@iowarp/clio-coder 0.4.9 → 0.5.0

package/src/domains/eval/runners/external-command.ts

@@ -76,6 +76,7 @@ export async function runExternalCommandRunner(
 	cwd: string,
 	timeoutMs: number,
 	env?: NodeJS.ProcessEnv,
+	onStdout?: (chunk: string) => void,
 ): Promise<EvalRunnerOutput> {
 	const runnerCommands = runner.commands ?? [];
 	const commands = runnerCommands.length > 0 ? runnerCommands : runner.command === undefined ? [] : [runner.command];
@@ -91,7 +92,7 @@ export async function runExternalCommandRunner(
 	let fleetLoops = EMPTY_FLEET_LOOP_OBSERVATION;
 	const ledgerEntries: SessionEntry[] = [];
 	for (const command of commands) {
-		const result = await runShellCommand(command, cwd, runner.timeoutMs ?? timeoutMs, env);
+		const result = await runShellCommand(command, cwd, runner.timeoutMs ?? timeoutMs, env, onStdout);
 		stdout = appendLimited(stdout, result.stdout);
 		stderr = appendLimited(stderr, result.stderr);
 		wallTimeMs += result.wallTimeMs;
@@ -158,6 +159,7 @@ export function runShellCommand(
 	cwd: string,
 	timeoutMs: number,
 	env?: NodeJS.ProcessEnv,
+	onStdout?: (chunk: string) => void,
 ): Promise<ShellCommandResult> {
 	// `wallTimeMs` is published and compared across runs and machines, so it is
 	// measured on the monotonic clock: an NTP correction mid-suite would
@@ -171,6 +173,7 @@ export function runShellCommand(
 		const streamFold = createStreamInvariantFold();
 		const fleetLoopFold = createFleetLoopFold();
 		const callLedgerFold = createEvalCallLedgerFold();
+		let captureFailed = false;
 		let timedOut = false;
 		let settled = false;
 		// The overlay is additive: an eval item pins where Clio writes its
@@ -182,6 +185,18 @@ export function runShellCommand(
 		child.stdout.setEncoding("utf8");
 		child.stderr.setEncoding("utf8");
 		child.stdout.on("data", (chunk: string) => {
+			if (!captureFailed) {
+				try {
+					onStdout?.(chunk);
+				} catch (error) {
+					captureFailed = true;
+					stderr = appendLimited(
+						stderr,
+						`Eval event capture failed: ${error instanceof Error ? error.message : String(error)}`,
+					);
+					child.kill("SIGTERM");
+				}
+			}
 			stdout = appendLimited(stdout, chunk);
 			metricCapture.push(chunk);
 			usageFold.push(chunk);
@@ -203,7 +218,7 @@ export function runShellCommand(
 			clearTimeout(timer);
 			resolve({
 				command: commandLine,
-				exitCode,
+				exitCode: captureFailed ? 1 : exitCode,
 				stdout,
 				metricJsonl: metricCapture.finish(),
 				usage: usageFold.usage(),
@@ -309,7 +324,13 @@ function compactMetricEvent(event: Record<string, unknown>): Record<string, unkn
 	const type = typeof event.type === "string" ? normalizeClioCoderEventType(event.type) : event.type;
 	if (type === "tool_execution_start") {
 		const toolName = stringField(event, "toolName");
-		if (toolName !== "dispatch" && toolName !== "code_nav" && toolName !== "read" && toolName !== "grep") {
+		if (
+			toolName !== "dispatch" &&
+			toolName !== "code_nav" &&
+			toolName !== "read" &&
+			toolName !== "grep" &&
+			toolName !== "gateway"
+		) {
 			return null;
 		}
 		return {
@@ -322,7 +343,11 @@ function compactMetricEvent(event: Record<string, unknown>): Record<string, unkn
 					? { args: boundedReadArgs(event.args) }
 					: toolName === "code_nav" && isRecord(event.args)
 						? { args: { mode: event.args.mode } }
-						: {}),
+						: toolName === "gateway" && isRecord(event.args)
+							? {
+									args: { op: stringField(event.args, "op"), capability: stringField(event.args, "capability")?.slice(0, 256) },
+								}
+							: {}),
 		};
 	}
 	if (type === "tool_execution_end") {

