@iowarp/clio-coder 0.4.7 → 0.4.9

package/dist/{chunk-7EEGBKV4.js → chunk-FEBQWHJT.js}

@@ -1,39 +1,39 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   verifyTool
-} from "./chunk-L3Z5ANCV.js";
+} from "./chunk-RQROVOV3.js";
 import {
-  discoverDeclaredChecksAtRoot,
-  discoverDeclaredProjectEntriesAtRoot
-} from "./chunk-TLTGZTXI.js";
+  VALIDATION_CONTRACT_MARKDOWN_PATH,
+  loadValidationContract
+} from "./chunk-PTFISXQO.js";
 import {
   parseTomlDocument,
   tomlTableAt
 } from "./chunk-LQTKDAUO.js";
 import {
-  VALIDATION_CONTRACT_MARKDOWN_PATH,
-  loadValidationContract
-} from "./chunk-T52TPHYC.js";
+  discoverDeclaredChecksAtRoot,
+  discoverDeclaredProjectEntriesAtRoot
+} from "./chunk-QI72X67S.js";
 import {
   PROJECT_VERIFIER_CATALOG_CAPS,
   PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
   PROJECT_VERIFIER_CATALOG_VERSION,
-  normalizeNumericTolerance,
   parseProjectVerifierCatalogText
-} from "./chunk-BO4XV5VX.js";
+} from "./chunk-H72DCH3E.js";
 import {
-  compareCodepoints
-} from "./chunk-B6UM3OZC.js";
+  compareCodepoints,
+  normalizeNumericTolerance
+} from "./chunk-2KUBKL63.js";
 import {
   isVerificationScriptName
 } from "./chunk-M4KFUXS7.js";
-import {
-  SAFE_EXEC_DEFAULT_TIMEOUT_MS,
-  resolveSafeCwd
-} from "./chunk-GJ24ODAX.js";
 import {
   require_dist
 } from "./chunk-B5GGDIHT.js";
+import {
+  SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+  resolveSafeCwd
+} from "./chunk-XTQ7MEJG.js";
 import {
   __toESM,
   init_esm_shims
@@ -523,7 +523,7 @@ function validationContractProposals(workspaceRoot, diagnostics) {
   }
   return proposals;
 }
-function numericContractProposals(workspaceRoot) {
+function numericContractProposals(workspaceRoot, diagnostics) {
   const loaded = loadValidationContract(workspaceRoot);
   if (!loaded.ok || loaded.contract === null) return [];
   const proposals = [];
@@ -531,7 +531,12 @@ function numericContractProposals(workspaceRoot) {
   for (const artifact of loaded.contract.artifacts ?? []) {
     if (artifact.numerical_tolerances === void 0) continue;
     const tolerance = normalizeNumericTolerance(artifact.numerical_tolerances);
-    if (tolerance instanceof Error) continue;
+    if (tolerance instanceof Error) {
+      diagnostics.push(
+        `${loaded.path}: artifact ${JSON.stringify(artifact.path)} numeric proposal skipped: ${tolerance.message}`
+      );
+      continue;
+    }
     const base = slug(path.basename(artifact.path).replace(/\.[^.]+$/u, ""), "artifact");
     const preferred = boundedId(`numeric-${base}`);
     let id = preferred;
@@ -642,7 +647,7 @@ function discoverVerifierAuthoring(workspaceRoot = process.cwd()) {
     activeChecks,
     existingChecks,
     proposals,
-    numericProposals: numericContractProposals(workspaceRoot),
+    numericProposals: numericContractProposals(workspaceRoot, diagnostics),
     diagnostics,
     manualEntry,
     ...typeof catalogText === "string" ? { catalogText } : {}
@@ -1015,4 +1020,4 @@ export {
   previewVerifierDraft,
   runVerifierAuthoringWorkflow
 };
-//# sourceMappingURL=chunk-7EEGBKV4.js.map
+//# sourceMappingURL=chunk-FEBQWHJT.js.map

