@aragon-agent/cli 0.5.6 → 0.5.9

package/dist/config/store.js

@@ -14,7 +14,7 @@ import { dirname } from 'node:path';
 import process from 'node:process';
 import { getConfigPath, getSessionsDir } from './app-paths.js';
 import { registerSecretsFrom } from '../logging/secret-registry.js';
-import { CONFIG_VERSION, DEFAULT_CONFIG, clampLogConfig, clampMaxTokens, clampSkillsConfig, clampTeamConfig, clampTodoConfig, isAutoToken, stripLegacyStateKeys, } from './schema.js';
+import { CONFIG_VERSION, DEFAULT_CONFIG, clampFastConfig, clampLogConfig, clampMaxTokens, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, isAutoToken, stripLegacyStateKeys, } from './schema.js';
 /**
  * Normalize `maxTokens` for both directions of the config file.
  *
@@ -126,6 +126,14 @@ export function loadPersistedConfig() {
         // the READ half of the pair that keeps `/todo panel off` from silently
         // unregistering the tool on the next launch (P0-1 / AC-35).
         todo: clampTodoConfig({ ...DEFAULT_CONFIG.todo, ...(partial.todo ?? {}) }),
+        // `retry` is the sixth. The READ half: without it a config file with no
+        // `retry` key yields `undefined` and `toRetryPolicy` throws on the value it
+        // is handed (R-9 / AC-20).
+        retry: clampRetryConfig({ ...DEFAULT_CONFIG.retry, ...(partial.retry ?? {}) }),
+        // `fast` is the seventh. Same one-level rule, same merge — and this is the
+        // READ half of the pair that keeps `/fast review 8` from silently switching
+        // the whole tier off on the next launch (C-3 / R-10).
+        fast: clampFastConfig({ ...DEFAULT_CONFIG.fast, ...(partial.fast ?? {}) }),
     };
 }
 /**
@@ -177,6 +185,17 @@ export function updatePersistedConfig(patch) {
         // spread turns into "turning the panel off silently unregisters the tool",
         // permanently, from the next launch onward, with nothing anywhere saying so.
         todo: clampTodoConfig({ ...current.todo, ...(patch.todo ?? {}) }),
+        // The sixth section. `/retry max 5` sends `{ retry: { maxRetries: 5 } }`,
+        // which a shallow spread turns into "changing the retry count silently
+        // reverted `respectRetryAfter` and `jitter`" (R-9 / AC-19).
+        retry: clampRetryConfig({ ...current.retry, ...(patch.retry ?? {}) }),
+        // The seventh section, and THE WRITE HALF IS THE ONE THAT BITES (R-10).
+        // `/fast review 8` sends `{ fast: { reviewEveryTurns: 8 } }`; without this
+        // line the shallow top-level spread REPLACES the section, `enabled` is
+        // written absent, and the tier the user configured yesterday is gone
+        // tomorrow with no error anywhere. This package has paid for that once
+        // already, in `todo` (P0-1).
+        fast: clampFastConfig({ ...current.fast, ...(patch.fast ?? {}) }),
     };
     writeConfigFile(merged);
     return merged;

package/dist/fast/critique.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `normalizeCritique` — turn whatever the fast model wrote into one of three
+ * outcomes (fast-model-tier §3.5.3). PURE: no I/O, no state.
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope.
+ */
+/**
+ * What a review amounted to.
+ *
+ * `ok` and `empty` are NOT INJECTED (D-16). They still produce a transcript
+ * entry and a log record, so the user can see the harness is alive, but the lead
+ * pays no context for the message "nothing to say".
+ */
+export type Critique = {
+    kind: 'ok';
+} | {
+    kind: 'advice';
+    text: string;
+} | {
+    kind: 'empty';
+};
+/**
+ * THE ON-TRACK TEST IS A NORMALIZED REGEX, NEVER STRING EQUALITY (D-17).
+ *
+ * The system prompt asks for the exact string `OK - on track.`, and models
+ * mostly comply - but one that writes `Ok, on track` would, under an equality
+ * test, be classified as ADVICE and injected into the main context on every
+ * cycle, forever, saying nothing. That is worse than having no reviewer: it is a
+ * permanent context tax that looks like the feature working.
