ({ ...m, locked: false })),
+}).model, "anthropic/claude-fable-5");
+console.log("\n- plan locks -");
+check("Free plan never escapes economy on a complex turn", route({ text: "refactor the auth module", available: freePlan }).model, "moonshotai/kimi-k2.7-code");
+console.log("\n- sub-agents -");
+check("explore sub-agent is pinned to economy despite complex text", route({ text: "refactor the auth module", subagent: "explore", available: corePlan }).model, "z-ai/glm-4.7-flash");
+check("general sub-agent routes normally", route({ text: "refactor the auth module", subagent: "general", available: corePlan }).model, "anthropic/claude-sonnet-5");
+console.log("\n- BYOK (no catalog) -");
+check("no catalog still routes to the complex ladder head", route({ text: "refactor the auth module" }).model, "anthropic/claude-sonnet-5");
+console.log(`\n${failures ? `${failures} failed` : "all router checks passed"}`);
+process.exit(failures ? 1 : 0);
+//# sourceMappingURL=router-smoke.js.map

package/dist/scripts/smoke.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scripts/smoke.js

@@ -0,0 +1,52 @@
+/**
+ * Live end-to-end check of the agent loop against OpenRouter (bypass mode, cheap model).
+ *   OPENROUTER_API_KEY=... node dist/scripts/smoke.js ["custom prompt"]
+ */
+import { AgentSession } from "../session.js";
+import { McpManager } from "../mcp.js";
+// Platform mode: PLATFORM_URL=http://localhost:4009/v1 PLATFORM_TOKEN=<jwt>
+// Direct mode:   OPENROUTER_API_KEY=sk-or-...
+const platformUrl = process.env.PLATFORM_URL;
+const apiKey = platformUrl ? process.env.PLATFORM_TOKEN : process.env.OPENROUTER_API_KEY;
+if (!apiKey) {
+    console.error("Set OPENROUTER_API_KEY, or PLATFORM_URL + PLATFORM_TOKEN");
+    process.exit(1);
+}
+const mcp = await McpManager.fromCwd(process.cwd());
+if (mcp.servers.length) {
+    console.log(`[mcp] connected: ${mcp.servers.join(", ")} (${mcp.tools.length} tools)`);
+}
+const session = new AgentSession({
+    apiKey,
+    mcp,
+    model: process.env.SMOKE_MODEL ?? "z-ai/glm-4.7-flash",
+    cwd: process.cwd(),
+    mode: "bypass",
+    ...(platformUrl ? { platform: { baseUrl: platformUrl } } : {}),
+});
+const prompt = process.argv[2] ??
+    "Find every package.json in this workspace with glob, read the root one, and report each workspace package's name and license on one line each.";
+for await (const ev of session.send(prompt)) {
+    switch (ev.type) {
+        case "text_delta":
+            process.stdout.write(ev.text);
+            break;
+        case "tool_start":
+            console.log(`\n[tool] ${ev.summary}`);
+            break;
+        case "tool_end":
+            console.log(`[done ${ev.durationMs}ms${ev.isError ? " ERROR" : ""}] ${ev.output.split("\n")[0]?.slice(0, 100) ?? ""}`);
+            break;
+        case "permission_denied":
+            console.log(`\n[denied] ${ev.summary}`);
+            break;
+        case "turn_end":
+            console.log(`\n\n[usage] ${ev.usage.requests} calls · in=${ev.usage.inputTokens} (cached=${ev.usage.cachedTokens}) · out=${ev.usage.outputTokens}`);
+            break;
+        case "error":
+            console.error(`\n[error] ${ev.message}`);
+            process.exitCode = 1;
+    }
+}
+await mcp.close();
+//# sourceMappingURL=smoke.js.map