@caupulican/pi-adaptative 0.81.38 → 0.81.40

package/dist/core/risk-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-classifier.d.ts","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEjH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAiFtD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAyFtE;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAE3E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAuE9E","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" | \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+.*\\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish|release|push|deploy|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth|token|credential|credentials|secret|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete|reset|rm\\s+-rf|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify|change|write|update|edit|delete|add|remove|set)\\s+.*\\b(skills|prompts|settings|tools|behavior)\\b|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite|redesign|change|modify|rearchitect)\\s+.*\\b(architecture|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan|planning|roadmap|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design|architect\\w*|structure|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test|testing|validation|lint|vitest|jest|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r|\\s+-f|\\s+-rf|\\s+-fr)?|mv|cp|chmod|chown|install)\\b|>\\s*\\/dev\\/(sda|hda|vda)|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit|push|reset|clean|stash|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm|pnpm|yarn|bun)\\s+(install|i|update|up|publish|run|remove|rm|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree|move|copy|copy2|copytree)|os\\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\\.(?:run|call|check_call|check_output|Popen)|Path\\([^)]*\\)\\.(?:unlink|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" | \"security\" | \"destructive\" | \"self-modification\" | \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal | undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) ||\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}

package/dist/core/risk-classifier.js

@@ -0,0 +1,225 @@
+const EXPLICIT_MODIFY_REQUEST_RE = /^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\s+.*\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\b/i;
+const READ_ONLY_QUESTION_RE = /^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\b/i;
+const RELEASE_PUBLISH_RE = /\b(publish|release|push|deploy|tag)\b/i;
+const SECURITY_AUTH_RE = /\b(auth|token|credential|credentials|secret|api[-_]key)\b/i;
+const DESTRUCTIVE_RE = /\b(delete|reset|rm\s+-rf|clean)\b/i;
+const SELF_MOD_MUTATE_RE = /\b(modify|change|write|update|edit|delete|add|remove|set)\s+.*\b(skills|prompts|settings|tools|behavior)\b|self[-_]modification/i;
+const ARCHITECTURE_MUTATE_RE = /\b(rewrite|redesign|change|modify|rearchitect)\s+.*\b(architecture|architect)\b/i;
+const PLANNING_CORE_RE = /\b(plan|planning|roadmap|strategy)\b/i;
+const PLANNING_DESIGN_WORD_RE = /\b(design|architect\w*|structure|approach)\b/i;
+const PLANNING_PROSPECTIVE_RE = /\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\b/i;
+const REFACTOR_RE = /\b(refactor|refactoring)\b/i;
+const TEST_VALIDATION_RE = /\b(test|testing|validation|lint|vitest|jest|run)\b/i;
+const IMPLEMENT_RE = /\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\b/i;
+const DESTRUCTIVE_CMD_RE = /\b(rm(\s+-r|\s+-f|\s+-rf|\s+-fr)?|mv|cp|chmod|chown|install)\b|>\s*\/dev\/(sda|hda|vda)|\b(dd\s+if=)/i;
+const GIT_MUTATE_CMD_RE = /\bgit\s+(commit|push|reset|clean|stash|rebase)\b/i;
+const PKG_MUTATE_CMD_RE = /\b(npm|pnpm|yarn|bun)\s+(install|i|update|up|publish|run|remove|rm|uninstall)\b/i;
+const RELEASE_DEPLOY_CMD_RE = /\b(release|deploy)\b/i;
+const PYTHON_HIGH_IMPACT_RE = /\b(?:shutil\.(?:rmtree|move|copy|copy2|copytree)|os\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\.(?:run|call|check_call|check_output|Popen)|Path\([^)]*\)\.(?:unlink|rmdir))\b/i;
+const REDIRECTION_RE = /[<>]/;
+function isPlanningPrompt(text) {
