@iowarp/clio-coder 0.3.4 → 0.3.6

package/dist/{chunk-VMNQ6OZA.js → chunk-ZRGEBJ4T.js}

@@ -7,29 +7,25 @@ import {
 } from "./chunk-UOV2BYIW.js";
 import {
   describeDispatchPlan
-} from "./chunk-EDRHSCIE.js";
+} from "./chunk-EYPA3EGJ.js";
 import {
   RESPONSE_SCHEMA_RUNTIME_ID,
   applyToolProfile,
   bashTool,
   builtin,
+  describeCallAction,
   networkToolsDisabled,
   readMaxBytes,
   readTool,
   renderAgentLedger
-} from "./chunk-ZYKPLLNQ.js";
+} from "./chunk-XXQNGV4M.js";
 import {
   createTaskBoardStore,
   taskBoardCounts
-} from "./chunk-WPQLXFOZ.js";
+} from "./chunk-43AOLP7E.js";
 import {
-  DEFAULT_AUTONOMY_EXPOSURE,
-  DEFAULT_AUTONOMY_LEVEL,
-  autonomyAskRejection,
-  autonomyDenyRejection,
-  formatModelRejection,
-  mapAutonomy
-} from "./chunk-7RXG6QRZ.js";
+  formatModelRejection
+} from "./chunk-EKY57CSP.js";
 import {
   classify
 } from "./chunk-AOCYTWAV.js";
@@ -71,7 +67,14 @@ import {
 import {
   evaluateSkillToolSurface,
   skillActivationFromToolDetails
-} from "./chunk-BEY543CS.js";
+} from "./chunk-GOXNB3AO.js";
+import {
+  DEFAULT_AUTONOMY_EXPOSURE,
+  DEFAULT_AUTONOMY_LEVEL,
+  autonomyAskRejection,
+  autonomyDenyRejection,
+  mapAutonomy
+} from "./chunk-HWUFFB6L.js";
 import {
   DEFAULT_TOOL_RESULT_MAX_BYTES,
   OBSERVATION_POLICY_SLACK_BYTES,
@@ -84,8 +87,9 @@ import {
   reserveObservation,
   shapeToolResult,
   toolResultContextText,
+  toolResultDigestFor,
   truncateHead
-} from "./chunk-5M54SPOL.js";
+} from "./chunk-ODFEOB4F.js";
 import {
   GREP_MAX_LINE_LENGTH,
   truncateLine
@@ -124,7 +128,7 @@ import {
 } from "./chunk-BNAZZHFG.js";
 import {
   BusChannels
-} from "./chunk-TTNYS3EA.js";
+} from "./chunk-G7MUEIGA.js";
 import {
   init_esm_shims
 } from "./chunk-3R73A4XB.js";
@@ -238,670 +242,327 @@ function cloneArtifact(artifact) {
   return clone;
 }
 
-// src/engine/loop-guard.ts
+// src/tools/ask-user.ts
 init_esm_shims();
-var LOOP_GUARD_REGISTRATION_ID = "guard.loop";
-var INTERACTIVE_LOOP_BLOCK_BUDGET = 2;
-var WORKER_LOOP_BLOCK_CALLS_PER_BLOCK = 10;
-function workerLoopBlockBudget(toolCalls) {
-  if (!Number.isSafeInteger(toolCalls) || toolCalls <= 0) return INTERACTIVE_LOOP_BLOCK_BUDGET;
-  return Math.max(INTERACTIVE_LOOP_BLOCK_BUDGET, Math.ceil(toolCalls / WORKER_LOOP_BLOCK_CALLS_PER_BLOCK));
+import { randomUUID } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+// src/domains/safety/decision-presentation.ts
+init_esm_shims();
+var ACTION_CLASSES = /* @__PURE__ */ new Set([
+  "read",
+  "write",
+  "execute",
+  "dispatch",
+  "system_modify",
+  "git_destructive",
+  "unknown"
+]);
+function decisionActionClass(value) {
+  return typeof value === "string" && ACTION_CLASSES.has(value) ? value : "unknown";
+}
+function actionConsequence(actionClass) {
+  switch (actionClass) {
+    case "read":
+      return { affectedScope: "workspace", reversibility: "reversible" };
+    case "write":
+      return { affectedScope: "workspace", reversibility: "reversible" };
+    case "execute":
+    case "dispatch":
+      return { affectedScope: "workspace", reversibility: "limited" };
+    case "system_modify":
+    case "git_destructive":
+    case "unknown":
+      return { affectedScope: "system", reversibility: "unknown" };
+  }
+}
+function decisionFactsForPermission(input) {
+  const exposure = input.exposure ?? "local";
+  const consequence = actionConsequence(input.actionClass);
+  return {
+    requestKind: "permission",
+    axis: input.axis,
+    exposure,
+    affectedScope: exposure === "outward" ? "outward" : consequence.affectedScope,
+    reversibility: exposure === "outward" ? "limited" : consequence.reversibility,
+    origin: input.origin,
+    authorityEffect: "grants-once",
+    tool: input.tool,
+    actionClass: input.actionClass
+  };
 }
-var LOOP_SYNTHESIS_BACKSTOP_DENIALS = 2;
-var WIDE_BATCH_DENIAL_FLOOR = 32;
-var DEFAULT_WORKER_TOOL_CALL_CAP = GUARDRAIL_DEFAULTS.workerToolCallCap;
-var DEFAULT_ORCH_TURN_TOOL_CALL_BUDGET = GUARDRAIL_DEFAULTS.turnToolCallBudget;
-var ORCH_TURN_TOOL_CALL_HARD_MARGIN = 15;
-var LOOP_GUARD_TURN_LIMIT = 32;
-var SUCCEEDED_FINGERPRINT_LIMIT = 128;
-var NO_TURN_BUCKET = "no-turn";
-var SIZE_ONLY_ARG_KEYS = /* @__PURE__ */ new Set(["limit", "offset", "max_bytes", "context"]);
-var RESULT_STAGNATION_THRESHOLD = 3;
-var CROSS_ARGUMENT_RESULT_MIN_BYTES = 64;
-function stagnationFingerprint(tool, args) {
-  const reduced = {};
-  for (const [key, value] of Object.entries(args ?? {})) {
-    if (!SIZE_ONLY_ARG_KEYS.has(key)) reduced[key] = value;
-  }
-  return hashToolCall(tool, reduced);
+function decisionFactsForAnswer(exposure) {
+  return {
+    requestKind: "question",
+    axis: { kind: "answer" },
+    exposure,
+    affectedScope: exposure === "outward" ? "outward" : "conversation",
+    reversibility: exposure === "outward" ? "limited" : "reversible",
+    origin: { kind: "main" },
+    authorityEffect: "records-answer"
+  };
 }
-function stagnationBlockReason(tool, identicalResults) {
-  return `loop detected: the last ${identicalResults} ${tool} calls returned byte-identical results even though size arguments (limit/offset) changed. Raising them is not producing new information. Re-read the result above, change the query or tool, or answer from what you have.`;
+function classifyTier(facts) {
+  if (facts.origin.kind === "worker") return "worker";
+  if (facts.affectedScope === "system") return "system";
+  if (facts.exposure === "outward" || facts.affectedScope === "outward") return "outward";
+  if (facts.axis.kind === "safety-net") return "safety-net";
+  if (facts.authorityEffect === "grants-once") return "workspace";
+  return "conversation";
+}
+function tierIdentity(tier) {
+  switch (tier) {
+    case "conversation":
+      return { tierLabel: "Conversational answer", title: "Answer a question", semanticToken: "accent" };
+    case "workspace":
+      return { tierLabel: "Workspace authority", title: "Approve workspace action", semanticToken: "action" };
+    case "outward":
+      return { tierLabel: "Outward consequence", title: "Confirm outward consequence", semanticToken: "warning" };
+    case "safety-net":
+      return { tierLabel: "Safety-net confirmation", title: "Safety-net confirmation", semanticToken: "warning" };
+    case "system":
+      return { tierLabel: "System change", title: "Approve system change", semanticToken: "warning" };
+    case "worker":
+      return { tierLabel: "Worker escalation", title: "Worker needs approval", semanticToken: "action" };
+  }
+}
+function requestedByCopy(facts) {
+  const requester = facts.origin.kind === "worker" ? `worker ${facts.origin.agentId} (run ${facts.origin.runId})` : "main agent";
+  if (facts.axis.kind === "answer") return requester;
+  if (facts.axis.kind === "safety-net") return `${requester} through safety-net rail ${facts.axis.ruleId}`;
+  return `${requester} through autonomy level (${facts.axis.level})`;
+}
+function authorizationCopy(facts) {
+  if (facts.authorityEffect === "records-answer") {
+    return facts.exposure === "outward" ? "Your response records an answer about an outward step. It does not publish or send anything by itself." : "Your response records an answer for this interview. It grants no tool authority.";
+  }
+  const tool = facts.tool ?? "the presented tool";
+  const actionClass = facts.actionClass ?? "unknown";
+  if (tool === "ask_user" && facts.exposure === "outward") {
+    return "Approval opens this one outward-decision interview. It does not publish or send anything by itself.";
+  }
+  return `Approval authorizes one ${actionClass} call to ${tool}. It does not change the autonomy level.`;
+}
+function consequenceCopy(facts, tier) {
+  switch (tier) {
+    case "conversation":
+      return "The answer stays in this session's decision record.";
+    case "workspace":
+      return facts.actionClass === "read" ? "The call reads within the workspace without mutating it." : "The call can affect files or processes inside the workspace.";
+    case "outward":
+      return "The resulting step can reach people or systems outside the workspace.";
+    case "safety-net":
+      return "An always-on safety-net rail requires a one-shot operator decision before this call can run.";
+    case "system":
+      return "The call can change state outside the workspace or state the classifier cannot safely bound.";
+    case "worker":
+      return "A dispatched worker is parked. Your answer returns only to that run's exact request.";
+  }
+}
+function reversibilityCopy(facts) {
+  if (facts.requestKind === "question") {
+    return facts.reversibility === "reversible" ? "Reversible: yes. The recorded answer can be superseded later." : "Reversible: not guaranteed. An outward step that later uses this answer may have lasting effects.";
+  }
+  if (facts.actionClass === "read" && facts.reversibility === "reversible") {
+    return "Reversible: yes. This call does not mutate the workspace.";
+  }
+  switch (facts.reversibility) {
+    case "reversible":
+      return "Reversible: yes. Workspace changes can be reviewed and reverted.";
+    case "limited":
+      return "Reversible: not guaranteed. Effects that already ran or reached an outward system may remain.";
+    case "unknown":
+      return "Reversible: unknown. Treat the effect as not safely reversible.";
+  }
+}
+function requiredActions(facts, tier) {
+  if (facts.authorityEffect === "records-answer") {
+    return [
+      {
+        id: "record-answer",
+        label: facts.exposure === "outward" ? "Record outward answer" : "Record answer",
+        consequence: "Records the selected or typed answer without granting tool authority."
+      },
+      { id: "cancel", label: "Cancel", consequence: "Closes the interview without recording an answer for this round." }
+    ];
+  }
+  const approveLabel = tier === "system" ? "Approve system change once" : tier === "safety-net" ? "Approve guarded action once" : tier === "worker" ? "Approve worker request once" : tier === "outward" ? "Approve outward decision once" : "Approve workspace action once";
+  const stopConsequence = facts.origin.kind === "worker" ? "Denies this worker request and ends the active main-agent turn. Other worker requests retain their timeout policy." : "Denies every parked request from this turn and ends the run.";
+  return [
+    {
+      id: "approve-once",
+      label: approveLabel,
+      consequence: "Runs only the presented request and does not change the autonomy level."
