@kodax-ai/kodax 0.7.72 → 0.7.73

package/CHANGELOG.md

@@ -6,6 +6,98 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.7.73] - 2026-07-20
+
+### Added
+
+- **Qwen Token Plan provider.** The new `qwen-token-plan` alias uses the
+  Anthropic-compatible Alibaba Cloud Token Plan endpoint and
+  `QWEN_TOKEN_API_KEY`. It defaults to `qwen3.8-max-preview`, exposes the
+  supported Qwen 3.7/3.6, GLM-5.2, and DeepSeek V4 Pro routes with one-million-
+  token context metadata, and declares verified reasoning, image-input, and
+  nominal subscription-cost capabilities without changing the existing `qwen`
+  provider.
+- **First-run provider setup (FEATURE_271).** A bare interactive `kodax`
+  launch with no selected provider and no supported local credential now opens
+  a focused provider/model setup flow before Runtime, daemon, session, or REPL
+  startup. `kodax setup` reruns the same flow explicitly. It stores only
+  non-secret metadata, preserves unrelated config through a revision-checked
+  atomic write, refuses malformed existing custom providers and credential-
+  bearing endpoint URLs, and then names the required environment variable and
+  terminal restart steps.
+- **Typed Auto Mode SDK contract (FEATURE_271).** The root and REPL SDK
+  entries now export one pure `resolveAutoModeSettings()` plus the authoritative
+  loader and related types; `loadConfig().autoMode` is declared, Runtime Session
+  settings persist `autoModeSpeculativeWindowMs` (including `0`), and side
+  queries return prompt-free provider/model/timing/retry/phase diagnostics.
+- **Runtime-owned concrete permission grants.** Embedded and daemon SDK clients
+  can submit concrete `toolInput` and `executionCwd`, receive only opaque
+  Runtime-issued Session/persistent grant suggestions, and select a suggestion
+  without constructing or widening its hidden matcher. Exact command, known
+  file-tool path, and generic exact-call matchers remain revisioned and audited;
+  dynamic or dangerous shell calls never receive a persistent suggestion.
+
+### Fixed
+
+- **Reasoning, Auto Mode, and confirmation regressions.** Native
+  disabled-thinking requests now send the provider's explicit disabled form
+  only for models that declare support (including verified Qwen Token Plan 3.7
+  routes); always-thinking variants retain their declared behavior. Sidecar
+  queries preserve a supported `none` effort, persisted Runtime Auto engines
+  are not overwritten by a fresh REPL, `/mode` synchronizes before reporting
+  success, and concurrent confirmation prompts are serialized instead of
+  replacing one another.
+- **Legacy permission-grant upgrade safety.** Matcherless grants persisted by
+  older releases remain visible and revocable but can no longer authorize a
+  concrete tool call. The next invocation requires a fresh Runtime-issued
+  matcher, so old coarse Bash grants cannot bypass exact-command, dynamic-shell,
+  or absolute-deny protections.
+- **Classifier credential boundary.** Auto[LLM] now redacts explicitly named
+  credential values inside shell-escaped JSON before sending an action to its
+  side provider, while retaining adjacent operational fields. Redaction is
+  documented as defense in depth; arbitrary Base64/hex values are not treated
+  as secrets without a credential signal.
+- **Todo/Actor semantic progress checkpoint (FEATURE_270 follow-up).** Worker
+  guidance now treats Todo rows as user-visible milestones rather than Actor
+  instances and requires timely updates at milestone boundaries. Structured
+  terminal child results arm one deduplicated, warn-only reconciliation
+  reminder; transcript scans are append-incremental with safe compaction
+  fallback, and Sidecar accept-time residual reconciliation emits a diagnostic
+  without changing its existing bridge contract.
+- **Auto LLM classifier timeout and missing-model escalation.** Runtime now
+  treats omitted Auto engine as the documented LLM default and still owns the
+  guardrail, while a missing/blank/malformed effective classifier model fails
+  as a typed recoverable Runtime error or a local block in the shared
+  `createAutoModeToolGuardrail` boundary. The final guardrail check runs before
+  provider lookup and cannot invoke `askUser`, record a circuit-breaker error,
+  or downgrade to rules. Classifier requests strip assistant prose/thinking,
+  cap normalized transcript/tool-result/action/prompt bytes, remove image
+  paths, and cap the structured response at 256 tokens. The 20-second deadline remains bounded:
+  a four-call `zai-coding/glm-5.2` probe completed representative Windows
+  permission verdicts in 1.9–2.8 seconds, while the matching production session
+  revealed a 1.625 MB tool result that had bypassed the existing sanitizer.
+- **Auto guardrail daemon and tracing semantics.** Auto-started Runtime clients
+  now require `runtimeAutoModeGuardrail:3`. It retains v2's effective
+  timeout/window defaults, bounded classifier input, and diagnostics metadata,
+  and adds opaque concrete-grant semantics. Capability negotiation is monotonic
+  (v3 satisfies v2/v1); idle older daemons use the existing fenced upgrade path,
+  while busy daemons are left untouched with a recoverable error. Guardrail
+  spans now cover the awaited callback instead of timing only final verdict
+  emission.
+- **Concurrent daemon startup publication race.** A cleanly exiting loser now
+  gives the elected owner a bounded publication grace period, preventing an
+  SDK starter from reporting failure during the short lock/state handoff gap.
+- **Guardrail/permission execution parity.** Both Runner paths now commit each
+  guardrail rewrite before permission policy and execution, reject correlation-
+  id rewrites, propagate blocks as visible audited tool results, and preserve
+  embedded host policy hooks while rejecting non-transportable daemon hooks.
+  Calls rewritten into Bash retain serialized shell ordering.
+- **Managed-run capacity and tool-dispatch accounting.** A complete system
+  prompt override no longer double-counts Skills, missing provider usage rebases
+  from the final request envelope, and authoritative provider usage remains
+  intact. Non-Bash tool calls keep parallel dispatch, Bash remains sequential,
+  and aggregate tool-result spill decisions use the complete batch budget.
+
 ## [0.7.72] - 2026-07-19
 