+    return PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));
+}
+function highRiskSignal(text) {
+    if (RELEASE_PUBLISH_RE.test(text)) {
+        return {
+            risk: "approval-required",
+            kind: "release",
+            reason: "Operation mentions releasing, publishing, or deploying",
+        };
+    }
+    if (SECURITY_AUTH_RE.test(text)) {
+        return {
+            risk: "approval-required",
+            kind: "security",
+            reason: "Operation mentions authentication or credentials",
+        };
+    }
+    if (DESTRUCTIVE_RE.test(text)) {
+        return {
+            risk: "approval-required",
+            kind: "destructive",
+            reason: "Operation involves deleting, resetting, or cleaning",
+        };
+    }
+    if (SELF_MOD_MUTATE_RE.test(text)) {
+        return {
+            risk: "approval-required",
+            kind: "self-modification",
+            reason: "Operation modifies settings, tools, skills, or prompts",
+        };
+    }
+    if (ARCHITECTURE_MUTATE_RE.test(text)) {
+        return {
+            risk: "high-impact",
+            kind: "architecture",
+            reason: "Operation mentions rewriting or rearchitecting core parts",
+        };
+    }
+    return undefined;
+}
+function stripSingleQuotes(command) {
+    return command.replace(/'[^']*'/g, "''");
+}
+export function classifyModelRouterRoute(prompt) {
+    const text = prompt.trim();
+    if (!text) {
+        return {
+            tier: "cheap",
+            risk: "read-only",
+            confidence: 0.1,
+            reasonCode: "empty_prompt",
+            reasons: ["Empty or whitespace prompt"],
+        };
+    }
+    if (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {
+        if (isPlanningPrompt(text)) {
+            return {
+                tier: "medium",
+                risk: "read-only",
+                confidence: 0.75,
+                reasonCode: "planning_min_medium",
+                reasons: ["Planning/design prompts never route cheap by default; a judge may deem them trivial"],
+            };
+        }
+        return {
+            tier: "cheap",
+            risk: "read-only",
+            confidence: 0.9,
+            reasonCode: "read_only_question",
+            reasons: ["Prompt asks a question or requests an explanation, search, or lookup"],
+        };
+    }
+    const highRisk = highRiskSignal(text);
+    if (highRisk) {
+        const reasonCode = {
+            release: "release_or_publish",
+            security: "security_or_auth",
+            destructive: "destructive_or_git_history",
+            "self-modification": "settings_or_self_modification",
+            architecture: "architecture_or_ambiguous",
+        };
+        return {
+            tier: "expensive",
+            risk: highRisk.kind === "security" ? "high-impact" : highRisk.risk,
+            confidence: highRisk.kind === "security" ? 0.95 : highRisk.kind === "destructive" ? 0.85 : 0.9,
+            reasonCode: reasonCode[highRisk.kind],
+            reasons: [highRisk.reason],
+        };
+    }
+    if (isPlanningPrompt(text)) {
+        return {
+            tier: "medium",
+            risk: "read-only",
+            confidence: 0.75,
+            reasonCode: "planning_min_medium",
+            reasons: ["Planning/design prompts never route cheap by default; a judge may deem them trivial"],
+        };
+    }
+    if (REFACTOR_RE.test(text)) {
+        return {
+            tier: "medium",
+            risk: "scoped-write",
+            confidence: 0.8,
+            reasonCode: "mechanical_refactor",
+            reasons: ["Prompt mentions refactoring code structure"],
+        };
+    }
+    if (TEST_VALIDATION_RE.test(text)) {
+        return {
+            tier: "medium",
+            risk: "scoped-write",
+            confidence: 0.8,
+            reasonCode: "test_or_validation",
+            reasons: ["Prompt mentions testing, validation, or linting"],
+        };
+    }
+    if (IMPLEMENT_RE.test(text)) {
+        return {