+ *
+ * So: trim, lowercase, drop trailing punctuation, then `/^ok\b.*on track/`.
+ * `'OK, but the tests are failing'` still classifies as advice, because it does
+ * not say "on track".
+ */
+export declare function isOnTrack(text: string): boolean;
+/**
+ * Normalize and classify one raw review answer.
+ *
+ * @param raw      Whatever the model returned.
+ * @param maxChars `fast.reviewMaxChars` — the ceiling the user chose on how much
+ *                 of their own context a critique may spend.
+ */
+export declare function normalizeCritique(raw: string, maxChars: number): Critique;

package/dist/fast/critique.js

@@ -0,0 +1,62 @@
+/**
+ * `normalizeCritique` — turn whatever the fast model wrote into one of three
+ * outcomes (fast-model-tier §3.5.3). PURE: no I/O, no state.
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope.
+ */
+/** Strip a fenced code block wrapper the model may have put around its prose. */
+function stripFences(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed.startsWith('```'))
+        return trimmed;
+    const withoutOpen = trimmed.replace(/^```[a-zA-Z0-9_-]*\s*\r?\n?/, '');
+    return withoutOpen.replace(/\r?\n?```\s*$/, '').trim();
+}
+/**
+ * THE ON-TRACK TEST IS A NORMALIZED REGEX, NEVER STRING EQUALITY (D-17).
+ *
+ * The system prompt asks for the exact string `OK - on track.`, and models
+ * mostly comply - but one that writes `Ok, on track` would, under an equality
+ * test, be classified as ADVICE and injected into the main context on every
+ * cycle, forever, saying nothing. That is worse than having no reviewer: it is a
+ * permanent context tax that looks like the feature working.
+ *
+ * So: trim, lowercase, drop trailing punctuation, then `/^ok\b.*on track/`.
+ * `'OK, but the tests are failing'` still classifies as advice, because it does
+ * not say "on track".
+ */
+export function isOnTrack(text) {
+    const normalized = text
+        .trim()
+        .toLowerCase()
+        .replace(/[.!\s]+$/, '')
+        .replace(/\s+/g, ' ');
+    return /^ok\b.*on track/.test(normalized);
+}
+/**
+ * Normalize and classify one raw review answer.
+ *
+ * @param raw      Whatever the model returned.
+ * @param maxChars `fast.reviewMaxChars` — the ceiling the user chose on how much
+ *                 of their own context a critique may spend.
+ */
+export function normalizeCritique(raw, maxChars) {
+    const stripped = stripFences(raw ?? '');
+    // Whitespace is collapsed BEFORE the length test: a model that answers with
+    // four blank lines and a sentence must not spend its budget on the blanks.
+    const collapsed = stripped.replace(/\s+/g, ' ').trim();
+    if (collapsed.length === 0)
+        return { kind: 'empty' };
+    if (isOnTrack(collapsed))
+        return { kind: 'ok' };
+    const limit = Math.max(1, Math.floor(maxChars) || 1);
+    if (collapsed.length <= limit)
+        return { kind: 'advice', text: collapsed };
+    // Clamp on a word boundary when one is close enough that the sentence still
+    // reads; otherwise a hard cut, because a critique is prose and a mid-word
+    // truncation is what makes advice look like corruption.
+    const cut = collapsed.slice(0, limit);
+    const space = cut.lastIndexOf(' ');
+    const text = space > limit * 0.6 ? cut.slice(0, space) : cut;
+    return { kind: 'advice', text };
+}

package/dist/fast/digest.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `buildReviewDigest` — the bounded text one review is asked about
+ * (fast-model-tier §3.5.2). PURE: no I/O, no clock, no state.
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope.