package/dist/{chunk-4QKAITQT.js → chunk-FPS4R2RN.js}

@@ -11,23 +11,23 @@ import {
   THEME_NAMED_COLORS,
   THINKING_LEVELS,
   normalizeOutputStyle
-} from "./chunk-3XE4NRLF.js";
+} from "./chunk-ZKJU55MX.js";
+import {
+  require_dist
+} from "./chunk-B5GGDIHT.js";
 import {
   MAX_TIMER_DELAY_MS
 } from "./chunk-6EXUUOSN.js";
 import {
   withStateFileLockSync
 } from "./chunk-DVJL77SO.js";
-import {
-  require_dist
-} from "./chunk-B5GGDIHT.js";
-import {
-  safeResourceWrite
-} from "./chunk-ZZFWWYLX.js";
 import {
   clioConfigDir,
   resolveClioDirs
 } from "./chunk-CTTI7G3T.js";
+import {
+  safeResourceWrite
+} from "./chunk-ZZFWWYLX.js";
 import {
   __toESM,
   init_esm_shims
@@ -456,6 +456,7 @@ function validateTarget(issues, path, value) {
     "lifecycle",
     "gateway",
     "pricing",
+    "cache",
     "lmstudio",
     "litellm",
     "maxConcurrentRequests"
@@ -505,6 +506,68 @@ function validateTarget(issues, path, value) {
     const v = validatePricing(issues, `${path}.pricing`, value.pricing);
     if (v !== void 0) target.pricing = v;
   }
+  if ("cache" in value) {
+    if (!isPlainObject(value.cache)) issues.add(`${path}.cache`, "expected a map");
+    else {
+      issues.unknownKeys(`${path}.cache`, value.cache, ["retention", "deployment", "warm"]);
+      target.cache = {};
+      if ("retention" in value.cache) {
+        const retention = expectEnum(issues, `${path}.cache.retention`, value.cache.retention, [
+          "none",
+          "short",
+          "long"
+        ]);
+        if (retention !== void 0) target.cache.retention = retention;
+      }
+      if ("deployment" in value.cache) {
+        const binding = value.cache.deployment;
+        const bindingPath = `${path}.cache.deployment`;
+        if (!isPlainObject(binding)) issues.add(bindingPath, "expected a map");
+        else {
+          issues.unknownKeys(bindingPath, binding, ["backend", "controlUrl", "model", "build", "gatewayDeploymentId"]);
+          const backend = expectEnum(issues, `${bindingPath}.backend`, binding.backend, ["llamacpp", "vllm"]);
+          for (const key of ["controlUrl", "model", "build"]) {
+            if (typeof binding[key] !== "string" || !binding[key].trim())
+              issues.add(`${bindingPath}.${key}`, "expected a nonempty string");
+          }
+          if (typeof binding.controlUrl === "string") {
+            try {
+              const url = new URL(binding.controlUrl);
+              if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+                throw new Error("invalid URL");
+            } catch {
+              issues.add(`${bindingPath}.controlUrl`, "expected an HTTP(S) URL without credentials, query, or fragment");
+            }
+          }
+          if (binding.gatewayDeploymentId !== void 0 && (typeof binding.gatewayDeploymentId !== "string" || !binding.gatewayDeploymentId.trim()))
+            issues.add(`${bindingPath}.gatewayDeploymentId`, "expected a nonempty string");
+          if (backend && typeof binding.controlUrl === "string" && typeof binding.model === "string" && typeof binding.build === "string") {
+            target.cache.deployment = {
+              backend,
+              controlUrl: binding.controlUrl,
+              model: binding.model,
+              build: binding.build,
+              ...typeof binding.gatewayDeploymentId === "string" ? { gatewayDeploymentId: binding.gatewayDeploymentId } : {}
+            };
+          }
+        }
+      }
+      if ("warm" in value.cache) {
+        if (!isPlainObject(value.cache.warm)) issues.add(`${path}.cache.warm`, "expected a map");
+        else {
+          issues.unknownKeys(`${path}.cache.warm`, value.cache.warm, ["maxInputTokens", "maxDurationMs", "cooldownMs"]);
+          target.cache.warm = {};
+          for (const key of ["maxInputTokens", "maxDurationMs", "cooldownMs"]) {
+            const bound = value.cache.warm[key];
+            if (bound === void 0) continue;
+            if (typeof bound !== "number" || !Number.isSafeInteger(bound) || bound < 1)
+              issues.add(`${path}.cache.warm.${key}`, "expected a positive safe integer");
+            else target.cache.warm[key] = bound;
+          }
+        }
+      }
+    }
+  }
   if ("lmstudio" in value) {
     const v = validateLmStudioSettings(issues, `${path}.lmstudio`, value.lmstudio);
     if (v !== void 0) target.lmstudio = v;
@@ -1033,13 +1096,14 @@ function validateSettings(raw) {
             "maxRetries",
             "baseDelayMs",
             "maxDelayMs",
-            "streamStallMs"
+            "streamStallMs",
+            "firstTokenStallMs"
           ]);
           if ("enabled" in chat.retry) {
             const parsed = expectBoolean(issues, "chat.retry.enabled", chat.retry.enabled);
             if (parsed !== void 0) settings.chat.retry.enabled = parsed;
           }
-          for (const key of ["maxRetries", "baseDelayMs", "maxDelayMs", "streamStallMs"]) {
+          for (const key of ["maxRetries", "baseDelayMs", "maxDelayMs", "streamStallMs", "firstTokenStallMs"]) {
             if (!(key in chat.retry)) continue;
             const parsed = expectInteger(issues, `chat.retry.${key}`, chat.retry[key], { min: 0 });
             if (parsed !== void 0) settings.chat.retry[key] = parsed;
@@ -1908,4 +1972,4 @@ export {
   removeFleetProfileFromSettings,
   bindAgentProfileInSettings
 };
-//# sourceMappingURL=chunk-4QKAITQT.js.map
+//# sourceMappingURL=chunk-FPS4R2RN.js.map

