@bendyline/gezel-inference 0.0.0-stage → 1.0.0

package/dist/providers/ds4/residency.d.ts

@@ -0,0 +1,143 @@
+import { DS4_FULL_RESIDENCY_HEADROOM_BYTES } from '@bendyline/gezel';
+export { DS4_FULL_RESIDENCY_HEADROOM_BYTES };
+/**
+ * Conservative floor for the full-residency working set. Exclusivity is an
+ * explicit device lease at process startup, not a consequence of this number:
+ * the automatic model budget can exceed 96 GiB on larger machines.
+ */
+export declare const DS4_FULL_RESIDENCY_RESERVATION_BYTES: number;
+/**
+ * Extra resident memory for ds4's `--vision` encoder. The encoder is a GGUF
+ * tensor payload plus a separate image graph, matching the two terms measured
+ * for llama.cpp vision. Keep this conservative until ds4-specific telemetry
+ * gives us a tighter number.
+ */
+export declare function ds4VisionResidentBytes(encoderSizeBytes: number | undefined): number;
+/**
+ * Base resident working set before optional vision/drafting companions.
+ *
+ * A catalog `residentBytes` value is a model-specific measurement that already
+ * includes runtime overhead. The generic weights multiplier is only a fallback
+ * for an unmeasured explicit GGUF; applying it as a lower bound discarded the
+ * better measurement and made the measured GLM 5.3 Q2 launch exceed the
+ * unified-GPU admission ceiling. Never accept a measurement below the raw
+ * weights themselves, which still fails safely for a malformed catalog row.
+ */
+export declare function ds4BaseResidentBytes(opts: {
+    projectedBytes?: number;
+    modelSizeBytes?: number;
+}): number;
+export interface Ds4ResidencyOptions {
+    configured?: boolean;
+    /** False when this architecture has no routed-expert SSD-streaming graph. */
+    ssdStreamingSupported?: boolean;
+    /** Bytes of the selected GGUF that actually become resident model weights. */
+    modelSizeBytes?: number;
+    totalRamBytes?: number;
+    /**
+     * Resident bytes beyond the weights this launch would also hold (a DSpark
+     * companion). Not part of `modelSizeBytes`, so residency that ignores it
+     * under-reserves by exactly the companion's size.
+     */
+    companionBytes?: number;
+    platform?: NodeJS.Platform;
+    arch?: string;
+}
+/**
+ * Whether this exact model can be made fully resident without consuming the
+ * memory macOS/Linux and ds4's runtime still need. Delegates to core so the
+ * model list's fit badge and this launch decision cannot disagree.
+ */
+export declare function canUseDs4FullResidency(opts?: Ds4ResidencyOptions): boolean;
+/**
+ * Decide whether ds4 should stream experts from SSD.
+ *
+ * **Residency is the default wherever it fits.** Streaming is roughly an
+ * order of magnitude slower — measured 1.85 tok/s streaming against 18.1
+ * tok/s resident for the same IQ2_XXS build on a DGX Spark — so a machine
+ * with the memory to hold a model should hold it.
+ *
+ * This inverts the original policy, which returned `true` unless the config
+ * said exactly `false`. Device RAM was then consulted only to VETO a user's
+ * explicit opt-out, never to choose residency, so no install ever ran resident
+ * without a hand-edited config key that has no UI. The safety direction is
+ * unchanged and is what makes the flip safe: a model that does not fit still
+ * streams, and {@link canUseDs4FullResidency} is what refuses it.
+ *
+ * `configured === true` remains an explicit opt-in to streaming and is always
+ * honored — a user who wants the memory back can have it.
+ */
+export declare function shouldUseDs4SsdStreaming(opts?: Ds4ResidencyOptions): boolean;