+ *
+ * THE REVIEWER NEVER READS `agent.state.messages`, AND THAT IS THE SINGLE MOST
+ * IMPORTANT ECONOMIC DECISION IN THE FEATURE (D-6 / R-2). That history holds
+ * whole file bodies: a session that has read four 60 KB files carries 240 KB of
+ * them. Shipping it to the "cheap" model to ask whether the run is on track
+ * would make a review cost MORE than the main-model turn it is reviewing - the
+ * exact inversion this feature exists to prevent. The digest is bounded at
+ * `FAST_LIMITS.digestMaxChars` BY CONSTRUCTION, so a review's input cost is flat
+ * regardless of session length.
+ *
+ * Anyone tempted to "just pass the messages, the model has the context anyway"
+ * is about to turn a 400-token call into a 60 000-token one, and nothing in the
+ * UI would show it except the bill.
+ */
+import type { TurnFrame } from './types.js';
+export interface ReviewDigestParams {
+    /** The reviewer's ring buffer, oldest first. */
+    frames: TurnFrame[];
+    /** The user's request for this run, already clamped by the caller. */
+    goal: string;
+    /** `fast.reviewContextTurns` — how many SEALED frames to include. */
+    contextTurns: number;
+}
+/**
+ * Build the digest.
+ *
+ * SEALED FRAMES ONLY (RV-2 / D-22). The turn being reviewed is sealed by
+ * definition - sealing is what triggered the review - so the window is the
+ * newest `contextTurns` sealed frames, and a frame that is still accumulating is
+ * never half-rendered into a prompt.
+ *
+ * NEWEST FRAMES SURVIVE THE BOUND. When the assembled text exceeds
+ * `digestMaxChars` the OLDEST frame is dropped and the document is rebuilt,
+ * because the reviewer's question is about what just happened. Trimming from the
+ * tail would hand it the beginning of a run and ask about the end of one.
+ */
+export declare function buildReviewDigest(params: ReviewDigestParams): string;

package/dist/fast/digest.js

@@ -0,0 +1,85 @@
+/**
+ * `buildReviewDigest` — the bounded text one review is asked about
+ * (fast-model-tier §3.5.2). PURE: no I/O, no clock, no state.
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope.
+ *
+ * THE REVIEWER NEVER READS `agent.state.messages`, AND THAT IS THE SINGLE MOST
+ * IMPORTANT ECONOMIC DECISION IN THE FEATURE (D-6 / R-2). That history holds
+ * whole file bodies: a session that has read four 60 KB files carries 240 KB of
+ * them. Shipping it to the "cheap" model to ask whether the run is on track
+ * would make a review cost MORE than the main-model turn it is reviewing - the
+ * exact inversion this feature exists to prevent. The digest is bounded at
+ * `FAST_LIMITS.digestMaxChars` BY CONSTRUCTION, so a review's input cost is flat
+ * regardless of session length.
+ *
+ * Anyone tempted to "just pass the messages, the model has the context anyway"
+ * is about to turn a 400-token call into a 60 000-token one, and nothing in the
+ * UI would show it except the bill.
+ */
+import { FAST_LIMITS } from './limits.js';
+/** Clip to `maxChars` on a word boundary when one is close enough to matter. */
+function clip(text, maxChars) {
+    if (text.length <= maxChars)
+        return text;
+    const cut = text.slice(0, maxChars);
+    const space = cut.lastIndexOf(' ');
+    return space > maxChars * 0.6 ? cut.slice(0, space) : cut;
+}
+/** One tool as the digest names it: `read_file(src/app.ts) 12ms`. */
+function renderTool(tool) {
+    const arg = tool.arg ? `(${clip(tool.arg, FAST_LIMITS.toolArgChars)})` : '';
+    const failed = tool.isError ? ' FAILED' : '';
+    const ms = tool.ms === undefined ? '' : ` ${Math.round(tool.ms)}ms`;
+    return `${tool.name}${arg}${failed}${ms}`;
+}
+function renderFrame(frame) {
+    const lines = [`Turn ${frame.index}:`];
+    if (frame.tools.length > 0) {
+        lines.push(`  tools: ${frame.tools.map(renderTool).join(', ')}`);
+    }
+    else {
+        lines.push('  tools: (none)');
+    }
+    if (frame.error)
+        lines.push(`  error: ${clip(frame.error, 200)}`);
+    const tail = frame.textTail.trim();
+    if (tail.length > 0)
+        lines.push(`  said: ${clip(tail, FAST_LIMITS.turnTailChars)}`);
+    return lines;
+}
+/**
+ * Build the digest.
