@alumbwe/anvil 1.0.20 → 1.0.22

package/vendor/@anvil/common/src/constants/auth.ts

@@ -0,0 +1,18 @@
+/**
+ * How long a device-code sign-in stays valid.
+ *
+ * Shared because two apps issue these codes — codebuff.com serves the CLI and anvil.com serves
+ * Anvil Desktop — and a drift between them would show up only as one surface timing out sooner
+ * than the other, with nothing to point at.
+ *
+ * The `/api/auth/cli/code` response sends this as `expiresInMs` **alongside** the absolute
+ * `expiresAt`, and they are not redundant:
+ *
+ * - `expiresAt` is an instant on the SERVER's clock. It has to stay: it is the HMAC input the
+ *   status endpoint verifies, so clients must echo it back byte-for-byte.
+ * - `expiresInMs` is a duration, which means nothing about it depends on the client's clock. A
+ *   client that subtracts `expiresAt` from its own `Date.now()` is silently asking every user's
+ *   system clock to be right — and a machine running an hour fast rejects every code it is ever
+ *   issued, permanently, with a 200 in our logs. That was a real, unfixable-by-reinstalling bug.
+ */
+export const CLI_AUTH_CODE_LIFETIME_MS = 60 * 60 * 1000

package/vendor/@anvil/common/src/constants/byok.ts

@@ -0,0 +1,2 @@
+export const BYOK_OPENROUTER_HEADER = 'x-openrouter-api-key'
+export const BYOK_OPENROUTER_ENV_VAR = 'ANVIL_BYOK_OPENROUTER'

