@caupulican/pi-adaptative 0.81.26 → 0.81.27

package/dist/core/autonomy/bounded-completion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bounded-completion.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/bounded-completion.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,8BAA8B,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,oGAAoG;IACpG,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,8BAA8B,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAChD,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC7D,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoCpC","sourcesContent":["/**\n * Shared wall-clock/cancellation envelope for one-shot lane completions (research, scout workers).\n * Composes an optional external abort signal with an internal wall-clock timeout, executes the\n * injected completion, and maps every failure to a stable status/reasonCode pair. Never throws.\n */\n\nexport interface BoundedCompletion {\n\ttext: string;\n\tcostUsd: number;\n\tstopReason: string;\n}\n\nexport type BoundedCompletionFailureStatus = \"canceled\" | \"timeout\" | \"failed\";\n\nexport interface BoundedCompletionOutcome {\n\t/** Present when the executor settled; may coexist with `failure` when an abort raced the result. */\n\tcompletion?: BoundedCompletion;\n\tfailure?: { status: BoundedCompletionFailureStatus; reasonCode: string };\n}\n\nexport async function runBoundedCompletion(args: {\n\t/** Wall-clock budget in milliseconds; 0 disables. */\n\tmaxWallClockMs: number;\n\t/** External cancellation (e.g. session disposal). */\n\tsignal?: AbortSignal;\n\texecute: (signal: AbortSignal) => Promise<BoundedCompletion>;\n}): Promise<BoundedCompletionOutcome> {\n\tconst timeoutController = new AbortController();\n\tconst timeoutTimer =\n\t\targs.maxWallClockMs > 0 ? setTimeout(() => timeoutController.abort(), args.maxWallClockMs) : undefined;\n\tif (timeoutTimer && typeof timeoutTimer === \"object\" && \"unref\" in timeoutTimer) {\n\t\tconst { unref } = timeoutTimer as { unref?: () => void };\n\t\tunref?.call(timeoutTimer);\n\t}\n\tconst signals: AbortSignal[] = [timeoutController.signal];\n\tif (args.signal) signals.push(args.signal);\n\tconst signal = AbortSignal.any(signals);\n\n\tlet completion: BoundedCompletion;\n\ttry {\n\t\tcompletion = await args.execute(signal);\n\t} catch {\n\t\tif (args.signal?.aborted) {\n\t\t\treturn { failure: { status: \"canceled\", reasonCode: \"external_abort\" } };\n\t\t}\n\t\tif (timeoutController.signal.aborted) {\n\t\t\treturn { failure: { status: \"timeout\", reasonCode: \"wall_clock_exceeded\" } };\n\t\t}\n\t\treturn { failure: { status: \"failed\", reasonCode: \"completion_error\" } };\n\t} finally {\n\t\tif (timeoutTimer !== undefined) clearTimeout(timeoutTimer);\n\t}\n\n\t// An abort can race a completion that settled without throwing; the abort still wins, but the\n\t// settled completion is passed through so callers can account its spend.\n\tif (args.signal?.aborted) {\n\t\treturn { completion, failure: { status: \"canceled\", reasonCode: \"external_abort\" } };\n\t}\n\tif (timeoutController.signal.aborted) {\n\t\treturn { completion, failure: { status: \"timeout\", reasonCode: \"wall_clock_exceeded\" } };\n\t}\n\treturn { completion };\n}\n"]}
+{"version":3,"file":"bounded-completion.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/bounded-completion.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,8BAA8B,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/E,MAAM,WAAW,wBAAwB;IACxC,oGAAoG;IACpG,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,8BAA8B,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACzE;AAaD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE;IAChD,qDAAqD;IACrD,cAAc,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC7D,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA2EpC","sourcesContent":["/**\n * Shared wall-clock/cancellation envelope for one-shot lane completions (research, scout workers).\n * Composes an optional external abort signal with an internal wall-clock timeout, executes the\n * injected completion, and maps every failure to a stable status/reasonCode pair. Never throws.\n */\n\nexport interface BoundedCompletion {\n\ttext: string;\n\tcostUsd: number;\n\tstopReason: string;\n}\n\nexport type BoundedCompletionFailureStatus = \"canceled\" | \"timeout\" | \"failed\";\n\nexport interface BoundedCompletionOutcome {\n\t/** Present when the executor settled; may coexist with `failure` when an abort raced the result. */\n\tcompletion?: BoundedCompletion;\n\tfailure?: { status: BoundedCompletionFailureStatus; reasonCode: string };\n}\n\ntype ExecutorSettlement = { kind: \"completion\"; completion: BoundedCompletion } | { kind: \"error\"; error: unknown };\n\nfunction abortFailure(args: {\n\texternalSignal?: AbortSignal;\n\ttimeoutSignal: AbortSignal;\n}): BoundedCompletionOutcome[\"failure\"] {\n\tif (args.externalSignal?.aborted) return { status: \"canceled\", reasonCode: \"external_abort\" };\n\tif (args.timeoutSignal.aborted) return { status: \"timeout\", reasonCode: \"wall_clock_exceeded\" };\n\treturn { status: \"failed\", reasonCode: \"completion_error\" };\n}\n\nexport async function runBoundedCompletion(args: {\n\t/** Wall-clock budget in milliseconds; 0 disables. */\n\tmaxWallClockMs: number;\n\t/** External cancellation (e.g. session disposal). */\n\tsignal?: AbortSignal;\n\texecute: (signal: AbortSignal) => Promise<BoundedCompletion>;\n}): Promise<BoundedCompletionOutcome> {\n\tconst timeoutController = new AbortController();\n\tlet resolveAbort!: () => void;\n\tconst abortPromise = new Promise<{ kind: \"abort\" }>((resolve) => {\n\t\tresolveAbort = () => resolve({ kind: \"abort\" });\n\t});\n\tconst onExternalAbort = (): void => resolveAbort();\n\targs.signal?.addEventListener(\"abort\", onExternalAbort, { once: true });\n\tconst timeoutTimer =\n\t\targs.maxWallClockMs > 0\n\t\t\t? setTimeout(() => {\n\t\t\t\t\ttimeoutController.abort();\n\t\t\t\t\tresolveAbort();\n\t\t\t\t}, args.maxWallClockMs)\n\t\t\t: undefined;\n\tif (timeoutTimer && typeof timeoutTimer === \"object\" && \"unref\" in timeoutTimer) {\n\t\tconst { unref } = timeoutTimer as { unref?: () => void };\n\t\tunref?.call(timeoutTimer);\n\t}\n\tconst signals: AbortSignal[] = [timeoutController.signal];\n\tif (args.signal) signals.push(args.signal);\n\tconst signal = AbortSignal.any(signals);\n\n\tlet settled: ExecutorSettlement | undefined;\n\tconst execution = Promise.resolve()\n\t\t.then(() => args.execute(signal))\n\t\t.then<ExecutorSettlement, ExecutorSettlement>(\n\t\t\t(completion) => {\n\t\t\t\tsettled = { kind: \"completion\", completion };\n\t\t\t\treturn settled;\n\t\t\t},\n\t\t\t(error: unknown) => {\n\t\t\t\tsettled = { kind: \"error\", error };\n\t\t\t\treturn settled;\n\t\t\t},\n\t\t);\n\tif (args.signal?.aborted) resolveAbort();\n\n\ttry {\n\t\tconst winner = await Promise.race([execution, abortPromise]);\n\t\tif (winner.kind === \"abort\") {\n\t\t\t// An abort and a completion can settle in the same microtask turn. Give the already-queued\n\t\t\t// executor handlers one chance to retain that completion (and its visible spend) without\n\t\t\t// ever waiting for a non-cooperative executor. Later settlement remains observed by\n\t\t\t// `execution`'s rejection handler, preventing an unhandled rejection after this returns.\n\t\t\tfor (let flush = 0; flush < 4 && settled === undefined; flush++) {\n\t\t\t\tawait Promise.resolve();\n\t\t\t}\n\t\t\treturn {\n\t\t\t\t...(settled?.kind === \"completion\" ? { completion: settled.completion } : {}),\n\t\t\t\tfailure: abortFailure({ externalSignal: args.signal, timeoutSignal: timeoutController.signal }),\n\t\t\t};\n\t\t}\n\n\t\tif (winner.kind === \"error\") {\n\t\t\treturn {\n\t\t\t\tfailure:\n\t\t\t\t\targs.signal?.aborted || timeoutController.signal.aborted\n\t\t\t\t\t\t? abortFailure({ externalSignal: args.signal, timeoutSignal: timeoutController.signal })\n\t\t\t\t\t\t: { status: \"failed\", reasonCode: \"completion_error\" },\n\t\t\t};\n\t\t}\n\n\t\tconst completion = winner.completion;\n\t\tif (args.signal?.aborted || timeoutController.signal.aborted) {\n\t\t\treturn {\n\t\t\t\tcompletion,\n\t\t\t\tfailure: abortFailure({ externalSignal: args.signal, timeoutSignal: timeoutController.signal }),\n\t\t\t};\n\t\t}\n\t\treturn { completion };\n\t} finally {\n\t\tif (timeoutTimer !== undefined) clearTimeout(timeoutTimer);\n\t\targs.signal?.removeEventListener(\"abort\", onExternalAbort);\n\t}\n}\n"]}

package/dist/core/autonomy/bounded-completion.js

@@ -3,9 +3,27 @@
  * Composes an optional external abort signal with an internal wall-clock timeout, executes the
  * injected completion, and maps every failure to a stable status/reasonCode pair. Never throws.
  */
+function abortFailure(args) {
+    if (args.externalSignal?.aborted)
+        return { status: "canceled", reasonCode: "external_abort" };
+    if (args.timeoutSignal.aborted)
+        return { status: "timeout", reasonCode: "wall_clock_exceeded" };
+    return { status: "failed", reasonCode: "completion_error" };
+}
 export async function runBoundedCompletion(args) {
     const timeoutController = new AbortController();
-    const timeoutTimer = args.maxWallClockMs > 0 ? setTimeout(() => timeoutController.abort(), args.maxWallClockMs) : undefined;
+    let resolveAbort;
+    const abortPromise = new Promise((resolve) => {
+        resolveAbort = () => resolve({ kind: "abort" });
+    });
+    const onExternalAbort = () => resolveAbort();
+    args.signal?.addEventListener("abort", onExternalAbort, { once: true });
+    const timeoutTimer = args.maxWallClockMs > 0
+        ? setTimeout(() => {
+            timeoutController.abort();
+            resolveAbort();
+        }, args.maxWallClockMs)
+        : undefined;
     if (timeoutTimer && typeof timeoutTimer === "object" && "unref" in timeoutTimer) {
         const { unref } = timeoutTimer;
         unref?.call(timeoutTimer);
@@ -14,31 +32,53 @@ export async function runBoundedCompletion(args) {
     if (args.signal)
         signals.push(args.signal);
     const signal = AbortSignal.any(signals);
-    let completion;
+    let settled;
+    const execution = Promise.resolve()
+        .then(() => args.execute(signal))
+        .then((completion) => {
+        settled = { kind: "completion", completion };
+        return settled;
+    }, (error) => {
+        settled = { kind: "error", error };
+        return settled;
+    });
+    if (args.signal?.aborted)
+        resolveAbort();
     try {
-        completion = await args.execute(signal);
-    }
-    catch {
-        if (args.signal?.aborted) {
-            return { failure: { status: "canceled", reasonCode: "external_abort" } };
+        const winner = await Promise.race([execution, abortPromise]);
+        if (winner.kind === "abort") {
+            // An abort and a completion can settle in the same microtask turn. Give the already-queued
+            // executor handlers one chance to retain that completion (and its visible spend) without
+            // ever waiting for a non-cooperative executor. Later settlement remains observed by
+            // `execution`'s rejection handler, preventing an unhandled rejection after this returns.
+            for (let flush = 0; flush < 4 && settled === undefined; flush++) {
+                await Promise.resolve();
+            }
+            return {
+                ...(settled?.kind === "completion" ? { completion: settled.completion } : {}),
+                failure: abortFailure({ externalSignal: args.signal, timeoutSignal: timeoutController.signal }),
+            };
+        }
+        if (winner.kind === "error") {
+            return {
+                failure: args.signal?.aborted || timeoutController.signal.aborted
+                    ? abortFailure({ externalSignal: args.signal, timeoutSignal: timeoutController.signal })
+                    : { status: "failed", reasonCode: "completion_error" },
+            };
         }
-        if (timeoutController.signal.aborted) {
-            return { failure: { status: "timeout", reasonCode: "wall_clock_exceeded" } };
+        const completion = winner.completion;
+        if (args.signal?.aborted || timeoutController.signal.aborted) {
+            return {
+                completion,
+                failure: abortFailure({ externalSignal: args.signal, timeoutSignal: timeoutController.signal }),
+            };
         }
-        return { failure: { status: "failed", reasonCode: "completion_error" } };
+        return { completion };
     }
     finally {
         if (timeoutTimer !== undefined)
             clearTimeout(timeoutTimer);
+        args.signal?.removeEventListener("abort", onExternalAbort);
     }
-    // An abort can race a completion that settled without throwing; the abort still wins, but the
-    // settled completion is passed through so callers can account its spend.