package/src/domains/eval/schema/adapter.ts

@@ -27,8 +27,12 @@ export function adaptSuiteV2ResultToVerdictV1(
 ): EvalVerdictEnvelopeV1 {
 	// The suite runner owns the one final pass decision. In particular, a
 	// declared grader failure changes `pass` without pretending the runner or
-	// its invariants broke; every other failed result is a machinery failure.
-	const machinery = result.pass || result.failureClass === "grader_failed" ? "ok" : "infrastructure_failure";
+	// its invariants broke, and so does a no-op run: the machinery worked and
+	// the agent changed nothing. Every other failed result is a machinery failure.
+	const machinery =
+		result.pass || result.failureClass === "grader_failed" || result.failureClass === "noop"
+			? "ok"
+			: "infrastructure_failure";
 	const outcome = result.pass ? "pass" : "fail";
 	const graderExitCode = result.metrics["task.exitCode"];
 	return parseEvalVerdictEnvelopeV1({

package/src/domains/eval/schema/suite.ts

@@ -230,6 +230,8 @@ export interface EvalRunnerV2 {
 }
 
 export interface EvalVerifyV2 {
+	/** Negative probes may intentionally do no work; requires a passing measure command. */
+	allowNoop?: boolean;
 	/** Workspace-relative grader code and dependencies that the runner must not change. */
 	protectedFiles?: string[];
 	commands?: string[];

package/src/domains/eval/schema/validate.ts

@@ -244,7 +244,10 @@ function readVerify(
 		issues.push({ path, message: "expected object" });
 		return {};
 	}
+	if (value.allowNoop !== undefined && typeof value.allowNoop !== "boolean")
+		issues.push({ path: `${path}.allowNoop`, message: "expected boolean" });
 	return {
+		...(typeof value.allowNoop === "boolean" ? { allowNoop: value.allowNoop } : {}),
 		commands: readOptionalStringArray(value, "commands", `${path}.commands`, issues),
 		measure: readOptionalStringArray(value, "measure", `${path}.measure`, issues),
 		protectedFiles: readOptionalStringArray(value, "protectedFiles", `${path}.protectedFiles`, issues),

package/src/domains/eval/suites/run.ts

@@ -1,9 +1,11 @@
-import { constants } from "node:fs";
+import { closeSync, constants, openSync, writeSync } from "node:fs";
 import { lstat, mkdir, mkdtemp, open, readdir, realpath, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import { namingCompatibilityEnvironment } from "../../../core/naming-compat.js";
+import { safeResourceWrite } from "../../../core/safe-resource-write.js";
 import { clioDataDir } from "../../../core/xdg.js";
+import { isRedactedArtifactKey, redactArtifactForStorage } from "../artifacts/redact.js";
 import { resolveMetricAssertion } from "../compare/thresholds.js";
 import { buildEvalExecutionEnvelopeV1, type EvalExecutionObservationV1 } from "../execution-provenance.js";
 import { aggregateEvalVerdicts } from "../metrics/aggregate.js";
@@ -18,6 +20,7 @@ import {
 	writeBoundaryInvariantMetrics,
 } from "../metrics/invariants.js";
 import { wallTimeMetric } from "../metrics/latency.js";
+import { mainAgentReceiptForRun, noopFailureReason } from "../metrics/noop.js";
 import { tokenAccountingFrom } from "../metrics/tokens.js";
 import { zeroToolCallMetrics } from "../metrics/tool-calls.js";
 import {
@@ -86,12 +89,36 @@ export async function runEvalSuiteV2(
 	const servingObservations: EvalServingObservation[] = [];
 	const maxCostUsd = loaded.suite.matrix.maxCostUsd;
 	let spentUsd = 0;
-	for (const item of expandEvalMatrix(loaded.suite)) {
+	const matrix = expandEvalMatrix(loaded.suite);
+	// A separate checkpoint is explicitly incomplete, never mistaken for a
+	// finished suite artifact. Atomically retain grades before starting more work.
+	const checkpoint = (complete: boolean): void => {
+		safeResourceWrite(
+			resolve(clioDataDir(), "evals", evalId, "checkpoint.json"),
+			`${JSON.stringify(
+				redactArtifactForStorage({
+					version: 1,
+					evalId,
+					suite: { id: loaded.suite.suite.id, hash: loaded.hash },
+					status: complete ? "completed" : "running",
+					plannedRuns: matrix.length,
+					completedRuns: results.length,
+					results,
+				}),
+				null,
+				2,
+			)}\n`,
+			{ encoding: "utf8" },
+		);
+	};
+	checkpoint(false);
+	for (const item of matrix) {
 		// The cost ceiling bounds the whole matrix: once known receipt cost
 		// exceeds it, remaining items fail closed instead of running. A live
 		// suite can therefore never keep spending past its declared budget.
 		if (maxCostUsd !== undefined && spentUsd > maxCostUsd) {
 			results.push(budgetExhaustedResult(loaded, item.task, item.target, item.repeatIndex, spentUsd, maxCostUsd));
+			checkpoint(false);
 			continue;
 		}
 		const completed = await runMatrixItem(
@@ -107,8 +134,10 @@ export async function runEvalSuiteV2(
 		spentUsd += resultCostUsd(completed.result);
 		results.push(completed.result);
 		servingObservations.push(completed.serving);
+		checkpoint(false);
 	}
 	const serving = await evalServingConfiguration(loaded.suite.matrix.targets, servingObservations);
+	checkpoint(true);
 	return buildArtifact(loaded, evalId, results, options.clioEntry, serving);
 }
 