package/vendor/@anvil/common/src/constants/cf-worker-signals.ts

@@ -0,0 +1,132 @@
+/**
+ * Cloudflare Worker egress detection.
+ *
+ * What this catches
+ * -----------------
+ * `pingmike2/anvil2api-wokers` and its relatives run as a Cloudflare Worker
+ * that pools harvested account tokens and resells free mode as an
+ * OpenAI/Anthropic-compatible endpoint. Cloudflare stamps `CF-Worker` onto every
+ * outbound subrequest a Worker makes, naming the Worker's zone, and Worker code
+ * cannot remove it — the edge adds it after `fetch()` returns to the runtime.
+ * The published source never references the header at all.
+ *
+ * Why this signal is different from the ones that went wrong before
+ * ----------------------------------------------------------------
+ * Every previous third-party-client detector keyed on something the CLIENT
+ * chooses: `fingerprint_id` (self-reported), the tool list (they inject
+ * `end_turn` to pass), the system prompt (they now send our canonical opening
+ * byte-for-byte). Each was defeated within days, and one produced a
+ * 659-account false-positive ban that had to be fully reversed.
+ *
+ * This one is stamped by OUR edge, on the request, describing the infrastructure
+ * that sent it. A caller cannot remove it, and adding it falsely only implicates
+ * themselves. That is what makes it safe enough to action automatically — and
+ * the reason every other signal here is still only a lead.
+ *
+ * The three ways it could still be wrong, and what each costs
+ * ----------------------------------------------------------
+ * 1. **Our own infrastructure calls our own API from a Worker.** Real: the
+ *    app-preview-proxy is a Cloudflare Worker. Handled by never actioning
+ *    unmetered service accounts, and by the zone allowlist.
+ * 2. **Cloudflare does not strip an inbound `cf-worker` from an ordinary
+ *    client.** Then anyone can send it — but only on their OWN authenticated
+ *    request, so they can only get themselves actioned. It is not a vector for
+ *    getting someone else banned.
+ * 3. **A user sits behind a corporate proxy implemented on Workers.** Rare but
+ *    not impossible, and the reason `ban` is not the default mode.
+ *
+ * Nothing here fires on paid or BYOK traffic. The concern is subsidised
+ * free-mode capacity being resold, and a paying customer routing through their
+ * own Worker is doing nothing wrong.
+ */
+
+/** Header Cloudflare stamps on subrequests originating from a Worker. */
+export const CF_WORKER_HEADER = 'cf-worker'
+
+/**
+ * Corroborates that the request actually traversed our edge. Without it we are
+ * reading a header an arbitrary caller wrote on a request that reached the
+ * origin some other way, which is not the same claim at all.
+ */
+export const CF_RAY_HEADER = 'cf-ray'
+
+export type CfWorkerMode = 'off' | 'observe' | 'block' | 'ban'
+
+export type CfWorkerVerdict =
+  | { detected: false; reason: 'no_header' | 'not_edge_verified' | 'allowlisted' }
+  | { detected: true; zone: string }
+
+export type CfWorkerDetectInput = {
+  /** Raw `cf-worker` value, or null/undefined when absent. */
+  cfWorkerHeader: string | null | undefined
+  /** Raw `cf-ray` value. Absent means the request did not come through our
+   *  Cloudflare edge, so the `cf-worker` value is not ours to trust. */
+  cfRayHeader: string | null | undefined
+  /** Worker zones operated by us (app-preview-proxy and friends). */
+  allowedZones: ReadonlySet<string>
+}
+
+/**
+ * Pure detection. No I/O, so the exact decision can be replayed offline when
+ * auditing a ban — a verdict that cannot be reproduced cannot be defended.
+ */
+export function detectCfWorker(input: CfWorkerDetectInput): CfWorkerVerdict {
+  const raw = input.cfWorkerHeader?.trim()
+  if (!raw) return { detected: false, reason: 'no_header' }
+
+  // Require edge corroboration. A `cf-worker` on a request that never touched
+  // Cloudflare is caller-authored noise, and treating it as proof would make
+  // this detector exactly as forgeable as the ones it replaces.
+  if (!input.cfRayHeader?.trim()) {
+    return { detected: false, reason: 'not_edge_verified' }
+  }
+
+  const zone = raw.toLowerCase()
+  if (input.allowedZones.has(zone)) {
+    return { detected: false, reason: 'allowlisted' }
+  }
+
+  return { detected: true, zone }
+}
+
+/**
+ * Evidence recorded with every automated action, and shown verbatim in the ban
+ * review dashboard.
+ *
+ * Deliberately everything needed to re-derive the verdict without the original
+ * request: the zone, the edge ray id (so the request can be found in Cloudflare
+ * logs), and the calling client's self-description. A reviewer who cannot see
+ * why an account was banned cannot tell a true positive from a false one, which
+ * is how the 2026-08-03 sweep ended up reversed in full.
+ */
+export type CfWorkerEvidence = {
+  zone: string
+  cfRay: string | null
+  /** `anvil_metadata.client_id`. The published proxy sends `wf-` + 8 base36
+   *  characters; our own clients send a different shape entirely. */
+  clientId: string | null
+  userAgent: string | null
+  model: string | null
+  agentId: string | null
+  endpoint: string
+  detectedAt: string
+}
+
+/** Parse the operator-configured allowlist of our own Worker zones. */
+export function parseAllowedWorkerZones(
+  raw: string | null | undefined,
+): ReadonlySet<string> {
+  return new Set(
+    (raw ?? '')
+      .split(',')
+      .map((zone) => zone.trim().toLowerCase())
+      .filter((zone) => zone.length > 0),
+  )
+}
+
+/** A caller-supplied `client_id` matching the published proxy's generator.
+ *  Corroboration only — never a reason to action on its own, because it is
+ *  client-controlled and therefore trivially changed the moment it is used. */
+export function looksLikeProxyClientId(clientId: string | null | undefined): boolean {
+  return typeof clientId === 'string' && /^wf-[a-z0-9]{8}$/.test(clientId)
+}

package/vendor/@anvil/common/src/constants/composio.ts

@@ -0,0 +1,34 @@
+export const COMPOSIO_API_KEY_ENV_VAR = 'COMPOSIO_API_KEY'
+
+export const COMPOSIO_META_TOOL_NAMES = [
+  'composio_manage_connections',
+  'composio_multi_execute_tool',
+  'composio_search_tools',
+  'composio_get_tool_schemas',
+] as const
+
+export type ComposioMetaToolName = (typeof COMPOSIO_META_TOOL_NAMES)[number]
+
+export const COMPOSIO_META_TOOL_NAME_TO_UPSTREAM = {
+  composio_manage_connections: 'COMPOSIO_MANAGE_CONNECTIONS',
+  composio_multi_execute_tool: 'COMPOSIO_MULTI_EXECUTE_TOOL',
+  composio_search_tools: 'COMPOSIO_SEARCH_TOOLS',
+  composio_get_tool_schemas: 'COMPOSIO_GET_TOOL_SCHEMAS',
+} as const satisfies Record<ComposioMetaToolName, string>
+
+export type ComposioUpstreamMetaToolName =
+  (typeof COMPOSIO_META_TOOL_NAME_TO_UPSTREAM)[ComposioMetaToolName]
+
+const COMPOSIO_META_TOOL_NAME_SET = new Set<string>(COMPOSIO_META_TOOL_NAMES)
+
+export function isComposioMetaToolName(
+  toolName: string,
+): toolName is ComposioMetaToolName {
+  return COMPOSIO_META_TOOL_NAME_SET.has(toolName)
+}
+
+export function getComposioUpstreamToolName(
+  toolName: ComposioMetaToolName,
+): ComposioUpstreamMetaToolName {
+  return COMPOSIO_META_TOOL_NAME_TO_UPSTREAM[toolName]
+}

