@iowarp/clio-coder 0.4.3 → 0.4.5

package/dist/{chunk-B4OAX3SI.js → chunk-OQM5IVJY.js}

@@ -1,21 +1,14 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
-  extractCommandCdTargets,
-  extractCommandWriteTargets
-} from "./chunk-I7ZPNEJM.js";
-import {
-  artifactDefaultPath
-} from "./chunk-GYV6VZOC.js";
-import {
-  canonicalizeExistingPath
-} from "./chunk-ECH6PKUQ.js";
+  classify
+} from "./chunk-LUL5Z66S.js";
 import {
   ToolNames,
   isBuiltinToolName
-} from "./chunk-K6BSR66V.js";
+} from "./chunk-EHOSNVVM.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/json-payload.ts
 init_esm_shims();
@@ -48,192 +41,6 @@ function parseJsonObjectPayload(text) {
 // src/domains/agents/spec.ts
 init_esm_shims();
 import { createHash } from "node:crypto";
-
-// src/domains/safety/action-classifier.ts
-init_esm_shims();
-import path from "node:path";
-var GIT_DESTRUCTIVE_PATTERNS = [
-  { name: "git-push-force-long", re: /\bgit\s+push\s+--force\b/i },
-  { name: "git-push-force-short", re: /\bgit\s+push\s+-f\b/i },
-  { name: "git-reset-hard", re: /\bgit\s+reset\s+--hard\b/i },
-  { name: "git-clean-fd", re: /\bgit\s+clean\s+-fd?\b/i },
-  { name: "git-checkout-dot", re: /\bgit\s+checkout\s+--\s+\./i },
-  { name: "git-branch-D", re: /\bgit\s+branch\s+-D\b/i },
-  { name: "git-restore-source", re: /\bgit\s+restore\s+--source\b/i }
-];
-var SYSTEM_MODIFY_PATTERNS = [
-  { name: "sudo-or-doas", re: /\b(sudo|doas)\b/i },
-  // allow rm -rf /tmp/... and /var/tmp/... but flag everything else rooted at /
-  { name: "rm-rf-root", re: /\brm\s+-rf?\s+\/(?!(tmp|var\/tmp)(?:\/|\s|$))/i },
-  { name: "apt-install", re: /\bapt(-get)?\s+(install|remove|purge)/i },
-  { name: "brew-install", re: /\bbrew\s+(install|uninstall|reinstall)/i },
-  { name: "npm-install-global", re: /\bnpm\s+install\s+-g\b/i },
-  { name: "pip-install", re: /\bpip\s+install\b/i },
-  { name: "systemctl", re: /\bsystemctl\s+/i },
-  { name: "chmod-root", re: /\bchmod\s+[0-7]{3,4}\s+\//i },
-  { name: "chown", re: /\bchown\s+/i }
-];
-var SYSTEM_WRITE_ROOT_PREFIXES = ["/etc", "/usr", "/var", "/bin", "/sbin", "/run"];
-var SYSTEM_WRITE_EXEMPT_PREFIXES = ["/var/tmp", "/var/folders"];
-function isUnderPrefix(abs, prefix) {
-  return abs === prefix || abs.startsWith(`${prefix}/`);
-}
-function baseClassify(tool) {
-  switch (tool) {
-    case ToolNames.Read:
-    case ToolNames.Grep:
-    case ToolNames.Find:
-    case ToolNames.Ls:
-    case ToolNames.WebFetch:
-    case ToolNames.Git:
-    case ToolNames.CodeNav:
-    case ToolNames.Context:
-    case ToolNames.Monitor:
-    case ToolNames.AskUser:
-    case ToolNames.CredentialPresent:
-    // tasks pick mutates only Clio-owned session-ledger and project-local
-    // .clio-coder runtime state, never source-workspace files. By intentional
-    // policy it stays read class and ungated; the tool itself still requires
-    // a durable operator task id before it can mutate either store.
-    case ToolNames.Tasks:
-    // ledger posts a typed contribution to a coordination board and reads a
-    // local mirror. Neither touches the workspace, so it is never gated
-    // behind a confirmation.