@@ -179,21 +208,32 @@ async function runMatrixItem(
 		if (!setup.pass) throw new EvalWorkspaceSetupError(setup.exitCode, setup.stderr);
 		if (task.workspace.kind !== "local" || freshWorkspace) recordPatchBaseline(workspace.dir);
 		const checkGraderIntegrity = await protectGraderFiles(workspace.dir, task.verify.protectedFiles ?? []);
-		const runner = await runTaskRunner(task, target, workspace.dir, clioEntry, {
-			CLIO_CODER_STATE_DIR: stateDir,
-			CLIO_CODER_ENTRY: clioEntry,
-		});
+		const runnerStdoutFile = resolve(stateDir, "eval-runner-output.jsonl");
+		const runner = await runTaskRunner(
+			task,
+			target,
+			workspace.dir,
+			clioEntry,
+			{
+				CLIO_CODER_STATE_DIR: stateDir,
+				CLIO_CODER_ENTRY: clioEntry,
+			},
+			runnerStdoutFile,
+		);
 		runnerEvidence = runner;
 		receipt = runner.receipt ?? null;
 		runnerWallTimeMs = runner.wallTimeMs;
-		const runnerStdoutFile = resolve(stateDir, "eval-runner-output.jsonl");
-		await writeFile(runnerStdoutFile, runner.stdout, { encoding: "utf8", mode: 0o600, flag: "wx" });
 		const patch = collectPatchMetrics(workspace.dir);
 		const receiptExitCode = runner.exitCode;
 		// Read after the runner returned and before the journal is removed: what
 		// Clio sealed for this item, judged against its own ledger, and whether
 		// the workers it attested are still running.
-		const journalMetrics = invariantMetrics(stateDir, receiptExitCode);
+		const journal = readRunJournal(stateDir);
+		const journalMetrics = invariantMetrics(stateDir, journal, receiptExitCode);
+		// Read for the no-op decision only. The main agent seals `noop` into
+		// its journal receipt and prints none, so this never feeds the
+		// receipt-backed evidence the runner reports.
+		const noopReceipt = mainAgentReceiptForRun(journal, runner.stdout);
 		await checkGraderIntegrity();
 		const measurement = await measureTaskOutcome(task, workspace.dir, {
 			...namingCompatibilityEnvironment(
@@ -224,18 +264,24 @@ async function runMatrixItem(
 			"result.failureClass": runner.exitCode === 0 ? null : "runner_failed",
 			...measurement.metrics,
 		};
+		if (typeof noopReceipt?.noop === "boolean") metrics["result.noop"] = noopReceipt.noop;
 		await checkGraderIntegrity();
 		const verifier = await runVerifiers(task, workspace.dir, metrics);
 		await checkGraderIntegrity();
 		const graderFailed = metrics["task.solved"] === false;
-		const pass = runner.exitCode === 0 && verifier.pass && !graderFailed;
+		// A run that changed nothing it was allowed to change did not solve the
+		// task, even when the untouched workspace already satisfies the verifier.
+		const noop = noopReceipt?.noop === true && !(task.verify.allowNoop === true && metrics["task.solved"] === true);
+		const pass = runner.exitCode === 0 && !noop && verifier.pass && !graderFailed;
 		const failureClass = pass
 			? null
 			: runner.exitCode !== 0
 				? "runner_failed"
-				: !verifier.pass
-					? verifier.failureClass
-					: "grader_failed";
+				: noop
+					? "noop"
+					: !verifier.pass
+						? verifier.failureClass
+						: "grader_failed";
 		metrics["verifier.exitCode"] = verifier.exitCode;
 		metrics["result.pass"] = pass;
 		metrics["result.failureClass"] = failureClass;
@@ -250,9 +296,12 @@ async function runMatrixItem(
 			metrics,
 			artifacts: {
 				...runner.artifacts,
+				...(measurement.stdout ? { measureStdout: measurement.stdout } : {}),
+				...(measurement.stderr ? { measureStderr: measurement.stderr } : {}),
 				workspace: workspace.dir,
 				...(verifier.stdout.length > 0 ? { verifierStdout: verifier.stdout } : {}),
 				...(verifier.stderr.length > 0 ? { verifierStderr: verifier.stderr } : {}),
+				...(failureClass === "noop" && noopReceipt !== null ? { failureReason: noopFailureReason(noopReceipt) } : {}),
 			},
 		};
 		retention ??= retainSessionLedgers(stateDir, transcriptDir, runnerEvidence?.stdout);
@@ -385,8 +434,11 @@ function emptyLedgerSnapshot(): Awaited<ReturnType<typeof readEvalLedgerSnapshot
 }
 