-    if (args.signal?.aborted) {
-        return { completion, failure: { status: "canceled", reasonCode: "external_abort" } };
-    }
-    if (timeoutController.signal.aborted) {
-        return { completion, failure: { status: "timeout", reasonCode: "wall_clock_exceeded" } };
-    }
-    return { completion };
 }
 //# sourceMappingURL=bounded-completion.js.map

package/dist/core/autonomy/bounded-completion.js.map

@@ -1 +1 @@
-{"version":3,"file":"bounded-completion.js","sourceRoot":"","sources":["../../../src/core/autonomy/bounded-completion.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAgBH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAM1C,EAAqC;IACrC,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;IAChD,MAAM,YAAY,GACjB,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QACjF,MAAM,EAAE,KAAK,EAAE,GAAG,YAAsC,CAAC;QACzD,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAkB,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,UAA6B,CAAC;IAClC,IAAI,CAAC;QACJ,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE,CAAC;IAC1E,CAAC;YAAS,CAAC;QACV,IAAI,YAAY,KAAK,SAAS;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED,8FAA8F;IAC9F,yEAAyE;IACzE,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AAAA,CACtB","sourcesContent":["/**\n * Shared wall-clock/cancellation envelope for one-shot lane completions (research, scout workers).\n * Composes an optional external abort signal with an internal wall-clock timeout, executes the\n * injected completion, and maps every failure to a stable status/reasonCode pair. Never throws.\n */\n\nexport interface BoundedCompletion {\n\ttext: string;\n\tcostUsd: number;\n\tstopReason: string;\n}\n\nexport type BoundedCompletionFailureStatus = \"canceled\" | \"timeout\" | \"failed\";\n\nexport interface BoundedCompletionOutcome {\n\t/** Present when the executor settled; may coexist with `failure` when an abort raced the result. */\n\tcompletion?: BoundedCompletion;\n\tfailure?: { status: BoundedCompletionFailureStatus; reasonCode: string };\n}\n\nexport async function runBoundedCompletion(args: {\n\t/** Wall-clock budget in milliseconds; 0 disables. */\n\tmaxWallClockMs: number;\n\t/** External cancellation (e.g. session disposal). */\n\tsignal?: AbortSignal;\n\texecute: (signal: AbortSignal) => Promise<BoundedCompletion>;\n}): Promise<BoundedCompletionOutcome> {\n\tconst timeoutController = new AbortController();\n\tconst timeoutTimer =\n\t\targs.maxWallClockMs > 0 ? setTimeout(() => timeoutController.abort(), args.maxWallClockMs) : undefined;\n\tif (timeoutTimer && typeof timeoutTimer === \"object\" && \"unref\" in timeoutTimer) {\n\t\tconst { unref } = timeoutTimer as { unref?: () => void };\n\t\tunref?.call(timeoutTimer);\n\t}\n\tconst signals: AbortSignal[] = [timeoutController.signal];\n\tif (args.signal) signals.push(args.signal);\n\tconst signal = AbortSignal.any(signals);\n\n\tlet completion: BoundedCompletion;\n\ttry {\n\t\tcompletion = await args.execute(signal);\n\t} catch {\n\t\tif (args.signal?.aborted) {\n\t\t\treturn { failure: { status: \"canceled\", reasonCode: \"external_abort\" } };\n\t\t}\n\t\tif (timeoutController.signal.aborted) {\n\t\t\treturn { failure: { status: \"timeout\", reasonCode: \"wall_clock_exceeded\" } };\n\t\t}\n\t\treturn { failure: { status: \"failed\", reasonCode: \"completion_error\" } };\n\t} finally {\n\t\tif (timeoutTimer !== undefined) clearTimeout(timeoutTimer);\n\t}\n\n\t// An abort can race a completion that settled without throwing; the abort still wins, but the\n\t// settled completion is passed through so callers can account its spend.\n\tif (args.signal?.aborted) {\n\t\treturn { completion, failure: { status: \"canceled\", reasonCode: \"external_abort\" } };\n\t}\n\tif (timeoutController.signal.aborted) {\n\t\treturn { completion, failure: { status: \"timeout\", reasonCode: \"wall_clock_exceeded\" } };\n\t}\n\treturn { completion };\n}\n"]}
+{"version":3,"file":"bounded-completion.js","sourceRoot":"","sources":["../../../src/core/autonomy/bounded-completion.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,SAAS,YAAY,CAAC,IAGrB,EAAuC;IACvC,IAAI,IAAI,CAAC,cAAc,EAAE,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC9F,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC;IAChG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;AAAA,CAC5D;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAM1C,EAAqC;IACrC,MAAM,iBAAiB,GAAG,IAAI,eAAe,EAAE,CAAC;IAChD,IAAI,YAAyB,CAAC;IAC9B,MAAM,YAAY,GAAG,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;QAChE,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAAA,CAChD,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,GAAS,EAAE,CAAC,YAAY,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,YAAY,GACjB,IAAI,CAAC,cAAc,GAAG,CAAC;QACtB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;YACjB,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC1B,YAAY,EAAE,CAAC;QAAA,CACf,EAAE,IAAI,CAAC,cAAc,CAAC;QACxB,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;QACjF,MAAM,EAAE,KAAK,EAAE,GAAG,YAAsC,CAAC;QACzD,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAkB,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,OAAuC,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE;SACjC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SAChC,IAAI,CACJ,CAAC,UAAU,EAAE,EAAE,CAAC;QACf,OAAO,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC;IAAA,CACf,EACD,CAAC,KAAc,EAAE,EAAE,CAAC;QACnB,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC;IAAA,CACf,CACD,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,YAAY,EAAE,CAAC;IAEzC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,2FAA2F;YAC3F,yFAAyF;YACzF,oFAAoF;YACpF,yFAAyF;YACzF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,OAAO,KAAK,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjE,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC;YACD,OAAO;gBACN,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,OAAO,EAAE,YAAY,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC;aAC/F,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,OAAO;gBACN,OAAO,EACN,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO;oBACvD,CAAC,CAAC,YAAY,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC;oBACxF,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE;aACxD,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9D,OAAO;gBACN,UAAU;gBACV,OAAO,EAAE,YAAY,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC;aAC/F,CAAC;QACH,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,CAAC;IACvB,CAAC;YAAS,CAAC;QACV,IAAI,YAAY,KAAK,SAAS;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC5D,CAAC;AAAA,CACD","sourcesContent":["/**\n * Shared wall-clock/cancellation envelope for one-shot lane completions (research, scout workers).\n * Composes an optional external abort signal with an internal wall-clock timeout, executes the\n * injected completion, and maps every failure to a stable status/reasonCode pair. Never throws.\n */\n\nexport interface BoundedCompletion {\n\ttext: string;\n\tcostUsd: number;\n\tstopReason: string;\n}\n\nexport type BoundedCompletionFailureStatus = \"canceled\" | \"timeout\" | \"failed\";\n\nexport interface BoundedCompletionOutcome {\n\t/** Present when the executor settled; may coexist with `failure` when an abort raced the result. */\n\tcompletion?: BoundedCompletion;\n\tfailure?: { status: BoundedCompletionFailureStatus; reasonCode: string };\n}\n\ntype ExecutorSettlement = { kind: \"completion\"; completion: BoundedCompletion } | { kind: \"error\"; error: unknown };\n\nfunction abortFailure(args: {\n\texternalSignal?: AbortSignal;\n\ttimeoutSignal: AbortSignal;\n}): BoundedCompletionOutcome[\"failure\"] {\n\tif (args.externalSignal?.aborted) return { status: \"canceled\", reasonCode: \"external_abort\" };\n\tif (args.timeoutSignal.aborted) return { status: \"timeout\", reasonCode: \"wall_clock_exceeded\" };\n\treturn { status: \"failed\", reasonCode: \"completion_error\" };\n}\n\nexport async function runBoundedCompletion(args: {\n\t/** Wall-clock budget in milliseconds; 0 disables. */\n\tmaxWallClockMs: number;\n\t/** External cancellation (e.g. session disposal). */\n\tsignal?: AbortSignal;\n\texecute: (signal: AbortSignal) => Promise<BoundedCompletion>;\n}): Promise<BoundedCompletionOutcome> {\n\tconst timeoutController = new AbortController();\n\tlet resolveAbort!: () => void;\n\tconst abortPromise = new Promise<{ kind: \"abort\" }>((resolve) => {\n\t\tresolveAbort = () => resolve({ kind: \"abort\" });\n\t});\n\tconst onExternalAbort = (): void => resolveAbort();\n\targs.signal?.addEventListener(\"abort\", onExternalAbort, { once: true });\n\tconst timeoutTimer =\n\t\targs.maxWallClockMs > 0\n\t\t\t? setTimeout(() => {\n\t\t\t\t\ttimeoutController.abort();\n\t\t\t\t\tresolveAbort();\n\t\t\t\t}, args.maxWallClockMs)\n\t\t\t: undefined;\n\tif (timeoutTimer && typeof timeoutTimer === \"object\" && \"unref\" in timeoutTimer) {\n\t\tconst { unref } = timeoutTimer as { unref?: () => void };\n\t\tunref?.call(timeoutTimer);\n\t}\n\tconst signals: AbortSignal[] = [timeoutController.signal];\n\tif (args.signal) signals.push(args.signal);\n\tconst signal = AbortSignal.any(signals);\n\n\tlet settled: ExecutorSettlement | undefined;\n\tconst execution = Promise.resolve()\n\t\t.then(() => args.execute(signal))\n\t\t.then<ExecutorSettlement, ExecutorSettlement>(\n\t\t\t(completion) => {\n\t\t\t\tsettled = { kind: \"completion\", completion };\n\t\t\t\treturn settled;\n\t\t\t},\n\t\t\t(error: unknown) => {\n\t\t\t\tsettled = { kind: \"error\", error };\n\t\t\t\treturn settled;\n\t\t\t},\n\t\t);\n\tif (args.signal?.aborted) resolveAbort();\n\n\ttry {\n\t\tconst winner = await Promise.race([execution, abortPromise]);\n\t\tif (winner.kind === \"abort\") {\n\t\t\t// An abort and a completion can settle in the same microtask turn. Give the already-queued\n\t\t\t// executor handlers one chance to retain that completion (and its visible spend) without\n\t\t\t// ever waiting for a non-cooperative executor. Later settlement remains observed by\n\t\t\t// `execution`'s rejection handler, preventing an unhandled rejection after this returns.\n\t\t\tfor (let flush = 0; flush < 4 && settled === undefined; flush++) {\n\t\t\t\tawait Promise.resolve();\n\t\t\t}\n\t\t\treturn {\n\t\t\t\t...(settled?.kind === \"completion\" ? { completion: settled.completion } : {}),\n\t\t\t\tfailure: abortFailure({ externalSignal: args.signal, timeoutSignal: timeoutController.signal }),\n\t\t\t};\n\t\t}\n\n\t\tif (winner.kind === \"error\") {\n\t\t\treturn {\n\t\t\t\tfailure:\n\t\t\t\t\targs.signal?.aborted || timeoutController.signal.aborted\n\t\t\t\t\t\t? abortFailure({ externalSignal: args.signal, timeoutSignal: timeoutController.signal })\n\t\t\t\t\t\t: { status: \"failed\", reasonCode: \"completion_error\" },\n\t\t\t};\n\t\t}\n\n\t\tconst completion = winner.completion;\n\t\tif (args.signal?.aborted || timeoutController.signal.aborted) {\n\t\t\treturn {\n\t\t\t\tcompletion,\n\t\t\t\tfailure: abortFailure({ externalSignal: args.signal, timeoutSignal: timeoutController.signal }),\n\t\t\t};\n\t\t}\n\t\treturn { completion };\n\t} finally {\n\t\tif (timeoutTimer !== undefined) clearTimeout(timeoutTimer);\n\t\targs.signal?.removeEventListener(\"abort\", onExternalAbort);\n\t}\n}\n"]}

package/dist/core/autonomy/lane-tool-surface.d.ts

@@ -0,0 +1,31 @@
+import type { AgentLoopConfig, AgentTool } from "@caupulican/pi-agent-core";
+import type { NormalizedProfile } from "../profile-registry.ts";
+export interface LaneToolSurface {
+    /** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */
+    tools: AgentTool[];
+    /** Exact names after profile globs are expanded. Safe to persist in a capability envelope. */
+    allowedTools: string[];
+    /** Exact safe-candidate names denied by the profile's block patterns. */
+    deniedTools: string[];
+    /** Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). */
+    unboundAllowPatterns: string[];
+    /** Per-call path and capability gate for the isolated child loop. */
+    beforeToolCall: NonNullable<AgentLoopConfig["beforeToolCall"]>;
+}
+export interface LaneToolSurfaceOptions {
+    cwd: string;
+    profile?: NormalizedProfile;
+    /** Research never sets this. Workers require both this flag and at least one write path. */
+    writeEnabled?: boolean;
+    writePaths?: readonly string[];
+}
+/**
+ * Materialize a fresh, fail-closed tool surface for one isolated lane.
+ *
+ * Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,
+ * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or
+ * recursively spawn more workers. Write/edit additionally require the explicit worker write switch
+ * and a non-empty path scope; research therefore stays read-only regardless of profile contents.
+ */
+export declare function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface;
+//# sourceMappingURL=lane-tool-surface.d.ts.map

package/dist/core/autonomy/lane-tool-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lane-tool-surface.d.ts","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAehE,MAAM,WAAW,eAAe;IAC/B,oGAAoG;IACpG,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yEAAyE;IACzE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qEAAqE;IACrE,cAAc,EAAE,WAAW,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,4FAA4F;IAC5F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAkCD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAmDtF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */\n\ttools: AgentTool[];\n\t/** Exact names after profile globs are expanded. Safe to persist in a capability envelope. */\n\tallowedTools: string[];\n\t/** Exact safe-candidate names denied by the profile's block patterns. */\n\tdeniedTools: string[];\n\t/** Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). */\n\tunboundAllowPatterns: string[];\n\t/** Per-call path and capability gate for the isolated child loop. */\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/** Research never sets this. Workers require both this flag and at least one write path. */\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile | undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"*\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(cwd: string, names: readonly string[]): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [factory()] : [];\n\t});\n}\n\n/**\n * Materialize a fresh, fail-closed tool surface for one isolated lane.\n *\n * Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [...READ_ONLY_LANE_TOOL_NAMES, ...(writeCapable ? WRITE_LANE_TOOL_NAMES : [])];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst deniedTools = candidateNames.filter((name) => matchesResourceProfilePattern(name, patterns.block));\n\tconst unboundAllowPatterns = patterns.allow.filter(\n\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t);\n\tconst allowedTools = candidateNames.filter(\n\t\t(name) =>\n\t\t\t(patterns.allow.length === 0 || matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\"read_files\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"write_files\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(options.cwd, allowedTools),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t};\n}\n"]}

package/dist/core/autonomy/lane-tool-surface.js

@@ -0,0 +1,96 @@
+import path from "node:path";
+import { matchesResourceProfilePattern } from "../settings-manager.js";
+import { createEditTool } from "../tools/edit.js";
+import { createFindTool } from "../tools/find.js";
+import { createGrepTool } from "../tools/grep.js";
+import { createLsTool } from "../tools/ls.js";
+import { createReadTool } from "../tools/read.js";
+import { createWriteTool } from "../tools/write.js";
+import { evaluateToolGate } from "./gates.js";
+const READ_ONLY_LANE_TOOL_NAMES = ["read", "grep", "find", "ls"];
+const WRITE_LANE_TOOL_NAMES = ["write", "edit"];
+const WRITE_LANE_TOOL_NAME_SET = new Set(WRITE_LANE_TOOL_NAMES);
+function strictLaneProfilePatterns(profile) {
+    if (!profile)
+        return { allow: [], block: [] };
+    const filter = profile.resources.tools;
+    const allow = [...(filter?.allow ?? [])];
+    const block = [...(filter?.block ?? [])];
+    // Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.
+    if (allow.length === 0 && block.length === 0)
+        return { allow: [], block: ["*"] };
+    return { allow, block };
+}
+function resolveWriteRoots(cwd, writePaths) {
+    return writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));
+}
+function createLaneTools(cwd, names) {
+    const factories = new Map([
+        ["read", () => createReadTool(cwd)],
+        ["grep", () => createGrepTool(cwd)],
+        ["find", () => createFindTool(cwd)],
+        ["ls", () => createLsTool(cwd)],
+        ["write", () => createWriteTool(cwd)],
+        ["edit", () => createEditTool(cwd)],
+    ]);
+    return names.flatMap((name) => {
+        const factory = factories.get(name);
+        return factory ? [factory()] : [];
+    });
+}
+/**
+ * Materialize a fresh, fail-closed tool surface for one isolated lane.
+ *
+ * Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,
+ * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or
+ * recursively spawn more workers. Write/edit additionally require the explicit worker write switch
+ * and a non-empty path scope; research therefore stays read-only regardless of profile contents.
+ */
+export function createLaneToolSurface(options) {
+    const writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;
+    const candidateNames = [...READ_ONLY_LANE_TOOL_NAMES, ...(writeCapable ? WRITE_LANE_TOOL_NAMES : [])];
+    const patterns = strictLaneProfilePatterns(options.profile);
+    const deniedTools = candidateNames.filter((name) => matchesResourceProfilePattern(name, patterns.block));
+    const unboundAllowPatterns = patterns.allow.filter((pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])));
+    const allowedTools = candidateNames.filter((name) => (patterns.allow.length === 0 || matchesResourceProfilePattern(name, patterns.allow)) &&
+        !matchesResourceProfilePattern(name, patterns.block));
+    const allowedToolSet = new Set(allowedTools);
+    const readEnvelope = {
+        id: "isolated-lane-read-tools",
+        capabilities: ["read_files"],
+        allowedTools,
+        deniedTools,
+        allowedPaths: [path.resolve(options.cwd)],
+    };
+    const writeEnvelope = {
+        id: "isolated-lane-write-tools",
+        capabilities: ["write_files"],
+        allowedTools,
+        deniedTools,
+        allowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),
+    };
+    return {
+        tools: createLaneTools(options.cwd, allowedTools),
+        allowedTools,
+        deniedTools,
+        unboundAllowPatterns,
+        beforeToolCall: async ({ toolCall, args }) => {
+            if (!allowedToolSet.has(toolCall.name)) {
+                return { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };
+            }
+            const outcome = evaluateToolGate({
+                toolName: toolCall.name,
+                args,
+                cwd: options.cwd,
+                envelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,
+            });
+            if (outcome.outcome === "allow")
+                return undefined;
+            return {
+                block: true,
+                reason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? "capability gate denied it"}`,
+            };
+        },
+    };
+}
+//# sourceMappingURL=lane-tool-surface.js.map

package/dist/core/autonomy/lane-tool-surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lane-tool-surface.js","sourceRoot":"","sources":["../../../src/core/autonomy/lane-tool-surface.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAU,CAAC;AAC1E,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AACzD,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;AAuBxE,SAAS,yBAAyB,CAAC,OAAsC,EAGvE;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,6FAA6F;IAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAAA,CACxB;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,UAA6B,EAAY;IAChF,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAAA,CAC5G;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,KAAwB,EAAe;IAC5E,MAAM,SAAS,GAAG,IAAI,GAAG,CAA0B;QAClD,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAA,CAClC,CAAC,CAAC;AAAA,CACH;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B,EAAmB;IACvF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,CAAC,GAAG,yBAAyB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACzG,MAAM,oBAAoB,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CACjD,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAC3F,CAAC;IACF,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CACzC,CAAC,IAAI,EAAE,EAAE,CACR,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpF,CAAC,6BAA6B,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CACrD,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;IACrD,MAAM,YAAY,GAAuB;QACxC,EAAE,EAAE,0BAA0B;QAC9B,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;KACzC,CAAC;IACF,MAAM,aAAa,GAAuB;QACzC,EAAE,EAAE,2BAA2B;QAC/B,YAAY,EAAE,CAAC,aAAa,CAAC;QAC7B,YAAY;QACZ,WAAW;QACX,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;KACtE,CAAC;IAEF,OAAO;QACN,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC;QACjD,YAAY;QACZ,WAAW;QACX,oBAAoB;QACpB,cAAc,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,QAAQ,CAAC,IAAI,4CAA4C,EAAE,CAAC;YACzG,CAAC;YACD,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;aACpF,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,sBAAsB,OAAO,CAAC,UAAU,MAAM,OAAO,CAAC,OAAO,IAAI,2BAA2B,EAAE;aACtG,CAAC;QAAA,CACF;KACD,CAAC;AAAA,CACF","sourcesContent":["import path from \"node:path\";\nimport type { AgentLoopConfig, AgentTool } from \"@caupulican/pi-agent-core\";\nimport type { NormalizedProfile } from \"../profile-registry.ts\";\nimport { matchesResourceProfilePattern } from \"../settings-manager.ts\";\nimport { createEditTool } from \"../tools/edit.ts\";\nimport { createFindTool } from \"../tools/find.ts\";\nimport { createGrepTool } from \"../tools/grep.ts\";\nimport { createLsTool } from \"../tools/ls.ts\";\nimport { createReadTool } from \"../tools/read.ts\";\nimport { createWriteTool } from \"../tools/write.ts\";\nimport type { CapabilityEnvelope } from \"./contracts.ts\";\nimport { evaluateToolGate } from \"./gates.ts\";\n\nconst READ_ONLY_LANE_TOOL_NAMES = [\"read\", \"grep\", \"find\", \"ls\"] as const;\nconst WRITE_LANE_TOOL_NAMES = [\"write\", \"edit\"] as const;\nconst WRITE_LANE_TOOL_NAME_SET = new Set<string>(WRITE_LANE_TOOL_NAMES);\n\nexport interface LaneToolSurface {\n\t/** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */\n\ttools: AgentTool[];\n\t/** Exact names after profile globs are expanded. Safe to persist in a capability envelope. */\n\tallowedTools: string[];\n\t/** Exact safe-candidate names denied by the profile's block patterns. */\n\tdeniedTools: string[];\n\t/** Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). */\n\tunboundAllowPatterns: string[];\n\t/** Per-call path and capability gate for the isolated child loop. */\n\tbeforeToolCall: NonNullable<AgentLoopConfig[\"beforeToolCall\"]>;\n}\n\nexport interface LaneToolSurfaceOptions {\n\tcwd: string;\n\tprofile?: NormalizedProfile;\n\t/** Research never sets this. Workers require both this flag and at least one write path. */\n\twriteEnabled?: boolean;\n\twritePaths?: readonly string[];\n}\n\nfunction strictLaneProfilePatterns(profile: NormalizedProfile | undefined): {\n\tallow: string[];\n\tblock: string[];\n} {\n\tif (!profile) return { allow: [], block: [] };\n\tconst filter = profile.resources.tools;\n\tconst allow = [...(filter?.allow ?? [])];\n\tconst block = [...(filter?.block ?? [])];\n\t// Strict UAC: a shipped profile is the complete authority grant. Grant-all must be explicit.\n\tif (allow.length === 0 && block.length === 0) return { allow: [], block: [\"*\"] };\n\treturn { allow, block };\n}\n\nfunction resolveWriteRoots(cwd: string, writePaths: readonly string[]): string[] {\n\treturn writePaths.map((entry) => (path.isAbsolute(entry) ? path.resolve(entry) : path.resolve(cwd, entry)));\n}\n\nfunction createLaneTools(cwd: string, names: readonly string[]): AgentTool[] {\n\tconst factories = new Map<string, () => AgentTool>([\n\t\t[\"read\", () => createReadTool(cwd)],\n\t\t[\"grep\", () => createGrepTool(cwd)],\n\t\t[\"find\", () => createFindTool(cwd)],\n\t\t[\"ls\", () => createLsTool(cwd)],\n\t\t[\"write\", () => createWriteTool(cwd)],\n\t\t[\"edit\", () => createEditTool(cwd)],\n\t]);\n\treturn names.flatMap((name) => {\n\t\tconst factory = factories.get(name);\n\t\treturn factory ? [factory()] : [];\n\t});\n}\n\n/**\n * Materialize a fresh, fail-closed tool surface for one isolated lane.\n *\n * Profiles select only from classified built-ins. Opaque extension tools, shell, memory, goals,\n * and `delegate` are never candidates, so a wildcard cannot manufacture unknown authority or\n * recursively spawn more workers. Write/edit additionally require the explicit worker write switch\n * and a non-empty path scope; research therefore stays read-only regardless of profile contents.\n */\nexport function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface {\n\tconst writeCapable = options.writeEnabled === true && (options.writePaths?.length ?? 0) > 0;\n\tconst candidateNames = [...READ_ONLY_LANE_TOOL_NAMES, ...(writeCapable ? WRITE_LANE_TOOL_NAMES : [])];\n\tconst patterns = strictLaneProfilePatterns(options.profile);\n\tconst deniedTools = candidateNames.filter((name) => matchesResourceProfilePattern(name, patterns.block));\n\tconst unboundAllowPatterns = patterns.allow.filter(\n\t\t(pattern) => !candidateNames.some((name) => matchesResourceProfilePattern(name, [pattern])),\n\t);\n\tconst allowedTools = candidateNames.filter(\n\t\t(name) =>\n\t\t\t(patterns.allow.length === 0 || matchesResourceProfilePattern(name, patterns.allow)) &&\n\t\t\t!matchesResourceProfilePattern(name, patterns.block),\n\t);\n\tconst allowedToolSet = new Set<string>(allowedTools);\n\tconst readEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-read-tools\",\n\t\tcapabilities: [\"read_files\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: [path.resolve(options.cwd)],\n\t};\n\tconst writeEnvelope: CapabilityEnvelope = {\n\t\tid: \"isolated-lane-write-tools\",\n\t\tcapabilities: [\"write_files\"],\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tallowedPaths: resolveWriteRoots(options.cwd, options.writePaths ?? []),\n\t};\n\n\treturn {\n\t\ttools: createLaneTools(options.cwd, allowedTools),\n\t\tallowedTools,\n\t\tdeniedTools,\n\t\tunboundAllowPatterns,\n\t\tbeforeToolCall: async ({ toolCall, args }) => {\n\t\t\tif (!allowedToolSet.has(toolCall.name)) {\n\t\t\t\treturn { block: true, reason: `Lane tool '${toolCall.name}' is outside the materialized UAC surface.` };\n\t\t\t}\n\t\t\tconst outcome = evaluateToolGate({\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\targs,\n\t\t\t\tcwd: options.cwd,\n\t\t\t\tenvelope: WRITE_LANE_TOOL_NAME_SET.has(toolCall.name) ? writeEnvelope : readEnvelope,\n\t\t\t});\n\t\t\tif (outcome.outcome === \"allow\") return undefined;\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Lane tool blocked (${outcome.reasonCode}): ${outcome.message ?? \"capability gate denied it\"}`,\n\t\t\t};\n\t\t},\n\t};\n}\n"]}

package/dist/core/background-lane-controller.d.ts

@@ -50,6 +50,8 @@ export interface BackgroundLaneControllerDeps {
     isModelExhausted(model: Model<Api>): boolean;
     /** The session's current model — lanes inherit it unless a lane model is explicitly configured. */
     getModel(): Model<Api> | undefined;
+    /** Tool/profile gate: delegation is unavailable when the active surface removes `delegate`. */
+    isDelegateToolActive(): boolean;
     /** Foreground cost ceiling — a lane budget is clamped to it, never exceeds it. */
     getCapabilityEnvelope(): CapabilityEnvelope | undefined;
     /** Capability profile of the SESSION model (gates background lanes, scales continuation budgets). */
@@ -74,7 +76,7 @@ export interface BackgroundLaneControllerDeps {
         sourceSessionId?: string;
         reportId?: string;
     }): string | undefined;
-    /** One-shot LLM call fully isolated from the main session — the lane execution primitive. */
+    /** Bounded LLM call fully isolated from the main session; lanes may supply a child tool loop. */
     runIsolatedCompletion(opts: IsolatedCompletionOptions): Promise<IsolatedCompletionResult>;
     /** Drive-loop boundary: the session's bounded goal-continuation loop (owns `prompt()`, not us). */
     continueGoalLoop(options: GoalContinuationLoopOptions): Promise<GoalContinuationLoopResult>;
@@ -98,6 +100,8 @@ export declare class BackgroundLaneController {
     private readonly _researchLaneAbort;
     /** Session-lifetime abort for in-flight delegated workers. */
     private readonly _workerDelegationAbort;
+    /** Session-local de-duplication for fail-closed profile grants that cannot bind to lane tools. */
+    private readonly _warnedUnboundLaneToolGrants;
     private readonly deps;
     constructor(deps: BackgroundLaneControllerDeps);
     /** Live lane records tracked by this process (running and terminal). */
@@ -140,8 +144,7 @@ export declare class BackgroundLaneController {
      * skip, never a fallback), then generic inheritance of the session model.
