@aragon-agent/cli 0.5.8 → 0.5.10

package/dist/fast/frames.d.ts

@@ -0,0 +1,99 @@
+/**
+ * TurnFrameRing — the reviewer's bounded record of what the lead just did
+ * (fast-model-tier §3.5.1, extracted here by fast-model-tier-hardening W3).
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope.
+ *
+ * THIS IS THE `data` HALF OF THE SPLIT, AND IT IS A LEAF ON PURPOSE. `reviewer.ts`
+ * was at 871 of the repo's 1 000-line cap before round 2 added a budget to it, so
+ * the ring and the transport moved out. The split line is drawn along data and
+ * transport BECAUSE BOTH ARE LEAVES: the protocol — the two drain guards and the
+ * call-cancellation stamping — stays whole in `reviewer.ts`, where a module
+ * boundary through it would reopen a P0 (§3.3 / AC-H11 / AC-H16).
+ *
+ * WHAT THIS CLASS OWNS: the open frame, the retired ring, the outstanding-call
+ * counter and the tool-argument map. WHAT IT DECIDES: nothing. It reports that a
+ * batch has emptied; the caller decides what that means.
+ */
+import type { AssistantMessage, StreamEvent } from '@aragon-agent/core';
+import type { TurnFrame } from './types.js';
+export interface TurnFrameRingDeps {
+    /**
+     * Whether a frame can still be consumed by a review this run.
+     *
+     * A PREDICATE, NOT A BOOLEAN, and read inside `recordDelta` rather than at its
+     * call site: this runs on every `text_delta` of every turn, and evaluating the
+     * caller's gate eagerly would move a config read onto the hottest path in the
+     * package for the deltas that are discarded by type anyway.
+     */
+    canRecord(): boolean;
+}
+export declare class TurnFrameRing {
+    private readonly deps;
+    private retained;
+    private open;
+    /**
+     * Tool calls still to run in the current batch.
+     *
+     * ASSIGNED at `turn_end`, NEVER CARRIED ACROSS TURNS (RV-7), and the
+     * difference is not cosmetic. Two paths end a batch without emitting a
+     * `tool_execution_end` for every call: checkpoint 2 skips the whole batch
+     * (`agent-loop.ts:199-207`) and an abort breaks out mid-batch (`:211`). A
+     * counter that only ever decremented would sit permanently above zero after
+     * either, and the injection window would never open again for the rest of the
+     * run. Re-assigning at each `turn_end` makes both cases self-heal on the next
+     * turn, which is correct: those batches genuinely had no window.
+     */
+    private outstanding;
+    private completedTurns;
+    /** Tool args captured at `tool_execution_start`, keyed by call id. */
+    private readonly toolArgs;
+    constructor(deps: TurnFrameRingDeps);
+    /** Completed turns of the CURRENT run — the cadence and staleness clock. */
+    get turns(): number;
+    /** Always 0 at the injection window; logged there as the assertion, recorded. */
+    get outstandingCalls(): number;
+    /** The ring, oldest first. `buildReviewDigest` filters it for sealed frames. */
+    frames(): TurnFrame[];
+    /** `agent_start`. */
+    reset(): void;
+    /** `agent_end` — the ring survives for a late answer; the open frame does not. */
+    endRun(): void;
+    /** `turn_start`. */
+    beginTurn(): void;
+    /**
+     * The frame recorder.
+     *
+     * GATED ON `text_delta` AS AN ALLOW-TEST, NEVER A DENY-LIST (RV-10 / R-16).
+     * `agent-loop.ts:170` forwards EVERY stream event through `message_update` -
+     * `text_delta`, `thinking_delta`, `tool_call_delta`, `done`, and (as of
+     * `llm-api-retry-backoff`) `retry_scheduled` / `retry_attempt` - so this is a
+     * synchronous listener on the hottest path in the package. A deny-list would
+     * have silently started recording the two new members the moment they shipped.
+     *
+     * The remaining conditions are economic rather than structural: after the last
+     * permitted review of a run there is nothing left that can consume a frame.