+            tier: "medium",
+            risk: "scoped-write",
+            confidence: 0.85,
+            reasonCode: "normal_implementation",
+            reasons: ["Prompt mentions implementing, updating, creating, or modifying code"],
+        };
+    }
+    return {
+        tier: "cheap",
+        risk: "read-only",
+        confidence: 0.5,
+        reasonCode: "default_read_only",
+        reasons: ["No explicit implementation, destructive, or release patterns detected"],
+    };
+}
+export function classifyModelRouterIntent(prompt) {
+    return classifyModelRouterRoute(prompt).tier === "cheap" ? "research" : "modify";
+}
+export function assessOperationRisk(input) {
+    const operation = input.operation.trim();
+    const command = input.command?.trim() ?? "";
+    const cleanCommand = stripSingleQuotes(command);
+    const fullText = `${operation} ${command}`.trim();
+    const cleanFullText = `${operation} ${cleanCommand}`.trim();
+    if (!fullText) {
+        return {
+            risk: "read-only",
+            reasonCode: "empty_operation",
+            reasons: ["Empty operation"],
+            requiresApproval: false,
+        };
+    }
+    if (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {
+        return {
+            risk: "read-only",
+            reasonCode: "read_only_operation",
+            reasons: ["Operation is explicitly read-only (list/show/read/search)"],
+            requiresApproval: false,
+        };
+    }
+    const highRisk = highRiskSignal(cleanFullText);
+    if (highRisk) {
+        const reasonCode = {
+            release: "release_publish_operation",
+            security: "security_auth_operation",
+            destructive: "destructive_operation",
+            "self-modification": "self_modification_operation",
+            architecture: "architecture_mutation_operation",
+        };
+        return {
+            risk: highRisk.risk,
+            reasonCode: reasonCode[highRisk.kind],
+            reasons: [highRisk.reason],
+            requiresApproval: highRisk.risk === "approval-required",
+        };
+    }
+    if (command &&
+        (DESTRUCTIVE_CMD_RE.test(cleanCommand) ||
+            GIT_MUTATE_CMD_RE.test(cleanCommand) ||
+            PKG_MUTATE_CMD_RE.test(cleanCommand) ||
+            RELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||
+            PYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||
+            REDIRECTION_RE.test(cleanCommand))) {
+        return {
+            risk: "approval-required",
+            reasonCode: "mutating_command",
+            reasons: ["Command executes a destructive, mutating, or publish operation"],
+            requiresApproval: true,
+        };
+    }
+    if (input.toolName &&
+        !["read_file", "search_web", "list_dir", "grep_search", "view_file", "memory"].includes(input.toolName)) {
+        return {
+            risk: "scoped-write",
+            reasonCode: "generic_mutation",
+            reasons: ["Generic mutating operation or command"],
+            requiresApproval: false,
+        };
+    }
+    return {
+        risk: "read-only",
+        reasonCode: "default_read_only",
+        reasons: ["No mutating or high-risk patterns detected"],
+        requiresApproval: false,
+    };
+}
+//# sourceMappingURL=risk-classifier.js.map

package/dist/core/risk-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-classifier.js","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAIA,MAAM,0BAA0B,GAC/B,mSAAmS,CAAC;AACrS,MAAM,qBAAqB,GAC1B,qNAAqN,CAAC;AACvN,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAC5D,MAAM,kBAAkB,GACvB,kIAAkI,CAAC;AACpI,MAAM,sBAAsB,GAAG,kFAAkF,CAAC;AAClH,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACjE,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAChF,MAAM,uBAAuB,GAC5B,6IAA6I,CAAC;AAC/I,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AACjF,MAAM,YAAY,GAAG,sFAAsF,CAAC;AAC5G,MAAM,kBAAkB,GACvB,uGAAuG,CAAC;AACzG,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAC9E,MAAM,iBAAiB,GAAG,kFAAkF,CAAC;AAC7G,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