package/dist/chunk-G5R53COU.js

@@ -0,0 +1,68 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  withStateFileLock
+} from "./chunk-DVJL77SO.js";
+import {
+  safeResourceWrite
+} from "./chunk-ZZFWWYLX.js";
+import {
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/domains/observability/evidence-index.ts
+init_esm_shims();
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+var MAX_EVIDENCE_INDEX_ROWS = 1e3;
+var EVIDENCE_INDEX_FILE = "evidence-index.json";
+var evidenceIndexWriteQueue = Promise.resolve();
+function indexPath(stateDir) {
+  return join(stateDir, EVIDENCE_INDEX_FILE);
+}
+function isEvidenceIndexRow(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const row = value;
+  return typeof row.runId === "string" && typeof row.evidenceId === "string" && Array.isArray(row.tags) && row.tags.every((tag) => typeof tag === "string") && typeof row.firstPassSuccess === "boolean" && typeof row.findingCount === "number" && (row.succeeded === void 0 || typeof row.succeeded === "boolean") && (row.completionEvidenceWarning === void 0 || typeof row.completionEvidenceWarning === "boolean") && (row.ungroundedClaims === void 0 || typeof row.ungroundedClaims === "number" && Number.isSafeInteger(row.ungroundedClaims) && row.ungroundedClaims >= 0) && typeof row.generatedAt === "string";
+}
+function readEvidenceIndex(stateDir) {
+  let raw;
+  try {
+    raw = readFileSync(indexPath(stateDir), "utf8");
+  } catch {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  return parsed.filter(isEvidenceIndexRow);
+}
+async function writeEvidenceIndexRow(stateDir, row) {
+  let bounded = [];
+  await withStateFileLock(indexPath(stateDir), () => {
+    const existing = readEvidenceIndex(stateDir).filter((entry) => entry.runId !== row.runId);
+    existing.push(row);
+    bounded = existing.length > MAX_EVIDENCE_INDEX_ROWS ? existing.slice(-MAX_EVIDENCE_INDEX_ROWS) : existing;
+    safeResourceWrite(indexPath(stateDir), `${JSON.stringify(bounded, null, 2)}
+`, { encoding: "utf8" });
+  });
+  return bounded;
+}
+async function writeEvidenceIndexRowQueued(stateDir, row) {
+  let written = [];
+  const write = evidenceIndexWriteQueue.then(async () => {
+    written = await writeEvidenceIndexRow(stateDir, row);
+  });
+  evidenceIndexWriteQueue = write.catch(() => void 0);
+  await write;
+  return written;
+}
+
+export {
+  readEvidenceIndex,
+  writeEvidenceIndexRowQueued
+};
+//# sourceMappingURL=chunk-G5R53COU.js.map