      */
     private _resolveLaneShipment;
-    /** UAC tool grants from a shipped lane profile, recorded on the lane envelope. */
-    private _laneProfileToolGrants;
+    private _warnUnboundLaneToolGrants;
     /** Stripped research envelope — never the foreground/architect envelope. */
     private _buildResearchLaneEnvelope;
     /**

package/dist/core/background-lane-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"background-lane-controller.d.ts","sourceRoot":"","sources":["../../src/core/background-lane-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EACX,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,0BAA0B,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EAAE,KAAK,UAAU,EAAe,MAAM,4BAA4B,CAAC;AAG1E,OAAO,EAAkC,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAG7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACzG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAEN,KAAK,sBAAsB,EAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEnF,OAAO,EAAE,KAAK,kBAAkB,EAAwB,MAAM,6BAA6B,CAAC;AAE5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,yBAAyB,CAAC,EAAE,MAAM,GAAG,MAAM,CAElG;AAED,MAAM,WAAW,4BAA4B;IAC5C,6EAA6E;IAC7E,UAAU,IAAI,OAAO,CAAC;IACtB,oGAAoG;IACpG,cAAc,IAAI,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,YAAY,IAAI,MAAM,CAAC;IACvB,mGAAmG;IACnG,MAAM,IAAI,MAAM,CAAC;IACjB,mEAAmE;IACnE,WAAW,IAAI,MAAM,CAAC;IACtB,+EAA+E;IAC/E,iBAAiB,IAAI,cAAc,CAAC;IACpC,uGAAuG;IACvG,kBAAkB,IAAI,eAAe,CAAC;IACtC,wEAAwE;IACxE,gBAAgB,IAAI,aAAa,CAAC;IAClC,4DAA4D;IAC5D,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IAC7C,qGAAmG;IACnG,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACnC,oFAAkF;IAClF,qBAAqB,IAAI,kBAAkB,GAAG,SAAS,CAAC;IACxD,qGAAqG;IACrG,yBAAyB,IAAI,sBAAsB,CAAC;IACpD,mEAAmE;IACnE,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,yEAAuE;IACvE,qBAAqB,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC3D,mFAAmF;IACnF,oBAAoB,IAAI,SAAS,GAAG,SAAS,CAAC;IAC9C,uEAAuE;IACvE,sBAAsB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,mBAAmB,CAAC;IACnF,kEAAkE;IAClE,yBAAyB,IAAI,cAAc,GAAG,SAAS,CAAC;IACxD,oEAAoE;IACpE,0BAA0B,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;IAC3D,wEAAwE;IACxE,wBAAwB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IAChF,qFAAqF;IACrF,eAAe,CACd,KAAK,EAAE,KAAK,EACZ,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,MAAM,GAAG,SAAS,CAAC;IACtB,+FAA6F;IAC7F,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC1F,mGAAmG;IACnG,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC5F,kGAAkG;IAClG,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;CACxD;AAED,qBAAa,wBAAwB;IACpC,+FAA+F;IAC/F,OAAO,CAAC,sBAAsB,CAA4C;IAC1E,mGAAmG;IACnG,OAAO,CAAC,qBAAqB,CAAS;IACtC,iGAAiG;IACjG,OAAO,CAAC,kBAAkB,CAA4C;IACtE,iFAAiF;IACjF,OAAO,CAAC,sBAAsB,CAAS;IACvC,qFAAqF;IACrF,OAAO,CAAC,2BAA2B,CAAqB;IACxD,yFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyB;IAC5D,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAyB;IAEhE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IAEpD,YAAY,IAAI,EAAE,4BAA4B,EAE7C;IAED,wEAAwE;IACxE,cAAc,IAAI,UAAU,EAAE,CAE7B;IAED,iGAA+F;IAC/F,kBAAkB,IAAI,MAAM,CAE3B;IAED,qFAAqF;IACrF,6BAA6B,IAAI,MAAM,GAAG,SAAS,CAElD;IAED,yFAAyF;IACzF,kBAAkB,IAAI,IAAI,CAGzB;IAED,0BAA0B,IAAI,IAAI,CAKjC;IAED,gCAAgC,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAyB9D;YAEa,6BAA6B;IAgC3C,sBAAsB,IAAI,IAAI,CAK7B;IAED;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IA2BhC;;;;OAIG;IACH,4BAA4B,IAAI,IAAI,CAsCnC;YAEa,yBAAyB;IAevC,oGAAoG;IACpG,OAAO,CAAC,sBAAsB;IAO9B;;;;;OAKG;IACH,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAS9E;IAED;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IA6B5B,kFAAkF;IAClF,OAAO,CAAC,sBAAsB;IAU9B,8EAA4E;IAC5E,OAAO,CAAC,0BAA0B;IAWlC;;;;;OAKG;IACG,mBAAmB,CAAC,OAAO,CAAC,EAAE;QACnC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAiJlC;IAED;;;;;OAKG;IACG,uBAAuB,CAAC,OAAO,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC;QACrB,+FAA+F;QAC/F,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4KtC;IAED;;;;;OAKG;IACG,eAAe,CAAC,IAAI,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAqEjH;IAED,mGAAmG;IACnG,uBAAuB,IAAI,mBAAmB,EAAE,CAM/C;CACD","sourcesContent":["/**\n * Background-lane controller: goal auto-continue, the research lane, scout-worker delegation, and\n * the model-fitness probe.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Owns the lane timers, the\n * single-flight guards, the last research-lane skip reason, the live {@link LaneTracker}, and the\n * session-lifetime abort controllers for in-flight research/worker passes. Everything else it needs\n * — the session manager, settings, model registry, live model, capability envelope, the goal\n * continuation LOOP, the isolated-completion primitive, spawned-usage accounting, and the telemetry\n * sink — is reached through narrow deps accessors rather than the whole AgentSession.\n *\n * Drive-loop boundary (deliberate): the idle triggers ({@link scheduleGoalAutoContinueFromIdle},\n * {@link scheduleResearchLaneFromIdle}) are invoked from the session's prompt tail as one-line\n * delegations; goal auto-continue itself only ever asks the session to `continueGoalLoop`, so this\n * controller never touches `prompt()`, the last-assistant-message, retry, or streaming state.\n */\n\nimport type { SessionManager } from \"@caupulican/pi-agent-core/node\";\nimport type { Api, Model, Usage } from \"@caupulican/pi-ai\";\nimport type {\n\tAgentSessionEvent,\n\tGoalContinuationLoopOptions,\n\tGoalContinuationLoopResult,\n\tIsolatedCompletionOptions,\n\tIsolatedCompletionResult,\n\tPromptOptions,\n\tResearchLaneRunOutcome,\n\tWorkerDelegationRunOutcome,\n} from \"./agent-session.ts\";\nimport type { CapabilityEnvelope, EvidenceBundle, WorkerRequest, WorkerResult } from \"./autonomy/contracts.ts\";\nimport { type LaneRecord, LaneTracker } from \"./autonomy/lane-tracker.ts\";\nimport { appendLaneRecordSnapshot, getLaneRecordSnapshots } from \"./autonomy/session-lane-record.ts\";\nimport { composeSubagentSystemPrompt } from \"./autonomy/subagent-prompt.ts\";\nimport { AUTONOMY_TELEMETRY_EVENT_TYPES, type AutonomyTelemetryEvent } from \"./autonomy/telemetry-events.ts\";\nimport { applyWorkerActions } from \"./delegation/worker-actions.ts\";\nimport { runWorker } from \"./delegation/worker-runner.ts\";\nimport type { GoalRuntimeSnapshot, GoalRuntimeSnapshotSettings } from \"./goals/goal-runtime-snapshot.ts\";\nimport type { GoalState } from \"./goals/goal-state.ts\";\nimport {\n\tderiveModelCapabilityProfile,\n\ttype ModelCapabilityProfile,\n\tscaleContinuationBudgetsForCapability,\n} from \"./model-capability.ts\";\nimport type { ModelRegistry } from \"./model-registry.ts\";\nimport { resolveCliModel } from \"./model-resolver.ts\";\nimport { FitnessStore, type StoredFitnessReport } from \"./models/fitness-store.ts\";\nimport type { NormalizedProfile } from \"./profile-registry.ts\";\nimport { type ModelFitnessReport, runModelFitnessProbe } from \"./research/model-fitness.ts\";\nimport { runResearch } from \"./research/research-runner.ts\";\nimport type { collectWorkspaceSources } from \"./research/workspace-collector.ts\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\n\nexport function clampLaneMaxUsd(settingsMaxUsd: number, foregroundMaxEstimatedUsd?: number): number {\n\treturn Math.min(settingsMaxUsd, foregroundMaxEstimatedUsd ?? Number.POSITIVE_INFINITY);\n}\n\nexport interface BackgroundLaneControllerDeps {\n\t/** A disposed session must never schedule/persist a lane or continuation. */\n\tisDisposed(): boolean;\n\t/** Child sessions never run the idle research lane (only the top-level session drives autonomy). */\n\tisChildSession(): boolean;\n\t/** This session's id, for lane envelope ids and spawned-usage report ids. */\n\tgetSessionId(): string;\n\t/** The workspace root a lane runs relative to (worker path scope + research source collection). */\n\tgetCwd(): string;\n\t/** Root dir the host-keyed {@link FitnessStore} persists under. */\n\tgetAgentDir(): string;\n\t/** Session log: lane records read/append here and feed lane-history dedupe. */\n\tgetSessionManager(): SessionManager;\n\t/** Autonomy / research-lane / worker-delegation / model-capability settings + the profile registry. */\n\tgetSettingsManager(): SettingsManager;\n\t/** Resolves a configured lane model pattern against configured auth. */\n\tgetModelRegistry(): ModelRegistry;\n\t/** Session-scoped provider/model quota exhaustion guard. */\n\tisModelExhausted(model: Model<Api>): boolean;\n\t/** The session's current model — lanes inherit it unless a lane model is explicitly configured. */\n\tgetModel(): Model<Api> | undefined;\n\t/** Foreground cost ceiling — a lane budget is clamped to it, never exceeds it. */\n\tgetCapabilityEnvelope(): CapabilityEnvelope | undefined;\n\t/** Capability profile of the SESSION model (gates background lanes, scales continuation budgets). */\n\tgetModelCapabilityProfile(): ModelCapabilityProfile;\n\t/** Emits a session event (only `warning` from this controller). */\n\temit(event: AgentSessionEvent): void;\n\t/** G3/G8 telemetry sink (codes/ids only — never lane product text). */\n\temitAutonomyTelemetry(event: AutonomyTelemetryEvent): void;\n\t/** Durable goal state, if a goal is active (the research lane's demand source). */\n\tgetGoalStateSnapshot(): GoalState | undefined;\n\t/** Continuation gate + goal state for the idle autosteer scheduler. */\n\tgetGoalRuntimeSnapshot(settings: GoalRuntimeSnapshotSettings): GoalRuntimeSnapshot;\n\t/** Latest persisted evidence bundle, for research-lane dedupe. */\n\tgetEvidenceBundleSnapshot(): EvidenceBundle | undefined;\n\t/** Persist a research lane's evidence bundle to the session log. */\n\tsaveEvidenceBundleSnapshot(bundle: EvidenceBundle): string;\n\t/** Persist a worker delegation's result snapshot to the session log. */\n\tsaveWorkerResultSnapshot(result: WorkerResult, request?: WorkerRequest): string;\n\t/** Roll a lane's spawned usage into session accounting (idempotent per reportId). */\n\taddSpawnedUsage(\n\t\tusage: Usage,\n\t\topts?: { label?: string; sourceSessionId?: string; reportId?: string },\n\t): string | undefined;\n\t/** One-shot LLM call fully isolated from the main session — the lane execution primitive. */\n\trunIsolatedCompletion(opts: IsolatedCompletionOptions): Promise<IsolatedCompletionResult>;\n\t/** Drive-loop boundary: the session's bounded goal-continuation loop (owns `prompt()`, not us). */\n\tcontinueGoalLoop(options: GoalContinuationLoopOptions): Promise<GoalContinuationLoopResult>;\n\t/** Best-effort workspace evidence collection (silent-on-failure; [] preserves prior behavior). */\n\tcollectWorkspaceSources: typeof collectWorkspaceSources;\n}\n\nexport class BackgroundLaneController {\n\t/** Pending idle timer that starts bounded goal continuation after the session becomes idle. */\n\tprivate _goalAutoContinueTimer: ReturnType<typeof setTimeout> | undefined;\n\t/** Guards bounded idle autosteer so continuation prompts do not recursively trigger themselves. */\n\tprivate _isGoalAutoContinuing = false;\n\t/** Pending idle timer that starts an autonomous research pass after the session becomes idle. */\n\tprivate _researchLaneTimer: ReturnType<typeof setTimeout> | undefined;\n\t/** Single-flight guard: at most one research pass runs at a time per session. */\n\tprivate _isResearchLaneRunning = false;\n\t/** Why the last idle research-lane evaluation skipped, for /autonomy diagnostics. */\n\tprivate _lastResearchLaneSkipReason: string | undefined;\n\t/** Live lane registry — the real source for AutonomyStatusSnapshot.activeLaneCount. */\n\tprivate readonly _laneTracker = new LaneTracker();\n\t/** Session-lifetime abort for in-flight research passes (same pattern as _reflectionAbort). */\n\tprivate readonly _researchLaneAbort = new AbortController();\n\t/** Session-lifetime abort for in-flight delegated workers. */\n\tprivate readonly _workerDelegationAbort = new AbortController();\n\n\tprivate readonly deps: BackgroundLaneControllerDeps;\n\n\tconstructor(deps: BackgroundLaneControllerDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\t/** Live lane records tracked by this process (running and terminal). */\n\tgetLaneRecords(): LaneRecord[] {\n\t\treturn this._laneTracker.getRecords();\n\t}\n\n\t/** Live count of active lanes — the real source for AutonomyStatusSnapshot.activeLaneCount. */\n\tgetActiveLaneCount(): number {\n\t\treturn this._laneTracker.getActiveCount();\n\t}\n\n\t/** Why the last idle research-lane evaluation skipped, for /autonomy diagnostics. */\n\tgetLastResearchLaneSkipReason(): string | undefined {\n\t\treturn this._lastResearchLaneSkipReason;\n\t}\n\n\t/** Abort any in-flight research pass or delegated worker (called on session dispose). */\n\tabortInFlightLanes(): void {\n\t\tthis._researchLaneAbort.abort();\n\t\tthis._workerDelegationAbort.abort();\n\t}\n\n\tclearGoalAutoContinueTimer(): void {\n\t\tif (this._goalAutoContinueTimer !== undefined) {\n\t\t\tclearTimeout(this._goalAutoContinueTimer);\n\t\t\tthis._goalAutoContinueTimer = undefined;\n\t\t}\n\t}\n\n\tscheduleGoalAutoContinueFromIdle(options?: PromptOptions): void {\n\t\tif (options?.autoContinueGoal === false || this._isGoalAutoContinuing || this.deps.isDisposed()) return;\n\n\t\t// Small-window models cannot afford multi-thousand-token continuation prompts per idle turn.\n\t\tif (!this.deps.getModelCapabilityProfile().backgroundLanesEnabled) return;\n\n\t\tconst { maxStallTurns, goalAutoContinue, goalAutoContinueDelayMs } = this.deps\n\t\t\t.getSettingsManager()\n\t\t\t.getAutonomySettings();\n\t\tif (!goalAutoContinue) return;\n\n\t\tconst snapshot = this.deps.getGoalRuntimeSnapshot({ maxStallTurns });\n\t\tif (snapshot.continuation.action !== \"continue\") return;\n\n\t\tthis.clearGoalAutoContinueTimer();\n\t\tthis._goalAutoContinueTimer = setTimeout(() => {\n\t\t\tthis._goalAutoContinueTimer = undefined;\n\t\t\tvoid this._runScheduledGoalAutoContinue();\n\t\t}, goalAutoContinueDelayMs);\n\n\t\tconst timer = this._goalAutoContinueTimer;\n\t\tif (typeof timer === \"object\" && timer && \"unref\" in timer) {\n\t\t\tconst { unref } = timer as { unref?: () => void };\n\t\t\tunref?.call(timer);\n\t\t}\n\t}\n\n\tprivate async _runScheduledGoalAutoContinue(): Promise<void> {\n\t\tif (this._isGoalAutoContinuing || this.deps.isDisposed()) return;\n\n\t\tconst { maxStallTurns, goalContinueTurns, goalContinueMaxWallClockMinutes, goalAutoContinue } = this.deps\n\t\t\t.getSettingsManager()\n\t\t\t.getAutonomySettings();\n\t\tif (!goalAutoContinue) return;\n\n\t\tconst snapshot = this.deps.getGoalRuntimeSnapshot({ maxStallTurns });\n\t\tif (snapshot.continuation.action !== \"continue\") return;\n\n\t\t// Lean-window models (16-32k) keep autosteer but at a reduced budget; full passes through.