+    },
+    { id: "deny", label: "Deny this request", consequence: "Denies only the presented request and advances the queue." },
+    { id: "stop", label: "Deny and stop", consequence: stopConsequence }
+  ];
 }
-function crossArgumentResultMessage(tool, distinctArguments) {
-  return `loop guard: ${distinctArguments} distinct ${tool} arguments returned the same substantial result this turn. The tool may be ignoring an argument; re-read the result, change tools, or answer from what you have.`;
+function classifyDecisionPresentation(facts) {
+  const tier = classifyTier(facts);
+  return {
+    tier,
+    ...tierIdentity(tier),
+    authorizationCopy: authorizationCopy(facts),
+    consequenceCopy: consequenceCopy(facts, tier),
+    reversibilityCopy: reversibilityCopy(facts),
+    requestedByCopy: requestedByCopy(facts),
+    requiredActions: requiredActions(facts, tier)
+  };
 }
-function loopBlockBaseReason(tool, repeatCount, priorSuccesses) {
-  const evidence = priorSuccesses > 0 ? `This exact call already succeeded ${priorSuccesses} ${priorSuccesses === 1 ? "time" : "times"} this run; its result is already in the conversation above \u2014 re-read that result before calling tools again. ` : "";
-  return `loop detected: ${tool} was called ${repeatCount} times with identical arguments among this turn's recent tool calls. Repeating the exact call is blocked. ${evidence}Change strategy: vary the arguments, use a different tool, or explain what new information you expect before retrying.`;
+
+// src/tools/ask-user.ts
+var ASK_USER_OTHER_LABEL = "Other (type your answer)";
+var MAX_DECISIONS = 24;
+var DEFAULT_MAX_ROUNDS = 6;
+var MAX_ROUNDS = 24;
+var askUserParameters = typebox_exports.Object({
+  action: typebox_exports.Optional(
+    StringEnum(["ask", "complete"], {
+      description: "ask presents a round of questions; complete (exactly once) records decisions before final prose."
+    })
+  ),
+  mode: typebox_exports.Optional(
+    StringEnum(["round", "single_question"], {
+      description: "Caps how many questions this call may carry. single_question accepts exactly 1 and rejects the call otherwise (interviews); round accepts 1 to 4 tightly related confirmations. Default is round."
+    })
+  ),
+  questions: typebox_exports.Optional(
+    typebox_exports.Array(
+      typebox_exports.Object({
+        question: typebox_exports.String({ description: "Question for the operator." }),
+        header: typebox_exports.Optional(typebox_exports.String({ description: "Short header." })),
+        options: typebox_exports.Optional(
+          typebox_exports.Array(
+            typebox_exports.Object({
+              label: typebox_exports.String({ description: "Choice label." }),
+              description: typebox_exports.Optional(typebox_exports.String({ description: "Short explanation." }))
+            }),
+            { description: "Suggested choices, recommended first. The UI adds an implicit Other choice." }
+          )
+        ),
+        multi_select: typebox_exports.Optional(typebox_exports.Boolean({ description: "Allow multiple selections." }))
+      }),
+      { description: "For action=ask: 1 to 4 questions, or exactly 1 when mode=single_question." }
+    )
+  ),
+  max_rounds: typebox_exports.Optional(typebox_exports.Integer({ description: "Round limit for this turn (default 6, max 24)." })),
+  decisions: typebox_exports.Optional(
+    typebox_exports.Array(
+      typebox_exports.Object({
+        key: typebox_exports.String({ description: "Stable snake_case key." }),
+        value: typebox_exports.String({ description: "Decision value." }),
+        label: typebox_exports.Optional(typebox_exports.String({ description: "Human-readable label." }))
+      }),
+      { description: "For action=complete: compact decisions." }
+    )
+  ),
+  summary: typebox_exports.Optional(typebox_exports.String({ description: "Short closeout summary for action=complete." })),
+  exposure: typebox_exports.Optional(
+    StringEnum(["local", "outward"], {
+      description: "Blast radius of this gate. local (default) stays inside the workspace. outward means answering it publishes or sends something the operator cannot take back (filing an issue or PR, posting a comment, pushing, releasing); at autonomy auto-edit an outward gate parks for the operator instead of being answered automatically."
+    })
+  )
+});
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function synthesisLockoutDirective() {
-  return "loop guard: this turn reached its tool-call limit after repeated identical calls, so tool calls are now disabled for the rest of this turn. Everything you retrieved is already in the conversation above. Answer the operator now, in plain prose, from what you have gathered. Do not write tool-call markup such as <tool_call> blocks; tool calls are disabled and will not run.";
+function trimOptionalString(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
 }
-function synthesisBackstopReason(tool) {
-  return `loop guard: tool calls stayed disabled and ${tool} was called again instead of answering, so the turn is being stopped. Summarize what you found for the operator.`;
+function normalizeAskUserMode(value) {
+  if (value === void 0) return {};
+  const raw = trimOptionalString(value)?.toLowerCase().replace(/[-\s]+/g, "_");
+  if (!raw) return { error: "mode must be round or single_question" };
+  if (raw === "round" || raw === "batch") return { mode: "round" };
+  if (raw === "single" || raw === "single_question" || raw === "one_question") {
+    return { mode: "single_question" };
+  }
+  return { error: "mode must be round or single_question" };
 }
-function workerExplorationSynthesisDirective(limit) {
-  return `worker exploration budget reached (${limit}); exploration tools are now disabled for this run. Answer in plain prose from the evidence already gathered, with live path:line citations. Do not retry or substitute another tool call.`;
+function normalizeExposure(value) {
+  if (value === void 0) return { exposure: DEFAULT_AUTONOMY_EXPOSURE };
+  const raw = trimOptionalString(value)?.toLowerCase();
+  if (raw === "local" || raw === "outward") return { exposure: raw };
+  return { error: "exposure must be local or outward" };
 }
-function disallowedToolsText(deliveryTools) {
-  const candidates = ["code_nav", "ls", "grep", "find", "context", "git", "shell commands"];
-  const excluded = candidates.filter((tool) => !deliveryTools.includes(tool));
-  return excluded.join(", ");
+function askUserExposure(args) {
+  if (args?.exposure === void 0) return DEFAULT_AUTONOMY_EXPOSURE;
+  return normalizeExposure(args.exposure).exposure === "local" ? "local" : "outward";
 }
-function workerLiveReadReserveDirective(remaining, deliveryTools) {
-  const admitted = deliveryTools.length > 0 ? `read and ${deliveryTools.join("/")}` : "the read tool";
-  const finish = deliveryTools.length > 0 ? `Finish the work: re-read what you will cite and write it with ${deliveryTools.join(" or ")}.` : "Read a specific live file needed for the handoff.";
-  return `worker live-read reserve: broad orientation is complete and ${remaining} ${remaining === 1 ? "call remains" : "calls remain"}. Only ${admitted} ${deliveryTools.length > 0 ? "are" : "is"} admitted now. ${finish} Do not substitute ${disallowedToolsText(deliveryTools)}.`;
+function normalizeMaxRounds(value) {
+  if (value === void 0) return {};
+  if (typeof value !== "number" || !Number.isInteger(value)) {
+    return { error: `max_rounds must be an integer from 1 to ${MAX_ROUNDS}` };
+  }
+  if (value < 1 || value > MAX_ROUNDS) {
+    return { error: `max_rounds must be an integer from 1 to ${MAX_ROUNDS}` };
+  }
+  return { maxRounds: value };
 }
-function workerDeliveryOnlyDirective(limit, deliveryTools) {
-  return `worker discovery budget reached (${limit}); exploration tools are disabled for the rest of this run. Only read and ${deliveryTools.join("/")} are admitted now. Write what you have with ${deliveryTools.join(" or ")} and finish. Do not substitute ${disallowedToolsText(deliveryTools)}.`;
+function normalizeOptions(value, index) {
+  if (value === void 0) return {};
+  if (!Array.isArray(value)) return { error: `questions[${index}].options must be an array` };
+  const options = [];
+  for (let optionIndex = 0; optionIndex < value.length; optionIndex += 1) {
+    const raw = value[optionIndex];
+    if (!isRecord(raw)) return { error: `questions[${index}].options[${optionIndex}] must be an object` };
+    const label = trimOptionalString(raw.label);
+    if (!label) return { error: `questions[${index}].options[${optionIndex}].label is required` };
+    const option = { label };
+    const description = trimOptionalString(raw.description);
+    if (description) option.description = description;
+    options.push(option);
+  }
+  return options.length > 0 ? { options } : {};
 }
-var DEAD_TOOL_CALL_MARKUP_PATTERNS = [
-  /<tool_call>[\s\S]*?<\/tool_call>/gi,
-  /<function=[\w.-]+>[\s\S]*?<\/function>/gi,
-  /<tool_call>\s*(?:<function=|[{[])[\s\S]*$/i,
-  /<function=[\w.-]+>[\s\S]*$/i
-];
-function stripDeadToolCallMarkup(text) {
-  let out = text;
-  for (const pattern of DEAD_TOOL_CALL_MARKUP_PATTERNS) {
-    out = out.replace(pattern, "");
+function normalizeAskUserQuestions(args) {
+  const rawQuestions = args.questions;
+  if (!Array.isArray(rawQuestions)) return { error: "questions must be an array" };
+  if (rawQuestions.length < 1) return { error: "questions must contain at least 1 item" };
+  if (rawQuestions.length > 4) return { error: "questions must contain at most 4 items" };
+  const questions = [];
+  for (let index = 0; index < rawQuestions.length; index += 1) {
+    const raw = rawQuestions[index];
+    if (!isRecord(raw)) return { error: `questions[${index}] must be an object` };
+    const questionText = trimOptionalString(raw.question);
+    if (!questionText) return { error: `questions[${index}].question is required` };
+    const normalized = { question: questionText };
+    const header = trimOptionalString(raw.header);
+    if (header) normalized.header = header;
+    const options = normalizeOptions(raw.options, index);
+    if (options.error) return { error: options.error };
+    if (options.options) normalized.options = options.options;
+    if (raw.multi_select === true) normalized.multi_select = true;
+    questions.push(normalized);
   }
-  return out === text ? text : out.trim();
+  return { questions };
 }
-function lockedSynthesisFallbackText() {
-  return "[Clio Coder] loop guard: tool calls were disabled for the rest of this turn, but the reply contained only tool-call markup, which cannot run and was removed. Ask me to continue with a different approach, or narrow the request.";
+function normalizeDecision(raw, index) {
+  if (!isRecord(raw)) return { error: `decisions[${index}] must be an object` };
+  const key = trimOptionalString(raw.key);
+  if (!key) return { error: `decisions[${index}].key is required` };
+  const value = trimOptionalString(raw.value);
+  if (!value) return { error: `decisions[${index}].value is required` };
+  const decision = { key: toDecisionKey(key), value };
+  const label = trimOptionalString(raw.label);
+  if (label) decision.label = label;
+  return { decision };
 }
-function sanitizeLockedSynthesisMessage(message) {
-  if (!message || typeof message !== "object" || message.role !== "assistant") return false;
-  const record = message;
-  const stopReason = record.stopReason;
-  if (stopReason !== void 0 && stopReason !== "stop" && stopReason !== "length") return false;
-  if (!Array.isArray(record.content)) return false;
