@caupulican/pi-adaptative 0.81.41 → 0.81.43

package/dist/core/tool-gate-controller.js

@@ -11,100 +11,99 @@
 import { evaluateToolGate } from "./autonomy/gates.js";
 import { classifyToolTrust, wrapUntrustedText } from "./security/untrusted-boundary.js";
 export class ToolGateController {
-    deps;
     constructor(deps) {
-        this.deps = deps;
-    }
-    beforeToolCall = async ({ toolCall, args }) => {
-        const escalation = this.deps.maybeEscalateToolCall(toolCall.name, args);
-        if (escalation) {
-            return escalation;
-        }
-        // Autonomy tool gating
-        const envelope = this.deps.getCapabilityEnvelope();
-        const gateResult = evaluateToolGate({
-            toolName: toolCall.name,
-            args,
-            cwd: this.deps.getCwd(),
-            envelope,
-        });
-        if (envelope) {
-            this.deps.recordGateOutcome(gateResult);
-        }
-        if (gateResult.outcome === "block" || gateResult.outcome === "ask-user") {
-            return {
-                block: true,
-                reason: `Tool execution blocked by autonomy gate [${gateResult.gate}]: ${gateResult.message} (${gateResult.reasonCode})`,
-            };
-        }
-        const runner = this.deps.getExtensionRunner();
-        let extensionResult;
-        if (runner.hasHandlers("tool_call")) {
-            try {
-                extensionResult = await runner.emitToolCall({
-                    type: "tool_call",
+        this.beforeToolCall = async ({ toolCall, args }) => {
+            const escalation = this.deps.maybeEscalateToolCall(toolCall.name, args);
+            if (escalation) {
+                return escalation;
+            }
+            // Autonomy tool gating
+            const envelope = this.deps.getCapabilityEnvelope();
+            const gateResult = evaluateToolGate({
+                toolName: toolCall.name,
+                args,
+                cwd: this.deps.getCwd(),
+                envelope,
+            });
+            if (envelope) {
+                this.deps.recordGateOutcome(gateResult);
+            }
+            if (gateResult.outcome === "block" || gateResult.outcome === "ask-user") {
+                return {
+                    block: true,
+                    reason: `Tool execution blocked by autonomy gate [${gateResult.gate}]: ${gateResult.message} (${gateResult.reasonCode})`,
+                };
+            }
+            const runner = this.deps.getExtensionRunner();
+            let extensionResult;
+            if (runner.hasHandlers("tool_call")) {
+                try {
+                    extensionResult = await runner.emitToolCall({
+                        type: "tool_call",
+                        toolName: toolCall.name,
+                        toolCallId: toolCall.id,
+                        input: args,
+                    });
+                }
+                catch (err) {
+                    if (err instanceof Error) {
+                        throw err;
+                    }
+                    throw new Error(`Extension failed, blocking execution: ${String(err)}`);
+                }
+            }
+            if (extensionResult)
+                return extensionResult;
+            // begin()'s return value is intentionally unused here: it tracks the pending observation
+            // internally (keyed by toolCall.id) and afterToolCall's complete() call below retrieves it
+            // from there, records observe-mode agreement/hint-efficacy stats, and feeds the durable
+            // evidence-gated promotion surfaced in system-prompt-builder.ts and getReport(). This is
+            // a side-effecting call, not a discarded decision.
+            this.deps.getToolSelectionController?.()?.begin(toolCall.id, toolCall.name, args);
+            return undefined;
+        };
+        this.afterToolCall = async ({ toolCall, args, result, isError }) => {
+            const runner = this.deps.getExtensionRunner();
+            let content = result.content;
+            let details = result.details;
+            let usage = result.usage;
+            let resolvedIsError = isError;
+            if (runner.hasHandlers("tool_result")) {
+                const hookResult = await runner.emitToolResult({
+                    type: "tool_result",
                     toolName: toolCall.name,
                     toolCallId: toolCall.id,
                     input: args,
+                    content,
+                    details,
+                    isError,
+                    usage,
                 });
-            }
-            catch (err) {
-                if (err instanceof Error) {
-                    throw err;
+                if (hookResult) {
+                    content = hookResult.content ?? content;
+                    details = hookResult.details;
+                    resolvedIsError = hookResult.isError ?? isError;
+                    usage = hookResult.usage ?? usage;
                 }
-                throw new Error(`Extension failed, blocking execution: ${String(err)}`);
             }
-        }
-        if (extensionResult)
-            return extensionResult;
-        // begin()'s return value is intentionally unused here: it tracks the pending observation
-        // internally (keyed by toolCall.id) and afterToolCall's complete() call below retrieves it
-        // from there, records observe-mode agreement/hint-efficacy stats, and feeds the durable
-        // evidence-gated promotion surfaced in system-prompt-builder.ts and getReport(). This is
-        // a side-effecting call, not a discarded decision.
-        this.deps.getToolSelectionController?.()?.begin(toolCall.id, toolCall.name, args);
-        return undefined;
-    };
-    afterToolCall = async ({ toolCall, args, result, isError }) => {
-        const runner = this.deps.getExtensionRunner();
-        let content = result.content;
-        let details = result.details;
-        let usage = result.usage;
-        let resolvedIsError = isError;
-        if (runner.hasHandlers("tool_result")) {
-            const hookResult = await runner.emitToolResult({
-                type: "tool_result",
-                toolName: toolCall.name,
-                toolCallId: toolCall.id,
-                input: args,
-                content,
-                details,
-                isError,
-                usage,
-            });
-            if (hookResult) {
-                content = hookResult.content ?? content;
-                details = hookResult.details;
-                resolvedIsError = hookResult.isError ?? isError;
-                usage = hookResult.usage ?? usage;
+            // Untrusted-content boundary: structurally fence output from attacker-controllable sources
+            // (web/search, subagents, recall, third-party tools) so injection payloads are framed as data.
+            // First-party tools (read/grep/find/ls/edit/write/bash) are trusted and pass through unchanged.
+            if (classifyToolTrust(toolCall.name) === "untrusted") {
+                const source = `tool:${toolCall.name}`;
+                const wrapped = content.map((block) => block.type === "text" ? { ...block, text: wrapUntrustedText(block.text, source) } : block);
+                content = wrapped;
             }
-        }
-        // Untrusted-content boundary: structurally fence output from attacker-controllable sources
-        // (web/search, subagents, recall, third-party tools) so injection payloads are framed as data.
-        // First-party tools (read/grep/find/ls/edit/write/bash) are trusted and pass through unchanged.
-        if (classifyToolTrust(toolCall.name) === "untrusted") {
-            const source = `tool:${toolCall.name}`;
-            const wrapped = content.map((block) => block.type === "text" ? { ...block, text: wrapUntrustedText(block.text, source) } : block);
-            content = wrapped;
-        }
-        this.deps.getToolSelectionController?.()?.complete(toolCall.id, !resolvedIsError, content);
-        if (content === result.content &&