\n\t\tconst scaled = scaleContinuationBudgetsForCapability(this.deps.getModelCapabilityProfile(), {\n\t\t\tmaxTurns: goalContinueTurns,\n\t\t\tmaxWallClockMinutes: goalContinueMaxWallClockMinutes,\n\t\t});\n\n\t\tthis._isGoalAutoContinuing = true;\n\t\ttry {\n\t\t\tawait this.deps.continueGoalLoop({\n\t\t\t\tmaxTurns: scaled.maxTurns,\n\t\t\t\tmaxStallTurns,\n\t\t\t\tmaxWallClockMinutes: scaled.maxWallClockMinutes,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthis.deps.emit({ type: \"warning\", message: `Goal auto-continuation failed: ${message}` });\n\t\t} finally {\n\t\t\tthis._isGoalAutoContinuing = false;\n\t\t}\n\t}\n\n\tclearResearchLaneTimer(): void {\n\t\tif (this._researchLaneTimer !== undefined) {\n\t\t\tclearTimeout(this._researchLaneTimer);\n\t\t\tthis._researchLaneTimer = undefined;\n\t\t}\n\t}\n\n\t/**\n\t * Derive the research demand from durable goal state: an active goal with open requirements,\n\t * deduplicated against the latest persisted bundle so the same requirement set is never\n\t * researched twice (the query is deterministic, so dedupe survives session reload).\n\t */\n\tprivate _buildResearchLaneDemand(): { query: string; context: string; goalId: string } | undefined {\n\t\tconst goal = this.deps.getGoalStateSnapshot();\n\t\tif (!goal || goal.status !== \"active\") {\n\t\t\tthis._lastResearchLaneSkipReason = \"no_active_goal\";\n\t\t\treturn undefined;\n\t\t}\n\t\tconst open = goal.requirements.filter((requirement) => requirement.status === \"open\");\n\t\tif (open.length === 0) {\n\t\t\tthis._lastResearchLaneSkipReason = \"no_open_requirements\";\n\t\t\treturn undefined;\n\t\t}\n\t\tconst query = `goal:${goal.goalId} requirements:${open\n\t\t\t.map((requirement) => requirement.id)\n\t\t\t.sort()\n\t\t\t.join(\",\")}`;\n\t\tif (this.deps.getEvidenceBundleSnapshot()?.query === query) {\n\t\t\tthis._lastResearchLaneSkipReason = \"recent_evidence_sufficient\";\n\t\t\treturn undefined;\n\t\t}\n\t\tconst context = [\n\t\t\t`Goal: ${goal.userGoal}`,\n\t\t\t\"Open requirements:\",\n\t\t\t...open.slice(0, 20).map((requirement) => `- ${requirement.text}`),\n\t\t].join(\"\\n\");\n\t\treturn { query, context, goalId: goal.goalId };\n\t}\n\n\t/**\n\t * Idle trigger for the autonomous research lane (mirrors {@link scheduleGoalAutoContinueFromIdle}).\n\t * All skips are recorded in `_lastResearchLaneSkipReason` and surfaced via diagnostics — the lane\n\t * informs, it never prompts or blocks the foreground.\n\t */\n\tscheduleResearchLaneFromIdle(): void {\n\t\tif (this._isResearchLaneRunning || this.deps.isDisposed() || this.deps.isChildSession()) return;\n\n\t\tif (!this.deps.getModelCapabilityProfile().backgroundLanesEnabled) {\n\t\t\tthis._lastResearchLaneSkipReason = \"model_context_too_small\";\n\t\t\treturn;\n\t\t}\n\n\t\tconst research = this.deps.getSettingsManager().getResearchLaneSettings();\n\t\tif (!research.enabled) {\n\t\t\tthis._lastResearchLaneSkipReason = \"research_lane_disabled\";\n\t\t\treturn;\n\t\t}\n\t\tconst { mode } = this.deps.getSettingsManager().getAutonomySettings();\n\t\tif (mode === \"off\") {\n\t\t\tthis._lastResearchLaneSkipReason = \"autonomy_mode_off\";\n\t\t\treturn;\n\t\t}\n\t\tconst priorRuns = getLaneRecordSnapshots(this.deps.getSessionManager().getEntries()).filter(\n\t\t\t(record) => record.type === \"research\",\n\t\t).length;\n\t\tif (priorRuns >= research.maxRunsPerSession) {\n\t\t\tthis._lastResearchLaneSkipReason = \"max_runs_reached\";\n\t\t\treturn;\n\t\t}\n\t\tif (!this._buildResearchLaneDemand()) return;\n\n\t\tthis.clearResearchLaneTimer();\n\t\tthis._researchLaneTimer = setTimeout(() => {\n\t\t\tthis._researchLaneTimer = undefined;\n\t\t\tvoid this._runScheduledResearchLane();\n\t\t}, research.idleDelayMs);\n\n\t\tconst timer = this._researchLaneTimer;\n\t\tif (typeof timer === \"object\" && timer && \"unref\" in timer) {\n\t\t\tconst { unref } = timer as { unref?: () => void };\n\t\t\tunref?.call(timer);\n\t\t}\n\t}\n\n\tprivate async _runScheduledResearchLane(): Promise<void> {\n\t\tif (this._isResearchLaneRunning || this.deps.isDisposed()) return;\n\n\t\tconst research = this.deps.getSettingsManager().getResearchLaneSettings();\n\t\tconst { mode } = this.deps.getSettingsManager().getAutonomySettings();\n\t\tif (!research.enabled || mode === \"off\") return;\n\n\t\ttry {\n\t\t\tawait this.runResearchLaneOnce();\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthis.deps.emit({ type: \"warning\", message: `Research lane failed: ${message}` });\n\t\t}\n\t}\n\n\t/** Capability profile for a specific lane model (lane budgets scale to the lane model's window). */\n\tprivate _laneCapabilityProfile(model: Model<Api>): ModelCapabilityProfile {\n\t\treturn deriveModelCapabilityProfile({\n\t\t\tcontextWindow: model.contextWindow,\n\t\t\tmode: this.deps.getSettingsManager().getModelCapabilitySettings().mode,\n\t\t});\n\t}\n\n\t/**\n\t * Resolve the model for a background lane. Lanes are shipped BY this session, so they inherit\n\t * the session's own model unless a lane-specific model is explicitly configured — a single-model\n\t * setup (e.g. one local open model) runs its lanes on that same model. An explicitly configured\n\t * pattern that cannot resolve/authenticate is a visible skip, not a silent fallback.\n\t */\n\tresolveLaneModel(configuredPattern: string | undefined): Model<Api> | undefined {\n\t\tif (configuredPattern) {\n\t\t\tconst resolved = resolveCliModel({ cliModel: configuredPattern, modelRegistry: this.deps.getModelRegistry() });\n\t\t\tif (resolved.model && this.deps.getModelRegistry().hasConfiguredAuth(resolved.model)) {\n\t\t\t\treturn resolved.model;\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t\treturn this.deps.getModel() ?? undefined;\n\t}\n\n\t/**\n\t * Resolve what a lane ships with. Precedence: explicit lane model setting, then the lane\n\t * profile's model (a shipped profile with a model MUST be obeyed — unresolvable is a visible\n\t * skip, never a fallback), then generic inheritance of the session model.\n\t */\n\tprivate _resolveLaneShipment(\n\t\tlaneSettings: { model?: string; profile?: string },\n\t\tmissingModelReason: string,\n\t): { ok: true; model: Model<Api>; laneProfile?: NormalizedProfile } | { ok: false; skipReason: string } {\n\t\tlet laneProfile: NormalizedProfile | undefined;\n\t\tif (laneSettings.profile) {\n\t\t\tlaneProfile = this.deps.getSettingsManager().getProfileRegistry().getProfile(laneSettings.profile);\n\t\t\tif (!laneProfile) {\n\t\t\t\treturn { ok: false, skipReason: \"lane_profile_not_found\" };\n\t\t\t}\n\t\t}\n\n\t\tlet model: Model<Api> | undefined;\n\t\tif (laneSettings.model) {\n\t\t\tmodel = this.resolveLaneModel(laneSettings.model);\n\t\t\tif (!model) return { ok: false, skipReason: missingModelReason };\n\t\t} else if (laneProfile?.model) {\n\t\t\tmodel = this.resolveLaneModel(laneProfile.model);\n\t\t\tif (!model) return { ok: false, skipReason: \"no_lane_profile_model\" };\n\t\t} else {\n\t\t\tmodel = this.deps.getModel() ?? undefined;\n\t\t\tif (!model) return { ok: false, skipReason: missingModelReason };\n\t\t}\n\t\tif (this.deps.isModelExhausted(model)) {\n\t\t\treturn { ok: false, skipReason: `${model.provider}/${model.id} model exhausted: quota` };\n\t\t}\n\t\treturn { ok: true, model, laneProfile };\n\t}\n\n\t/** UAC tool grants from a shipped lane profile, recorded on the lane envelope. */\n\tprivate _laneProfileToolGrants(\n\t\tlaneProfile?: NormalizedProfile,\n\t): Pick<CapabilityEnvelope, \"allowedTools\" | \"deniedTools\"> {\n\t\tconst toolsFilter = laneProfile?.resources.tools;\n\t\treturn {\n\t\t\t...(toolsFilter?.allow && toolsFilter.allow.length > 0 ? { allowedTools: [...toolsFilter.allow] } : {}),\n\t\t\t...(toolsFilter?.block && toolsFilter.block.length > 0 ? { deniedTools: [...toolsFilter.block] } : {}),\n\t\t};\n\t}\n\n\t/** Stripped research envelope — never the foreground/architect envelope. */\n\tprivate _buildResearchLaneEnvelope(maxUsd: number, laneProfile?: NormalizedProfile): CapabilityEnvelope {\n\t\treturn {\n\t\t\tid: `research-${this.deps.getSessionId()}-${Date.now()}`,\n\t\t\tprofileId: laneProfile?.name,\n\t\t\tcapabilities: [\"research\", \"read_files\", \"memory_read\"],\n\t\t\t...this._laneProfileToolGrants(laneProfile),\n\t\t\tmaxEstimatedUsd: clampLaneMaxUsd(maxUsd, this.deps.getCapabilityEnvelope()?.maxEstimatedUsd),\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\t}\n\n\t/**\n\t * Run one bounded, read-only research pass and persist its results: evidence bundle snapshot,\n\t * terminal lane record, and spawned-usage cost report (single-hop invariant, idempotent on the\n\t * lane's reportId). Explicit calls (e.g. `/autonomy research`) express user intent and bypass the\n\t * enabled/mode/dedupe gates the idle scheduler enforces; budget and capability gates always apply.\n\t */\n\tasync runResearchLaneOnce(request?: {\n\t\tquery?: string;\n\t\tcontext?: string;\n\t\tgoalId?: string;\n\t}): Promise<ResearchLaneRunOutcome> {\n\t\tif (this._isResearchLaneRunning) {\n\t\t\treturn { started: false, skipReason: \"research_lane_already_running\" };\n\t\t}\n\t\tif (this.deps.isDisposed()) {\n\t\t\treturn { started: false, skipReason: \"session_disposed\" };\n\t\t}\n\n\t\tconst settings = this.deps.getSettingsManager().getResearchLaneSettings();\n\t\tconst demand = request?.query\n\t\t\t? { query: request.query, context: request.context ?? \"\", goalId: request.goalId }\n\t\t\t: this._buildResearchLaneDemand();\n\t\tif (!demand) {\n\t\t\treturn { started: false, skipReason: this._lastResearchLaneSkipReason ?? \"no_research_demand\" };\n\t\t}\n\n\t\tconst shipment = this._resolveLaneShipment(settings, \"no_research_model\");\n\t\tif (!shipment.ok) {\n\t\t\tthis._lastResearchLaneSkipReason = shipment.skipReason;\n\t\t\treturn { started: false, skipReason: shipment.skipReason };\n\t\t}\n\t\tconst { model, laneProfile } = shipment;\n\n\t\tthis._isResearchLaneRunning = true;\n\t\tthis._laneTracker.ensureCounterAtLeast(\n\t\t\tgetLaneRecordSnapshots(this.deps.getSessionManager().getEntries()).length + 1,\n\t\t);\n\t\tconst startedRecord = this._laneTracker.start({ type: \"research\", goalId: demand.goalId });\n\t\ttry {\n\t\t\tlet spentUsage: Usage | undefined;\n\t\t\t// Best-effort, pointer-first workspace evidence. Derives search terms from the goal/requirement\n\t\t\t// text (not the identity-key query) and is bounded + silent-on-failure: [] == today's behavior.\n\t\t\tconst workspaceSources = await this.deps.collectWorkspaceSources({\n\t\t\t\tquery: `${demand.context}\\n${demand.query}`,\n\t\t\t\tcwd: this.deps.getCwd(),\n\t\t\t\tmaxSources: settings.maxSources,\n\t\t\t});\n\t\t\tconst maxUsd = clampLaneMaxUsd(settings.maxUsd, this.deps.getCapabilityEnvelope()?.maxEstimatedUsd);\n\t\t\tconst result = await runResearch({\n\t\t\t\tquery: demand.query,\n\t\t\t\tcontext: demand.context,\n\t\t\t\tsources: workspaceSources,\n\t\t\t\tenvelope: this._buildResearchLaneEnvelope(maxUsd, laneProfile),\n\t\t\t\tmaxUsd,\n\t\t\t\tmaxSources: settings.maxSources,\n\t\t\t\tmaxFindings: settings.maxFindings,\n\t\t\t\tmaxWallClockMs: settings.maxWallClockMs,\n\t\t\t\tsignal: this._researchLaneAbort.signal,\n\t\t\t\tcomplete: async ({ systemPrompt, userPrompt, signal }) => {\n\t\t\t\t\tconst completion = await this.deps.runIsolatedCompletion({\n\t\t\t\t\t\t// Level-0 core always survives; profile soul and role prompt are the replaceable\n\t\t\t\t\t\t// layers; a settings-provided prompt replaces everything above the core.\n\t\t\t\t\t\tsystemPrompt: composeSubagentSystemPrompt({\n\t\t\t\t\t\t\tsoul: laneProfile?.soul,\n\t\t\t\t\t\t\trolePrompt: systemPrompt,\n\t\t\t\t\t\t\toverride: settings.systemPrompt,\n\t\t\t\t\t\t}),\n\t\t\t\t\t\tmessages: [{ role: \"user\", content: [{ type: \"text\", text: userPrompt }], timestamp: Date.now() }],\n\t\t\t\t\t\tmodel,\n\t\t\t\t\t\tthinkingLevel: laneProfile?.thinking ?? \"off\",\n\t\t\t\t\t\tmaxTokens: this._laneCapabilityProfile(model).laneMaxOutputTokens,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t// Core/soul/role are all static per configuration — the provider can cache the prefix.\n\t\t\t\t\t\tcacheRetention: \"short\",\n\t\t\t\t\t});\n\t\t\t\t\tspentUsage = completion.usage;\n\t\t\t\t\treturn {\n\t\t\t\t\t\ttext: completion.text,\n\t\t\t\t\t\tcostUsd: completion.usage.cost.total,\n\t\t\t\t\t\tstopReason: String(completion.stopReason),\n\t\t\t\t\t};\n\t\t\t\t},\n\t\t\t});\n\n\t\t\t// Bug #21 pattern: if the session was disposed while the completion was in flight, do NOT\n\t\t\t// persist evidence/records/usage against the dead session.\n\t\t\tif (this.deps.isDisposed()) {\n\t\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\t\tstatus: \"canceled\",\n\t\t\t\t\treasonCode: \"session_disposed\",\n\t\t\t\t});\n\t\t\t\treturn { started: true, record, result };\n\t\t\t}\n\n\t\t\tlet evidenceEntryId: string | undefined;\n\t\t\tif (result.bundle) {\n\t\t\t\tevidenceEntryId = this.deps.saveEvidenceBundleSnapshot(result.bundle);\n\t\t\t}\n\t\t\tif (spentUsage && (spentUsage.cost.total > 0 || spentUsage.totalTokens > 0)) {\n\t\t\t\tthis.deps.addSpawnedUsage(spentUsage, {\n\t\t\t\t\tlabel: \"research-lane\",\n\t\t\t\t\treportId: `research:${this.deps.getSessionId()}:${startedRecord.laneId}`,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\tstatus: result.status,\n\t\t\t\treasonCode: result.reasonCode,\n\t\t\t\tcostUsd: result.costUsd,\n\t\t\t\tevidenceEntryId,\n\t\t\t});\n\t\t\tif (record) {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), record);\n\t\t\t\t// G3: a research lane's product is an evidence bundle, so its terminal record maps to\n\t\t\t\t// the evidence_bundle event. Lane outcome only (status/reasonCode/cost) — no findings text.\n\t\t\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.evidenceBundle,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\tpayload: {\n\t\t\t\t\t\tlaneId: record.laneId,\n\t\t\t\t\t\tlaneType: record.type,\n\t\t\t\t\t\tstatus: record.status,\n\t\t\t\t\t\treasonCode: record.reasonCode ?? null,\n\t\t\t\t\t\tcostUsd: record.costUsd ?? null,\n\t\t\t\t\t\thasEvidence: record.evidenceEntryId !== undefined,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn { started: true, record, result };\n\t\t} catch (error) {\n\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\tstatus: \"failed\",\n\t\t\t\treasonCode: \"research_lane_error\",\n\t\t\t});\n\t\t\tif (record && !this.deps.isDisposed()) {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), record);\n\t\t\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.evidenceBundle,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\tpayload: {\n\t\t\t\t\t\tlaneId: record.laneId,\n\t\t\t\t\t\tlaneType: record.type,\n\t\t\t\t\t\tstatus: record.status,\n\t\t\t\t\t\treasonCode: record.reasonCode ?? null,\n\t\t\t\t\t\tcostUsd: record.costUsd ?? null,\n\t\t\t\t\t\thasEvidence: record.evidenceEntryId !