@buildaharness/aielia 0.3.4 → 0.3.6

package/dist/index.js

@@ -1,9 +1,9 @@
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
-import { M as classifyRisk } from "./provider-setup-CPbB5y_V.js";
-import { A, a, b, C, c, D, e, f, g, h, i, k, F, l, I, L, m, n, o, p, P, q, r, s, R, t, S, u, W, v, w, x, y, z, B, G, H, J, K, N, O, Q, T, U, V, X, Y, _, $, a1, a2, a3, a4, a5, a7, a8, a9, aa, ae, ag, ah, ak, am, ao, ap, aq, ar, as, at, au, av, aw, ax, ay, az, aA, aB, aC, aD, aE, aG, aH, aI, aJ, aK, aL, aM, aN, aO, aP, aR, aS, aU, aV, aW, aX, aY } from "./provider-setup-CPbB5y_V.js";
-import { MAX_OPTIONS_PER_QUESTION, MAX_QUESTIONS_PER_BATCH, MIN_OPTIONS_PER_QUESTION, validateAskResponse } from "@buildaharness/harness";
+import { bj as parseModelJson, a0 as classifyRiskLexical } from "./provider-setup-CV3S_TAS.js";
+import { A, a, b, C, c, D, e, f, g, h, i, j, k, l, m, o, F, p, I, L, q, r, s, t, u, v, w, x, M, P, y, z, B, R, G, S, H, J, W, K, N, O, Q, T, U, V, X, Y, Z, _, $, a1, a2, a3, a4, a5, a6, a7, a8, a9, aa, ac, ad, ae, ag, ah, ai, aj, ak, al, am, ao, aq, ar, as, at, av, aw, ay, az, aB, aC, aE, aF, aI, aK, aL, aM, aN, aP, aQ, aR, aS, aT, aU, aW, aX, aY, aZ, a_, a$, b0, b1, b2, b4, b5, b6, b7, b8, b9, ba, bb, bc, bd, be, bf, bh, bk, bl, bm, bp, bq, br, bs, bt, bu, bv, bw, bx, by, bz, bA, bB, bC, bD, bE, bF, bH, bI, bK, bM, bN, bO, bP, bQ, bR, bS, bT } from "./provider-setup-CV3S_TAS.js";
+import { DEFAULT_LAYER_POLICY_MODE, MAX_OPTIONS_PER_QUESTION, MAX_QUESTIONS_PER_BATCH, MIN_OPTIONS_PER_QUESTION, validateAskResponse } from "@buildaharness/harness";
 const PLAN_SCHEMA = {
   type: "object",
   properties: {
@@ -46,7 +46,7 @@ async function buildPlanFromTemplate(llmClient, message, template, model, onUsag
       void 0,
       { model, onUsage, structuredOutput: { schema: PLAN_SCHEMA } }
     );
-    const parsed = JSON.parse(response.content);
+    const parsed = parseModelJson(response.content);
     if (!Array.isArray(parsed.tasks)) return null;
     const rawTasks = parsed.tasks.filter(isRawPlanTask);
     if (rawTasks.length <= 1) return null;
@@ -57,14 +57,30 @@ async function buildPlanFromTemplate(llmClient, message, template, model, onUsag
     return null;
   }
 }
-const TURN_INTENT_MARKER = "eight independent judgments";
+const SIDE_CALL_MARKERS = [
+  ["You check whether a proposed action genuinely conflicts", '{"conflict":false}'],
+  ["You match a set of observed symptoms against a curated library", "null"],
+  ["You are a security classifier analyzing untrusted external content", '{"flagged":false}'],
+  ["You check whether an assistant's reply is faithful to the raw results", '{"verdict":"grounded"}'],
+  ["You judge whether an assistant actually accomplished a task", '{"done":true}'],
+  ["You condense the earlier part of a conversation", '{"summary":""}'],
+  ["You judge whether an assistant's reply violates constraints", '{"violations":[]}'],
+  ["You weigh the reliability of the sources an assistant read", '{"assessments":[],"weighed":true}'],
+  ["You propose competing explanations for an underdetermined request", '{"hypotheses":[]}'],
+  ["You decide which explanations a set of new observations rules out", '{"contradicted":[]}'],
+  ["You write a session handoff digest", '{"digest":null}'],
+  ["You consolidate a small store of remembered facts about a user", '{"proposals":[]}'],
+  ["You review what a user said across several turns", '{"ops":[]}'],
+  ["You check proposed memory entries against what a user actually said", '{"verdicts":[]}']
+];
+const TURN_INTENT_MARKER = " independent judgments";
 function isTurnIntentRequest(messages) {
   return messages.some((m2) => m2.role === "system" && m2.content.includes(TURN_INTENT_MARKER));
 }
 function deriveTurnIntentJSON(messages, override) {
   var _a;
   const userContent = ((_a = messages.find((m2) => m2.role === "user")) == null ? void 0 : _a.content) ?? "";
-  const risk = classifyRisk(userContent);
+  const risk = classifyRiskLexical(userContent);
   const isReminderRequest = risk.reason.includes("reminder");
   const base = {
     riskLevel: risk.riskLevel,
@@ -74,6 +90,8 @@ function deriveTurnIntentJSON(messages, override) {
     isReminderRequest,
     isBulkReminderRequest: isReminderRequest && risk.requiresApproval,
     isAbandonRequest: false,
+    isPlanQuestion: false,
+    isUnderdetermined: false,
     matchedPlanTemplate: null,
     needsMultiStepPlan: false,
     statesDurableFacts: []
@@ -99,11 +117,14 @@ class ScriptedLLMClient {
     return chunks.join("");
   }
   async callChatStructured(messages, _tools, _options) {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     if (isTurnIntentRequest(messages)) {
       const userContent = ((_a = messages.find((m2) => m2.role === "user")) == null ? void 0 : _a.content) ?? "";
       return { content: deriveTurnIntentJSON(messages, (_c = (_b = this.script).classify) == null ? void 0 : _c.call(_b, userContent)) };
     }
+    const system = ((_d = messages.find((m2) => m2.role === "system")) == null ? void 0 : _d.content) ?? "";
+    const side = [...this.script.sideResponses ?? [], ...SIDE_CALL_MARKERS].find(([marker]) => system.includes(marker));
+    if (side) return { content: side[1] };
     this.toolCalls++;
     const responses = this.script.responses ?? [];
     if (this.responseIndex >= responses.length) {
@@ -124,104 +145,155 @@ export {
   b as AskClarificationService,
   C as CONFIG_KEYS,
   c as ConfigValidationError,
-  D as DEFAULT_ASK_MODE,
-  e as DEFAULT_CONFIG,
-  f as DEFAULT_GOAL_GRAPH_MODE,
-  g as DEFAULT_GOAL_GRAPH_SUGGEST_MODE,
-  h as DEFAULT_ONE_LOOP_MODE,
-  i as DEFAULT_PLAN_MODE,
-  k as EmailDeliveryError,
+  D as DEFAULT_AMBIGUITY_GUARD_MODE,
+  e as DEFAULT_ASK_MODE,
+  f as DEFAULT_CONFIG,
+  g as DEFAULT_GOAL_GRAPH_MODE,
+  h as DEFAULT_GOAL_GRAPH_SUGGEST_MODE,
+  DEFAULT_LAYER_POLICY_MODE,
+  i as DEFAULT_LEXICAL_MODE,
+  j as DEFAULT_MEMORY_WRITE_MODE,
+  k as DEFAULT_ONE_LOOP_MODE,
+  l as DEFAULT_PLAN_GRAPH_MODE,
+  m as DEFAULT_PLAN_MODE,
+  o as EmailDeliveryError,
   F as FETCH_URL_TOOL,
-  l as FILE_TOOLS,
+  p as FILE_TOOLS,
   I as InvalidEmailArgsError,
   L as LAYER_DISPLAY_NAME,
-  m as LAYER_ORDER,
-  n as LAYER_SHORT_CODE,
-  o as LIST_DIRECTORY_TOOL,
-  p as LiveSteeringChannel,
+  q as LAYER_ORDER,
+  r as LAYER_SETTINGS,
+  s as LAYER_SHORT_CODE,
+  t as LEXICAL_CHECK_FAMILIES,
+  u as LEXICAL_FAMILIES,
+  v as LIST_DIRECTORY_TOOL,
+  w as LayerSettingError,
+  x as LiveSteeringChannel,
   MAX_OPTIONS_PER_QUESTION,
   MAX_QUESTIONS_PER_BATCH,
+  M as MEMORY_WRITE_MODES,
   MIN_OPTIONS_PER_QUESTION,
   P as PROVIDER_SETUP,
-  q as PathOutsideWorkspaceError,
-  r as PersonalAssistant,
-  s as PrivateNetworkTargetError,
+  y as PathOutsideWorkspaceError,
+  z as PersonalAssistant,
+  B as PrivateNetworkTargetError,
   R as READ_FILE_TOOL,
-  t as RUN_SHELL_COMMAND_TOOL,
-  S as SEND_EMAIL_TOOL,
-  u as SHELL_TOOLS,
+  G as RUN_SHELL_COMMAND_TOOL,
+  S as SEMANTIC_ESCALATIONS,
+  H as SEND_EMAIL_TOOL,
+  J as SHELL_TOOLS,
   W as WEB_SEARCH_TOOL,
-  v as WEB_TOOLS,
-  w as WRITE_FILE_TOOL,
-  x as abandonPlan,
-  y as applyPendingAction,
-  z as assertPublicHttpUrl,
-  B as braveSearch,
-  G as buildClaudePrompt,
+  K as WEB_TOOLS,
+  N as WRITE_FILE_TOOL,
+  O as abandonPlan,
+  Q as applyLayerSettings,
+  T as applyPendingAction,
+  U as assertPublicHttpUrl,
+  V as braveSearch,
+  X as buildClaudePrompt,
   buildPlanFromTemplate,
-  H as buildWhyChain,
-  J as checkApiKeyFormat,
-  K as classifyError,