 ### Added

package/README.md

@@ -17,7 +17,7 @@
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-KAI--FCL_1.0-orange?style=flat-square"></a>
   <a href="https://github.com/icetomoyo/KodaX/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/icetomoyo/KodaX?style=flat-square&logo=github&color=f1c40f"></a>
   <a href="https://github.com/icetomoyo/KodaX/actions"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/icetomoyo/KodaX/release.yml?style=flat-square&label=release"></a>
-  <img alt="providers" src="https://img.shields.io/badge/LLMs-15_aliases_+_custom-2ecc71?style=flat-square">
+  <img alt="providers" src="https://img.shields.io/badge/LLMs-16_aliases_+_custom-2ecc71?style=flat-square">
 </p>
 
 <p align="center">
@@ -44,12 +44,18 @@ npm i -g @kodax-ai/kodax
 # Pick any one you have an API key for:
 export ZHIPU_API_KEY=...        # or ANTHROPIC_API_KEY / OPENAI_API_KEY / KIMI_API_KEY /
                                 # MINIMAX_API_KEY / MIMO_API_KEY / ARK_API_KEY / QWEN_API_KEY /
+                                # QWEN_TOKEN_API_KEY /
                                 # DEEPSEEK_API_KEY / GEMINI_API_KEY
 
 kodax
 ```
 
-That's it. You're in the REPL — ask anything in natural language.
+That's it. You're in the REPL — ask anything in natural language. If this is a
+new machine with no provider selection or supported API-key environment
+variable, the bare `kodax` launch opens a metadata-only setup flow first. It
+never asks for the key itself; after choosing a provider/model, set the named
+environment variable, restart the terminal, and run `kodax` again. Use
+`kodax setup` to rerun that flow explicitly.
 
 > **No-Node target machines:** download a Bun-compiled single binary for Windows / macOS / Linux × x64 + arm64 from the [GitHub Releases](https://github.com/icetomoyo/KodaX/releases) page. See [docs/release.md](docs/release.md) for the build pipeline.
 
@@ -141,6 +147,14 @@ npm link
 
 KodaX reads API keys from environment variables. For built-in providers, the fastest path is:
 
+```bash
+# Interactive metadata-only provider/model setup (does not collect a key)
+kodax setup
+```
+
+The command tells you the exact environment-variable name to set and exits so
+you can restart the terminal. You can also configure it directly:
+
 ```bash
 # macOS / Linux
 export ZHIPU_API_KEY=your_api_key
@@ -149,6 +163,14 @@ export ZHIPU_API_KEY=your_api_key
 $env:ZHIPU_API_KEY="your_api_key"
 ```
 
+For Qwen Token Plan, select `qwen-token-plan` and use its separate credential;
+`QWEN_API_KEY` does not authenticate this route:
+
+```bash
+export QWEN_TOKEN_API_KEY=your_api_key
+kodax --provider qwen-token-plan
+```
+
 For CLI defaults, create `~/.kodax/config.json`:
 
 ```json
@@ -386,12 +408,16 @@ context diagnostics, and daemon protocol schemas, see
 The Space/IDE shared-daemon contract is documented in
 [SDK Embedder Guide section 23](docs/SDK_EMBEDDER_GUIDE.md#23-shared-coder-daemon-for-space-and-ide-hosts-feature_269-v0769).
 
-**v0.7.72 Runtime correction:** Auto Mode is now owned by the Runtime session,
+**v0.7.72–v0.7.73 Runtime permission contract:** Auto Mode is owned by the Runtime session,
 not by a UI hook. It reuses its LLM/rules guardrail across turns, classifies
 before the shared permission bridge, and persists an automatic fallback to
 rules. The same session settings can select a classifier model and bounded
-timeout. Host plan exit is exposed only when the host supplies an approval
-callback. See the [Runtime Auto Mode integration guide](docs/SDK_EMBEDDER_GUIDE.md#24-runtime-owned-auto-mode-and-plan-approval-bridges-v072).
+timeout; `auto` defaults to LLM classification and fails with a recoverable
+configuration error when no effective classifier model exists, rather than
+silently falling back. Runtime permission prompts now offer opaque, exact
+allow-once/session/persistent grant suggestions; persistent grants are
+daemon-owned and revisioned. Host plan exit is exposed only when the host
+supplies an approval callback. See the [Runtime Auto Mode integration guide](docs/SDK_EMBEDDER_GUIDE.md#24-runtime-owned-auto-mode-and-plan-approval-bridges-v072).
 