+     */
+    recordDelta(streamEvent: StreamEvent): void;
+    /** `tool_execution_start`. */
+    noteToolArgs(toolCallId: string, args: unknown): void;
+    /** `turn_end`. A turn with NO tool calls ends the run, so its frame seals here. */
+    endTurn(message: AssistantMessage): void;
+    /**
+     * `tool_execution_end`. Returns whether this call EMPTIED the batch — which is
+     * both the sealing point (§3.5.1) and the one injection window (§3.5.4). The
+     * ring reports the fact; `reviewer.ts` owns what follows from it.
+     */
+    endTool(toolCallId: string, toolName: string, isError: boolean, duration: number): boolean;
+    /**
+     * Seal the open frame and retire it into the ring.
+     *
+     * A REVIEW IS TRIGGERED ON SEALING, NOT AT `turn_end` (RV-2 / D-22).
+     * `turn_end` fires at `agent-loop.ts:188`, BEFORE any tool runs, while
+     * `TurnFrame.tools` carries `isError` and `ms` - fields that exist only once
+     * `tool_execution_end` has been emitted (`:249-256`). Triggering there meant
+     * the newest frame of every digest was structurally missing the single fact a
+     * reviewer most needs: whether the batch it is reviewing just failed.
+     */
+    seal(): void;
+}

package/dist/fast/frames.js

@@ -0,0 +1,180 @@
+/**
+ * TurnFrameRing — the reviewer's bounded record of what the lead just did
+ * (fast-model-tier §3.5.1, extracted here by fast-model-tier-hardening W3).
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope.
+ *
+ * THIS IS THE `data` HALF OF THE SPLIT, AND IT IS A LEAF ON PURPOSE. `reviewer.ts`
+ * was at 871 of the repo's 1 000-line cap before round 2 added a budget to it, so
+ * the ring and the transport moved out. The split line is drawn along data and
+ * transport BECAUSE BOTH ARE LEAVES: the protocol — the two drain guards and the
+ * call-cancellation stamping — stays whole in `reviewer.ts`, where a module
+ * boundary through it would reopen a P0 (§3.3 / AC-H11 / AC-H16).
+ *
+ * WHAT THIS CLASS OWNS: the open frame, the retired ring, the outstanding-call
+ * counter and the tool-argument map. WHAT IT DECIDES: nothing. It reports that a
+ * batch has emptied; the caller decides what that means.
+ */
+import { FAST_LIMITS } from './limits.js';
+// The one `unknown -> text` helper of this tree lives with the module that
+// classifies errors. A second copy here would be a second answer to one question.
+import { errorText } from './review-call.js';
+/** The one argument a tool call is worth naming in a digest. */
+function pickToolArg(args) {
+    const a = (args ?? {});
+    for (const key of ['path', 'pattern', 'command', 'query', 'label']) {
+        const value = a[key];
+        if (typeof value === 'string' && value.length > 0) {
+            return value.slice(0, FAST_LIMITS.toolArgChars);
+        }
+    }
+    return undefined;
+}
+export class TurnFrameRing {
+    deps;
+    retained = [];
+    open = null;
+    /**
+     * Tool calls still to run in the current batch.
+     *
+     * ASSIGNED at `turn_end`, NEVER CARRIED ACROSS TURNS (RV-7), and the
+     * difference is not cosmetic. Two paths end a batch without emitting a
+     * `tool_execution_end` for every call: checkpoint 2 skips the whole batch
+     * (`agent-loop.ts:199-207`) and an abort breaks out mid-batch (`:211`). A
+     * counter that only ever decremented would sit permanently above zero after
+     * either, and the injection window would never open again for the rest of the
+     * run. Re-assigning at each `turn_end` makes both cases self-heal on the next
+     * turn, which is correct: those batches genuinely had no window.