+ *
+ * SEALED FRAMES ONLY (RV-2 / D-22). The turn being reviewed is sealed by
+ * definition - sealing is what triggered the review - so the window is the
+ * newest `contextTurns` sealed frames, and a frame that is still accumulating is
+ * never half-rendered into a prompt.
+ *
+ * NEWEST FRAMES SURVIVE THE BOUND. When the assembled text exceeds
+ * `digestMaxChars` the OLDEST frame is dropped and the document is rebuilt,
+ * because the reviewer's question is about what just happened. Trimming from the
+ * tail would hand it the beginning of a run and ask about the end of one.
+ */
+export function buildReviewDigest(params) {
+    const sealed = params.frames.filter((f) => f.sealed);
+    const want = Math.max(1, Math.floor(params.contextTurns) || 1);
+    let window = sealed.slice(-want);
+    const goal = clip(params.goal.trim(), FAST_LIMITS.goalChars);
+    const assemble = (frames) => [
+        `Goal: ${goal.length > 0 ? goal : '(not captured)'}`,
+        '',
+        ...frames.flatMap(renderFrame),
+    ].join('\n');
+    let out = assemble(window);
+    while (out.length > FAST_LIMITS.digestMaxChars && window.length > 1) {
+        window = window.slice(1);
+        out = assemble(window);
+    }
+    // A single frame can still be over budget on its own (a 600-char tail plus
+    // twelve tools), so the hard clamp is unconditional. It is a CEILING, not the
+    // trimming strategy: the loop above is what decides WHAT is lost.
+    return out.length > FAST_LIMITS.digestMaxChars
+        ? out.slice(0, FAST_LIMITS.digestMaxChars)
+        : out;
+}

package/dist/fast/frames.d.ts

@@ -0,0 +1,99 @@
+/**
+ * TurnFrameRing — the reviewer's bounded record of what the lead just did
+ * (fast-model-tier §3.5.1, extracted here by fast-model-tier-hardening W3).
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope.
+ *
+ * THIS IS THE `data` HALF OF THE SPLIT, AND IT IS A LEAF ON PURPOSE. `reviewer.ts`
+ * was at 871 of the repo's 1 000-line cap before round 2 added a budget to it, so
+ * the ring and the transport moved out. The split line is drawn along data and
+ * transport BECAUSE BOTH ARE LEAVES: the protocol — the two drain guards and the
+ * call-cancellation stamping — stays whole in `reviewer.ts`, where a module
+ * boundary through it would reopen a P0 (§3.3 / AC-H11 / AC-H16).
+ *
+ * WHAT THIS CLASS OWNS: the open frame, the retired ring, the outstanding-call
+ * counter and the tool-argument map. WHAT IT DECIDES: nothing. It reports that a
+ * batch has emptied; the caller decides what that means.
+ */
+import type { AssistantMessage, StreamEvent } from '@aragon-agent/core';
+import type { TurnFrame } from './types.js';
+export interface TurnFrameRingDeps {
+    /**
+     * Whether a frame can still be consumed by a review this run.
+     *
+     * A PREDICATE, NOT A BOOLEAN, and read inside `recordDelta` rather than at its
+     * call site: this runs on every `text_delta` of every turn, and evaluating the
+     * caller's gate eagerly would move a config read onto the hottest path in the
+     * package for the deltas that are discarded by type anyway.
+     */
+    canRecord(): boolean;
+}
+export declare class TurnFrameRing {
+    private readonly deps;
+    private retained;
+    private open;
+    /**
+     * Tool calls still to run in the current batch.