-  const blocks = record.content;
-  if (blocks.some((block) => block?.type === "toolCall")) return false;
-  let changed = false;
-  for (const block of blocks) {
-    if (block?.type !== "text" || typeof block.text !== "string") continue;
-    const stripped = stripDeadToolCallMarkup(block.text);
-    if (stripped !== block.text) {
-      block.text = stripped;
-      changed = true;
-    }
-  }
-  if (!changed) return false;
-  const remaining = blocks.filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text).join("").trim();
-  if (remaining.length === 0) {
-    const firstText = blocks.find(
-      (block) => block?.type === "text" && typeof block.text === "string"
-    );
-    if (firstText) firstText.text = lockedSynthesisFallbackText();
-    else blocks.push({ type: "text", text: lockedSynthesisFallbackText() });
+function normalizeDecisions(value) {
+  if (value === void 0) return {};
+  if (!Array.isArray(value)) return { error: "decisions must be an array" };
+  if (value.length > MAX_DECISIONS) return { error: `decisions must contain at most ${MAX_DECISIONS} items` };
+  const decisions = [];
+  for (let index = 0; index < value.length; index += 1) {
+    const normalized = normalizeDecision(value[index], index);
+    if (normalized.error) return { error: normalized.error };
+    if (normalized.decision) decisions.push(normalized.decision);
   }
-  return true;
-}
-function isLoopGuardSynthesisBackstopReason(reason) {
-  return /^loop guard: tool calls stayed disabled and .+ was called again instead of answering/.test(reason);
-}
-function readOrchTurnToolCallBudget(env = process.env) {
-  const soft = resolveGuardrail("turnToolCallBudget", env);
-  return { soft, hard: soft + ORCH_TURN_TOOL_CALL_HARD_MARGIN };
-}
-function createLoopGuardRegistration(options) {
-  const budget = options.turnBlockBudget ?? INTERACTIVE_LOOP_BLOCK_BUDGET;
-  const cap = options.toolCallCap;
-  const softLimit = options.toolCallSoftLimit !== void 0 && Number.isSafeInteger(options.toolCallSoftLimit) && options.toolCallSoftLimit > 0 && (cap === void 0 || options.toolCallSoftLimit <= cap) ? options.toolCallSoftLimit : void 0;
-  const turnBudget = options.turnToolCallBudget;
-  const synthesisLockout = options.turnSynthesisLockout === true;
-  const softReadReserve = options.toolCallSoftReadReserve ?? 0;
-  const softReadReserveThreshold = softLimit !== void 0 && softReadReserve > 0 && softLimit > softReadReserve ? softLimit - softReadReserve : null;
-  const deliveryTools = [...new Set(options.deliveryTools ?? [])];
-  const reserveAdmits = (tool) => isReserveAdmittedTool(tool, deliveryTools);
-  let softAdmittedCount = 0;
-  let softReadReserveEntered = false;
-  let reserveDenials = { denials: 0 };
-  let deniedAttempts = 0;
-  const denialBudget = cap === void 0 ? void 0 : Math.max(cap, WIDE_BATCH_DENIAL_FLOOR);
-  const boundRunDenials = (effects, input) => {
-    if (denialBudget === void 0 || !effects.some((effect) => effect.kind === "block_tool")) return effects;
-    deniedAttempts += 1;
-    if (deniedAttempts <= denialBudget) return effects;
-    return [{ kind: "block_tool", reason: synthesisBackstopReason(input.toolName ?? "unknown"), severity: "hard-block" }];
-  };
-  const reserve = options.toolCallReserve ?? 0;
-  const reserveThreshold = cap !== void 0 && reserve > 0 && cap > reserve ? cap - reserve : null;
-  let reserveDirectiveEmitted = false;
-  const blocksByTurn = /* @__PURE__ */ new Map();
-  const callsByTurn = /* @__PURE__ */ new Map();
-  const lockoutByTurn = /* @__PURE__ */ new Map();
-  let capLockout = null;
-  let softLockout = null;
-  const succeededFingerprints = /* @__PURE__ */ new Map();
-  const stagnationByTurn = /* @__PURE__ */ new Map();
-  const crossArgumentResultsByTurn = /* @__PURE__ */ new Map();
-  let count = 0;
-  const enterSoftReadReserve = () => {
-    if (softReadReserveEntered) return;
-    softReadReserveEntered = true;
-    options.onSoftReadReserve?.();
-  };
-  const bumpBoundedCounter = (store, key, limit = LOOP_GUARD_TURN_LIMIT) => {
-    if (!store.has(key)) {
-      while (store.size >= limit) {
-        const oldest = store.keys().next().value;
-        if (typeof oldest !== "string") break;
-        store.delete(oldest);
-      }
-    }
-    const next = (store.get(key) ?? 0) + 1;
-    store.set(key, next);
-    return next;
-  };
-  const resultCarriesEvidence = (details) => {
-    const observation = details?.observation;
-    if (observation === null || typeof observation !== "object" || Array.isArray(observation)) return true;
-    const record = observation;
-    return !(record.truncated === true && record.shownCount === 0);
-  };
-  const recordSuccessfulResult = (input) => {
-    if (input.metadata?.resultKind !== "ok") return;
-    if (!resultCarriesEvidence(input.toolResultDetails)) return;
-    const tool = input.toolName;
-    if (typeof tool !== "string" || tool.length === 0) return;
-    bumpBoundedCounter(succeededFingerprints, hashToolCall(tool, input.toolArgs ?? {}), SUCCEEDED_FINGERPRINT_LIMIT);
-  };
-  const recordResultForStagnation = (input) => {
-    const turnKey = input.turnId ?? NO_TURN_BUCKET;
-    const tool = input.toolName;
-    const resultFingerprint = input.metadata?.resultFingerprint;
-    if (typeof tool !== "string" || tool.length === 0 || input.metadata?.resultKind !== "ok" || typeof resultFingerprint !== "string") {
-      stagnationByTurn.delete(turnKey);
-      return;
-    }
-    const reducedFingerprint = stagnationFingerprint(tool, input.toolArgs);
-    const previous = stagnationByTurn.get(turnKey);
-    if (previous !== void 0 && previous.reducedFingerprint === reducedFingerprint && previous.resultFingerprint === resultFingerprint) {
-      previous.streak += 1;
-      return;
-    }
-    if (!stagnationByTurn.has(turnKey)) {
-      while (stagnationByTurn.size >= LOOP_GUARD_TURN_LIMIT) {
-        const oldest = stagnationByTurn.keys().next().value;
-        if (typeof oldest !== "string") break;
-        stagnationByTurn.delete(oldest);
-      }
-    }
-    stagnationByTurn.set(turnKey, { reducedFingerprint, resultFingerprint, streak: 1 });
-  };
-  const crossArgumentResultEffects = (input) => {
-    const turnKey = input.turnId ?? NO_TURN_BUCKET;
-    const tool = input.toolName;
-    const resultFingerprint = input.metadata?.resultFingerprint;
-    const resultBytes = input.metadata?.resultBytes;
-    if (typeof tool !== "string" || tool.length === 0 || input.metadata?.actionClass !== "read" || input.metadata?.resultKind !== "ok" || typeof resultFingerprint !== "string" || typeof resultBytes !== "number" || resultBytes < CROSS_ARGUMENT_RESULT_MIN_BYTES || !resultCarriesEvidence(input.toolResultDetails)) {
-      crossArgumentResultsByTurn.delete(turnKey);
-      return [];
-    }
-    const argumentFingerprint = stagnationFingerprint(tool, input.toolArgs);
-    const previous = crossArgumentResultsByTurn.get(turnKey);
-    if (previous?.tool === tool && previous.resultFingerprint === resultFingerprint) {
-      if (previous.warned) return [];
-      previous.argumentFingerprints.add(argumentFingerprint);
-      if (previous.argumentFingerprints.size >= RESULT_STAGNATION_THRESHOLD) {
-        previous.warned = true;
-        return [
-          {
-            kind: "annotate_tool_result",
-            message: crossArgumentResultMessage(tool, previous.argumentFingerprints.size),
-            severity: "warn"
-          }
-        ];
-      }
-      return [];
-    }
-    if (!crossArgumentResultsByTurn.has(turnKey)) {
-      while (crossArgumentResultsByTurn.size >= LOOP_GUARD_TURN_LIMIT) {
-        const oldest = crossArgumentResultsByTurn.keys().next().value;
-        if (typeof oldest !== "string") break;
-        crossArgumentResultsByTurn.delete(oldest);
-      }
-    }
-    crossArgumentResultsByTurn.set(turnKey, {
-      tool,
-      resultFingerprint,
-      argumentFingerprints: /* @__PURE__ */ new Set([argumentFingerprint]),
-      warned: false
-    });
-    return [];
-  };
-  const bumpTurnBlocks = (turnId) => bumpBoundedCounter(blocksByTurn, turnId);
-  const enterLockout = (input, turnKey, state) => {
-    if (!lockoutByTurn.has(turnKey)) {
-      while (lockoutByTurn.size >= LOOP_GUARD_TURN_LIMIT) {
-        const oldest = lockoutByTurn.keys().next().value;
-        if (typeof oldest !== "string") break;
-        lockoutByTurn.delete(oldest);
-      }
-    }
-    lockoutByTurn.set(turnKey, {
-      ...state,
-      denials: 0,
-      ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
-    });
-  };
-  const reachesLockoutBackstop = (state, input) => {
-    if (input.correlationId !== void 0 && state.correlationId === input.correlationId) return false;
-    state.denials += 1;
-    if (input.correlationId !== void 0) state.correlationId = input.correlationId;
-    else delete state.correlationId;
-    return state.denials > LOOP_SYNTHESIS_BACKSTOP_DENIALS;
-  };
-  const emitLoopBlocked = (input, info, at) => {
-    const payload = {
-      tool: info.tool,
-      repeatCount: info.repeatCount,
-      blocksThisTurn: info.blocksThisTurn,
-      budget,
-      interrupted: info.disposition === "stop",
-      disposition: info.disposition,
-      at,
-      ...input.turnId !== void 0 ? { turnId: input.turnId } : {}
-    };
-    options.bus?.emit(BusChannels.LoopBlocked, payload);
-  };
-  const emitBudgetEvent = (input, callsThisTurn, interrupted, at) => {
-    if (turnBudget === void 0) return;
-    const payload = {
-      tool: input.toolName ?? "unknown",
-      callsThisTurn,
-      softBudget: turnBudget.soft,
-      hardCeiling: turnBudget.hard,
-      interrupted,
-      at,
-      ...input.turnId !== void 0 ? { turnId: input.turnId } : {}
-    };
-    options.bus?.emit(BusChannels.ToolBudgetExceeded, payload);
-  };
-  const evaluateTurnBudget = (input, now) => {
-    if (turnBudget === void 0) return null;
-    const turnKey = input.turnId ?? NO_TURN_BUCKET;
-    const callsThisTurn = bumpBoundedCounter(callsByTurn, turnKey);
-    if (callsThisTurn >= turnBudget.hard) {
-      if (callsThisTurn === turnBudget.hard) emitBudgetEvent(input, callsThisTurn, true, now);
-      return [
-        {
-          kind: "block_tool",
-          reason: `tool-call budget exhausted: ${callsThisTurn} tool calls in this turn reached the hard ceiling (${turnBudget.hard}); the turn is being stopped. Summarize what you found and wait for the operator.`,
-          severity: "hard-block"
-        }
-      ];
-    }
-    if (callsThisTurn >= turnBudget.soft) {
-      if (callsThisTurn === turnBudget.soft) emitBudgetEvent(input, callsThisTurn, false, now);
-      return [
-        {
-          kind: "block_tool",
-          reason: `tool-call budget: you have made ${callsThisTurn} tool calls in this turn (soft budget ${turnBudget.soft}). Every further tool call this turn will be blocked, so do not retry this call and do not substitute another one. Summarize what you have found so far in plain text, state the single next step you propose, and wait for the operator.`,
-          severity: "hard-block"
-        }
-      ];
-    }
-    return null;
-  };
-  const blockAsLoop = (input, turnKey, tool, repeatCount, baseReason, now) => {
-    const blocksThisTurn = bumpTurnBlocks(turnKey);
-    const reachedBudget = blocksThisTurn >= budget;
-    if (synthesisLockout && reachedBudget) {
-      enterLockout(input, turnKey, { tool, repeatCount, blocksThisTurn });
-      options.onSynthesisLockout?.();
-      emitLoopBlocked(input, { tool, repeatCount, blocksThisTurn, disposition: "lockout" }, now);
-      return [{ kind: "block_tool", reason: synthesisLockoutDirective(), severity: "hard-block" }];