-    case ToolNames.Ledger:
-    // panes focuses, opens, and closes terminal panes Clio itself created, in
-    // a pane host that lives outside the workspace. Nothing it does writes a
-    // file, runs a model-supplied command (its schema exposes presets only),
-    // or survives the session, so it is reversible, local, and never gated
-    // behind a confirmation.
-    case ToolNames.Panes:
-      return "read";
-    case ToolNames.Write:
-    case ToolNames.Edit:
-    case ToolNames.Artifact:
-      return "write";
-    case ToolNames.Bash:
-    case ToolNames.Verify:
-      return "execute";
-    case ToolNames.Dispatch:
-    case ToolNames.Steer:
-      return "dispatch";
-    default:
-      return null;
-  }
-}
-function scanStringOf(args) {
-  if (!args) return "";
-  const parts = [];
-  for (const value of Object.values(args)) {
-    if (value == null) continue;
-    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-      parts.push(String(value));
-    } else {
-      try {
-        parts.push(JSON.stringify(value));
-      } catch {
-      }
-    }
-  }
-  return parts.join(" ");
-}
-function matchFirst(patterns, haystack) {
-  for (const p of patterns) {
-    if (p.re.test(haystack)) return p;
-  }
-  return null;
-}
-function resolveCandidate(p, baseCwd) {
-  if (p.startsWith("~")) return p;
-  const base = canonicalizeExistingPath(path.resolve(baseCwd ?? process.cwd()));
-  const resolved = path.isAbsolute(p) ? path.resolve(p) : path.resolve(base, p);
-  return canonicalizeExistingPath(resolved);
-}
-function isInsideCwd(abs) {
-  const cwd = canonicalizeExistingPath(path.resolve(process.cwd()));
-  const candidate = canonicalizeExistingPath(abs);
-  const rel = path.relative(cwd, candidate);
-  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
-}
-function writePathClass(pathArg, baseCwd) {
-  if (pathArg.startsWith("~")) {
-    return { cls: "system_modify", reason: `write-path-home-escape: ${pathArg}` };
-  }
-  const abs = resolveCandidate(pathArg, baseCwd);
-  const exempt = SYSTEM_WRITE_EXEMPT_PREFIXES.some((prefix) => isUnderPrefix(abs, prefix));
-  if (!exempt) {
-    for (const prefix of SYSTEM_WRITE_ROOT_PREFIXES) {
-      if (isUnderPrefix(abs, prefix)) {
-        return { cls: "system_modify", reason: `write-path-system-root: ${prefix}` };
-      }
-    }
-  }
-  if (!isInsideCwd(abs)) {
-    return { cls: "system_modify", reason: `write-path-outside-cwd: ${abs}` };
-  }
-  return { cls: "write" };
-}
-function extractWritePath(tool, args) {
-  const candidate = args?.path ?? args?.file_path ?? args?.filePath;
-  if (typeof candidate === "string" && candidate.length > 0) return candidate;
-  return tool === ToolNames.Artifact ? artifactDefaultPath(args?.kind) : null;
-}
-function classify(call) {
-  const base = baseClassify(call.tool);
-  if (base === null) {
-    return { actionClass: "unknown", reasons: [`unknown tool: ${call.tool}`] };
-  }
-  const reasons = [];
-  if (call.tool === ToolNames.Bash) {
-    const scan = scanStringOf(call.args);
-    const gitHit = matchFirst(GIT_DESTRUCTIVE_PATTERNS, scan);
-    if (gitHit) {
-      return { actionClass: "git_destructive", reasons: [`pattern:${gitHit.name}`] };
-    }
-    const sysHit = matchFirst(SYSTEM_MODIFY_PATTERNS, scan);
-    if (sysHit) {
-      return { actionClass: "system_modify", reasons: [`pattern:${sysHit.name}`] };
-    }
-    const command = typeof call.args?.command === "string" ? call.args.command : null;
-    const argCwd = typeof call.args?.cwd === "string" && call.args.cwd.length > 0 ? call.args.cwd : void 0;
-    if (command !== null) {
-      const targetReasons = [];
-      for (const target of extractCommandWriteTargets(command)) {
-        const decision = writePathClass(target, argCwd);
-        if (decision.cls === "system_modify") {