package/vendor/@anvil/common/src/constants/deepseek-direct.ts

@@ -0,0 +1,55 @@
+/**
+ * Direct-to-DeepSeek mode ("own backend").
+ *
+ * When `DEEPSEEK_API_KEY` is set, the SDK routes model calls straight to
+ * DeepSeek's OpenAI-compatible API instead of the Codebuff backend, and the
+ * CLI bypasses backend auth/session gates with a local identity. When unset,
+ * every path behaves exactly as before (Codebuff backend).
+ *
+ * `DEEPSEEK_MODEL` optionally overrides the model ID sent to DeepSeek. Without
+ * it, DeepSeek's API serves exactly two model names — `deepseek-v4-pro` and
+ * `deepseek-v4-flash` (a request for anything else is rejected with "The
+ * supported API model names are deepseek-v4-pro or deepseek-v4-flash"). So:
+ *
+ *  - `deepseek/…` lane ids keep their model name (`deepseek/deepseek-v4-pro`
+ *    → `deepseek-v4-pro`), with the `-max` context tiers normalized to their
+ *    base model and the legacy fireworks lane mapped to flash.
+ *  - Every other provider id (anthropic/*, openai/*, google/*, …) cannot be
+ *    served by DeepSeek at all and falls back to the default DeepSeek model.
+ */
+
+export const DEEPSEEK_BASE_URL = 'https://api.deepseek.com'
+
+/** Model name sent to DeepSeek for ids that are not a DeepSeek lane model. */
+export const DEFAULT_DIRECT_DEEPSEEK_MODEL = 'deepseek-v4-pro'
+
+/** The user's DeepSeek API key, read from the runtime environment. */
+export const getDirectDeepSeekApiKey = (): string | undefined =>
+  process.env.DEEPSEEK_API_KEY
+
+/** True when the CLI/SDK should talk to DeepSeek directly instead of Codebuff. */
+export const isDirectDeepSeekMode = (): boolean =>
+  Boolean(getDirectDeepSeekApiKey())
+
+/** Map a Codebuff model ID to the model name DeepSeek's API accepts. */
+export function remapModelForDirectDeepSeek(model: string): string {
+  const override = process.env.DEEPSEEK_MODEL
+  if (override) return override
+
+  // DeepSeek lane ids: keep the model name, normalizing the -max context tiers
+  // and the legacy fireworks lane to ids the API actually serves.
+  if (model.startsWith('deepseek/')) {
+    const name = model.slice('deepseek/'.length)
+    if (name === 'deepseek-v4-pro' || name === 'deepseek-v4-flash') {
+      return name
+    }
+    if (name === 'deepseek-v4-pro-max') return 'deepseek-v4-pro'
+    if (name === 'deepseek-v4-flash-max') return 'deepseek-v4-flash'
+    return DEFAULT_DIRECT_DEEPSEEK_MODEL
+  }
+  if (model === 'fireworks/deepseek-v4-flash') return 'deepseek-v4-flash'
+
+  // Any other provider (anthropic, openai, google, …) has no DeepSeek
+  // equivalent — fall back so the request is never rejected for the model name.
+  return DEFAULT_DIRECT_DEEPSEEK_MODEL
+}