+     */
+    outstanding = 0;
+    completedTurns = 0;
+    /** Tool args captured at `tool_execution_start`, keyed by call id. */
+    toolArgs = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Completed turns of the CURRENT run — the cadence and staleness clock. */
+    get turns() {
+        return this.completedTurns;
+    }
+    /** Always 0 at the injection window; logged there as the assertion, recorded. */
+    get outstandingCalls() {
+        return this.outstanding;
+    }
+    /** The ring, oldest first. `buildReviewDigest` filters it for sealed frames. */
+    frames() {
+        return this.retained;
+    }
+    /** `agent_start`. */
+    reset() {
+        this.retained = [];
+        this.open = null;
+        this.outstanding = 0;
+        this.completedTurns = 0;
+        this.toolArgs.clear();
+    }
+    /** `agent_end` — the ring survives for a late answer; the open frame does not. */
+    endRun() {
+        this.open = null;
+        this.toolArgs.clear();
+    }
+    /** `turn_start`. */
+    beginTurn() {
+        this.open = {
+            index: this.completedTurns + 1,
+            textTail: '',
+            tools: [],
+            sealed: false,
+        };
+    }
+    /**
+     * The frame recorder.
+     *
+     * GATED ON `text_delta` AS AN ALLOW-TEST, NEVER A DENY-LIST (RV-10 / R-16).
+     * `agent-loop.ts:170` forwards EVERY stream event through `message_update` -
+     * `text_delta`, `thinking_delta`, `tool_call_delta`, `done`, and (as of
+     * `llm-api-retry-backoff`) `retry_scheduled` / `retry_attempt` - so this is a
+     * synchronous listener on the hottest path in the package. A deny-list would
+     * have silently started recording the two new members the moment they shipped.
+     *
+     * The remaining conditions are economic rather than structural: after the last
+     * permitted review of a run there is nothing left that can consume a frame.
+     */
+    recordDelta(streamEvent) {
+        if (streamEvent.type === 'error') {
+            if (this.open)
+                this.open.error = errorText(streamEvent.error);
+            return;
+        }
+        if (streamEvent.type !== 'text_delta')
+            return;
+        if (!this.open)
+            return;
+        if (!this.deps.canRecord())
+            return;
+        const delta = streamEvent.delta;
+        if (delta.length === 0)
+            return;
+        // O(1) per delta: one bounded concat and one bounded slice, the same rolling
+        // tail `subagent.ts:392` already uses for the activity line.
+        this.open.textTail = (this.open.textTail + delta).slice(-FAST_LIMITS.turnTailChars);
+    }
+    /** `tool_execution_start`. */
+    noteToolArgs(toolCallId, args) {
+        const arg = pickToolArg(args);
+        if (arg !== undefined)
+            this.toolArgs.set(toolCallId, arg);
+    }
+    /** `turn_end`. A turn with NO tool calls ends the run, so its frame seals here. */
+    endTurn(message) {
+        this.completedTurns += 1;
+        const calls = Array.isArray(message?.content)
+            ? message.content.filter((b) => b.type === 'tool_call').length
+            : 0;
+        this.outstanding = calls;
+        if (this.open)
+            this.open.index = this.completedTurns;
+        if (calls === 0)
+            this.seal();
+    }
+    /**
+     * `tool_execution_end`. Returns whether this call EMPTIED the batch — which is
+     * both the sealing point (§3.5.1) and the one injection window (§3.5.4). The
+     * ring reports the fact; `reviewer.ts` owns what follows from it.
+     */
+    endTool(toolCallId, toolName, isError, duration) {
+        if (this.open) {
+            const arg = this.toolArgs.get(toolCallId);
+            this.open.tools.push({
+                name: toolName,
+                ...(arg !== undefined ? { arg } : {}),
+                ...(isError ? { isError: true } : {}),
+                ms: duration,
+            });
+        }
+        this.toolArgs.delete(toolCallId);
+        if (this.outstanding > 0)
+            this.outstanding -= 1;
+        return this.outstanding === 0;
+    }
+    /**
+     * Seal the open frame and retire it into the ring.
+     *
+     * A REVIEW IS TRIGGERED ON SEALING, NOT AT `turn_end` (RV-2 / D-22).