,qBAAqB,GAC1B,2LAA2L,CAAC;AAC7L,MAAM,cAAc,GAAG,MAAM,CAAC;AAQ9B,SAAS,gBAAgB,CAAC,IAAY,EAAW;IAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAAA,CACjH;AAED,SAAS,cAAc,CAAC,IAAY,EAA0B;IAC7D,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,kDAAkD;SAC1D,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qDAAqD;SAC7D,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,2DAA2D;SACnE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAU;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAAA,CACzC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAiB;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,CAAC,4BAA4B,CAAC;SACvC,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;aAChG,CAAC;QACH,CAAC;QACD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,sEAAsE,CAAC;SACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,oBAAoB;YAC7B,QAAQ,EAAE,kBAAkB;YAC5B,WAAW,EAAE,4BAA4B;YACzC,mBAAmB,EAAE,+BAA+B;YACpD,YAAY,EAAE,2BAA2B;SACzC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;YAClE,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;YAC9F,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC1B,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;SAChG,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,4CAA4C,CAAC;SACvD,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,iDAAiD,CAAC;SAC5D,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,uBAAuB;YACnC,OAAO,EAAE,CAAC,qEAAqE,CAAC;SAChF,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,uEAAuE,CAAC;KAClF,CAAC;AAAA,CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAqB;IAC5E,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAAA,CACjF;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA0B,EAAkB;IAC/E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,2DAA2D,CAAC;YACtE,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,2BAA2B;YACpC,QAAQ,EAAE,yBAAyB;YACnC,WAAW,EAAE,uBAAuB;YACpC,mBAAmB,EAAE,6BAA6B;YAClD,YAAY,EAAE,iCAAiC;SAC/C,CAAC;QACF,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,IAAI,KAAK,mBAAmB;SACvD,CAAC;IACH,CAAC;IACD,IACC,OAAO;QACP,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAClC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,gEAAgE,CAAC;YAC3E,gBAAgB,EAAE,IAAI;SACtB,CAAC;IACH,CAAC;IACD,IACC,KAAK,CAAC,QAAQ;QACd,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EACtG,CAAC;QACF,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,uCAAuC,CAAC;YAClD,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,4CAA4C,CAAC;QACvD,gBAAgB,EAAE,KAAK;KACvB,CAAC;AAAA,CACF","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" | \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+.*\\b(add|apply|build|change|commit|create|delete|edit|fix|generate|implement|install|modify|patch|remove|rename|replace|run|test|update|write|publish|release|push|deploy|tag|reset|clean|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you|could you|please|pls|go ahead and|let'?s|i need you to|we need to|you should)\\s+)?(?:how|what|why|when|where|which|who|explain|summarize|compare|describe|list|show|search|find|view|read|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish|release|push|deploy|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth|token|credential|credentials|secret|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete|reset|rm\\s+-rf|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify|change|write|update|edit|delete|add|remove|set)\\s+.*\\b(skills|prompts|settings|tools|behavior)\\b|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite|redesign|change|modify|rearchitect)\\s+.*\\b(architecture|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan|planning|roadmap|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design|architect\\w*|structure|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should|would|do we|can we)|what(?:'s| is) the (?:best|cleanest|right)|propose|draft|come up with|figure out|decide (?:on|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test|testing|validation|lint|vitest|jest|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement|fix|apply|change|update|create|write|generate|modify|edit|patch|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r|\\s+-f|\\s+-rf|\\s+-fr)?