-          targetReasons.push(decision.reason ?? `bash-write-target: ${target}`);
-        }
-      }
-      for (const target of extractCommandCdTargets(command)) {
-        if (target.startsWith("~")) {
-          targetReasons.push(`bash-cd-home-escape: ${target}`);
-          continue;
-        }
-        const abs = resolveCandidate(target, argCwd);
-        if (!isInsideCwd(abs)) {
-          targetReasons.push(`bash-cd-outside-workspace: ${abs}`);
-        }
-      }
-      if (targetReasons.length > 0) {
-        return { actionClass: "system_modify", reasons: targetReasons };
-      }
-    }
-    return { actionClass: "execute", reasons };
-  }
-  if (base === "write") {
-    const pathArg = extractWritePath(call.tool, call.args);
-    if (pathArg) {
-      const decision = writePathClass(pathArg);
-      if (decision.cls === "system_modify") {
-        return { actionClass: "system_modify", reasons: decision.reason ? [decision.reason] : [] };
-      }
-    }
-    return { actionClass: "write", reasons };
-  }
-  return { actionClass: base, reasons };
-}
-
-// src/domains/agents/spec.ts
 var AGENT_AUTOMATION_AUTHORITIES = ["read-only", "verification", "artifact-write", "workspace-edit"];
 var AGENT_PRODUCTS = ["orientation"];
 var AGENT_CATEGORIES = [
@@ -469,7 +276,7 @@ ${errors.map((error) => `- ${error}`).join("\n")}`);
 // src/domains/agents/result-contract.ts
 init_esm_shims();
 import { createHash as createHash2 } from "node:crypto";
-import path2 from "node:path";
+import path from "node:path";
 function parseDelegationPlanResult(output) {
   const parsed = parseJson(output);
   if (!parsed.ok || !hasOnlyKeys(parsed.value, ["tasks"]) || !Array.isArray(parsed.value.tasks) || parsed.value.tasks.length === 0)
@@ -792,17 +599,17 @@ function parseChecks(value) {
   return checks;
 }
 function citationWithinWorkspace(cwd, citedPath) {
-  const relative = path2.relative(cwd, citedPath);
+  const relative = path.relative(cwd, citedPath);
   if (relative === "") return true;
-  return !(relative === ".." || relative.startsWith(`..${path2.sep}`) || path2.isAbsolute(relative));
+  return !(relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative));
 }
 function directoryCitationDigest(cwd, citedPath) {
-  const relative = path2.relative(cwd, citedPath);
+  const relative = path.relative(cwd, citedPath);
   return createHash2("sha256").update(`directory:${relative === "" ? "." : relative}`, "utf8").digest("hex");
 }
 function validateScoutCitation(input, citation) {
-  const cwd = path2.resolve(input.cwd);
-  const citedPath = path2.resolve(cwd, citation.path);
+  const cwd = path.resolve(input.cwd);
+  const citedPath = path.resolve(cwd, citation.path);
   if (!citationWithinWorkspace(cwd, citedPath)) {
     return { ok: false, reason: `Scout citation path escapes the workspace: ${citation.path}` };
   }
@@ -967,6 +774,27 @@ function validateCodeReport(contract, output) {
   return success(contract, "unmeasured", value);
 }
 var RESULT_COMMIT_MESSAGE_MAX_BYTES = 1e3;
+var RESULT_SUMMARY_DEFAULT_MAX_BYTES = 16384;
+var RESULT_SUMMARY_MAX_BYTES_CEILING = 32768;
+var RESULT_OUTPUT_ENVELOPE_HEADROOM_BYTES = 4096;
+function resultSummaryMaxBytes(contract) {
+  if (contract.kind !== "mutation-report") return RESULT_COMMIT_MESSAGE_MAX_BYTES;
+  return contract.maxSummaryBytes ?? RESULT_SUMMARY_DEFAULT_MAX_BYTES;
+}
+function parseResultSummaryMaxBytes(value, label) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1 || value > RESULT_SUMMARY_MAX_BYTES_CEILING) {
+    throw new Error(`${label} must be an integer between 1 and ${RESULT_SUMMARY_MAX_BYTES_CEILING}`);
+  }
+  return value;
+}
+function withResultSummaryAllowance(contract, maxSummaryBytes) {
+  if (contract.kind !== "mutation-report") return contract;
+  return { kind: "mutation-report", maxSummaryBytes: parseResultSummaryMaxBytes(maxSummaryBytes, "maxSummaryBytes") };
