@iowarp/clio-coder 0.4.0 → 0.4.1

package/src/domains/session/extension.ts

@@ -392,7 +392,7 @@ export function createSessionBundle(context: DomainContext): DomainBundle<Sessio
 				await performCheckpoint(state, "shutdown");
 			} catch (err) {
 				process.stderr.write(
-					`[clio:session] shutdown checkpoint failed: ${err instanceof Error ? err.message : String(err)}\n`,
+					`[clio-coder:session] shutdown checkpoint failed: ${err instanceof Error ? err.message : String(err)}\n`,
 				);
 			}
 			await closeCurrent("shutdown");

package/src/domains/session/handoff.ts

@@ -176,7 +176,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
  * ceiling, so the returned string is never longer than the bound, and the cut
  * lands on a whole code point rather than mid-sequence.
  */
-export function boundHandoffString(value: string): { text: string; truncated: boolean } {
+function boundHandoffString(value: string): { text: string; truncated: boolean } {
 	const text = value.trim();
 	const bytes = Buffer.byteLength(text, "utf8");
 	if (bytes <= HANDOFF_MAX_STRING_BYTES) return { text, truncated: false };
@@ -343,7 +343,7 @@ export interface HandoffReadLedgerOptions {
  * absolute form, which is what makes it fail the ledger check against paths
  * recorded relative to the workspace root.
  */
-export function normalizeHandoffPath(value: string, cwd: string | null): string {
+function normalizeHandoffPath(value: string, cwd: string | null): string {
 	const trimmed = value.trim().replace(/[\\/]+$/u, "");
 	if (trimmed.length === 0) return "";
 	const absolute = isAbsolute(trimmed) ? normalize(trimmed) : cwd === null ? normalize(trimmed) : resolve(cwd, trimmed);

package/src/domains/session/prompt-manifest.ts

@@ -155,11 +155,6 @@ function isSessionPromptCompileRecord(value: unknown): value is SessionPromptCom
 	);
 }
 
-/** A record written before the field existed describes the 0.3.8 layout. */
-export function promptManifestVersion(record: SessionPromptCompileRecord): number {
-	return record.version ?? 1;
-}
-
 export function getPromptManifestFilePath(meta: SessionMeta, stateDir?: string): string {
 	const safeMeta = {
 		...meta,

package/src/domains/session/protected-artifact-journal.ts

@@ -63,9 +63,12 @@ function artifactPayload(artifact: ProtectedArtifact): Record<string, unknown> {
 	};
 }
 
-function recordPayload(record: Omit<PendingProtectedArtifactRecord, "integrity">): Record<string, unknown> {
+function recordPayload(
+	record: Omit<PendingProtectedArtifactRecord, "integrity">,
+	legacyNaming = false,
+): Record<string, unknown> {
 	return {
-		contract: "clio.protectedArtifact.pending",
+		contract: legacyNaming ? "clio.protectedArtifact.pending" : "clio-coder.protectedArtifact.pending",
 		version: record.version,
 		id: record.id,
 		sessionId: record.sessionId,
@@ -81,9 +84,9 @@ function recordPayload(record: Omit<PendingProtectedArtifactRecord, "integrity">
 	};
 }
 
-function digest(record: Omit<PendingProtectedArtifactRecord, "integrity">): string {
+function digest(record: Omit<PendingProtectedArtifactRecord, "integrity">, legacyNaming = false): string {
 	return createHash("sha256")
-		.update(JSON.stringify(recordPayload(record)), "utf8")
+		.update(JSON.stringify(recordPayload(record, legacyNaming)), "utf8")
 		.digest("hex");
 }
 
@@ -153,7 +156,10 @@ function parseRecord(value: unknown, sessionId: string): PendingProtectedArtifac
 		createdAt: value.createdAt,
 		integrity: { algorithm: "sha256", digest: value.integrity.digest },
 	};
-	return digest(withoutIntegrity(parsed)) === parsed.integrity.digest ? parsed : null;
+	const without = withoutIntegrity(parsed);
+	return digest(without) === parsed.integrity.digest || digest(without, true) === parsed.integrity.digest
+		? parsed
+		: null;
 }
 
 export function stagePendingProtectedArtifact(
@@ -190,7 +196,7 @@ export function clearPendingProtectedArtifact(handle: PendingProtectedArtifactHa
 	rmSync(handle.path, { force: true });
 }
 