-            details === result.details &&
-            resolvedIsError === isError &&
-            usage === result.usage) {
-            return undefined;
-        }
-        return { content, details, isError: resolvedIsError, usage };
-    };
+            this.deps.getToolSelectionController?.()?.complete(toolCall.id, !resolvedIsError, content);
+            if (content === result.content &&
+                details === result.details &&
+                resolvedIsError === isError &&
+                usage === result.usage) {
+                return undefined;
+            }
+            return { content, details, isError: resolvedIsError, usage };
+        };
+        this.deps = deps;
+    }
 }
 //# sourceMappingURL=tool-gate-controller.js.map

package/dist/core/tool-gate-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-gate-controller.js","sourceRoot":"","sources":["../../src/core/tool-gate-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAmBxF,MAAM,OAAO,kBAAkB;IACb,IAAI,CAAyB;IAE9C,YAAY,IAA4B,EAAE;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;IAEQ,cAAc,GAAmB,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACnB,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC;YACnC,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YACvB,QAAQ;SACR,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,UAAU,CAAC,OAAO,KAAK,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACzE,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,4CAA4C,UAAU,CAAC,IAAI,MAAM,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG;aACxH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,eAAiD,CAAC;QACtD,IAAI,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC;gBACJ,eAAe,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;oBAC3C,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,IAA+B;iBACtC,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;oBAC1B,MAAM,GAAG,CAAC;gBACX,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;QACD,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAC5C,yFAAyF;QACzF,2FAA2F;QAC3F,wFAAwF;QACxF,yFAAyF;QACzF,mDAAmD;QACnD,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClF,OAAO,SAAS,CAAC;IAAA,CACjB,CAAC;IAEO,aAAa,GAAkB,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACzB,IAAI,eAAe,GAAG,OAAO,CAAC;QAE9B,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC;gBAC9C,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,KAAK,EAAE,IAA+B;gBACtC,OAAO;gBACP,OAAO;gBACP,OAAO;gBACP,KAAK;aACL,CAAC,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBAChB,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC;gBACxC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;gBAC7B,eAAe,GAAG,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC;gBAChD,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC;YACnC,CAAC;QACF,CAAC;QAED,2FAA2F;QAC3F,+FAA+F;QAC/F,gGAAgG;QAChG,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACrC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CACzF,CAAC;YACF,OAAO,GAAG,OAAO,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC3F,IACC,OAAO,KAAK,MAAM,CAAC,OAAO;YAC1B,OAAO,KAAK,MAAM,CAAC,OAAO;YAC1B,eAAe,KAAK,OAAO;YAC3B,KAAK,KAAK,MAAM,CAAC,KAAK,EACrB,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAAA,CAC7D,CAAC;CACF","sourcesContent":["/**\n * Agent tool-call gate: model-router escalation, autonomy gating, extension tool hooks, and the\n * untrusted-content output boundary.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Provides the two agent-core\n * hooks (`beforeToolCall`/`afterToolCall`) as bound arrow-field members the session installs onto its\n * agent. `beforeToolCall` runs the router escalation, then the autonomy tool gate (recording the\n * outcome when a capability envelope is active), then extension `tool_call` handlers. `afterToolCall`\n * runs extension `tool_result` handlers and structurally fences output from untrusted-content sources.\n */\n\nimport type { Agent, BeforeToolCallResult } from \"@caupulican/pi-agent-core\";\nimport type { CapabilityEnvelope, GateOutcome } from \"./autonomy/contracts.ts\";\nimport { evaluateToolGate } from \"./autonomy/gates.ts\";\nimport type { ExtensionRunner } from \"./extensions/index.ts\";\nimport { classifyToolTrust, wrapUntrustedText } from \"./security/untrusted-boundary.ts\";\nimport type { ToolSelectionController } from \"./tool-selection/tool-selection-controller.ts\";\n\ntype BeforeToolCall = NonNullable<Agent[\"beforeToolCall\"]>;\ntype AfterToolCall = NonNullable<Agent[\"afterToolCall\"]>;\n\nexport interface ToolGateControllerDeps {\n\t/** Router escalation: block a tool the active cheap route is not allowed to run. */\n\tmaybeEscalateToolCall(toolName: string, args: unknown): { block: true; reason: string } | undefined;\n\tgetCwd(): string;\n\t/** Active foreground capability envelope, if any — presence enables gate-outcome recording. */\n\tgetCapabilityEnvelope(): CapabilityEnvelope | undefined;\n\t/** Record an autonomy gate outcome (only when a capability envelope is active). */\n\trecordGateOutcome(outcome: GateOutcome): void;\n\tgetExtensionRunner(): ExtensionRunner;\n\t/** Observe an execution only after all pre-execution gates and extension hooks allow it. */\n\tgetToolSelectionController?(): ToolSelectionController | undefined;\n}\n\nexport class ToolGateController {\n\tprivate readonly deps: ToolGateControllerDeps;\n\n\tconstructor(deps: ToolGateControllerDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\treadonly beforeToolCall: BeforeToolCall = async ({ toolCall, args }) => {\n\t\tconst escalation = this.deps.maybeEscalateToolCall(toolCall.name, args);\n\t\tif (escalation) {\n\t\t\treturn escalation;\n\t\t}\n\n\t\t// Autonomy tool gating\n\t\tconst envelope = this.deps.getCapabilityEnvelope();\n\t\tconst gateResult = evaluateToolGate({\n\t\t\ttoolName: toolCall.name,\n\t\t\targs,\n\t\t\tcwd: this.deps.getCwd(),\n\t\t\tenvelope,\n\t\t});\n\n\t\tif (envelope) {\n\t\t\tthis.deps.recordGateOutcome(gateResult);\n\t\t}\n\n\t\tif (gateResult.outcome === \"block\" || gateResult.outcome === \"ask-user\") {\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Tool execution blocked by autonomy gate [${gateResult.gate}]: ${gateResult.message} (${gateResult.reasonCode})`,\n\t\t\t};\n\t\t}\n\n\t\tconst runner = this.deps.getExtensionRunner();\n\t\tlet extensionResult: BeforeToolCallResult | undefined;\n\t\tif (runner.hasHandlers(\"tool_call\")) {\n\t\t\ttry {\n\t\t\t\textensionResult = await runner.emitToolCall({\n\t\t\t\t\ttype: \"tool_call\",\n\t\t\t\t\ttoolName: toolCall.name,\n\t\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\t\tinput: args as Record<string, unknown>,\n\t\t\t\t});\n\t\t\t} catch (err) {\n\t\t\t\tif (err instanceof Error) {\n\t\t\t\t\tthrow err;\n\t\t\t\t}\n\t\t\t\tthrow new Error(`Extension failed, blocking execution: ${String(err)}`);\n\t\t\t}\n\t\t}\n\t\tif (extensionResult) return extensionResult;\n\t\t// begin()'s return value is intentionally unused here: it tracks the pending observation\n\t\t// internally (keyed by toolCall.id) and afterToolCall's complete() call below retrieves it\n\t\t// from there, records observe-mode agreement/hint-efficacy stats, and feeds the durable\n\t\t// evidence-gated promotion surfaced in system-prompt-builder.ts and getReport(). This is\n\t\t// a side-effecting call, not a discarded decision.\n\t\tthis.deps.getToolSelectionController?.()?.begin(toolCall.id, toolCall.name, args);\n\t\treturn undefined;\n\t};\n\n\treadonly afterToolCall: AfterToolCall = async ({ toolCall, args, result, isError }) => {\n\t\tconst runner = this.deps.getExtensionRunner();\n\t\tlet content = result.content;\n\t\tlet details = result.details;\n\t\tlet usage = result.usage;\n\t\tlet resolvedIsError = isError;\n\n\t\tif (runner.hasHandlers(\"tool_result\")) {\n\t\t\tconst hookResult = await runner.emitToolResult({\n\t\t\t\ttype: \"tool_result\",\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\tinput: args as Record<string, unknown>,\n\t\t\t\tcontent,\n\t\t\t\tdetails,\n\t\t\t\tisError,\n\t\t\t\tusage,\n\t\t\t});\n\t\t\tif (hookResult) {\n\t\t\t\tcontent = hookResult.content ?? content;\n\t\t\t\tdetails = hookResult.details;\n\t\t\t\tresolvedIsError = hookResult.isError ?? isError;\n\t\t\t\tusage = hookResult.usage ?? usage;\n\t\t\t}\n\t\t}\n\n\t\t// Untrusted-content boundary: structurally fence output from attacker-controllable sources\n\t\t// (web/search, subagents, recall, third-party tools) so injection payloads are framed as data.\n\t\t// First-party tools (read/grep/find/ls/edit/write/bash) are trusted and pass through unchanged.\n\t\tif (classifyToolTrust(toolCall.name) === \"untrusted\") {\n\t\t\tconst source = `tool:${toolCall.name}`;\n\t\t\tconst wrapped = content.map((block) =>\n\t\t\t\tblock.type === \"text\" ? { ...block, text: wrapUntrustedText(block.text, source) } : block,\n\t\t\t);\n\t\t\tcontent = wrapped;\n\t\t}\n\n\t\tthis.deps.getToolSelectionController?.()?.complete(toolCall.id, !resolvedIsError, content);\n\t\tif (\n\t\t\tcontent === result.content &&\n\t\t\tdetails === result.details &&\n\t\t\tresolvedIsError === isError &&\n\t\t\tusage === result.usage\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn { content, details, isError: resolvedIsError, usage };\n\t};\n}\n"]}