+}
+function resultContractOutputBytes(contract) {
+  if (contract === null || contract === void 0 || contract.kind !== "mutation-report") return null;
+  return 2 * resultSummaryMaxBytes(contract) + 2 * RESULT_COMMIT_MESSAGE_MAX_BYTES + RESULT_OUTPUT_ENVELOPE_HEADROOM_BYTES;
+}
 var AUTHORSHIP_FIELDS = ["commitMessage", "summary"];
 function hasControlCharacters(value) {
   for (const character of value) {
@@ -979,15 +807,15 @@ function hasControlCharacters(value) {
 function normalizeAuthored(value) {
   return value.replace(/\r\n/gu, "\n").replace(/\r/gu, "\n").trim();
 }
-function validateAuthorship(value) {
+function validateAuthorship(value, summaryMaxBytes) {
   for (const field of AUTHORSHIP_FIELDS) {
+    const maxBytes = field === "summary" ? summaryMaxBytes : RESULT_COMMIT_MESSAGE_MAX_BYTES;
     const raw = value[field];
     if (raw === void 0 || raw === null) continue;
     if (typeof raw !== "string") return `${field} must be a string when present`;
     if (raw.trim().length === 0) continue;
-    if (Buffer.byteLength(raw, "utf8") > RESULT_COMMIT_MESSAGE_MAX_BYTES) {
-      return `${field} must be at most ${RESULT_COMMIT_MESSAGE_MAX_BYTES} bytes`;
-    }
+    const bytes = Buffer.byteLength(raw, "utf8");
+    if (bytes > maxBytes) return `${field} must be at most ${maxBytes} UTF-8 bytes (${bytes} given)`;
     if (hasControlCharacters(raw)) return `${field} must not contain control characters`;
   }
   return null;
@@ -996,7 +824,7 @@ function resultContractAuthorship(contract, output) {
   const empty = { commitMessage: null, summary: null };
   if (contract.kind !== "mutation-report" && contract.kind !== "architect-plan") return empty;
   const parsed = parseJson(output);
-  if (!parsed.ok || validateAuthorship(parsed.value) !== null) return empty;
+  if (!parsed.ok || validateAuthorship(parsed.value, resultSummaryMaxBytes(contract)) !== null) return empty;
   const read = (field) => {
     const raw = parsed.value[field];
     if (typeof raw !== "string") return null;
@@ -1141,7 +969,7 @@ function validateWorldKnowledge(contract, output, externalSourcesAllowed) {
 }
 function describeWriteSet(effects, cwd) {
   if (effects.mutatedPaths.size === 0) return "this run wrote nothing";
-  const written = [...effects.mutatedPaths].map((target) => path2.relative(cwd, target) || target).sort().slice(0, MUTATION_WRITE_SET_REASON_LIMIT);
+  const written = [...effects.mutatedPaths].map((target) => path.relative(cwd, target) || target).sort().slice(0, MUTATION_WRITE_SET_REASON_LIMIT);
   const more = effects.mutatedPaths.size - written.length;
   return `this run wrote ${written.join(", ")}${more > 0 ? ` (+${more} more)` : ""}`;
 }
@@ -1159,23 +987,31 @@ function mutationValidationsReason(value) {
   return `Mutation result must carry typed validation results: every validations entry is shaped like ${MUTATION_VALIDATION_EXAMPLE}, with a string name, a boolean passed, a string evidence, and no other keys.`;
 }
 function validateMutation(contract, input) {
+  if (input.outputTruncated === true && input.output !== null) {
+    const bound = resultContractOutputBytes(contract) ?? Buffer.byteLength(input.output, "utf8");
+    return failure(
+      contract,
+      "unmeasured",
+      `result exceeded the sealed output bound of ${bound} bytes and was truncated; keep summary within ${resultSummaryMaxBytes(contract)} UTF-8 bytes or state the limitation`
+    );
+  }
   const parsed = parseJson(input.output);
   if (!parsed.ok) return failure(contract, "unmeasured", parsed.reason);
   const value = parsed.value;
   if (!hasOnlyKeys(value, ["mutatedPaths", "validations", "commitMessage", "summary"]) || !Array.isArray(value.mutatedPaths) || value.mutatedPaths.some((entry) => !string(entry))) {