-export function readPendingProtectedArtifacts(sessionId: string): PendingProtectedArtifactReadResult {
+function readPendingProtectedArtifacts(sessionId: string): PendingProtectedArtifactReadResult {
 	const directory = journalDirectory(sessionId);
 	if (!existsSync(directory)) return { records: [], errors: [] };
 	const records: PendingProtectedArtifactHandle[] = [];

package/src/domains/session/retry.ts

@@ -70,7 +70,7 @@ const MODEL_LOADING_MIN_DELAY_MS = 15000;
  * True when the error says the target is loading the model, so the wait should
  * be sized for disk and VRAM rather than for a provider backing off.
  */
-export function isModelLoadingErrorMessage(errorMessage: string | null | undefined): boolean {
+function isModelLoadingErrorMessage(errorMessage: string | null | undefined): boolean {
 	if (!errorMessage || errorMessage.length === 0) return false;
 	return MODEL_LOADING_PATTERN.test(errorMessage);
 }

package/src/domains/share/archive.ts

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, type Stats, statSync } from "node:fs";
 import path from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-import { type ClioSettings, readSettings, settingsPath, updateSettings } from "../../core/config.js";
+import { type ClioSettings, readSettings, settingsPath, updateSettings, validateSettings } from "../../core/config.js";
 import { DEFAULT_SETTINGS } from "../../core/defaults.js";
 import { readClioVersion } from "../../core/package-root.js";
 import {
@@ -18,6 +18,7 @@ import {
 	parseAgentRecipeSchema,
 	parseFleetContract,
 } from "../agents/index.js";
+import { migrateSettingsV1Document } from "../lifecycle/migrations/2026-09-01-settings-v2.js";
 
 export type ShareScope = "project" | "user";
 export type ShareEntryType = "project-context" | "prompt" | "skill" | "agent" | "fleet" | "settings" | "extension";
@@ -43,14 +44,14 @@ export interface ShareArchiveManifestFile {
 }
 
 export interface ShareArchiveManifest {
-	format: "clio.share.v1";
-	clioVersion: string;
+	format: "clio-coder.share.v1";
+	clioCoderVersion: string;
 	createdAt: string;
 	files: ShareArchiveManifestFile[];
 }
 
 export interface ClioShareArchive {
-	kind: "clio-share-archive";
+	kind: "clio-coder-share-archive";
 	formatVersion: 1;
 	manifest: ShareArchiveManifest;
 	files: ShareArchiveFile[];
@@ -194,17 +195,49 @@ function addTree(
 
 function settingsFragment(settings: Readonly<ClioSettings>): Record<string, unknown> {
 	return {
-		autonomy: settings.autonomy,
-		scope: settings.scope,
-		budget: settings.budget,
-		theme: settings.theme,
-		terminal: settings.terminal,
-		keybindings: settings.keybindings,
-		compaction: settings.compaction,
-		retry: settings.retry,
+		version: 2,
+		chat: {
+			modelPicker: { cycleSet: [...settings.chat.modelPicker.cycleSet] },
+			retry: structuredClone(settings.chat.retry),
+		},
+		fleet: { concurrency: settings.fleet.concurrency },
+		context: { compaction: structuredClone(settings.context.compaction) },
+		safety: {
+			autonomy: settings.safety.autonomy,
+			limits: { sessionCostUsd: settings.safety.limits.sessionCostUsd },
+		},
+		interface: structuredClone(settings.interface),
 	};
 }
 