|mv|cp|chmod|chown|install)\\b|>\\s*\\/dev\\/(sda|hda|vda)|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit|push|reset|clean|stash|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm|pnpm|yarn|bun)\\s+(install|i|update|up|publish|run|remove|rm|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree|move|copy|copy2|copytree)|os\\.(?:remove|unlink|rmdir|removedirs|system)|subprocess\\.(?:run|call|check_call|check_output|Popen)|Path\\([^)]*\\)\\.(?:unlink|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" | \"security\" | \"destructive\" | \"self-modification\" | \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) || (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal | undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) ||\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) ||\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) ||\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) ||\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}

package/dist/core/runtime-builder.d.ts

@@ -36,26 +36,47 @@ import type { Agent, AgentContext, AgentMessage, AgentTool } from "@caupulican/p
 import type { SessionManager } from "@caupulican/pi-agent-core/node";
 import type { Api, Model, Usage } from "@caupulican/pi-ai";
 import type { IsolatedCompletionOptions, IsolatedCompletionResult, WorkerDelegationRunOutcome } from "./agent-session.ts";
-import type { WorkerResult } from "./autonomy/contracts.ts";
+import type { WorkerClaim } from "./autonomy/contracts.ts";
 import type { LaneRecord } from "./autonomy/lane-tracker.ts";
 import type { ArtifactStore } from "./context/context-artifacts.ts";
 import type { MemoryPromptInclusionReport, MemoryRetrievalDiagnostics } from "./context/memory-diagnostics.ts";
 import type { ContextGcReport } from "./context-gc.ts";
+import type { WorkerDelegationRequest } from "./delegation/worker-delegation-request.ts";
 import { type ContextUsage, type Extension, type ExtensionCommandContextActions, type ExtensionErrorListener, ExtensionRunner, type ExtensionUIContext, type ShutdownHandler, type ToolDefinition, type ToolInfo } from "./extensions/index.ts";
 import type { GoalState } from "./goals/goal-state.ts";
+import type { OpenTaskStepRef } from "./goals/goal-tool-core.ts";
 import type { MemoryManager } from "./memory/memory-manager.ts";
 import type { MemoryControllerReloadSnapshot } from "./memory-controller.ts";
+import type { LaneWorkerRefusal } from "./model-capability.ts";
 import type { ModelRegistry } from "./model-registry.ts";
+import type { OrchestrationProfile } from "./orchestration/contracts.ts";
 import type { ProfileFilterReloadSnapshot } from "./profile-filter-controller.ts";
 import type { ModelFitnessReport } from "./research/model-fitness.ts";
 import type { ResourceLoader } from "./resource-loader.ts";
+import type { SessionImageStore } from "./session-image-store.ts";
 import { type ResourceProfileFilterSettings, type SettingsManager } from "./settings-manager.ts";
 import type { TaskStepsState } from "./tasks/task-state.ts";
+/**
+ * Is `toolCallId` a real, answered tool call on `sessionManager`'s active branch? A
+ * toolCallId is "real" iff a toolResult message on that branch responded to it -- the same
+ * toolResult/toolCallId match `context-pipeline.ts`'s `_buildSessionEntryIdLookup` uses, and
+ * branch-scoped (via `getBranch()`) so a sibling branch's tool calls never count. Exported (pure,
+ * no `this`) so the goal tool's `hasToolCallId` wiring below is directly testable against a real
+ * `SessionManager` without constructing the whole `RuntimeBuilder`.
+ */
+export declare function hasAnsweredToolCallOnBranch(sessionManager: SessionManager, toolCallId: string): boolean;
+/**
+ * Goal-tool adapter over the canonical open-task projection. Exported (pure, no `this`) so the
+ * production `getOpenTaskSteps` wiring below remains directly testable without another filter.