     return failure(contract, "unmeasured", "Mutation result must carry mutatedPaths and validations");
   }
-  const authorship = validateAuthorship(value);
+  const authorship = validateAuthorship(value, resultSummaryMaxBytes(contract));
   if (authorship !== null) return failure(contract, "unmeasured", authorship);
   const validations = parseChecks(value.validations);
   if (validations === null) return failure(contract, "unmeasured", mutationValidationsReason(value.validations));
   const reportedFailure = !validations.every((check) => check.passed);
   const effects = input.observedRunEffects;
   if (effects === void 0) return success(contract, reportedFailure ? "fail" : "pass", value);
-  const cwd = path2.resolve(input.cwd);
+  const cwd = path.resolve(input.cwd);
   let unverifiedMutation = false;
   for (const reported of value.mutatedPaths) {
-    const target = path2.resolve(cwd, reported);
+    const target = path.resolve(cwd, reported);
     if (effects.mutatedPaths.has(target)) continue;
     if (effects.failedMutationPaths.has(target)) {
       return failure(
@@ -1214,7 +1050,7 @@ function validateProvenance(contract, output) {
   return success(contract, "unmeasured", value);
 }
 function validateArchitect(contract, input) {
-  const artifactPath = path2.resolve(input.cwd, contract.path);
+  const artifactPath = path.resolve(input.cwd, contract.path);
   const content = input.filesystem.readFile(artifactPath);
   if (content === null || content.trim().length === 0) {
     return failure(contract, "unmeasured", `required plan artifact is missing or empty: ${contract.path}`);
@@ -1278,8 +1114,22 @@ function validateResultContract(input) {
       return validateOracle(input.contract, input.output);
     case "external-delegation":
       return success(input.contract, "unmeasured", { external: true });
-    case "artifact-report":
+    case "artifact-report": {
+      if (input.contract.path !== void 0) {
+        const content = input.filesystem.readFile(path.resolve(input.cwd, input.contract.path));
+        if (content === null) {
+          return failure(
+            input.contract,
+            "unmeasured",
+            `Required artifact is missing or unreadable: ${JSON.stringify(input.contract.path)}`
+          );
+        }
+        if (content.trim().length === 0) {
+          return failure(input.contract, "unmeasured", `Required artifact is empty: ${JSON.stringify(input.contract.path)}`);
+        }
+      }
       return success(input.contract, "unmeasured", { artifact: true });
+    }
     case "context-handbook":
       return validateContextHandbook(input.contract, input.output);
     case "code-report":
@@ -1305,7 +1155,8 @@ function validateRecipeResult(input) {
     cwd: input.cwd,
     networkAllowed: input.networkAllowed,
     filesystem: input.filesystem,
-    ...input.observedRunEffects !== void 0 ? { observedRunEffects: input.observedRunEffects } : {}
+    ...input.observedRunEffects !== void 0 ? { observedRunEffects: input.observedRunEffects } : {},
+    ...input.outputTruncated !== void 0 ? { outputTruncated: input.outputTruncated } : {}
   });
   return {
     applicable: true,
@@ -1339,7 +1190,7 @@ function resultContractShape(contract) {
     case "world-knowledge-report":
       return '{"discovery":"performed|caller-supplied-only|unavailable","facts":[{"claim":"...","evidence":"...","sources":["URL or document id"]}],"synthesis":["comparison or advisory conclusion"],"uncertainties":["..."],"followUpVerification":["..."]}';
     case "mutation-report":
-      return '{"mutatedPaths":["src/file.ts"],"validations":[{"name":"npm test","passed":true,"evidence":"exit 0"}],"commitMessage":"optional: the commit message for this change","summary":"optional: one line"}';