+const SETTINGS_FRAGMENT_ROOTS = ["chat", "fleet", "context", "safety", "interface"] as const;
+
+function normalizedSettingsFragment(parsed: unknown): Record<string, unknown> {
+	if (!isRecord(parsed)) throw new Error("settings fragment must be a YAML object");
+	let normalized = parsed;
+	if (parsed.version === undefined || parsed.version === 1) {
+		normalized = migrateSettingsV1Document(parsed).document;
+	} else if (parsed.version !== 2) {
+		throw new Error(`settings fragment version must be 1 or 2, got ${String(parsed.version)}`);
+	}
+	const validation = validateSettings(normalized);
+	if (validation.issues.length > 0) {
+		throw new Error(
+			`invalid settings fragment: ${validation.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`,
+		);
+	}
+	return normalized;
+}
+
+function mergeFragmentValue(current: unknown, fragment: unknown): unknown {
+	if (!isRecord(current) || !isRecord(fragment)) return structuredClone(fragment);
+	const merged: Record<string, unknown> = { ...current };
+	for (const [key, value] of Object.entries(fragment)) {
+		merged[key] = mergeFragmentValue(merged[key], value);
+	}
+	return merged;
+}
+
 function requestedScopes(scope: ShareExportOptions["scope"]): ShareScope[] {
 	if (scope === "both") return ["project", "user"];
 	return [scope ?? "project"];
@@ -314,11 +347,11 @@ export function createShareArchive(options: ShareExportOptions = {}): ClioShareA
 
 	const manifestFiles = files.map(({ data: _data, encoding: _encoding, ...entry }) => entry);
 	return {
-		kind: "clio-share-archive",
+		kind: "clio-coder-share-archive",
 		formatVersion: 1,
 		manifest: {
-			format: "clio.share.v1",
-			clioVersion: readClioVersion(),
+			format: "clio-coder.share.v1",
+			clioCoderVersion: readClioVersion(),
 			createdAt: new Date().toISOString(),
 			files: manifestFiles,
 		},
@@ -337,13 +370,33 @@ function decodeArchiveFile(entry: ShareArchiveFile): Buffer {
 }
 
 function parseArchive(raw: unknown): ClioShareArchive {
-	if (!isRecord(raw) || raw.kind !== "clio-share-archive" || raw.formatVersion !== 1 || !isRecord(raw.manifest)) {
+	if (
+		!isRecord(raw) ||
+		(raw.kind !== "clio-coder-share-archive" && raw.kind !== "clio-share-archive") ||
+		raw.formatVersion !== 1 ||
+		!isRecord(raw.manifest)
+	) {
 		throw new Error("not a Clio share archive v1");
 	}
-	if (raw.manifest.format !== "clio.share.v1" || !Array.isArray(raw.files)) {
+	if (
+		(raw.manifest.format !== "clio-coder.share.v1" && raw.manifest.format !== "clio.share.v1") ||
+		!Array.isArray(raw.files)
+	) {
 		throw new Error("share archive manifest is malformed");
 	}
-	const archive = raw as unknown as ClioShareArchive;
+	const clioCoderVersion = raw.manifest.clioCoderVersion ?? raw.manifest.clioVersion;
+	if (typeof clioCoderVersion !== "string") throw new Error("share archive manifest is malformed");
+	const archive: ClioShareArchive = {
+		kind: "clio-coder-share-archive",
+		formatVersion: 1,
+		manifest: {
+			format: "clio-coder.share.v1",
+			clioCoderVersion,
+			createdAt: raw.manifest.createdAt as string,
+			files: raw.manifest.files as ShareArchiveManifestFile[],
+		},
+		files: raw.files as ShareArchiveFile[],
+	};
 	const allowedTypes = new Set<ShareEntryType>([
 		"project-context",
 		"prompt",
@@ -558,12 +611,12 @@ function preflightImportTargets(
 function versionDiagnostics(archive: ClioShareArchive): ShareDiagnostic[] {
 	const current = readClioVersion();
 	const [curMajor, curMinor] = current.split(".");
-	const [arcMajor, arcMinor] = archive.manifest.clioVersion.split(".");
+	const [arcMajor, arcMinor] = archive.manifest.clioCoderVersion.split(".");
 	if (curMajor !== arcMajor || curMinor !== arcMinor) {
 		return [
 			{
 				type: "warning",
-				message: `archive was created by Clio ${archive.manifest.clioVersion}; current Clio is ${current}`,
+				message: `archive was created by Clio ${archive.manifest.clioCoderVersion}; current Clio is ${current}`,
 			},
 		];
 	}
@@ -571,12 +624,18 @@ function versionDiagnostics(archive: ClioShareArchive): ShareDiagnostic[] {
 }
 