package/vendor/@anvil/common/src/constants/feedback.ts

@@ -0,0 +1,13 @@
+export const FEEDBACK_CATEGORIES = ['good_result', 'bad_result', 'app_bug', 'other'] as const
+export type FeedbackCategory = (typeof FEEDBACK_CATEGORIES)[number]
+
+export const FEEDBACK_SOURCES = ['cli', 'desktop', 'sdk', 'web'] as const
+export type FeedbackSource = (typeof FEEDBACK_SOURCES)[number]
+
+export const MESSAGE_VARIANTS = ['ai', 'user', 'agent', 'error'] as const
+export type MessageVariant = (typeof MESSAGE_VARIANTS)[number]
+
+export const MAX_RECENT_MESSAGES = 10
+export const MAX_ERRORS = 50
+export const MAX_ERROR_MESSAGE_LENGTH = 2000
+export const MAX_ERROR_ID_LENGTH = 200

package/vendor/@anvil/common/src/constants/foreign-client-signals.ts

@@ -0,0 +1,272 @@
+import { toolNames } from '../tools/constants'
+
+/**
+ * Where a free-mode request goes when it did not come from a anvil client.
+ *
+ * OpenRouter's `:free` variant, so a downgraded request costs nothing upstream
+ * — which is the point. A caller proxying our free endpoint into their own
+ * harness is spending our inference budget; serving them a free model spends
+ * none of it. `getChatCompletionsProvider` has no branch for this slug and
+ * falls through to `openrouter`, so nothing else needs to know about it.
+ *
+ * Verified against the OpenRouter catalog on 2026-08-08: 262k context, $0
+ * prompt and completion, and `tools` + `tool_choice` in supported_parameters —
+ * so a downgraded tool-calling request degrades rather than hard-erroring.
+ */
+export const ANVIL_DOWNGRADE_MODEL_ID = 'inclusionai/ling-3.0-tiny:free'
+
+/**
+ * Tool names we define that other agent harnesses also ship.
+ *
+ * Maintained as an EXCLUSION list, with the signature derived from it, because
+ * the inclusion list rotted: `researcher-web` offers exactly
+ * `['web_search', 'read_url']`, and a hand-picked signature that happened to
+ * omit both flagged 100% of its 334,042 requests from 4,821 users over 30 days.
+ * Any tool added to `toolNames` now joins the signature automatically, so the
+ * failure mode is a new *generic* name we forget to list here — which flags a
+ * third party we could already flag, rather than silently downgrading our own
+ * users.
+ *
+ * Each entry carries the third-party usage that justifies it, so this stays
+ * evidence rather than superstition.
+ */
+export const GENERIC_TOOL_NAMES: ReadonlySet<string> = new Set([
+  // Counts are distinct users, over 30 days, on requests carrying NO signature
+  // tool at all — i.e. unambiguously third-party harnesses. Anything without
+  // that evidence belongs in the signature: excluding a name we define costs us
+  // nothing against proxies and risks flagging whichever agent of ours uses it
+  // alone, which is exactly how researcher-web broke.
+  'write_file', // 3,372 users (Cline)
+  'web_search', // 3,273 users (opencode)
+  'glob', // 2,691 users (opencode, Claude Code ships `Glob`)
+  'skill', // 2,257 users
+  'apply_patch', // 1,137 users (Codex)
+])
+
+/**
+ * Tools our own surfaces define outside `toolNames`, via
+ * `customToolDefinitions`. Anvil Desktop's autorun agent
+ * (anvil-desktop/src/server/services/autorun.ts) offers exactly `decide` and
+ * nothing else, so without this it had no signature tool at all and was flagged
+ * on 100% of its 2,904 requests from 41 users over 30 days.
+ */
+export const ANVIL_CUSTOM_TOOL_NAMES = ['decide'] as const
+
+/**
+ * Tool names that, on their own, mark a request as coming from one of our
+ * clients: everything we define that is not generic.
+ *
+ * The discriminator is the tool schema rather than the system prompt because
+ * the two are attacker-controlled in very different ways. A system prompt is
+ * free to copy — ours ships in the CLI and is recoverable from any response —
+ * so a prompt check is a speed bump. Tool schemas are not free to copy: a
+ * harness dispatches on the tool name the model returns, so sending ours means
+ * also executing ours and speaking our result format. Evading this check
+ * converges on behaving like a real client, which is the outcome we want.
+ */
+export const ANVIL_SIGNATURE_TOOL_NAMES: ReadonlySet<string> = new Set([
+  ...(toolNames as readonly string[]).filter(
+    (name) => !GENERIC_TOOL_NAMES.has(name),
+  ),
+  ...ANVIL_CUSTOM_TOOL_NAMES,