+      return `{"mutatedPaths":["src/file.ts"],"validations":[{"name":"npm test","passed":true,"evidence":"exit 0"}],"commitMessage":"optional: the commit message for this change","summary":"the requested explanation or deliverable, or a specific limitation; otherwise optional"}. summary allows at most ${resultSummaryMaxBytes(contract)} UTF-8 bytes and commitMessage at most ${RESULT_COMMIT_MESSAGE_MAX_BYTES} UTF-8 bytes. Preserve the requested explanation and citations in summary when repairing the report; if they cannot fit or be grounded, state that specific limitation. Report only actual mutations and checks; a read-only task has mutatedPaths:[] and names the source read in validations, never a command that did not run`;
     case "provenance-report":
       return '{"confirmedFacts":["..."],"missingEvidence":["..."],"nextInspections":["..."]}';
     case "delegation-plan":
@@ -1349,7 +1200,7 @@ function resultContractShape(contract) {
     case "external-delegation":
       return "any final text";
     case "artifact-report":
-      return "any final text; the artifact you wrote at the location the task named is the result";
+      return contract.path === void 0 ? "any final text; the artifact you wrote at the location the task named is the result" : `any final text; the required artifact at ${JSON.stringify(contract.path)} must be readable and non-empty on disk`;
     case "context-handbook":
       return '{"projectName":"string","identity":"one sentence","conventions":[],"invariants":[],"sections":[{"title":"Architecture","body":"markdown that cites `real/path.ts` tokens"}]}';
     case "code-report":
@@ -1358,20 +1209,32 @@ function resultContractShape(contract) {
 }
 function resultContractRepairMessage(input) {
   const last = input.attempt >= RESULT_CONTRACT_REPAIR_LIMIT;
+  const boundArtifact = input.contract.kind === "artifact-report" && input.contract.path !== void 0;
   const lines = [
     last ? "FINAL RESULT REQUIRED IN THIS RESPONSE. Your previous response still did not satisfy this run's result contract." : "Your previous response did not satisfy this run's result contract.",
     `Validator reason: ${input.reason}`,
     input.toolsAvailable === true ? "You may use the admitted tools to repair this validator failure, then emit the required terminal result." : "Tool use is over. Answer from the evidence you already gathered.",
-    `Emit exactly this shape and nothing else: ${resultContractShape(input.contract)}`,
-    "Do not add prose, code fences, or commentary around it. Do not describe work you intend to do next."
+    ...boundArtifact ? [
+      `Required result: ${resultContractShape(input.contract)}`,
+      input.toolsAvailable === true ? "Repair the required artifact on disk, then give a brief final status. Literal tool-call markup in final text does not write a file." : "State the limitation in a brief final status; the required artifact remains unsatisfied."
+    ] : [
+      `Emit exactly this shape and nothing else: ${resultContractShape(input.contract)}`,
+      "Do not add prose, code fences, or commentary around it. Do not describe work you intend to do next."
+    ]
   ];
   if (input.anchors.length > 0) {
     lines.push(
       "",
-      "Locations you read successfully in this run (use these exact path:line values):",
+      "Source ranges you read successfully in this run (path:start-end, inclusive):",
       ...input.anchors.slice(-RESULT_CONTRACT_ANCHOR_LIMIT).map((anchor) => `- ${anchor}`)
     );
   }
+  if (input.contract.kind === "scout-report") {
+    lines.push(
+      "For each finding, use the exact source line that supports its claim inside a listed read range. Range endpoints are not suggested citations.",
+      "If a finding's supporting line cannot be confirmed from the source already returned, remove that finding and keep the confirmed findings. Never shift a rejected citation into range just to pass validation."