 function settingsPlan(buffer: Buffer, options: ShareImportOptions): ShareDiagnostic[] {
-	const parsed = parseYaml(buffer.toString("utf8")) as unknown;
-	if (!isRecord(parsed)) return [{ type: "error", message: "settings fragment must be a YAML object" }];
+	let parsed: Record<string, unknown>;
+	try {
+		parsed = normalizedSettingsFragment(parseYaml(buffer.toString("utf8")) as unknown);
+	} catch (error) {
+		return [{ type: "error", message: error instanceof Error ? error.message : String(error) }];
+	}
 	const settingsTarget = settingsFilePath();
 	const current = settingsFragment(existsSync(settingsTarget) ? readSettings() : DEFAULT_SETTINGS);
 	const diagnostics: ShareDiagnostic[] = [];
-	for (const [key, value] of Object.entries(parsed)) {
+	for (const [key, value] of Object.entries(parsed).filter(([key]) =>
+		(SETTINGS_FRAGMENT_ROOTS as ReadonlyArray<string>).includes(key),
+	)) {
 		if (key in current && JSON.stringify(current[key]) !== JSON.stringify(value)) {
 			diagnostics.push({
 				type: "conflict",
@@ -664,25 +723,15 @@ export function planShareImport(filePath: string, options: ShareImportOptions =
 }
 
 function mergeSettingsFragment(buffer: Buffer): string {
-	const parsed = parseYaml(buffer.toString("utf8")) as unknown;
-	if (!isRecord(parsed)) throw new Error("settings fragment must be a YAML object");
+	const parsed = normalizedSettingsFragment(parseYaml(buffer.toString("utf8")) as unknown);
 	// Single-writer rule: the merge goes through updateSettings (lock + strict
 	// re-validation), so an invalid fragment throws here instead of landing on
 	// disk. No backup sidecar: settings.yaml is machine-owned and versioned by
 	// the importer's own plan/diagnostics flow.
 	updateSettings((settings) => {
 		const next = settings as unknown as Record<string, unknown>;
-		for (const key of [
-			"autonomy",
-			"scope",
-			"budget",
-			"theme",
-			"terminal",
-			"keybindings",
-			"compaction",
-			"retry",
-		] as const) {
-			if (key in parsed) next[key] = parsed[key];
+		for (const key of SETTINGS_FRAGMENT_ROOTS) {
+			if (key in parsed) next[key] = mergeFragmentValue(next[key], parsed[key]);
 		}
 	});
 	return settingsPath();

package/src/domains/toolchain/install.ts

@@ -191,7 +191,7 @@ export async function installPinnedTool(
 			documents.push(join(dir, name));
 		}
 		writeFileSync(
-			join(staging, "clio-install.json"),
+			join(staging, "clio-coder-install.json"),
 			`${JSON.stringify(
 				{
 					id: entry.id,

package/src/engine/acp/adapter.ts

@@ -32,7 +32,7 @@ export interface AcpDelegationRunInput {
 	dynamicPromptMessages?: ReadonlyArray<{ body: string }>;
 	cwd: string;
 	safety: SafetyContract;
-	/** Session autonomy level applied by the mediator under clio-policy governance. */
+	/** Session autonomy level applied by the mediator under clio-coder-policy governance. */
 	autonomy?: AutonomyLevel;
 	signal?: AbortSignal;
 	clientVersion?: string;
@@ -223,11 +223,11 @@ export function startAcpDelegationRun(input: AcpDelegationRunInput): AcpDelegati
 	const mediator = new AcpToolMediator({
 		safety: input.safety,
 		cwd: input.cwd,
-		toolGovernance: input.agent.toolGovernance ?? "clio-policy",
+		toolGovernance: input.agent.toolGovernance ?? "clio-coder-policy",
 		...(input.autonomy !== undefined ? { autonomy: input.autonomy } : {}),
 		onPermissionResolved: (event) =>
 			emit({
-				type: "clio_permission_resolved",
+				type: "clio_coder_permission_resolved",
 				payload: event,
 			} as ClioWorkerEvent),
 	});