+{"version":3,"file":"tool-gate-controller.js","sourceRoot":"","sources":["../../src/core/tool-gate-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAmBxF,MAAM,OAAO,kBAAkB;IAG9B,YAAY,IAA4B;QAI/B,mBAAc,GAAmB,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxE,IAAI,UAAU,EAAE,CAAC;gBAChB,OAAO,UAAU,CAAC;YACnB,CAAC;YAED,uBAAuB;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC;gBACnC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI;gBACJ,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACvB,QAAQ;aACR,CAAC,CAAC;YAEH,IAAI,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC;YAED,IAAI,UAAU,CAAC,OAAO,KAAK,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBACzE,OAAO;oBACN,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,4CAA4C,UAAU,CAAC,IAAI,MAAM,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG;iBACxH,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC9C,IAAI,eAAiD,CAAC;YACtD,IAAI,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACJ,eAAe,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;wBAC3C,IAAI,EAAE,WAAW;wBACjB,QAAQ,EAAE,QAAQ,CAAC,IAAI;wBACvB,UAAU,EAAE,QAAQ,CAAC,EAAE;wBACvB,KAAK,EAAE,IAA+B;qBACtC,CAAC,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;wBAC1B,MAAM,GAAG,CAAC;oBACX,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzE,CAAC;YACF,CAAC;YACD,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAC;YAC5C,yFAAyF;YACzF,2FAA2F;YAC3F,wFAAwF;YACxF,yFAAyF;YACzF,mDAAmD;YACnD,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClF,OAAO,SAAS,CAAC;QAClB,CAAC,CAAC;QAEO,kBAAa,GAAkB,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YACrF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC9C,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC7B,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC7B,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACzB,IAAI,eAAe,GAAG,OAAO,CAAC;YAE9B,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;gBACvC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC;oBAC9C,IAAI,EAAE,aAAa;oBACnB,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,KAAK,EAAE,IAA+B;oBACtC,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,KAAK;iBACL,CAAC,CAAC;gBACH,IAAI,UAAU,EAAE,CAAC;oBAChB,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC;oBACxC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;oBAC7B,eAAe,GAAG,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC;oBAChD,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC;gBACnC,CAAC;YACF,CAAC;YAED,2FAA2F;YAC3F,+FAA+F;YAC/F,gGAAgG;YAChG,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;gBACtD,MAAM,MAAM,GAAG,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACrC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CACzF,CAAC;gBACF,OAAO,GAAG,OAAO,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC3F,IACC,OAAO,KAAK,MAAM,CAAC,OAAO;gBAC1B,OAAO,KAAK,MAAM,CAAC,OAAO;gBAC1B,eAAe,KAAK,OAAO;gBAC3B,KAAK,KAAK,MAAM,CAAC,KAAK,EACrB,CAAC;gBACF,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9D,CAAC,CAAC;QAvGD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CAuGD","sourcesContent":["/**\n * Agent tool-call gate: model-router escalation, autonomy gating, extension tool hooks, and the\n * untrusted-content output boundary.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Provides the two agent-core\n * hooks (`beforeToolCall`/`afterToolCall`) as bound arrow-field members the session installs onto its\n * agent. `beforeToolCall` runs the router escalation, then the autonomy tool gate (recording the\n * outcome when a capability envelope is active), then extension `tool_call` handlers. `afterToolCall`\n * runs extension `tool_result` handlers and structurally fences output from untrusted-content sources.\n */\n\nimport type { Agent, BeforeToolCallResult } from \"@caupulican/pi-agent-core\";\nimport type { CapabilityEnvelope, GateOutcome } from \"./autonomy/contracts.ts\";\nimport { evaluateToolGate } from \"./autonomy/gates.ts\";\nimport type { ExtensionRunner } from \"./extensions/index.ts\";\nimport { classifyToolTrust, wrapUntrustedText } from \"./security/untrusted-boundary.ts\";\nimport type { ToolSelectionController } from \"./tool-selection/tool-selection-controller.ts\";\n\ntype BeforeToolCall = NonNullable<Agent[\"beforeToolCall\"]>;\ntype AfterToolCall = NonNullable<Agent[\"afterToolCall\"]>;\n\nexport interface ToolGateControllerDeps {\n\t/** Router escalation: block a tool the active cheap route is not allowed to run. */\n\tmaybeEscalateToolCall(toolName: string, args: unknown): { block: true; reason: string } | undefined;\n\tgetCwd(): string;\n\t/** Active foreground capability envelope, if any — presence enables gate-outcome recording. */\n\tgetCapabilityEnvelope(): CapabilityEnvelope | undefined;\n\t/** Record an autonomy gate outcome (only when a capability envelope is active). */\n\trecordGateOutcome(outcome: GateOutcome): void;\n\tgetExtensionRunner(): ExtensionRunner;\n\t/** Observe an execution only after all pre-execution gates and extension hooks allow it. */\n\tgetToolSelectionController?(): ToolSelectionController | undefined;\n}\n\nexport class ToolGateController {\n\tprivate readonly deps: ToolGateControllerDeps;\n\n\tconstructor(deps: ToolGateControllerDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\treadonly beforeToolCall: BeforeToolCall = async ({ toolCall, args }) => {\n\t\tconst escalation = this.deps.maybeEscalateToolCall(toolCall.name, args);\n\t\tif (escalation) {\n\t\t\treturn escalation;\n\t\t}\n\n\t\t// Autonomy tool gating\n\t\tconst envelope = this.deps.getCapabilityEnvelope();\n\t\tconst gateResult = evaluateToolGate({\n\t\t\ttoolName: toolCall.name,\n\t\t\targs,\n\t\t\tcwd: this.deps.getCwd(),\n\t\t\tenvelope,\n\t\t});\n\n\t\tif (envelope) {\n\t\t\tthis.deps.recordGateOutcome(gateResult);\n\t\t}\n\n\t\tif (gateResult.outcome === \"block\" || gateResult.outcome === \"ask-user\") {\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Tool execution blocked by autonomy gate [${gateResult.gate}]: ${gateResult.message} (${gateResult.reasonCode})`,\n\t\t\t};\n\t\t}\n\n\t\tconst runner = this.deps.getExtensionRunner();\n\t\tlet extensionResult: BeforeToolCallResult | undefined;\n\t\tif (runner.hasHandlers(\"tool_call\")) {\n\t\t\ttry {\n\t\t\t\textensionResult = await runner.emitToolCall({\n\t\t\t\t\ttype: \"tool_call\",\n\t\t\t\t\ttoolName: toolCall.name,\n\t\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\t\tinput: args as Record<string, unknown>,\n\t\t\t\t});\n\t\t\t} catch (err) {\n\t\t\t\tif (err instanceof Error) {\n\t\t\t\t\tthrow err;\n\t\t\t\t}\n\t\t\t\tthrow new Error(`Extension failed, blocking execution: ${String(err)}`);\n\t\t\t}\n\t\t}\n\t\tif (extensionResult) return extensionResult;\n\t\t// begin()'s return value is intentionally unused here: it tracks the pending observation\n\t\t// internally (keyed by toolCall.id) and afterToolCall's complete() call below retrieves it\n\t\t// from there, records observe-mode agreement/hint-efficacy stats, and feeds the durable\n\t\t// evidence-gated promotion surfaced in system-prompt-builder.ts and getReport(). This is\n\t\t// a side-effecting call, not a discarded decision.