+export interface Ds4ExpertCachePlanOptions {
+    configuredGb?: number;
+    catalogCacheBytes?: number;
+    catalogResidentBytes?: number;
+    totalRamBytes?: number;
+}
+export interface Ds4ExpertCachePlan {
+    cacheGb: number;
+    requestedGb: number;
+    clamped: boolean;
+    safe: boolean;
+}
+/**
+ * Pick a bounded routed-expert cache for streaming mode. Catalog guidance is
+ * model-aware (Q2 currently recommends 32 GiB; Q4 recommends 64 GiB), unlike
+ * the old RAM-tier heuristic which incorrectly gave both models 64 GiB on a
+ * 128 GiB Mac. Manual values are still accepted, but clamped so fixed model
+ * state + the cache cannot consume the runtime/OS reserve.
+ */
+export declare function planDs4ExpertCache(opts: Ds4ExpertCachePlanOptions): Ds4ExpertCachePlan;
+/** Effective capacity-broker reservation for the chosen DS4 residency mode. */
+export declare function ds4ResidentBytesForMode(catalogResidentBytes: number, ssdStreaming: boolean, ssdStreamingSupported?: boolean): number;
+/** Allowance for ds4's compute and staging buffers beyond weights and KV rows. */
+export declare const DS4_RUNTIME_BUFFER_BYTES: number;
+/**
+ * Accelerator bytes a launch actually wires, for device admission's GPU
+ * check. `ds4ResidentBytesForMode` floors the RAM reservation at 96 GiB, and
+ * handing that floor over as GPU bytes compared it against a unified host's
+ * 0.75 × RAM ceiling — 91.2 GiB on a 121.6 GiB DGX Spark — so every
+ * full-residency deepseek-v4-flash q2 launch was refused, although ds4 itself
+ * plans that model at ~84 GiB (2026-09-29). Undefined when the floor did not
+ * raise the reservation: the reservation is then the working set already.
+ */
+export declare function ds4AdmissionGpuBytes(opts: {
+    workingSetBytes: number;
+    reservationBytes: number;
+    kvBytesPerToken?: number | undefined;
+    numCtx: number;
+}): number | undefined;
+/**
+ * DS4's resident footprint as a line in the context window:
+ * `contextFreeBytes + kvBytesPerToken × ctx`.
+ *
+ * The catalog's `residentBytes` is a measurement at ONE window
+ * (`residentCtxTokens`), so re-basing it is what lets a 64K and a 256K launch
+ * of the same model quote different numbers. Everything that does not move
+ * with the window — expert cache, prefill expert reserve, resident non-routed
+ * weights, the raw KV rows pinned to the prefill chunk — collapses into
+ * `contextFreeBytes`.
+ *
+ * Same `fixed + slope × ctx` shape llama.cpp/MLX rows already carry, so the
+ * models list and the context slider price ds4 through their existing path.
+ */
+export interface Ds4ResidentLine {
+    /** Footprint at a zero-token window: everything the context doesn't move. */
+    contextFreeBytes: number;
+    /** Resident bytes per context token (compressed KV + scaling buffers). */
+    kvBytesPerToken: number;
+}
+export interface Ds4ResidentLineOptions {
+    residentBytes?: number | undefined;
+    kvBytesPerToken?: number | undefined;
+    residentCtxTokens?: number | undefined;
+}
+/**
+ * Build the line from a catalog `ds4` source block. Returns undefined unless
+ * the entry authors all three inputs — a slope without the window it was
+ * measured at cannot be re-based, and guessing one would quote confident
+ * numbers for a model nobody measured.
+ */
+export declare function ds4ResidentLine(opts: Ds4ResidentLineOptions): Ds4ResidentLine | undefined;
+/** Evaluate {@link ds4ResidentLine} at a window. */
+export declare function ds4ProjectedResidentBytes(line: Ds4ResidentLine, ctxTokens: number): number;