+ */
+export declare function deriveOpenTaskStepRefs(taskStepsState: TaskStepsState | undefined): OpenTaskStepRef[];
 export interface RuntimeBuilderDeps {
     /** Live agent — the snapshot/doctor read and restore its `state.tools` / `state.systemPrompt`. */
     getAgent(): Agent;
     /** Workspace root, passed to the tool-definition factory and the extension runner. */
     getCwd(): string;
+    /** Per-agent persistent shell session key; stable across reloads so the shell survives them. */
+    getShellSessionKey(): string;
     /** Agent state root, including the host-keyed fitness store. */
     getAgentDir(): string;
     /** Session log, passed to the extension runner. */
@@ -86,6 +107,8 @@ export interface RuntimeBuilderDeps {
     getToolProfileFilter(): Required<ResourceProfileFilterSettings> | undefined;
     setToolProfileFilter(filter: Required<ResourceProfileFilterSettings> | undefined): void;
     getAllowedToolNames(): Set<string> | undefined;
+    /** Immutable active orchestration profile; absent sessions never construct run_process. */
+    getOrchestrationProfile?(): OrchestrationProfile | undefined;
     getExcludedToolNames(): Set<string> | undefined;
     /** Re-derive the profile tool filter from freshly reloaded settings (reload only). */
     deriveToolProfileFilter(): Required<ResourceProfileFilterSettings>;
@@ -93,7 +116,7 @@ export interface RuntimeBuilderDeps {
     isToolOrCommandAllowedByProfile(name: string): boolean;
     /** Filter the loaded extensions through the active resource profile (records inert/denied warnings host-side). */
     filterExtensionsForRuntime(extensions: Extension[]): Extension[];
-    /** Sink for the G13 unbound-profile-tool-grant warnings surfaced in /context. */
+    /** Sink for the unbound-profile-tool-grant warnings surfaced in /context. */
     setUnboundToolGrantWarnings(warnings: string[]): void;
     getUnboundToolGrantWarnings(): string[];
     createProfileFilterReloadSnapshot(): ProfileFilterReloadSnapshot;
@@ -117,6 +140,8 @@ export interface RuntimeBuilderDeps {
     notifyExtensionsChanged(): void;
     /** Session-scoped tool-output artifact store for artifact-producing tools and artifact_retrieve (gated on the profile). */
     getToolArtifactStore(): ArtifactStore;
+    /** Lazily resolve durable image storage only for a persisted/configured session. */
+    getSessionImageStore(): Pick<SessionImageStore, "retainContent"> | undefined;
     /** Live memory manager — its provider tools join the registry. */
     getMemoryManager(): MemoryManager;
     /** Memory retrieval + prompt-inclusion diagnostics for the core diagnostics tool. */
@@ -139,29 +164,31 @@ export interface RuntimeBuilderDeps {
     /** Context-gc report for the core diagnostics tool. */
     getContextGcReport(messages: AgentMessage[]): ContextGcReport;
     /** Non-blocking worker-delegation starter for the delegate tool. */
-    startWorkerDelegation(request: {
-        instructions: string;
-        systemPrompt?: string;
-        memoryRead?: boolean;
-    }): {
+    startWorkerDelegation(request: WorkerDelegationRequest): {
         started: false;
         skipReason: string;
     } | {
         started: true;
         record: LaneRecord;
     };
+    getOrchestrationProfileCatalog(): Array<{
+        profileId: string;
+        role: string;
+        description: string;
+    }>;
     getWorkerLaneRecords(): LaneRecord[];
-    getWorkerResultSnapshots(): WorkerResult[];
+    getWorkerClaimSnapshots(): WorkerClaim[];
+    /** Confirm a managed dispatch's caller-stable canonical lane id was registered durably before the
+     * goal binds it (`BackgroundLaneController.resolveManagedLaneId`). */
+    resolveManagedLaneId(callerLaneId: string): string | undefined;
     /** Worker-delegation runner for SDK/test through-completion calls. */
-    runWorkerDelegationOnce(request: {
-        instructions: string;
-        systemPrompt?: string;
-        memoryRead?: boolean;
-    }): Promise<WorkerDelegationRunOutcome>;
-    /** Model-fitness probe for the model_fitness tool. */
+    runWorkerDelegationOnce(request: WorkerDelegationRequest): Promise<WorkerDelegationRunOutcome>;
+    /** Model-fitness probe for the model_fitness tool. `toolCallId` is the idempotency token
+     * for spawned-usage reportId — present only for the LLM tool-call path (see model-fitness.ts). */
     runModelFitness(args: {
         model: string;
         trials?: number;
+        toolCallId?: string;
     }): Promise<{
         started: true;
         model: string;
@@ -174,12 +201,18 @@ export interface RuntimeBuilderDeps {
     resolveCurationModelIfFit(): Model<Api> | undefined;
     /** One-shot, tool-less LLM call — the reflex-brain interpreter rides this. */
     runIsolatedCompletion(opts: IsolatedCompletionOptions): Promise<IsolatedCompletionResult>;
-    /** Roll reflex-brain spend into spawned-usage accounting. */
-    addSpawnedUsage(usage: Usage, opts?: {
+    /** Roll reflex-brain spend into spawned-usage accounting. `reportId` is REQUIRED: every
+     * caller derives a stable id from the work unit's identity so a retry cannot double-count. */
+    addSpawnedUsage(usage: Usage, opts: {
         label?: string;
         sourceSessionId?: string;
-        reportId?: string;
+        reportId: string;
     }): string | undefined;
+    /** Whether the CURRENT session model may drive a worktree-sync lane worker (`AgentSession.