 ## Repo Intelligence
 
@@ -411,7 +437,7 @@ KodaX uses a **monorepo architecture** with npm workspaces. Source layout curren
 ```
 KodaX/
 ├── packages/                # 4 workspace packages (FEATURE_194 v0.7.43)
-│   ├── llm/                 # @kodax-ai/llm - LLM abstraction (15 built-in provider aliases)
+│   ├── llm/                 # @kodax-ai/llm - LLM abstraction (16 built-in provider aliases)
 │   │   └── providers/       # Anthropic, OpenAI, DeepSeek, Kimi, MiMo, MiniMax, Zhipu, Ark, …
 │   │
 │   ├── agent/               # @kodax-ai/agent - Generic Agent framework
@@ -459,7 +485,7 @@ KodaX/
        ┌──────────────┐ ┌──────────────────────────┐ ┌──────────────┐
        │@kodax-ai/    │ │@kodax-ai/agent           │ │@kodax-ai/llm │
        │coding (via   │ │Runner + fan-out +        │ │LLM Abstract  │
-       │above)        │ │idle-yield + session-     │ │(15 aliases)  │
+       │above)        │ │idle-yield + session-     │ │(16 aliases)  │
        │              │ │lineage + skills + mcp +  │ │              │
        │              │ │tracing (FEATURE_194)     │ │              │
        └──────────────┘ └──────────────────────────┘ └──────────────┘
@@ -471,7 +497,7 @@ Source-side workspace package names (`@kodax-ai/*`). npm consumers install the s
 
 | Workspace package | Purpose | Key Dependencies |
 |---------|---------|------------------|
-| `@kodax-ai/llm` | LLM abstraction (15 built-in provider aliases + custom registration) | @anthropic-ai/sdk, openai |
+| `@kodax-ai/llm` | LLM abstraction (16 built-in provider aliases + custom registration) | @anthropic-ai/sdk, openai |
 | `@kodax-ai/agent` | Generic Agent framework — Runner, fan-out, idle-yield, media/input artifacts, session-lineage, capabilities (mcp + skills), tracing (ADR-036 v0.7.43 consolidation; subpaths: `/media`, `/session-lineage`, `/capabilities/mcp`, `/capabilities/skills`, `/tracing`) | @kodax-ai/llm, js-tiktoken, fflate, jimp, yaml |
 | `@kodax-ai/coding` | Coding Agent — 50+ tools (incl. canonical Actor collaboration tools) + role prompts + auto-continue + repo-intelligence protocol | @kodax-ai/llm, @kodax-ai/agent |
 | `@kodax-ai/repl` | Complete interactive terminal UI (Ink/React, permission modes, commands, streaming) | @kodax-ai/coding, ink, react |
@@ -487,7 +513,7 @@ KodaX has two layers that consumers should understand separately:
 
 | Source package | npm subpath | Type | What you get | Example consumer |
 |---|---|---|---|---|
-| `packages/llm`    | `@kodax-ai/kodax/llm`     | Full package | 15-alias LLM abstraction (108 exports) | Standalone LLM clients |
+| `packages/llm`    | `@kodax-ai/kodax/llm`     | Full package | 16-alias LLM abstraction (108 exports) | Standalone LLM clients |
 | `packages/agent`  | `@kodax-ai/kodax/agent`   | Full package | Runner / fan-out / external-agent plane / session-lineage / capabilities / tracing (331 exports) | Custom agent frameworks |
 | `packages/agent`  | `@kodax-ai/kodax/skills`  | **Narrow subset** | Skills system only — `SkillRegistry` / `loadFullSkill` / `expandSkillForLLM` / ... (26 exports = pre-v0.7.43 `@kodax-ai/skills` complete API) | Skill loaders, IDE plugins |
 | `packages/agent`  | `@kodax-ai/kodax/mcp`     | **Narrow subset** | MCP only — `McpCapabilityProvider` / `createMcpTransport` / `searchMcpCatalog` / ... (23 exports) | MCP server hosts |
@@ -626,7 +652,7 @@ one-time provisioning).
 ## Features
 
 - **Modular Architecture** - Use as CLI, as a library, or as a Node-free single binary
-- **15 Built-in Provider Aliases** - Anthropic, OpenAI, DeepSeek, Kimi, Kimi Code, Qwen, Zhipu, Zhipu Coding, Zai Coding, MiniMax Coding, MiMo Coding, MiMo, Ark Coding, Gemini CLI, Codex CLI - plus user-defined OpenAI/Anthropic-compatible providers
+- **16 Built-in Provider Aliases** - Anthropic, OpenAI, DeepSeek, Kimi, Kimi Code, Qwen, Qwen Token Plan, Zhipu, Zhipu Coding, Zai Coding, MiniMax Coding, MiMo Coding, MiMo, Ark Coding, Gemini CLI, Codex CLI - plus user-defined OpenAI/Anthropic-compatible providers
 - **Dynamic Workflows + SDK Process Surface** - Generate/reuse capability-routed workflows, observe live progress through `WorkflowProcessSnapshot`, and control workflow lifecycle from SDK hosts without parsing REPL output
 - **V2 Worker single-loop + Sidecar Verifier (default)** - Single-agent main loop with an out-of-band Sidecar Verifier as Stop-hook (claudecode-shape; FEATURE_184 v0.7.42, ADR-030). Verifier returns accept/revise/blocked verdict on Worker text-only termination. The pre-v0.7.43 V1 chain is retired, `emit_handoff` is deleted, accept-verdict UI silently passes through, and content-aware gating skips trivial-chat sidecar calls. Adaptive child steering uses the canonical Actor collaboration tools with idle-yield waiting; specialist routing uses `spawn_agent(agent_id=...)`.
 - **Reasoning Effort** - Effort-first control (`off/auto/low/medium/high` plus model-supported extras) across providers
@@ -728,7 +754,7 @@ For smaller surface and tree-shake-friendly imports, the SDK is also exposed via
 
 ```typescript
 import { Runner } from '@kodax-ai/kodax/agent';                // agent runtime
-import { getProvider } from '@kodax-ai/kodax/llm';              // LLM abstraction (15 aliases)
+import { getProvider } from '@kodax-ai/kodax/llm';              // LLM abstraction (16 aliases)
 import { runKodaX } from '@kodax-ai/kodax/coding';              // coding tools + prompts
 import { createImageArtifactFromPath } from '@kodax-ai/kodax/media'; // input artifacts
 import { SkillRegistry } from '@kodax-ai/kodax/skills';         // zero-dep skill loader
@@ -896,6 +922,12 @@ KodaX provides 3 permission modes for fine-grained control:
 - Auto Mode runs guardrail classification before the permission UI; a safe
   allow verdict does not create a pending approval request. The session records
   an automatic LLM-to-rules fallback for later turns.
+- Runtime-backed prompts can offer exact `allow once`, `allow this session`,
+  and `always allow` choices. Return the Runtime-issued opaque suggestion;
+  never derive or widen a permission rule from the displayed command or path.
+  Persistent grants are daemon-owned, revisioned, and can be listed/revoked
+  through `runtime.permissions` by an authorized SDK host. Dynamic shell
+  commands deliberately receive no persistent-grant suggestion.
 
 ### CLI Help Topics
 
@@ -1059,7 +1091,7 @@ npm install @kodax-ai/kodax
 ```typescript
 import { runKodaX } from '@kodax-ai/kodax';                       // root: CLI helpers + runKodaX
 import { Runner, runFanOut } from '@kodax-ai/kodax/agent';        // generic Agent framework
-import { getProvider } from '@kodax-ai/kodax/llm';                // 15-alias LLM abstraction
+import { getProvider } from '@kodax-ai/kodax/llm';                // 16-alias LLM abstraction
 import { KODAX_TOOLS } from '@kodax-ai/kodax/coding';             // tools + prompts + agent loop
 import { createImageArtifactFromPath } from '@kodax-ai/kodax/media'; // input artifact helpers
 import { runInkInteractiveMode } from '@kodax-ai/kodax/repl';     // Ink TUI entrypoint
@@ -1075,7 +1107,7 @@ import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-
 
 ### `@kodax-ai/kodax/llm` — LLM Abstraction
 
-15 built-in provider aliases (Anthropic, OpenAI, DeepSeek, Kimi, Kimi-Code, Qwen, Zhipu, Zhipu-Coding, Zai-Coding, MiniMax-Coding, MiMo, MiMo-Coding, Ark-Coding, Gemini-CLI, Codex-CLI) + custom provider registration.
+16 built-in provider aliases (Anthropic, OpenAI, DeepSeek, Kimi, Kimi-Code, Qwen, Qwen-Token-Plan, Zhipu, Zhipu-Coding, Zai-Coding, MiniMax-Coding, MiMo, MiMo-Coding, Ark-Coding, Gemini-CLI, Codex-CLI) + custom provider registration.
 