+     *
+     * ASSIGNED at `turn_end`, NEVER CARRIED ACROSS TURNS (RV-7), and the
+     * difference is not cosmetic. Two paths end a batch without emitting a
+     * `tool_execution_end` for every call: checkpoint 2 skips the whole batch
+     * (`agent-loop.ts:199-207`) and an abort breaks out mid-batch (`:211`). A
+     * counter that only ever decremented would sit permanently above zero after
+     * either, and the injection window would never open again for the rest of the
+     * run. Re-assigning at each `turn_end` makes both cases self-heal on the next
+     * turn, which is correct: those batches genuinely had no window.
+     */
+    private outstanding;
+    private completedTurns;
+    /** Tool args captured at `tool_execution_start`, keyed by call id. */
+    private readonly toolArgs;
+    constructor(deps: TurnFrameRingDeps);
+    /** Completed turns of the CURRENT run — the cadence and staleness clock. */
+    get turns(): number;
+    /** Always 0 at the injection window; logged there as the assertion, recorded. */
+    get outstandingCalls(): number;
+    /** The ring, oldest first. `buildReviewDigest` filters it for sealed frames. */
+    frames(): TurnFrame[];
+    /** `agent_start`. */
+    reset(): void;
+    /** `agent_end` — the ring survives for a late answer; the open frame does not. */
+    endRun(): void;
+    /** `turn_start`. */
+    beginTurn(): void;
+    /**
+     * The frame recorder.
+     *
+     * GATED ON `text_delta` AS AN ALLOW-TEST, NEVER A DENY-LIST (RV-10 / R-16).
+     * `agent-loop.ts:170` forwards EVERY stream event through `message_update` -
+     * `text_delta`, `thinking_delta`, `tool_call_delta`, `done`, and (as of
+     * `llm-api-retry-backoff`) `retry_scheduled` / `retry_attempt` - so this is a
+     * synchronous listener on the hottest path in the package. A deny-list would
+     * have silently started recording the two new members the moment they shipped.
+     *
+     * The remaining conditions are economic rather than structural: after the last
+     * permitted review of a run there is nothing left that can consume a frame.
+     */
+    recordDelta(streamEvent: StreamEvent): void;
+    /** `tool_execution_start`. */
+    noteToolArgs(toolCallId: string, args: unknown): void;
+    /** `turn_end`. A turn with NO tool calls ends the run, so its frame seals here. */
+    endTurn(message: AssistantMessage): void;
+    /**
+     * `tool_execution_end`. Returns whether this call EMPTIED the batch — which is
+     * both the sealing point (§3.5.1) and the one injection window (§3.5.4). The
+     * ring reports the fact; `reviewer.ts` owns what follows from it.
+     */
+    endTool(toolCallId: string, toolName: string, isError: boolean, duration: number): boolean;
+    /**
+     * Seal the open frame and retire it into the ring.
+     *
+     * A REVIEW IS TRIGGERED ON SEALING, NOT AT `turn_end` (RV-2 / D-22).
+     * `turn_end` fires at `agent-loop.ts:188`, BEFORE any tool runs, while
+     * `TurnFrame.tools` carries `isError` and `ms` - fields that exist only once
+     * `tool_execution_end` has been emitted (`:249-256`). Triggering there meant
+     * the newest frame of every digest was structurally missing the single fact a
+     * reviewer most needs: whether the batch it is reviewing just failed.
+     */
+    seal(): void;
+}

package/dist/fast/frames.js

@@ -0,0 +1,180 @@
+/**
+ * TurnFrameRing — the reviewer's bounded record of what the lead just did
+ * (fast-model-tier §3.5.1, extracted here by fast-model-tier-hardening W3).
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope.
+ *
+ * THIS IS THE `data` HALF OF THE SPLIT, AND IT IS A LEAF ON PURPOSE. `reviewer.ts`
+ * was at 871 of the repo's 1 000-line cap before round 2 added a budget to it, so
+ * the ring and the transport moved out. The split line is drawn along data and
+ * transport BECAUSE BOTH ARE LEAVES: the protocol — the two drain guards and the
+ * call-cancellation stamping — stays whole in `reviewer.ts`, where a module
+ * boundary through it would reopen a P0 (§3.3 / AC-H11 / AC-H16).