-    }
-    emitLoopBlocked(input, { tool, repeatCount, blocksThisTurn, disposition: reachedBudget ? "stop" : "block" }, now);
-    const reason = reachedBudget ? `${baseReason} Loop budget exhausted (${blocksThisTurn} blocks this turn); the agent is being stopped.` : baseReason;
-    return [{ kind: "block_tool", reason, severity: "hard-block" }];
-  };
-  return {
-    id: LOOP_GUARD_REGISTRATION_ID,
-    description: "blocks repeated tool calls, enforces tool-call caps, and annotates substantial identical read results across distinct arguments",
-    hooks: ["before_tool", "after_tool"],
-    callCount: () => count,
-    evaluate(input) {
-      if (input.hook === "after_tool") {
-        recordSuccessfulResult(input);
-        recordResultForStagnation(input);
-        const effects = [...crossArgumentResultEffects(input)];
-        if (softReadReserveEntered && softLockout === null && deliveryTools.length === 0 && input.toolName === ToolNames.Read) {
-          effects.push({ kind: "require_tool", toolName: ToolNames.Read });
-        }
-        if (reserveThreshold !== null && cap !== void 0 && !reserveDirectiveEmitted && count > reserveThreshold && count <= cap) {
-          reserveDirectiveEmitted = true;
-          effects.push({
-            kind: "annotate_tool_result",
-            message: workerSynthesisReserveDirective(Math.max(0, cap - count), cap),
-            severity: "warn"
-          });
-        }
-        return effects;
-      }
-      const now = options.now?.() ?? Date.now();
-      const turnKey = input.turnId ?? NO_TURN_BUCKET;
-      const decide = () => {
-        if (capLockout !== null && cap !== void 0) {
-          if (reachesLockoutBackstop(capLockout, input)) {
-            return [
-              { kind: "block_tool", reason: synthesisBackstopReason(input.toolName ?? "unknown"), severity: "hard-block" }
-            ];
-          }
-          return [{ kind: "block_tool", reason: workerToolCallCapSynthesisReason(cap), severity: "hard-block" }];
-        }
-        if (softLockout !== null && softLimit !== void 0) {
-          if (reachesLockoutBackstop(softLockout, input)) {
-            return [
-              { kind: "block_tool", reason: synthesisBackstopReason(input.toolName ?? "unknown"), severity: "hard-block" }
-            ];
-          }
-          return [{ kind: "block_tool", reason: workerExplorationSynthesisDirective(softLimit), severity: "hard-block" }];
-        }
-        const lockout = synthesisLockout ? lockoutByTurn.get(turnKey) : void 0;
-        if (lockout !== void 0) {
-          if (reachesLockoutBackstop(lockout, input)) {
-            emitLoopBlocked(
-              input,
-              {
-                tool: lockout.tool,
-                repeatCount: lockout.repeatCount,
-                blocksThisTurn: lockout.blocksThisTurn,
-                disposition: "stop"
-              },
-              now
-            );
-            return [{ kind: "block_tool", reason: synthesisBackstopReason(lockout.tool), severity: "hard-block" }];
-          }
-          return [{ kind: "block_tool", reason: synthesisLockoutDirective(), severity: "hard-block" }];
-        }
-        if (softLimit !== void 0) {
-          const spentSoftLimit = softAdmittedCount >= softLimit;
-          if (spentSoftLimit && deliveryTools.length === 0) {
-            softLockout = {
-              denials: 0,
-              ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
-            };
-            options.onSynthesisLockout?.();
-            return [{ kind: "block_tool", reason: workerExplorationSynthesisDirective(softLimit), severity: "hard-block" }];
-          }
-          const inReserve = softReadReserveThreshold !== null && softAdmittedCount >= softReadReserveThreshold;
-          if (spentSoftLimit || inReserve) {
-            enterSoftReadReserve();
-            if (!reserveAdmits(input.toolName)) {
-              if (reachesLockoutBackstop(reserveDenials, input)) {
-                softLockout = {
-                  denials: 0,
-                  ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
-                };
-                options.onSynthesisLockout?.();
-                return [{ kind: "block_tool", reason: workerExplorationSynthesisDirective(softLimit), severity: "hard-block" }];
-              }
-              return [
-                {
-                  kind: "block_tool",
-                  reason: spentSoftLimit ? workerDeliveryOnlyDirective(softLimit, deliveryTools) : workerLiveReadReserveDirective(softLimit - softAdmittedCount, deliveryTools),
-                  severity: "hard-block"
-                }
-              ];
-            }
-          }
-        }
-        if (reserveThreshold !== null && cap !== void 0 && count >= reserveThreshold && !reserveAdmits(input.toolName)) {
-          if (reachesLockoutBackstop(reserveDenials, input)) {
-            if (synthesisLockout) {
-              capLockout = {
-                denials: 0,
-                ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
-              };
-              options.onSynthesisLockout?.();
-            }
-            return [{ kind: "block_tool", reason: workerToolCallCapSynthesisReason(cap), severity: "hard-block" }];
-          }
-          return [
-            {
-              kind: "block_tool",
-              reason: workerSynthesisReserveBlockReason(input.toolName ?? "unknown", Math.max(1, cap - count), cap),
-              severity: "hard-block"
-            }
-          ];
-        }
-        count += 1;
-        reserveDenials = { denials: 0 };
-        if (softLimit !== void 0) {
-          softAdmittedCount += 1;
-          if (softReadReserveThreshold !== null && softAdmittedCount >= softReadReserveThreshold) enterSoftReadReserve();
-          if (softAdmittedCount >= softLimit) {
-            if (deliveryTools.length === 0) {
-              softLockout = {
-                denials: 0,
-                ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
-              };
-              options.onSynthesisLockout?.();
-            }
-            options.onSoftLimitFinalCallAdmitted?.(input.toolCallId);
-          }
-        }
-        if (cap !== void 0 && count > cap) {
-          if (!synthesisLockout) {
-            return [{ kind: "block_tool", reason: workerToolCallCapExceededReason(cap), severity: "hard-block" }];
-          }
-          capLockout = {
-            denials: 0,
-            ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
-          };
-          options.onSynthesisLockout?.();
-          return [{ kind: "block_tool", reason: workerToolCallCapSynthesisReason(cap), severity: "hard-block" }];
-        }
-        const fingerprint = input.metadata?.callFingerprint;
-        if (typeof fingerprint !== "string" || fingerprint.length === 0) {
-          return evaluateTurnBudget(input, now) ?? [];
-        }
-        const verdict = options.safety.observeLoop(`${turnKey}|${fingerprint}`, now);
-        if (verdict.looping) {
-          const tool = input.toolName ?? "unknown";
-          const priorSuccesses = succeededFingerprints.get(fingerprint) ?? 0;
-          return blockAsLoop(
-            input,
-            turnKey,
-            tool,
-            verdict.count,
-            loopBlockBaseReason(tool, verdict.count, priorSuccesses),
-            now
-          );
-        }
-        const toolName = input.toolName;
-        if (typeof toolName === "string" && toolName.length > 0) {
-          const entry = stagnationByTurn.get(turnKey);
-          if (entry !== void 0 && entry.streak >= RESULT_STAGNATION_THRESHOLD - 1 && entry.reducedFingerprint === stagnationFingerprint(toolName, input.toolArgs)) {
-            return blockAsLoop(
-              input,
-              turnKey,
-              toolName,
-              entry.streak + 1,
-              stagnationBlockReason(toolName, entry.streak),
-              now
-            );
-          }
-        }
-        return evaluateTurnBudget(input, now) ?? [];
-      };
-      return boundRunDenials(decide(), input);
-    }
-  };
-}
-function isReserveAdmittedTool(tool, deliveryTools) {
-  return tool === ToolNames.Read || tool !== void 0 && deliveryTools.includes(tool);
-}
-function resolveDeliveryTools(allowedTools, product) {
-  const candidates = product === "orientation" ? [ToolNames.Write, ToolNames.Edit, ToolNames.CodeNav] : [ToolNames.Write, ToolNames.Edit];
-  if (allowedTools instanceof Set) {
-    return candidates.filter((tool) => allowedTools.has(tool));
-  }
-  return candidates.filter((tool) => allowedTools.includes(tool));
-}
-
-// src/tools/ask-user.ts
-init_esm_shims();
-import { randomUUID } from "node:crypto";
-import { mkdir, writeFile } from "node:fs/promises";
-import path from "node:path";
-var ASK_USER_OTHER_LABEL = "Other (type your answer)";
-var MAX_DECISIONS = 24;
-var DEFAULT_MAX_ROUNDS = 6;
-var MAX_ROUNDS = 24;
-var askUserParameters = typebox_exports.Object({
-  action: typebox_exports.Optional(
-    StringEnum(["ask", "complete"], {
-      description: "ask presents a round of questions; complete (exactly once) records decisions before final prose."
-    })
-  ),
-  mode: typebox_exports.Optional(
-    StringEnum(["round", "single_question"], {
-      description: "Caps how many questions this call may carry. single_question accepts exactly 1 and rejects the call otherwise (interviews); round accepts 1 to 4 tightly related confirmations. Default is round."
-    })
-  ),
-  questions: typebox_exports.Optional(
-    typebox_exports.Array(
-      typebox_exports.Object({
-        question: typebox_exports.String({ description: "Question for the operator." }),
-        header: typebox_exports.Optional(typebox_exports.String({ description: "Short header." })),
-        options: typebox_exports.Optional(
-          typebox_exports.Array(
-            typebox_exports.Object({
-              label: typebox_exports.String({ description: "Choice label." }),
-              description: typebox_exports.Optional(typebox_exports.String({ description: "Short explanation." }))
-            }),
-            { description: "Suggested choices, recommended first. The UI adds an implicit Other choice." }
-          )
-        ),
-        multi_select: typebox_exports.Optional(typebox_exports.Boolean({ description: "Allow multiple selections." }))
-      }),
-      { description: "For action=ask: 1 to 4 questions, or exactly 1 when mode=single_question." }
-    )
-  ),
-  max_rounds: typebox_exports.Optional(typebox_exports.Integer({ description: "Round limit for this turn (default 6, max 24)." })),
-  decisions: typebox_exports.Optional(
-    typebox_exports.Array(
-      typebox_exports.Object({
-        key: typebox_exports.String({ description: "Stable snake_case key." }),
-        value: typebox_exports.String({ description: "Decision value." }),
-        label: typebox_exports.Optional(typebox_exports.String({ description: "Human-readable label." }))
-      }),
-      { description: "For action=complete: compact decisions." }
-    )
-  ),
-  summary: typebox_exports.Optional(typebox_exports.String({ description: "Short closeout summary for action=complete." })),
-  exposure: typebox_exports.Optional(
-    StringEnum(["local", "outward"], {
-      description: "Blast radius of this gate. local (default) stays inside the workspace. outward means answering it publishes or sends something the operator cannot take back (filing an issue or PR, posting a comment, pushing, releasing); at autonomy auto-edit an outward gate parks for the operator instead of being answered automatically."