package/src/engine/acp/event-mapper.ts

@@ -74,7 +74,7 @@ export class AcpEventMapper {
 			return this.mapToolUpdate(update as AcpToolCallUpdate);
 		}
 		if (kind === "plan") {
-			return [{ type: "clio_plan_update", payload: update } as unknown as AgentEvent];
+			return [{ type: "clio_coder_plan_update", payload: update } as unknown as AgentEvent];
 		}
 		return [];
 	}
@@ -116,7 +116,7 @@ export class AcpEventMapper {
 			// operator surface. The descriptor composed from it here does.
 			const action = describeCallAction(update.kind ?? title, update.rawInput);
 			out.push({
-				type: "clio_tool_start",
+				type: "clio_coder_tool_start",
 				payload: {
 					tool: update.kind ?? title,
 					toolCallId,
@@ -145,7 +145,7 @@ export class AcpEventMapper {
 				isError,
 			} as unknown as AgentEvent);
 			out.push({
-				type: "clio_tool_finish",
+				type: "clio_coder_tool_finish",
 				payload: {
 					tool: update.kind ?? title,
 					toolCallId,

package/src/engine/acp/server.ts

@@ -77,10 +77,10 @@ export interface AcpSafeSettingsSnapshot extends AcpRoutingSnapshot {
 }
 
 export type AcpSafeSettingsPatch = Partial<{
-	"orchestrator.target": string | null;
-	"orchestrator.model": string | null;
-	"orchestrator.thinkingLevel": AcpThinkingLevel;
-	autonomy: AutonomyLevel;
+	"chat.target": string | null;
+	"chat.model": string | null;
+	"chat.thinkingLevel": AcpThinkingLevel;
+	"safety.autonomy": AutonomyLevel;
 }>;
 
 export interface AcpSettingsControl {
@@ -676,21 +676,26 @@ function eventTextDelta(event: AcpEventRecord): string {
 }
 
 /**
- * The next unused `clio-tool-<n>`. The counter alone is not enough: an engine
- * that names its own calls `clio-tool-1` would otherwise collide with an alias
+ * The next unused `clio-coder-tool-<n>`. The counter alone is not enough: an engine
+ * that names its own calls `clio-coder-tool-1` would otherwise collide with an alias
  * this server minted, and two different calls sharing one wire id is the exact
  * failure aliasing exists to prevent.
  */
 function nextAliasToolCallId(active: ActivePrompt): string {
 	for (;;) {
 		active.toolCallSequence += 1;
-		const alias = `clio-tool-${active.toolCallSequence}`;
+		const alias = `clio-coder-tool-${active.toolCallSequence}`;
 		if (active.usedWireIds.has(alias)) continue;
 		active.usedWireIds.add(alias);
 		return alias;
 	}
 }
 
+function normalizeReleasedAliasToolCallId(engineId: string): string {
+	const legacy = /^clio-tool-([1-9]\d*)$/u.exec(engineId);
+	return legacy === null ? engineId : `clio-coder-tool-${legacy[1]}`;
+}
+
 /** Records `wireId` as the newest wire id this engine id speaks under. */
 function pushWireId(active: ActivePrompt, engineId: string, wireId: string): string {
 	const existing = active.toolCallWireIds.get(engineId);
@@ -705,9 +710,10 @@ function pushWireId(active: ActivePrompt, engineId: string, wireId: string): str
  * call travels under a per-prompt alias.
  */
 function mintWireId(active: ActivePrompt, engineId: string): string {
-	const usable = utf8Bytes(engineId) <= ACP_MAX_TOOL_CALL_ID_BYTES && !active.usedWireIds.has(engineId);
-	if (usable) active.usedWireIds.add(engineId);
-	return pushWireId(active, engineId, usable ? engineId : nextAliasToolCallId(active));
+	const candidate = normalizeReleasedAliasToolCallId(engineId);
+	const usable = utf8Bytes(candidate) <= ACP_MAX_TOOL_CALL_ID_BYTES && !active.usedWireIds.has(candidate);
+	if (usable) active.usedWireIds.add(candidate);
+	return pushWireId(active, engineId, usable ? candidate : nextAliasToolCallId(active));
 }
 