 ```typescript
 import { getProvider, KodaXBaseProvider } from '@kodax-ai/kodax/llm';
@@ -1213,7 +1245,7 @@ await runInkInteractiveMode({ provider: 'zhipu-coding', effort: 'auto' });
 
 | Use Case | Subpath | Why |
 |----------|---------|-----|
-| Only need LLM abstraction | `@kodax-ai/kodax/llm` | Minimal deps; 15 built-in aliases |
+| Only need LLM abstraction | `@kodax-ai/kodax/llm` | Minimal deps; 16 built-in aliases |
 | Building custom agent | `@kodax-ai/kodax/agent` | Runner + fan-out + idle-yield + session-lineage + capabilities |
 | Coding tasks | `@kodax-ai/kodax/coding` | Complete coding agent + tools |
 | Terminal app | `@kodax-ai/kodax/repl` | Full interactive experience |
@@ -1229,6 +1261,7 @@ await runInkInteractiveMode({ provider: 'zhipu-coding', effort: 'auto' });
 | kimi | `KIMI_API_KEY` | Native | kimi-k2.7-code (262,144-token context; `kimi-k2.7-code-highspeed` / `kimi-k2.6` / `kimi-k2.5` via `/model`) |
 | kimi-code | `KIMI_CODE_API_KEY` | Native | kimi-for-coding (`k3-256k` for Moderato / `k3` 1M for Allegretto+ / `kimi-for-coding-highspeed` via `/model`; both K3 choices use upstream `k3`) |
 | qwen | `QWEN_API_KEY` | Native | qwen3.5-plus |
+| qwen-token-plan | `QWEN_TOKEN_API_KEY` | Native | qwen3.8-max-preview (Anthropic-compat; `qwen3.7-max` / `qwen3.7-plus` / `qwen3.6-flash` / `glm-5.2` / `deepseek-v4-pro` via `/model`; all 1M context; image input on Qwen 3.8 / 3.7 Plus / 3.6 Flash) |
 | zhipu | `ZHIPU_API_KEY` | Native | glm-5 (`glm-5.2` 1M ctx / `glm-5.1` / `glm-5-turbo` via `/model`) |
 | zhipu-coding | `ZHIPU_CODING_API_KEY` | Native | glm-5.2 (1M ctx; legacy `glm-5.1` and `glm-5-turbo` remain selectable via `/model`) |
 | zai-coding | `ZAI_CODING_API_KEY` | Native | glm-5.2 (Zhipu Coding Plan overseas mirror via `api.z.ai`, Anthropic-compat — same model lineup as `zhipu-coding`, served from outside CN) |
@@ -1465,6 +1498,7 @@ KodaX uses an **English-first** comment style with selective Chinese brief notes
 ## Documentation
 
 - [README_CN.md](README_CN.md) - Chinese Documentation
+- [docs/SDK_EMBEDDER_GUIDE.md](docs/SDK_EMBEDDER_GUIDE.md) - SDK hosting, shared Runtime daemon, Auto Mode, and permission-grant contracts
 - [docs/release.md](docs/release.md) - Standalone binary build & release pipeline
 - [docs/PRD.md](docs/PRD.md) - Product Requirements
 - [docs/ADR.md](docs/ADR.md) - Architecture Decisions

package/README_CN.md

@@ -17,7 +17,7 @@
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-KAI--FCL_1.0-orange?style=flat-square"></a>
   <a href="https://github.com/icetomoyo/KodaX/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/icetomoyo/KodaX?style=flat-square&logo=github&color=f1c40f"></a>
   <a href="https://github.com/icetomoyo/KodaX/actions"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/icetomoyo/KodaX/release.yml?style=flat-square&label=release"></a>
-  <img alt="providers" src="https://img.shields.io/badge/LLMs-15_aliases_+_custom-2ecc71?style=flat-square">
+  <img alt="providers" src="https://img.shields.io/badge/LLMs-16_aliases_+_custom-2ecc71?style=flat-square">
 </p>
 
 <p align="center">
@@ -44,12 +44,15 @@ npm i -g @kodax-ai/kodax
 # 选一个你有 API key 的 provider
 export ZHIPU_API_KEY=...        # 或 KIMI_API_KEY / MINIMAX_API_KEY / MIMO_API_KEY /
                                 # ARK_API_KEY / DEEPSEEK_API_KEY / ANTHROPIC_API_KEY /
-                                # OPENAI_API_KEY / QWEN_API_KEY / GEMINI_API_KEY
+                                # OPENAI_API_KEY / QWEN_API_KEY / QWEN_TOKEN_API_KEY / GEMINI_API_KEY
 
 kodax
 ```
 
-就这样。进 REPL，自然语言提问。
+就这样。进 REPL，自然语言提问。如果新机器既没有选择 provider，也没有任何
+受支持的 API Key 环境变量，直接运行 `kodax` 会先打开只配置元数据的向导；它不会
+要求输入或保存 Key。选择 provider/model 后，按提示设置对应环境变量、重启终端，
+再运行 `kodax`。需要主动重新配置时可运行 `kodax setup`。
 
 > **不装 Node 的目标机器**：从 [GitHub Releases](https://github.com/icetomoyo/KodaX/releases) 拿 Bun 编译的单文件二进制（Win / macOS / Linux × x64 + arm64）。详见 [docs/release.md](docs/release.md)。
 
@@ -88,10 +91,14 @@ daemon，不会再次打开 GUI。`ELECTRON_RUN_AS_NODE` 只存在于子进程
 再使用 attach-only 模式连接。SDK 的 `homeDir` 是拥有 `.kodax` 的 CLI 风格基础目录，
 不是 `.kodax` 目录本身。
 
-**v0.7.72 Runtime 修正：**Auto Mode 的权限决策由 Runtime Session 持有，
+**v0.7.72–v0.7.73 Runtime 权限契约：**Auto Mode 的权限决策由 Runtime Session 持有，
 不再由 UI hook 抢先决定。Runtime 会跨 turn 复用 LLM/rules guardrail，先分类、
 仅在 `escalate` 时创建共享 permission 请求，并把自动降级到 rules 的结果持久化到
-session。Session 也可设置 classifier model 和有界 timeout；没有宿主审批回调时，
+session。Session 也可设置 classifier model 和有界 timeout；`auto` 默认使用 LLM
+分类，没有有效 classifier model 时会在调用 provider 或创建审批前返回可恢复配置错误，
+绝不静默退回 rules。Runtime 权限请求可给出由 Runtime 生成的精确作用域建议：一次允许、
+本 Session 允许，或（仅安全场景）持久允许；客户端只能回传不透明 suggestion id，不能从
+预览内容自行扩大范围。持久授权由 daemon 持有并通过 revision 管理。没有宿主审批回调时，
 不会向模型暴露 `exit_plan_mode`。完整 SDK 接入见
 [Runtime Auto Mode 指引](docs/SDK_EMBEDDER_GUIDE.md#24-runtime-owned-auto-mode-and-plan-approval-bridges-v072)。
 
@@ -174,7 +181,14 @@ kodax
 
 ### 2. 配置模型提供商
 
-最简单的方式是先设置 API Key：
+可以先运行不会收集 Key 的交互配置：
+
+```bash
+kodax setup
+```
+
+命令会保存 provider/model，告诉你准确的环境变量名，然后退出以便重启终端。
+也可以直接设置 API Key：
 