-    })
-  )
-});
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function trimOptionalString(value) {
-  if (typeof value !== "string") return void 0;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-function normalizeAskUserMode(value) {
-  if (value === void 0) return {};
-  const raw = trimOptionalString(value)?.toLowerCase().replace(/[-\s]+/g, "_");
-  if (!raw) return { error: "mode must be round or single_question" };
-  if (raw === "round" || raw === "batch") return { mode: "round" };
-  if (raw === "single" || raw === "single_question" || raw === "one_question") {
-    return { mode: "single_question" };
-  }
-  return { error: "mode must be round or single_question" };
-}
-function normalizeExposure(value) {
-  if (value === void 0) return { exposure: DEFAULT_AUTONOMY_EXPOSURE };
-  const raw = trimOptionalString(value)?.toLowerCase();
-  if (raw === "local" || raw === "outward") return { exposure: raw };
-  return { error: "exposure must be local or outward" };
-}
-function askUserExposure(args) {
-  if (args?.exposure === void 0) return DEFAULT_AUTONOMY_EXPOSURE;
-  return normalizeExposure(args.exposure).exposure === "local" ? "local" : "outward";
-}
-function normalizeMaxRounds(value) {
-  if (value === void 0) return {};
-  if (typeof value !== "number" || !Number.isInteger(value)) {
-    return { error: `max_rounds must be an integer from 1 to ${MAX_ROUNDS}` };
-  }
-  if (value < 1 || value > MAX_ROUNDS) {
-    return { error: `max_rounds must be an integer from 1 to ${MAX_ROUNDS}` };
-  }
-  return { maxRounds: value };
-}
-function normalizeOptions(value, index) {
-  if (value === void 0) return {};
-  if (!Array.isArray(value)) return { error: `questions[${index}].options must be an array` };
-  const options = [];
-  for (let optionIndex = 0; optionIndex < value.length; optionIndex += 1) {
-    const raw = value[optionIndex];
-    if (!isRecord(raw)) return { error: `questions[${index}].options[${optionIndex}] must be an object` };
-    const label = trimOptionalString(raw.label);
-    if (!label) return { error: `questions[${index}].options[${optionIndex}].label is required` };
-    const option = { label };
-    const description = trimOptionalString(raw.description);
-    if (description) option.description = description;
-    options.push(option);
-  }
-  return options.length > 0 ? { options } : {};
-}
-function normalizeAskUserQuestions(args) {
-  const rawQuestions = args.questions;
-  if (!Array.isArray(rawQuestions)) return { error: "questions must be an array" };
-  if (rawQuestions.length < 1) return { error: "questions must contain at least 1 item" };
-  if (rawQuestions.length > 4) return { error: "questions must contain at most 4 items" };
-  const questions = [];
-  for (let index = 0; index < rawQuestions.length; index += 1) {
-    const raw = rawQuestions[index];
-    if (!isRecord(raw)) return { error: `questions[${index}] must be an object` };
-    const questionText = trimOptionalString(raw.question);
-    if (!questionText) return { error: `questions[${index}].question is required` };
-    const normalized = { question: questionText };
-    const header = trimOptionalString(raw.header);
-    if (header) normalized.header = header;
-    const options = normalizeOptions(raw.options, index);
-    if (options.error) return { error: options.error };
-    if (options.options) normalized.options = options.options;
-    if (raw.multi_select === true) normalized.multi_select = true;
-    questions.push(normalized);
-  }
-  return { questions };
-}
-function normalizeDecision(raw, index) {
-  if (!isRecord(raw)) return { error: `decisions[${index}] must be an object` };
-  const key = trimOptionalString(raw.key);
-  if (!key) return { error: `decisions[${index}].key is required` };
-  const value = trimOptionalString(raw.value);
-  if (!value) return { error: `decisions[${index}].value is required` };
-  const decision = { key: toDecisionKey(key), value };
-  const label = trimOptionalString(raw.label);
-  if (label) decision.label = label;
-  return { decision };
-}
-function normalizeDecisions(value) {
-  if (value === void 0) return {};
-  if (!Array.isArray(value)) return { error: "decisions must be an array" };
-  if (value.length > MAX_DECISIONS) return { error: `decisions must contain at most ${MAX_DECISIONS} items` };
-  const decisions = [];
-  for (let index = 0; index < value.length; index += 1) {
-    const normalized = normalizeDecision(value[index], index);
-    if (normalized.error) return { error: normalized.error };
-    if (normalized.decision) decisions.push(normalized.decision);
-  }
-  return { decisions };
+  return { decisions };
 }
 function normalizeAskUserCall(args) {
   const rawAction = trimOptionalString(args.action)?.toLowerCase() ?? "ask";
@@ -939,6 +600,7 @@ function normalizeAskUserCall(args) {
   return {
     call: {
       action: "ask",
+      exposure: exposure.exposure ?? DEFAULT_AUTONOMY_EXPOSURE,
       ...mode.mode ? { mode: mode.mode } : {},
       questions: questions.questions,
       ...summary ? { summary } : {},
@@ -971,6 +633,7 @@ function createStandalonePolicy(options) {
     updatedAt: now,
     ...options?.sessionId ? { sessionId: options.sessionId } : {},
     ...options?.turnId ? { turnId: options.turnId } : {},
+    exposure: DEFAULT_AUTONOMY_EXPOSURE,
     rounds: [],
     decisions: [],
     inFlight: false,
@@ -985,6 +648,11 @@ function hydratePolicy(policy, options) {
   if (options?.sessionId && !policy.sessionId) policy.sessionId = options.sessionId;
   if (options?.turnId && !policy.turnId) policy.turnId = options.turnId;
 }
+function mergePolicyExposure(policy, exposure) {
+  const merged = policy.exposure === "outward" || exposure === "outward" ? "outward" : "local";
+  policy.exposure = merged;
+  return merged;
+}
 function transcriptQuestions(questions) {
   return questions.map((question) => ({
     question: question.question,
@@ -1077,6 +745,7 @@ async function persistAskUserTranscript(policy, options) {
       ...policy.endedAt ? { endedAt: policy.endedAt } : {},
       ...policy.sessionId ? { sessionId: policy.sessionId } : {},
       ...policy.turnId ? { turnId: policy.turnId } : {},
+      exposure: policy.exposure ?? DEFAULT_AUTONOMY_EXPOSURE,
       ...policy.summary ? { summary: policy.summary } : {},
       decisions: policy.decisions,
       rounds: policy.rounds
@@ -1096,6 +765,7 @@ function compactInterview(policy, event, latestAnswers = []) {
     rounds: policy.rounds.length,
     max_rounds: policy.maxCalls,
     transcript_path: policy.transcriptPath ?? null,
+    exposure: policy.exposure ?? DEFAULT_AUTONOMY_EXPOSURE,
     latest_answers: latestAnswers,
     decisions: policy.decisions,
     ...policy.summary ? { summary: policy.summary } : {},
@@ -1142,104 +812,632 @@ async function finalizeAskUserInterview(policy, reason, options) {
     policy.endedAt = now;
     policy.summary = policy.summary ?? `Interview closed by host: ${reason}.`;
   }
-  await persistAskUserTranscript(policy, options);
+  await persistAskUserTranscript(policy, options);
+}
+async function finalizeAskUserInterviewForHost(policy, reason, options, onFinalized) {
+  await finalizeAskUserInterview(policy, reason, options);
+  onFinalized?.(policy);
+}
+async function defaultAskUserHandler() {
+  return cancelledAskUserResult();
+}
+function createAskUserTool(deps = {}) {
+  return {
+    name: ToolNames.AskUser,
+    description: "Run a host-owned operator interview: action=ask presents questions, action=complete records compact decisions before final prose. If cancelled, proceed with defaults and do not ask again.",
+    parameters: askUserParameters,
+    baseActionClass: "read",
+    executionMode: "sequential",
+    async run(args, options) {
+      const normalized = normalizeAskUserCall(args);
+      if (!normalized.call) return { kind: "error", message: `ask_user: ${normalized.error ?? "invalid input"}` };
+      const policy = options?.askUserPolicy ?? createStandalonePolicy(options);
+      hydratePolicy(policy, options);
+      const call = normalized.call;
+      if (call.action === "complete") {
+        return completeInterview(policy, "complete", options, call.summary, call.decisions ?? []);
+      }
+      const questions = call.questions ?? [];
+      const exposure = mergePolicyExposure(policy, call.exposure ?? DEFAULT_AUTONOMY_EXPOSURE);
+      if (call.max_rounds !== void 0) {
+        const nextLimit = policy.callCount === 0 ? call.max_rounds : Math.max(policy.maxCalls, call.max_rounds);
+        policy.maxCalls = Math.max(nextLimit, policy.callCount + 1);
+      }
+      if (policy.inFlight === true) {
+        return {
+          kind: "error",
+          message: "ask_user: an operator interview round is already in progress. Wait for that answer."
+        };
+      }
+      if (policy.status === "complete") {
+        await persistAskUserTranscript(policy, options);
+        return okInterviewResult(policy, "already_complete");
+      }
+      if (policy.status === "cancelled" || policy.cancelled === true) {
+        policy.status = "cancelled";
+        policy.cancelled = true;
+        await persistAskUserTranscript(policy, options);
+        return okInterviewResult(policy, "already_cancelled");
+      }
+      const key = questionKey(questions);
+      if (policy.askedQuestionKeys.has(key)) {
+        await persistAskUserTranscript(policy, options);
+        return okInterviewResult(policy, "duplicate_round_ignored");
+      }
+      if (policy.callCount >= policy.maxCalls) {
+        return completeInterview(
+          policy,
+          "round_limit_reached",
+          options,
+          `Interview closed after reaching the ${policy.maxCalls}-round limit.`
+        );
+      }
+      const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
+      policy.inFlight = true;
+      policy.status = "active";
+      policy.updatedAt = requestedAt;
+      if (call.summary) policy.summary = call.summary;
+      const handler = deps.askUser ?? defaultAskUserHandler;
+      try {
+        const result = normalizeAskUserResult(
+          questions,
+          await handler(questions, {
+            ...options,
+            decisionPresentation: classifyDecisionPresentation(decisionFactsForAnswer(exposure))
+          })
+        );
+        const answeredAt = (/* @__PURE__ */ new Date()).toISOString();
+        policy.callCount += 1;
+        policy.askedQuestionKeys.add(key);
+        policy.answerCount += result.answers.length;
+        policy.updatedAt = answeredAt;
+        const round = {
+          round: policy.rounds.length + 1,
+          requestedAt,
+          answeredAt,
+          questions: transcriptQuestions(questions),
+          answers: transcriptAnswers(result.answers),
+          ...result.cancelled === true ? { cancelled: true } : {}
+        };
+        policy.rounds.push(round);
+        if (result.cancelled === true) {
+          policy.status = "cancelled";
+          policy.cancelled = true;
+          policy.endedAt = answeredAt;
+          await persistAskUserTranscript(policy, options);
+          return okInterviewResult(policy, "cancelled", []);
+        }
+        const derived = deriveAnswerDecisions(questions, result.answers, policy);
+        upsertDecisions(policy, derived);