== undefined,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthis.deps.emit({ type: \"warning\", message: `Research lane failed: ${message}` });\n\t\t\treturn { started: true, record };\n\t\t} finally {\n\t\t\tthis._isResearchLaneRunning = false;\n\t\t}\n\t}\n\n\t/**\n\t * Run one bounded scout-worker delegation: build a WorkerRequest with a stripped read-only\n\t * envelope, execute it as an isolated completion on a cheap lane, validate the result via\n\t * {@link validateWorkerResult} before acceptance, and persist result + lane record + spawned\n\t * usage (idempotent per-lane reportId). Consumed by the `delegate` tool.\n\t */\n\tasync runWorkerDelegationOnce(request: {\n\t\tinstructions: string;\n\t\t/** Model-provided replacement for the worker role prompt (the level-0 core always remains). */\n\t\tsystemPrompt?: string;\n\t}): Promise<WorkerDelegationRunOutcome> {\n\t\tconst delegationSettings = this.deps.getSettingsManager().getWorkerDelegationSettings();\n\t\tif (this._laneTracker.getActiveCount(\"worker\") >= delegationSettings.maxConcurrent) {\n\t\t\treturn { started: false, skipReason: \"worker_delegation_already_running\" };\n\t\t}\n\t\tif (this.deps.isDisposed()) {\n\t\t\treturn { started: false, skipReason: \"session_disposed\" };\n\t\t}\n\t\tconst instructions = request.instructions.trim();\n\t\tif (instructions.length === 0) {\n\t\t\treturn { started: false, skipReason: \"missing_instructions\" };\n\t\t}\n\n\t\tconst settings = delegationSettings;\n\t\tif (!settings.enabled) {\n\t\t\treturn { started: false, skipReason: \"worker_delegation_disabled\" };\n\t\t}\n\n\t\tconst shipment = this._resolveLaneShipment(settings, \"no_worker_model\");\n\t\tif (!shipment.ok) {\n\t\t\treturn { started: false, skipReason: shipment.skipReason };\n\t\t}\n\t\tconst { model, laneProfile } = shipment;\n\n\t\tthis._laneTracker.ensureCounterAtLeast(\n\t\t\tgetLaneRecordSnapshots(this.deps.getSessionManager().getEntries()).length + 1,\n\t\t);\n\t\tconst startedRecord = this._laneTracker.start({ type: \"worker\" });\n\t\tconst maxUsd = Math.min(\n\t\t\tsettings.maxUsd,\n\t\t\tthis.deps.getCapabilityEnvelope()?.maxEstimatedUsd ?? Number.POSITIVE_INFINITY,\n\t\t);\n\t\tconst workerRequest: WorkerRequest = {\n\t\t\tid: startedRecord.laneId,\n\t\t\tinstructions,\n\t\t\troute: {\n\t\t\t\ttier: \"cheap\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 1,\n\t\t\t\treasonCode: \"scout_worker\",\n\t\t\t\treasons: [\"Read-only scout delegation\"],\n\t\t\t},\n\t\t\tenvelope: {\n\t\t\t\tid: `worker-${this.deps.getSessionId()}-${startedRecord.laneId}`,\n\t\t\t\tprofileId: laneProfile?.name,\n\t\t\t\t// write_files requires BOTH the opt-in AND an explicit non-empty path scope —\n\t\t\t\t// an unscoped write grant is refused here, not discovered at validation time.\n\t\t\t\tcapabilities:\n\t\t\t\t\tsettings.writeEnabled && settings.writePaths.length > 0 ? [\"read_files\", \"write_files\"] : [\"read_files\"],\n\t\t\t\t...(settings.writeEnabled && settings.writePaths.length > 0\n\t\t\t\t\t? { allowedPaths: [...settings.writePaths] }\n\t\t\t\t\t: {}),\n\t\t\t\t...this._laneProfileToolGrants(laneProfile),\n\t\t\t\tmaxEstimatedUsd: maxUsd,\n\t\t\t\tcreatedAt: new Date().toISOString(),\n\t\t\t},\n\t\t\tmaxEstimatedUsd: maxUsd,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\t\t// G8: worker delegation START. Routing/scope codes + budget only — never the instructions text.\n\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.workerRequest,\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tpayload: {\n\t\t\t\tid: workerRequest.id,\n\t\t\t\ttier: workerRequest.route.tier,\n\t\t\t\tcapabilities: [...workerRequest.envelope.capabilities],\n\t\t\t\tmaxEstimatedUsd: workerRequest.maxEstimatedUsd ?? null,\n\t\t\t},\n\t\t});\n\t\tconst usageReportId = `worker:${this.deps.getSessionId()}:${startedRecord.laneId}`;\n\n\t\ttry {\n\t\t\tlet spentUsage: Usage | undefined;\n\t\t\tconst outcome = await runWorker({\n\t\t\t\trequest: workerRequest,\n\t\t\t\tmaxUsd,\n\t\t\t\tmaxWallClockMs: settings.maxWallClockMs,\n\t\t\t\tusageReportId,\n\t\t\t\tsignal: this._workerDelegationAbort.signal,\n\t\t\t\t// Parent validation must use the same relative-path baseline the runner reports in.\n\t\t\t\tcwd: this.deps.getCwd(),\n\t\t\t\t// Write lane (G2): runner-side action application through the envelope path scope.\n\t\t\t\tapplyActions: workerRequest.envelope.capabilities.includes(\"write_files\")\n\t\t\t\t\t? (actions) => applyWorkerActions({ actions, envelope: workerRequest.envelope, cwd: this.deps.getCwd() })\n\t\t\t\t\t: undefined,\n\t\t\t\tcomplete: async ({ systemPrompt, userPrompt, signal }) => {\n\t\t\t\t\tconst completion = await this.deps.runIsolatedCompletion({\n\t\t\t\t\t\t// Level-0 core always survives. A model-provided prompt (delegate tool) is the most\n\t\t\t\t\t\t// specific override, then the settings-level prompt, then profile soul + role prompt.\n\t\t\t\t\t\tsystemPrompt: composeSubagentSystemPrompt({\n\t\t\t\t\t\t\tsoul: laneProfile?.soul,\n\t\t\t\t\t\t\trolePrompt: systemPrompt,\n\t\t\t\t\t\t\toverride: request.systemPrompt ?? settings.systemPrompt,\n\t\t\t\t\t\t}),\n\t\t\t\t\t\tmessages: [{ role: \"user\", content: [{ type: \"text\", text: userPrompt }], timestamp: Date.now() }],\n\t\t\t\t\t\tmodel,\n\t\t\t\t\t\tthinkingLevel: laneProfile?.thinking ?? \"off\",\n\t\t\t\t\t\tmaxTokens: this._laneCapabilityProfile(model).laneMaxOutputTokens,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t// Core/soul/role are all static per configuration — the provider can cache the prefix.\n\t\t\t\t\t\tcacheRetention: \"short\",\n\t\t\t\t\t});\n\t\t\t\t\tspentUsage = completion.usage;\n\t\t\t\t\treturn {\n\t\t\t\t\t\ttext: completion.text,\n\t\t\t\t\t\tcostUsd: completion.usage.cost.total,\n\t\t\t\t\t\tstopReason: String(completion.stopReason),\n\t\t\t\t\t};\n\t\t\t\t},\n\t\t\t});\n\n\t\t\t// Bug #21 pattern: never persist against a disposed session.\n\t\t\tif (this.deps.isDisposed()) {\n\t\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\t\tstatus: \"canceled\",\n\t\t\t\t\treasonCode: \"session_disposed\",\n\t\t\t\t});\n\t\t\t\treturn { started: true, record, outcome };\n\t\t\t}\n\n\t\t\tthis.deps.saveWorkerResultSnapshot(outcome.result, workerRequest);\n\t\t\tif (spentUsage && (spentUsage.cost.total > 0 || spentUsage.totalTokens > 0)) {\n\t\t\t\tthis.deps.addSpawnedUsage(spentUsage, { label: \"worker-delegation\", reportId: usageReportId });\n\t\t\t}\n\n\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\tstatus: outcome.laneStatus,\n\t\t\t\treasonCode: outcome.reasonCode,\n\t\t\t\tcostUsd: outcome.costUsd,\n\t\t\t});\n\t\t\tif (record) {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), record);\n\t\t\t\t// G3: worker lane terminal record -> worker_result event. Lane outcome only\n\t\t\t\t// (status/reasonCode/cost) — never the worker's summary/changed-file text.\n\t\t\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.workerResult,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\tpayload: {\n\t\t\t\t\t\tlaneId: record.laneId,\n\t\t\t\t\t\tlaneType: record.type,\n\t\t\t\t\t\tstatus: record.status,\n\t\t\t\t\t\treasonCode: record.reasonCode ?? null,\n\t\t\t\t\t\tcostUsd: record.costUsd ?? null,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn { started: true, record, outcome };\n\t\t} catch (error) {\n\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\tstatus: \"failed\",\n\t\t\t\treasonCode: \"worker_delegation_error\",\n\t\t\t});\n\t\t\tif (record && !this.deps.isDisposed()) {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), record);\n\t\t\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.workerResult,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\tpayload: {\n\t\t\t\t\t\tlaneId: record.laneId,\n\t\t\t\t\t\tlaneType: record.type,\n\t\t\t\t\t\tstatus: record.status,\n\t\t\t\t\t\treasonCode: record.reasonCode ?? null,\n\t\t\t\t\t\tcostUsd: record.costUsd ?? null,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthis.deps.emit({ type: \"warning\", message: `Worker delegation failed: ${message}` });\n\t\t\treturn { started: true, record };\n\t\t} finally {\n\t\t}\n\t}\n\n\t/**\n\t * Probe a candidate model against the subagent contracts (research/worker/judge/search/\n\t * tool-call surfaces) via {@link runModelFitnessProbe}. The model must resolve and\n\t * authenticate; every probe call runs as an isolated completion on that model, and probe\n\t * spend is reported through spawned-usage accounting.\n\t */\n\tasync runModelFitness(args: {\n\t\tmodel: string;\n\t\ttrials?: number;\n\t}): Promise<{ started: true; model: string; report: ModelFitnessReport } | { started: false; skipReason: string }> {\n\t\tif (this.deps.isDisposed()) return { started: false, skipReason: \"session_disposed\" };\n\t\tconst resolved = this.resolveLaneModel(args.model.trim() || undefined);\n\t\tif (!resolved) return { started: false, skipReason: \"model_unresolved_or_unauthenticated\" };\n\t\tconst capability = this._laneCapabilityProfile(resolved);\n\n\t\tconst spent: Usage = {\n\t\t\tinput: 0,\n\t\t\toutput: 0,\n\t\t\tcacheRead: 0,\n\t\t\tcacheWrite: 0,\n\t\t\ttotalTokens: 0,\n\t\t\tcost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },\n\t\t};\n\t\tconst report = await runModelFitnessProbe({\n\t\t\ttrials: args.trials,\n\t\t\tsignal: this._researchLaneAbort.signal,\n\t\t\tcapacityProbe:\n\t\t\t\tresolved.provider === \"ollama\" && resolved.contextWindow > 0\n\t\t\t\t\t? { registeredContextWindow: resolved.contextWindow }\n\t\t\t\t\t: undefined,\n\t\t\tcomplete: async ({ systemPrompt, userPrompt, signal }) => {\n\t\t\t\tconst callStarted = Date.now();\n\t\t\t\tconst completion = await this.deps.runIsolatedCompletion({\n\t\t\t\t\tsystemPrompt,\n\t\t\t\t\tmessages: [{ role: \"user\", content: [{ type: \"text\", text: userPrompt }], timestamp: Date.now() }],\n\t\t\t\t\tmodel: resolved,\n\t\t\t\t\tthinkingLevel: \"off\",\n\t\t\t\t\tmaxTokens: capability.laneMaxOutputTokens,\n\t\t\t\t\tsignal,\n\t\t\t\t\tcacheRetention: \"short\",\n\t\t\t\t});\n\t\t\t\tconst callMs = Date.now() - callStarted;\n\t\t\t\tspent.input += completion.usage.input;\n\t\t\t\tspent.output += completion.usage.output;\n\t\t\t\tspent.cacheRead += completion.usage.cacheRead;\n\t\t\t\tspent.cacheWrite += completion.usage.cacheWrite;\n\t\t\t\tspent.totalTokens += completion.usage.totalTokens;\n\t\t\t\tspent.cost.input += completion.usage.cost.input;\n\t\t\t\tspent.cost.output += completion.usage.cost.output;\n\t\t\t\tspent.cost.cacheRead += completion.usage.cost.cacheRead;\n\t\t\t\tspent.cost.cacheWrite += completion.usage.cost.cacheWrite;\n\t\t\t\tspent.cost.total += completion.usage.cost.total;\n\t\t\t\treturn {\n\t\t\t\t\ttext: completion.text,\n\t\t\t\t\tcostUsd: completion.usage.cost.total,\n\t\t\t\t\tstopReason: String(completion.stopReason),\n\t\t\t\t\t// Wall-clock fallback for tok/s: providers don't expose pure eval time, so the\n\t\t\t\t\t// measured call time stands in — slightly conservative (includes network/queue).\n\t\t\t\t\toutputTokens: completion.usage.output,\n\t\t\t\t\tevalMs: callMs,\n\t\t\t\t};\n\t\t\t},\n\t\t});\n\t\tif (!this.deps.isDisposed() && (spent.cost.total > 0 || spent.totalTokens > 0)) {\n\t\t\tthis.deps.addSpawnedUsage(spent, { label: \"model-fitness\" });\n\t\t}\n\t\tconst modelRef = `${resolved.provider}/${resolved.id}`;\n\t\t// Fitness is a property of a model ON a host — persist the report host-keyed so role\n\t\t// assignments stay per-machine (a model can await better hardware without being forgotten).\n\t\t// Best-effort: a disk problem must not fail the probe itself.\n\t\ttry {\n\t\t\tif (!this.deps.isDisposed()) {\n\t\t\t\tFitnessStore.forAgentDir(this.deps.getAgentDir()).save(modelRef, report);\n\t\t\t}\n\t\t} catch {\n\t\t\t// best-effort persistence\n\t\t}\n\t\treturn { started: true, model: modelRef, report };\n\t}\n\n\t/** Fitness reports persisted for THIS host (measured evidence for architect/profile decisions). */\n\tgetStoredFitnessReports(): StoredFitnessReport[] {\n\t\ttry {\n\t\t\treturn FitnessStore.forAgentDir(this.deps.getAgentDir()).getForHost();\n\t\t} catch {\n\t\t\treturn [];\n\t\t}\n\t}\n}\n"]}
+{"version":3,"file":"background-lane-controller.d.ts","sourceRoot":"","sources":["../../src/core/background-lane-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EACX,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,0BAA0B,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE/G,OAAO,EAAE,KAAK,UAAU,EAAe,MAAM,4BAA4B,CAAC;AAI1E,OAAO,EAAkC,KAAK,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAG7G,OAAO,KAAK,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACzG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAEN,KAAK,sBAAsB,EAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEnF,OAAO,EAAE,KAAK,kBAAkB,EAAwB,MAAM,6BAA6B,CAAC;AAE5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,yBAAyB,CAAC,EAAE,MAAM,GAAG,MAAM,CAElG;AAED,MAAM,WAAW,4BAA4B;IAC5C,6EAA6E;IAC7E,UAAU,IAAI,OAAO,CAAC;IACtB,oGAAoG;IACpG,cAAc,IAAI,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,YAAY,IAAI,MAAM,CAAC;IACvB,mGAAmG;IACnG,MAAM,IAAI,MAAM,CAAC;IACjB,mEAAmE;IACnE,WAAW,IAAI,MAAM,CAAC;IACtB,+EAA+E;IAC/E,iBAAiB,IAAI,cAAc,CAAC;IACpC,uGAAuG;IACvG,kBAAkB,IAAI,eAAe,CAAC;IACtC,wEAAwE;IACxE,gBAAgB,IAAI,aAAa,CAAC;IAClC,4DAA4D;IAC5D,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IAC7C,qGAAmG;IACnG,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACnC,+FAA+F;IAC/F,oBAAoB,IAAI,OAAO,CAAC;IAChC,oFAAkF;IAClF,qBAAqB,IAAI,kBAAkB,GAAG,SAAS,CAAC;IACxD,qGAAqG;IACrG,yBAAyB,IAAI,sBAAsB,CAAC;IACpD,mEAAmE;IACnE,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,yEAAuE;IACvE,qBAAqB,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC3D,mFAAmF;IACnF,oBAAoB,IAAI,SAAS,GAAG,SAAS,CAAC;IAC9C,uEAAuE;IACvE,sBAAsB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,mBAAmB,CAAC;IACnF,kEAAkE;IAClE,yBAAyB,IAAI,cAAc,GAAG,SAAS,CAAC;IACxD,oEAAoE;IACpE,0BAA0B,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;IAC3D,wEAAwE;IACxE,wBAAwB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IAChF,qFAAqF;IACrF,eAAe,CACd,KAAK,EAAE,KAAK,EACZ,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,MAAM,GAAG,SAAS,CAAC;IACtB,iGAAiG;IACjG,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC1F,mGAAmG;IACnG,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC5F,kGAAkG;IAClG,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;CACxD;AAED,qBAAa,wBAAwB;IACpC,+FAA+F;IAC/F,OAAO,CAAC,sBAAsB,CAA4C;IAC1E,mGAAmG;IACnG,OAAO,CAAC,qBAAqB,CAAS;IACtC,iGAAiG;IACjG,OAAO,CAAC,kBAAkB,CAA4C;IACtE,iFAAiF;IACjF,OAAO,CAAC,sBAAsB,CAAS;IACvC,qFAAqF;IACrF,OAAO,CAAC,2BAA2B,CAAqB;IACxD,yFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyB;IAC5D,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAyB;IAChE,kGAAkG;IAClG,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAqB;IAElE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IAEpD,YAAY,IAAI,EAAE,4BAA4B,EAE7C;IAED,wEAAwE;IACxE,cAAc,IAAI,UAAU,EAAE,CAE7B;IAED,iGAA+F;IAC/F,kBAAkB,IAAI,MAAM,CAE3B;IAED,qFAAqF;IACrF,6BAA6B,IAAI,MAAM,GAAG,SAAS,CAElD;IAED,yFAAyF;IACzF,kBAAkB,IAAI,IAAI,CAGzB;IAED,0BAA0B,IAAI,IAAI,CAKjC;IAED,gCAAgC,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAyB9D;YAEa,6BAA6B;IAgC3C,sBAAsB,IAAI,IAAI,CAK7B;IAED;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IA2BhC;;;;OAIG;IACH,4BAA4B,IAAI,IAAI,CA0CnC;YAEa,yBAAyB;IAevC,oGAAoG;IACpG,OAAO,CAAC,sBAAsB;IAO9B;;;;;OAKG;IACH,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAS9E;IAED;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAkC5B,OAAO,CAAC,0BAA0B;IAWlC,8EAA4E;IAC5E,OAAO,CAAC,0BAA0B;IAiBlC;;;;;OAKG;IACG,mBAAmB,CAAC,OAAO,CAAC,EAAE;QACnC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA2JlC;IAED;;;;;OAKG;IACG,uBAAuB,CAAC,OAAO,EAAE;QACtC,YAAY,EAAE,MAAM,CAAC;QACrB,+FAA+F;QAC/F,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA0PtC;IAED;;;;;OAKG;IACG,eAAe,CAAC,IAAI,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAqEjH;IAED,mGAAmG;IACnG,uBAAuB,IAAI,mBAAmB,EAAE,CAM/C;CACD","sourcesContent":["/**\n * Background-lane controller: goal auto-continue, the research lane, scout-worker delegation, and\n * the model-fitness probe.