-  classifyRisk,
-  N as classifyToolYield,
-  O as classifyTurnIntent,
-  Q as cleanApiKey,
-  T as computePlanPosition,
-  U as createPlanRecord,
-  V as createResendSender,
+  Y as buildWhyChain,
+  Z as checkApiKeyFormat,
+  _ as classifyError,
+  $ as classifyRisk,
+  a1 as classifyToolYield,
+  a2 as classifyTurnIntent,
+  a3 as cleanApiKey,
+  a4 as computePlanPosition,
+  a5 as createPlanRecord,
+  a6 as createResendSender,
   createScriptedLLMClient,
-  X as createSmtpSender,
-  Y as defaultExportFilename,
-  _ as detectHomogeneousBatchList,
-  $ as discardPendingAction,
-  a1 as estimateCostUsd,
-  a2 as executeActionTool,
-  a3 as executeFileTool,
-  a4 as executeShellTool,
-  a5 as executeWebTool,
-  a7 as formatCostSummary,
-  a8 as formatDoctorReport,
-  a9 as formatEmailApprovalReason,
-  aa as formatGoalGraphState,
-  ae as formatMemorySummary,
-  ag as formatPlanProgress,
-  ah as formatSearchResults,
-  ak as formatTranscriptMarkdown,
-  am as getProviderSetup,
-  ao as isGoalGraphEnabled,
-  ap as isGoalGraphSuggestEnabled,
-  aq as isLikelyEmailAddress,
-  ar as listTemplateNames,
-  as as loadActivePlan,
-  at as loadPendingAction,
-  au as loadTemplate,
-  av as matchTemplateIfConfident,
-  aw as nextPendingTask,
-  ax as nodeDisplayName,
-  ay as nodeToLayer,
-  az as normalizeAskMode,
-  aA as normalizeGoalGraphMode,
-  aB as normalizeGoalGraphSuggestMode,
-  aC as normalizeOneLoopMode,
-  aD as normalizePlanMode,
-  aE as parseClaudeCliOutput,
-  aG as pickTemplateForTask,
-  aH as planCompletionPct,
-  aI as resolveAskMode,
-  aJ as resolveConfig,
-  aK as resolveGoalGraphMode,
-  aL as resolveGoalGraphSuggestMode,
-  aM as resolveInWorkspace,
-  aN as resolveOneLoopMode,
-  aO as resolvePlanMode,
-  aP as savePlan,
-  aR as stagePendingAction,
-  aS as stagedActionInput,
-  aU as stripMcpToolPrefix,
-  aV as summarizeToolStep,
-  aW as testApiKey,
-  aX as updatePlanFromRun,
+  a7 as createSmtpSender,
+  a8 as decisionNote,
+  a9 as decompositionReframeEnabled,
+  aa as defaultExportFilename,
+  ac as detectHomogeneousBatchList,
+  ad as discardPendingAction,
+  ae as effectiveState,
+  ag as escalationEnabled,
+  ah as estimateCostUsd,
+  ai as executeActionTool,
+  aj as executeFileTool,
+  ak as executeShellTool,
+  al as executeWebTool,
+  am as explicitEnvOverride,
+  ao as findLayer,
+  aq as formatCostSummary,
+  ar as formatDoctorReport,
+  as as formatEmailApprovalReason,
+  at as formatGoalGraphState,
+  av as formatLayerListing,
+  aw as formatMemoryArchive,
+  ay as formatMemoryHistory,
+  az as formatMemoryInjection,
+  aB as formatMemoryStatus,
+  aC as formatMemorySummary,
+  aE as formatPlanProgress,
+  aF as formatSearchResults,
+  aI as formatTranscriptMarkdown,
+  aK as getProviderSetup,
+  aL as harnessGatePolicy,
+  aM as injectionDetectionEnabled,
+  aN as isAdaptivePolicyEnabled,
+  aP as isGoalGraphEnabled,
+  aQ as isGoalGraphSuggestEnabled,
+  aR as isLayerPolicyMode,
+  aS as isLikelyEmailAddress,
+  aT as isPlanGraphEnabled,
+  aU as isPolicyRecordingEnabled,
+  aW as isToggleable,
+  aX as lexicalActive,
+  aY as lexicalOffEnvValue,
+  aZ as listTemplateNames,
+  a_ as loadActivePlan,
+  a$ as loadPendingAction,
+  b0 as loadTemplate,
+  b1 as lowerConfidenceSourceLines,
+  b2 as matchTemplateIfConfident,
+  b4 as memoryStatusChecks,
+  b5 as nextPendingTask,
+  b6 as nodeDisplayName,
+  b7 as nodeToLayer,
+  b8 as normalizeAmbiguityGuardMode,
+  b9 as normalizeAskMode,
+  ba as normalizeGoalGraphMode,
+  bb as normalizeGoalGraphSuggestMode,
+  bc as normalizeLayerPolicyMode,
+  bd as normalizeOneLoopMode,
+  be as normalizePlanGraphMode,
+  bf as normalizePlanMode,
+  bh as parseClaudeCliOutput,
+  bk as pickTemplateForTask,
+  bl as planCompletionPct,
+  bm as planToSnapshot,
+  bp as resolveAmbiguityGuardMode,
+  bq as resolveAskMode,
+  br as resolveConfig,
+  bs as resolveEscalationPlan,
+  bt as resolveGoalGraphMode,
+  bu as resolveGoalGraphSuggestMode,
+  bv as resolveInWorkspace,
+  bw as resolveLayerPolicyMode,
+  bx as resolveLayerPolicyModeFromConfig,
+  by as resolveLexicalMode,
+  bz as resolveLexicalOff,
+  bA as resolveMemoryWriteMode,
+  bB as resolveOneLoopMode,
+  bC as resolvePlanGraphMode,
+  bD as resolvePlanMode,
+  bE as sanitizeLayerChoices,
+  bF as savePlan,
+  bH as stagePendingAction,
+  bI as stagedActionInput,
+  bK as stripMcpToolPrefix,
+  bM as summarizeSettledToolStep,
+  bN as summarizeToolStep,
+  bO as syncHarnessLexicalEnv,
+  bP as testApiKey,
+  bQ as turnPolicyBudget,
+  bR as updatePlanFromRun,
   validateAskResponse,
-  aY as validateConfig
+  bS as validateConfig,
+  bT as withLayerChoice
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../src/plan-builder.ts","../src/scripted-llm-client.ts"],"sourcesContent":["import type { ILLMClient, TokenUsage } from '@buildaharness/runtime'\nimport type { DecomposedTaskSpec } from './decomposition-classifier.js'\nimport type { PlanTemplate } from './plan-templates/index.js'\n\nexport interface Plan {\n  templateName: string\n  successCriteria: string\n  tasks: DecomposedTaskSpec[]\n  /**\n   * Why this approach, not just what the success criteria are — optional for now since neither\n   * buildPlanFromTemplate's template-personalization call nor any other current producer of a\n   * Plan asks the LLM for one; plan-store.ts's createPlanRecord defaults it to '' when absent.\n   * A future from-scratch drafting path (plan mode's P3) is expected to populate it.\n   */\n  rationale?: string\n}\n\nconst PLAN_SCHEMA = {\n  type: 'object',\n  properties: {\n    tasks: {\n      type: 'array',\n      items: {\n        type: 'object',\n        properties: {\n          id: { type: 'string' },\n          description: { type: 'string' },\n          depends_on: { type: 'array', items: { type: 'string' } },\n        },\n        required: ['id', 'description', 'depends_on'],\n      },\n    },\n  },\n  required: ['tasks'],\n}\n\nfunction buildSystemPrompt(template: PlanTemplate): string {\n  const skeleton = template.tasks\n    .map((t) => `- id: ${t.id}; title: ${t.title}; depends_on: [${t.depends_on.join(', ')}]`)\n    .join('\\n')\n  return (\n    `You are adapting a \"${template.name}\" plan template to a specific user request. ` +\n    `Here is the template's task skeleton — keep the exact same ids and depends_on structure, ` +\n    `one output task per skeleton task, but personalize each description to the actual request:\\n${skeleton}\\n\\n` +\n    `Success criteria for this kind of plan: ${template.success_criteria}\\n\\n` +\n    'Phrase each `description` starting with the concrete subject or object it acts on (e.g. \"the login tests: ' +\n    'rerun after the config fix\" rather than \"rerun the login tests after the config fix\"), so later comparisons ' +\n    \"against this task's completion/failure beliefs share matching vocabulary. \" +\n    'Respond with JSON only, no prose: {\"tasks\":[{\"id\": string, \"description\": string, \"depends_on\": ' +\n    'string[]}]}. `id` and `depends_on` values must exactly match the skeleton above.'\n  )\n}\n\n// Only the shape the LLM actually returns (id/description/depends_on) — riskLevel isn't asked for\n// here at all (see buildPlanFromTemplate's doc comment for why) and gets attached afterward from\n// the template's own already-curated risk_level, so this is deliberately narrower than\n// DecomposedTaskSpec itself.