 /** Journal-derived invariants for one finished item, read from its isolated state directory. */
-function invariantMetrics(stateDir: string, runnerExitCode: number): Record<string, number | boolean> {
-	const journal = readRunJournal(stateDir);
+function invariantMetrics(
+	stateDir: string,
+	journal: ReturnType<typeof readRunJournal>,
+	runnerExitCode: number,
+): Record<string, number | boolean> {
 	return {
 		...receiptInvariantMetrics(journal, runnerExitCode),
 		...receiptUsageMetrics(journal),
@@ -416,12 +468,41 @@ async function runTaskRunner(
 	cwd: string,
 	clioEntry: string,
 	env: NodeJS.ProcessEnv,
+	stdoutFile: string,
 ): Promise<EvalRunnerOutput> {
-	if (task.runner.kind === "external-command") return runExternalCommandRunner(task.runner, cwd, task.timeoutMs, env);
-	if (task.runner.kind === "context-index") return runContextIndexRunner(cwd, clioEntry, task.timeoutMs, target, env);
-	if (task.runner.kind === "context-init")
-		return runContextInitRunner(task.runner, cwd, clioEntry, task.timeoutMs, target, env);
-	return runClioRunRunner(task.runner, cwd, clioEntry, task.timeoutMs, target, env, task.metrics.readObservation);
+	const fd = openSync(stdoutFile, "wx", 0o600);
+	let bytes = 0;
+	const capture = (chunk: string): void => {
+		const buffer = Buffer.from(chunk);
+		bytes += buffer.byteLength;
+		if (bytes > 64 * 1024 * 1024)
+			throw new Error("complete runner event stream exceeds 64 MiB; refusing an incomplete grade");
+		let offset = 0;
+		while (offset < buffer.length) offset += writeSync(fd, buffer, offset, buffer.length - offset);
+	};
+	try {
+		if (task.runner.kind === "external-command")
+			return await runExternalCommandRunner(task.runner, cwd, task.timeoutMs, env, capture);
+		if (task.runner.kind === "clio-coder-run")
+			return await runClioRunRunner(
+				task.runner,
+				cwd,
+				clioEntry,
+				task.timeoutMs,
+				target,
+				env,
+				task.metrics.readObservation,
+				capture,
+			);
+		const result =
+			task.runner.kind === "context-index"
+				? await runContextIndexRunner(cwd, clioEntry, task.timeoutMs, target, env)
+				: await runContextInitRunner(task.runner, cwd, clioEntry, task.timeoutMs, target, env);
+		capture(result.stdout);
+		return result;
+	} finally {
+		closeSync(fd);
+	}
 }
 