package/dist/providers/ds4/residency.js

@@ -0,0 +1,139 @@
+import { totalmem } from 'node:os';
+import { DS4_FULL_RESIDENCY_HEADROOM_BYTES, LLAMA_CPP_VISION_COMPUTE_BYTES, LLAMA_CPP_WEIGHTS_MULTIPLIER, ds4FitsFullResidency, } from '@bendyline/gezel';
+const GB = 1024 ** 3;
+export { DS4_FULL_RESIDENCY_HEADROOM_BYTES };
+/**
+ * Conservative floor for the full-residency working set. Exclusivity is an
+ * explicit device lease at process startup, not a consequence of this number:
+ * the automatic model budget can exceed 96 GiB on larger machines.
+ */
+export const DS4_FULL_RESIDENCY_RESERVATION_BYTES = 96 * GB;
+/**
+ * Extra resident memory for ds4's `--vision` encoder. The encoder is a GGUF
+ * tensor payload plus a separate image graph, matching the two terms measured
+ * for llama.cpp vision. Keep this conservative until ds4-specific telemetry
+ * gives us a tighter number.
+ */
+export function ds4VisionResidentBytes(encoderSizeBytes) {
+    if (!encoderSizeBytes || encoderSizeBytes <= 0)
+        return 0;
+    return (Math.round(encoderSizeBytes * LLAMA_CPP_WEIGHTS_MULTIPLIER) + LLAMA_CPP_VISION_COMPUTE_BYTES);
+}
+/**
+ * Base resident working set before optional vision/drafting companions.
+ *
+ * A catalog `residentBytes` value is a model-specific measurement that already
+ * includes runtime overhead. The generic weights multiplier is only a fallback
+ * for an unmeasured explicit GGUF; applying it as a lower bound discarded the
+ * better measurement and made the measured GLM 5.3 Q2 launch exceed the
+ * unified-GPU admission ceiling. Never accept a measurement below the raw
+ * weights themselves, which still fails safely for a malformed catalog row.
+ */
+export function ds4BaseResidentBytes(opts) {
+    const modelSizeBytes = Math.max(0, opts.modelSizeBytes ?? 0);
+    if (opts.projectedBytes !== undefined)
+        return Math.max(modelSizeBytes, Math.max(0, opts.projectedBytes));
+    return Math.round(modelSizeBytes * LLAMA_CPP_WEIGHTS_MULTIPLIER);
+}
+/**
+ * Whether this exact model can be made fully resident without consuming the
+ * memory macOS/Linux and ds4's runtime still need. Delegates to core so the
+ * model list's fit badge and this launch decision cannot disagree.
+ */
+export function canUseDs4FullResidency(opts = {}) {
+    return ds4FitsFullResidency({
+        modelSizeBytes: opts.modelSizeBytes,
+        totalRamBytes: opts.totalRamBytes ?? totalmem(),
+        companionBytes: opts.companionBytes,
+        platform: opts.platform ?? process.platform,
+        arch: opts.arch ?? process.arch,
+    });
+}
+/**
+ * Decide whether ds4 should stream experts from SSD.
+ *
+ * **Residency is the default wherever it fits.** Streaming is roughly an
+ * order of magnitude slower — measured 1.85 tok/s streaming against 18.1
+ * tok/s resident for the same IQ2_XXS build on a DGX Spark — so a machine
+ * with the memory to hold a model should hold it.
+ *
+ * This inverts the original policy, which returned `true` unless the config
+ * said exactly `false`. Device RAM was then consulted only to VETO a user's
+ * explicit opt-out, never to choose residency, so no install ever ran resident
+ * without a hand-edited config key that has no UI. The safety direction is
+ * unchanged and is what makes the flip safe: a model that does not fit still
+ * streams, and {@link canUseDs4FullResidency} is what refuses it.
+ *
+ * `configured === true` remains an explicit opt-in to streaming and is always
+ * honored — a user who wants the memory back can have it.
+ */
+export function shouldUseDs4SsdStreaming(opts = {}) {
+    if (opts.ssdStreamingSupported === false)
+        return false;
+    if (opts.configured === true)