\ninterface RawPlanTask {\n  id: string\n  description: string\n  depends_on: string[]\n}\n\nfunction isRawPlanTask(value: unknown): value is RawPlanTask {\n  if (typeof value !== 'object' || value === null) return false\n  const v = value as Record<string, unknown>\n  return (\n    typeof v.id === 'string' &&\n    typeof v.description === 'string' &&\n    Array.isArray(v.depends_on) &&\n    v.depends_on.every((d) => typeof d === 'string')\n  )\n}\n\n/**\n * Spends one real LLM call personalizing `template`'s task skeleton to `message` —\n * only called once classifyTurnIntent has already named a matchedPlanTemplate, so an\n * ordinary turn never pays for this. Same \"malformed/incomplete JSON is the expected\n * failure mode, not the edge case\" fallback classifyTurnIntent itself uses: any parse\n * failure or a response with fewer than 2 usable tasks returns null, meaning \"fall back to\n * the caller's own ad hoc decomposition for this turn\" rather than throwing.\n *\n * Each output task's `riskLevel` is attached from the matching skeleton task's own\n * `risk_level` (curated by whoever wrote the template's JSON) by id, not asked of the LLM —\n * the template already has this, more accurately than an LLM re-deriving it from a\n * personalized one-line description would, and it costs zero extra output tokens. Falls back\n * to 'LOW' only for the pathological case of a task id the LLM invented that doesn't match any\n * skeleton task (the id/depends_on-must-match-skeleton instruction above means this should not\n * happen in practice).\n */\nexport async function buildPlanFromTemplate(\n  llmClient: ILLMClient,\n  message: string,\n  template: PlanTemplate,\n  model?: string,\n  onUsage?: (usage: TokenUsage) => void,\n): Promise<Plan | null> {\n  try {\n    const response = await llmClient.callChatStructured(\n      [\n        { role: 'system', content: buildSystemPrompt(template) },\n        { role: 'user', content: message },\n      ],\n      undefined,\n      { model, onUsage, structuredOutput: { schema: PLAN_SCHEMA } },\n    )\n    const parsed = JSON.parse(response.content) as { tasks?: unknown }\n    if (!Array.isArray(parsed.tasks)) return null\n    const rawTasks = parsed.tasks.filter(isRawPlanTask)\n    if (rawTasks.length <= 1) return null\n    const riskByTemplateId = new Map(template.tasks.map((t) => [t.id, t.risk_level]))\n    const tasks: DecomposedTaskSpec[] = rawTasks.map((t) => ({ ...t, riskLevel: riskByTemplateId.get(t.id) ?? 'LOW' }))\n    return { templateName: template.name, successCriteria: template.success_criteria, tasks }\n  } catch {\n    return null\n  }\n}\n","import type {\n  ChatMessage,\n  ChatOptions,\n  ILLMClient,\n  LLMStructuredResponse,\n  ToolDefinition,\n} from '@buildaharness/runtime'\nimport { classifyRisk } from './risk-classifier.js'\n\n/**\n * A deterministic, network-free {@link ILLMClient} for tests and demos — the one publicly\n * supported way to drive a real `PersonalAssistant` turn end to end without a proxy, an API key,\n * or a live model. Built for the internal plan phase B1 (the browser-e2e lane\n * that unblocks the `ASSISTANT_ONE_LOOP` default-flip), and reusable by chat-ui's `demo-seed.ts`.\n *\n * It mirrors the shape of the internal `ScriptedToolLLMClient` that `assistant.test.ts` has used\n * for a long time: every turn spends exactly one mandatory `classifyTurnIntent` call up front,\n * which this client recognises (by a distinctive phrase from that classifier's system prompt) and\n * answers on its own from a lightweight, deterministic default — so `responses` only has to\n * script the *tool loop / one-loop proposer's* own calls, not that bookkeeping call.\n *\n * `responses` entries are consumed in order, one per non-classifier `callChatStructured` call:\n *   - a plain `string` → `{ content: string }` (a final answer, no tool calls)\n *   - an `LLMStructuredResponse` → use as-is (set `toolCalls` to simulate the model calling a tool)\n *\n * `callChat`/`callChatSync` (the no-tools reply path, and post-approval synthesis) stream\n * `streamChunks` (default: `['']`).\n */\nexport interface ScriptedLLMClientScript {\n  /** Ordered structured responses for the tool loop / one-loop proposer. A bare string is shorthand for a final answer with no tool calls. */\n  responses?: Array<string | LLMStructuredResponse>\n  /** Chunks streamed from `callChat`/`callChatSync`. Defaults to `['']`. */\n  streamChunks?: string[]\n  /**\n   * Per-user-message override of the auto-answered `classifyTurnIntent` JSON fields (e.g.\n   * `{ isTrivial: true }`, `{ riskLevel: 'HIGH' }`, `{ decomposedTasks: [...] }`). Return\n   * `undefined` to keep the derived default for that message.\n   */\n  classify?: (userMessage: string) => Record<string, unknown> | undefined\n}\n\n/** The phrase that opens `turn-intent-classifier.ts`'s system prompt — stable, and how every scripted client tells that mandatory call apart from a real tool-loop call. */\nconst TURN_INTENT_MARKER = 'eight independent judgments'\n\nfunction isTurnIntentRequest(messages: ChatMessage[]): boolean {\n  return messages.some((m) => m.role === 'system' && m.content.includes(TURN_INTENT_MARKER))\n}\n\n/**\n * The deterministic stand-in for what a real model would return for `classifyTurnIntent` —\n * risk comes from the same lexical `classifyRisk` the real fallback path uses; everything else\n * is inert (not trivial, not a reminder, no decomposition, no plan template) unless `override`\n * says otherwise. `isTrivial` defaults to `false` so a scripted turn actually exercises the\n * harness loop (the interesting case for one-loop parity tests); pass `{ isTrivial: true }` via\n * `classify` for the triviality fast path.\n */\nfunction deriveTurnIntentJSON(messages: ChatMessage[], override?: Record<string, unknown>): string {\n  const userContent = messages.find((m) => m.role === 'user')?.content ?? ''\n  const risk = classifyRisk(userContent)\n  const isReminderRequest = risk.reason.includes('reminder')\n  const base = {\n    riskLevel: risk.riskLevel,\n    riskReason: risk.reason,\n    isTrivial: false,\n    decomposedTasks: [],\n    isReminderRequest,\n    isBulkReminderRequest: isReminderRequest && risk.requiresApproval,\n    isAbandonRequest: false,\n    matchedPlanTemplate: null,\n    needsMultiStepPlan: false,\n    statesDurableFacts: [],\n  }\n  return JSON.stringify({ ...base, ...override })\n}\n\nclass ScriptedLLMClient implements ILLMClient {\n  /** Non-classifier `callChatStructured` calls made so far — the index into `responses`. */\n  toolCalls = 0\n  private responseIndex = 0\n\n  constructor(private readonly script: ScriptedLLMClientScript) {}\n\n  private get streamChunks(): string[] {\n    return this.script.streamChunks && this.script.streamChunks.length > 0 ? this.script.streamChunks : ['']\n  }\n\n  async *callChat(_messages: ChatMessage[], _options?: ChatOptions): AsyncIterable<string> {\n    for (const chunk of this.streamChunks) yield chunk\n  }\n\n  async callChatSync(messages: ChatMessage[], options?: ChatOptions): Promise<string> {\n    const chunks: string[] = []\n    for await (const chunk of this.callChat(messages, options)) chunks.push(chunk)\n    return chunks.join('')\n  }\n\n  async callChatStructured(messages: ChatMessage[], _tools?: ToolDefinition[], _options?: ChatOptions): Promise<LLMStructuredResponse> {\n    if (isTurnIntentRequest(messages)) {\n      const userContent = messages.find((m) => m.role === 'user')?.content ?? ''\n      return { content: deriveTurnIntentJSON(messages, this.script.classify?.