+ *
+ * WHAT THIS CLASS OWNS: the open frame, the retired ring, the outstanding-call
+ * counter and the tool-argument map. WHAT IT DECIDES: nothing. It reports that a
+ * batch has emptied; the caller decides what that means.
+ */
+import { FAST_LIMITS } from './limits.js';
+// The one `unknown -> text` helper of this tree lives with the module that
+// classifies errors. A second copy here would be a second answer to one question.
+import { errorText } from './review-call.js';
+/** The one argument a tool call is worth naming in a digest. */
+function pickToolArg(args) {
+    const a = (args ?? {});
+    for (const key of ['path', 'pattern', 'command', 'query', 'label']) {
+        const value = a[key];
+        if (typeof value === 'string' && value.length > 0) {
+            return value.slice(0, FAST_LIMITS.toolArgChars);
+        }
+    }
+    return undefined;
+}
+export class TurnFrameRing {
+    deps;
+    retained = [];
+    open = null;
+    /**
+     * Tool calls still to run in the current batch.
+     *
+     * ASSIGNED at `turn_end`, NEVER CARRIED ACROSS TURNS (RV-7), and the
+     * difference is not cosmetic. Two paths end a batch without emitting a
+     * `tool_execution_end` for every call: checkpoint 2 skips the whole batch
+     * (`agent-loop.ts:199-207`) and an abort breaks out mid-batch (`:211`). A
+     * counter that only ever decremented would sit permanently above zero after
+     * either, and the injection window would never open again for the rest of the
+     * run. Re-assigning at each `turn_end` makes both cases self-heal on the next
+     * turn, which is correct: those batches genuinely had no window.
+     */
+    outstanding = 0;
+    completedTurns = 0;
+    /** Tool args captured at `tool_execution_start`, keyed by call id. */
+    toolArgs = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Completed turns of the CURRENT run — the cadence and staleness clock. */
+    get turns() {
+        return this.completedTurns;
+    }
+    /** Always 0 at the injection window; logged there as the assertion, recorded. */
+    get outstandingCalls() {
+        return this.outstanding;
+    }
+    /** The ring, oldest first. `buildReviewDigest` filters it for sealed frames. */
+    frames() {
+        return this.retained;
+    }
+    /** `agent_start`. */
+    reset() {
+        this.retained = [];
+        this.open = null;
+        this.outstanding = 0;
+        this.completedTurns = 0;
+        this.toolArgs.clear();
+    }
+    /** `agent_end` — the ring survives for a late answer; the open frame does not. */
+    endRun() {
+        this.open = null;
+        this.toolArgs.clear();
+    }
+    /** `turn_start`. */
+    beginTurn() {
+        this.open = {
+            index: this.completedTurns + 1,
+            textTail: '',
+            tools: [],
+            sealed: false,
+        };
+    }
+    /**
+     * The frame recorder.
+     *
+     * GATED ON `text_delta` AS AN ALLOW-TEST, NEVER A DENY-LIST (RV-10 / R-16).
+     * `agent-loop.ts:170` forwards EVERY stream event through `message_update` -
+     * `text_delta`, `thinking_delta`, `tool_call_delta`, `done`, and (as of
+     * `llm-api-retry-backoff`) `retry_scheduled` / `retry_attempt` - so this is a
+     * synchronous listener on the hottest path in the package. A deny-list would
+     * have silently started recording the two new members the moment they shipped.
+     *
+     * The remaining conditions are economic rather than structural: after the last
+     * permitted review of a run there is nothing left that can consume a frame.
+     */
+    recordDelta(streamEvent) {
+        if (streamEvent.type === 'error') {
+            if (this.open)
+                this.open.error = errorText(streamEvent.error);
+            return;
+        }
+        if (streamEvent.type !== 'text_delta')
+            return;
+        if (!this.open)
+            return;
+        if (!this.deps.canRecord())
+            return;
+        const delta = streamEvent.delta;
+        if (delta.length === 0)
+            return;
+        // O(1) per delta: one bounded concat and one bounded slice, the same rolling
+        // tail `subagent.ts:392` already uses for the activity line.