+        return true;
+    return !canUseDs4FullResidency(opts);
+}
+/**
+ * Pick a bounded routed-expert cache for streaming mode. Catalog guidance is
+ * model-aware (Q2 currently recommends 32 GiB; Q4 recommends 64 GiB), unlike
+ * the old RAM-tier heuristic which incorrectly gave both models 64 GiB on a
+ * 128 GiB Mac. Manual values are still accepted, but clamped so fixed model
+ * state + the cache cannot consume the runtime/OS reserve.
+ */
+export function planDs4ExpertCache(opts) {
+    const totalRamBytes = opts.totalRamBytes ?? totalmem();
+    const catalogCacheBytes = opts.catalogCacheBytes ?? 0;
+    const fixedResidentBytes = Math.max(0, (opts.catalogResidentBytes ?? 0) - catalogCacheBytes);
+    const fallbackGb = totalRamBytes >= 120 * GB ? 64 : totalRamBytes >= 88 * GB ? 48 : 32;
+    const requestedGb = opts.configuredGb ?? (catalogCacheBytes > 0 ? catalogCacheBytes / GB : fallbackGb);
+    const safeCacheBytes = totalRamBytes - fixedResidentBytes - DS4_FULL_RESIDENCY_HEADROOM_BYTES;
+    const safeCacheGb = Math.floor(safeCacheBytes / GB);
+    if (safeCacheGb < 1) {
+        return { cacheGb: 1, requestedGb, clamped: true, safe: false };
+    }
+    const cacheGb = Math.max(1, Math.min(requestedGb, safeCacheGb));
+    return { cacheGb, requestedGb, clamped: cacheGb !== requestedGb, safe: true };
+}
+/** Effective capacity-broker reservation for the chosen DS4 residency mode. */
+export function ds4ResidentBytesForMode(catalogResidentBytes, ssdStreaming, ssdStreamingSupported = true) {
+    return ssdStreaming || !ssdStreamingSupported
+        ? catalogResidentBytes
+        : Math.max(catalogResidentBytes, DS4_FULL_RESIDENCY_RESERVATION_BYTES);
+}
+/** Allowance for ds4's compute and staging buffers beyond weights and KV rows. */
+export const DS4_RUNTIME_BUFFER_BYTES = 4 * GB;
+/**
+ * Accelerator bytes a launch actually wires, for device admission's GPU
+ * check. `ds4ResidentBytesForMode` floors the RAM reservation at 96 GiB, and
+ * handing that floor over as GPU bytes compared it against a unified host's
+ * 0.75 × RAM ceiling — 91.2 GiB on a 121.6 GiB DGX Spark — so every
+ * full-residency deepseek-v4-flash q2 launch was refused, although ds4 itself
+ * plans that model at ~84 GiB (2026-09-29). Undefined when the floor did not
+ * raise the reservation: the reservation is then the working set already.
+ */
+export function ds4AdmissionGpuBytes(opts) {
+    if (opts.reservationBytes <= opts.workingSetBytes)
+        return undefined;
+    const wired = opts.workingSetBytes + (opts.kvBytesPerToken ?? 0) * opts.numCtx + DS4_RUNTIME_BUFFER_BYTES;
+    return Math.min(opts.reservationBytes, wired);
+}
+/**
+ * Build the line from a catalog `ds4` source block. Returns undefined unless
+ * the entry authors all three inputs — a slope without the window it was
+ * measured at cannot be re-based, and guessing one would quote confident
+ * numbers for a model nobody measured.
+ */
+export function ds4ResidentLine(opts) {
+    const { residentBytes, kvBytesPerToken, residentCtxTokens } = opts;
+    if (!residentBytes || !kvBytesPerToken || !residentCtxTokens)
+        return undefined;
+    // A mis-authored slope that swallows the whole footprint would quote a
+    // negative floor; clamp rather than propagate it into admission math.
+    const contextFreeBytes = Math.max(0, residentBytes - kvBytesPerToken * residentCtxTokens);
+    return { contextFreeBytes, kvBytesPerToken };
+}
+/** Evaluate {@link ds4ResidentLine} at a window. */
+export function ds4ProjectedResidentBytes(line, ctxTokens) {
+    return Math.round(line.contextFreeBytes + line.kvBytesPerToken * Math.max(0, ctxTokens));
+}