(userContent)) }\n    }\n    this.toolCalls++\n    const responses = this.script.responses ?? []\n    if (this.responseIndex >= responses.length) {\n      throw new Error(\n        `createScriptedLLMClient: no scripted response for tool-loop call #${this.responseIndex + 1} (scripted ${responses.length})`,\n      )\n    }\n    const next = responses[this.responseIndex++]\n    return typeof next === 'string' ? { content: next } : next\n  }\n}\n\n/**\n * Builds a scripted {@link ILLMClient}. See {@link ScriptedLLMClientScript}. The returned value\n * is a plain `ILLMClient` — pass it straight to `PersonalAssistant.create({ llmClient })`.\n */\nexport function createScriptedLLMClient(script: ScriptedLLMClientScript = {}): ILLMClient {\n  return new ScriptedLLMClient(script)\n}\n"],"names":["t","v","m"],"mappings":";;;;;;AAiBA,MAAM,cAAc;AAAA,EAClB,MAAM;AAAA,EACN,YAAY;AAAA,IACV,OAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,QACL,MAAM;AAAA,QACN,YAAY;AAAA,UACV,IAAI,EAAE,MAAM,SAAA;AAAA,UACZ,aAAa,EAAE,MAAM,SAAA;AAAA,UACrB,YAAY,EAAE,MAAM,SAAS,OAAO,EAAE,MAAM,WAAS;AAAA,QAAE;AAAA,QAEzD,UAAU,CAAC,MAAM,eAAe,YAAY;AAAA,MAAA;AAAA,IAC9C;AAAA,EACF;AAAA,EAEF,UAAU,CAAC,OAAO;AACpB;AAEA,SAAS,kBAAkB,UAAgC;AACzD,QAAM,WAAW,SAAS,MACvB,IAAI,CAACA,OAAM,SAASA,GAAE,EAAE,YAAYA,GAAE,KAAK,kBAAkBA,GAAE,WAAW,KAAK,IAAI,CAAC,GAAG,EACvF,KAAK,IAAI;AACZ,SACE,uBAAuB,SAAS,IAAI;AAAA,EAE2D,QAAQ;AAAA;AAAA,0CAC5D,SAAS,gBAAgB;AAAA;AAAA;AAOxE;AAYA,SAAS,cAAc,OAAsC;AAC3D,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAMC,KAAI;AACV,SACE,OAAOA,GAAE,OAAO,YAChB,OAAOA,GAAE,gBAAgB,YACzB,MAAM,QAAQA,GAAE,UAAU,KAC1BA,GAAE,WAAW,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AAEnD;AAkBA,eAAsB,sBACpB,WACA,SACA,UACA,OACA,SACsB;AACtB,MAAI;AACF,UAAM,WAAW,MAAM,UAAU;AAAA,MAC/B;AAAA,QACE,EAAE,MAAM,UAAU,SAAS,kBAAkB,QAAQ,EAAA;AAAA,QACrD,EAAE,MAAM,QAAQ,SAAS,QAAA;AAAA,MAAQ;AAAA,MAEnC;AAAA,MACA,EAAE,OAAO,SAAS,kBAAkB,EAAE,QAAQ,cAAY;AAAA,IAAE;AAE9D,UAAM,SAAS,KAAK,MAAM,SAAS,OAAO;AAC1C,QAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,EAAG,QAAO;AACzC,UAAM,WAAW,OAAO,MAAM,OAAO,aAAa;AAClD,QAAI,SAAS,UAAU,EAAG,QAAO;AACjC,UAAM,mBAAmB,IAAI,IAAI,SAAS,MAAM,IAAI,CAACD,OAAM,CAACA,GAAE,IAAIA,GAAE,UAAU,CAAC,CAAC;AAChF,UAAM,QAA8B,SAAS,IAAI,CAACA,QAAO,EAAE,GAAGA,IAAG,WAAW,iBAAiB,IAAIA,GAAE,EAAE,KAAK,QAAQ;AAClH,WAAO,EAAE,cAAc,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,MAAA;AAAA,EACpF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AC1EA,MAAM,qBAAqB;AAE3B,SAAS,oBAAoB,UAAkC;AAC7D,SAAO,SAAS,KAAK,CAACE,OAAMA,GAAE,SAAS,YAAYA,GAAE,QAAQ,SAAS,kBAAkB,CAAC;AAC3F;AAUA,SAAS,qBAAqB,UAAyB,UAA4C;;AACjG,QAAM,gBAAc,cAAS,KAAK,CAACA,OAAMA,GAAE,SAAS,MAAM,MAAtC,mBAAyC,YAAW;AACxE,QAAM,OAAO,aAAa,WAAW;AACrC,QAAM,oBAAoB,KAAK,OAAO,SAAS,UAAU;AACzD,QAAM,OAAO;AAAA,IACX,WAAW,KAAK;AAAA,IAChB,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,IACX,iBAAiB,CAAA;AAAA,IACjB;AAAA,IACA,uBAAuB,qBAAqB,KAAK;AAAA,IACjD,kBAAkB;AAAA,IAClB,qBAAqB;AAAA,IACrB,oBAAoB;AAAA,IACpB,oBAAoB,CAAA;AAAA,EAAC;AAEvB,SAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,UAAU;AAChD;AAEA,MAAM,kBAAwC;AAAA,EAK5C,YAA6B,QAAiC;AAH9D;AAAA,qCAAY;AACJ,yCAAgB;AAEK,SAAA,SAAA;AAAA,EAAkC;AAAA,EAE/D,IAAY,eAAyB;AACnC,WAAO,KAAK,OAAO,gBAAgB,KAAK,OAAO,aAAa,SAAS,IAAI,KAAK,OAAO,eAAe,CAAC,EAAE;AAAA,EACzG;AAAA,EAEA,OAAO,SAAS,WAA0B,UAA+C;AACvF,eAAW,SAAS,KAAK,aAAc,OAAM;AAAA,EAC/C;AAAA,EAEA,MAAM,aAAa,UAAyB,SAAwC;AAClF,UAAM,SAAmB,CAAA;AACzB,qBAAiB,SAAS,KAAK,SAAS,UAAU,OAAO,EAAG,QAAO,KAAK,KAAK;AAC7E,WAAO,OAAO,KAAK,EAAE;AAAA,EACvB;AAAA,EAEA,MAAM,mBAAmB,UAAyB,QAA2B,UAAwD;;AACnI,QAAI,oBAAoB,QAAQ,GAAG;AACjC,YAAM,gBAAc,cAAS,KAAK,CAACA,OAAMA,GAAE,SAAS,MAAM,MAAtC,mBAAyC,YAAW;AACxE,aAAO,EAAE,SAAS,qBAAqB,WAAU,gBAAK,QAAO,aAAZ,4BAAuB,YAAY,EAAA;AAAA,IACtF;AACA,SAAK;AACL,UAAM,YAAY,KAAK,OAAO,aAAa,CAAA;AAC3C,QAAI,KAAK,iBAAiB,UAAU,QAAQ;AAC1C,YAAM,IAAI;AAAA,QACR,qEAAqE,KAAK,gBAAgB,CAAC,cAAc,UAAU,MAAM;AAAA,MAAA;AAAA,IAE7H;AACA,UAAM,OAAO,UAAU,KAAK,eAAe;AAC3C,WAAO,OAAO,SAAS,WAAW,EAAE,SAAS,SAAS;AAAA,EACxD;AACF;AAMO,SAAS,wBAAwB,SAAkC,IAAgB;AACxF,SAAO,IAAI,kBAAkB,MAAM;AACrC;"}
+{"version":3,"file":"index.js","sources":["../src/plan-builder.ts","../src/scripted-llm-client.ts"],"sourcesContent":["import type { ILLMClient, TokenUsage } from '@buildaharness/runtime'\nimport type { DecomposedTaskSpec } from './decomposition-classifier.js'\nimport type { PlanTemplate } from './plan-templates/index.js'\nimport { parseModelJson } from './model-json.js'\n\nexport interface Plan {\n  templateName: string\n  successCriteria: string\n  tasks: DecomposedTaskSpec[]\n  /**\n   * Why this approach, not just what the success criteria are — optional for now since neither\n   * buildPlanFromTemplate's template-personalization call nor any other current producer of a\n   * Plan asks the LLM for one; plan-store.ts's createPlanRecord defaults it to '' when absent.\n   * A future from-scratch drafting path (plan mode's P3) is expected to populate it.\n   */\n  rationale?: string\n}\n\nconst PLAN_SCHEMA = {\n  type: 'object',\n  properties: {\n    tasks: {\n      type: 'array',\n      items: {\n        type: 'object',\n        properties: {\n          id: { type: 'string' },\n          description: { type: 'string' },\n          depends_on: { type: 'array', items: { type: 'string' } },\n        },\n        required: ['id', 'description', 'depends_on'],\n      },\n    },\n  },\n  required: ['tasks'],\n}\n\nfunction buildSystemPrompt(template: PlanTemplate): string {\n  const skeleton = template.tasks\n    .map((t) => `- id: ${t.id}; title: ${t.title}; depends_on: [${t.depends_on.join(', ')}]`)\n    .join('\\n')\n  return (\n    `You are adapting a \"${template.name}\" plan template to a specific user request. ` +\n    `Here is the template's task skeleton — keep the exact same ids and depends_on structure, ` +\n    `one output task per skeleton task, but personalize each description to the actual request:\\n${skeleton}\\n\\n` +\n    `Success criteria for this kind of plan: ${template.success_criteria}\\n\\n` +\n    'Phrase each `description` starting with the concrete subject or object it acts on (e.g. \"the login tests: ' +\n    'rerun after the config fix\" rather than \"rerun the login tests after the config fix\"), so later comparisons ' +\n    \"against this task's completion/failure beliefs share matching vocabulary. \" +\n    'Respond with JSON only, no prose: {\"tasks\":[{\"id\": string, \"description\": string, \"depends_on\": ' +\n    'string[]}]}. `id` and `depends_on` values must exactly match the skeleton above.'\n  )\n}\n\n// Only the shape the LLM actually returns (id/description/depends_on) — riskLevel isn't asked for\n// here at all (see buildPlanFromTemplate's doc comment for why) and gets attached afterward from\n// the template's own already-curated risk_level, so this is deliberately narrower than\n// DecomposedTaskSpec itself.\ninterface RawPlanTask {\n  id: string\n  description: string\n  depends_on: string[]\n}\n\nfunction isRawPlanTask(value: unknown): value is RawPlanTask {\n  if (typeof value !== 'object' || value === null) return false\n  const v = value as Record<string, unknown>\n  return (\n    typeof v.id === 'string' &&\n    typeof v.description === 'string' &&\n    Array.isArray(v.depends_on) &&\n    v.depends_on.every((d) => typeof d === 'string')\n  )\n}\n\n/**\n * Spends one real LLM call personalizing `template`'s task skeleton to `message` —\n * only called once classifyTurnIntent has already named a matchedPlanTemplate, so an\n * ordinary turn never pays for this. Same \"malformed/incomplete JSON is the expected\n * failure mode, not the edge case\" fallback classifyTurnIntent itself uses: any parse\n * failure or a response with fewer than 2 usable tasks returns null, meaning \"fall back to\n * the caller's own ad hoc decomposition for this turn\" rather than throwing.