package/dist/chunk-GHXGMFQ5.js

@@ -0,0 +1,40 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  truncateHead,
+  truncateTail
+} from "./chunk-KECNXMDE.js";
+import {
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/tools/truncate.ts
+init_esm_shims();
+var DEFAULT_MAX_LINES = 2e3;
+var DEFAULT_MAX_BYTES = 64 * 1024;
+function splitLinesForCounting(content) {
+  if (content.length === 0) return [];
+  const lines = content.split("\n");
+  if (content.endsWith("\n")) lines.pop();
+  return lines;
+}
+function withClioDefaults(options) {
+  return {
+    maxLines: options.maxLines ?? DEFAULT_MAX_LINES,
+    maxBytes: options.maxBytes ?? DEFAULT_MAX_BYTES
+  };
+}
+function truncateHead2(content, options = {}) {
+  return truncateHead(content, withClioDefaults(options));
+}
+function truncateTail2(content, options = {}) {
+  return truncateTail(content, withClioDefaults(options));
+}
+
+export {
+  DEFAULT_MAX_LINES,
+  DEFAULT_MAX_BYTES,
+  splitLinesForCounting,
+  truncateHead2 as truncateHead,
+  truncateTail2 as truncateTail
+};
+//# sourceMappingURL=chunk-GHXGMFQ5.js.map

package/dist/{chunk-GFQ7P2UF.js → chunk-GJDRMBDI.js}

@@ -3,25 +3,25 @@ import {
   truncateToWidth,
   visibleWidth,
   wrapTextWithAnsi
-} from "./chunk-V4ZKOKRB.js";
+} from "./chunk-434LRQ6Z.js";
 import {
   openLedger,
   readFleetRun
-} from "./chunk-WN552PKN.js";
-import {
-  WRITE_BOUNDARY_VIOLATION_REASON
-} from "./chunk-UA3W4FGC.js";
+} from "./chunk-F2YM3JY4.js";
 import {
   formatTrustSummaryLine,
   inspectRunReceiptTrustStatus
-} from "./chunk-IQCNVLO6.js";
+} from "./chunk-IALZJE37.js";
+import {
+  WRITE_BOUNDARY_VIOLATION_REASON
+} from "./chunk-KRJQG47M.js";
 import {
   readRunEventJournal,
   runEventJournalPath
 } from "./chunk-UQIVHSE4.js";
 import {
   sanitizeCallTargetText
-} from "./chunk-2GPGAE5W.js";
+} from "./chunk-XNIZBOFV.js";
 import {
   clioStateDir,
   resetXdgCache
@@ -478,7 +478,7 @@ async function runFleetView(args) {
   return followRun(runId);
 }
 async function watchSelection(selectionPath) {
-  const { ProcessTerminal, TuiAltScreen } = await import("./tui-primitives-A6MUW32V.js");
+  const { ProcessTerminal, TuiAltScreen } = await import("./tui-primitives-36BY2774.js");
   const terminal = new ProcessTerminal();
   const tui = new TuiAltScreen(terminal);
   let selected = readWatchSelection(selectionPath);
@@ -521,7 +521,7 @@ async function watchSelection(selectionPath) {
   });
 }
 async function followRun(runId) {
-  const { ProcessTerminal, TuiAltScreen } = await import("./tui-primitives-A6MUW32V.js");
+  const { ProcessTerminal, TuiAltScreen } = await import("./tui-primitives-36BY2774.js");
   const terminal = new ProcessTerminal();
   const tui = new TuiAltScreen(terminal);
   let model = loadRunViewModel(runId);
@@ -570,4 +570,4 @@ export {
   loadFleetRunViewModel,
   runFleetView
 };
-//# sourceMappingURL=chunk-GFQ7P2UF.js.map
+//# sourceMappingURL=chunk-GJDRMBDI.js.map