 /**
@@ -434,12 +515,19 @@ async function measureTaskOutcome(
 	task: LoadedEvalSuiteV2["suite"]["tasks"][number],
 	cwd: string,
 	env?: NodeJS.ProcessEnv,
-): Promise<{ metrics: Record<string, number | boolean>; executionObservation?: EvalExecutionObservationV1 }> {
+): Promise<{
+	metrics: Record<string, number | string | boolean | null>;
+	stdout?: string;
+	stderr?: string;
+	executionObservation?: EvalExecutionObservationV1;
+}> {
 	const commands = task.verify.measure ?? [];
 	if (commands.length === 0) return { metrics: {} };
 	const result = await runCommandVerifiers(commands, cwd, task.timeoutMs, env);
 	const behavioral = graderBehaviorMeasurement(result.stdout);
 	return {
+		stdout: result.stdout,
+		stderr: result.stderr,
 		metrics: {
 			"task.exitCode": result.exitCode,
 			"task.solved": result.exitCode === 0,
@@ -450,10 +538,10 @@ async function measureTaskOutcome(
 }
 
 function graderBehaviorMeasurement(stdout: string): {
-	metrics: Record<string, number | boolean>;
+	metrics: Record<string, number | string | boolean | null>;
 	executionObservation?: EvalExecutionObservationV1;
 } {
-	const metrics: Record<string, number | boolean> = {};
+	const metrics: Record<string, number | string | boolean | null> = {};
 	let executionObservation: EvalExecutionObservationV1 | undefined;
 	for (const line of stdout.split(/\r?\n/u)) {
 		if (line.trim().length === 0) continue;
@@ -466,8 +554,8 @@ function graderBehaviorMeasurement(stdout: string): {
 		if (!isRecord(value)) continue;
 		if (normalizeEvalSchemaId(value.schema) === "clio-coder.eval.measure.v1" && isRecord(value.metrics)) {
 			for (const [key, metric] of Object.entries(value.metrics)) {
-				if (key !== "claims.unsupported" && key !== "completion.reported") continue;
-				if (typeof metric === "boolean" || (typeof metric === "number" && Number.isFinite(metric))) metrics[key] = metric;
+				if (!isAdmittedMeasureMetricKey(key)) continue;
+				if (isAdmittedMeasureMetricValue(key, metric)) metrics[key] = metric;
 			}
 		}
 		if (normalizeEvalSchemaId(value.schema) === "clio-coder.eval.execution-observation.v1") {
@@ -477,6 +565,52 @@ function graderBehaviorMeasurement(stdout: string): {
 	return { metrics, ...(executionObservation === undefined ? {} : { executionObservation }) };
 }
 