+    );
+  }
   return lines.join("\n");
 }
 var RESULT_CONTRACT_REPAIR_TOOL = "result_contract";
@@ -1420,7 +1283,7 @@ var RECIPE_DECLARABLE_KINDS = [
   "delegation-plan"
 ];
 var COORDINATOR_AUTHORED_KINDS = ["council-ballot"];
-function parseContract(value, sourcePath, kinds) {
+function parseContract(value, sourcePath, kinds, callerBoundArtifacts = false) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`agent recipe: ${sourcePath}: resultContract must be an object`);
   }
@@ -1432,11 +1295,38 @@ function parseContract(value, sourcePath, kinds) {
     if (!only("kind", "path") || !string(record.path)) {
       throw new Error(`agent recipe: ${sourcePath}: architect-plan requires only non-empty path`);
     }
-    if (path2.isAbsolute(record.path) || record.path.split(/[\\/]/u).includes("..")) {
+    if (path.isAbsolute(record.path) || record.path.split(/[\\/]/u).includes("..")) {
       throw new Error(`agent recipe: ${sourcePath}: architect-plan path must be workspace-relative`);
     }
     return { kind: "architect-plan", path: record.path };
   }
+  if (record.kind === "artifact-report" && callerBoundArtifacts) {
+    if (!only("kind", "path")) {
+      throw new Error(`agent recipe: ${sourcePath}: artifact-report admits only kind and path`);
+    }
+    if (record.path === void 0) return { kind: "artifact-report" };
+    if (!string(record.path) || record.path.includes("\0")) {
+      throw new Error(`agent recipe: ${sourcePath}: artifact-report requires a non-empty path without NUL`);
+    }
+    if (path.posix.isAbsolute(record.path) || path.win32.isAbsolute(record.path) || /^[a-z]:/iu.test(record.path) || record.path.split(/[\\/]/u).includes("..")) {
+      throw new Error(`agent recipe: ${sourcePath}: artifact-report path must be workspace-relative`);
+    }
+    return { kind: "artifact-report", path: record.path };
+  }
+  if (record.kind === "mutation-report") {
+    if (!only("kind", "maxSummaryBytes")) {
+      throw new Error(`agent recipe: ${sourcePath}: mutation-report admits only kind and maxSummaryBytes`);
+    }
+    if (record.maxSummaryBytes === void 0) return { kind: "mutation-report" };
+    try {
+      return {
+        kind: "mutation-report",
+        maxSummaryBytes: parseResultSummaryMaxBytes(record.maxSummaryBytes, "maxSummaryBytes")
+      };
+    } catch (error) {
+      throw new Error(`agent recipe: ${sourcePath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
   if (!kinds.includes(record.kind) || !only("kind")) {
     throw new Error(`agent recipe: ${sourcePath}: resultContract.kind is unsupported or has unknown keys`);
   }
@@ -1446,12 +1336,11 @@ function parseResultContract(value, sourcePath) {
   return parseContract(value, sourcePath, RECIPE_DECLARABLE_KINDS);
 }
 function parseWorkerResultContract(value, sourcePath) {
-  return parseContract(value, sourcePath, [...RECIPE_DECLARABLE_KINDS, ...COORDINATOR_AUTHORED_KINDS]);
+  return parseContract(value, sourcePath, [...RECIPE_DECLARABLE_KINDS, ...COORDINATOR_AUTHORED_KINDS], true);
 }
 
 export {
   parseJsonObjectPayload,
-  classify,
   AGENT_AUTOMATION_AUTHORITIES,
   isAgentCategory,
   isAgentCapabilityClass,
@@ -1471,6 +1360,10 @@ export {
   resultContractSourceId,
   parseVerifierResult,
   parseOracleResult,
+  RESULT_SUMMARY_MAX_BYTES_CEILING,
+  parseResultSummaryMaxBytes,
+  withResultSummaryAllowance,
+  resultContractOutputBytes,
   resultContractAuthorship,
   parseScoutResult,
   validateResultContract,
@@ -1481,4 +1374,4 @@ export {
   parseResultContract,
   parseWorkerResultContract
 };
-//# sourceMappingURL=chunk-B4OAX3SI.js.map
+//# sourceMappingURL=chunk-OQM5IVJY.js.map

package/dist/{chunk-XRZT5WY5.js → chunk-P5SC4DLJ.js}

@@ -1,13 +1,13 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   atomicWrite
-} from "./chunk-HAXOFFRH.js";
+} from "./chunk-FQOOGXBH.js";
 import {
   clioStateDir
-} from "./chunk-BYP5D4HI.js";
+} from "./chunk-CTTI7G3T.js";
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/dispatch/code-step-store.ts
 init_esm_shims();
@@ -44,4 +44,4 @@ export {
   writeCodeStepRecord,
   readCodeStepRecords
 };
-//# sourceMappingURL=chunk-XRZT5WY5.js.map
+//# sourceMappingURL=chunk-P5SC4DLJ.js.map