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Owns the lane timers, the\n * single-flight guards, the last research-lane skip reason, the live {@link LaneTracker}, and the\n * session-lifetime abort controllers for in-flight research/worker passes. Everything else it needs\n * — the session manager, settings, model registry, live model, capability envelope, the goal\n * continuation LOOP, the isolated-completion primitive, spawned-usage accounting, and the telemetry\n * sink — is reached through narrow deps accessors rather than the whole AgentSession.\n *\n * Drive-loop boundary (deliberate): the idle triggers ({@link scheduleGoalAutoContinueFromIdle},\n * {@link scheduleResearchLaneFromIdle}) are invoked from the session's prompt tail as one-line\n * delegations; goal auto-continue itself only ever asks the session to `continueGoalLoop`, so this\n * controller never touches `prompt()`, the last-assistant-message, retry, or streaming state.\n */\n\nimport path from \"node:path\";\nimport type { SessionManager } from \"@caupulican/pi-agent-core/node\";\nimport type { Api, Model, Usage } from \"@caupulican/pi-ai\";\nimport type {\n\tAgentSessionEvent,\n\tGoalContinuationLoopOptions,\n\tGoalContinuationLoopResult,\n\tIsolatedCompletionOptions,\n\tIsolatedCompletionResult,\n\tPromptOptions,\n\tResearchLaneRunOutcome,\n\tWorkerDelegationRunOutcome,\n} from \"./agent-session.ts\";\nimport type { CapabilityEnvelope, EvidenceBundle, WorkerRequest, WorkerResult } from \"./autonomy/contracts.ts\";\nimport { createLaneToolSurface, type LaneToolSurface } from \"./autonomy/lane-tool-surface.ts\";\nimport { type LaneRecord, LaneTracker } from \"./autonomy/lane-tracker.ts\";\nimport { safeRealpathSync } from \"./autonomy/path-scope.ts\";\nimport { appendLaneRecordSnapshot, getLaneRecordSnapshots } from \"./autonomy/session-lane-record.ts\";\nimport { composeSubagentSystemPrompt } from \"./autonomy/subagent-prompt.ts\";\nimport { AUTONOMY_TELEMETRY_EVENT_TYPES, type AutonomyTelemetryEvent } from \"./autonomy/telemetry-events.ts\";\nimport { applyWorkerActions, type WorkerAction } from \"./delegation/worker-actions.ts\";\nimport { runWorker } from \"./delegation/worker-runner.ts\";\nimport type { GoalRuntimeSnapshot, GoalRuntimeSnapshotSettings } from \"./goals/goal-runtime-snapshot.ts\";\nimport type { GoalState } from \"./goals/goal-state.ts\";\nimport {\n\tderiveModelCapabilityProfile,\n\ttype ModelCapabilityProfile,\n\tscaleContinuationBudgetsForCapability,\n} from \"./model-capability.ts\";\nimport type { ModelRegistry } from \"./model-registry.ts\";\nimport { resolveCliModel } from \"./model-resolver.ts\";\nimport { FitnessStore, type StoredFitnessReport } from \"./models/fitness-store.ts\";\nimport type { NormalizedProfile } from \"./profile-registry.ts\";\nimport { type ModelFitnessReport, runModelFitnessProbe } from \"./research/model-fitness.ts\";\nimport { runResearch } from \"./research/research-runner.ts\";\nimport type { collectWorkspaceSources } from \"./research/workspace-collector.ts\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\n\nexport function clampLaneMaxUsd(settingsMaxUsd: number, foregroundMaxEstimatedUsd?: number): number {\n\treturn Math.min(settingsMaxUsd, foregroundMaxEstimatedUsd ?? Number.POSITIVE_INFINITY);\n}\n\nexport interface BackgroundLaneControllerDeps {\n\t/** A disposed session must never schedule/persist a lane or continuation. */\n\tisDisposed(): boolean;\n\t/** Child sessions never run the idle research lane (only the top-level session drives autonomy). */\n\tisChildSession(): boolean;\n\t/** This session's id, for lane envelope ids and spawned-usage report ids. */\n\tgetSessionId(): string;\n\t/** The workspace root a lane runs relative to (worker path scope + research source collection). */\n\tgetCwd(): string;\n\t/** Root dir the host-keyed {@link FitnessStore} persists under. */\n\tgetAgentDir(): string;\n\t/** Session log: lane records read/append here and feed lane-history dedupe. */\n\tgetSessionManager(): SessionManager;\n\t/** Autonomy / research-lane / worker-delegation / model-capability settings + the profile registry. */\n\tgetSettingsManager(): SettingsManager;\n\t/** Resolves a configured lane model pattern against configured auth. */\n\tgetModelRegistry(): ModelRegistry;\n\t/** Session-scoped provider/model quota exhaustion guard. */\n\tisModelExhausted(model: Model<Api>): boolean;\n\t/** The session's current model — lanes inherit it unless a lane model is explicitly configured. */\n\tgetModel(): Model<Api> | undefined;\n\t/** Tool/profile gate: delegation is unavailable when the active surface removes `delegate`. */\n\tisDelegateToolActive(): boolean;\n\t/** Foreground cost ceiling — a lane budget is clamped to it, never exceeds it. */\n\tgetCapabilityEnvelope(): CapabilityEnvelope | undefined;\n\t/** Capability profile of the SESSION model (gates background lanes, scales continuation budgets). */\n\tgetModelCapabilityProfile(): ModelCapabilityProfile;\n\t/** Emits a session event (only `warning` from this controller). */\n\temit(event: AgentSessionEvent): void;\n\t/** G3/G8 telemetry sink (codes/ids only — never lane product text). */\n\temitAutonomyTelemetry(event: AutonomyTelemetryEvent): void;\n\t/** Durable goal state, if a goal is active (the research lane's demand source). */\n\tgetGoalStateSnapshot(): GoalState | undefined;\n\t/** Continuation gate + goal state for the idle autosteer scheduler. */\n\tgetGoalRuntimeSnapshot(settings: GoalRuntimeSnapshotSettings): GoalRuntimeSnapshot;\n\t/** Latest persisted evidence bundle, for research-lane dedupe. */\n\tgetEvidenceBundleSnapshot(): EvidenceBundle | undefined;\n\t/** Persist a research lane's evidence bundle to the session log. */\n\tsaveEvidenceBundleSnapshot(bundle: EvidenceBundle): string;\n\t/** Persist a worker delegation's result snapshot to the session log. */\n\tsaveWorkerResultSnapshot(result: WorkerResult, request?: WorkerRequest): string;\n\t/** Roll a lane's spawned usage into session accounting (idempotent per reportId). */\n\taddSpawnedUsage(\n\t\tusage: Usage,\n\t\topts?: { label?: string; sourceSessionId?: string; reportId?: string },\n\t): string | undefined;\n\t/** Bounded LLM call fully isolated from the main session; lanes may supply a child tool loop. */\n\trunIsolatedCompletion(opts: IsolatedCompletionOptions): Promise<IsolatedCompletionResult>;\n\t/** Drive-loop boundary: the session's bounded goal-continuation loop (owns `prompt()`, not us). */\n\tcontinueGoalLoop(options: GoalContinuationLoopOptions): Promise<GoalContinuationLoopResult>;\n\t/** Best-effort workspace evidence collection (silent-on-failure; [] preserves prior behavior). */\n\tcollectWorkspaceSources: typeof collectWorkspaceSources;\n}\n\nexport class BackgroundLaneController {\n\t/** Pending idle timer that starts bounded goal continuation after the session becomes idle. */\n\tprivate _goalAutoContinueTimer: ReturnType<typeof setTimeout> | undefined;\n\t/** Guards bounded idle autosteer so continuation prompts do not recursively trigger themselves. */\n\tprivate _isGoalAutoContinuing = false;\n\t/** Pending idle timer that starts an autonomous research pass after the session becomes idle. */\n\tprivate _researchLaneTimer: ReturnType<typeof setTimeout> | undefined;\n\t/** Single-flight guard: at most one research pass runs at a time per session. */\n\tprivate _isResearchLaneRunning = false;\n\t/** Why the last idle research-lane evaluation skipped, for /autonomy diagnostics. */\n\tprivate _lastResearchLaneSkipReason: string | undefined;\n\t/** Live lane registry — the real source for AutonomyStatusSnapshot.activeLaneCount. */\n\tprivate readonly _laneTracker = new LaneTracker();\n\t/** Session-lifetime abort for in-flight research passes (same pattern as _reflectionAbort). */\n\tprivate readonly _researchLaneAbort = new AbortController();\n\t/** Session-lifetime abort for in-flight delegated workers. */\n\tprivate readonly _workerDelegationAbort = new AbortController();\n\t/** Session-local de-duplication for fail-closed profile grants that cannot bind to lane tools. */\n\tprivate readonly _warnedUnboundLaneToolGrants = new Set<string>();\n\n\tprivate readonly deps: BackgroundLaneControllerDeps;\n\n\tconstructor(deps: BackgroundLaneControllerDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\t/** Live lane records tracked by this process (running and terminal). */\n\tgetLaneRecords(): LaneRecord[] {\n\t\treturn this._laneTracker.getRecords();\n\t}\n\n\t/** Live count of active lanes — the real source for AutonomyStatusSnapshot.activeLaneCount. */\n\tgetActiveLaneCount(): number {\n\t\treturn this._laneTracker.getActiveCount();\n\t}\n\n\t/** Why the last idle research-lane evaluation skipped, for /autonomy diagnostics. */\n\tgetLastResearchLaneSkipReason(): string | undefined {\n\t\treturn this._lastResearchLaneSkipReason;\n\t}\n\n\t/** Abort any in-flight research pass or delegated worker (called on session dispose). */\n\tabortInFlightLanes(): void {\n\t\tthis._researchLaneAbort.abort();\n\t\tthis._workerDelegationAbort.abort();\n\t}\n\n\tclearGoalAutoContinueTimer(): void {\n\t\tif (this._goalAutoContinueTimer !== undefined) {\n\t\t\tclearTimeout(this._goalAutoContinueTimer);\n\t\t\tthis._goalAutoContinueTimer = undefined;\n\t\t}\n\t}\n\n\tscheduleGoalAutoContinueFromIdle(options?: PromptOptions): void {\n\t\tif (options?.autoContinueGoal === false || this._isGoalAutoContinuing || this.deps.isDisposed()) return;\n\n\t\t// Small-window models cannot afford multi-thousand-token continuation prompts per idle turn.\n\t\tif (!this.deps.getModelCapabilityProfile().backgroundLanesEnabled) return;\n\n\t\tconst { maxStallTurns, goalAutoContinue, goalAutoContinueDelayMs } = this.deps\n\t\t\t.getSettingsManager()\n\t\t\t.getAutonomySettings();\n\t\tif (!goalAutoContinue) return;\n\n\t\tconst snapshot = this.deps.getGoalRuntimeSnapshot({ maxStallTurns });\n\t\tif (snapshot.continuation.action !== \"continue\") return;\n\n\t\tthis.clearGoalAutoContinueTimer();\n\t\tthis._goalAutoContinueTimer = setTimeout(() => {\n\t\t\tthis._goalAutoContinueTimer = undefined;\n\t\t\tvoid this._runScheduledGoalAutoContinue();\n\t\t}, goalAutoContinueDelayMs);\n\n\t\tconst timer = this._goalAutoContinueTimer;\n\t\tif (typeof timer === \"object\" && timer && \"unref\" in timer) {\n\t\t\tconst { unref } = timer as { unref?: () => void };\n\t\t\tunref?.call(timer);\n\t\t}\n\t}\n\n\tprivate async _runScheduledGoalAutoContinue(): Promise<void> {\n\t\tif (this._isGoalAutoContinuing || this.deps.isDisposed()) return;\n\n\t\tconst { maxStallTurns, goalContinueTurns, goalContinueMaxWallClockMinutes, goalAutoContinue } = this.deps\n\t\t\t.getSettingsManager()\n\t\t\t.getAutonomySettings();\n\t\tif (!goalAutoContinue) return;\n\n\t\tconst snapshot = this.deps.getGoalRuntimeSnapshot({ maxStallTurns });\n\t\tif (snapshot.continuation.action !== \"continue\") return;\n\n\t\t// Lean-window models (16-32k) keep autosteer but at a reduced budget; full passes through.\n\t\tconst scaled = scaleContinuationBudgetsForCapability(this.deps.getModelCapabilityProfile(), {\n\t\t\tmaxTurns: goalContinueTurns,\n\t\t\tmaxWallClockMinutes: goalContinueMaxWallClockMinutes,\n\t\t});\n\n\t\tthis._isGoalAutoContinuing = true;\n\t\ttry {\n\t\t\tawait this.deps.continueGoalLoop({\n\t\t\t\tmaxTurns: scaled.maxTurns,\n\t\t\t\tmaxStallTurns,\n\t\t\t\tmaxWallClockMinutes: scaled.maxWallClockMinutes,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthis.deps.emit({ type: \"warning\", message: `Goal auto-continuation failed: ${message}` });\n\t\t} finally {\n\t\t\tthis._isGoalAutoContinuing = false;\n\t\t}\n\t}\n\n\tclearResearchLaneTimer(): void {\n\t\tif (this._researchLaneTimer !== undefined) {\n\t\t\tclearTimeout(this._researchLaneTimer);\n\t\t\tthis._researchLaneTimer = undefined;\n\t\t}\n\t}\n\n\t/**\n\t * Derive the research demand from durable goal state: an active goal with open requirements,\n\t * deduplicated against the latest persisted bundle so the same requirement set is never\n\t * researched twice (the query is deterministic, so dedupe survives session reload).\n\t */\n\tprivate _buildResearchLaneDemand(): { query: string; context: string; goalId: string } | undefined {\n\t\tconst goal = this.deps.getGoalStateSnapshot();\n\t\tif (!goal || goal.status !== \"active\") {\n\t\t\tthis._lastResearchLaneSkipReason = \"no_active_goal\";\n\t\t\treturn undefined;\n\t\t}\n\t\tconst open = goal.requirements.filter((requirement) => requirement.status === \"open\");\n\t\tif (open.length === 0) {\n\t\t\tthis._lastResearchLaneSkipReason = \"no_open_requirements\";\n\t\t\treturn undefined;\n\t\t}\n\t\tconst query = `goal:${goal.goalId} requirements:${open\n\t\t\t.map((requirement) => requirement.id)\n\t\t\t.sort()\n\t\t\t.join(\",\")}`;\n\t\tif (this.deps.getEvidenceBundleSnapshot()?.query === query) {\n\t\t\tthis._lastResearchLaneSkipReason = \"recent_evidence_sufficient\";\n\t\t\treturn undefined;\n\t\t}\n\t\tconst context = [\n\t\t\t`Goal: ${goal.userGoal}`,\n\t\t\t\"Open requirements:\",\n\t\t\t...open.slice(0, 20).map((requirement) => `- ${requirement.text}`),\n\t\t].join(\"\\n\");\n\t\treturn { query, context, goalId: goal.goalId };\n\t}\n\n\t/**\n\t * Idle trigger for the autonomous research lane (mirrors {@link scheduleGoalAutoContinueFromIdle}).\n\t * All skips are recorded in `_lastResearchLaneSkipReason` and surfaced via diagnostics — the lane\n\t * informs, it never prompts or blocks the foreground.