+        this.open.textTail = (this.open.textTail + delta).slice(-FAST_LIMITS.turnTailChars);
+    }
+    /** `tool_execution_start`. */
+    noteToolArgs(toolCallId, args) {
+        const arg = pickToolArg(args);
+        if (arg !== undefined)
+            this.toolArgs.set(toolCallId, arg);
+    }
+    /** `turn_end`. A turn with NO tool calls ends the run, so its frame seals here. */
+    endTurn(message) {
+        this.completedTurns += 1;
+        const calls = Array.isArray(message?.content)
+            ? message.content.filter((b) => b.type === 'tool_call').length
+            : 0;
+        this.outstanding = calls;
+        if (this.open)
+            this.open.index = this.completedTurns;
+        if (calls === 0)
+            this.seal();
+    }
+    /**
+     * `tool_execution_end`. Returns whether this call EMPTIED the batch — which is
+     * both the sealing point (§3.5.1) and the one injection window (§3.5.4). The
+     * ring reports the fact; `reviewer.ts` owns what follows from it.
+     */
+    endTool(toolCallId, toolName, isError, duration) {
+        if (this.open) {
+            const arg = this.toolArgs.get(toolCallId);
+            this.open.tools.push({
+                name: toolName,
+                ...(arg !== undefined ? { arg } : {}),
+                ...(isError ? { isError: true } : {}),
+                ms: duration,
+            });
+        }
+        this.toolArgs.delete(toolCallId);
+        if (this.outstanding > 0)
+            this.outstanding -= 1;
+        return this.outstanding === 0;
+    }
+    /**
+     * Seal the open frame and retire it into the ring.
+     *
+     * A REVIEW IS TRIGGERED ON SEALING, NOT AT `turn_end` (RV-2 / D-22).
+     * `turn_end` fires at `agent-loop.ts:188`, BEFORE any tool runs, while
+     * `TurnFrame.tools` carries `isError` and `ms` - fields that exist only once
+     * `tool_execution_end` has been emitted (`:249-256`). Triggering there meant
+     * the newest frame of every digest was structurally missing the single fact a
+     * reviewer most needs: whether the batch it is reviewing just failed.
+     */
+    seal() {
+        if (!this.open || this.open.sealed)
+            return;
+        this.open.sealed = true;
+        this.retained.push(this.open);
+        if (this.retained.length > FAST_LIMITS.maxFramesRetained) {
+            this.retained.splice(0, this.retained.length - FAST_LIMITS.maxFramesRetained);
+        }
+        this.open = null;
+    }
+}

package/dist/fast/limits.d.ts

@@ -0,0 +1,98 @@
+/**
+ * FAST_LIMITS — the single authority on every bound the fast tier enforces
+ * (fast-model-tier §5.5).
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope
+ * (`glyphs.test.ts`), so no literal in this tree may hold a non-ASCII byte. The
+ * regex there is a hardcoded directory list, which is why adding this tree and
+ * adding `fast` to that list are the SAME change (C-4 / AC-27) - a scanner that
+ * silently stops scanning is worse than no scanner.
+ *
+ * TWO KINDS OF NUMBER, AND THEY ARE NOT INTERCHANGEABLE - the distinction
+ * `TEAM_LIMITS` and `TODO_LIMITS` both state:
+ *
+ *  - The entries below are STRUCTURAL. They describe what a review call, a
+ *    digest and a card can physically carry. A user has no business tuning them.
+ *  - The ten `fast.*` keys in `config/schema.ts` are POLICY: which model, how
+ *    often, how long a critique may be. Those are clamped, persisted and
+ *    user-facing.
+ *
+ * `reviewMaxChars` therefore lives in the CONFIG and not here: it is the one
+ * number whose right value depends on how much of their own context the user is
+ * willing to spend on advice. `reviewOutputTokens` stays here because 512 tokens
+ * is a bound on a protocol, not a preference.
+ */
+export declare const FAST_LIMITS: {
+    /**
+     * The flat input cost of one review (D-6 / R-2).