\n\t\tthis.deps.getToolSelectionController?.()?.begin(toolCall.id, toolCall.name, args);\n\t\treturn undefined;\n\t};\n\n\treadonly afterToolCall: AfterToolCall = async ({ toolCall, args, result, isError }) => {\n\t\tconst runner = this.deps.getExtensionRunner();\n\t\tlet content = result.content;\n\t\tlet details = result.details;\n\t\tlet usage = result.usage;\n\t\tlet resolvedIsError = isError;\n\n\t\tif (runner.hasHandlers(\"tool_result\")) {\n\t\t\tconst hookResult = await runner.emitToolResult({\n\t\t\t\ttype: \"tool_result\",\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\tinput: args as Record<string, unknown>,\n\t\t\t\tcontent,\n\t\t\t\tdetails,\n\t\t\t\tisError,\n\t\t\t\tusage,\n\t\t\t});\n\t\t\tif (hookResult) {\n\t\t\t\tcontent = hookResult.content ?? content;\n\t\t\t\tdetails = hookResult.details;\n\t\t\t\tresolvedIsError = hookResult.isError ?? isError;\n\t\t\t\tusage = hookResult.usage ?? usage;\n\t\t\t}\n\t\t}\n\n\t\t// Untrusted-content boundary: structurally fence output from attacker-controllable sources\n\t\t// (web/search, subagents, recall, third-party tools) so injection payloads are framed as data.\n\t\t// First-party tools (read/grep/find/ls/edit/write/bash) are trusted and pass through unchanged.\n\t\tif (classifyToolTrust(toolCall.name) === \"untrusted\") {\n\t\t\tconst source = `tool:${toolCall.name}`;\n\t\t\tconst wrapped = content.map((block) =>\n\t\t\t\tblock.type === \"text\" ? { ...block, text: wrapUntrustedText(block.text, source) } : block,\n\t\t\t);\n\t\t\tcontent = wrapped;\n\t\t}\n\n\t\tthis.deps.getToolSelectionController?.()?.complete(toolCall.id, !resolvedIsError, content);\n\t\tif (\n\t\t\tcontent === result.content &&\n\t\t\tdetails === result.details &&\n\t\t\tresolvedIsError === isError &&\n\t\t\tusage === result.usage\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn { content, details, isError: resolvedIsError, usage };\n\t};\n}\n"]}

package/dist/core/tool-protocol-controller.d.ts

@@ -1,5 +1,7 @@
 import type { Agent, StreamFn } from "@caupulican/pi-agent-core";
-import type { Api, AssistantMessage, Model, TextToolProtocolParseEvent, TextToolProtocolVariant, ToolArgumentValidationTelemetryEvent, Usage } from "@caupulican/pi-ai";
+import { type TextToolProtocolVariant } from "@caupulican/pi-ai/text-tool-protocol";
+import type { Api, AssistantMessage, Model, TextToolProtocolParseEvent, Usage } from "@caupulican/pi-ai/types";
+import type { ToolArgumentValidationTelemetryEvent } from "@caupulican/pi-ai/validation";
 import type { ModelRegistry } from "./model-registry.ts";
 import { type ModelToolProtocolResolution } from "./model-tool-protocol.ts";
 import type { ModelAdaptationRule, ModelAdaptationStore, ModelToolProbeVerdict, NativeToolProbeGrade } from "./models/adaptation-store.ts";
@@ -73,6 +75,7 @@ export declare class ToolProtocolController {
     private textProtocolCalibrationContext;
     private messageHasToolCallWithStringArgument;
     private nativeToolProbeSystemPrompt;
+    private runNativeToolProbeTrial;
     private runNativeReadTaskProbeTrial;
     private runNativeEchoToolProbeTrial;
     private gradeNativeToolCallingForModel;

package/dist/core/tool-protocol-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-protocol-controller.d.ts","sourceRoot":"","sources":["../../src/core/tool-protocol-controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EACX,GAAG,EACH,gBAAgB,EAGhB,KAAK,EAGL,0BAA0B,EAC1B,uBAAuB,EAEvB,oCAAoC,EAEpC,KAAK,EACL,MAAM,mBAAmB,CAAC;AAU3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEN,KAAK,2BAA2B,EAEhC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACX,mBAAmB,EACnB,oBAAoB,EAEpB,qBAAqB,EACrB,oBAAoB,EACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAoBzE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,eAAe,GAAG,MAAM,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,0BAA0B;IAC1C,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,gBAAgB,IAAI,aAAa,CAAC;IAClC,eAAe,EAAE,oBAAoB,CAAC;IACtC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChE,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,wBAAwB,IAAI,gBAAgB,GAAG,SAAS,CAAC;IACzD,UAAU,IAAI,OAAO,CAAC;IACtB,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D;AAED,0FAA0F;AAC1F,qBAAa,sBAAsB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA6B;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6D;IAC3F,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,yBAAyB,CAAyC;IAC1E,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAElD,YAAY,IAAI,EAAE,0BAA0B,EAE3C;IAED,wBAAwB,IAAI,IAAI,CAE/B;IAED,cAAc,IAAI,IAAI,CAGrB;IAED,2BAA2B,IAAI,mBAAmB,EAAE,CAInD;IAED,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,2BAA2B,CAMvE;IAEK,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB/C;IAED,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,qBAAqB,GAAG,SAAS,CAExE;IAEK,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAMhE;IAEK,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAkD1E;IAED,uBAAuB,CAAC,KAAK,EAAE,0BAA0B,GAAG,IAAI,CAgC/D;IAED,uBAAuB,CAAC,KAAK,EAAE,oCAAoC,GAAG,IAAI,CAkBzE;IAED,mCAAmC,IAAI,IAAI,CAmC1C;IAED,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,GAAG,oCAAoC,CAe3G;IAED,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,GAAG,IAAI,CAsC3E;IAED,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAwBtC;IAED,kBAAkB,CAAC,KAAK,CAAC,EAAE,uBAAuB,GAAG,MAAM,CAE1D;IAED,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;IAED,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI/C;IAED,iBAAiB,mEAEhB;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,QAAQ;YAIF,cAAc;IAa5B,OAAO,CAAC,sBAAsB;YAIhB,+BAA+B;IAa7C,OAAO,CAAC,8BAA8B;IAStC,OAAO,CAAC,oCAAoC;IAkB5C,OAAO,CAAC,2BAA2B;YAKrB,2BAA2B;YAqB3B,2BAA2B;YAqB3B,8BAA8B;YAe9B,oBAAoB;YA0BpB,iCAAiC;IA0C/C,OAAO,CAAC,qBAAqB;IAoB7B,OAAO,CAAC,cAAc;YAIR,sBAAsB;IAapC,OAAO,CAAC,0BAA0B;IAWlC,OAAO,CAAC,4BAA4B;IAIpC,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,wBAAwB;CAMhC","sourcesContent":["import { rmSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { Agent, StreamFn } from \"@caupulican/pi-agent-core\";\nimport type {\n\tApi,\n\tAssistantMessage,\n\tAssistantMessageEventStream,\n\tContext,\n\tModel,\n\tSimpleStreamOptions,\n\tTextContent,\n\tTextToolProtocolParseEvent,\n\tTextToolProtocolVariant,\n\tTool,\n\tToolArgumentValidationTelemetryEvent,\n\tToolRepairModeName,\n\tUsage,\n} from \"@caupulican/pi-ai\";\nimport {\n\tformatToolRepairStandingRule,\n\tformatVariantEnvelope,\n\tgenerateTextToolProtocolPrimer,\n\tparseTextToolCalls,\n\tTEXT_TOOL_PROTOCOL_VARIANTS,\n} from \"@caupulican/pi-ai\";\nimport { Type } from \"typebox\";\nimport { getProcessWorkRun } from \"../utils/work-directory.ts\";\nimport type { ModelRegistry } from \"./model-registry.ts\";\nimport {\n\tMODEL_TOOL_PROTOCOL_VERSION,\n\ttype ModelToolProtocolResolution,\n\tresolveModelToolProtocol,\n} from \"./model-tool-protocol.ts\";\nimport type {\n\tModelAdaptationRule,\n\tModelAdaptationStore,\n\tModelToolProbe,\n\tModelToolProbeVerdict,\n\tNativeToolProbeGrade,\n} from \"./models/adaptation-store.ts\";\nimport type { RequestAuth } from \"./request-auth.ts\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport type { ToolRecoveryLoggerStats } from \"./tool-recovery-logger.ts\";\nimport { formatToolRepairHealthReport } from \"./tool-repair-health.ts\";\nimport { resolveCurrentToolRepairSettings } from \"./tool-repair-settings.ts\";\n\nconst MODEL_ADAPTATION_REPAIR_THRESHOLD = 3;\nconst TEXT_TOOL_PROTOCOL_TRIALS_PER_VARIANT = 2;\nconst TEXT_TOOL_PROTOCOL_PARSE_FAILURE_THRESHOLD = 3;\nconst TEXT_TOOL_PROTOCOL_STEER_INTERVAL = 5;\nconst AUTO_TOOL_PROBE_FRESHNESS_MS = 15 * 60 * 1000;\nconst TEXT_TOOL_PROTOCOL_ECHO_TOOL = {\n\tname: \"echo\",\n\tdescription: \"Echo calibration data\",\n\tparameters: Type.Object({ data: Type.String() }),\n} satisfies Tool;\nconst NATIVE_TOOL_PROBE_READ_TOOL = {\n\tname: \"read\",\n\tdescription: \"Read file contents\",\n\tparameters: Type.Object({ path: Type.String() }),\n} satisfies Tool;\n\nexport type ToolProbeVerdict = \"native\" | \"text-protocol\" | \"none\";\n\nexport interface ToolProbeResult {\n\tmodel: string;\n\tverdict: ToolProbeVerdict;\n\tvariant?: TextToolProtocolVariant;\n\tnativeGrade?: NativeToolProbeGrade;\n\tdiagnostic?: string;\n}\n\nexport interface ToolProbeReport {\n\tresults: ToolProbeResult[];\n\ttable: string;\n}\n\nexport interface ToolProtocolControllerDeps {\n\tagent: Agent;\n\tagentDir: string;\n\tsettingsManager: SettingsManager;\n\tgetModelRegistry(): ModelRegistry;\n\tadaptationStore: ModelAdaptationStore;\n\tisRawStreamSimple(fn: StreamFn): boolean;\n\tgetRequiredRequestAuth(model: Model<Api>): Promise<RequestAuth>;\n\taddSpawnedUsage(usage: Usage, opts: { label?: string; reportId: string }): string | undefined;\n\temitWarning(message: string): void;\n\tsendCorrectiveSteer(message: string): Promise<void>;\n\tfindLastAssistantMessage(): AssistantMessage | undefined;\n\tisDisposed(): boolean;\n\tprobeForAuto(model: Model<Api>): Promise<ToolProbeResult>;\n}\n\n/** Owns model tool-protocol selection, probing, circuit breaking, and repair teaching. */\nexport class ToolProtocolController {\n\tprivate readonly repairModeSessionCounts = new Map<string, number>();\n\tprivate readonly parseFailures = new Map<string, { signature: string; repeats: number }>();\n\tprivate parseObservedThisTurn = false;\n\tprivate correctiveSteerCount = 0;\n\tprivate probeUsageReportSeq = 0;\n\tprivate readonly autoProbedModels = new Set<string>();\n\tprivate validationOutcomeThisTurn: TextToolProtocolParseEvent | undefined;\n\tprivate readonly deps: ToolProtocolControllerDeps;\n\n\tconstructor(deps: ToolProtocolControllerDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\tapplyRepairLayerSettings(): void {\n\t\tthis.deps.agent.toolArgumentTeachEnabled = this.getRepairSettings().teach;\n\t}\n\n\tresetTurnState(): void {\n\t\tthis.parseObservedThisTurn = false;\n\t\tthis.validationOutcomeThisTurn = undefined;\n\t}\n\n\tgetAdaptationRulesForPrompt(): ModelAdaptationRule[] {\n\t\tif (!this.getRepairSettings().teach) return [];\n\t\tconst modelKey = this.modelKey(this.deps.agent.state.model);\n\t\treturn modelKey ? this.deps.adaptationStore.get(modelKey).rules : [];\n\t}\n\n\tresolveModelToolProtocol(model: Model<Api>): ModelToolProtocolResolution {\n\t\treturn resolveModelToolProtocol({\n\t\t\tmodel,\n\t\t\tsettingsOverride: this.getRepairSettings().textProtocol,\n\t\t\tadaptation: this.deps.adaptationStore.get(this.modelRef(model)),\n\t\t});\n\t}\n\n\tasync ensureActiveModelProtocol(): Promise<void> {\n\t\tconst model = this.deps.agent.state.model;\n\t\tconst resolution = this.resolveModelToolProtocol(model);\n\t\tthis.deps.agent.textToolCallProtocol = resolution.protocol;\n\t\tif (\n\t\t\tresolution.reasonCode !== \"probe_calibration_missing\" &&\n\t\t\tresolution.reasonCode !== \"probe_calibration_failed\" &&\n\t\t\tresolution.reasonCode !== \"probe_calibration_invalid\"\n\t\t) {\n\t\t\treturn;\n\t\t}\n\t\tconst modelKey = this.modelRef(model);\n\t\tthis.deps.emitWarning(\n\t\t\tresolution.reasonCode === \"probe_calibration_failed\"\n\t\t\t\t? `Text tool protocol calibration for ${modelKey} previously failed (variants tried: ${(resolution.variantsTried ?? []).join(\", \")}); falling back to native tool calls this turn. Run /toolprobe ${modelKey} to recalibrate.`\n\t\t\t\t: `Text tool protocol for ${modelKey} has no valid calibration on record; falling back to native tool calls this turn. Run /toolprobe ${modelKey} to calibrate.`,\n\t\t);\n\t}\n\n\tgetToolProbeVerdict(model: Model<Api>): ModelToolProbeVerdict | undefined {\n\t\treturn this.deps.adaptationStore.get(this.modelRef(model)).toolProbe?.status;\n\t}\n\n\tasync probeToolCalling(target?: string): Promise<ToolProbeReport> {\n\t\tconst models = await this.resolveToolProbeModels(target);\n\t\tif (models.length === 0) throw new Error(\"No available models to probe.\");\n\t\tconst results: ToolProbeResult[] = [];\n\t\tfor (const model of models) results.push(await this.probeToolCallingForModel(model));\n\t\treturn { results, table: this.formatToolProbeReport(results) };\n\t}\n\n\tasync probeToolCallingForModel(model: Model<Api>): Promise<ToolProbeResult> {\n\t\tconst modelKey = this.modelRef(model);\n\t\tconst probedAt = new Date().toISOString();\n\t\tlet nativeGrade: NativeToolProbeGrade = \"absent\";\n\t\tlet diagnostic: string | undefined;\n\t\ttry {\n\t\t\tnativeGrade = await this.gradeNativeToolCallingForModel(model, \"pi-native-probe\");\n\t\t\tif (nativeGrade === \"task\") {\n\t\t\t\tthis.storeToolProbe(modelKey, {\n\t\t\t\t\tversion: MODEL_TOOL_PROTOCOL_VERSION,\n\t\t\t\t\tstatus: \"native\",\n\t\t\t\t\tprobedAt,\n\t\t\t\t\tnativeGrade,\n\t\t\t\t});\n\t\t\t\treturn { model: modelKey, verdict: \"native\", nativeGrade };\n\t\t\t}\n\t\t\tdiagnostic =\n\t\t\t\tnativeGrade === \"echo-only\"\n\t\t\t\t\t? \"Native echo probe passed but task-scale read probe failed.\"\n\t\t\t\t\t: \"Native task-scale read and echo probes did not produce provider-native tool calls.\";\n\t\t} catch (error) {\n\t\t\tdiagnostic = error instanceof Error ? error.message : String(error);\n\t\t}\n\n\t\ttry {\n\t\t\tconst calibrated = await this.calibrateTextToolProtocolForModel(model, modelKey, { persistFailure: false });\n\t\t\tif (calibrated.status === \"calibrated\") {\n\t\t\t\tthis.storeToolProbe(modelKey, {\n\t\t\t\t\tversion: MODEL_TOOL_PROTOCOL_VERSION,\n\t\t\t\t\tstatus: \"text-protocol\",\n\t\t\t\t\tprobedAt: calibrated.calibratedAt,\n\t\t\t\t\tvariant: calibrated.variant,\n\t\t\t\t\tnativeGrade,\n\t\t\t\t\tdiagnostic,\n\t\t\t\t});\n\t\t\t\treturn { model: modelKey, verdict: \"text-protocol\", variant: calibrated.variant, nativeGrade, diagnostic };\n\t\t\t}\n\t\t\tdiagnostic = `${diagnostic ? `${diagnostic} ` : \"\"}Text protocol variants failed: ${calibrated.variantsTried.join(\", \")}`;\n\t\t} catch (error) {\n\t\t\tdiagnostic = error instanceof Error ? error.message : String(error);\n\t\t}\n\n\t\tthis.storeToolProbe(modelKey, {\n\t\t\tversion: MODEL_TOOL_PROTOCOL_VERSION,\n\t\t\tstatus: \"none\",\n\t\t\tprobedAt,\n\t\t\tnativeGrade,\n\t\t\tdiagnostic,\n\t\t});\n\t\treturn { model: modelKey, verdict: \"none\", nativeGrade, diagnostic };\n\t}\n\n\thandleTextProtocolParse(event: TextToolProtocolParseEvent): void {\n\t\tthis.parseObservedThisTurn = true;\n\t\tconst modelKey = `${event.provider}/${event.model}`;\n\t\tif (event.status === \"parsed\") return;\n\t\tthis.maybeInjectCorrectiveSteer(event.variant);\n\t\tconst signature = `${event.variant}:${event.reason ?? \"failed\"}`;\n\t\tconst previous = this.parseFailures.get(modelKey);\n\t\tconst repeats = previous?.signature === signature ? previous.repeats + 1 : 1;\n\t\tthis.parseFailures.set(modelKey, { signature, repeats });\n\t\tif (repeats < TEXT_TOOL_PROTOCOL_PARSE_FAILURE_THRESHOLD) return;\n\n\t\tconst profile = this.deps.adaptationStore.get(modelKey);\n\t\tif (profile.protocol?.version === MODEL_TOOL_PROTOCOL_VERSION && profile.protocol.status !== \"failed\") {\n\t\t\tthis.deps.adaptationStore.removeProtocol(modelKey);\n\t\t\tthis.deps.agent.textToolCallProtocol = undefined;\n\t\t}\n\t\tthis.parseFailures.delete(modelKey);\n\t\tconst probedAt = new Date().toISOString();\n\t\tthis.deps.adaptationStore.setToolProbe(\n\t\t\tmodelKey,\n\t\t\t{\n\t\t\t\tversion: MODEL_TOOL_PROTOCOL_VERSION,\n\t\t\t\tstatus: \"none\",\n\t\t\t\tprobedAt,\n\t\t\t\tnativeGrade: profile.toolProbe?.nativeGrade,\n\t\t\t\tdiagnostic: `Text protocol parsing failed ${TEXT_TOOL_PROTOCOL_PARSE_FAILURE_THRESHOLD}x in a row with signature \"${signature}\".`,\n\t\t\t},\n\t\t\tprobedAt,\n\t\t);\n\t\tthis.deps.emitWarning(\n\t\t\t`Text tool protocol for ${modelKey} stopped parsing after ${TEXT_TOOL_PROTOCOL_PARSE_FAILURE_THRESHOLD} attempts; demoted to native fallback. Run /toolprobe ${modelKey} to recalibrate.`,\n\t\t);\n\t}\n\n\thandleValidationOutcome(event: ToolArgumentValidationTelemetryEvent): void {\n\t\tif (event.source !