 ```bash
 # macOS / Linux
@@ -184,6 +198,14 @@ export ZHIPU_API_KEY=your_api_key
 $env:ZHIPU_API_KEY="your_api_key"
 ```
 
+Qwen Token Plan 需要选择 `qwen-token-plan` 并使用单独的凭据；`QWEN_API_KEY`
+不能用于该路由：
+
+```bash
+export QWEN_TOKEN_API_KEY=your_api_key
+kodax --provider qwen-token-plan
+```
+
 然后在 `~/.kodax/config.json` 里写一个最小配置：
 
 ```json
@@ -235,7 +257,7 @@ const result = await runKodaX(
 
 ```typescript
 import { Runner } from '@kodax-ai/kodax/agent';                // Agent runtime
-import { getProvider } from '@kodax-ai/kodax/llm';              // LLM 抽象（15 个内置 alias）
+import { getProvider } from '@kodax-ai/kodax/llm';              // LLM 抽象（16 个内置 alias）
 import { runKodaX } from '@kodax-ai/kodax/coding';              // Coding tools + prompts
 import { createImageArtifactFromPath } from '@kodax-ai/kodax/media'; // 输入 artifact helpers
 import { SkillRegistry } from '@kodax-ai/kodax/skills';         // 零依赖 skill loader
@@ -472,6 +494,7 @@ dist/binary/linux-x64/
 | kimi | `KIMI_API_KEY` | Native | kimi-k2.7-code（262,144 token；可 `/model` 切换 `kimi-k2.7-code-highspeed` / `kimi-k2.6` / `kimi-k2.5`） |
 | kimi-code | `KIMI_CODE_API_KEY` | Native | kimi-for-coding（可 `/model` 切换 `k3-256k`〔Moderato，256K〕/ `k3`〔Allegretto+，1M〕/ `kimi-for-coding-highspeed`；两个 K3 选项均请求上游 `k3`） |
 | qwen | `QWEN_API_KEY` | Native | qwen3.5-plus |
+| qwen-token-plan | `QWEN_TOKEN_API_KEY` | Native | qwen3.8-max-preview（Anthropic 协议；可 `/model` 切换 `qwen3.7-max` / `qwen3.7-plus` / `qwen3.6-flash` / `glm-5.2` / `deepseek-v4-pro`；均为 1M ctx；Qwen 3.8 / 3.7 Plus / 3.6 Flash 支持图片理解） |
 | zhipu | `ZHIPU_API_KEY` | Native | glm-5（可 `/model` 切换 `glm-5.2` 1M ctx / `glm-5.1` / `glm-5-turbo`） |
 | zhipu-coding | `ZHIPU_CODING_API_KEY` | Native | glm-5.2（1M ctx；仍可通过 `/model` 显式选择兼容模型 `glm-5.1` / `glm-5-turbo`） |
 | zai-coding | `ZAI_CODING_API_KEY` | Native | glm-5.2（GLM Coding Plan 海外站，通过 `api.z.ai` 接入，Anthropic 协议 — 模型清单和 `zhipu-coding` 完全一致） |
@@ -568,7 +591,7 @@ KodaX 是基于 npm workspaces 的 TypeScript monorepo，**源码层 4 个 works
 
 | Workspace 包 | 作用 | 主要依赖 |
 |----|------|---------|
-| `@kodax-ai/llm` | LLM 抽象层（15 个内置 provider alias + 自定义 provider 注册），可独立使用 | `@anthropic-ai/sdk`, `openai` |
+| `@kodax-ai/llm` | LLM 抽象层（16 个内置 provider alias + 自定义 provider 注册），可独立使用 | `@anthropic-ai/sdk`, `openai` |
 | `@kodax-ai/agent` | 通用 Agent 框架 —— Runner / runFanOut / runWithIdleYield / AgentActorController / AgentTurnScheduler + media/input artifacts + 会话管理 + tokenization + 可插拔 compaction + **inline 后**:session-lineage 子树 + capabilities (mcp + skills + builtin) + tracing（subpaths: `/media`、`/session-lineage`、`/capabilities/mcp`、`/capabilities/skills`、`/tracing`） | `@kodax-ai/llm`, `js-tiktoken`, `fflate`, `jimp`, `yaml` |
 | `@kodax-ai/coding` | Coding Agent:50+ 工具（含 canonical Actor 协作工具）、role prompts、agent loop、auto-continue + repo-intelligence protocol(v0.7.43 inline) | `@kodax-ai/llm`, `@kodax-ai/agent` |
 | `@kodax-ai/repl` | 完整交互式终端 UI（Ink / React、权限模式、命令系统、流式渲染） | `@kodax-ai/coding`, `ink`, `react` |
@@ -709,7 +732,7 @@ REPL 显示、唤醒或消费。
 ```
 KodaX/                       # 4 workspace packages(FEATURE_194 v0.7.43)
 ├── packages/
-│   ├── llm/                 # @kodax-ai/llm —— 15 个内置 provider alias
+│   ├── llm/                 # @kodax-ai/llm —— 16 个内置 provider alias
 │   ├── agent/               # @kodax-ai/agent —— Runner / fan-out / idle-yield + 子树:
 │   │   ├── session-lineage/ # 分支 session tree (v0.7.43 inline)
 │   │   ├── capabilities/
@@ -817,7 +840,7 @@ KodaX 现在会把 Repo Intelligence 的本地缓存分成内置引擎 profile
 ## 文档
 