+     * getLaneWorkerRefusal`) -- consulted BEFORE a goal→tmux dispatch so an ineligible model's
+     * dispatch is refused before any lane/pane side effect (`tools/tmux-dispatch.ts`'s
+     * `evaluateWorkerLaneRefusal`). `undefined` means eligible. */
+    getLaneWorkerRefusal(): LaneWorkerRefusal | undefined;
     /** Post-rebuild doctor helpers (validate the rebuilt runtime can render a context). */
     createAgentContextSnapshot(): AgentContext;
     getContextUsage(): ContextUsage | undefined;
@@ -191,6 +224,17 @@ export interface RuntimeBuilderDeps {
     getExtensionCommandContextActions(): ExtensionCommandContextActions | undefined;
     getExtensionShutdownHandler(): ShutdownHandler | undefined;
     getExtensionErrorListener(): ExtensionErrorListener | undefined;
+    /**
+     * Stop any pi-spawned local (Ollama/Transformers/prism llama.cpp) runtime the host's
+     * LocalRuntimeController is holding open that no longer applies under the just-reloaded
+     * configuration — e.g. `LocalRuntimeController.reconcile(eligibleModels)`, with `eligibleModels`
+     * derived from whatever the host still routes to post-reload (foreground model + any configured
+     * router tier). Called ONLY after `_reloadOnce()` commits successfully — never on a rolled-back
+     * reload, since a rollback restores the PREVIOUS configuration and nothing became ineligible.
+     * Optional: a host that hasn't wired a LocalRuntimeController through here yet sees no behavior
+     * change — a local runtime this builder doesn't know about is simply left alone, never guessed at.
+     */
+    reconcileLocalRuntimes?(): void;
 }
 /**
  * Owns the tool-registry build and the self-modification-safe extension reload extracted from
@@ -206,6 +250,12 @@ export declare class RuntimeBuilder {
     private _reloadRequested;
     private readonly deps;
     constructor(deps: RuntimeBuilderDeps);
+    /**
+     * Resolve the construction and activation policy once for a runtime generation. This is the
+     * UAC choke point: callers must consult it before invoking a tool factory, not merely before
+     * placing an already-created definition in the live registry.
+     */
+    private _createToolAccessPolicy;
     private _runContextScout;
     /** Whether a tool name is present in the live wrapped registry. */
     hasTool(name: string): boolean;
@@ -235,6 +285,15 @@ export declare class RuntimeBuilder {
     }): (() => void) | undefined;
     reload(): Promise<void>;
     private _drainReloadRequests;
+    /**
+     * Unified reload-gate quiescence check: refuses the caller's action (message-prefixed by
+     * `action`) while the agent is streaming, is compacting, or ANY background work unit is still
+     * registered in the in-process quiesce registry — background lanes (research/worker/
+     * model-fitness), a context-scout run, or an isolated completion (see reload-blockers.ts). Every
+     * live-op entry point below calls this so they refuse identically; this is a synchronous refusal
+     * (not a wait/poll) — callers retry via the same coalescing `reload()` already provides.
+     */
+    private _assertReloadQuiescent;
     private _reloadOnce;
     /**
      * Unload a single extension without full reload.