package/dist/{chunk-LZBMXNLP.js → chunk-GM4TY6VN.js}

@@ -155,7 +155,7 @@ CREATE TABLE phases (
   error TEXT,
   started_at TEXT,
   ended_at TEXT,
-  input_tokens INTEGER, output_tokens INTEGER, cache_read_tokens INTEGER, cache_write_tokens INTEGER,
+  input_tokens INTEGER, output_tokens INTEGER, cache_read_tokens INTEGER, cache_write_tokens INTEGER, cache_write_1h_tokens INTEGER,
   reasoning_tokens INTEGER, total_tokens INTEGER,
   input_cost_usd REAL, output_cost_usd REAL, cache_read_cost_usd REAL, cache_write_cost_usd REAL,
   total_cost_usd REAL,
@@ -242,6 +242,11 @@ function ensureRunSourceColumn(db) {
   db.exec("ALTER TABLE runs ADD COLUMN source TEXT NOT NULL DEFAULT 'dispatch';");
   db.prepare("UPDATE runs SET source = 'session' WHERE assignment_id = ?").run(SESSION_TRACE_ASSIGNMENT_ID);
 }
+function ensureCacheWriteLifetimeColumn(db) {
+  const columns = db.prepare("PRAGMA table_info(phases)").all();
+  if (!columns.some((column) => column.name === "cache_write_1h_tokens"))
+    db.exec("ALTER TABLE phases ADD COLUMN cache_write_1h_tokens INTEGER;");
+}
 function reconcileAbandonedRuns(db) {
   const owners = db.prepare(`SELECT r.run_id, r.started_at, p.pid, p.host, p.birth_token FROM runs r
       JOIN processes p ON p.id = (SELECT MAX(id) FROM processes WHERE run_id = r.run_id AND host IS NOT NULL)
@@ -272,6 +277,7 @@ var TraceStore = class {
     this.transaction(() => {
       ensureProcessOwnerColumns(this.db);
       ensureRunSourceColumn(this.db);
+      ensureCacheWriteLifetimeColumn(this.db);
       reconcileAbandonedRuns(this.db);
     });
   }
@@ -451,13 +457,14 @@ var TraceStore = class {
   }
   recordSpend(input) {
     this.transaction(() => {
-      this.db.prepare(`UPDATE phases SET input_tokens=?, output_tokens=?, cache_read_tokens=?, cache_write_tokens=?,
+      this.db.prepare(`UPDATE phases SET input_tokens=?, output_tokens=?, cache_read_tokens=?, cache_write_tokens=?, cache_write_1h_tokens=?,
           reasoning_tokens=?, total_tokens=?, input_cost_usd=?, output_cost_usd=?, cache_read_cost_usd=?,
           cache_write_cost_usd=?, total_cost_usd=?, context_tokens=?, context_window=? WHERE phase_id=? AND run_id=?`).run(
         input.inputTokens,
         input.outputTokens,
         input.cacheReadTokens,
         input.cacheWriteTokens,
+        input.cacheWrite1hTokens ?? null,
         input.reasoningTokens,
         input.totalTokens,
         input.inputCostUsd ?? null,
@@ -598,7 +605,7 @@ var TraceStore = class {
         input.runId
       );
       this.db.prepare(`UPDATE phases SET status=?, attempt=?, retries=?, ended_at=?, error=?, input_tokens=?, output_tokens=?,
-          cache_read_tokens=?, cache_write_tokens=?, reasoning_tokens=?, total_tokens=?, total_cost_usd=?
+          cache_read_tokens=?, cache_write_tokens=?, cache_write_1h_tokens=?, reasoning_tokens=?, total_tokens=?, total_cost_usd=?
           WHERE phase_id=?`).run(
         success ? "success" : "fail",
         input.lineage?.attempt ?? 0,
@@ -609,6 +616,7 @@ var TraceStore = class {
         input.outputTokenCount ?? null,
         input.cacheReadTokenCount ?? null,
         input.cacheWriteTokenCount ?? null,
+        input.cacheWrite1hTokenCount ?? null,
         input.reasoningTokenCount ?? null,
         input.tokenCount ?? null,
         input.costUsd ?? null,
@@ -718,7 +726,7 @@ var TraceStore = class {
     this.transaction(() => {