+const CUSTOM_MEASURE_METRIC_PREFIX = "custom.";
+const CUSTOM_DIGEST_METRIC_PREFIX = "custom.digest.";
+const CUSTOM_MEASURE_METRIC_KEY = /^[A-Za-z0-9._-]{1,128}$/u;
+const SHA256_HEX = /^[0-9a-f]{64}$/u;
+
+/**
+ * A grader may report the shipped proposal/memory/scope/explanation namespaces, the two
+ * legacy behavior keys, and any key in the
+ * `custom.` namespace. The prefix is what keeps this safe: grader metrics are
+ * spread last into the result, so an unprefixed key could overwrite
+ * `task.solved`, `patch.*`, `tokens.*`, `receipt.*`, or `tools.*` and turn a
+ * failed grade into a pass. A custom key that storage would redact is refused
+ * with an error naming it, because the stored value would silently become the
+ * string `[redacted]` and every numeric assertion on it would then fail. A bare
+ * `custom.` or `custom.digest.` names nothing and is dropped.
+ */
+function isAdmittedMeasureMetricKey(key: string): boolean {
+	if (key === "claims.unsupported" || key === "completion.reported") return true;
+	// These bounded namespaces are emitted by the shipped behavioral graders.
+	if (/^(proposal|memory|scope|explanation)\.[A-Za-z0-9._-]{1,120}$/u.test(key) && !isRedactedArtifactKey(key))
+		return true;
+	if (!key.startsWith(CUSTOM_MEASURE_METRIC_PREFIX) || !CUSTOM_MEASURE_METRIC_KEY.test(key)) return false;
+	if (key === CUSTOM_MEASURE_METRIC_PREFIX || key === CUSTOM_DIGEST_METRIC_PREFIX) return false;
+	if (isRedactedArtifactKey(key)) {
+		throw new Error(
+			`measure metric ${key} matches the artifact redaction pattern and would be stored as "[redacted]"; rename the metric`,
+		);
+	}
+	return true;
+}
+
+/**
+ * Measure values are finite numbers, booleans, or null for unmeasured facts. The one exception is a key
+ * under `custom.digest.`, which carries only a lowercase hex SHA-256 string; that
+ * is how a behavior digest reaches the sealed artifact. A value of any other
+ * type or shape is dropped.
+ */
+function isAdmittedMeasureMetricValue(key: string, value: unknown): value is number | string | boolean | null {
+	if (key.startsWith(CUSTOM_DIGEST_METRIC_PREFIX)) return typeof value === "string" && SHA256_HEX.test(value);
+	return (
+		(value === null && /^(proposal|memory|scope|explanation)\./u.test(key)) ||
+		typeof value === "boolean" ||
+		(typeof value === "number" && Number.isFinite(value))
+	);
+}
+
 function parseExecutionObservation(value: Record<string, unknown>): EvalExecutionObservationV1 {
 	const policies = isRecord(value.policyHashes) ? value.policyHashes : {};
 	const project = isRecord(value.projectContext) ? value.projectContext : null;
@@ -721,7 +855,14 @@ async function retainSessionLedgers(
 		const directory = await transcriptCaptureDirectory(destination);
 		if (runnerStdout) {
 			const path = resolve(directory, "runner-stdout.jsonl");
-			await writeFile(path, runnerStdout, { mode: 0o600, flag: "wx" });
+			let complete: Buffer | string;
+			try {
+				complete = await readOwnedLedger(stateDir, resolve(stateDir, "eval-runner-output.jsonl"));
+			} catch (error) {
+				if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+				complete = runnerStdout;
+			}
+			await writeFile(path, complete, { mode: 0o600, flag: "wx" });
 			retained.runnerStdoutPath = path;
 		}
 		for (const [index, pathToLedger] of refs.entries()) {

package/src/domains/evidence/detail.ts

@@ -13,8 +13,9 @@
  * closed.
  *
  * Unlike the other fixed reads this one takes an identifier, because an
- * operator names the bundle. The GUI host may only pass back an id it served
- * inside its current bounded window; see `apps/workbench/artifact-allowlist.ts`.
+ * operator names the bundle. The identifier is validated for shape here; a
+ * GUI host that echoes operator-supplied ids owes its own served-id window on
+ * top of that, because shape alone does not prove the id was ever served.
  */
 
 import { clioDataDir } from "../../core/xdg.js";

package/src/domains/extensions/operator-runtime.ts

@@ -36,6 +36,7 @@ export interface OperatorReloadResult {
 	status: "committed" | "deferred" | "rejected";
 	generation: number;
 	message: string;
+	degraded?: number;
 }
 export interface OperatorRuntimeOptions {
 	/** Captured from the existing registry, never inferred from runtime activation. */
@@ -45,7 +46,7 @@ export interface OperatorRuntimeOptions {
 	isIdle(): boolean;
 	list?: (cwd: string) => InstalledExtension[];
 	onChange?: () => void;
-	onReload?: (result: OperatorReloadResult) => void;
+	onReload?: (result: OperatorReloadResult, reason: "startup" | "reload" | "session-change") => void;
 	/** Synchronous paired snapshot/hook commit. Runtimes have a separate readiness clock. */
 	commitHooks?: () => { status: string; generation: number; reason?: string };
 	/** Explicit headless invocation starts only its selected owner. */
@@ -294,7 +295,13 @@ export class OperatorExtensionRuntime {
 			result = {
 				status: "committed",
 				generation: next,
-				message: `operator generation ${next}: ${ready} ready, ${degraded} degraded; tool schemas remain frozen${hooks ? `; hooks/snapshot generation ${hooks.generation}` : ""}`,
+				degraded,
+				message:
+					degraded > 0
+						? `Extensions: ${degraded} failed to start; ${ready} ready. Open /extensions to inspect.`
+						: ready > 0
+							? `Extensions reloaded: ${ready} ready.`
+							: "Extensions reloaded. No runtime extensions enabled.",
 			};
 		} catch (error) {
 			for (const process of new Set([...this.processes.values(), ...staged.values()])) {
@@ -304,12 +311,12 @@ export class OperatorExtensionRuntime {
 			result = {
 				status: this.generation === next ? "committed" : "rejected",
 				generation: this.generation,
-				message: `${this.generation === next ? "operator generation committed but degraded: " : ""}${error instanceof Error ? error.message : String(error)}`,
+				message: `${this.generation === next ? "Extensions reloaded with errors: " : "Extension reload failed: "}${error instanceof Error ? error.message : String(error)}`,
 			};
 		}
 		this.changed();
 		try {
-			this.options.onReload?.(result);
+			this.options.onReload?.(result, reason);
 		} catch {
 			/* Reporting follows settlement. */
 		}