+        await persistAskUserTranscript(policy, options);
+        return okInterviewResult(policy, "round_answered", result.answers);
+      } finally {
+        policy.inFlight = false;
+      }
+    }
+  };
+}
+
+// src/engine/loop-guard.ts
+init_esm_shims();
+var LOOP_GUARD_REGISTRATION_ID = "guard.loop";
+var INTERACTIVE_LOOP_BLOCK_BUDGET = 2;
+var WORKER_LOOP_BLOCK_CALLS_PER_BLOCK = 10;
+function workerLoopBlockBudget(toolCalls) {
+  if (!Number.isSafeInteger(toolCalls) || toolCalls <= 0) return INTERACTIVE_LOOP_BLOCK_BUDGET;
+  return Math.max(INTERACTIVE_LOOP_BLOCK_BUDGET, Math.ceil(toolCalls / WORKER_LOOP_BLOCK_CALLS_PER_BLOCK));
+}
+var LOOP_SYNTHESIS_BACKSTOP_DENIALS = 2;
+var WIDE_BATCH_DENIAL_FLOOR = 32;
+var DEFAULT_WORKER_TOOL_CALL_CAP = GUARDRAIL_DEFAULTS.workerToolCallCap;
+var DEFAULT_ORCH_TURN_TOOL_CALL_BUDGET = GUARDRAIL_DEFAULTS.turnToolCallBudget;
+var ORCH_TURN_TOOL_CALL_HARD_MARGIN = 15;
+var LOOP_GUARD_TURN_LIMIT = 32;
+var SUCCEEDED_FINGERPRINT_LIMIT = 128;
+var NO_TURN_BUCKET = "no-turn";
+var SIZE_ONLY_ARG_KEYS = /* @__PURE__ */ new Set(["limit", "offset", "max_bytes", "context"]);
+var RESULT_STAGNATION_THRESHOLD = 3;
+var CROSS_ARGUMENT_RESULT_MIN_BYTES = 64;
+function stagnationFingerprint(tool, args) {
+  const reduced = {};
+  for (const [key, value] of Object.entries(args ?? {})) {
+    if (!SIZE_ONLY_ARG_KEYS.has(key)) reduced[key] = value;
+  }
+  return hashToolCall(tool, reduced);
+}
+function stagnationBlockReason(tool, identicalResults) {
+  return `loop detected: the last ${identicalResults} ${tool} calls returned byte-identical results even though size arguments (limit/offset) changed. Raising them is not producing new information. Re-read the result above, change the query or tool, or answer from what you have.`;
+}
+function crossArgumentResultMessage(tool, distinctArguments) {
+  return `loop guard: ${distinctArguments} distinct ${tool} arguments returned the same substantial result this turn. The tool may be ignoring an argument; re-read the result, change tools, or answer from what you have.`;
+}
+function loopBlockBaseReason(tool, repeatCount, priorSuccesses) {
+  const evidence = priorSuccesses > 0 ? `This exact call already succeeded ${priorSuccesses} ${priorSuccesses === 1 ? "time" : "times"} this run; its result is already in the conversation above \u2014 re-read that result before calling tools again. ` : "";
+  return `loop detected: ${tool} was called ${repeatCount} times with identical arguments among this turn's recent tool calls. Repeating the exact call is blocked. ${evidence}Change strategy: vary the arguments, use a different tool, or explain what new information you expect before retrying.`;
+}
+function synthesisLockoutDirective() {
+  return "loop guard: this turn reached its tool-call limit after repeated identical calls, so tool calls are now disabled for the rest of this turn. Everything you retrieved is already in the conversation above. Answer the operator now, in plain prose, from what you have gathered. Do not write tool-call markup such as <tool_call> blocks; tool calls are disabled and will not run.";
+}
+function synthesisBackstopReason(tool) {
+  return `loop guard: tool calls stayed disabled and ${tool} was called again instead of answering, so the turn is being stopped. Summarize what you found for the operator.`;
+}
+function workerExplorationSynthesisDirective(limit) {
+  return `worker exploration budget reached (${limit}); exploration tools are now disabled for this run. Answer in plain prose from the evidence already gathered, with live path:line citations. Do not retry or substitute another tool call.`;
+}
+function disallowedToolsText(deliveryTools) {
+  const candidates = ["code_nav", "ls", "grep", "find", "context", "git", "shell commands"];
+  const excluded = candidates.filter((tool) => !deliveryTools.includes(tool));
+  return excluded.join(", ");
+}
+function workerLiveReadReserveDirective(remaining, deliveryTools) {
+  const admitted = deliveryTools.length > 0 ? `read and ${deliveryTools.join("/")}` : "the read tool";
+  const finish = deliveryTools.length > 0 ? `Finish the work: re-read what you will cite and write it with ${deliveryTools.join(" or ")}.` : "Read a specific live file needed for the handoff.";
+  return `worker live-read reserve: broad orientation is complete and ${remaining} ${remaining === 1 ? "call remains" : "calls remain"}. Only ${admitted} ${deliveryTools.length > 0 ? "are" : "is"} admitted now. ${finish} Do not substitute ${disallowedToolsText(deliveryTools)}.`;
+}
+function workerDeliveryOnlyDirective(limit, deliveryTools) {
+  return `worker discovery budget reached (${limit}); exploration tools are disabled for the rest of this run. Only read and ${deliveryTools.join("/")} are admitted now. Write what you have with ${deliveryTools.join(" or ")} and finish. Do not substitute ${disallowedToolsText(deliveryTools)}.`;
+}
+var DEAD_TOOL_CALL_MARKUP_PATTERNS = [
+  /<tool_call>[\s\S]*?<\/tool_call>/gi,
+  /<function=[\w.-]+>[\s\S]*?<\/function>/gi,
+  /<tool_call>\s*(?:<function=|[{[])[\s\S]*$/i,
+  /<function=[\w.-]+>[\s\S]*$/i
+];
+function stripDeadToolCallMarkup(text) {
+  let out = text;
+  for (const pattern of DEAD_TOOL_CALL_MARKUP_PATTERNS) {
+    out = out.replace(pattern, "");
+  }
+  return out === text ? text : out.trim();
+}
+function lockedSynthesisFallbackText() {
+  return "[Clio Coder] loop guard: tool calls were disabled for the rest of this turn, but the reply contained only tool-call markup, which cannot run and was removed. Ask me to continue with a different approach, or narrow the request.";
+}
+function sanitizeLockedSynthesisMessage(message) {
+  if (!message || typeof message !== "object" || message.role !== "assistant") return false;
+  const record = message;
+  const stopReason = record.stopReason;
+  if (stopReason !== void 0 && stopReason !== "stop" && stopReason !== "length") return false;
+  if (!Array.isArray(record.content)) return false;
+  const blocks = record.content;
+  if (blocks.some((block) => block?.type === "toolCall")) return false;
+  let changed = false;
+  for (const block of blocks) {
+    if (block?.type !== "text" || typeof block.text !== "string") continue;
+    const stripped = stripDeadToolCallMarkup(block.text);
+    if (stripped !== block.text) {
+      block.text = stripped;
+      changed = true;
+    }
+  }
+  if (!changed) return false;
+  const remaining = blocks.filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text).join("").trim();
+  if (remaining.length === 0) {
+    const firstText = blocks.find(
+      (block) => block?.type === "text" && typeof block.text === "string"
+    );
+    if (firstText) firstText.text = lockedSynthesisFallbackText();
+    else blocks.push({ type: "text", text: lockedSynthesisFallbackText() });
+  }
+  return true;
 }
-async function finalizeAskUserInterviewForHost(policy, reason, options, onFinalized) {
-  await finalizeAskUserInterview(policy, reason, options);
-  onFinalized?.(policy);
+function isLoopGuardSynthesisBackstopReason(reason) {
+  return /^loop guard: tool calls stayed disabled and .+ was called again instead of answering/.test(reason);
 }
-async function defaultAskUserHandler() {
-  return cancelledAskUserResult();
+function readOrchTurnToolCallBudget(env = process.env) {
+  const soft = resolveGuardrail("turnToolCallBudget", env);
+  return { soft, hard: soft + ORCH_TURN_TOOL_CALL_HARD_MARGIN };
 }
-function createAskUserTool(deps = {}) {
-  return {
-    name: ToolNames.AskUser,
-    description: "Run a host-owned operator interview: action=ask presents questions, action=complete records compact decisions before final prose. If cancelled, proceed with defaults and do not ask again.",
-    parameters: askUserParameters,
-    baseActionClass: "read",
-    executionMode: "sequential",
-    async run(args, options) {
-      const normalized = normalizeAskUserCall(args);
-      if (!normalized.call) return { kind: "error", message: `ask_user: ${normalized.error ?? "invalid input"}` };
-      const policy = options?.askUserPolicy ?? createStandalonePolicy(options);
-      hydratePolicy(policy, options);
-      const call = normalized.call;
-      if (call.action === "complete") {
-        return completeInterview(policy, "complete", options, call.summary, call.decisions ?? []);
-      }
-      const questions = call.questions ?? [];
-      if (call.max_rounds !== void 0) {
-        const nextLimit = policy.callCount === 0 ? call.max_rounds : Math.max(policy.maxCalls, call.max_rounds);
-        policy.maxCalls = Math.max(nextLimit, policy.callCount + 1);
+function createLoopGuardRegistration(options) {
+  const budget = options.turnBlockBudget ?? INTERACTIVE_LOOP_BLOCK_BUDGET;
+  const cap = options.toolCallCap;
+  let softLimit = options.toolCallSoftLimit !== void 0 && Number.isSafeInteger(options.toolCallSoftLimit) && options.toolCallSoftLimit > 0 && (cap === void 0 || options.toolCallSoftLimit <= cap) ? options.toolCallSoftLimit : void 0;
+  const turnBudget = options.turnToolCallBudget;
+  const synthesisLockout = options.turnSynthesisLockout === true;
+  let softReadReserve = options.toolCallSoftReadReserve ?? 0;
+  let softReadReserveThreshold = softLimit !== void 0 && softReadReserve > 0 && softLimit > softReadReserve ? softLimit - softReadReserve : null;
+  const deliveryTools = [...new Set(options.deliveryTools ?? [])];
+  const reserveAdmits = (tool) => isReserveAdmittedTool(tool, deliveryTools);
+  let softAdmittedCount = 0;
+  let softReadReserveEntered = false;
+  let reserveDenials = { denials: 0 };
+  let deniedAttempts = 0;
+  const denialBudget = cap === void 0 ? void 0 : Math.max(cap, WIDE_BATCH_DENIAL_FLOOR);
+  const boundRunDenials = (effects, input) => {
+    if (denialBudget === void 0 || !effects.some((effect) => effect.kind === "block_tool")) return effects;
+    deniedAttempts += 1;
+    if (deniedAttempts <= denialBudget) return effects;
+    return [{ kind: "block_tool", reason: synthesisBackstopReason(input.toolName ?? "unknown"), severity: "hard-block" }];
+  };
+  const reserve = options.toolCallReserve ?? 0;
+  const reserveThreshold = cap !== void 0 && reserve > 0 && cap > reserve ? cap - reserve : null;
+  let reserveDirectiveEmitted = false;
+  const blocksByTurn = /* @__PURE__ */ new Map();
+  const callsByTurn = /* @__PURE__ */ new Map();
+  const lockoutByTurn = /* @__PURE__ */ new Map();
+  let capLockout = null;
+  let softLockout = null;
+  const succeededFingerprints = /* @__PURE__ */ new Map();
+  const stagnationByTurn = /* @__PURE__ */ new Map();
+  const crossArgumentResultsByTurn = /* @__PURE__ */ new Map();
+  let count = 0;
+  const enterSoftReadReserve = () => {
+    if (softReadReserveEntered) return;
+    softReadReserveEntered = true;
+    options.onSoftReadReserve?.();
+  };
+  const bumpBoundedCounter = (store, key, limit = LOOP_GUARD_TURN_LIMIT) => {
+    if (!store.has(key)) {
+      while (store.size >= limit) {
+        const oldest = store.keys().next().value;
+        if (typeof oldest !== "string") break;
+        store.delete(oldest);
       }
-      if (policy.inFlight === true) {
-        return {
-          kind: "error",
-          message: "ask_user: an operator interview round is already in progress. Wait for that answer."