       this.db.prepare("UPDATE runs SET status=?, ended_at=?, total_tokens=?, total_cost_usd=? WHERE run_id=?").run(input.status, input.at, usage?.totalTokens ?? null, usage?.costUsd ?? null, input.runId);
       this.db.prepare(`UPDATE phases SET status=?, ended_at=?, error=?, input_tokens=?, output_tokens=?,
-          cache_read_tokens=?, cache_write_tokens=?, reasoning_tokens=?, total_tokens=?, total_cost_usd=?
+          cache_read_tokens=?, cache_write_tokens=?, cache_write_1h_tokens=?, reasoning_tokens=?, total_tokens=?, total_cost_usd=?
           WHERE phase_id=?`).run(
         input.status,
         input.at,
@@ -727,6 +735,7 @@ var TraceStore = class {
         usage?.outputTokens ?? null,
         usage?.cacheReadTokens ?? null,
         usage?.cacheWriteTokens ?? null,
+        usage?.cacheWrite1hTokens ?? null,
         usage?.reasoningTokens ?? null,
         usage?.totalTokens ?? null,
         usage?.costUsd ?? null,
@@ -797,7 +806,7 @@ var TraceReader = class {
    * `runs.source` is an additive column (see ensureRunSourceColumn) a
    * TraceStore writer backfills in place. A read-only reader can open a
    * database no writer has touched since before the column existed — the
-   * trace viewer opening a dormant install's trace.sqlite fresh is the
+   * web application opening a dormant install's trace.sqlite fresh is the
    * realistic case — and cannot ALTER TABLE to fix that itself, so it
    * derives the same value the migration would have written instead.
    */
@@ -808,6 +817,32 @@ var TraceReader = class {
   runs(limit = 50) {
     return this.db.prepare(`SELECT ${this.runsSourceExpr} FROM runs ORDER BY started_at DESC LIMIT ?`).all(clampInt(limit, 1, 500));
   }
+  /** Stable keyset pagination, including read-only databases predating runs.source. */
+  runsPage({ before, limit = 50, filter = {} } = {}) {
+    const size = clampInt(limit, 1, 500);
+    const where = [], args = [];
+    if (before) {
+      where.push("(started_at < ? OR (started_at = ? AND run_id < ?))");
+      args.push(before.startedAt, before.startedAt, before.runId);
+    }
+    if (filter.source) {
+      where.push("source = ?");
+      args.push(filter.source);
+    }
+    if (filter.status) {
+      where.push("status = ?");
+      args.push(filter.status);
+    }
+    if (filter.q) {
+      where.push("(run_id LIKE ? OR agent LIKE ? OR model LIKE ? OR status LIKE ? OR request LIKE ?)");
+      args.push(...Array(5).fill(`%${filter.q}%`));
+    }
+    const rows = this.db.prepare(
+      `SELECT * FROM (SELECT ${this.runsSourceExpr} FROM runs) ${where.length ? `WHERE ${where.join(" AND ")}` : ""} ORDER BY started_at DESC, run_id DESC LIMIT ?`
+    ).all(...args, size + 1);
+    const runs = rows.slice(0, size), last = runs.at(-1);
+    return { runs, nextBefore: rows.length > size && last ? { startedAt: last.started_at, runId: last.run_id } : null };
+  }
   run(runId) {
     return this.db.prepare(`SELECT ${this.runsSourceExpr} FROM runs WHERE run_id=?`).get(runId) ?? null;
   }
@@ -1057,6 +1092,7 @@ function terminalUsage(input) {
     output: input.outputTokenCount ?? 0,
     cache_read: input.cacheReadTokenCount ?? 0,
     cache_write: input.cacheWriteTokenCount ?? 0,
+    ...input.cacheWrite1hTokenCount === void 0 ? {} : { cache_write_1h: input.cacheWrite1hTokenCount },
     reasoning_tokens: input.reasoningTokenCount ?? 0,
     total_tokens: input.tokenCount
   };
@@ -1184,6 +1220,7 @@ function finiteNonNegative(value) {
 }
 