+     * `turn_end` fires at `agent-loop.ts:188`, BEFORE any tool runs, while
+     * `TurnFrame.tools` carries `isError` and `ms` - fields that exist only once
+     * `tool_execution_end` has been emitted (`:249-256`). Triggering there meant
+     * the newest frame of every digest was structurally missing the single fact a
+     * reviewer most needs: whether the batch it is reviewing just failed.
+     */
+    seal() {
+        if (!this.open || this.open.sealed)
+            return;
+        this.open.sealed = true;
+        this.retained.push(this.open);
+        if (this.retained.length > FAST_LIMITS.maxFramesRetained) {
+            this.retained.splice(0, this.retained.length - FAST_LIMITS.maxFramesRetained);
+        }
+        this.open = null;
+    }
+}

package/dist/fast/limits.d.ts

@@ -0,0 +1,98 @@
+/**
+ * FAST_LIMITS — the single authority on every bound the fast tier enforces
+ * (fast-model-tier §5.5).
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope
+ * (`glyphs.test.ts`), so no literal in this tree may hold a non-ASCII byte. The
+ * regex there is a hardcoded directory list, which is why adding this tree and
+ * adding `fast` to that list are the SAME change (C-4 / AC-27) - a scanner that
+ * silently stops scanning is worse than no scanner.
+ *
+ * TWO KINDS OF NUMBER, AND THEY ARE NOT INTERCHANGEABLE - the distinction
+ * `TEAM_LIMITS` and `TODO_LIMITS` both state:
+ *
+ *  - The entries below are STRUCTURAL. They describe what a review call, a
+ *    digest and a card can physically carry. A user has no business tuning them.
+ *  - The ten `fast.*` keys in `config/schema.ts` are POLICY: which model, how
+ *    often, how long a critique may be. Those are clamped, persisted and
+ *    user-facing.
+ *
+ * `reviewMaxChars` therefore lives in the CONFIG and not here: it is the one
+ * number whose right value depends on how much of their own context the user is
+ * willing to spend on advice. `reviewOutputTokens` stays here because 512 tokens
+ * is a bound on a protocol, not a preference.
+ */
+export declare const FAST_LIMITS: {
+    /**
+     * The flat input cost of one review (D-6 / R-2).
+     *
+     * THIS NUMBER IS THE WHOLE ECONOMIC ARGUMENT. The reviewer builds its own
+     * bounded frame ring and never reads `agent.state.messages`, which after four
+     * 60 KB file reads carries 240 KB of file bodies; shipping that to the "cheap"
+     * model would make a review cost MORE than the turn it is reviewing.
+     */
+    readonly digestMaxChars: 4000;
+    /** The user's request for the run, clamped. Without it the reviewer is asked
+     *  whether work is on track without being told what the track is. */
+    readonly goalChars: 500;
+    /** Per-frame assistant-text tail. Rolling, clipped on every append. */
+    readonly turnTailChars: 600;
+    /** Per picked tool argument. Mirrors `TEAM_LIMITS.activityArgChars`. */
+    readonly toolArgChars: 120;
+    /** Frames kept per run. `>=` the max of `reviewContextTurns`, with slack. */
+    readonly maxFramesRetained: 12;
+    /** Hard cap on the review's own output. */
+    readonly reviewOutputTokens: 512;
+    /**
+     * Wall-clock budget for ONE review call INCLUDING RETRIES (D-H11).
+     *
+     * THE BUDGET HAS TWO TERMS AND ONLY ONE OF THEM SHRANK. Round 1 set 30 s as
+     * IF-3's fallback: `ProviderRegistry.complete()` routed through a retrying
+     * `stream()` with `maxRetries: 10`, so the budget covered
+     * `attempts x (call + backoff)`. Round 2 gives the reviewer its own
+     * `maxRetries: 1` registry (`wiring.ts`), which collapses that term to about
+     * one call plus a one-second backoff - but it does nothing at all to the
+     * other term, THE FAST MODEL'S OWN GENERATION LATENCY. The review asks for up
+     * to `reviewOutputTokens` from a `digestMaxChars` prompt, and the tier is by
+     * construction pointed at the cheapest endpoint the user has: the population
+     * where a 15-25 s completion is ordinary rather than pathological.