\n *\n * Each output task's `riskLevel` is attached from the matching skeleton task's own\n * `risk_level` (curated by whoever wrote the template's JSON) by id, not asked of the LLM —\n * the template already has this, more accurately than an LLM re-deriving it from a\n * personalized one-line description would, and it costs zero extra output tokens. Falls back\n * to 'LOW' only for the pathological case of a task id the LLM invented that doesn't match any\n * skeleton task (the id/depends_on-must-match-skeleton instruction above means this should not\n * happen in practice).\n */\nexport async function buildPlanFromTemplate(\n  llmClient: ILLMClient,\n  message: string,\n  template: PlanTemplate,\n  model?: string,\n  onUsage?: (usage: TokenUsage) => void,\n): Promise<Plan | null> {\n  try {\n    const response = await llmClient.callChatStructured(\n      [\n        { role: 'system', content: buildSystemPrompt(template) },\n        { role: 'user', content: message },\n      ],\n      undefined,\n      { model, onUsage, structuredOutput: { schema: PLAN_SCHEMA } },\n    )\n    const parsed = parseModelJson(response.content) as { tasks?: unknown }\n    if (!Array.isArray(parsed.tasks)) return null\n    const rawTasks = parsed.tasks.filter(isRawPlanTask)\n    if (rawTasks.length <= 1) return null\n    const riskByTemplateId = new Map(template.tasks.map((t) => [t.id, t.risk_level]))\n    const tasks: DecomposedTaskSpec[] = rawTasks.map((t) => ({ ...t, riskLevel: riskByTemplateId.get(t.id) ?? 'LOW' }))\n    return { templateName: template.name, successCriteria: template.success_criteria, tasks }\n  } catch {\n    return null\n  }\n}\n","import type {\n  ChatMessage,\n  ChatOptions,\n  ILLMClient,\n  LLMStructuredResponse,\n  ToolDefinition,\n} from '@buildaharness/runtime'\nimport { classifyRiskLexical } from './risk-classifier.js'\n\n/**\n * A deterministic, network-free {@link ILLMClient} for tests and demos — the one publicly\n * supported way to drive a real `PersonalAssistant` turn end to end without a proxy, an API key,\n * or a live model. Built for the internal plan phase B1 (the browser-e2e lane\n * that unblocks the `ASSISTANT_ONE_LOOP` default-flip), and reusable by chat-ui's `demo-seed.ts`.\n *\n * It mirrors the shape of the internal `ScriptedToolLLMClient` that `assistant.test.ts` has used\n * for a long time: every turn spends exactly one mandatory `classifyTurnIntent` call up front,\n * which this client recognises (by a distinctive phrase from that classifier's system prompt) and\n * answers on its own from a lightweight, deterministic default — so `responses` only has to\n * script the *tool loop / one-loop proposer's* own calls, not that bookkeeping call.\n *\n * `responses` entries are consumed in order, one per non-classifier, non-side-call\n * `callChatStructured` call:\n *   - a plain `string` → `{ content: string }` (a final answer, no tool calls)\n *   - an `LLMStructuredResponse` → use as-is (set `toolCalls` to simulate the model calling a tool)\n *\n * A handful of other calls are auxiliary semantic escalations (the change reviewer, the failure\n * matcher, the LLM injection classifier) that a tool-using turn can trigger without any script\n * author asking for them — with lexicalMode's default now `disabled`, the lexical checks these\n * sit on top of never short-circuit them, so they fire on every qualifying call, not just ones a\n * scenario is specifically testing. Answered from a safe, inert default (see SIDE_CALL_MARKERS)\n * so they never silently consume a `responses` slot meant for the real tool loop — the exact\n * silent-consumption bug that broke chat-ui's W5 proxy e2e test when the default flipped. Override\n * or add to this list via `sideResponses` for a test that specifically wants one of these calls to\n * answer something else (e.g. a genuine injection flag).\n *\n * `callChat`/`callChatSync` (the no-tools reply path, and post-approval synthesis) stream\n * `streamChunks` (default: `['']`).\n */\nexport interface ScriptedLLMClientScript {\n  /** Ordered structured responses for the tool loop / one-loop proposer. A bare string is shorthand for a final answer with no tool calls. */\n  responses?: Array<string | LLMStructuredResponse>\n  /** Chunks streamed from `callChat`/`callChatSync`. Defaults to `['']`. */\n  streamChunks?: string[]\n  /**\n   * Per-user-message override of the auto-answered `classifyTurnIntent` JSON fields (e.g.\n   * `{ isTrivial: true }`, `{ riskLevel: 'HIGH' }`, `{ decomposedTasks: [...] }`). Return\n   * `undefined` to keep the derived default for that message.\n   */\n  classify?: (userMessage: string) => Record<string, unknown> | undefined\n  /**\n   * Overrides/extends SIDE_CALL_MARKERS' default answers for a system-prompt substring — checked\n   * before the built-in defaults, so a test can make the change reviewer/failure matcher/injection\n   * classifier answer something other than \"nothing to see here\" without it consuming a\n   * `responses` slot either way. `[marker, rawJsonContent]` pairs, same shape as the built-ins.\n   */\n  sideResponses?: Array<[string, string]>\n}\n\n/**\n * Known auxiliary semantic-escalation system prompts and their safe, inert default answer — see\n * ScriptedLLMClientScript's doc comment. Kept in sync by hand with each check's own system prompt\n * (review-checker.ts, failure-mode-matcher.ts, trust-tagging.ts, grounding-check.ts, task-completion-check.ts, constraint-check.ts, semantic-compaction.ts, source-reliability.ts, semantic-hypotheses.ts, episodic-digest.ts, memory-consolidation.ts, memory-reviewer.ts) since there's no shared constant\n * to import without a circular dependency back into this package's own public surface.\n */\nexport const SIDE_CALL_MARKERS: Array<[string, string]> = [\n  ['You check whether a proposed action genuinely conflicts', '{\"conflict\":false}'],\n  ['You match a set of observed symptoms against a curated library', 'null'],\n  ['You are a security classifier analyzing untrusted external content', '{\"flagged\":false}'],\n  ['You check whether an assistant\\'s reply is faithful to the raw results', '{\"verdict\":\"grounded\"}'],\n  ['You judge whether an assistant actually accomplished a task', '{\"done\":true}'],\n  ['You condense the earlier part of a conversation', '{\"summary\":\"\"}'],\n  ['You judge whether an assistant\\'s reply violates constraints', '{\"violations\":[]}'],\n  ['You weigh the reliability of the sources an assistant read', '{\"assessments\":[],\"weighed\":true}'],\n  ['You propose competing explanations for an underdetermined request', '{\"hypotheses\":[]}'],\n  ['You decide which explanations a set of new observations rules out', '{\"contradicted\":[]}'],\n  ['You write a session handoff digest', '{\"digest\":null}'],\n  ['You consolidate a small store of remembered facts about a user', '{\"proposals\":[]}'],\n  ['You review what a user said across several turns', '{\"ops\":[]}'],\n  ['You check proposed memory entries against what a user actually said', '{\"verdicts\":[]}'],\n]\n\n/** The phrase that opens `turn-intent-classifier.ts`'s system prompt — stable, and how every scripted client tells that mandatory call apart from a real tool-loop call. */\nconst TURN_INTENT_MARKER = ' independent judgments'\n\nfunction isTurnIntentRequest(messages: ChatMessage[]): boolean {\n  return messages.some((m) => m.role === 'system' && m.content.includes(TURN_INTENT_MARKER))\n}\n\n/**\n * The deterministic stand-in for what a real model would return for `classifyTurnIntent` —\n * risk comes from the same lexical `classifyRisk` the real fallback path uses; everything else\n * is inert (not trivial, not a reminder, no decomposition, no plan template) unless `override`\n * says otherwise. `isTrivial` defaults to `false` so a scripted turn actually exercises the\n * harness loop (the interesting case for one-loop parity tests); pass `{ isTrivial: true }` via\n * `classify` for the triviality fast path.