 /**
@@ -975,14 +981,14 @@ function handleChatEvent(
 		if (last !== undefined) applyStopReason(active, last);
 		return;
 	}
-	// Clio lifecycle events (agent_start, retry_status, clio_plan_update) have
+	// Clio lifecycle events (agent_start, retry_status, clio_coder_plan_update) have
 	// no ACP v1 SessionUpdate equivalent. The prompt turn is bounded by the
 	// session/prompt response, so emitting non-spec `progress` updates would
 	// break strict clients. They are intentionally dropped. The same protocol
 	// gap applies to routing advisories (external settings divergence, active
 	// target removed): ACP v1 has no agent-initiated advisory channel, so the
 	// orchestrator records those as `custom` session-ledger entries
-	// (customType "clio.routing-notice") instead of inventing update kinds.
+	// (customType "clio-coder.routing-notice") instead of inventing update kinds.
 }
 
 const ACP_MAX_SESSION_ID_BYTES = 128;
@@ -1259,12 +1265,7 @@ function sessionResultMeta(
 	};
 }
 
-const ACP_SAFE_SETTINGS_KEYS = [
-	"orchestrator.target",
-	"orchestrator.model",
-	"orchestrator.thinkingLevel",
-	"autonomy",
-] as const;
+const ACP_SAFE_SETTINGS_KEYS = ["chat.target", "chat.model", "chat.thinkingLevel", "safety.autonomy"] as const;
 const ACP_THINKING_LEVELS = new Set<AcpThinkingLevel>(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
 const ACP_AUTONOMY_LEVELS = new Set<AutonomyLevel>(["read-only", "suggest", "auto-edit", "full-auto"]);
 const ACP_MAX_TARGETS = 64;
@@ -1288,12 +1289,12 @@ function safeSettingsProjection(snapshot: AcpSafeSettingsSnapshot): Record<strin
 	const autonomy = ACP_AUTONOMY_LEVELS.has(snapshot.autonomy) ? snapshot.autonomy : DEFAULT_AUTONOMY_LEVEL;
 	return {
 		settings: {
-			orchestrator: {
+			chat: {
 				target: safeConfiguredIdentifier(snapshot.target, ACP_MAX_TARGET_ID_BYTES),
 				model: safeConfiguredIdentifier(snapshot.model, ACP_MAX_MODEL_ID_BYTES),
 				thinkingLevel,
 			},
-			autonomy,
+			safety: { autonomy },
 		},
 		editable: [...ACP_SAFE_SETTINGS_KEYS],
 	};
@@ -2318,7 +2319,7 @@ export async function serveClioAcpAgent(options: ClioAcpServerOptions): Promise<
 				throw new AcpRequestError(-32602, "patch contains an unknown setting", { code: "invalid_params" });
 			}
 			switch (key) {
-				case "orchestrator.target": {
+				case "chat.target": {
 					if (value === null) {
 						patch[key] = null;
 						break;
@@ -2333,16 +2334,16 @@ export async function serveClioAcpAgent(options: ClioAcpServerOptions): Promise<
 					patch[key] = target;
 					break;
 				}
-				case "orchestrator.model":
+				case "chat.model":
 					patch[key] = value === null ? null : requireBoundedClientString(value, key, ACP_MAX_MODEL_ID_BYTES);
 					break;
-				case "orchestrator.thinkingLevel":
+				case "chat.thinkingLevel":
 					if (typeof value !== "string" || !ACP_THINKING_LEVELS.has(value as AcpThinkingLevel)) {
 						throw new AcpRequestError(-32602, "invalid thinking level", { code: "invalid_params" });
 					}
 					patch[key] = value as AcpThinkingLevel;
 					break;
-				case "autonomy":
+				case "safety.autonomy":
 					if (typeof value !== "string" || !ACP_AUTONOMY_LEVELS.has(value as AutonomyLevel)) {
 						throw new AcpRequestError(-32602, "invalid autonomy level", { code: "invalid_params" });
 					}
@@ -2351,8 +2352,8 @@ export async function serveClioAcpAgent(options: ClioAcpServerOptions): Promise<
 			}
 		}
 		const current = options.settings.read();
-		const nextTarget = patch["orchestrator.target"] === undefined ? current.target : patch["orchestrator.target"];
-		const nextModel = patch["orchestrator.model"] === undefined ? current.model : patch["orchestrator.model"];
+		const nextTarget = patch["chat.target"] === undefined ? current.target : patch["chat.target"];
+		const nextModel = patch["chat.model"] === undefined ? current.model : patch["chat.model"];
 		if (nextTarget === null && nextModel !== null) {
 			throw new AcpRequestError(-32602, "model requires a configured target", { code: "invalid_params" });
 		}