-        };
+    }
+    const next = (store.get(key) ?? 0) + 1;
+    store.set(key, next);
+    return next;
+  };
+  const resultCarriesEvidence = (details) => {
+    const observation = details?.observation;
+    if (observation === null || typeof observation !== "object" || Array.isArray(observation)) return true;
+    const record = observation;
+    return !(record.truncated === true && record.shownCount === 0);
+  };
+  const recordSuccessfulResult = (input) => {
+    if (input.metadata?.resultKind !== "ok") return;
+    if (!resultCarriesEvidence(input.toolResultDetails)) return;
+    const tool = input.toolName;
+    if (typeof tool !== "string" || tool.length === 0) return;
+    bumpBoundedCounter(succeededFingerprints, hashToolCall(tool, input.toolArgs ?? {}), SUCCEEDED_FINGERPRINT_LIMIT);
+  };
+  const recordResultForStagnation = (input) => {
+    const turnKey = input.turnId ?? NO_TURN_BUCKET;
+    const tool = input.toolName;
+    const resultFingerprint = input.metadata?.resultFingerprint;
+    if (typeof tool !== "string" || tool.length === 0 || input.metadata?.resultKind !== "ok" || typeof resultFingerprint !== "string") {
+      stagnationByTurn.delete(turnKey);
+      return;
+    }
+    const reducedFingerprint = stagnationFingerprint(tool, input.toolArgs);
+    const previous = stagnationByTurn.get(turnKey);
+    if (previous !== void 0 && previous.reducedFingerprint === reducedFingerprint && previous.resultFingerprint === resultFingerprint) {
+      previous.streak += 1;
+      return;
+    }
+    if (!stagnationByTurn.has(turnKey)) {
+      while (stagnationByTurn.size >= LOOP_GUARD_TURN_LIMIT) {
+        const oldest = stagnationByTurn.keys().next().value;
+        if (typeof oldest !== "string") break;
+        stagnationByTurn.delete(oldest);
       }
-      if (policy.status === "complete") {
-        await persistAskUserTranscript(policy, options);
-        return okInterviewResult(policy, "already_complete");
+    }
+    stagnationByTurn.set(turnKey, { reducedFingerprint, resultFingerprint, streak: 1 });
+  };
+  const crossArgumentResultEffects = (input) => {
+    const turnKey = input.turnId ?? NO_TURN_BUCKET;
+    const tool = input.toolName;
+    const resultFingerprint = input.metadata?.resultFingerprint;
+    const resultBytes = input.metadata?.resultBytes;
+    if (typeof tool !== "string" || tool.length === 0 || input.metadata?.actionClass !== "read" || input.metadata?.resultKind !== "ok" || typeof resultFingerprint !== "string" || typeof resultBytes !== "number" || resultBytes < CROSS_ARGUMENT_RESULT_MIN_BYTES || !resultCarriesEvidence(input.toolResultDetails)) {
+      crossArgumentResultsByTurn.delete(turnKey);
+      return [];
+    }
+    const argumentFingerprint = stagnationFingerprint(tool, input.toolArgs);
+    const previous = crossArgumentResultsByTurn.get(turnKey);
+    if (previous?.tool === tool && previous.resultFingerprint === resultFingerprint) {
+      if (previous.warned) return [];
+      previous.argumentFingerprints.add(argumentFingerprint);
+      if (previous.argumentFingerprints.size >= RESULT_STAGNATION_THRESHOLD) {
+        previous.warned = true;
+        return [
+          {
+            kind: "annotate_tool_result",
+            message: crossArgumentResultMessage(tool, previous.argumentFingerprints.size),
+            severity: "warn"
+          }
+        ];
       }
-      if (policy.status === "cancelled" || policy.cancelled === true) {
-        policy.status = "cancelled";
-        policy.cancelled = true;
-        await persistAskUserTranscript(policy, options);
-        return okInterviewResult(policy, "already_cancelled");
+      return [];
+    }
+    if (!crossArgumentResultsByTurn.has(turnKey)) {
+      while (crossArgumentResultsByTurn.size >= LOOP_GUARD_TURN_LIMIT) {
+        const oldest = crossArgumentResultsByTurn.keys().next().value;
+        if (typeof oldest !== "string") break;
+        crossArgumentResultsByTurn.delete(oldest);
       }
-      const key = questionKey(questions);
-      if (policy.askedQuestionKeys.has(key)) {
-        await persistAskUserTranscript(policy, options);
-        return okInterviewResult(policy, "duplicate_round_ignored");
+    }
+    crossArgumentResultsByTurn.set(turnKey, {
+      tool,
+      resultFingerprint,
+      argumentFingerprints: /* @__PURE__ */ new Set([argumentFingerprint]),
+      warned: false
+    });
+    return [];
+  };
+  const bumpTurnBlocks = (turnId) => bumpBoundedCounter(blocksByTurn, turnId);
+  const enterLockout = (input, turnKey, state) => {
+    if (!lockoutByTurn.has(turnKey)) {
+      while (lockoutByTurn.size >= LOOP_GUARD_TURN_LIMIT) {
+        const oldest = lockoutByTurn.keys().next().value;
+        if (typeof oldest !== "string") break;
+        lockoutByTurn.delete(oldest);
       }
-      if (policy.callCount >= policy.maxCalls) {
-        return completeInterview(
-          policy,
-          "round_limit_reached",
-          options,
-          `Interview closed after reaching the ${policy.maxCalls}-round limit.`
-        );
+    }
+    lockoutByTurn.set(turnKey, {
+      ...state,
+      denials: 0,
+      ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
+    });
+  };
+  const reachesLockoutBackstop = (state, input) => {
+    if (input.correlationId !== void 0 && state.correlationId === input.correlationId) return false;
+    state.denials += 1;
+    if (input.correlationId !== void 0) state.correlationId = input.correlationId;
+    else delete state.correlationId;
+    return state.denials > LOOP_SYNTHESIS_BACKSTOP_DENIALS;
+  };
+  const emitLoopBlocked = (input, info, at) => {
+    const payload = {
+      tool: info.tool,
+      repeatCount: info.repeatCount,
+      blocksThisTurn: info.blocksThisTurn,
+      budget,
+      interrupted: info.disposition === "stop",
+      disposition: info.disposition,
+      at,
+      ...input.turnId !== void 0 ? { turnId: input.turnId } : {}
+    };
+    options.bus?.emit(BusChannels.LoopBlocked, payload);
+  };
+  const emitBudgetEvent = (input, callsThisTurn, interrupted, at) => {
+    if (turnBudget === void 0) return;
+    const payload = {
+      tool: input.toolName ?? "unknown",
+      callsThisTurn,
+      softBudget: turnBudget.soft,
+      hardCeiling: turnBudget.hard,
+      interrupted,
+      at,
+      ...input.turnId !== void 0 ? { turnId: input.turnId } : {}
+    };
+    options.bus?.emit(BusChannels.ToolBudgetExceeded, payload);
+  };
+  const evaluateTurnBudget = (input, now) => {
+    if (turnBudget === void 0) return null;
+    const turnKey = input.turnId ?? NO_TURN_BUCKET;
+    const callsThisTurn = bumpBoundedCounter(callsByTurn, turnKey);
+    if (callsThisTurn >= turnBudget.hard) {
+      if (callsThisTurn === turnBudget.hard) emitBudgetEvent(input, callsThisTurn, true, now);
+      return [
+        {
+          kind: "block_tool",
+          reason: `tool-call budget exhausted: ${callsThisTurn} tool calls in this turn reached the hard ceiling (${turnBudget.hard}); the turn is being stopped. Summarize what you found and wait for the operator.`,
+          severity: "hard-block"
+        }
+      ];
+    }
+    if (callsThisTurn >= turnBudget.soft) {
+      if (callsThisTurn === turnBudget.soft) emitBudgetEvent(input, callsThisTurn, false, now);
+      return [
+        {
+          kind: "block_tool",
+          reason: `tool-call budget: you have made ${callsThisTurn} tool calls in this turn (soft budget ${turnBudget.soft}). Every further tool call this turn will be blocked, so do not retry this call and do not substitute another one. Summarize what you have found so far in plain text, state the single next step you propose, and wait for the operator.`,
+          severity: "hard-block"
+        }
+      ];
+    }
+    return null;
+  };
+  const blockAsLoop = (input, turnKey, tool, repeatCount, baseReason, now) => {
+    const blocksThisTurn = bumpTurnBlocks(turnKey);
+    const reachedBudget = blocksThisTurn >= budget;
+    if (synthesisLockout && reachedBudget) {
+      enterLockout(input, turnKey, { tool, repeatCount, blocksThisTurn });
+      options.onSynthesisLockout?.();
+      emitLoopBlocked(input, { tool, repeatCount, blocksThisTurn, disposition: "lockout" }, now);
+      return [{ kind: "block_tool", reason: synthesisLockoutDirective(), severity: "hard-block" }];
+    }
+    emitLoopBlocked(input, { tool, repeatCount, blocksThisTurn, disposition: reachedBudget ? "stop" : "block" }, now);
+    const reason = reachedBudget ? `${baseReason} Loop budget exhausted (${blocksThisTurn} blocks this turn); the agent is being stopped.` : baseReason;
+    return [{ kind: "block_tool", reason, severity: "hard-block" }];
+  };
+  return {
+    id: LOOP_GUARD_REGISTRATION_ID,
+    description: "blocks repeated tool calls, enforces tool-call caps, and annotates substantial identical read results across distinct arguments",
+    hooks: ["before_tool", "after_tool"],
+    callCount: () => count,
+    extendWorkerToolCallPhase(phase) {
+      if (softLimit === void 0 || !Number.isSafeInteger(phase.toolCalls) || !Number.isSafeInteger(phase.readReserve) || phase.toolCalls <= 0 || phase.readReserve < 0 || phase.readReserve >= phase.toolCalls || cap !== void 0 && phase.toolCalls > cap || phase.toolCalls < softLimit || phase.toolCalls === softLimit && phase.readReserve <= softReadReserve) {
+        return false;
       }
-      const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
-      policy.inFlight = true;
-      policy.status = "active";
-      policy.updatedAt = requestedAt;
-      if (call.summary) policy.summary = call.summary;
-      const handler = deps.askUser ?? defaultAskUserHandler;
-      try {
-        const result = normalizeAskUserResult(questions, await handler(questions, options));
-        const answeredAt = (/* @__PURE__ */ new Date()).toISOString();
-        policy.callCount += 1;
-        policy.askedQuestionKeys.add(key);
-        policy.answerCount += result.answers.length;
-        policy.updatedAt = answeredAt;
-        const round = {
-          round: policy.rounds.length + 1,
-          requestedAt,
-          answeredAt,
-          questions: transcriptQuestions(questions),
-          answers: transcriptAnswers(result.answers),
-          ...result.cancelled === true ? { cancelled: true } : {}
-        };
-        policy.rounds.push(round);
-        if (result.cancelled === true) {
-          policy.status = "cancelled";
-          policy.cancelled = true;
-          policy.endedAt = answeredAt;
-          await persistAskUserTranscript(policy, options);
-          return okInterviewResult(policy, "cancelled", []);
+      softLimit = phase.toolCalls;
+      softReadReserve = phase.readReserve;
+      softReadReserveThreshold = softReadReserve > 0 && softLimit > softReadReserve ? softLimit - softReadReserve : null;
+      softReadReserveEntered = false;
+      softLockout = null;
+      reserveDenials = { denials: 0 };
+      return true;
+    },
+    evaluate(input) {
+      if (input.hook === "after_tool") {
+        recordSuccessfulResult(input);
+        recordResultForStagnation(input);
+        const effects = [...crossArgumentResultEffects(input)];
+        if (softReadReserveEntered && softLockout === null && deliveryTools.length === 0 && input.toolName === ToolNames.Read) {
+          effects.push({ kind: "require_tool", toolName: ToolNames.Read });
         }
-        const derived = deriveAnswerDecisions(questions, result.answers, policy);
-        upsertDecisions(policy, derived);
-        await persistAskUserTranscript(policy, options);
-        return okInterviewResult(policy, "round_answered", result.answers);
-      } finally {
-        policy.inFlight = false;
+        if (reserveThreshold !== null && cap !== void 0 && !reserveDirectiveEmitted && count > reserveThreshold && count <= cap) {
+          reserveDirectiveEmitted = true;
+          effects.push({
+            kind: "annotate_tool_result",
+            message: workerSynthesisReserveDirective(Math.max(0, cap - count), cap),
+            severity: "warn"
+          });
+        }
+        return effects;
       }
+      const now = options.now?.() ?? Date.now();
+      const turnKey = input.turnId ?? NO_TURN_BUCKET;
+      const decide = () => {
+        if (capLockout !== null && cap !== void 0) {
+          if (reachesLockoutBackstop(capLockout, input)) {
+            return [
+              { kind: "block_tool", reason: synthesisBackstopReason(input.toolName ?? "unknown"), severity: "hard-block" }
+            ];
+          }
+          return [{ kind: "block_tool", reason: workerToolCallCapSynthesisReason(cap), severity: "hard-block" }];
+        }
+        if (softLockout !== null && softLimit !== void 0) {
+          if (reachesLockoutBackstop(softLockout, input)) {
+            return [
+              { kind: "block_tool", reason: synthesisBackstopReason(input.toolName ?? "unknown"), severity: "hard-block" }
+            ];
+          }
+          return [{ kind: "block_tool", reason: workerExplorationSynthesisDirective(softLimit), severity: "hard-block" }];
+        }
+        const lockout = synthesisLockout ? lockoutByTurn.get(turnKey) : void 0;
+        if (lockout !== void 0) {