== \"text-protocol\") return;\n\t\tconst protocol = this.deps.agent.textToolCallProtocol;\n\t\tconst variant = protocol === true ? \"tool-tag\" : protocol ? protocol.variant : undefined;\n\t\tif (!variant) return;\n\t\tconst status = event.outcome === \"bounced\" ? \"failed\" : \"parsed\";\n\t\tif (this.validationOutcomeThisTurn?.status === \"parsed\" && status === \"failed\") return;\n\t\tthis.validationOutcomeThisTurn = {\n\t\t\tprovider: event.provider ?? this.deps.agent.state.model.provider,\n\t\t\tmodel: event.model ?? this.deps.agent.state.model.id,\n\t\t\tvariant,\n\t\t\tstatus,\n\t\t\tcallCount: 1,\n\t\t\ttextLength: 0,\n\t\t\t...(status === \"failed\" && {\n\t\t\t\treason: event.errorKeywords?.includes(\"unknown_tool\") ? \"unknown-tool\" : \"validation-failed\",\n\t\t\t}),\n\t\t};\n\t}\n\n\trecordParseOutcomeFromLastAssistant(): void {\n\t\tconst validationOutcome = this.validationOutcomeThisTurn;\n\t\tthis.validationOutcomeThisTurn = undefined;\n\t\tif (validationOutcome?.status === \"parsed\") {\n\t\t\tthis.parseObservedThisTurn = true;\n\t\t\tthis.parseFailures.delete(`${validationOutcome.provider}/${validationOutcome.model}`);\n\t\t\treturn;\n\t\t}\n\t\tif (validationOutcome) {\n\t\t\tthis.handleTextProtocolParse(validationOutcome);\n\t\t\treturn;\n\t\t}\n\t\tif (this.parseObservedThisTurn) return;\n\t\tconst protocol = this.deps.agent.textToolCallProtocol;\n\t\tif (protocol === false || protocol === true || !protocol?.variant) return;\n\t\tconst response = this.deps.findLastAssistantMessage();\n\t\tif (!response) return;\n\t\tconst responseText = response.content\n\t\t\t.filter((content): content is TextContent => content.type === \"text\")\n\t\t\t.map((content) => content.text)\n\t\t\t.join(\"\\n\");\n\t\tif (!responseText) return;\n\n\t\tconst parsed = parseTextToolCalls(responseText, this.deps.agent.state.tools);\n\t\tconst attempted = parsed.attempted || this.looksLikeTextProtocolAttempt(responseText);\n\t\tif (!attempted) return;\n\t\tthis.handleTextProtocolParse({\n\t\t\tprovider: this.deps.agent.state.model.provider,\n\t\t\tmodel: this.deps.agent.state.model.id,\n\t\t\tvariant: protocol.variant,\n\t\t\tstatus: parsed.calls.length > 0 ? \"parsed\" : \"failed\",\n\t\t\treason: parsed.failure,\n\t\t\tcallCount: parsed.calls.length,\n\t\t\ttextLength: responseText.length,\n\t\t});\n\t}\n\n\ttagAdaptationRuleTeaching(event: ToolArgumentValidationTelemetryEvent): ToolArgumentValidationTelemetryEvent {\n\t\tif (!this.getRepairSettings().teach || event.taught !== \"none\") return event;\n\t\tconst modelKey =\n\t\t\tevent.provider && event.model\n\t\t\t\t? `${event.provider}/${event.model}`\n\t\t\t\t: this.modelKey(this.deps.agent.state.model);\n\t\tif (!modelKey) return event;\n\t\ttry {\n\t\t\tconst rules = this.deps.adaptationStore.get(modelKey).rules;\n\t\t\tconst modes = new Set([...event.failureModes, ...event.repairsApplied]);\n\t\t\tif (rules.some((rule) => modes.has(rule.mode as ToolRepairModeName))) return { ...event, taught: \"rule\" };\n\t\t} catch {\n\t\t\t// Best-effort telemetry tagging.\n\t\t}\n\t\treturn event;\n\t}\n\n\thandleAdaptationTelemetry(event: ToolArgumentValidationTelemetryEvent): void {\n\t\tif (!this.getRepairSettings().teach || event.outcome !== \"repaired\" || event.repairsApplied.length === 0) return;\n\t\tconst modelKey =\n\t\t\tevent.provider && event.model\n\t\t\t\t? `${event.provider}/${event.model}`\n\t\t\t\t: this.modelKey(this.deps.agent.state.model);\n\t\tif (!modelKey) return;\n\t\ttry {\n\t\t\tfor (const mode of [...new Set(event.repairsApplied)]) {\n\t\t\t\tconst profile = this.deps.adaptationStore.get(modelKey);\n\t\t\t\tconst stats = profile.teachStats[mode] ?? { taught: 0, recurrenceBefore: 0, recurrenceAfter: 0 };\n\t\t\t\tif (profile.rules.some((rule) => rule.mode === mode)) {\n\t\t\t\t\tthis.deps.adaptationStore.markRuleFired(modelKey, mode);\n\t\t\t\t\tthis.deps.adaptationStore.setTeachStats(modelKey, mode, {\n\t\t\t\t\t\t...stats,\n\t\t\t\t\t\trecurrenceAfter: stats.recurrenceAfter + 1,\n\t\t\t\t\t});\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst recurrenceBefore = stats.recurrenceBefore + 1;\n\t\t\t\tthis.deps.adaptationStore.setTeachStats(modelKey, mode, { ...stats, recurrenceBefore });\n\t\t\t\tconst sessionCount = this.repairSessionCount(modelKey, mode);\n\t\t\t\tif (\n\t\t\t\t\tsessionCount >= MODEL_ADAPTATION_REPAIR_THRESHOLD ||\n\t\t\t\t\trecurrenceBefore >= MODEL_ADAPTATION_REPAIR_THRESHOLD\n\t\t\t\t) {\n\t\t\t\t\tthis.deps.adaptationStore.addRule(modelKey, { mode, text: formatToolRepairStandingRule(mode) });\n\t\t\t\t\tthis.deps.adaptationStore.setTeachStats(modelKey, mode, {\n\t\t\t\t\t\t...stats,\n\t\t\t\t\t\ttaught: stats.taught + 1,\n\t\t\t\t\t\trecurrenceBefore,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t} catch {\n\t\t\t// Best-effort adaptation persistence.\n\t\t}\n\t}\n\n\tmaybeAutoProbe(model: Model<Api>): void {\n\t\tconst modelKey = this.modelRef(model);\n\t\tif (this.autoProbedModels.has(modelKey) || this.hasFreshToolProbeVerdict(modelKey)) return;\n\t\tthis.autoProbedModels.add(modelKey);\n\t\tvoid this.deps\n\t\t\t.probeForAuto(model)\n\t\t\t.then((result) => {\n\t\t\t\tif (this.deps.isDisposed()) return;\n\t\t\t\tconst detail =\n\t\t\t\t\tresult.verdict === \"text-protocol\"\n\t\t\t\t\t\t? ` (variant ${result.variant}); it will use the text tool protocol starting next turn`\n\t\t\t\t\t\t: result.verdict === \"none\"\n\t\t\t\t\t\t\t? \" — no working tool-call path was found; run /toolprobe for details\"\n\t\t\t\t\t\t\t: \"; native tool calls stay in use\";\n\t\t\t\tthis.deps.emitWarning(\n\t\t\t\t\t`Auto-probed ${modelKey} after repeated native tool-call validation failures: verdict \"${result.verdict}\"${detail}.`,\n\t\t\t\t);\n\t\t\t})\n\t\t\t.catch((error) => {\n\t\t\t\tif (this.deps.isDisposed()) return;\n\t\t\t\tthis.deps.emitWarning(\n\t\t\t\t\t`Auto-probe for ${modelKey} (triggered by repeated tool-call validation failures) did not complete: ${error instanceof Error ? error.message : String(error)}.`,\n\t\t\t\t);\n\t\t\t});\n\t}\n\n\tformatRepairHealth(stats?: ToolRecoveryLoggerStats): string {\n\t\treturn formatToolRepairHealthReport(this.deps.adaptationStore, new Date(), stats);\n\t}\n\n\tremoveRepairRule(model: string, mode: string): boolean {\n\t\treturn this.deps.adaptationStore.removeRule(model, mode);\n\t}\n\n\tresetProtocolCalibration(model: string): boolean {\n\t\tconst removed = this.deps.adaptationStore.removeProtocol(model);\n\t\tthis.parseFailures.delete(model);\n\t\treturn removed;\n\t}\n\n\tgetRepairSettings() {\n\t\treturn resolveCurrentToolRepairSettings(this.deps.settingsManager.settings);\n\t}\n\n\tprivate modelKey(model: Model<Api> | undefined): string | undefined {\n\t\treturn model ? this.modelRef(model) : undefined;\n\t}\n\n\tprivate modelRef(model: Model<Api>): string {\n\t\treturn `${model.provider}/${model.id}`;\n\t}\n\n\tprivate async streamForProbe(model: Model<Api>, context: Context, options: SimpleStreamOptions) {\n\t\tlet requestOptions = options;\n\t\tif (this.deps.isRawStreamSimple(this.deps.agent.streamFn)) {\n\t\t\tconst auth = await this.deps.getRequiredRequestAuth(model);\n\t\t\trequestOptions = {\n\t\t\t\t...options,\n\t\t\t\tapiKey: auth.apiKey,\n\t\t\t\theaders: auth.headers || options.headers ? { ...auth.headers, ...options.headers } : undefined,\n\t\t\t};\n\t\t}\n\t\treturn this.deps.agent.streamFn(model, context, requestOptions);\n\t}\n\n\tprivate nextProbeUsageReportId(model: Model<Api>, kind: string): string {\n\t\treturn `tool-probe:${this.modelRef(model)}:${kind}:${this.probeUsageReportSeq++}`;\n\t}\n\n\tprivate async resolveProbeStreamCountingUsage(\n\t\tstream: AssistantMessageEventStream,\n\t\tlabel: string,\n\t\treportId: string,\n\t): Promise<AssistantMessage> {\n\t\tconst message = await stream.result();\n\t\tconst usage = message.usage;\n\t\tif (usage && (usage.cost.total > 0 || usage.totalTokens > 0)) {\n\t\t\tthis.deps.addSpawnedUsage(usage, { label, reportId });\n\t\t}\n\t\treturn message;\n\t}\n\n\tprivate textProtocolCalibrationContext(variant: TextToolProtocolVariant, token: string): Context {\n\t\tconst primer = generateTextToolProtocolPrimer([TEXT_TOOL_PROTOCOL_ECHO_TOOL], { variant });\n\t\tconst instruction = `Text tool protocol calibration trial. Using the protocol above, call echo with data exactly \"${token}\". Output only the tool-call envelope.