package/src/engine/acp/tool-mediator.ts

@@ -27,7 +27,7 @@ interface MediatorInput {
 	toolGovernance: DelegationToolGovernance;
 	/**
 	 * Session autonomy level (sd-01 §2.5). Applied after the safety net under
-	 * clio-policy governance; `ask` dispositions resolve as non-stall denials
+	 * clio-coder-policy governance; `ask` dispositions resolve as non-stall denials
 	 * because a delegation has no operator to answer a prompt.
 	 */
 	autonomy?: AutonomyLevel;
@@ -579,7 +579,7 @@ export class AcpToolMediator {
 		let safetyDecision: SafetyDecision | undefined;
 
 		if (mapped.validationError !== undefined) {
-			if (this.input.toolGovernance === "clio-policy") {
+			if (this.input.toolGovernance === "clio-coder-policy") {
 				const invalidSafetyDecisions = mapped.evaluations.map((evaluation) =>
 					this.input.safety.evaluate({ tool: evaluation.tool, args: evaluation.args }),
 				);

package/src/engine/acp/types.ts

@@ -34,7 +34,7 @@ export const ACP_MAX_CHUNK_BYTES = 16384;
  * Upper bound on a `toolCallId` this server puts on the wire, in UTF-8 bytes
  * (CONTRACT C001 §3). Identity is one call per id in both directions: an engine
  * id over this bound, missing, or already claimed by another call this turn
- * travels under a `clio-tool-<n>` alias, and an engine id starting a second call
+ * travels under a `clio-coder-tool-<n>` alias, and an engine id starting a second call
  * mints a fresh alias rather than reusing the first call's wire id. A permission
  * request binds only to an id the client already received a `tool_call` for and
  * has not yet seen finish; nothing is minted on that path.

package/src/engine/alcf-oauth.ts

@@ -40,7 +40,7 @@ function randomState(): string {
 	return base64Url(bytes);
 }
 
-export function buildAuthorizeUrl(params: { challenge: string; state: string }): string {
+function buildAuthorizeUrl(params: { challenge: string; state: string }): string {
 	const query = new URLSearchParams({
 		client_id: AUTH_CLIENT_ID,
 		response_type: "code",
@@ -55,7 +55,7 @@ export function buildAuthorizeUrl(params: { challenge: string; state: string }):
 	return `${AUTHORIZE_URL}?${query.toString()}`;
 }
 
-export function parseAuthorizationInput(input: string): string {
+function parseAuthorizationInput(input: string): string {
 	const value = input.trim();
 	if (!value) return "";
 	try {
@@ -89,7 +89,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 	return typeof value === "object" && value !== null;
 }
 
-export function selectGatewayGrant(payload: GlobusTokenResponse): GlobusTokenGrant {
+function selectGatewayGrant(payload: GlobusTokenResponse): GlobusTokenGrant {
 	const grants: GlobusTokenGrant[] = [payload, ...(Array.isArray(payload.other_tokens) ? payload.other_tokens : [])];
 	const byResourceServer = grants.find((grant) => grant.resource_server === GATEWAY_CLIENT_ID);
 	if (byResourceServer) return byResourceServer;
@@ -103,7 +103,7 @@ export function selectGatewayGrant(payload: GlobusTokenResponse): GlobusTokenGra
 	);
 }
 