\n\t */\n\tscheduleResearchLaneFromIdle(): void {\n\t\tif (this._isResearchLaneRunning || this.deps.isDisposed() || this.deps.isChildSession()) return;\n\n\t\tconst research = this.deps.getSettingsManager().getResearchLaneSettings();\n\t\tif (!research.enabled) {\n\t\t\tthis._lastResearchLaneSkipReason = \"research_lane_disabled\";\n\t\t\treturn;\n\t\t}\n\t\tconst { mode } = this.deps.getSettingsManager().getAutonomySettings();\n\t\tif (mode === \"off\") {\n\t\t\tthis._lastResearchLaneSkipReason = \"autonomy_mode_off\";\n\t\t\treturn;\n\t\t}\n\t\tconst priorRuns = getLaneRecordSnapshots(this.deps.getSessionManager().getEntries()).filter(\n\t\t\t(record) => record.type === \"research\",\n\t\t).length;\n\t\tif (priorRuns >= research.maxRunsPerSession) {\n\t\t\tthis._lastResearchLaneSkipReason = \"max_runs_reached\";\n\t\t\treturn;\n\t\t}\n\t\tif (!this._buildResearchLaneDemand()) return;\n\t\tconst shipment = this._resolveLaneShipment(research, \"no_research_model\");\n\t\tif (!shipment.ok) {\n\t\t\tthis._lastResearchLaneSkipReason = shipment.skipReason;\n\t\t\treturn;\n\t\t}\n\t\tif (!this._laneCapabilityProfile(shipment.model).backgroundLanesEnabled) {\n\t\t\tthis._lastResearchLaneSkipReason = \"model_research_unsupported\";\n\t\t\treturn;\n\t\t}\n\n\t\tthis.clearResearchLaneTimer();\n\t\tthis._researchLaneTimer = setTimeout(() => {\n\t\t\tthis._researchLaneTimer = undefined;\n\t\t\tvoid this._runScheduledResearchLane();\n\t\t}, research.idleDelayMs);\n\n\t\tconst timer = this._researchLaneTimer;\n\t\tif (typeof timer === \"object\" && timer && \"unref\" in timer) {\n\t\t\tconst { unref } = timer as { unref?: () => void };\n\t\t\tunref?.call(timer);\n\t\t}\n\t}\n\n\tprivate async _runScheduledResearchLane(): Promise<void> {\n\t\tif (this._isResearchLaneRunning || this.deps.isDisposed()) return;\n\n\t\tconst research = this.deps.getSettingsManager().getResearchLaneSettings();\n\t\tconst { mode } = this.deps.getSettingsManager().getAutonomySettings();\n\t\tif (!research.enabled || mode === \"off\") return;\n\n\t\ttry {\n\t\t\tawait this.runResearchLaneOnce();\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthis.deps.emit({ type: \"warning\", message: `Research lane failed: ${message}` });\n\t\t}\n\t}\n\n\t/** Capability profile for a specific lane model (lane budgets scale to the lane model's window). */\n\tprivate _laneCapabilityProfile(model: Model<Api>): ModelCapabilityProfile {\n\t\treturn deriveModelCapabilityProfile({\n\t\t\tcontextWindow: model.contextWindow,\n\t\t\tmode: this.deps.getSettingsManager().getModelCapabilitySettings().mode,\n\t\t});\n\t}\n\n\t/**\n\t * Resolve the model for a background lane. Lanes are shipped BY this session, so they inherit\n\t * the session's own model unless a lane-specific model is explicitly configured — a single-model\n\t * setup (e.g. one local open model) runs its lanes on that same model. An explicitly configured\n\t * pattern that cannot resolve/authenticate is a visible skip, not a silent fallback.\n\t */\n\tresolveLaneModel(configuredPattern: string | undefined): Model<Api> | undefined {\n\t\tif (configuredPattern) {\n\t\t\tconst resolved = resolveCliModel({ cliModel: configuredPattern, modelRegistry: this.deps.getModelRegistry() });\n\t\t\tif (resolved.model && this.deps.getModelRegistry().hasConfiguredAuth(resolved.model)) {\n\t\t\t\treturn resolved.model;\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t\treturn this.deps.getModel() ?? undefined;\n\t}\n\n\t/**\n\t * Resolve what a lane ships with. Precedence: explicit lane model setting, then the lane\n\t * profile's model (a shipped profile with a model MUST be obeyed — unresolvable is a visible\n\t * skip, never a fallback), then generic inheritance of the session model.\n\t */\n\tprivate _resolveLaneShipment(\n\t\tlaneSettings: { model?: string; profile?: string },\n\t\tmissingModelReason: string,\n\t): { ok: true; model: Model<Api>; laneProfile?: NormalizedProfile } | { ok: false; skipReason: string } {\n\t\tlet laneProfile: NormalizedProfile | undefined;\n\t\tif (laneSettings.profile) {\n\t\t\tconst profileRef = laneSettings.profile.trim();\n\t\t\tconst registry = this.deps.getSettingsManager().getProfileRegistry();\n\t\t\tlaneProfile =\n\t\t\t\tprofileRef.startsWith(\"./\") || profileRef.startsWith(\"../\")\n\t\t\t\t\t? registry.resolveProfileRef(profileRef, this.deps.getCwd())\n\t\t\t\t\t: registry.getProfile(profileRef);\n\t\t\tif (!laneProfile) {\n\t\t\t\treturn { ok: false, skipReason: \"lane_profile_not_found\" };\n\t\t\t}\n\t\t}\n\n\t\tlet model: Model<Api> | undefined;\n\t\tif (laneSettings.model) {\n\t\t\tmodel = this.resolveLaneModel(laneSettings.model);\n\t\t\tif (!model) return { ok: false, skipReason: missingModelReason };\n\t\t} else if (laneProfile?.model) {\n\t\t\tmodel = this.resolveLaneModel(laneProfile.model);\n\t\t\tif (!model) return { ok: false, skipReason: \"no_lane_profile_model\" };\n\t\t} else {\n\t\t\tmodel = this.deps.getModel() ?? undefined;\n\t\t\tif (!model) return { ok: false, skipReason: missingModelReason };\n\t\t}\n\t\tif (this.deps.isModelExhausted(model)) {\n\t\t\treturn { ok: false, skipReason: `${model.provider}/${model.id} model exhausted: quota` };\n\t\t}\n\t\treturn { ok: true, model, laneProfile };\n\t}\n\n\tprivate _warnUnboundLaneToolGrants(laneProfile: NormalizedProfile | undefined, surface: LaneToolSurface): void {\n\t\tif (!laneProfile || surface.unboundAllowPatterns.length === 0) return;\n\t\tconst warningKey = `${laneProfile.name}\\0${[...surface.unboundAllowPatterns].sort().join(\"\\0\")}`;\n\t\tif (this._warnedUnboundLaneToolGrants.has(warningKey)) return;\n\t\tthis._warnedUnboundLaneToolGrants.add(warningKey);\n\t\tthis.deps.emit({\n\t\t\ttype: \"warning\",\n\t\t\tmessage: `Lane profile '${laneProfile.name}' grants unavailable isolated-lane tools: ${surface.unboundAllowPatterns.join(\", \")}. Only classified lane tools can execute.`,\n\t\t});\n\t}\n\n\t/** Stripped research envelope — never the foreground/architect envelope. */\n\tprivate _buildResearchLaneEnvelope(\n\t\tmaxUsd: number,\n\t\tlaneProfile: NormalizedProfile | undefined,\n\t\tsurface: LaneToolSurface,\n\t): CapabilityEnvelope {\n\t\treturn {\n\t\t\tid: `research-${this.deps.getSessionId()}-${Date.now()}`,\n\t\t\tprofileId: laneProfile?.name,\n\t\t\tcapabilities: [\"research\", \"read_files\", \"memory_read\"],\n\t\t\tallowedTools: [...surface.allowedTools],\n\t\t\tdeniedTools: [...surface.deniedTools],\n\t\t\tallowedPaths: [this.deps.getCwd()],\n\t\t\tmaxEstimatedUsd: clampLaneMaxUsd(maxUsd, this.deps.getCapabilityEnvelope()?.maxEstimatedUsd),\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\t}\n\n\t/**\n\t * Run one bounded, read-only research pass and persist its results: evidence bundle snapshot,\n\t * terminal lane record, and spawned-usage cost report (single-hop invariant, idempotent on the\n\t * lane's reportId). Explicit calls (e.g. `/autonomy research`) express user intent and bypass the\n\t * enabled/mode/dedupe gates the idle scheduler enforces; budget and capability gates always apply.\n\t */\n\tasync runResearchLaneOnce(request?: {\n\t\tquery?: string;\n\t\tcontext?: string;\n\t\tgoalId?: string;\n\t}): Promise<ResearchLaneRunOutcome> {\n\t\tif (this._isResearchLaneRunning) {\n\t\t\treturn { started: false, skipReason: \"research_lane_already_running\" };\n\t\t}\n\t\tif (this.deps.isDisposed()) {\n\t\t\treturn { started: false, skipReason: \"session_disposed\" };\n\t\t}\n\n\t\tconst settings = this.deps.getSettingsManager().getResearchLaneSettings();\n\t\tconst demand = request?.query\n\t\t\t? { query: request.query, context: request.context ?? \"\", goalId: request.goalId }\n\t\t\t: this._buildResearchLaneDemand();\n\t\tif (!demand) {\n\t\t\treturn { started: false, skipReason: this._lastResearchLaneSkipReason ?? \"no_research_demand\" };\n\t\t}\n\n\t\tconst shipment = this._resolveLaneShipment(settings, \"no_research_model\");\n\t\tif (!shipment.ok) {\n\t\t\tthis._lastResearchLaneSkipReason = shipment.skipReason;\n\t\t\treturn { started: false, skipReason: shipment.skipReason };\n\t\t}\n\t\tconst { model, laneProfile } = shipment;\n\t\tconst laneCapability = this._laneCapabilityProfile(model);\n\t\tif (!laneCapability.backgroundLanesEnabled) {\n\t\t\tthis._lastResearchLaneSkipReason = \"model_research_unsupported\";\n\t\t\treturn { started: false, skipReason: \"model_research_unsupported\" };\n\t\t}\n\n\t\tthis._isResearchLaneRunning = true;\n\t\tthis._laneTracker.ensureCounterAtLeast(\n\t\t\tgetLaneRecordSnapshots(this.deps.getSessionManager().getEntries()).length + 1,\n\t\t);\n\t\tconst startedRecord = this._laneTracker.start({ type: \"research\", goalId: demand.goalId });\n\t\ttry {\n\t\t\tlet spentUsage: Usage | undefined;\n\t\t\t// Best-effort, pointer-first workspace evidence. Derives search terms from the goal/requirement\n\t\t\t// text (not the identity-key query) and is bounded + silent-on-failure: [] == today's behavior.\n\t\t\tconst workspaceSources = await this.deps.collectWorkspaceSources({\n\t\t\t\tquery: `${demand.context}\\n${demand.query}`,\n\t\t\t\tcwd: this.deps.getCwd(),\n\t\t\t\tmaxSources: settings.maxSources,\n\t\t\t});\n\t\t\tconst maxUsd = clampLaneMaxUsd(settings.maxUsd, this.deps.getCapabilityEnvelope()?.maxEstimatedUsd);\n\t\t\tconst toolSurface = createLaneToolSurface({ cwd: this.deps.getCwd(), profile: laneProfile });\n\t\t\tthis._warnUnboundLaneToolGrants(laneProfile, toolSurface);\n\t\t\tconst result = await runResearch({\n\t\t\t\tquery: demand.query,\n\t\t\t\tcontext: demand.context,\n\t\t\t\tsources: workspaceSources,\n\t\t\t\tenvelope: this._buildResearchLaneEnvelope(maxUsd, laneProfile, toolSurface),\n\t\t\t\tmaxUsd,\n\t\t\t\tmaxSources: settings.maxSources,\n\t\t\t\tmaxFindings: settings.maxFindings,\n\t\t\t\tmaxWallClockMs: settings.maxWallClockMs,\n\t\t\t\tsignal: this._researchLaneAbort.signal,\n\t\t\t\tcomplete: async ({ systemPrompt, userPrompt, signal }) => {\n\t\t\t\t\tconst completion = await this.deps.runIsolatedCompletion({\n\t\t\t\t\t\t// Level-0 core always survives; profile soul and role prompt are the replaceable\n\t\t\t\t\t\t// layers; a settings-provided prompt replaces everything above the core.\n\t\t\t\t\t\tsystemPrompt: composeSubagentSystemPrompt({\n\t\t\t\t\t\t\tsoul: laneProfile?.soul,\n\t\t\t\t\t\t\trolePrompt: systemPrompt,\n\t\t\t\t\t\t\toverride: settings.systemPrompt,\n\t\t\t\t\t\t}),\n\t\t\t\t\t\tmessages: [{ role: \"user\", content: [{ type: \"text\", text: userPrompt }], timestamp: Date.now() }],\n\t\t\t\t\t\tmodel,\n\t\t\t\t\t\tthinkingLevel: laneProfile?.thinking ?? \"off\",\n\t\t\t\t\t\tmaxTokens: laneCapability.laneMaxOutputTokens,\n\t\t\t\t\t\ttools: toolSurface.tools,\n\t\t\t\t\t\tmaxTurns: 6,\n\t\t\t\t\t\tbeforeToolCall: toolSurface.beforeToolCall,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t// Core/soul/role are all static per configuration — the provider can cache the prefix.\n\t\t\t\t\t\tcacheRetention: \"short\",\n\t\t\t\t\t});\n\t\t\t\t\tspentUsage = completion.usage;\n\t\t\t\t\treturn {\n\t\t\t\t\t\ttext: completion.text,\n\t\t\t\t\t\tcostUsd: completion.usage.cost.total,\n\t\t\t\t\t\tstopReason: String(completion.stopReason),\n\t\t\t\t\t};\n\t\t\t\t},\n\t\t\t});\n\n\t\t\t// Bug #21 pattern: if the session was disposed while the completion was in flight, do NOT\n\t\t\t// persist evidence/records/usage against the dead session.\n\t\t\tif (this.deps.isDisposed()) {\n\t\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\t\tstatus: \"canceled\",\n\t\t\t\t\treasonCode: \"session_disposed\",\n\t\t\t\t});\n\t\t\t\treturn { started: true, record, result };\n\t\t\t}\n\n\t\t\tlet evidenceEntryId: string | undefined;\n\t\t\tif (result.bundle) {\n\t\t\t\tevidenceEntryId = this.deps.saveEvidenceBundleSnapshot(result.bundle);\n\t\t\t}\n\t\t\tif (spentUsage && (spentUsage.cost.total > 0 || spentUsage.totalTokens > 0)) {\n\t\t\t\tthis.deps.addSpawnedUsage(spentUsage, {\n\t\t\t\t\tlabel: \"research-lane\",\n\t\t\t\t\treportId: `research:${this.deps.getSessionId()}:${startedRecord.laneId}`,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\tstatus: result.status,\n\t\t\t\treasonCode: result.reasonCode,\n\t\t\t\tcostUsd: result.costUsd,\n\t\t\t\tevidenceEntryId,\n\t\t\t});\n\t\t\tif (record) {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), record);\n\t\t\t\t// G3: a research lane's product is an evidence bundle, so its terminal record maps to\n\t\t\t\t// the evidence_bundle event. Lane outcome only (status/reasonCode/cost) — no findings text.\n\t\t\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.evidenceBundle,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\tpayload: {\n\t\t\t\t\t\tlaneId: record.laneId,\n\t\t\t\t\t\tlaneType: record.type,\n\t\t\t\t\t\tstatus: record.status,\n\t\t\t\t\t\treasonCode: record.reasonCode ?? null,\n\t\t\t\t\t\tcostUsd: record.costUsd ?? null,\n\t\t\t\t\t\thasEvidence: record.evidenceEntryId !== undefined,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn { started: true, record, result };\n\t\t} catch (error) {\n\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\tstatus: \"failed\",\n\t\t\t\treasonCode: \"research_lane_error\",\n\t\t\t});\n\t\t\tif (record && !this.deps.isDisposed()) {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), record);\n\t\t\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.evidenceBundle,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\tpayload: {\n\t\t\t\t\t\tlaneId: record.laneId,\n\t\t\t\t\t\tlaneType: record.type,\n\t\t\t\t\t\tstatus: record.status,\n\t\t\t\t\t\treasonCode: record.reasonCode ?? null,\n\t\t\t\t\t\tcostUsd: record.costUsd ?? null,\n\t\t\t\t\t\thasEvidence: record.evidenceEntryId !== undefined,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthis.deps.emit({ type: \"warning\", message: `Research lane failed: ${message}` });\n\t\t\treturn { started: true, record };\n\t\t} finally {\n\t\t\tthis._isResearchLaneRunning = false;\n\t\t}\n\t}\n\n\t/**\n\t * Run one bounded scout-worker delegation: build a WorkerRequest with a stripped read-only\n\t * envelope, execute it as an isolated completion on a cheap lane, validate the result via\n\t * {@link validateWorkerResult} before acceptance, and persist result + lane record + spawned\n\t * usage (idempotent per-lane reportId). Consumed by the `delegate` tool.