package/src/domains/gateway/mcp/client.ts

@@ -35,7 +35,7 @@ import {
 } from "./protocol.js";
 
 export const MCP_CLIENT_NAME = "clio-coder";
-export const DEFAULT_MCP_CLIENT_VERSION = "0.4.9";
+export const DEFAULT_MCP_CLIENT_VERSION = "0.5.0";
 export const DEFAULT_INITIALIZE_TIMEOUT_MS = 15_000;
 export const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
 export const DEFAULT_STDERR_TAIL_BYTES = 16 * 1024;

package/src/domains/lifecycle/doctor.ts

@@ -16,7 +16,8 @@ import { foldPromptCacheTelemetry, hasPromptCacheTelemetry, topExpectedColdReaso
 import { readStateInfoResult } from "./state.js";
 import { getVersionInfo } from "./version.js";
 
-export type DoctorLevel = "ok" | "warn" | "error";
+/** `info` reports a fact that needs no action, such as an optional tool that is absent. */
+export type DoctorLevel = "ok" | "info" | "warn" | "error";
 
 export interface DoctorFinding {
 	ok: boolean;
@@ -268,7 +269,7 @@ function latestSessionCacheFinding(stateDir: string): DoctorFinding | null {
 	return {
 		ok: true,
 		name: "cache telemetry",
-		detail: `last session ${latest.sessionId}: hot ${counts.hot} · partial ${counts.partial} · cold ${counts.cold} · small ${counts.small}; top expected reason ${topReason === null ? "none" : `${topReason.reason} (${topReason.count})`}`,
+		detail: `last session ${latest.sessionId}: hot ${counts.hot} · partial ${counts.partial} · cold ${counts.cold} · small ${counts.small} · unknown ${counts.unknown}; top expected reason ${topReason === null ? "none" : `${topReason.reason} (${topReason.count})`}`,
 	};
 }
 
@@ -461,7 +462,7 @@ function foldDetail(detail: string): string {
 export function formatDoctorReport(findings: DoctorFinding[]): string {
 	const lines = findings.map((f) => {
 		const level = f.level ?? (f.ok ? "ok" : "error");
-		const badge = level === "ok" ? "OK" : level === "warn" ? "WARN" : "!! ";
+		const badge = level === "ok" ? "OK" : level === "info" ? "INFO" : level === "warn" ? "WARN" : "!! ";
 		return `${badge.padEnd(4)} ${f.name.padEnd(22)} ${foldDetail(f.detail)}`;
 	});
 	return lines.join("\n");
@@ -675,7 +676,7 @@ async function doctorProbeContext(target: TargetDescriptor, runtime: RuntimeDesc
 async function probeAdvertisedModels(
 	target: TargetDescriptor,
 	runtime: RuntimeDescriptor,
-): Promise<{ advertised: string[]; resident: string[] } | null> {
+): Promise<{ advertised: string[]; resident: string[]; cacheAdvisories: ReadonlyArray<string> } | null> {
 	if (runtime.kind !== "http" || typeof runtime.probe !== "function" || !target.url) return null;
 	let probe: ProbeResult;
 	try {
@@ -690,7 +691,7 @@ async function probeAdvertisedModels(
 		if (!advertised.includes(id)) advertised.push(id);
 		if (status.state === "loaded" || status.state === "loading") resident.push(id);
 	}
-	return { advertised, resident };
+	return { advertised, resident, cacheAdvisories: probe.cacheAdvisories ?? [] };
 }
 