+     *
+     * SO THIS IS 20 000 AND NOT 12 000. A timeout IS a strike (see `runReview`),
+     * and `maxConsecutiveFailures` is 3, so a 12 s bound would convert "slow but
+     * healthy provider" into a tier that self-disables for the session and
+     * reports itself as MISCONFIGURED - the one register D-24 reserves for faults
+     * that never self-heal, spent on one that does. 20 s keeps a margin over a
+     * slow completion and still cuts a stuck review's occupancy of the
+     * single-flight slot by a third. Lower it only with a measured p99, which
+     * `manual-test.md` row 6 exists to produce.
+     */
+    readonly reviewTimeoutMs: 20000;
+    /** Reviews STARTED per run. A 40-turn run at cadence 5 would otherwise buy 8
+     *  critiques the lead increasingly ignores. */
+    readonly maxReviewsPerRun: 6;
+    /** Consecutive NON-TRANSIENT failures before the reviewer self-disables. */
+    readonly maxConsecutiveFailures: 3;
+    /**
+     * A critique waiting for its injection window goes stale (RV-12).
+     *
+     * The window is not guaranteed to be prompt: one `task` dispatch is a single
+     * tool call that can run for `team.dispatchTimeoutMs`, so a critique triggered
+     * just before one arrives at the far side describing a state five children
+     * have since rewritten. Advice that is merely late is worse than no advice,
+     * because the lead cannot tell that it is late.
+     */
+    readonly pendingMaxAgeMs: 120000;
+    /** ... or is overtaken by the run itself, in turns. */
+    readonly pendingMaxTurnsBehind: 2;
+    /** Rows the transcript card renders before eliding. */
+    readonly cardTextRows: 4;
+    /** Below this many columns the status chip drops (D-20's treatment, not
+     *  `agentMode`'s - the guaranteed reporting surface is `/fast status`). */
+    readonly statusCompactCols: 100;
+};
+/**
+ * Bumped whenever the wording of `<fast_tier>` or the review system prompt
+ * changes, so a behaviour report can be tied to a block revision with one grep -
+ * exactly what `TEAM_BLOCK_VERSION` and `TODO_BLOCK_VERSION` are for.
+ */
+export declare const FAST_BLOCK_VERSION = "v1-2026-07";

package/dist/fast/limits.js

@@ -0,0 +1,98 @@
+/**
+ * FAST_LIMITS — the single authority on every bound the fast tier enforces
+ * (fast-model-tier §5.5).
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope
+ * (`glyphs.test.ts`), so no literal in this tree may hold a non-ASCII byte. The
+ * regex there is a hardcoded directory list, which is why adding this tree and
+ * adding `fast` to that list are the SAME change (C-4 / AC-27) - a scanner that
+ * silently stops scanning is worse than no scanner.
+ *
+ * TWO KINDS OF NUMBER, AND THEY ARE NOT INTERCHANGEABLE - the distinction
+ * `TEAM_LIMITS` and `TODO_LIMITS` both state:
+ *
+ *  - The entries below are STRUCTURAL. They describe what a review call, a
+ *    digest and a card can physically carry. A user has no business tuning them.
+ *  - The ten `fast.*` keys in `config/schema.ts` are POLICY: which model, how
+ *    often, how long a critique may be. Those are clamped, persisted and
+ *    user-facing.
+ *
+ * `reviewMaxChars` therefore lives in the CONFIG and not here: it is the one
+ * number whose right value depends on how much of their own context the user is
+ * willing to spend on advice. `reviewOutputTokens` stays here because 512 tokens
+ * is a bound on a protocol, not a preference.
+ */
+export const FAST_LIMITS = {
+    /**
+     * The flat input cost of one review (D-6 / R-2).
+     *
+     * THIS NUMBER IS THE WHOLE ECONOMIC ARGUMENT. The reviewer builds its own
+     * bounded frame ring and never reads `agent.state.messages`, which after four
+     * 60 KB file reads carries 240 KB of file bodies; shipping that to the "cheap"
+     * model would make a review cost MORE than the turn it is reviewing.