\n\t */\n\tasync runWorkerDelegationOnce(request: {\n\t\tinstructions: string;\n\t\t/** Model-provided replacement for the worker role prompt (the level-0 core always remains). */\n\t\tsystemPrompt?: string;\n\t}): Promise<WorkerDelegationRunOutcome> {\n\t\tconst delegationSettings = this.deps.getSettingsManager().getWorkerDelegationSettings();\n\t\tif (this._laneTracker.getActiveCount(\"worker\") >= delegationSettings.maxConcurrent) {\n\t\t\treturn { started: false, skipReason: \"worker_delegation_already_running\" };\n\t\t}\n\t\tif (this.deps.isDisposed()) {\n\t\t\treturn { started: false, skipReason: \"session_disposed\" };\n\t\t}\n\t\tconst instructions = request.instructions.trim();\n\t\tif (instructions.length === 0) {\n\t\t\treturn { started: false, skipReason: \"missing_instructions\" };\n\t\t}\n\n\t\tconst settings = delegationSettings;\n\t\tif (!this.deps.isDelegateToolActive()) {\n\t\t\treturn { started: false, skipReason: \"delegate_tool_inactive\" };\n\t\t}\n\t\tif (!settings.enabled) {\n\t\t\treturn { started: false, skipReason: \"worker_delegation_disabled\" };\n\t\t}\n\n\t\tconst shipment = this._resolveLaneShipment(settings, \"no_worker_model\");\n\t\tif (!shipment.ok) {\n\t\t\treturn { started: false, skipReason: shipment.skipReason };\n\t\t}\n\t\tconst { model, laneProfile } = shipment;\n\t\tconst laneCapability = this._laneCapabilityProfile(model);\n\t\tif (!laneCapability.backgroundLanesEnabled) {\n\t\t\treturn { started: false, skipReason: \"model_delegation_unsupported\" };\n\t\t}\n\n\t\tthis._laneTracker.ensureCounterAtLeast(\n\t\t\tgetLaneRecordSnapshots(this.deps.getSessionManager().getEntries()).length + 1,\n\t\t);\n\t\tconst startedRecord = this._laneTracker.start({ type: \"worker\" });\n\t\tconst maxUsd = Math.min(\n\t\t\tsettings.maxUsd,\n\t\t\tthis.deps.getCapabilityEnvelope()?.maxEstimatedUsd ?? Number.POSITIVE_INFINITY,\n\t\t);\n\t\tconst writeEnabled = settings.writeEnabled && settings.writePaths.length > 0;\n\t\tconst toolSurface = createLaneToolSurface({\n\t\t\tcwd: this.deps.getCwd(),\n\t\t\tprofile: laneProfile,\n\t\t\twriteEnabled,\n\t\t\twritePaths: settings.writePaths,\n\t\t});\n\t\tthis._warnUnboundLaneToolGrants(laneProfile, toolSurface);\n\t\tconst allowedActionOps = new Set<WorkerAction[\"op\"]>(\n\t\t\ttoolSurface.allowedTools.filter((name): name is WorkerAction[\"op\"] => name === \"write\" || name === \"edit\"),\n\t\t);\n\t\tconst writeGranted = writeEnabled && allowedActionOps.size > 0;\n\t\tconst workerRequest: WorkerRequest = {\n\t\t\tid: startedRecord.laneId,\n\t\t\tinstructions,\n\t\t\troute: {\n\t\t\t\ttier: \"cheap\",\n\t\t\t\trisk: writeGranted ? \"scoped-write\" : \"read-only\",\n\t\t\t\tconfidence: 1,\n\t\t\t\treasonCode: \"scout_worker\",\n\t\t\t\treasons: [writeGranted ? \"Path-scoped worker delegation\" : \"Read-only scout delegation\"],\n\t\t\t},\n\t\t\tenvelope: {\n\t\t\t\tid: `worker-${this.deps.getSessionId()}-${startedRecord.laneId}`,\n\t\t\t\tprofileId: laneProfile?.name,\n\t\t\t\t// write_files requires BOTH the opt-in AND an explicit non-empty path scope —\n\t\t\t\t// an unscoped write grant is refused here, not discovered at validation time.\n\t\t\t\tcapabilities: writeGranted ? [\"read_files\", \"write_files\"] : [\"read_files\"],\n\t\t\t\t...(writeGranted ? { allowedPaths: [...settings.writePaths] } : {}),\n\t\t\t\tallowedTools: [...toolSurface.allowedTools],\n\t\t\t\tdeniedTools: [...toolSurface.deniedTools],\n\t\t\t\tmaxEstimatedUsd: maxUsd,\n\t\t\t\tcreatedAt: new Date().toISOString(),\n\t\t\t},\n\t\t\tmaxEstimatedUsd: maxUsd,\n\t\t\tcreatedAt: new Date().toISOString(),\n\t\t};\n\t\t// G8: worker delegation START. Routing/scope codes + budget only — never the instructions text.\n\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.workerRequest,\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tpayload: {\n\t\t\t\tid: workerRequest.id,\n\t\t\t\ttier: workerRequest.route.tier,\n\t\t\t\tcapabilities: [...workerRequest.envelope.capabilities],\n\t\t\t\tmaxEstimatedUsd: workerRequest.maxEstimatedUsd ?? null,\n\t\t\t},\n\t\t});\n\t\tconst usageReportId = `worker:${this.deps.getSessionId()}:${startedRecord.laneId}`;\n\n\t\ttry {\n\t\t\tlet spentUsage: Usage | undefined;\n\t\t\tconst toolChangedFiles = new Set<string>();\n\t\t\tconst toolIssues = new Set<string>();\n\t\t\tconst outcome = await runWorker({\n\t\t\t\trequest: workerRequest,\n\t\t\t\tmaxUsd,\n\t\t\t\tmaxWallClockMs: settings.maxWallClockMs,\n\t\t\t\tusageReportId,\n\t\t\t\tgetChangedFiles: () => [...toolChangedFiles],\n\t\t\t\tsignal: this._workerDelegationAbort.signal,\n\t\t\t\t// Parent validation must use the same relative-path baseline the runner reports in.\n\t\t\t\tcwd: this.deps.getCwd(),\n\t\t\t\t// Write lane (G2): runner-side action application through the envelope path scope.\n\t\t\t\tapplyActions: workerRequest.envelope.capabilities.includes(\"write_files\")\n\t\t\t\t\t? (actions) => {\n\t\t\t\t\t\t\tconst permitted = actions.filter((action) => allowedActionOps.has(action.op));\n\t\t\t\t\t\t\tconst applied = applyWorkerActions({\n\t\t\t\t\t\t\t\tactions: permitted,\n\t\t\t\t\t\t\t\tenvelope: workerRequest.envelope,\n\t\t\t\t\t\t\t\tcwd: this.deps.getCwd(),\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\t...applied,\n\t\t\t\t\t\t\t\trefused: [\n\t\t\t\t\t\t\t\t\t...actions\n\t\t\t\t\t\t\t\t\t\t.filter((action) => !allowedActionOps.has(action.op))\n\t\t\t\t\t\t\t\t\t\t.map((action) => ({\n\t\t\t\t\t\t\t\t\t\t\tpath: action.path,\n\t\t\t\t\t\t\t\t\t\t\treason: `${action.op} is not granted by the lane profile`,\n\t\t\t\t\t\t\t\t\t\t})),\n\t\t\t\t\t\t\t\t\t...applied.refused,\n\t\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\t};\n\t\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t\tcomplete: async ({ systemPrompt, userPrompt, signal }) => {\n\t\t\t\t\tconst completion = await this.deps.runIsolatedCompletion({\n\t\t\t\t\t\t// Level-0 core always survives. A model-provided prompt (delegate tool) is the most\n\t\t\t\t\t\t// specific override, then the settings-level prompt, then profile soul + role prompt.\n\t\t\t\t\t\tsystemPrompt: composeSubagentSystemPrompt({\n\t\t\t\t\t\t\tsoul: laneProfile?.soul,\n\t\t\t\t\t\t\trolePrompt: systemPrompt,\n\t\t\t\t\t\t\toverride: request.systemPrompt ?? settings.systemPrompt,\n\t\t\t\t\t\t}),\n\t\t\t\t\t\tmessages: [{ role: \"user\", content: [{ type: \"text\", text: userPrompt }], timestamp: Date.now() }],\n\t\t\t\t\t\tmodel,\n\t\t\t\t\t\tthinkingLevel: laneProfile?.thinking ?? \"off\",\n\t\t\t\t\t\tmaxTokens: laneCapability.laneMaxOutputTokens,\n\t\t\t\t\t\ttools: toolSurface.tools,\n\t\t\t\t\t\tmaxTurns: 6,\n\t\t\t\t\t\tbeforeToolCall: async (context, toolSignal) => {\n\t\t\t\t\t\t\tconst decision = await toolSurface.beforeToolCall(context, toolSignal);\n\t\t\t\t\t\t\tif (decision?.block) {\n\t\t\t\t\t\t\t\ttoolIssues.add(`${context.toolCall.name} blocked: ${decision.reason ?? \"capability denied\"}`);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\treturn decision;\n\t\t\t\t\t\t},\n\t\t\t\t\t\tafterToolCall: async ({ toolCall, args, isError }) => {\n\t\t\t\t\t\t\t// This hook runs only for a validated, gate-approved tool that actually entered\n\t\t\t\t\t\t\t// execution. Record a direct mutation target before inspecting `isError`: write/edit\n\t\t\t\t\t\t\t// may have changed disk and then observed cancellation, timeout, or a late I/O error.\n\t\t\t\t\t\t\t// Pre-gate/profile/path refusals never reach afterToolCall, so they remain unreported.\n\t\t\t\t\t\t\tif (toolCall.name === \"write\" || toolCall.name === \"edit\") {\n\t\t\t\t\t\t\t\tif (args && typeof args === \"object\" && !Array.isArray(args)) {\n\t\t\t\t\t\t\t\t\tconst rawPath = (args as Record<string, unknown>).path;\n\t\t\t\t\t\t\t\t\tif (typeof rawPath === \"string\" && rawPath.length > 0) {\n\t\t\t\t\t\t\t\t\t\tconst absolutePath = path.isAbsolute(rawPath)\n\t\t\t\t\t\t\t\t\t\t\t? path.resolve(rawPath)\n\t\t\t\t\t\t\t\t\t\t\t: path.resolve(this.deps.getCwd(), rawPath);\n\t\t\t\t\t\t\t\t\t\tlet canonicalPath = absolutePath;\n\t\t\t\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\t\t\t\tcanonicalPath = safeRealpathSync(absolutePath);\n\t\t\t\t\t\t\t\t\t\t} catch {\n\t\t\t\t\t\t\t\t\t\t\t// Execution was attempted; preserve conservative accounting with the lexical path.\n\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\ttoolChangedFiles.add(path.relative(this.deps.getCwd(), canonicalPath));\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (isError) {\n\t\t\t\t\t\t\t\ttoolIssues.add(`${toolCall.name} failed during isolated execution`);\n\t\t\t\t\t\t\t\treturn undefined;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\treturn undefined;\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t// Core/soul/role are all static per configuration — the provider can cache the prefix.\n\t\t\t\t\t\tcacheRetention: \"short\",\n\t\t\t\t\t});\n\t\t\t\t\tspentUsage = completion.usage;\n\t\t\t\t\treturn {\n\t\t\t\t\t\ttext: completion.text,\n\t\t\t\t\t\tcostUsd: completion.usage.cost.total,\n\t\t\t\t\t\tstopReason: String(completion.stopReason),\n\t\t\t\t\t\tchangedFiles: [...toolChangedFiles],\n\t\t\t\t\t\tblockers: [...toolIssues],\n\t\t\t\t\t};\n\t\t\t\t},\n\t\t\t});\n\n\t\t\t// Bug #21 pattern: never persist against a disposed session.\n\t\t\tif (this.deps.isDisposed()) {\n\t\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\t\tstatus: \"canceled\",\n\t\t\t\t\treasonCode: \"session_disposed\",\n\t\t\t\t});\n\t\t\t\treturn { started: true, record, outcome };\n\t\t\t}\n\n\t\t\tthis.deps.saveWorkerResultSnapshot(outcome.result, workerRequest);\n\t\t\tif (spentUsage && (spentUsage.cost.total > 0 || spentUsage.totalTokens > 0)) {\n\t\t\t\tthis.deps.addSpawnedUsage(spentUsage, { label: \"worker-delegation\", reportId: usageReportId });\n\t\t\t}\n\n\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\tstatus: outcome.laneStatus,\n\t\t\t\treasonCode: outcome.reasonCode,\n\t\t\t\tcostUsd: outcome.costUsd,\n\t\t\t});\n\t\t\tif (record) {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), record);\n\t\t\t\t// G3: worker lane terminal record -> worker_result event. Lane outcome only\n\t\t\t\t// (status/reasonCode/cost) — never the worker's summary/changed-file text.\n\t\t\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.workerResult,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\tpayload: {\n\t\t\t\t\t\tlaneId: record.laneId,\n\t\t\t\t\t\tlaneType: record.type,\n\t\t\t\t\t\tstatus: record.status,\n\t\t\t\t\t\treasonCode: record.reasonCode ?? null,\n\t\t\t\t\t\tcostUsd: record.costUsd ?? null,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn { started: true, record, outcome };\n\t\t} catch (error) {\n\t\t\tconst record = this._laneTracker.complete(startedRecord.laneId, {\n\t\t\t\tstatus: \"failed\",\n\t\t\t\treasonCode: \"worker_delegation_error\",\n\t\t\t});\n\t\t\tif (record && !this.deps.isDisposed()) {\n\t\t\t\tappendLaneRecordSnapshot(this.deps.getSessionManager(), record);\n\t\t\t\tthis.deps.emitAutonomyTelemetry({\n\t\t\t\t\ttype: AUTONOMY_TELEMETRY_EVENT_TYPES.workerResult,\n\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\tpayload: {\n\t\t\t\t\t\tlaneId: record.laneId,\n\t\t\t\t\t\tlaneType: record.type,\n\t\t\t\t\t\tstatus: record.status,\n\t\t\t\t\t\treasonCode: record.reasonCode ?? null,\n\t\t\t\t\t\tcostUsd: record.costUsd ?? null,\n\t\t\t\t\t},\n\t\t\t\t});\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthis.deps.emit({ type: \"warning\", message: `Worker delegation failed: ${message}` });\n\t\t\treturn { started: true, record };\n\t\t} finally {\n\t\t}\n\t}\n\n\t/**\n\t * Probe a candidate model against the subagent contracts (research/worker/judge/search/\n\t * tool-call surfaces) via {@link runModelFitnessProbe}. The model must resolve and\n\t * authenticate; every probe call runs as an isolated completion on that model, and probe\n\t * spend is reported through spawned-usage accounting.\n\t */\n\tasync runModelFitness(args: {\n\t\tmodel: string;\n\t\ttrials?: number;\n\t}): Promise<{ started: true; model: string; report: ModelFitnessReport } | { started: false; skipReason: string }> {\n\t\tif (this.deps.isDisposed()) return { started: false, skipReason: \"session_disposed\" };\n\t\tconst resolved = this.resolveLaneModel(args.model.trim() || undefined);\n\t\tif (!resolved) return { started: false, skipReason: \"model_unresolved_or_unauthenticated\" };\n\t\tconst capability = this._laneCapabilityProfile(resolved);\n\n\t\tconst spent: Usage = {\n\t\t\tinput: 0,\n\t\t\toutput: 0,\n\t\t\tcacheRead: 0,\n\t\t\tcacheWrite: 0,\n\t\t\ttotalTokens: 0,\n\t\t\tcost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },\n\t\t};\n\t\tconst report = await runModelFitnessProbe({\n\t\t\ttrials: args.trials,\n\t\t\tsignal: this._researchLaneAbort.signal,\n\t\t\tcapacityProbe:\n\t\t\t\tresolved.provider === \"ollama\" && resolved.contextWindow > 0\n\t\t\t\t\t? { registeredContextWindow: resolved.contextWindow }\n\t\t\t\t\t: undefined,\n\t\t\tcomplete: async ({ systemPrompt, userPrompt, signal }) => {\n\t\t\t\tconst callStarted = Date.now();\n\t\t\t\tconst completion = await this.deps.runIsolatedCompletion({\n\t\t\t\t\tsystemPrompt,\n\t\t\t\t\tmessages: [{ role: \"user\", content: [{ type: \"text\", text: userPrompt }], timestamp: Date.now() }],\n\t\t\t\t\tmodel: resolved,\n\t\t\t\t\tthinkingLevel: \"off\",\n\t\t\t\t\tmaxTokens: capability.laneMaxOutputTokens,\n\t\t\t\t\tsignal,\n\t\t\t\t\tcacheRetention: \"short\",\n\t\t\t\t});\n\t\t\t\tconst callMs = Date.now() - callStarted;\n\t\t\t\tspent.input += completion.usage.input;\n\t\t\t\tspent.output += completion.usage.output;\n\t\t\t\tspent.cacheRead += completion.usage.cacheRead;\n\t\t\t\tspent.cacheWrite += completion.usage.cacheWrite;\n\t\t\t\tspent.totalTokens += completion.usage.totalTokens;\n\t\t\t\tspent.cost.input += completion.usage.cost.input;\n\t\t\t\tspent.cost.output += completion.usage.cost.output;\n\t\t\t\tspent.cost.cacheRead += completion.usage.cost.cacheRead;\n\t\t\t\tspent.cost.cacheWrite += completion.usage.cost.cacheWrite;\n\t\t\t\tspent.cost.total += completion.usage.cost.total;\n\t\t\t\treturn {\n\t\t\t\t\ttext: completion.text,\n\t\t\t\t\tcostUsd: completion.usage.cost.total,\n\t\t\t\t\tstopReason: String(completion.stopReason),\n\t\t\t\t\t// Wall-clock fallback for tok/s: providers don't expose pure eval time, so the\n\t\t\t\t\t// measured call time stands in — slightly conservative (includes network/queue).\n\t\t\t\t\toutputTokens: completion.usage.output,\n\t\t\t\t\tevalMs: callMs,\n\t\t\t\t};\n\t\t\t},\n\t\t});\n\t\tif (!this.deps.isDisposed() && (spent.cost.total > 0 || spent.totalTokens > 0)) {\n\t\t\tthis.deps.addSpawnedUsage(spent, { label: \"model-fitness\" });\n\t\t}\n\t\tconst modelRef = `${resolved.provider}/${resolved.id}`;\n\t\t// Fitness is a property of a model ON a host — persist the report host-keyed so role\n\t\t// assignments stay per-machine (a model can await better hardware without being forgotten).\n\t\t// Best-effort: a disk problem must not fail the probe itself.\n\t\ttry {\n\t\t\tif (!this.deps.isDisposed()) {\n\t\t\t\tFitnessStore.forAgentDir(this.deps.getAgentDir()).save(modelRef, report);\n\t\t\t}\n\t\t} catch {\n\t\t\t// best-effort persistence\n\t\t}\n\t\treturn { started: true, model: modelRef, report };\n\t}\n\n\t/** Fitness reports persisted for THIS host (measured evidence for architect/profile decisions). */\n\tgetStoredFitnessReports(): StoredFitnessReport[] {\n\t\ttry {\n\t\t\treturn FitnessStore.forAgentDir(this.deps.getAgentDir()).getForHost();\n\t\t} catch {\n\t\t\treturn [];\n\t\t}\n\t}\n}\n"]}