 export {
+  TRACE_SCHEMA_VERSION,
   TRACE_EVENT_POLL_LIMIT,
   DEFAULT_TRACE_RETENTION_POLICY,
   traceDatabasePath,
@@ -1193,4 +1230,4 @@ export {
   createDispatchTraceMirror,
   assertTraceSelectOnly
 };
-//# sourceMappingURL=chunk-LZBMXNLP.js.map
+//# sourceMappingURL=chunk-GM4TY6VN.js.map

package/dist/{chunk-NCCQ6DVS.js → chunk-GREYLTZ5.js}

@@ -2,7 +2,7 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   describeValidationContract,
   loadValidationContract
-} from "./chunk-T52TPHYC.js";
+} from "./chunk-PTFISXQO.js";
 import {
   CONFIRMED_SCOPE,
   READONLY_SCOPE,
@@ -10,17 +10,17 @@ import {
   createLoopState,
   isSubset,
   observe
-} from "./chunk-BQQ5MXUC.js";
-import {
-  createSafetyPolicyEngine
-} from "./chunk-DLIYANB7.js";
+} from "./chunk-AY4XE6GN.js";
 import {
   BusChannels,
   isRunAbortedPayload
-} from "./chunk-6CB2IL4N.js";
+} from "./chunk-W5RM7YAH.js";
+import {
+  createSafetyPolicyEngine
+} from "./chunk-IC7JXLOM.js";
 import {
   classify
-} from "./chunk-HOX4YZ2K.js";
+} from "./chunk-H2WSCZZT.js";
 import {
   clioStateDir,
   stateRootRemoved
@@ -655,4 +655,4 @@ export {
   parseRigorOverride,
   SafetyDomainModule
 };
-//# sourceMappingURL=chunk-NCCQ6DVS.js.map
+//# sourceMappingURL=chunk-GREYLTZ5.js.map

package/dist/{chunk-HOX4YZ2K.js → chunk-H2WSCZZT.js}

@@ -2,7 +2,7 @@ import { createRequire as __clioCreateRequire } from "node:module"; const requir
 import {
   extractCommandCdTargets,
   extractCommandWriteTargets
-} from "./chunk-2O2LVQQK.js";
+} from "./chunk-SQBT46OF.js";
 import {
   canonicalizeExistingPath
 } from "./chunk-KQ6IDQIB.js";
@@ -12,7 +12,7 @@ import {
 import {
   ToolNames,
   isHarnessExtensionToolName
-} from "./chunk-WLHX3MM5.js";
+} from "./chunk-V4XJWDHR.js";
 import {
   init_esm_shims
 } from "./chunk-ECBHH7LU.js";
@@ -53,10 +53,22 @@ function baseClassify(tool) {
     case ToolNames.Grep:
     case ToolNames.Find:
     case ToolNames.Ls:
+    // web_read is the GET-only half of the web split: no method, headers,
+    // or body can make it outward, so it is read class unconditionally.
+    case ToolNames.WebRead:
     case ToolNames.WebFetch:
     case ToolNames.Git:
     case ToolNames.CodeNav:
     case ToolNames.Context:
+    // clio_docs and clio_library read Clio's bundled documentation and the
+    // recipe catalog; data streams structured files. None writes.
+    case ToolNames.ClioDocs:
+    case ToolNames.ClioLibrary:
+    case ToolNames.Data:
+    // gateway lists and describes capabilities on its own; a call carries
+    // the capability's own class through a nested admission, so the outer
+    // call stays read class.
+    case ToolNames.Gateway:
     case ToolNames.Monitor:
     case ToolNames.AskUser:
     case ToolNames.CredentialPresent:
@@ -88,6 +100,10 @@ function baseClassify(tool) {
       return "write";
     case ToolNames.Bash:
     case ToolNames.Verify:
+    // run_script runs an interpreter over a workspace script; its
+    // safetyCall projects the exact argv to a bash command so the policy
+    // engine applies the shell rules to it.
+    case ToolNames.RunScript:
       return "execute";
     case ToolNames.Dispatch:
     case ToolNames.Steer:
@@ -219,4 +235,4 @@ export {
   webFetchIsOutward,
   classify
 };
-//# sourceMappingURL=chunk-HOX4YZ2K.js.map
+//# sourceMappingURL=chunk-H2WSCZZT.js.map

package/dist/{chunk-3LXJOICS.js → chunk-H6IUCY6Q.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   withResultSummaryAllowance
-} from "./chunk-34XHRVKG.js";
+} from "./chunk-I47EJPYL.js";
 import {
   init_esm_shims
 } from "./chunk-ECBHH7LU.js";
@@ -114,4 +114,4 @@ export {
   routeCorrelationFactsForRun,
   gateRouteCorrelation
 };
-//# sourceMappingURL=chunk-3LXJOICS.js.map
+//# sourceMappingURL=chunk-H6IUCY6Q.js.map