\n */\nfunction deriveTurnIntentJSON(messages: ChatMessage[], override?: Record<string, unknown>): string {\n  const userContent = messages.find((m) => m.role === 'user')?.content ?? ''\n  const risk = classifyRiskLexical(userContent)\n  const isReminderRequest = risk.reason.includes('reminder')\n  const base = {\n    riskLevel: risk.riskLevel,\n    riskReason: risk.reason,\n    isTrivial: false,\n    decomposedTasks: [],\n    isReminderRequest,\n    isBulkReminderRequest: isReminderRequest && risk.requiresApproval,\n    isAbandonRequest: false,\n    isPlanQuestion: false,\n    isUnderdetermined: false,\n    matchedPlanTemplate: null,\n    needsMultiStepPlan: false,\n    statesDurableFacts: [],\n  }\n  return JSON.stringify({ ...base, ...override })\n}\n\nclass ScriptedLLMClient implements ILLMClient {\n  /** Non-classifier `callChatStructured` calls made so far — the index into `responses`. */\n  toolCalls = 0\n  private responseIndex = 0\n\n  constructor(private readonly script: ScriptedLLMClientScript) {}\n\n  private get streamChunks(): string[] {\n    return this.script.streamChunks && this.script.streamChunks.length > 0 ? this.script.streamChunks : ['']\n  }\n\n  async *callChat(_messages: ChatMessage[], _options?: ChatOptions): AsyncIterable<string> {\n    for (const chunk of this.streamChunks) yield chunk\n  }\n\n  async callChatSync(messages: ChatMessage[], options?: ChatOptions): Promise<string> {\n    const chunks: string[] = []\n    for await (const chunk of this.callChat(messages, options)) chunks.push(chunk)\n    return chunks.join('')\n  }\n\n  async callChatStructured(messages: ChatMessage[], _tools?: ToolDefinition[], _options?: ChatOptions): Promise<LLMStructuredResponse> {\n    if (isTurnIntentRequest(messages)) {\n      const userContent = messages.find((m) => m.role === 'user')?.content ?? ''\n      return { content: deriveTurnIntentJSON(messages, this.script.classify?.(userContent)) }\n    }\n    const system = messages.find((m) => m.role === 'system')?.content ?? ''\n    const side = [...(this.script.sideResponses ?? []), ...SIDE_CALL_MARKERS].find(([marker]) => system.includes(marker))\n    if (side) return { content: side[1] }\n    this.toolCalls++\n    const responses = this.script.responses ?? []\n    if (this.responseIndex >= responses.length) {\n      throw new Error(\n        `createScriptedLLMClient: no scripted response for tool-loop call #${this.responseIndex + 1} (scripted ${responses.length})`,\n      )\n    }\n    const next = responses[this.responseIndex++]\n    return typeof next === 'string' ? { content: next } : next\n  }\n}\n\n/**\n * Builds a scripted {@link ILLMClient}. See {@link ScriptedLLMClientScript}. The returned value\n * is a plain `ILLMClient` — pass it straight to `PersonalAssistant.create({ llmClient })`.\n */\nexport function createScriptedLLMClient(script: ScriptedLLMClientScript = {}): ILLMClient {\n  return new ScriptedLLMClient(script)\n}\n"],"names":["t","v","m"],"mappings":";;;;;;AAkBA,MAAM,cAAc;AAAA,EAClB,MAAM;AAAA,EACN,YAAY;AAAA,IACV,OAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,QACL,MAAM;AAAA,QACN,YAAY;AAAA,UACV,IAAI,EAAE,MAAM,SAAA;AAAA,UACZ,aAAa,EAAE,MAAM,SAAA;AAAA,UACrB,YAAY,EAAE,MAAM,SAAS,OAAO,EAAE,MAAM,WAAS;AAAA,QAAE;AAAA,QAEzD,UAAU,CAAC,MAAM,eAAe,YAAY;AAAA,MAAA;AAAA,IAC9C;AAAA,EACF;AAAA,EAEF,UAAU,CAAC,OAAO;AACpB;AAEA,SAAS,kBAAkB,UAAgC;AACzD,QAAM,WAAW,SAAS,MACvB,IAAI,CAACA,OAAM,SAASA,GAAE,EAAE,YAAYA,GAAE,KAAK,kBAAkBA,GAAE,WAAW,KAAK,IAAI,CAAC,GAAG,EACvF,KAAK,IAAI;AACZ,SACE,uBAAuB,SAAS,IAAI;AAAA,EAE2D,QAAQ;AAAA;AAAA,0CAC5D,SAAS,gBAAgB;AAAA;AAAA;AAOxE;AAYA,SAAS,cAAc,OAAsC;AAC3D,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAMC,KAAI;AACV,SACE,OAAOA,GAAE,OAAO,YAChB,OAAOA,GAAE,gBAAgB,YACzB,MAAM,QAAQA,GAAE,UAAU,KAC1BA,GAAE,WAAW,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AAEnD;AAkBA,eAAsB,sBACpB,WACA,SACA,UACA,OACA,SACsB;AACtB,MAAI;AACF,UAAM,WAAW,MAAM,UAAU;AAAA,MAC/B;AAAA,QACE,EAAE,MAAM,UAAU,SAAS,kBAAkB,QAAQ,EAAA;AAAA,QACrD,EAAE,MAAM,QAAQ,SAAS,QAAA;AAAA,MAAQ;AAAA,MAEnC;AAAA,MACA,EAAE,OAAO,SAAS,kBAAkB,EAAE,QAAQ,cAAY;AAAA,IAAE;AAE9D,UAAM,SAAS,eAAe,SAAS,OAAO;AAC9C,QAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,EAAG,QAAO;AACzC,UAAM,WAAW,OAAO,MAAM,OAAO,aAAa;AAClD,QAAI,SAAS,UAAU,EAAG,QAAO;AACjC,UAAM,mBAAmB,IAAI,IAAI,SAAS,MAAM,IAAI,CAACD,OAAM,CAACA,GAAE,IAAIA,GAAE,UAAU,CAAC,CAAC;AAChF,UAAM,QAA8B,SAAS,IAAI,CAACA,QAAO,EAAE,GAAGA,IAAG,WAAW,iBAAiB,IAAIA,GAAE,EAAE,KAAK,QAAQ;AAClH,WAAO,EAAE,cAAc,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,MAAA;AAAA,EACpF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;ACpDO,MAAM,oBAA6C;AAAA,EACxD,CAAC,2DAA2D,oBAAoB;AAAA,EAChF,CAAC,kEAAkE,MAAM;AAAA,EACzE,CAAC,sEAAsE,mBAAmB;AAAA,EAC1F,CAAC,yEAA0E,wBAAwB;AAAA,EACnG,CAAC,+DAA+D,eAAe;AAAA,EAC/E,CAAC,mDAAmD,gBAAgB;AAAA,EACpE,CAAC,+DAAgE,mBAAmB;AAAA,EACpF,CAAC,8DAA8D,mCAAmC;AAAA,EAClG,CAAC,qEAAqE,mBAAmB;AAAA,EACzF,CAAC,qEAAqE,qBAAqB;AAAA,EAC3F,CAAC,sCAAsC,iBAAiB;AAAA,EACxD,CAAC,kEAAkE,kBAAkB;AAAA,EACrF,CAAC,oDAAoD,YAAY;AAAA,EACjE,CAAC,uEAAuE,iBAAiB;AAC3F;AAGA,MAAM,qBAAqB;AAE3B,SAAS,oBAAoB,UAAkC;AAC7D,SAAO,SAAS,KAAK,CAACE,OAAMA,GAAE,SAAS,YAAYA,GAAE,QAAQ,SAAS,kBAAkB,CAAC;AAC3F;AAUA,SAAS,qBAAqB,UAAyB,UAA4C;;AACjG,QAAM,gBAAc,cAAS,KAAK,CAACA,OAAMA,GAAE,SAAS,MAAM,MAAtC,mBAAyC,YAAW;AACxE,QAAM,OAAO,oBAAoB,WAAW;AAC5C,QAAM,oBAAoB,KAAK,OAAO,SAAS,UAAU;AACzD,QAAM,OAAO;AAAA,IACX,WAAW,KAAK;AAAA,IAChB,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,IACX,iBAAiB,CAAA;AAAA,IACjB;AAAA,IACA,uBAAuB,qBAAqB,KAAK;AAAA,IACjD,kBAAkB;AAAA,IAClB,gBAAgB;AAAA,IAChB,mBAAmB;AAAA,IACnB,qBAAqB;AAAA,IACrB,oBAAoB;AAAA,IACpB,oBAAoB,CAAA;AAAA,EAAC;AAEvB,SAAO,KAAK,UAAU,EAAE,GAAG,MAAM,GAAG,UAAU;AAChD;AAEA,MAAM,kBAAwC;AAAA,EAK5C,YAA6B,QAAiC;AAH9D;AAAA,qCAAY;AACJ,yCAAgB;AAEK,SAAA,SAAA;AAAA,EAAkC;AAAA,EAE/D,IAAY,eAAyB;AACnC,WAAO,KAAK,OAAO,gBAAgB,KAAK,OAAO,aAAa,SAAS,IAAI,KAAK,OAAO,eAAe,CAAC,EAAE;AAAA,EACzG;AAAA,EAEA,OAAO,SAAS,WAA0B,UAA+C;AACvF,eAAW,SAAS,KAAK,aAAc,OAAM;AAAA,EAC/C;AAAA,EAEA,MAAM,aAAa,UAAyB,SAAwC;AAClF,UAAM,SAAmB,CAAA;AACzB,qBAAiB,SAAS,KAAK,SAAS,UAAU,OAAO,EAAG,QAAO,KAAK,KAAK;AAC7E,WAAO,OAAO,KAAK,EAAE;AAAA,EACvB;AAAA,EAEA,MAAM,mBAAmB,UAAyB,QAA2B,UAAwD;;AACnI,QAAI,oBAAoB,QAAQ,GAAG;AACjC,YAAM,gBAAc,cAAS,KAAK,CAACA,OAAMA,GAAE,SAAS,MAAM,MAAtC,mBAAyC,YAAW;AACxE,aAAO,EAAE,SAAS,qBAAqB,WAAU,gBAAK,QAAO,aAAZ,4BAAuB,YAAY,EAAA;AAAA,IACtF;AACA,UAAM,WAAS,cAAS,KAAK,CAACA,OAAMA,GAAE,SAAS,QAAQ,MAAxC,mBAA2C,YAAW;AACrE,UAAM,OAAO,CAAC,GAAI,KAAK,OAAO,iBAAiB,CAAA,GAAK,GAAG,iBAAiB,EAAE,KAAK,CAAC,CAAC,MAAM,MAAM,OAAO,SAAS,MAAM,CAAC;AACpH,QAAI,KAAM,QAAO,EAAE,SAAS,KAAK,CAAC,EAAA;AAClC,SAAK;AACL,UAAM,YAAY,KAAK,OAAO,aAAa,CAAA;AAC3C,QAAI,KAAK,iBAAiB,UAAU,QAAQ;AAC1C,YAAM,IAAI;AAAA,QACR,qEAAqE,KAAK,gBAAgB,CAAC,cAAc,UAAU,MAAM;AAAA,MAAA;AAAA,IAE7H;AACA,UAAM,OAAO,UAAU,KAAK,eAAe;AAC3C,WAAO,OAAO,SAAS,WAAW,EAAE,SAAS,SAAS;AAAA,EACxD;AACF;AAMO,SAAS,wBAAwB,SAAkC,IAAgB;AACxF,SAAO,IAAI,kBAAkB,MAAM;AACrC;"}

