@kodax-ai/kodax 0.7.77 → 0.7.78

package/dist/types-chunks/{bash-prefix-extractor.d-pZdu6qt7.d.ts → bash-prefix-extractor.d-uAe2Oqda.d.ts}

@@ -1,9 +1,9 @@
-import { bs as KodaXGoalState, a8 as AgentMessage, dv as StopHookFn, bM as KodaXSessionLineage, k as AgentActorStore, aC as AgentTurnExecutor, t as AgentBudgetPort, h as AgentActorClient, N as AgentExecutionResult, V as AgentExecutorPlaneBinding, by as KodaXJsonValue, bm as KodaXExtensionSessionRecord, f as Agent, dS as WorkflowIsolation, bn as KodaXExtensionSessionState, bD as KodaXSessionArtifactLedgerEntry, df as SessionErrorMetadata, bU as KodaXSessionScope, bV as KodaXSessionStorage, cj as MemoryContextIdentity, cv as MemoryPack, aK as AskUserQuestionOptions, aG as AskUserAnswer, aI as AskUserMultiOptions, dP as WorkflowEventCorrelation, aT as CompactionUpdate, e4 as WorkflowProcessEvent, dO as WorkflowEvent, cJ as MemoryReviewPlan, bA as KodaXMemoryOutcomeDigest, bb as Guardrail, aY as DiscoveredInstance, bw as KodaXInputArtifact, cK as MemoryReviewRunner } from './types.d-RdWRfUEs.js';
+import { bz as KodaXGoalState, ab as AgentMessage, eg as StopHookFn, bU as KodaXSessionLineage, n as AgentActorStore, aF as AgentTurnExecutor, w as AgentBudgetPort, i as AgentActorOwner, h as AgentActorClient, Q as AgentExecutionResult, Y as AgentExecutorPlaneBinding, bF as KodaXJsonValue, bt as KodaXExtensionSessionRecord, f as Agent, eG as WorkflowIsolation, bu as KodaXExtensionSessionState, bL as KodaXSessionArtifactLedgerEntry, e0 as SessionErrorMetadata, c0 as KodaXSessionScope, c1 as KodaXSessionStorage, d2 as MemoryContextIdentity, de as MemoryPack, aN as AskUserQuestionOptions, aJ as AskUserAnswer, aL as AskUserMultiOptions, eD as WorkflowEventCorrelation, aX as CompactionUpdate, eU as WorkflowProcessEvent, eC as WorkflowEvent, dt as MemoryReviewPlan, bI as KodaXMemoryOutcomeDigest, bi as Guardrail, b2 as DiscoveredInstance, bD as KodaXInputArtifact, du as MemoryReviewRunner, eu as UnifiedLearningReviewRunner } from './types.d-BA-Jwpfs.js';
 import { a0 as KodaXTokenUsage, k as KodaXMessage, a1 as KodaXToolDefinition, a9 as KodaXWireReasoningEffort, U as KodaXTaskRoutingDecision, V as KodaXTaskType, W as KodaXTaskWorkIntent, Q as KodaXTaskComplexity, L as KodaXRiskLevel, h as KodaXHarnessProfile, f as KodaXExecutionMode, b as KodaXChildFanoutClass, F as KodaXReasoningMode, J as KodaXReviewScale } from './types.d-DIpZJKUl.js';
-import { d as SkillDynamicContextExecutor, I as ISkillRegistry } from './types.d-DCQVBqVn.js';
+import { d as SkillDynamicContextExecutor, I as ISkillRegistry } from './types.d-BbtGlKZu.js';
 import { Diagnostic, Position, Location, Hover, DocumentSymbol, SymbolInformation, WorkspaceSymbol, CallHierarchyItem, CallHierarchyIncomingCall, CallHierarchyOutgoingCall } from 'vscode-languageserver-protocol';
 import { K as KodaXLlmTimeoutConfig, a as CostTracker } from './cost-tracker.d-BeaenODW.js';
-import { t as MemoryRecallRunner } from './types-LanCEDj8.js';
+import { t as MemoryRecallRunner } from './types-D3g6XUQr.js';
 import { C as CapabilityKind, f as CapabilitySearchSnapshot, b as CapabilityResult } from './capability.d-K664nHOS.js';
 import { K as KodaXBaseProvider } from './base.d-4e74xDdy.js';
 