+])
+
+export type ForeignClientSignal =
+  | 'foreign_toolset'
+  | 'root_agent_no_tools'
+  | 'sampling_params'
+
+export type ForeignClientVerdict = {
+  /** Null when the request looks like it came from one of our clients. */
+  signal: ForeignClientSignal | null
+  toolCount: number
+  /** A few offered tool names, for the log line. Bounded so logs stay small. */
+  sampleToolNames: string[]
+}
+
+type InspectableRequest = {
+  tools?: unknown
+  temperature?: unknown
+  top_p?: unknown
+  max_tokens?: unknown
+  max_completion_tokens?: unknown
+}
+
+/** Longest tool name kept for the log line. Names are caller-controlled, so an
+ *  untruncated one is a log-flood vector; nothing legitimate is near this. */
+const MAX_LOGGED_TOOL_NAME_LENGTH = 64
+
+function readToolNames(tools: unknown): string[] {
+  if (!Array.isArray(tools)) return []
+  return tools
+    .map((tool) =>
+      typeof tool === 'object' && tool !== null
+        ? (tool as { function?: { name?: unknown } }).function?.name
+        : undefined,
+    )
+    .filter((name): name is string => typeof name === 'string')
+}
+
+/**
+ * Whether a free-mode request came from something other than a anvil client.
+ *
+ * Three signals, checked in a deliberate order:
+ *
+ *  1. The request offers tools and not one of them is distinctively ours.
+ *     Measured over 24h of DeepSeek V4 Flash traffic: 557 users / 75,741
+ *     requests.
+ *  2. The request offers NO tools and the agent is one of our roots, which are
+ *     agentic by definition — a caller using a root agent id as a bare
+ *     completion endpoint. Reported only; never enforced.
+ *  3. The request offers no tools and sets `temperature`, `top_p` or
+ *     `max_tokens`. Our clients leave all three unset on 99.2% of requests.
+ *     Reported only; never enforced.
+ *
+ * Signal 1 wins outright when it clears the request, and that ordering is the
+ * whole safety story rather than a detail: 16 users in the same window send our
+ * toolset *and* set sampling params (2,673 requests). Checking params first, or
+ * checking them independently, would downgrade those users. Anyone sending our
+ * tools is one of ours no matter what else the body says.
+ */
+export function detectForeignAnvilClient(
+  body: InspectableRequest,
+  /** The resolved agent id, when the caller has it. Root agents are agentic by
+   *  definition, so one that offers no tools is not being driven by our client
+   *  — see `root_agent_no_tools` below. */
+  isRootAgent = false,
+): ForeignClientVerdict {
+  const offered = readToolNames(body.tools)
+  const sampleToolNames = offered
+    .slice(0, 8)
+    .map((name) => name.slice(0, MAX_LOGGED_TOOL_NAME_LENGTH))
+
+  if (offered.length > 0) {
+    const hasSignatureTool = offered.some((name) =>
+      ANVIL_SIGNATURE_TOOL_NAMES.has(name),
+    )
+    return {
+      signal: hasSignatureTool ? null : 'foreign_toolset',
+      toolCount: offered.length,
+      sampleToolNames,
+    }
+  }
+
+  // A ROOT agent that offers no tools at all. Our roots always ship their
+  // toolset — the CI guard in foreign-client-shipped-agents.test.ts enforces
+  // that — so on its face this is a caller driving one of our root agent ids as
+  // a bare completion endpoint.
+  //
+  // An early hand-sample of 18 such users came back 18-for-18 non-coding
+  // automation — Shopee customer-service bots, Solana memecoin traders, RAG
+  // rephrasers, benchmark probes. DO NOT cite that as evidence for enforcing.
+  // It was drawn from a tail of roughly 5,000 users and the cohort analysis
+  // below shows it was not representative: 90% of the accounts the signal names
+  // also do real agentic work. An 18-for-18 result from an unrepresentative
+  // frame is what a biased sample looks like, not a strong one.
+  //
+  // REPORTED, NEVER ENFORCED, per the full 30-day backtest. Counting only root
+  // agents and excluding the paired
+  // assistant-response rows (they carry no tools by design and are half of all
+  // rows — miss that and every agent reads ~50% tool-free):
+  //
+  //   base2-free-deepseek           4.46%  215,777 reqs   2,672 users
+  //   base2-free-deepseek-flash     0.296% 103,726 reqs   2,281 users
+  //   base2-free                    0.90%      222 reqs      15 users