-export function grantToCredentials(grant: GlobusTokenGrant, previousRefresh?: string): OAuthCredentials {
+function grantToCredentials(grant: GlobusTokenGrant, previousRefresh?: string): OAuthCredentials {
 	const access = grant.access_token;
 	if (typeof access !== "string" || access.length === 0) {
 		throw new Error("Globus token response is missing an access token for the ALCF gateway.");
@@ -172,7 +172,7 @@ async function refreshGatewayToken(refreshToken: string, signal: AbortSignal): P
 	return grantToCredentials(selectGatewayGrant(payload), refreshToken);
 }
 
-export async function loginAlcf(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
+async function loginAlcf(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
 	const { verifier, challenge } = await generatePkce();
 	const url = buildAuthorizeUrl({ challenge, state: randomState() });
 	callbacks.onAuth({

package/src/engine/antigravity/subprocess-runtime.ts

@@ -63,7 +63,7 @@ export function antigravitySubprocessConfigForAutonomy(
 	return { extraArgs: [], dangerousBypass: false, externalMode: "agy-settings-default" };
 }
 
-export function buildAntigravityPrompt(input: WorkerRunInput): string {
+function buildAntigravityPrompt(input: WorkerRunInput): string {
 	const parts: string[] = [];
 	const systemPrompt = input.systemPrompt.trim();
 	if (systemPrompt.length > 0) parts.push(systemPrompt);
@@ -75,7 +75,7 @@ export function buildAntigravityPrompt(input: WorkerRunInput): string {
 	return parts.join("\n\n");
 }
 
-export function buildAgyArgs(input: WorkerRunInput): string[] {
+function buildAgyArgs(input: WorkerRunInput): string[] {
 	assertToolProfileEnforceable(input.toolProfile, "antigravity-code");
 	const permission = antigravitySubprocessConfigForAutonomy(input.autonomy);
 	const args = ["--print", ...permission.extraArgs];

package/src/engine/api-registry.ts

@@ -78,7 +78,7 @@ function unregisterEngineApiProviders(sourceId: string): void {
 	compatUniverse?.unregisterApiProviders(sourceId);
 }
 
-export function getEngineApiProvider(api: Api): EngineRegisteredApiProvider | undefined {
+function getEngineApiProvider(api: Api): EngineRegisteredApiProvider | undefined {
 	return registry.get(api)?.provider;
 }
 

package/src/engine/apis/llamacpp-residency.ts

@@ -5,7 +5,6 @@ import {
 	type ResidencyAdapter,
 	ResidencyPreconditionError,
 	reconcileResidency,
-	resetResidencyState,
 	residencyManaged,
 	residentTagProtected,
 } from "./residency.js";
@@ -72,11 +71,6 @@ interface LlamaCppRouterProps {
 	maxInstances?: number;
 }
 
-/** Test-only: clear the reconciler's TTL cache and Clio-loaded registry. */
-export function resetLlamaCppResidencyState(): void {
-	resetResidencyState();
-}
-
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -107,19 +101,7 @@ function residentModel(model: LlamaCppRouterModel): boolean {
 	return isResidentState(model.state);
 }
 
-/** Extract resident (loaded, loading, or sleeping) model records from a /v1/models payload. */
-export function parseLlamaCppResidentModels(payload: unknown): LlamaCppResidentModel[] {
-	return parseRouterModels(payload)
-		.filter(residentModel)
-		.map((entry) => ({ id: entry.id, tags: entry.tags }));
-}
-
-/** Extract resident (loaded or loading) model ids from a /v1/models payload. */
-export function parseLlamaCppResident(payload: unknown): string[] {
-	return parseLlamaCppResidentModels(payload).map((entry) => entry.id);
-}
-
-export function parseLlamaCppRouterProps(payload: unknown): LlamaCppRouterProps {
+function parseLlamaCppRouterProps(payload: unknown): LlamaCppRouterProps {
 	if (!isRecord(payload)) return {};
 	const maxInstances = payload.max_instances;
 	return typeof maxInstances === "number" && Number.isFinite(maxInstances) && maxInstances > 0