 - [README.md](README.md) - 英文版 README
-- [docs/SDK_EMBEDDER_GUIDE.md](docs/SDK_EMBEDDER_GUIDE.md) - SDK 宿主集成、shared Runtime 与 v0.7.72 Auto Mode 契约
+- [docs/SDK_EMBEDDER_GUIDE.md](docs/SDK_EMBEDDER_GUIDE.md) - SDK 宿主集成、shared Runtime、v0.7.73 Auto Mode 与精确授权契约
 - [docs/release.md](docs/release.md) - 单文件二进制构建与发布流程
 - [docs/PRD.md](docs/PRD.md) - 产品需求
 - [docs/ADR.md](docs/ADR.md) - 架构决策

package/dist/chunks/{agent-YKGU4USA.js → agent-T6PGT6AU.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Ga as i,Ma as j,da as d,ea as e,fa as f,j as c,ua as g,va as h}from"./chunk-VDGCGOQH.js";import"./chunk-SQODXBLX.js";import"./chunk-44QXPEEE.js";import"./chunk-GIK4SGAT.js";import"./chunk-ZJIMT5I3.js";import{sb as a,tb as b}from"./chunk-JSDLBXME.js";import"./chunk-E27LHEIP.js";import"./chunk-EDZ5KJFT.js";import"./chunk-23X6REO4.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,j as runKodaX,i as saveSessionSnapshot,a as validateAndFixToolHistory};
+import{Ga as i,Ma as j,da as d,ea as e,fa as f,j as c,ua as g,va as h}from"./chunk-AGDDM5AW.js";import"./chunk-64M5HOCA.js";import"./chunk-MBAPT2R5.js";import"./chunk-HVCNAZ52.js";import"./chunk-XXQLPTAN.js";import{sb as a,tb as b}from"./chunk-OG6DRNKV.js";import"./chunk-GAFFYJU3.js";import"./chunk-BUPJGG3C.js";import"./chunk-F7AIEHSS.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,j as runKodaX,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-QGMWA2C3.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{Ea as a,Fa as b}from"./chunk-6JTWXGVU.js";import"./chunk-MLEAQTCD.js";import"./chunk-PFH53O4M.js";import"./chunk-EAD4SF3Z.js";import"./chunk-6RI2RBTF.js";import"./chunk-M7FXNPWV.js";import"./chunk-AGDDM5AW.js";import"./chunk-64M5HOCA.js";import"./chunk-MBAPT2R5.js";import"./chunk-HVCNAZ52.js";import"./chunk-XXQLPTAN.js";import"./chunk-OG6DRNKV.js";import"./chunk-GAFFYJU3.js";import"./chunk-BUPJGG3C.js";import"./chunk-F7AIEHSS.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};