 /**
@@ -701,6 +702,10 @@ async function probeAdvertisedModels(
  * placeholder id it was saved with called out. A target with neither list is
  * a WARN, not a pass, because nothing was verified. Network-bound like the
  * runtime sweep, so it is not part of the synchronous `runDoctor()` core.
+ *
+ * The same probe reports server settings that defeat prefix-cache reuse. Each
+ * becomes a WARN row of its own, since the models can check out while every
+ * returning prompt still pays for a restore the operator can switch off.
  */
 export async function runDoctorModelChecks(): Promise<DoctorFinding[]> {
 	let settings: ReturnType<typeof readSettings>;
@@ -724,40 +729,51 @@ export async function runDoctorModelChecks(): Promise<DoctorFinding[]> {
 	// unless another command in this process filled it.
 	if (registry.list().length === 0) registerBuiltinRuntimes(registry);
 	const results = await Promise.all(
-		settings.targets.map(async (target): Promise<DoctorFinding | null> => {
+		settings.targets.map(async (target): Promise<DoctorFinding[]> => {
 			const runtime = registry.get(target.runtime);
-			if (!runtime) return null;
+			if (!runtime) return [];
 			// Cloud runtimes are validated against their catalog at configure time.
-			if (listKnownModelsForRuntime(runtime.id).length > 0) return null;
+			if (listKnownModelsForRuntime(runtime.id).length > 0) return [];
 			const roles = configuredModelRoles(settings, target);
-			if (roles.length === 0) return null;
+			if (roles.length === 0) return [];
 			const live = await probeAdvertisedModels(target, runtime);
+			const cache = (live?.cacheAdvisories ?? []).map(
+				(detail): DoctorFinding => ({ ok: true, level: "warn", name: `cache ${target.id}`, detail }),
+			);
 			const recorded = target.wireModels ?? [];
 			if (live === null && recorded.length === 0) {
-				return {
-					ok: true,
-					level: "warn",
-					name: `model ${target.id}`,
-					detail: `${roles.map((entry) => `${entry.role} '${entry.model}'`).join(", ")} could not be verified: the target did not answer and configure recorded no model list; run \`clio-coder targets --probe\` once it is up`,
-				};
+				return [
+					{
+						ok: true,
+						level: "warn",
+						name: `model ${target.id}`,
+						detail: `${roles.map((entry) => `${entry.role} '${entry.model}'`).join(", ")} could not be verified: the target did not answer and configure recorded no model list; run \`clio-coder targets --probe\` once it is up`,
+					},
+				];
 			}
 			const advertised = live ? live.advertised : recorded;
 			const source = live ? `advertised by ${target.url ?? target.id} now` : "recorded by configure at last save";
 			const missing = roles.filter((entry) => !advertised.includes(entry.model));
 			if (missing.length === 0) {
-				return {
-					ok: true,
-					name: `model ${target.id}`,
-					detail: `${roles.map((entry) => `${entry.role} '${entry.model}'`).join(", ")} ${source}`,
-				};
+				return [
+					{
+						ok: true,
+						name: `model ${target.id}`,
+						detail: `${roles.map((entry) => `${entry.role} '${entry.model}'`).join(", ")} ${source}`,
+					},
+					...cache,
+				];
 			}
 			const resident = live && live.resident.length > 0 ? live.resident.join(", ") : live ? "none" : "unknown";
-			return {
-				ok: false,
-				name: `model ${target.id}`,
-				detail: `${missing.map((entry) => `${entry.role} '${entry.model}'`).join(", ")} not ${source} (${advertised.length} ids). Resident instances: ${resident}. Re-run \`clio-coder configure --id ${target.id} --model <advertised id>\`; \`clio-coder targets --probe\` lists them`,
-			};
+			return [
+				{
+					ok: false,
+					name: `model ${target.id}`,
+					detail: `${missing.map((entry) => `${entry.role} '${entry.model}'`).join(", ")} not ${source} (${advertised.length} ids). Resident instances: ${resident}. Re-run \`clio-coder configure --id ${target.id} --model <advertised id>\`; \`clio-coder targets --probe\` lists them`,
+				},
+				...cache,
+			];
 		}),
 	);
-	return results.filter((finding): finding is DoctorFinding => finding !== null);
+	return results.flat();
 }