package/dist/providers/ds4/stdout-parser.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Classify a single line of ds4-server stderr into a lifecycle phase +
+ * human-readable detail. The ds4 sibling of llama.cpp's
+ * `classifyStartupLine` — same `StartupPhase` contract, but matching
+ * antirez's log wording instead of llama-server's.
+ *
+ * ds4-server logs are unconditional (its log "levels" only pick a TTY
+ * color), so everything below is present on every run of the pinned
+ * build. The formats come from the upstream source at the commit in
+ * native/engines/ds4/VERSION:
+ *
+ *   server_log() lines — `MMDD HH:MM:SS ds4-server: <msg>`:
+ *     - `ds4-server: chat ctx=0..7880:7880 TOOLS prefill chunk 512/7880
+ *        (6.5%) chunk=39.35 t/s avg=39.35 t/s 13.013s` — every prefill
+ *        batch, i.e. every few seconds. DS4 prefill on a long prompt
+ *        runs for MINUTES (~39 tok/s SSD-streamed), so this is the
+ *        single biggest user-facing win — without it the chat sits on
+ *        a bare "Thinking it through" the whole time.
+ *     - same shape with phase `tool checkpoint rebuild` — mid-turn KV
+ *        restore from the disk checkpoint before a continuation.
+ *     - `ds4-server: chat ctx=… gen=150 TOOLS decoding chunk=5.20 t/s
+ *        avg=5.35 t/s 28.846s` — every 50 decode tokens (~10-35s at
+ *        DS4 speeds).
+ *     - `ds4-server: listening on http://127.0.0.1:52341` — ready.
+ *
+ *   raw core prints (no timestamp) during model load:
+ *     - `ds4: metal prepared model tensor mappings 12.50 GiB` —
+ *        cumulative mapping ticker, every ~10s on a pipe.
+ *     - `ds4: warming mapped tensor pages: 81.20 GiB` /
+ *       `ds4: warmed tensor pages in 93.001s (checksum=…)` — the
+ *        minutes-long full-residency page warm.
+ *     - `ds4: prefill layer 12/61`, `ds4: gpu streaming prefill token
+ *        512/7880` — `\r`-repaint progress meters from non-server code
+ *        paths; matched for robustness (the supervisor splits on `\r`).
+ *
+ * Same tolerance contract as the llama.cpp classifier: unknown lines
+ * return null and flow to the raw log file; a format drift upstream
+ * degrades us to "no phase detail", never a crash.
+ */
+import type { StartupPhase } from '../llama-cpp/stdout-parser.js';
+/**
+ * Pure classifier for ds4-server output. Returns a phase descriptor
+ * when the line matches a known pattern, null otherwise. Caller (the
+ * shared `LlamaCppProvider.onStdoutLine`) dedupes repeated identical
+ * phases and accumulates `bufferBytes`.
+ */
+export declare function classifyDs4Line(rawLine: string): StartupPhase | null;