package/dist/{chunk-R6Q67RJH.js → chunk-PECBKCDK.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/domains/context/wiki/plan.ts
 init_esm_shims();
@@ -60,12 +60,17 @@ function overviewPage(source) {
   return {
     path: "architecture.md",
     title: "Architecture",
-    intent: "Explain what this repository is, its top-level composition, how a request or command flows through it, and where the boundaries between its major areas are.",
+    intent: "Explain what this repository is and its top-level composition; describe relationships, boundaries, and request or command flow where the inspected source establishes them.",
     sources: rankedSources(entries.length > 0 ? entries : source),
     status: "pending",
     attempts: 0
   };
 }
+function intentForScope(files, areaDepth) {
+  const lines = files.reduce((total, file) => total + Math.max(0, file.loc), 0);
+  const scopes = [...new Set(files.map((file) => areaForPath(file.path, areaDepth)))];
+  return `Assigned scope (${files.length} indexed files, ${lines} lines): document responsibilities and key entry points/symbols; explain lifecycle rules, callers, dependencies, and specific test cases only where inspected source or tests establish them. Anchors are starting points, not the full assignment. Assigned areas: ` + scopes.join(", ") + ".";
+}
 function buildCandidatePlan(codewiki, depth) {
   const source = codewiki.files.filter((file) => file.lang !== "config");
   const totalLines = source.reduce((total, file) => total + Math.max(0, file.loc), 0);
@@ -83,21 +88,38 @@ function buildCandidatePlan(codewiki, depth) {
     if (host === void 0) continue;
     extras.set(host, [...extras.get(host) ?? [], ...area.files]);
   }
+  const overview = overviewPage(source);
+  const [onlyArea] = selected;
+  if (depth === "simple" && selected.length === 1 && onlyArea) {
+    const files = [...onlyArea.files, ...extras.get(onlyArea.key) ?? []];
+    return {
+      version: 1,
+      depth,
+      overview: "",
+      pages: [
+        { ...overview, intent: `${overview.intent} ${intentForScope(files, areaDepth)}`, sources: rankedSources(files) }
+      ]
+    };
+  }
   const pages = selected.map((area) => {
     const files = [...area.files, ...extras.get(area.key) ?? []];
     return {
       path: pagePathForArea(area.key),
       title: titleForArea(area.key),
-      intent: `Document ${area.key} (${area.files.length} indexed files, ${area.lines} lines): what it owns, its entry points and important symbols, the state and lifecycle invariants it enforces, an upstream caller and a downstream dependency, the focused tests that prove its behavior, and what to watch when editing it.`,
+      intent: intentForScope(files, areaDepth),
       sources: rankedSources(files),
       status: "pending",
       attempts: 0
     };
   });
+  if (pages.length > 0) {
+    overview.intent += " Link to the area pages for detailed behavior; keep this page focused on their composition and relationships.";
+  }
   return dedupePagePaths({
     version: 1,
+    depth,
     overview: "",
-    pages: [overviewPage(source), ...pages]
+    pages: [overview, ...pages]
   });
 }
 function dedupePagePaths(plan) {
@@ -120,7 +142,13 @@ function planWikiGeneration(codewiki, requestedDepth = "auto") {
   const sourceFiles = source.length;
   const sourceLines = source.reduce((total, file) => total + Math.max(0, file.loc), 0);
   const depth = requestedDepth === "auto" ? classifyDepth(sourceFiles, sourceLines) : requestedDepth;
-  return { requestedDepth, depth, sourceFiles, sourceLines, plan: buildCandidatePlan(codewiki, depth) };
+  return {
+    requestedDepth,
+    depth,
+    sourceFiles,
+    sourceLines,
+    plan: { ...buildCandidatePlan(codewiki, depth), requestedDepth }
+  };
 }
 
 export {
@@ -131,4 +159,4 @@ export {
   buildCandidatePlan,
   planWikiGeneration
 };
-//# sourceMappingURL=chunk-R6Q67RJH.js.map
+//# sourceMappingURL=chunk-PECBKCDK.js.map

package/dist/{chunk-33YXPOE3.js → chunk-PPEZJWUG.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/core/workspace-files.ts
 init_esm_shims();
@@ -336,4 +336,4 @@ export {
   enumerateWorkspaceFilesAsync,
   filterWorkspaceFileCandidates
 };
-//# sourceMappingURL=chunk-33YXPOE3.js.map
+//# sourceMappingURL=chunk-PPEZJWUG.js.map