+     */
+    digestMaxChars: 4_000,
+    /** The user's request for the run, clamped. Without it the reviewer is asked
+     *  whether work is on track without being told what the track is. */
+    goalChars: 500,
+    /** Per-frame assistant-text tail. Rolling, clipped on every append. */
+    turnTailChars: 600,
+    /** Per picked tool argument. Mirrors `TEAM_LIMITS.activityArgChars`. */
+    toolArgChars: 120,
+    /** Frames kept per run. `>=` the max of `reviewContextTurns`, with slack. */
+    maxFramesRetained: 12,
+    /** Hard cap on the review's own output. */
+    reviewOutputTokens: 512,
+    /**
+     * Wall-clock budget for ONE review call INCLUDING RETRIES (D-H11).
+     *
+     * THE BUDGET HAS TWO TERMS AND ONLY ONE OF THEM SHRANK. Round 1 set 30 s as
+     * IF-3's fallback: `ProviderRegistry.complete()` routed through a retrying
+     * `stream()` with `maxRetries: 10`, so the budget covered
+     * `attempts x (call + backoff)`. Round 2 gives the reviewer its own
+     * `maxRetries: 1` registry (`wiring.ts`), which collapses that term to about
+     * one call plus a one-second backoff - but it does nothing at all to the
+     * other term, THE FAST MODEL'S OWN GENERATION LATENCY. The review asks for up
+     * to `reviewOutputTokens` from a `digestMaxChars` prompt, and the tier is by
+     * construction pointed at the cheapest endpoint the user has: the population
+     * where a 15-25 s completion is ordinary rather than pathological.
+     *
+     * SO THIS IS 20 000 AND NOT 12 000. A timeout IS a strike (see `runReview`),
+     * and `maxConsecutiveFailures` is 3, so a 12 s bound would convert "slow but
+     * healthy provider" into a tier that self-disables for the session and
+     * reports itself as MISCONFIGURED - the one register D-24 reserves for faults
+     * that never self-heal, spent on one that does. 20 s keeps a margin over a
+     * slow completion and still cuts a stuck review's occupancy of the
+     * single-flight slot by a third. Lower it only with a measured p99, which
+     * `manual-test.md` row 6 exists to produce.
+     */
+    reviewTimeoutMs: 20_000,
+    /** Reviews STARTED per run. A 40-turn run at cadence 5 would otherwise buy 8
+     *  critiques the lead increasingly ignores. */
+    maxReviewsPerRun: 6,
+    /** Consecutive NON-TRANSIENT failures before the reviewer self-disables. */
+    maxConsecutiveFailures: 3,
+    /**
+     * A critique waiting for its injection window goes stale (RV-12).
+     *
+     * The window is not guaranteed to be prompt: one `task` dispatch is a single
+     * tool call that can run for `team.dispatchTimeoutMs`, so a critique triggered
+     * just before one arrives at the far side describing a state five children
+     * have since rewritten. Advice that is merely late is worse than no advice,
+     * because the lead cannot tell that it is late.
+     */
+    pendingMaxAgeMs: 120_000,
+    /** ... or is overtaken by the run itself, in turns. */
+    pendingMaxTurnsBehind: 2,
+    /** Rows the transcript card renders before eliding. */
+    cardTextRows: 4,
+    /** Below this many columns the status chip drops (D-20's treatment, not
+     *  `agentMode`'s - the guaranteed reporting surface is `/fast status`). */
+    statusCompactCols: 100,
+};
+/**
+ * Bumped whenever the wording of `<fast_tier>` or the review system prompt
+ * changes, so a behaviour report can be tied to a block revision with one grep -
+ * exactly what `TEAM_BLOCK_VERSION` and `TODO_BLOCK_VERSION` are for.
+ */
+export const FAST_BLOCK_VERSION = 'v1-2026-07';

package/dist/fast/prompt.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The prompt text the fast tier adds (fast-model-tier §4.6).
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope, and these
+ * strings also reach a model that may be running in a `cmd.exe` terminal.