package/dist/providers/ds4/stdout-parser.js

@@ -0,0 +1,134 @@
+import { parseMemorySize, stripLogPrefix } from '../llama-cpp/stdout-parser.js';
+/** Strip server_log's `MMDD HH:MM:SS ` timestamp when present. */
+function stripTimestamp(line) {
+    return line.replace(/^\d{4} \d{2}:\d{2}:\d{2} /, '');
+}
+/**
+ * Format a tokens/sec figure the way a human scans it: one decimal
+ * below 10 (DS4 decode runs 1-5 tok/s where "1 tok/s" vs "1.4 tok/s"
+ * is a 40% difference), whole numbers above.
+ */
+function formatTps(tps) {
+    return tps < 10 ? tps.toFixed(1) : String(Math.round(tps));
+}
+const NUM = (n) => n.toLocaleString('en-US');
+/**
+ * Pure classifier for ds4-server output. Returns a phase descriptor
+ * when the line matches a known pattern, null otherwise. Caller (the
+ * shared `LlamaCppProvider.onStdoutLine`) dedupes repeated identical
+ * phases and accumulates `bufferBytes`.
+ */
+export function classifyDs4Line(rawLine) {
+    if (rawLine.includes('memory-admission:'))
+        return { phase: 'starting', detail: 'Waiting for available memory' };
+    const line = stripTimestamp(stripLogPrefix(rawLine));
+    if (!line)
+        return null;
+    // Server is up and listening — the readiness probe (`GET /v1/models`)
+    // corroborates. Model load happens BEFORE this line in ds4-server's
+    // main(), so `ready` here really means "load finished, serving".
+    if (/^ds4-server: listening on /.test(line)) {
+        return { phase: 'ready', detail: 'Server ready' };
+    }
+    // Prompt prefill / mid-turn KV rebuild progress. One line per prefill
+    // batch:
+    //   `ds4-server: chat ctx=0..7880:7880 TOOLS prefill chunk 512/7880
+    //    (6.5%) chunk=39.35 t/s avg=39.35 t/s 13.013s`
+    // The optional flag words between `ctx=…` and the phase are
+    // uppercase tokens (RESPPROTO TOOLS THINKING …); the phase string is
+    // exactly `prefill` or `tool checkpoint rebuild`, so anchor on those.
+    const prefillMatch = line.match(/^ds4-server: (?:chat|completion) ctx=\S+.*?\b(prefill|tool checkpoint rebuild) chunk (\d+)\/(\d+) \(([\d.]+)%\).*?\bavg=([\d.]+) t\/s/);
+    if (prefillMatch) {
+        const current = Number.parseInt(prefillMatch[2], 10);
+        const total = Number.parseInt(prefillMatch[3], 10);
+        const avgTps = Number.parseFloat(prefillMatch[5]);
+        if (total > 0 && current >= 0 && current <= total) {
+            const progress = current / total;
+            const pctText = Math.round(progress * 100);
+            const rebuild = prefillMatch[1] === 'tool checkpoint rebuild';
+            const tpsText = Number.isFinite(avgTps) && avgTps > 0 ? ` · ${formatTps(avgTps)} tok/s` : '';
+            return {
+                phase: 'prefill',
+                detail: rebuild
+                    ? `Restoring session context (${pctText}% · ${NUM(current)} / ${NUM(total)} tokens)`
+                    : `Processing prompt (${pctText}% · ${NUM(current)} / ${NUM(total)} tokens${tpsText})`,
+                progress,
+            };
+        }
+    }
+    // Decode progress — every 50 generated tokens. Valuable during long
+    // hidden-reasoning stretches where no visible delta reaches the UI:
+    //   `ds4-server: chat ctx=7880..8030:150 gen=150 TOOLS decoding
+    //    chunk=5.20 t/s avg=5.35 t/s 28.846s`
+    const decodeMatch = line.match(/^ds4-server: (?:chat|completion) ctx=\S+ gen=(\d+)\b.*?\bdecoding\b.*?\bavg=([\d.]+) t\/s/);
+    if (decodeMatch) {
+        const gen = Number.parseInt(decodeMatch[1], 10);
+        const avgTps = Number.parseFloat(decodeMatch[2]);
+        // Counters only — no `detail`. The UI names the phase itself and has
+        // its own row for the numbers; a prose copy here would just be
+        // scraped back apart on the other side.
+        return {
+            phase: 'generating',
+            outputTokens: gen,
+            ...(Number.isFinite(avgTps) && avgTps > 0 ? { tokensPerSec: avgTps } : {}),
+        };
+    }
+    // Model tensor mapping ticker (cumulative, so no bufferBytes — the
+    // provider would sum every tick into a wildly inflated RAM total):
+    //   `ds4: metal prepared model tensor mappings 12.50 GiB`
+    const mappedMatch = line.match(/^ds4: \S+ prepared model tensor mappings ([\d.]+) GiB/);
+    if (mappedMatch) {
+        return {
+            phase: 'loading_model',
+            detail: `Mapping model tensors (${mappedMatch[1]} GB)`,
+        };
+    }
+    // Full-residency page warm — a single announce line, so its size IS
+    // safe to count once toward the engine RAM figure:
+    //   `ds4: warming mapped tensor pages: 81.20 GiB`
+    const warmingMatch = line.match(/^ds4: warming mapped tensor pages: ([\d.]+) GiB/);
+    if (warmingMatch) {
+        const bytes = parseMemorySize(warmingMatch[1], 'GiB');
+        return {
+            phase: 'loading_model',
+            detail: `Warming model pages (${warmingMatch[1]} GB)`,
+            ...(bytes !== null ? { bufferBytes: bytes } : {}),
+        };
+    }
+    const warmedMatch = line.match(/^ds4: warmed tensor pages in ([\d.]+)s/);
+    if (warmedMatch) {
+        return {
+            phase: 'loading_model',
+            detail: `Warmed model pages in ${Math.round(Number.parseFloat(warmedMatch[1]))}s`,
+        };
+    }
+    // Core `\r`-repaint prefill meters (non-server code paths; matched
+    // defensively — the supervisor splits `\r` repaints into lines):
+    //   `ds4: prefill layer 12/61`  /  `ds4: gpu prefill layer 12/61`
+    //   `ds4: gpu streaming prefill token 512/7880`
+    const coreTokenMatch = line.match(/^ds4: .*?\bprefill token (\d+)\/(\d+)/);
+    if (coreTokenMatch) {
+        const current = Number.parseInt(coreTokenMatch[1], 10);
+        const total = Number.parseInt(coreTokenMatch[2], 10);
+        if (total > 0 && current >= 0 && current <= total) {
+            return {
+                phase: 'prefill',
+                detail: `Processing prompt (${Math.round((current / total) * 100)}% · ${NUM(current)} / ${NUM(total)} tokens)`,
+                progress: current / total,
+            };
+        }
+    }
+    const coreLayerMatch = line.match(/^ds4: .*?\bprefill layer (\d+)\/(\d+)/);
+    if (coreLayerMatch) {
+        const current = Number.parseInt(coreLayerMatch[1], 10);
+        const total = Number.parseInt(coreLayerMatch[2], 10);
+        if (total > 0 && current >= 0 && current <= total) {
+            return {
+                phase: 'prefill',
+                detail: `Prefill layer ${current} / ${total}`,
+                progress: current / total,
+            };
+        }
+    }
+    return null;
+}