package/dist/ink-select-prompt.d.ts

@@ -7,6 +7,8 @@ export interface SelectPromptProps {
     /** Called once, with the chosen option's `key` — either Enter on the highlighted row, or a direct keystroke matching an option's `key`. */
     onSubmit: (key: string) => void;
     isActive?: boolean;
+    /** Keys arriving within this many ms of the prompt appearing are ignored: a key typed ahead for the previous turn (an Enter, a 'y') must not answer a question the user has not seen yet. Default 0 (no guard). */
+    armDelayMs?: number;
 }
 /**
  * Phase 7 of the internal plan: an arrow-key + numbered/shortcut-key

package/dist/ink-test-render.d.ts

@@ -17,6 +17,8 @@ export interface TestInkInstance {
     lastFrame: () => string | undefined;
     /** See `TestStdout.fullOutput`'s doc comment — needed to assert on `<Static>` content. */
     fullOutput: () => string;
+    /** How many writes (frames and control sequences) the render has produced so far — constant while the UI is idle. */
+    writeCount: () => number;
     rerender: (tree: ReactElement) => void;
     unmount: () => void;
 }

package/dist/layer-policy-flag.d.ts

@@ -0,0 +1,13 @@
+import { DEFAULT_LAYER_POLICY_MODE, LayerPolicyMode } from '@buildaharness/harness';
+export type { LayerPolicyMode };
+export { DEFAULT_LAYER_POLICY_MODE };
+export declare function isLayerPolicyMode(v: unknown): v is LayerPolicyMode;
+/** The mode a resolved config means; unset ⇒ the package default (static). */
+export declare function resolveLayerPolicyModeFromConfig(mode: LayerPolicyMode | undefined): LayerPolicyMode;
+/** The single place a resolved `config.layerPolicyMode` becomes "does adaptive behaviour execute?". Shadow does not. */
+export declare function isAdaptivePolicyEnabled(mode: LayerPolicyMode | undefined): boolean;
+/** True when decisions should be computed and recorded (shadow or adaptive). */
+export declare function isPolicyRecordingEnabled(mode: LayerPolicyMode | undefined): boolean;
+/** Unset/empty ⇒ default silently; an unrecognized value ⇒ default with a warning naming `varName`. */
+export declare function normalizeLayerPolicyMode(raw: string | undefined, varName?: string): LayerPolicyMode;
+export declare function resolveLayerPolicyMode(env: NodeJS.ProcessEnv): LayerPolicyMode;