+ *
+ * `<fast_tier>` IS SPLICED CONDITIONALLY by `buildSystemPrompt`, which is what
+ * preserves invariant I-2: with the tier off the prompt is BYTE-IDENTICAL to the
+ * pre-feature output for a fixed tool array. An unconditional guidance line here
+ * would quietly break `--no-fast`, `--no-team`, `--no-skills` and `--no-todo`
+ * all at once.
+ *
+ * `FAST_BLOCK_VERSION` exists so a change to this wording is greppable from a
+ * behaviour report.
+ */
+import { FAST_BLOCK_VERSION } from './limits.js';
+export { FAST_BLOCK_VERSION };
+export interface FastBlockParams {
+    /** The resolved fast model id, interpolated so the prompt never names a model
+     *  the tier will not actually use (§3.9 / RV-3). */
+    model: string;
+    /** `fast.delegate` — whether `model: "fast"` is honoured on `task`. */
+    delegate: boolean;
+    /** `fast.review` — whether `<fast_review>` blocks can appear at all. */
+    review: boolean;
+}
+/**
+ * The lead's `<fast_tier>` block. Under 1100 characters on purpose: it is paid
+ * for on EVERY turn of every fast-enabled session, so anything that does not
+ * change a delegation decision does not belong in it (R-11).
+ *
+ * EACH PARAGRAPH IS PRESENT ONLY WHEN ITS CAPABILITY IS. `fast.delegate: false,
+ * fast.review: true` advertises only the review, because telling a model about a
+ * `model: "fast"` field that the normalizer will downgrade every time is how you
+ * get a model that keeps asking for something it can never have.
+ *
+ * Returns `''` when neither capability is live, which the splice treats as "no
+ * block" and which keeps the byte-identity branch intact.
+ */
+export declare function buildFastBlock(params: FastBlockParams): string;
+export interface ReviewSystemPromptParams {
+    /** `fast.reviewMaxChars` — quoted so the model and the clamp agree. */
+    maxChars: number;
+}
+/**
+ * The reviewer's own system prompt.
+ *
+ * IT ASKS FOR AN EXACT STRING when there is nothing to say (`OK - on track.`)
+ * and `normalizeCritique` still matches it with a NORMALIZED REGEX rather than
+ * equality (D-17). The two are not redundant: the prompt makes compliance the
+ * likely outcome, the regex makes non-compliance harmless.
+ *
+ * NO TOOLS ARE OFFERED AND NONE ARE MENTIONED (D-11). A tool-using reviewer
+ * would be a second agent editing the same working tree with none of the gates
+ * the lead's tools carry.
+ */
+export declare function buildReviewSystemPrompt(params: ReviewSystemPromptParams): string;
+export interface ReviewInjectionParams {
+    turn: number;
+    model: string;
+    text: string;
+}
+/**
+ * The block that is actually steered into the run.
+ *
+ * THE ATTRIBUTES ARE NOT DECORATION. Steering delivers this in the `user` role
+ * (`agent-loop.ts:129`), so the wrapper is the only thing distinguishing an
+ * automated critique from something the human typed - and it is also what makes
+ * the residual case in §3.5.4a (a stranded block the reviewer may not clear)
+ * self-identifying if it ever does surface.
+ */
+export declare function renderReviewInjection(params: ReviewInjectionParams): string;

package/dist/fast/prompt.js

@@ -0,0 +1,94 @@
+/**
+ * The prompt text the fast tier adds (fast-model-tier §4.6).
+ *
+ * ASCII ONLY: `src/fast/**` is inside the glyph scanner's scope, and these
+ * strings also reach a model that may be running in a `cmd.exe` terminal.
+ *
+ * `<fast_tier>` IS SPLICED CONDITIONALLY by `buildSystemPrompt`, which is what
+ * preserves invariant I-2: with the tier off the prompt is BYTE-IDENTICAL to the
+ * pre-feature output for a fixed tool array. An unconditional guidance line here
+ * would quietly break `--no-fast`, `--no-team`, `--no-skills` and `--no-todo`
+ * all at once.
+ *
+ * `FAST_BLOCK_VERSION` exists so a change to this wording is greppable from a
+ * behaviour report.