+     *
+     * THIS NUMBER IS THE WHOLE ECONOMIC ARGUMENT. The reviewer builds its own
+     * bounded frame ring and never reads `agent.state.messages`, which after four
+     * 60 KB file reads carries 240 KB of file bodies; shipping that to the "cheap"
+     * model would make a review cost MORE than the turn it is reviewing.
+     */
+    readonly digestMaxChars: 4000;
+    /** The user's request for the run, clamped. Without it the reviewer is asked
+     *  whether work is on track without being told what the track is. */
+    readonly goalChars: 500;
+    /** Per-frame assistant-text tail. Rolling, clipped on every append. */
+    readonly turnTailChars: 600;
+    /** Per picked tool argument. Mirrors `TEAM_LIMITS.activityArgChars`. */
+    readonly toolArgChars: 120;
+    /** Frames kept per run. `>=` the max of `reviewContextTurns`, with slack. */
+    readonly maxFramesRetained: 12;
+    /** Hard cap on the review's own output. */
+    readonly reviewOutputTokens: 512;
+    /**
+     * Wall-clock budget for ONE review call INCLUDING RETRIES (D-H11).
+     *
+     * THE BUDGET HAS TWO TERMS AND ONLY ONE OF THEM SHRANK. Round 1 set 30 s as
+     * IF-3's fallback: `ProviderRegistry.complete()` routed through a retrying
+     * `stream()` with `maxRetries: 10`, so the budget covered
+     * `attempts x (call + backoff)`. Round 2 gives the reviewer its own
+     * `maxRetries: 1` registry (`wiring.ts`), which collapses that term to about
+     * one call plus a one-second backoff - but it does nothing at all to the
+     * other term, THE FAST MODEL'S OWN GENERATION LATENCY. The review asks for up
+     * to `reviewOutputTokens` from a `digestMaxChars` prompt, and the tier is by
+     * construction pointed at the cheapest endpoint the user has: the population
+     * where a 15-25 s completion is ordinary rather than pathological.
+     *
+     * SO THIS IS 20 000 AND NOT 12 000. A timeout IS a strike (see `runReview`),
+     * and `maxConsecutiveFailures` is 3, so a 12 s bound would convert "slow but
+     * healthy provider" into a tier that self-disables for the session and
+     * reports itself as MISCONFIGURED - the one register D-24 reserves for faults
+     * that never self-heal, spent on one that does. 20 s keeps a margin over a
+     * slow completion and still cuts a stuck review's occupancy of the
+     * single-flight slot by a third. Lower it only with a measured p99, which
+     * `manual-test.md` row 6 exists to produce.
+     */
+    readonly reviewTimeoutMs: 20000;
+    /** Reviews STARTED per run. A 40-turn run at cadence 5 would otherwise buy 8
+     *  critiques the lead increasingly ignores. */
+    readonly maxReviewsPerRun: 6;
+    /** Consecutive NON-TRANSIENT failures before the reviewer self-disables. */
+    readonly maxConsecutiveFailures: 3;
+    /**
+     * A critique waiting for its injection window goes stale (RV-12).
+     *
+     * The window is not guaranteed to be prompt: one `task` dispatch is a single
+     * tool call that can run for `team.dispatchTimeoutMs`, so a critique triggered
+     * just before one arrives at the far side describing a state five children
+     * have since rewritten. Advice that is merely late is worse than no advice,
+     * because the lead cannot tell that it is late.
+     */
+    readonly pendingMaxAgeMs: 120000;
+    /** ... or is overtaken by the run itself, in turns. */
+    readonly pendingMaxTurnsBehind: 2;
+    /** Rows the transcript card renders before eliding. */
+    readonly cardTextRows: 4;
+    /** Below this many columns the status chip drops (D-20's treatment, not
+     *  `agentMode`'s - the guaranteed reporting surface is `/fast status`). */
+    readonly statusCompactCols: 100;
+};
+/**
+ * Bumped whenever the wording of `<fast_tier>` or the review system prompt
+ * changes, so a behaviour report can be tied to a block revision with one grep -
+ * exactly what `TEAM_BLOCK_VERSION` and `TODO_BLOCK_VERSION` are for.
+ */
+export declare const FAST_BLOCK_VERSION = "v1-2026-07";