`;\n\t\treturn {\n\t\t\tsystemPrompt: `${primer}\\n\\n${instruction}`,\n\t\t\tmessages: [{ role: \"user\", content: [{ type: \"text\", text: instruction }], timestamp: Date.now() }],\n\t\t};\n\t}\n\n\tprivate messageHasToolCallWithStringArgument(\n\t\tmessage: AssistantMessage,\n\t\ttoolName: string,\n\t\targName: string,\n\t\targValue: string,\n\t): boolean {\n\t\treturn message.content.some((block) => {\n\t\t\tif (block.type !== \"toolCall\" || block.name !== toolName) return false;\n\t\t\tconst args = block.arguments as unknown;\n\t\t\treturn (\n\t\t\t\ttypeof args === \"object\" &&\n\t\t\t\targs !== null &&\n\t\t\t\t!Array.isArray(args) &&\n\t\t\t\t(args as Record<string, unknown>)[argName] === argValue\n\t\t\t);\n\t\t});\n\t}\n\n\tprivate nativeToolProbeSystemPrompt(instruction: string): string {\n\t\tconst base = (this.deps.agent.state.systemPrompt ?? \"\").trim();\n\t\treturn base ? `${base}\\n\\n${instruction}` : instruction;\n\t}\n\n\tprivate async runNativeReadTaskProbeTrial(model: Model<Api>, path: string): Promise<boolean> {\n\t\tconst instruction =\n\t\t\t`Native tool-call capability probe: task-scale read. Use provider-native tool calling, not prose. ` +\n\t\t\t`Call read exactly once with path exactly \"${path}\".`;\n\t\tconst stream = await this.streamForProbe(\n\t\t\tmodel,\n\t\t\t{\n\t\t\t\tsystemPrompt: this.nativeToolProbeSystemPrompt(instruction),\n\t\t\t\tmessages: [{ role: \"user\", content: [{ type: \"text\", text: instruction }], timestamp: Date.now() }],\n\t\t\t\ttools: [NATIVE_TOOL_PROBE_READ_TOOL],\n\t\t\t},\n\t\t\t{ textToolCallProtocol: false, maxRetries: 0, temperature: 0, maxTokens: 768 },\n\t\t);\n\t\tconst message = await this.resolveProbeStreamCountingUsage(\n\t\t\tstream,\n\t\t\t\"tool-probe\",\n\t\t\tthis.nextProbeUsageReportId(model, \"read-task\"),\n\t\t);\n\t\treturn this.messageHasToolCallWithStringArgument(message, \"read\", \"path\", path);\n\t}\n\n\tprivate async runNativeEchoToolProbeTrial(model: Model<Api>, token: string): Promise<boolean> {\n\t\tconst instruction =\n\t\t\t`Native tool-call capability probe: echo-only. Use provider-native tool calling, not prose. ` +\n\t\t\t`Call echo with data exactly \"${token}\".`;\n\t\tconst stream = await this.streamForProbe(\n\t\t\tmodel,\n\t\t\t{\n\t\t\t\tsystemPrompt: this.nativeToolProbeSystemPrompt(instruction),\n\t\t\t\tmessages: [{ role: \"user\", content: [{ type: \"text\", text: instruction }], timestamp: Date.now() }],\n\t\t\t\ttools: [TEXT_TOOL_PROTOCOL_ECHO_TOOL],\n\t\t\t},\n\t\t\t{ textToolCallProtocol: false, maxRetries: 0, temperature: 0, maxTokens: 256 },\n\t\t);\n\t\tconst message = await this.resolveProbeStreamCountingUsage(\n\t\t\tstream,\n\t\t\t\"tool-probe\",\n\t\t\tthis.nextProbeUsageReportId(model, \"echo\"),\n\t\t);\n\t\treturn this.messageHasToolCallWithStringArgument(message, \"echo\", \"data\", token);\n\t}\n\n\tprivate async gradeNativeToolCallingForModel(model: Model<Api>, token: string): Promise<NativeToolProbeGrade> {\n\t\tconst path = join(\n\t\t\tgetProcessWorkRun(this.deps.agentDir, \"probes\", \"native-tools\").path,\n\t\t\t`pi-native-probe-${process.pid}-${Date.now()}.txt`,\n\t\t);\n\t\twriteFileSync(path, token, \"utf-8\");\n\t\ttry {\n\t\t\tif (await this.runNativeReadTaskProbeTrial(model, path)) return \"task\";\n\t\t\tif (await this.runNativeEchoToolProbeTrial(model, token)) return \"echo-only\";\n\t\t\treturn \"absent\";\n\t\t} finally {\n\t\t\trmSync(path, { force: true });\n\t\t}\n\t}\n\n\tprivate async runTextProtocolTrial(\n\t\tmodel: Model<Api>,\n\t\tvariant: TextToolProtocolVariant,\n\t\ttoken: string,\n\t): Promise<boolean> {\n\t\tconst stream = await this.streamForProbe(model, this.textProtocolCalibrationContext(variant, token), {\n\t\t\ttextToolCallProtocol: false,\n\t\t\tmaxRetries: 0,\n\t\t\ttemperature: 0,\n\t\t\tmaxTokens: 256,\n\t\t});\n\t\tconst message = await this.resolveProbeStreamCountingUsage(\n\t\t\tstream,\n\t\t\t\"text-protocol-calibration\",\n\t\t\tthis.nextProbeUsageReportId(model, `text-protocol:${variant}`),\n\t\t);\n\t\tconst text = message.content\n\t\t\t.filter((block): block is TextContent => block.type === \"text\")\n\t\t\t.map((block) => block.text)\n\t\t\t.join(\"\\n\")\n\t\t\t.trim();\n\t\tif (!text) return false;\n\t\tconst parsed = parseTextToolCalls(text, [TEXT_TOOL_PROTOCOL_ECHO_TOOL]);\n\t\treturn parsed.calls.some((call) => call.name === \"echo\" && call.arguments.data === token);\n\t}\n\n\tprivate async calibrateTextToolProtocolForModel(\n\t\tmodel: Model<Api>,\n\t\tmodelKey: string | undefined,\n\t\toptions: { persistFailure: boolean },\n\t): Promise<\n\t\t| { status: \"calibrated\"; variant: TextToolProtocolVariant; calibratedAt: string }\n\t\t| { status: \"failed\"; attemptedAt: string; variantsTried: string[] }\n\t> {\n\t\tconst variantsTried: string[] = [];\n\t\tfor (const variant of TEXT_TOOL_PROTOCOL_VARIANTS) {\n\t\t\tvariantsTried.push(variant);\n\t\t\tlet passed = true;\n\t\t\tfor (let trial = 0; trial < TEXT_TOOL_PROTOCOL_TRIALS_PER_VARIANT; trial++) {\n\t\t\t\tif (!(await this.runTextProtocolTrial(model, variant, `pi-calibration-${trial + 1}`))) {\n\t\t\t\t\tpassed = false;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (passed) {\n\t\t\t\tconst calibratedAt = new Date().toISOString();\n\t\t\t\tif (modelKey) {\n\t\t\t\t\tthis.deps.adaptationStore.setProtocol(\n\t\t\t\t\t\tmodelKey,\n\t\t\t\t\t\t{ version: MODEL_TOOL_PROTOCOL_VERSION, status: \"calibrated\", variant, calibratedAt },\n\t\t\t\t\t\tcalibratedAt,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn { status: \"calibrated\", variant, calibratedAt };\n\t\t\t}\n\t\t}\n\n\t\tconst attemptedAt = new Date().toISOString();\n\t\tif (modelKey && options.persistFailure) {\n\t\t\tthis.deps.adaptationStore.setProtocol(\n\t\t\t\tmodelKey,\n\t\t\t\t{ version: MODEL_TOOL_PROTOCOL_VERSION, status: \"failed\", attemptedAt, variantsTried },\n\t\t\t\tattemptedAt,\n\t\t\t);\n\t\t}\n\t\treturn { status: \"failed\", attemptedAt, variantsTried };\n\t}\n\n\tprivate formatToolProbeReport(results: readonly ToolProbeResult[]): string {\n\t\tconst lines = [\n\t\t\t\"Tool probe results:\",\n\t\t\t\"Model | Verdict | Variant | Native grade | Diagnostic\",\n\t\t\t\"--- | --- | --- | --- | ---\",\n\t\t];\n\t\tfor (const result of results) {\n\t\t\tlines.push(\n\t\t\t\t[\n\t\t\t\t\tresult.model,\n\t\t\t\t\tresult.verdict,\n\t\t\t\t\tresult.variant ?? \"-\",\n\t\t\t\t\tresult.nativeGrade ?? \"-\",\n\t\t\t\t\tresult.diagnostic ? result.diagnostic.replace(/\\s+/g, \" \").slice(0, 160) : \"-\",\n\t\t\t\t].join(\" | \"),\n\t\t\t);\n\t\t}\n\t\treturn lines.join(\"\\n\");\n\t}\n\n\tprivate storeToolProbe(modelKey: string, probe: ModelToolProbe): void {\n\t\tthis.deps.adaptationStore.setToolProbe(modelKey, probe, probe.probedAt);\n\t}\n\n\tprivate async resolveToolProbeModels(target?: string): Promise<Model<Api>[]> {\n\t\tconst trimmed = target?.trim();\n\t\tif (!trimmed) return this.deps.getModelRegistry().getAvailable();\n\t\tconst [provider, ...modelParts] = trimmed.split(\"/\");\n\t\tconst modelId = modelParts.join(\"/\");\n\t\tif (!provider || !modelId) throw new Error(\"Usage: /toolprobe [provider/model]\");\n\t\tconst exact = this.deps.getModelRegistry().find(provider, modelId);\n\t\tif (exact) return [exact];\n\t\tconst current = this.deps.agent.state.model;\n\t\tif (current?.provider === provider && current.id === modelId) return [current];\n\t\tthrow new Error(`Model not found: ${trimmed}`);\n\t}\n\n\tprivate maybeInjectCorrectiveSteer(variant: TextToolProtocolVariant): void {\n\t\tthis.correctiveSteerCount++;\n\t\tif (this.correctiveSteerCount !== 1 && this.correctiveSteerCount % TEXT_TOOL_PROTOCOL_STEER_INTERVAL !== 0) {\n\t\t\treturn;\n\t\t}\n\t\tconst reminder = `Reminder: to call a tool, emit exactly this envelope shape: ${formatVariantEnvelope(variant, \"TOOL\", '{\"arg\":\"value\"}')} — no other format is recognized. Reasoning may appear as prose before the envelope, never inside it.`;\n\t\tthis.deps.sendCorrectiveSteer(reminder).catch(() => {\n\t\t\t// Best-effort steer.\n\t\t});\n\t}\n\n\tprivate looksLikeTextProtocolAttempt(text: string): boolean {\n\t\treturn /<pi:call\\b|<tool_call\\b|```(?:tool|tool_call)[\\s\\S]*\"name\"\\s*:/i.test(text);\n\t}\n\n\tprivate repairSessionCount(modelKey: string, mode: ToolRepairModeName): number {\n\t\tconst key = `${modelKey}\\0${mode}`;\n\t\tconst count = (this.repairModeSessionCounts.get(key) ?? 0) + 1;\n\t\tthis.repairModeSessionCounts.set(key, count);\n\t\treturn count;\n\t}\n\n\tprivate hasFreshToolProbeVerdict(modelKey: string): boolean {\n\t\tconst probedAt = this.deps.adaptationStore.get(modelKey).toolProbe?.probedAt;\n\t\tif (!probedAt) return false;\n\t\tconst age = Date.now() - new Date(probedAt).getTime();\n\t\treturn Number.isFinite(age) && age >= 0 && age < AUTO_TOOL_PROBE_FRESHNESS_MS;\n\t}\n}\n"]}