package/dist/providers/duplicate-tool-calls.d.ts

@@ -0,0 +1 @@
+export * from '@bendyline/gezel/local-loop';

package/dist/providers/duplicate-tool-calls.js

@@ -0,0 +1,2 @@
+// Moved to core so the portable runtime runs the same loop; see core/src/local-loop.
+export * from '@bendyline/gezel/local-loop';

package/dist/providers/file-repair-policy.d.ts

@@ -0,0 +1 @@
+export * from '@bendyline/gezel/local-loop';

package/dist/providers/file-repair-policy.js

@@ -0,0 +1,2 @@
+// Moved to core so the portable runtime runs the same loop; see core/src/local-loop.
+export * from '@bendyline/gezel/local-loop';

package/dist/providers/gpu-arbiter.d.ts

@@ -0,0 +1,159 @@
+/**
+ * GpuArbiter — thermal admission plus the user's explicit cross-slot swap
+ * preference. Automatic memory admission belongs to DeviceCapacityLedger,
+ * shared by all native supervisors and cooperating daemon processes.
+ *
+ * Policies:
+ *   - `coexist` — no slot eviction; supervisors admit residency by bytes.
+ *   - `swap` — `acquire(slot)` evicts the *other* slot first. The
+ *     evicted engine's lazy-restart kicks in on its next request,
+ *     so callers see a small one-time latency on the turn after a
+ *     swap, not on every turn.
+ *
+ * Engines register an evictor via {@link registerEvictor}; the
+ * llama-cpp + sd-cpp providers each call this once at construction
+ * with their supervisor's `stop()`. When no engine has registered
+ * for a slot (e.g. cloud LLM + local image gen), `acquire()` for
+ * that slot is a no-op — there's nothing to evict.
+ *
+ * Designed to be light: no internal state machine, no per-request
+ * tracking. The supervisor's own state machine is the source of
+ * truth for "is the engine running"; an unconditional `stop()`
+ * call when the supervisor is already stopped is a tested no-op.
+ */
+import type { DeviceHealthGate, DeviceHealthStatusSnapshot, DeviceSafetyPolicyInput } from '@bendyline/gezel/native';
+export type GpuSlot = 'llm' | 'image' | 'video';
+export type GpuPolicy = 'coexist' | 'swap';
+export type GpuPolicySetting = GpuPolicy | 'auto';
+type DeviceHealthAdmissionGate = Pick<DeviceHealthGate, 'admit' | 'setPolicy' | 'status'>;
+export interface GpuMemoryPressureStatus {
+    pressured: boolean;
+    freeBytes?: number;
+    totalBytes?: number;
+    detail?: string;
+}
+export interface GpuArbiterOptions {
+    /**
+     * Initial policy. Use {@link detectGpuPolicy} to derive an `auto`
+     * default at boot, or pass `swap`/`coexist` directly when the user
+     * has overridden the auto pick in Settings.
+     */
+    policy: GpuPolicy;
+    /**
+     * Where lifecycle messages go. Defaults to `console.log`. The
+     * service wires this to its structured logger so swap events show
+     * up in the daemon log.
+     */
+    log?: (msg: string) => void;
+    /**
+     * Optional cross-vendor admission gate. It is consulted for every GPU slot
+     * regardless of the memory coexist/swap policy, so thermal safety does not
+     * accidentally disappear on large-memory systems.
+     */
+    healthGate?: DeviceHealthAdmissionGate;
+    /**
+     * How long a single lease may be held before the arbiter treats it as
+     * leaked and breaks it. Backstop only — see {@link STALE_LEASE_BREAK_MS}.
+     */
+    staleLeaseBreakMs?: number;
+}
+export declare class GpuArbiter {
+    private policy;
+    /**
+     * Evictors per slot, keyed by owner. A slot can have multiple
+     * registered engines at once — the engine pool runs several
+     * llama-server replicas (one per resident model), each registering
+     * under its engine key — and an eviction of the slot must stop ALL
+     * of them, not just the most recently registered.
+     */
+    private readonly evictors;
+    private readonly log;
+    private readonly healthGate?;
+    private activeLease;
+    private activeLeaseSince;
+    private leaseWaiters;
+    private readonly staleLeaseBreakMs;
+    constructor(opts: GpuArbiterOptions);
+    /**