package/dist/layer-policy-wiring.d.ts

@@ -0,0 +1,77 @@
+import { LayerPolicy, LayerPolicyMode, OptInLayer, PolicyBudget, PolicyRules, RunState, TurnSignals, TurnTier } from '@buildaharness/harness';
+import { TurnIntentClassification } from './turn-intent-classifier.js';
+/**
+ * The opt-in layers (default OFF, one `AUDIT_*` flag each) the operator has switched on. Each flag is still read
+ * where the layer runs; this only tells the policy which ones exist this turn so its record is true.
+ */
+export declare function enabledOptInLayers(env?: Record<string, string | undefined>): OptInLayer[];
+/**
+ * Whether an opt-in layer runs this turn. Restrict-only (AL-1): the layer's own `AUDIT_*` flag must be on (`flagOn`) AND the
+ * plan must not have switched it `off` (`budget_exhausted`) — a plan can never turn a disabled layer on. Only an `adaptive`
+ * plan exists (`resolveOptInPlan`); with none, or a decision the plan lacks, or a plan that throws, the flag alone decides,
+ * i.e. today's behaviour.
+ */
+export declare function optInLayerEnabled(layer: OptInLayer, flagOn: boolean, plan: EscalationPlan | undefined): boolean;
+/**
+ * The plan the opt-in layers are gated by, resolved once per turn right after classification — before the tool-less draft
+ * and the harness run, which is where the earliest opt-in call sits. Their decisions depend only on which are enabled and on
+ * the per-turn call budget (risk and posture), none of which needs the task graph, so the minimal signals here give the same
+ * answer the harness's own plan would. `undefined` unless `adaptive`: static and shadow execute today's behaviour.
+ */
+export declare function resolveOptInPlan(mode: LayerPolicyMode, classification: TurnIntentClassification): EscalationPlan | undefined;
+export declare const SEMANTIC_ESCALATIONS: readonly ["semantic_contradiction", "failure_match", "criterion_coverage", "change_review", "model_inferred_facts"];
+export type SemanticEscalation = (typeof SEMANTIC_ESCALATIONS)[number];
+export declare const ESCALATION_ENV: Readonly<Record<SemanticEscalation, string>>;
+/** `true`/`false` when the operator set the env var explicitly; `undefined` when unset/empty. */
+export declare function explicitEnvOverride(varName: string, env?: Record<string, string | undefined>): boolean | undefined;
+export interface EscalationPlan {
+    mode: LayerPolicyMode;
+    tier: TurnTier;
+    /** The policy that executes (static under static/shadow). */
+    policy: LayerPolicy;
+    /** Under shadow only: what adaptive would have decided. Recorded, never acted on. */
+    shadow?: {
+        policy: LayerPolicy;
+        tier: TurnTier;
+    };
+}
+/** AL9a: the per-turn LLM-call budget view for a turn's signals (risk- and posture-scaled). Static mode ignores it. */
+export declare function turnPolicyBudget(signals: TurnSignals): PolicyBudget;
+/** Resolves the executed policy for a turn. Never throws; any failure ⇒ today's static behaviour. */
+export declare function resolveEscalationPlan(mode: LayerPolicyMode, signals: TurnSignals, state: RunState | undefined, rules?: PolicyRules, budget?: PolicyBudget): EscalationPlan;
+/**
+ * Whether `layer`'s semantic (LLM) form runs this turn. `cheap` is a non-linguistic form, so for
+ * these layers only `full` runs the LLM hook. An explicit env override wins; a missing/broken plan
+ * keeps today's behaviour (ON).
+ */
+export declare function escalationEnabled(layer: SemanticEscalation, plan: EscalationPlan | undefined, env?: Record<string, string | undefined>): boolean;
+/**
+ * Whether a semantic escalation hook is supplied to the harness at all: unless the operator's explicit `AUDIT_*` value switches
+ * it off. The plan no longer decides this — it is consulted per call (`HarnessRunOptions.hookEnabled`), so a hook the opening
+ * plan would have left off can still run once mid-turn evidence changes the plan. With a static plan the result is exactly
+ * what `escalationEnabled` gave (the plan says `full`, so only the env override mattered).
+ */
+export declare function escalationHookWired(layer: SemanticEscalation, env?: Record<string, string | undefined>): boolean;
+/** The policy the harness runtime's ad hoc gates read: only an executed `adaptive` policy differs from today's. */
+export declare function harnessGatePolicy(plan: EscalationPlan | undefined): LayerPolicy | undefined;
+/**
+ * Decomposition reframe (`reframeTaskDescriptionWithLLM`). Precedence: explicit `AUDIT_DECOMPOSITION`
+ * env > the policy's decision > today's ON. `cheap` has no LLM-free form ⇒ off (only `full` reframes).
+ */
+export declare function decompositionReframeEnabled(plan: EscalationPlan | undefined, env?: Record<string, string | undefined>): boolean;
+/**
+ * LLM injection detection on fetched content (AL-1 security rule). Skippable ONLY on a
+ * non-linguistic proof of safety: no untrusted content in context, or no tool-capable next step.
+ * Anything the policy says short of `full` without such a proof is overridden back to ON — the
+ * check never trusts a message/LLM-derived signal, and the wiring re-verifies what
+ * `resolveLayerPolicy` already clamps so a hand-built plan cannot bypass it.
+ */
+export declare function injectionDetectionEnabled(plan: EscalationPlan | undefined, proof: {
+    untrustedContentInContext: boolean;
+    toolCapableNextStep: boolean;
+}): boolean;
+/** One-line reason a layer's decision is worth surfacing (escalated / skipped-with-reason), or `undefined` when routine. */
+export declare function decisionNote(event: {
+    decision?: string;
+    trigger?: string;
+}): string | undefined;

package/dist/layer-settings.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The user-facing on/off surface for reasoning layers, shared by the CLI (`/layers`) and the desktop/browser
+ * Settings screen. It is a thin layer over the existing `AUDIT_*` env flags, which every layer already reads in
+ * exactly one place: `applyLayerSettings` writes the persisted `config.layers` choices into an env object, so no
+ * layer needed a second code path. An env value the operator set themselves always wins and renders as pinned,
+ * the same precedence `explicitEnvOverride` already gives it.
+ *
+ * Floor layers (safety, approval, tool policy, verification, diagnostics) are listed but locked: there is no
+ * flag for them and the adaptive policy's types make them un-decidable on purpose.
+ */
+export type LayerGroup = 'escalation' | 'opt_in' | 'floor';
+export interface LayerSetting {
+    id: string;
+    group: LayerGroup;
+    /** The env flag that carries the choice; absent for locked layers. */
+    flag?: string;
+    /** What the layer does when the user hasn't chosen. */
+    defaultOn: boolean;
+    summary: string;
+    /** Rough extra cost when it fires, in plain words. */
+    cost: string;
+    /** What the audit found, in plain words — the record, not a promise. */
+    evidence: string;
+}
+export declare const LAYER_SETTINGS: readonly LayerSetting[];
+export type LayerChoices = Readonly<Record<string, boolean>>;
+export declare function findLayer(id: string): LayerSetting | undefined;
+/** The layers a user may change: everything except the locked floor. */
+export declare function isToggleable(layer: LayerSetting): boolean;
+type Env = Record<string, string | undefined>;
+export interface AppliedLayers {
+    /** Layer ids whose env flag was set outside this module (shell env / build var), so the saved choice is ignored. */
+    pinned: Set<string>;
+}
+/**
+ * Makes `env` reflect `choices`. Idempotent: a layer no longer in `choices` is restored to unset, and a flag that
+ * holds a value this module did not write is left alone and reported as pinned. Unknown ids and locked layers are ignored.
+ */
+export declare function applyLayerSettings(choices: LayerChoices | undefined, env: Env): AppliedLayers;
+/** What a layer will do right now: the saved choice, else its default; a pinned layer reports its env value. */
+export declare function effectiveState(layer: LayerSetting, choices: LayerChoices | undefined, pinned: ReadonlySet<string>, env: Env): boolean;
+/** Returns the choices after setting one layer; throws on an unknown or locked id so a typo never silently persists. */
+export declare function withLayerChoice(choices: LayerChoices | undefined, id: string, on: boolean | undefined): Record<string, boolean>;
+export declare class LayerSettingError extends Error {
+}
+/** Drops anything in a persisted value that is not a known toggleable layer with a boolean, so a stale or hand-edited file can't smuggle junk in. */
+export declare function sanitizeLayerChoices(raw: unknown): Record<string, boolean>;
+export declare function formatLayerListing(choices: LayerChoices | undefined, pinned: ReadonlySet<string>, env: Env): string;
+export {};

package/dist/layer-telemetry.d.ts

@@ -0,0 +1,2 @@
+import { ExperienceStore, LayerTelemetryRow } from '@buildaharness/harness';
+export declare function recordLayerTelemetry(store: ExperienceStore, row: LayerTelemetryRow | undefined, key: string): void;

package/dist/lexical/lexical-mode.d.ts

@@ -0,0 +1,29 @@
+export declare const LEXICAL_FAMILIES: readonly ["fact-markers", "coding-fact", "injection", "enumeration", "risk", "task-cancel", "plan-mode", "batch-list", "tool-yield", "template-keywords"];
+export type LexicalFamily = (typeof LEXICAL_FAMILIES)[number];
+/** The families `lexicalMode: 'disabled'` (the default) switches off: all of them. */
+export declare const LEXICAL_CHECK_FAMILIES: readonly LexicalFamily[];
+export type LexicalMode = 'enabled' | 'disabled';
+export declare const DEFAULT_LEXICAL_MODE: LexicalMode;
+type EnvLike = Record<string, string | undefined>;
+export declare function isLexicalFamily(v: string): v is LexicalFamily;
+/** Unset/empty ⇒ default silently; an unrecognized value ⇒ default with a warning. */
+export declare function resolveLexicalMode(env?: EnvLike): LexicalMode;
+/** Every family currently switched off: named in OFF, or not named in ON while the mode is disabled. */
+export declare function resolveLexicalOff(env?: EnvLike): ReadonlySet<LexicalFamily>;
+/** True only if this family is switched on. */
+export declare function lexicalActive(family: LexicalFamily, env?: EnvLike): boolean;
+/**
+ * The off families as a comma list, for handing to an out-of-process helper (the MCP server). Always
+ * pass it, even empty: the helper reads an unset variable as "every family off" (the default) and an
+ * empty one as "none off".
+ */
+export declare function lexicalOffEnvValue(env?: EnvLike): string;
+/**
+ * Hands this mode to the harness package's own lexical switch (`setHarnessLexicalMode`), so
+ * `ASSISTANT_LEXICAL_MODE=enabled` turns the harness's checks back on too. Works in a browser as well
+ * as in Node (it sets no environment variable), and an explicit HARNESS_LEXICAL_MODE /
+ * HARNESS_LEXICAL_ON / HARNESS_LEXICAL_OFF still wins inside the harness. Called at the start of every
+ * harness run.
+ */
+export declare function syncHarnessLexicalEnv(env?: EnvLike): void;
+export {};