+{"version":3,"file":"tool-protocol-controller.d.ts","sourceRoot":"","sources":["../../src/core/tool-protocol-controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EACX,GAAG,EACH,gBAAgB,EAGhB,KAAK,EAGL,0BAA0B,EAE1B,KAAK,EACL,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,8BAA8B,CAAC;AAGzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAEN,KAAK,2BAA2B,EAEhC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACX,mBAAmB,EACnB,oBAAoB,EAEpB,qBAAqB,EACrB,oBAAoB,EACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAoBzE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,eAAe,GAAG,MAAM,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,0BAA0B;IAC1C,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,gBAAgB,IAAI,aAAa,CAAC;IAClC,eAAe,EAAE,oBAAoB,CAAC;IACtC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChE,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,wBAAwB,IAAI,gBAAgB,GAAG,SAAS,CAAC;IACzD,UAAU,IAAI,OAAO,CAAC;IACtB,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1D;AAED,0FAA0F;AAC1F,qBAAa,sBAAsB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA6B;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6D;IAC3F,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,yBAAyB,CAAyC;IAC1E,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAElD,YAAY,IAAI,EAAE,0BAA0B,EAE3C;IAED,wBAAwB,IAAI,IAAI,CAE/B;IAED,cAAc,IAAI,IAAI,CAGrB;IAED,2BAA2B,IAAI,mBAAmB,EAAE,CAInD;IAED,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,2BAA2B,CAMvE;IAEK,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB/C;IAED,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,qBAAqB,GAAG,SAAS,CAExE;IAEK,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAMhE;IAEK,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAkD1E;IAED,uBAAuB,CAAC,KAAK,EAAE,0BAA0B,GAAG,IAAI,CAgC/D;IAED,uBAAuB,CAAC,KAAK,EAAE,oCAAoC,GAAG,IAAI,CAkBzE;IAED,mCAAmC,IAAI,IAAI,CAmC1C;IAED,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,GAAG,oCAAoC,CAe3G;IAED,yBAAyB,CAAC,KAAK,EAAE,oCAAoC,GAAG,IAAI,CAsC3E;IAED,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAwBtC;IAED,kBAAkB,CAAC,KAAK,CAAC,EAAE,uBAAuB,GAAG,MAAM,CAE1D;IAED,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;IAED,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAI/C;IAED,iBAAiB,mEAEhB;IAED,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,QAAQ;YAIF,cAAc;IAa5B,OAAO,CAAC,sBAAsB;YAIhB,+BAA+B;IAa7C,OAAO,CAAC,8BAA8B;IAStC,OAAO,CAAC,oCAAoC;IAkB5C,OAAO,CAAC,2BAA2B;YAKrB,uBAAuB;YA0BvB,2BAA2B;YAe3B,2BAA2B;YAO3B,8BAA8B;YAe9B,oBAAoB;YA0BpB,iCAAiC;IA0C/C,OAAO,CAAC,qBAAqB;IAoB7B,OAAO,CAAC,cAAc;YAIR,sBAAsB;IAapC,OAAO,CAAC,0BAA0B;IAWlC,OAAO,CAAC,4BAA4B;IAIpC,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,wBAAwB;CAMhC"}

package/dist/core/tool-protocol-controller.js

@@ -1,6 +1,7 @@
 import { rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { formatToolRepairStandingRule, formatVariantEnvelope, generateTextToolProtocolPrimer, parseTextToolCalls, TEXT_TOOL_PROTOCOL_VARIANTS, } from "@caupulican/pi-ai";
+import { formatVariantEnvelope, generateTextToolProtocolPrimer, parseTextToolCalls, TEXT_TOOL_PROTOCOL_VARIANTS, } from "@caupulican/pi-ai/text-tool-protocol";
+import { formatToolRepairStandingRule } from "@caupulican/pi-ai/tool-repair-registry";
 import { Type } from "typebox";
 import { getProcessWorkRun } from "../utils/work-directory.js";
 import { MODEL_TOOL_PROTOCOL_VERSION, resolveModelToolProtocol, } from "./model-tool-protocol.js";
@@ -23,15 +24,13 @@ const NATIVE_TOOL_PROBE_READ_TOOL = {
 };
 /** Owns model tool-protocol selection, probing, circuit breaking, and repair teaching. */
 export class ToolProtocolController {
-    repairModeSessionCounts = new Map();
-    parseFailures = new Map();
-    parseObservedThisTurn = false;
-    correctiveSteerCount = 0;
-    probeUsageReportSeq = 0;
-    autoProbedModels = new Set();
-    validationOutcomeThisTurn;
-    deps;
     constructor(deps) {
+        this.repairModeSessionCounts = new Map();
+        this.parseFailures = new Map();
+        this.parseObservedThisTurn = false;
+        this.correctiveSteerCount = 0;
+        this.probeUsageReportSeq = 0;
+        this.autoProbedModels = new Set();
         this.deps = deps;
     }
     applyRepairLayerSettings() {
@@ -367,27 +366,24 @@ export class ToolProtocolController {
         const base = (this.deps.agent.state.systemPrompt ?? "").trim();
         return base ? `${base}\n\n${instruction}` : instruction;
     }
-    async runNativeReadTaskProbeTrial(model, path) {
-        const instruction = `Native tool-call capability probe: task-scale read. Use provider-native tool calling, not prose. ` +
-            `Call read exactly once with path exactly "${path}".`;
+    async runNativeToolProbeTrial(model, instruction, tool, maxTokens, reportKind, argName, argValue) {
         const stream = await this.streamForProbe(model, {
             systemPrompt: this.nativeToolProbeSystemPrompt(instruction),
             messages: [{ role: "user", content: [{ type: "text", text: instruction }], timestamp: Date.now() }],
-            tools: [NATIVE_TOOL_PROBE_READ_TOOL],
-        }, { textToolCallProtocol: false, maxRetries: 0, temperature: 0, maxTokens: 768 });
-        const message = await this.resolveProbeStreamCountingUsage(stream, "tool-probe", this.nextProbeUsageReportId(model, "read-task"));
-        return this.messageHasToolCallWithStringArgument(message, "read", "path", path);
+            tools: [tool],
+        }, { textToolCallProtocol: false, maxRetries: 0, temperature: 0, maxTokens });
+        const message = await this.resolveProbeStreamCountingUsage(stream, "tool-probe", this.nextProbeUsageReportId(model, reportKind));
+        return this.messageHasToolCallWithStringArgument(message, tool.name, argName, argValue);
+    }
+    async runNativeReadTaskProbeTrial(model, path) {
+        const instruction = `Native tool-call capability probe: task-scale read. Use provider-native tool calling, not prose. ` +
+            `Call read exactly once with path exactly "${path}".`;
+        return this.runNativeToolProbeTrial(model, instruction, NATIVE_TOOL_PROBE_READ_TOOL, 768, "read-task", "path", path);
     }
     async runNativeEchoToolProbeTrial(model, token) {
         const instruction = `Native tool-call capability probe: echo-only. Use provider-native tool calling, not prose. ` +
             `Call echo with data exactly "${token}".`;
-        const stream = await this.streamForProbe(model, {
-            systemPrompt: this.nativeToolProbeSystemPrompt(instruction),
-            messages: [{ role: "user", content: [{ type: "text", text: instruction }], timestamp: Date.now() }],
-            tools: [TEXT_TOOL_PROTOCOL_ECHO_TOOL],
-        }, { textToolCallProtocol: false, maxRetries: 0, temperature: 0, maxTokens: 256 });
-        const message = await this.resolveProbeStreamCountingUsage(stream, "tool-probe", this.nextProbeUsageReportId(model, "echo"));
-        return this.messageHasToolCallWithStringArgument(message, "echo", "data", token);
+        return this.runNativeToolProbeTrial(model, instruction, TEXT_TOOL_PROTOCOL_ECHO_TOOL, 256, "echo", "data", token);
     }
     async gradeNativeToolCallingForModel(model, token) {
         const path = join(getProcessWorkRun(this.deps.agentDir, "probes", "native-tools").path, `pi-native-probe-${process.pid}-${Date.now()}.txt`);