+ */
+import { FAST_BLOCK_VERSION } from './limits.js';
+export { FAST_BLOCK_VERSION };
+/**
+ * The lead's `<fast_tier>` block. Under 1100 characters on purpose: it is paid
+ * for on EVERY turn of every fast-enabled session, so anything that does not
+ * change a delegation decision does not belong in it (R-11).
+ *
+ * EACH PARAGRAPH IS PRESENT ONLY WHEN ITS CAPABILITY IS. `fast.delegate: false,
+ * fast.review: true` advertises only the review, because telling a model about a
+ * `model: "fast"` field that the normalizer will downgrade every time is how you
+ * get a model that keeps asking for something it can never have.
+ *
+ * Returns `''` when neither capability is live, which the splice treats as "no
+ * block" and which keeps the byte-identity branch intact.
+ */
+export function buildFastBlock(params) {
+    if (!params.delegate && !params.review)
+        return '';
+    const lines = [
+        '<fast_tier>',
+        `A second, cheaper model is available in this session (${params.model}).`,
+    ];
+    if (params.delegate) {
+        lines.push('', 'Delegation: pass model:"fast" to a task subagent whose work is mechanical and', 'high-volume - reading or searching many files, summarizing long command output,', 'applying the same small edit in several places. Keep model:"main" (the default)', 'for design decisions, tricky debugging, and anything that has to be right the', 'first time. A fast subagent has the same tools and the same permissions as any', 'other; only the model differs.');
+    }
+    if (params.review) {
+        lines.push('', 'Reviews: every few turns a <fast_review> block may appear in the conversation.', 'It is an automated second opinion from the fast model - NOT a message from the', 'user. Treat it as advice: act on it when it is right, say so briefly and carry', 'on when it is not, and never ask the user to confirm it.');
+    }
+    lines.push('</fast_tier>');
+    return lines.join('\n');
+}
+/**
+ * The reviewer's own system prompt.
+ *
+ * IT ASKS FOR AN EXACT STRING when there is nothing to say (`OK - on track.`)
+ * and `normalizeCritique` still matches it with a NORMALIZED REGEX rather than
+ * equality (D-17). The two are not redundant: the prompt makes compliance the
+ * likely outcome, the regex makes non-compliance harmless.
+ *
+ * NO TOOLS ARE OFFERED AND NONE ARE MENTIONED (D-11). A tool-using reviewer
+ * would be a second agent editing the same working tree with none of the gates
+ * the lead's tools carry.
+ */
+export function buildReviewSystemPrompt(params) {
+    const max = Math.max(1, Math.floor(params.maxChars) || 1);
+    return [
+        'You are a fast reviewer watching another agent work. You see a short digest of',
+        'its recent turns: the goal, the tools it called, and the tail of what it said.',
+        '',
+        'Answer ONE question: is this run still on track for the goal?',
+        '',
+        `If it is, reply with EXACTLY: OK - on track.`,
+        'If it is not, reply with plain prose naming the single most useful correction -',
+        `at most ${max} characters, no preamble, no code fences, no lists, no headings.`,
+        '',
+        'Things worth saying: repeated edits with no verification, a failing tool call',
+        'that was ignored, work that has drifted from the goal, an obvious cheaper route.',
+        'Things not worth saying: style opinions, praise, restating what the agent did.',
+        '',
+        'You cannot run tools and you are not talking to the user. You are advising the',
+        'agent, and it will decide.',
+    ].join('\n');
+}
+/**
+ * The block that is actually steered into the run.
+ *
+ * THE ATTRIBUTES ARE NOT DECORATION. Steering delivers this in the `user` role
+ * (`agent-loop.ts:129`), so the wrapper is the only thing distinguishing an
+ * automated critique from something the human typed - and it is also what makes
+ * the residual case in §3.5.4a (a stranded block the reviewer may not clear)
+ * self-identifying if it ever does surface.
+ */
+export function renderReviewInjection(params) {
+    return [
+        `<fast_review turn="${params.turn}" model="${params.model}">`,
+        params.text,
+        '</fast_review>',
+    ].join('\n');
+}