+  //   anvil-desktop-thread-local 0.018%   2,400 reqs      11 users
+  //
+  // Only 417 of those users are 100% tool-free — actual bare-completion
+  // proxies. The other 3,729 mix tool-free requests into heavy real agentic
+  // traffic (bucket at <10% tool-free: 1,658 users over 1.25M requests), and
+  // 7,379 of their tool-free requests land INSIDE 999 sessions that also make
+  // tool-bearing root calls. Enforcing per-request would swap the model
+  // mid-session for real coding runs.
+  //
+  // Nor does run length separate the two: the longest consecutive tool-free run
+  // belongs to the MIXED cohort (11,094) and exceeds the pure proxies' longest
+  // (2,153), with 334 mixed users exceeding 50. There is no per-request
+  // threshold, so enforcement needs an account-level verdict this function
+  // cannot see. Note also that these requests all already reproduce our
+  // canonical root system prompt at position 0 — `requestHasAnvilSystemMarker`
+  // rejects root requests that do not — so the prompt is not a discriminator
+  // either.
+  if (isRootAgent) {
+    return {
+      signal: 'root_agent_no_tools',
+      toolCount: 0,
+      sampleToolNames,
+    }
+  }
+
+  // Only reached when no tools were offered at all, so this can never override
+  // the carve-out above.
+  //
+  // `!= null` deliberately, not `!== undefined`: a client that serializes its
+  // whole request sends `"temperature": null` rather than omitting the key, and
+  // that is unset, not a choice. Treating it as set downgraded every such
+  // caller. This matches how the rest of the request path already reads these
+  // fields — see `applyOpenRouterDefaultMaxTokens`, which gates on
+  // `body.max_tokens != null` for the same reason.
+  const setsSamplingParams =
+    body.temperature != null ||
+    body.top_p != null ||
+    body.max_tokens != null ||
+    body.max_completion_tokens != null
+  return {
+    signal: setsSamplingParams ? 'sampling_params' : null,
+    toolCount: 0,
+    sampleToolNames,
+  }
+}
+
+export type ForeignClientDecision = ForeignClientVerdict & {
+  signal: ForeignClientSignal
+  /** The model to serve instead, or null to serve what was requested. */
+  downgradeTo: string | null
+}
+
+/**
+ * Detect, then decide whether the signal changes what is served.
+ *
+ * `foreign_toolset` downgrades. Using a third-party client against this
+ * endpoint is a terms violation, not a grey area: Anvil funds free
+ * inference with ads that only our own clients render, so a proxied request
+ * takes the cost and returns none of the revenue.
+ *
+ * The other two are reported but never enforced, both because they fire on our
+ * own traffic:
+ *
+ *  - `sampling_params` — 568 requests / 13 users on
+ *    `code-reviewer-deepseek-flash` in a 24h sample, plus the CLI's own
+ *    free-mode shape, which sends `max_completion_tokens` with no tools. It
+ *    now only reports NON-root agents: `root_agent_no_tools` is checked first,
+ *    so the 8,884 requests / 395 users this used to cite on
+ *    `base2-free-deepseek-flash` classify under that signal instead. Neither
+ *    enforces, so the reclassification changes measurement, not behavior.
+ *  - `root_agent_no_tools` — 3,729 users who also do real agentic work, 999 of
+ *    whose sessions mix it with tool-bearing root calls. See the backtest in
+ *    `detectForeignAnvilClient`. Catching the 417 genuine proxies inside
+ *    that population needs an account-level verdict, not a per-request one.
+ *
+ * They stay as measurements, which is what makes the account-level rule
+ * buildable later without guessing at its blast radius.
+ */
+export function resolveForeignClientDowngrade(params: {
+  body: InspectableRequest & { model?: unknown }
+  isRootAgent?: boolean
+}): ForeignClientDecision | null {
+  const { body, isRootAgent = false } = params
+  const verdict = detectForeignAnvilClient(body, isRootAgent)
+  if (!verdict.signal) return null
+
+  return {
+    ...verdict,
+    signal: verdict.signal,
+    // Never downgrade something already on the downgrade model: that would be
+    // a no-op write that still reads as an enforcement in the logs.
+    downgradeTo:
+      verdict.signal === 'foreign_toolset' &&
+      body.model !== ANVIL_DOWNGRADE_MODEL_ID
+        ? ANVIL_DOWNGRADE_MODEL_ID
+        : null,
+  }
+}