+          if (reachesLockoutBackstop(lockout, input)) {
+            emitLoopBlocked(
+              input,
+              {
+                tool: lockout.tool,
+                repeatCount: lockout.repeatCount,
+                blocksThisTurn: lockout.blocksThisTurn,
+                disposition: "stop"
+              },
+              now
+            );
+            return [{ kind: "block_tool", reason: synthesisBackstopReason(lockout.tool), severity: "hard-block" }];
+          }
+          return [{ kind: "block_tool", reason: synthesisLockoutDirective(), severity: "hard-block" }];
+        }
+        if (softLimit !== void 0) {
+          const spentSoftLimit = softAdmittedCount >= softLimit;
+          if (spentSoftLimit && deliveryTools.length === 0) {
+            softLockout = {
+              denials: 0,
+              ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
+            };
+            options.onSynthesisLockout?.();
+            return [{ kind: "block_tool", reason: workerExplorationSynthesisDirective(softLimit), severity: "hard-block" }];
+          }
+          const inReserve = softReadReserveThreshold !== null && softAdmittedCount >= softReadReserveThreshold;
+          if (spentSoftLimit || inReserve) {
+            enterSoftReadReserve();
+            if (!reserveAdmits(input.toolName)) {
+              if (reachesLockoutBackstop(reserveDenials, input)) {
+                softLockout = {
+                  denials: 0,
+                  ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
+                };
+                options.onSynthesisLockout?.();
+                return [{ kind: "block_tool", reason: workerExplorationSynthesisDirective(softLimit), severity: "hard-block" }];
+              }
+              return [
+                {
+                  kind: "block_tool",
+                  reason: spentSoftLimit ? workerDeliveryOnlyDirective(softLimit, deliveryTools) : workerLiveReadReserveDirective(softLimit - softAdmittedCount, deliveryTools),
+                  severity: "hard-block"
+                }
+              ];
+            }
+          }
+        }
+        if (reserveThreshold !== null && cap !== void 0 && count >= reserveThreshold && !reserveAdmits(input.toolName)) {
+          if (reachesLockoutBackstop(reserveDenials, input)) {
+            if (synthesisLockout) {
+              capLockout = {
+                denials: 0,
+                ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
+              };
+              options.onSynthesisLockout?.();
+            }
+            return [{ kind: "block_tool", reason: workerToolCallCapSynthesisReason(cap), severity: "hard-block" }];
+          }
+          return [
+            {
+              kind: "block_tool",
+              reason: workerSynthesisReserveBlockReason(input.toolName ?? "unknown", Math.max(1, cap - count), cap),
+              severity: "hard-block"
+            }
+          ];
+        }
+        count += 1;
+        reserveDenials = { denials: 0 };
+        if (softLimit !== void 0) {
+          softAdmittedCount += 1;
+          if (softReadReserveThreshold !== null && softAdmittedCount >= softReadReserveThreshold) enterSoftReadReserve();
+          if (softAdmittedCount >= softLimit) {
+            if (deliveryTools.length === 0) {
+              softLockout = {
+                denials: 0,
+                ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
+              };
+              options.onSynthesisLockout?.();
+            }
+            options.onSoftLimitFinalCallAdmitted?.(input.toolCallId);
+          }
+        }
+        if (cap !== void 0 && count > cap) {
+          if (!synthesisLockout) {
+            return [{ kind: "block_tool", reason: workerToolCallCapExceededReason(cap), severity: "hard-block" }];
+          }
+          capLockout = {
+            denials: 0,
+            ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {}
+          };
+          options.onSynthesisLockout?.();
+          return [{ kind: "block_tool", reason: workerToolCallCapSynthesisReason(cap), severity: "hard-block" }];
+        }
+        const fingerprint = input.metadata?.callFingerprint;
+        if (typeof fingerprint !== "string" || fingerprint.length === 0) {
+          return evaluateTurnBudget(input, now) ?? [];
+        }
+        const verdict = options.safety.observeLoop(`${turnKey}|${fingerprint}`, now);
+        if (verdict.looping) {
+          const tool = input.toolName ?? "unknown";
+          const priorSuccesses = succeededFingerprints.get(fingerprint) ?? 0;
+          return blockAsLoop(
+            input,
+            turnKey,
+            tool,
+            verdict.count,
+            loopBlockBaseReason(tool, verdict.count, priorSuccesses),
+            now
+          );
+        }
+        const toolName = input.toolName;
+        if (typeof toolName === "string" && toolName.length > 0) {
+          const entry = stagnationByTurn.get(turnKey);
+          if (entry !== void 0 && entry.streak >= RESULT_STAGNATION_THRESHOLD - 1 && entry.reducedFingerprint === stagnationFingerprint(toolName, input.toolArgs)) {
+            return blockAsLoop(
+              input,
+              turnKey,
+              toolName,
+              entry.streak + 1,
+              stagnationBlockReason(toolName, entry.streak),
+              now
+            );
+          }
+        }
+        return evaluateTurnBudget(input, now) ?? [];
+      };
+      return boundRunDenials(decide(), input);
     }
   };
 }
+function isReserveAdmittedTool(tool, deliveryTools) {
+  return tool === ToolNames.Read || tool !== void 0 && deliveryTools.includes(tool);
+}
+function resolveDeliveryTools(allowedTools, product) {
+  const candidates = product === "orientation" ? [ToolNames.Write, ToolNames.Edit, ToolNames.CodeNav] : [ToolNames.Write, ToolNames.Edit];
+  if (allowedTools instanceof Set) {
+    return candidates.filter((tool) => allowedTools.has(tool));
+  }
+  return candidates.filter((tool) => allowedTools.includes(tool));
+}
 
 // src/tools/registry.ts
 init_esm_shims();
@@ -1286,13 +1484,15 @@ function createRegistry(deps) {
         const preparedArgs = prepareToolArgs(spec, call.args ?? {});
         resultDisposition = resolveToolResultDisposition(spec, preparedArgs);
         const result = await spec.run(preparedArgs, options);
-        const afterEffects = runToolHook("after_tool", spec, call, decision, options, result);
+        const digest = toolResultDigestFor(spec, result, resultDisposition);
+        const afterEffects = runToolHook("after_tool", spec, call, decision, options, result, digest);
         const finalResult = shapeToolResult(spec, applyToolResultEffects(result, afterEffects), options, resultDisposition);
         return { kind: "ok", result: finalResult, decision };
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         const result = { kind: "error", message };
-        const afterEffects = runToolHook("after_tool", spec, call, decision, options, result);
+        const digest = toolResultDigestFor(spec, result, resultDisposition);
+        const afterEffects = runToolHook("after_tool", spec, call, decision, options, result, digest);
         return {
           kind: "ok",
           result: shapeToolResult(spec, applyToolResultEffects(result, afterEffects), options, resultDisposition),
@@ -1303,9 +1503,9 @@ function createRegistry(deps) {
       disposeAdmissionArgs(spec, call.args ?? {});
     }
   };
-  const runToolHook = (hook, spec, call, decision, options, result) => {
+  const runToolHook = (hook, spec, call, decision, options, result, resultDigest) => {
     if (!deps.middleware) return [];
-    const input = buildToolHookInput(hook, spec, call, decision, "operating", options, result);
+    const input = buildToolHookInput(hook, spec, call, decision, "operating", options, result, resultDigest);
     const effects = deps.middleware.runHook(input).effects;
     try {
       deps.onMiddlewareEffects?.(effects, input);
@@ -1740,7 +1940,7 @@ ${plan.text}`,
     ...decision.policy !== void 0 ? { policy: decision.policy } : {}
   };
 }
-function buildToolHookInput(hook, spec, call, decision, posture, options, result) {
+function buildToolHookInput(hook, spec, call, decision, posture, options, result, resultDigest) {
   const metadata = {
     posture,
     actionClass: decision.classification.actionClass,
@@ -1769,6 +1969,7 @@ function buildToolHookInput(hook, spec, call, decision, posture, options, result
   };
   if (call.args !== void 0) input.toolArgs = call.args;
   if (result?.details !== void 0) input.toolResultDetails = result.details;
+  if (resultDigest !== void 0) input.toolResultDigest = resultDigest;
   if (options?.runId !== void 0) input.runId = options.runId;
   if (options?.sessionId !== void 0) input.sessionId = options.sessionId;
   if (options?.turnId !== void 0) input.turnId = options.turnId;
@@ -1863,9 +2064,16 @@ async function runValidatedToolCall(input) {
   const { spec, args, registry, signal, telemetry } = input;
   const startedAt = Date.now();
   const startedAtClock = performance2.now();
-  telemetry?.onStart?.({ tool: spec.name, posture: "operating", startedAt });
   const callId = input.invokeOptions?.toolCallId;
   const withCallId = callId === void 0 ? {} : { toolCallId: callId };
+  const action = describeCallAction(spec.name, args);
+  telemetry?.onStart?.({
+    tool: spec.name,
+    ...withCallId,
+    posture: "operating",
+    startedAt,
+    ...action !== null ? { action } : {}
+  });
   const invokeOpts = {};
   if (input.invokeOptions) Object.assign(invokeOpts, input.invokeOptions);
   if (signal) invokeOpts.signal = signal;
@@ -2023,40 +2231,6 @@ function resolveSessionTools(runtime, toolRegistry, invokeOptions, telemetry) {
   return resolveAgentTools(input);
 }
 
-// src/domains/safety/call-target.ts
-init_esm_shims();
-var ESC_CHAR = String.fromCharCode(27);
-var BEL_CHAR = String.fromCharCode(7);
-var OSC_PATTERN = new RegExp(`${ESC_CHAR}\\][\\s\\S]*?(?:${BEL_CHAR}|${ESC_CHAR}\\\\|$)`, "g");
-var CSI_PATTERN = new RegExp(`${ESC_CHAR}\\[[0-9;?]*[0-9A-Za-z]`, "g");
-function sanitizeForDisplay(value) {
-  const stripped = value.replace(OSC_PATTERN, "").replace(CSI_PATTERN, "");
-  let out = "";
-  for (const ch of stripped) {
-    const code = ch.codePointAt(0) ?? 0;
-    out += code < 32 || code === 127 ? " " : ch;
-  }
-  return out;
-}
-function oneLine(value) {
-  return value.replace(/\s+/g, " ").trim();
-}
-function sanitizeCallTargetText(value) {
-  return oneLine(sanitizeForDisplay(value));
-}
-function describeCallTarget(args) {
-  if (!args) return "";
-  const str = (value) => typeof value === "string" && value.trim().length > 0 ? oneLine(sanitizeForDisplay(value)).trim() || null : null;
-  const candidate = str(args.command) ?? str(args.path) ?? str(args.file_path) ?? str(args.name) ?? str(args.pattern);
-  if (candidate) return candidate;
-  try {
-    const json = JSON.stringify(args);
-    return json === "{}" || json === void 0 ? "" : oneLine(sanitizeForDisplay(json)).slice(0, 120);
-  } catch {
-    return "";
-  }
-}
-
 // src/engine/provider-payload.ts
 init_esm_shims();
 function reasoningSummaryForLevel(level) {
@@ -4908,7 +5082,7 @@ function registerCoreTools(registry, deps = {}) {
   });
   registry.register({
     ...builtin(
-      lazyTool(codeNavToolSurface, async () => (await import("./code-nav-AXCXSBHX.js")).codeNavTool),
+      lazyTool(codeNavToolSurface, async () => (await import("./code-nav-GQNL7XA6.js")).codeNavTool),
       { path: "src/tools/codewiki/code-nav.ts", scope: "core" }
     )
   });
@@ -4933,9 +5107,9 @@ function registerCoreTools(registry, deps = {}) {
   registry.register({
     ...builtin(
       lazyTool(contextToolSurface, async () => {
-        const { createContextTool } = await import("./context-EKDCKUUZ.js");
+        const { createContextTool } = await import("./context-ZQ7SIFJV.js");
         if (!session) return createContextTool(skillToolDeps);
-        const { probeWorkspace } = await import("./workspace-G4ZWUIPR.js");
+        const { probeWorkspace } = await import("./workspace-ZJ6BFM3Q.js");
         return createContextTool({
           ...skillToolDeps,
           ...readSessionEntries ? {
@@ -4998,6 +5172,14 @@ function assertRegisteredBuiltinTools(registry, registration, includeDispatchToo
 
 export {
   createProtectedArtifactsRegistration,
+  decisionActionClass,
+  decisionFactsForPermission,
+  decisionFactsForAnswer,
+  classifyDecisionPresentation,
+  ASK_USER_OTHER_LABEL,
+  askUserExposure,
+  cancelledAskUserResult,
+  finalizeAskUserInterviewForHost,
   INTERACTIVE_LOOP_BLOCK_BUDGET,
   workerLoopBlockBudget,
   lockedSynthesisFallbackText,
@@ -5011,11 +5193,6 @@ export {
   resolveAgentTools,
   effectiveToolNames,
   resolveSessionTools,
-  ASK_USER_OTHER_LABEL,
-  cancelledAskUserResult,
-  finalizeAskUserInterviewForHost,
-  sanitizeCallTargetText,
-  describeCallTarget,
   diffWords,
   patchProviderThinkingPayload,
   patchToolChoiceNonePayload,
@@ -5028,4 +5205,4 @@ export {
   assertRegisteredBuiltinTools,
   createRegistry
 };
-//# sourceMappingURL=chunk-VMNQ6OZA.js.map
+//# sourceMappingURL=chunk-ZRGEBJ4T.js.map