package/dist/chunks/{chunk-SQODXBLX.js → chunk-64M5HOCA.js}

@@ -1,5 +1,5 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{m as f}from"./chunk-E27LHEIP.js";import{a as h}from"./chunk-ONUPGMER.js";import{createHash as R}from"node:crypto";function O(i){return new y(i)}h(O,"createMemoryAgent");var y=class{static{h(this,"DefaultMemoryAgent")}options;constructor(e){this.options=e}async startSession(e){let t=this.options.initialMemoryPack??await this.options.controlPlane.buildMemoryPack({task:e.objective,identity:e.identity,maxCandidates:12,maxHints:5});return new g(e,t.memoryRevision,t.candidates,this.options)}},g=class{static{h(this,"DefaultMemorySession")}input;memoryRevision;candidates;options;observations=new Map;consumedReminderKeys=new Set;lastSequence=0;closed=!1;completion;prefetchGeneration=0;prefetch;readyPrefetch;queryByEpoch=new Map;injectedReceiptIds=[];constructor(e,t,n,c){this.input=e,this.memoryRevision=t,this.candidates=n,this.options=c}observe(e){if(this.assertOpen(),v(e.summary))return;let t=K(e,this.options.sourcePolicy),n=this.observations.get(e.id);if(n!==void 0){if(n.sequence===t.sequence&&w(n)===w(t))return;throw new Error(`conflicting duplicate memory observation: ${e.id}`)}if(!Number.isSafeInteger(e.sequence)||e.sequence<=this.lastSequence)throw new Error(`memory observation sequence must be strictly monotonic after ${this.lastSequence}`);if(e.summary.trim().length===0)throw new Error("memory observation summary must not be empty");this.observations.set(e.id,t),this.lastSequence=e.sequence}recall(e){this.assertOpen();let t=[...this.observations.values()].filter(d=>d.sequence<=e.throughSequence).filter(d=>I(d,e)).sort((d,l)=>l.sequence-d.sequence).slice(0,3),n=this.candidates.filter(d=>P(d,e)).slice(0,Math.max(0,3-t.length)),c=this.prefetchKey(e),s=this.consumeReadyPrefetch(c).filter(d=>!n.some(l=>l.ref.id===d.ref.id)).slice(0,Math.max(0,3-t.length-n.length)),a=m([...t.flatMap(d=>d.evidence.map(l=>l.ref)),...n.map(d=>d.ref.id),...s.map(d=>d.ref.id)]),r=k([...t.length>0||n.length>0?["exact"]:[],...s.length>0?["semantic_prefetch"]:[]]);if(t.length===0&&n.length===0&&s.length===0){this.startPrefetch(c,e),this.emitDecisionReceipt(e,[],[],r);return}let o=[...t.map(d=>d.summary.trim()),...n.map(d=>d.bodySnippet??d.hook),...s.map(d=>d.bodySnippet??d.hook)].join(`
+import{m as f}from"./chunk-GAFFYJU3.js";import{a as h}from"./chunk-ONUPGMER.js";import{createHash as R}from"node:crypto";function O(i){return new y(i)}h(O,"createMemoryAgent");var y=class{static{h(this,"DefaultMemoryAgent")}options;constructor(e){this.options=e}async startSession(e){let t=this.options.initialMemoryPack??await this.options.controlPlane.buildMemoryPack({task:e.objective,identity:e.identity,maxCandidates:12,maxHints:5});return new g(e,t.memoryRevision,t.candidates,this.options)}},g=class{static{h(this,"DefaultMemorySession")}input;memoryRevision;candidates;options;observations=new Map;consumedReminderKeys=new Set;lastSequence=0;closed=!1;completion;prefetchGeneration=0;prefetch;readyPrefetch;queryByEpoch=new Map;injectedReceiptIds=[];constructor(e,t,n,c){this.input=e,this.memoryRevision=t,this.candidates=n,this.options=c}observe(e){if(this.assertOpen(),v(e.summary))return;let t=K(e,this.options.sourcePolicy),n=this.observations.get(e.id);if(n!==void 0){if(n.sequence===t.sequence&&w(n)===w(t))return;throw new Error(`conflicting duplicate memory observation: ${e.id}`)}if(!Number.isSafeInteger(e.sequence)||e.sequence<=this.lastSequence)throw new Error(`memory observation sequence must be strictly monotonic after ${this.lastSequence}`);if(e.summary.trim().length===0)throw new Error("memory observation summary must not be empty");this.observations.set(e.id,t),this.lastSequence=e.sequence}recall(e){this.assertOpen();let t=[...this.observations.values()].filter(d=>d.sequence<=e.throughSequence).filter(d=>I(d,e)).sort((d,l)=>l.sequence-d.sequence).slice(0,3),n=this.candidates.filter(d=>P(d,e)).slice(0,Math.max(0,3-t.length)),c=this.prefetchKey(e),s=this.consumeReadyPrefetch(c).filter(d=>!n.some(l=>l.ref.id===d.ref.id)).slice(0,Math.max(0,3-t.length-n.length)),a=m([...t.flatMap(d=>d.evidence.map(l=>l.ref)),...n.map(d=>d.ref.id),...s.map(d=>d.ref.id)]),r=k([...t.length>0||n.length>0?["exact"]:[],...s.length>0?["semantic_prefetch"]:[]]);if(t.length===0&&n.length===0&&s.length===0){this.startPrefetch(c,e),this.emitDecisionReceipt(e,[],[],r);return}let o=[...t.map(d=>d.summary.trim()),...n.map(d=>d.bodySnippet??d.hook),...s.map(d=>d.bodySnippet??d.hook)].join(`
 `),b=u(`${a.join("\0")}\0${e.actionSignature??e.decisionIntent}`);if(this.consumedReminderKeys.has(b)){this.emitDecisionReceipt(e,a,[],r);return}return this.consumedReminderKeys.add(b),this.emitDecisionReceipt(e,a,a,r),{content:o,evidenceRefs:a}}query(e){this.assertOpen();let t=p(e.decisionRevision,e.throughSequence),n=E(e.need),c=u([t,this.memoryRevision,n??"",e.actionSignature??"",f].join("\0")),s=this.queryByEpoch.get(t);if(s!==void 0)return s.key===c?s.result:Promise.resolve(void 0);let a=n===void 0?Promise.resolve(void 0):this.queryOnce(e,n);return this.queryByEpoch.set(t,{key:c,result:a}),n===void 0&&this.emitDecisionReceipt(e,[],[],["deliberate_query"]),a}rewind(e){if(this.assertOpen(),!Number.isSafeInteger(e.throughSequence)||e.throughSequence<0)throw new Error("rewind sequence must be a non-negative safe integer");for(let[t,n]of this.observations)n.sequence>e.throughSequence&&this.observations.delete(t);for(this.lastSequence=e.throughSequence,this.consumedReminderKeys.clear(),this.queryByEpoch.clear();this.injectedReceiptIds.length>0;)this.injectedReceiptIds.pop();this.cancelPrefetch("rewind")}complete(e){return this.assertOpen(),this.completion!==void 0?this.completion:(this.completion=this.completeOnce(e),this.completion)}async close(e={}){this.cancelPrefetch("close"),e.drain!==!1&&this.completion!==void 0&&await this.completion,this.closed=!0}async completeOnce(e){if(e.status==="cancelled"||v(e.summary))return;let t=j(this.input,[...this.observations.values()],{...e,status:e.status,evidence:e.evidence.map(n=>q(n,this.options.sourcePolicy))},this.options.now?.()??new Date().toISOString(),this.injectedReceiptIds);await this.options.persistOutcomeDigest?.(t),await this.reviewWithTimeout(t)}async reviewWithTimeout(e){let t=this.options.reviewEpisode;if(t===void 0)return;let n=new AbortController,c=Math.max(1,this.options.reviewTimeoutMs??3e4),s,a=await Promise.race([t(e,n.signal).then(()=>!1),new Promise(r=>{s=setTimeout(()=>{n.abort(),r(!0)},c)})]);s!