+     * Drop a lease the holder can no longer release, so blocked acquirers make
+     * progress. Returns true when a lease was actually broken.
+     */
+    private breakStaleLease;
+    /**
+     * Register the function the arbiter should call to evict an engine
+     * from the GPU. Typically the supervisor's `stop()`. Re-registering
+     * the same `(slot, ownerId)` replaces the previous evictor — useful
+     * when a provider is rebuilt (e.g. user switched llama-cpp models
+     * in Settings) and the old supervisor is gone. Distinct owners on
+     * the same slot coexist (pool replicas); pass the engine key as
+     * `ownerId` so each replica can be unregistered independently.
+     */
+    registerEvictor(slot: GpuSlot, evict: () => Promise<void>, ownerId?: string): void;
+    /**
+     * Forget an evictor. Called when a provider is shut down for good
+     * (e.g. user switched from local to cloud, or the pool evicted a
+     * replica). After this, `acquire()` for the *other* slot won't try
+     * to evict here.
+     */
+    unregisterEvictor(slot: GpuSlot, ownerId?: string): void;
+    /**
+     * Called by a provider just before it intends to use the GPU. In
+     * `swap` mode, evicts every other registered slot first; in
+     * `coexist` mode, returns immediately. Failures during eviction are
+     * logged and swallowed — the requesting engine still gets to run,
+     * which is the user-visible promise.
+     */
+    acquire(slot: GpuSlot): Promise<void>;
+    /**
+     * Acquire the GPU and keep an in-flight operation protected until the
+     * returned release function is called. Long local image generations use
+     * this so a chat nudge cannot evict sd-server halfway through VAE decode.
+     */
+    acquireLease(slot: GpuSlot): Promise<() => void>;
+    private waitForForeignLease;
+    /**
+     * Resolves on the next release, or after {@link LEASE_WAIT_POLL_MS} so the
+     * caller re-evaluates. The timed wake is what makes the stale-lease breaker
+     * reachable: a leaked lease produces no release, so a wake-on-release-only
+     * wait would never re-check and the caller would park forever.
+     */
+    private waitForLeaseRelease;
+    private wakeLeaseWaiters;
+    private evictOthers;
+    getPolicy(): GpuPolicy;
+    /**
+     * Hot-swap the policy. Used by the config PUT handler when the user
+     * flips the toggle in Settings. Doesn't preemptively load or evict
+     * anything — the new policy applies on the next `acquire()`.
+     */
+    setPolicy(policy: GpuPolicy): void;
+    /** Hot-swap native device-safety thresholds for the next admission. */
+    setDeviceSafetyPolicy(policy: DeviceSafetyPolicyInput): void;
+    /** Latest normalized machine-health snapshot for the authenticated UI. */
+    getDeviceHealthStatus(maxAgeMs?: number): Promise<DeviceHealthStatusSnapshot | undefined>;
+    /**
+     * Low-free-VRAM signal for idle engine supervisors. This is deliberately a
+     * release hint, not an admission denial: active inference always finishes,
+     * then an idle model gets one minute to be reused before caches flush and
+     * its process exits.
+     */
+    getMemoryPressureStatus(maxAgeMs?: number): Promise<GpuMemoryPressureStatus>;
+}
+/**
+ * Automatic co-residency is now admitted by the device memory ledger at actual
+ * engine startup. The slot arbiter retains explicit `swap` as an operator
+ * preference; platform/RAM heuristics must not serialize models that fit.
+ */
+export declare function detectGpuPolicy(_opts?: {
+    platform?: NodeJS.Platform;
+    arch?: string;
+    totalMemBytes?: number;
+}): GpuPolicy;
+/**
+ * Resolve the user-facing setting (which may be `'auto'`) into a
+ * concrete policy by consulting {@link detectGpuPolicy} for the
+ * `'auto'` case. Centralized so the service entrypoint and the
+ * config-change path agree on the same mapping.
+ */
+export declare function resolveGpuPolicy(setting: GpuPolicySetting | undefined): GpuPolicy;
+export {};