==void 0&&clearTimeout(s),a&&this.options.onTrace?.({type:"review.timed_out",key:e.reviewKey,detail:`${c}ms`})}assertOpen(){if(this.closed)throw new Error("memory session is closed")}prefetchKey(e){return u([e.decisionRevision,e.decisionIntent,e.actionSignature??"",String(e.throughSequence),this.memoryRevision,this.candidates.map(t=>t.ref.id).join(",")].join("\0"))}async queryOnce(e,t){try{let n=await this.options.controlPlane.buildMemoryPack({task:this.input.objective,identity:this.input.identity,decisionIntent:t,...e.actionSignature!==void 0?{actionSignature:e.actionSignature}:{},maxCandidates:3,maxHints:3,includeSnippets:!0,purpose:"deliberate_query"}),c=n.promptHints.filter(M).filter(o=>o.bodySnippet!==void 0&&o.bodySnippet.trim().length>0).slice(0,3),s=c.map(o=>o.ref.id),a=x(c.map(o=>o.bodySnippet??"")),r=a.length===0?[]:s;return this.emitDecisionReceipt(e,s,r,["deliberate_query"],n.candidates.map(o=>o.ref.id)),a.length===0?void 0:{content:a,evidenceRefs:s}}catch(n){this.emitDecisionReceipt(e,[],[],["deliberate_query"]),this.options.onTrace?.({type:"query.failed",key:p(e.decisionRevision,e.throughSequence),detail:n instanceof Error?n.message:String(n)});return}}emitDecisionReceipt(e,t,n,c,s=this.candidates.map(a=>a.ref.id)){let a=p(e.decisionRevision,e.throughSequence),r=u(s.join("\0")),o={id:`memory-decision:${u([a,f,r,t.join(","),n.join(","),c.join(",")].join("\0")).slice(0,24)}`,decisionEpoch:a,decisionRevision:e.decisionRevision,policyVersion:f,candidateSetFingerprint:r,candidateRefs:[...s],selectedRefs:[...t],injectedRefs:[...n],selectionModes:[...c],...e.actionSignature!==void 0?{actionSignature:e.actionSignature}:{},throughSequence:e.throughSequence};n.length>0&&!this.injectedReceiptIds.includes(o.id)&&this.injectedReceiptIds.push(o.id),this.options.onTrace?.({type:"memory.decision",receipt:o})}consumeReadyPrefetch(e){if(this.readyPrefetch?.key!==e)return[];let t=new Set(this.readyPrefetch.refIds);return this.readyPrefetch=void 0,this.candidates.filter(n=>t.has(n.ref.id))}startPrefetch(e,t){let n=this.options.recallRunner;if(n===void 0||this.candidates.length===0||this.prefetch?.key===e)return;this.cancelPrefetch("superseded");let c=new AbortController,s=++this.prefetchGeneration;this.prefetch={key:e,controller:c};let a=new Set(this.candidates.map(r=>r.ref.id));n({objective:t.objective,decisionContext:t.decisionContext,decisionIntent:t.decisionIntent,candidates:this.candidates.map(r=>({refId:r.ref.id,claim:r.bodySnippet??r.hook,...r.ref.claimKind!==void 0?{claimKind:r.ref.claimKind}:{}})),signal:c.signal}).then(r=>{if(c.signal.aborted||s!==this.prefetchGeneration||this.prefetch?.key!==e){this.options.onTrace?.({type:"recall.prefetch.discarded",key:e});return}this.readyPrefetch={key:e,refIds:m(r.selectedRefIds.filter(o=>a.has(o)))},this.prefetch=void 0,this.options.onTrace?.({type:"recall.prefetch.completed",key:e})}).catch(r=>{c.signal.aborted||(s===this.prefetchGeneration&&(this.prefetch=void 0),this.options.onTrace?.({type:"recall.prefetch.failed",key:e,detail:r instanceof Error?r.message:String(r)}))})}cancelPrefetch(e){if(this.prefetch===void 0)return;let t=this.prefetch.key;this.prefetch.controller.abort(),this.prefetch=void 0,this.prefetchGeneration+=1,this.options.onTrace?.({type:"recall.prefetch.discarded",key:t,detail:e})}};function I(i,e){return i.actionSignature!==void 0&&e.actionSignature!==void 0?i.actionSignature===e.actionSignature:i.claimKey!==void 0&&i.claimKey===e.decisionIntent}h(I,"exactObservationMatch");function P(i,e){return i.ref.actionSignature!==void 0&&e.actionSignature!==void 0?i.ref.actionSignature===e.actionSignature:i.ref.claimKey!==void 0&&i.ref.claimKey===e.decisionIntent}h(P,"exactCandidateMatch");function j(i,e,t,n,c){let s=[...e].reverse().find(o=>o.kind==="outcome"),a=e.at(-1)?.sequence??0,r=u([i.identity.sessionId,String(a),t.status,t.summary].join("\0"));return{id:`memory-outcome:${r.slice(0,24)}`,reviewKey:r,sessionId:i.identity.sessionId,branchId:i.identity.sessionId,sequence:a,objective:i.objective,...s?.actionSignature!==void 0?{actionSignature:s.actionSignature}:{},approach:s?.summary??"episode completion",outcome:t.status,summary:t.summary.trim(),evidenceRefs:m(t.evidence.map(o=>o.ref)),evidence:t.evidence.map(o=>({ref:o.ref,grade:o.requestedGrade,source:o.source,observedAt:o.observedAt})),...c.length>0?{memoryInfluence:m(c).map(o=>({decisionReceiptRef:o,grade:"exposed"}))}:{},visibility:s?.visibility??"prompt_safe",createdAt:n}}h(j,"buildOutcomeDigest");function E(i){let e=i.replace(/\s+/g," ").trim();if(!(e.length===0||S(e)>512||v(e))&&!/^(?:list|show|dump|enumerate)\s+(?:all|every)\s+(?:the\s+)?memor(?:y|ies)\b/i.test(e)&&!/\b(?:all|every)\s+(?:project|workspace|tenant|user|agent)(?:s|'s)?\b/i.test(e))return e}h(E,"normalizeQueryNeed");function S(i){let e=0,t=0;for(let n of i)n.codePointAt(0)<=127?e+=1:t+=1;return Math.ceil(e/4)+t}h(S,"estimateMemoryTokens");function M(i){return i.ref.visibility==="prompt_safe"&&i.ref.authority!=="proposal_only"&&(i.ref.lifecycle==="active"||i.ref.lifecycle==="trusted"||i.ref.lifecycle==="readonly")}h(M,"isGovernedQueryHint");function x(i){let e=i.map(n=>n.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g,"").replace(/<\/?[^>]+>/g,"").replace(/[<>]/g,"").replace(/\s+/g," ").trim()).filter(n=>n.length>0),t=e.join(`
 `);for(;S(t)>512&&e.length>1;)e.pop(),t=e.join(`
 `);return S(t)<=512?t:""}h(x,"boundedQueryContent");function p(i,e){return u(`${i}\0${e}`).slice(0,24)}h(p,"decisionEpoch");function k(i){return[...new Set(i)]}h(k,"uniqueModes");function K(i,e){return Object.freeze({...i,evidence:Object.freeze(i.evidence.map(t=>Object.freeze(q(t,e)))),...i.metadata!==void 0?{metadata:Object.freeze({...i.metadata})}:{}})}h(K,"freezeObservation");function q(i,e){let t=e?.(i)??"inferred";return{...i,requestedGrade:_(i.requestedGrade,t)}}h(q,"applySourcePolicy");function _(i,e){let t=["inferred","observed","corroborated","verified","authoritative"];return t[Math.min(t.indexOf(i),t.indexOf(e))]??"inferred"}h(_,"lowerEvidenceGrade");function w(i){return JSON.stringify(i)}h(w,"stableObservation");function m(i){return[...new Set(i)]}h(m,"unique");function u(i){return R("sha256").update(i).digest("hex")}h(u,"digest");function v(i){return/(?:-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|authorization:\s*bearer\s+\S+|(?:api[_-]?key|password|secret|token)\s*[:=]\s*\S+)/i.test(i)}h(v,"isRestrictedMemoryContent");export{O as a};