@@ -837,6 +837,8 @@ interface CodingActorSessionOptions {
     readonly store?: AgentActorStore;
     readonly executor?: AgentTurnExecutor;
     readonly budget?: AgentBudgetPort;
+    readonly owner?: AgentActorOwner;
+    readonly isOwnerAlive?: (owner: AgentActorOwner) => boolean | Promise<boolean>;
 }
 /** One Runtime-owned Actor tree for one KodaX session. */
 declare class CodingActorSession {
@@ -849,6 +851,8 @@ declare class CodingActorSession {
     initialize(): Promise<void>;
     attach(parentCtx: KodaXToolExecutionContext, options: KodaXOptions, callerPath?: string): AgentActorClient;
     rootControl(): AgentActorClient;
+    ownerId(): string | undefined;
+    ownsDurableFence(): boolean;
     createWorkflowOwner(parentPath: string, runId: string): Promise<AgentActorClient>;
     workflowOwnerSignal(ownerPath: string): AbortSignal;
     settleWorkflowOwner(ownerPath: string, state: 'completed' | 'failed' | 'interrupted', result: AgentExecutionResult & {
@@ -859,6 +863,8 @@ declare class CodingActorSession {
     registerTurnExecutor(key: string, executor: AgentTurnExecutor): () => void;
     waitForAgentCapacity(signal?: AbortSignal): Promise<boolean>;
     close(reason?: string): Promise<void>;
+    quiesce(reason?: string): Promise<void>;
+    disposeAfterStoreRemoval(reason?: string): void;
 }
 declare function createLocalCodingActorControl(parentCtx: KodaXToolExecutionContext, options: KodaXOptions): AgentActorClient;
 /** Runtime adapter for detached external Actor turns. The executor plane stays internal. */
@@ -871,7 +877,7 @@ declare function createExternalActorTurnExecutor(binding: AgentExecutorPlaneBind
  * configure / install / troubleshoot KodaX?" questions. Pure data + a
  * deterministic resolver — no RAG, no vector store, no network fetch.
  */
-type KodaXManualTopicId = 'overview' | 'license' | 'install' | 'quickstart' | 'providers' | 'custom-providers' | 'config' | 'permissions' | 'commands' | 'tools' | 'agents' | 'skills' | 'extensions' | 'mcp' | 'a2a' | 'repo-intelligence' | 'sessions' | 'compaction' | 'memory' | 'doctor' | 'sdk' | 'troubleshooting';
+type KodaXManualTopicId = 'overview' | 'license' | 'install' | 'quickstart' | 'providers' | 'custom-providers' | 'config' | 'permissions' | 'sandbox' | 'commands' | 'tools' | 'agents' | 'skills' | 'extensions' | 'mcp' | 'a2a' | 'repo-intelligence' | 'sessions' | 'compaction' | 'memory' | 'doctor' | 'sdk' | 'troubleshooting';
 /** A pointer to the code/doc the topic is derived from (for traceability). */
 interface KodaXManualSource {
     readonly label: string;
@@ -1687,6 +1693,25 @@ interface KodaXWorkflowAgentDigestEvent {
 interface KodaXToolEventMeta extends KodaXActivityEventMeta {
     readonly toolId?: string;
 }
+type KodaXShellSandboxBackend = 'windows-restricted-user' | 'macos-seatbelt' | 'linux-bubblewrap' | 'unsupported';
+type KodaXShellSandboxObservation = {
+    readonly version: 1;
+    readonly state: 'applied';
+    readonly backend: KodaXShellSandboxBackend;
+    readonly policyId: 'kodax-workspace-shell-v1';
+} | {
+    readonly version: 1;
+    readonly state: 'fallback';
+    readonly reason: 'not_ready' | 'prepare_failed' | 'backend_failed';
+    readonly execution: 'normal_permission_policy';
+} | {
+    readonly version: 1;
+    readonly state: 'not_selected';
+};
+interface KodaXToolSandboxObservationUpdate {
+    readonly id: string;
+    readonly observation: KodaXShellSandboxObservation;
+}
 interface KodaXContextCompactionFinishedEvent extends Partial<KodaXLiveEventMeta> {
     readonly source: 'manual' | 'automatic_threshold' | 'physical_capacity';
     readonly tokensBefore: number;
@@ -1806,6 +1831,11 @@ interface KodaXEvents {
         id: string;
         message: string;
     }, meta?: KodaXToolEventMeta) => void;
+    /**
+     * Execution metadata for professional hosts. REPL history intentionally does
+     * not render this internal containment state.
+     */
+    onToolSandboxObservation?: (update: KodaXToolSandboxObservationUpdate, meta?: KodaXToolEventMeta) => void;
     onToolInputDelta?: (toolName: string, partialJson: string, meta?: KodaXToolEventMeta) => void;
     onStreamEnd?: (meta?: KodaXActivityEventMeta) => void;
     /** Fired once when a child-agent run fully leaves the child executor. */
@@ -2035,12 +2065,17 @@ interface KodaXEvents {
     /** Semantic memory review plan produced from explicit user feedback. */
     onMemoryReview?: (plan: MemoryReviewPlan) => void;
     onMemoryNotice?: (notice: {
+        readonly sessionId?: string;
         readonly episodeId: string;
         readonly summaries: readonly string[];
         readonly proposalIds: readonly string[];
     }) => void;
-    onMemoryOutcomeDigest?: (digest: KodaXMemoryOutcomeDigest) => void;
+    onMemoryOutcomeDigest?: (digest: KodaXMemoryOutcomeDigest, metadata?: {
+        readonly jobId?: string;
+    }) => void;
     onMemoryReviewReceipt?: (receipt: {
+        readonly sessionId?: string;
+        readonly jobId?: string;
         readonly reviewKey: string;
         readonly proposalIds: readonly string[];
         readonly completedAt: string;
@@ -2093,7 +2128,10 @@ interface KodaXSessionOptions {
      * NOT also snapshot the session: `saveSessionSnapshot` early-returns so
      * the runner's flat full-rewrite `storage.save` can never race / clobber
      * the host's richer incremental writes (which regressed `activeEntryId`
-     * to the first round on resume).
+     * to the first round on resume). Context-silent protocol facts may use the
+     * host's optional atomic `storage.mutateLineage`; this never writes a stale
+     * full session snapshot. A host using F263 durable Memory review facts must
+     * provide that capability; those writes fail closed when it is absent.
      *
      * `storage` is still consulted for LOAD (resume / `resolveInitialMessages`
      * tier 2). When absent (print CLI, ACP, SDK headless), the runner remains
@@ -2729,7 +2767,35 @@ interface KodaXShellExecutionContract {
     };
     readonly probeTimeoutMs?: number;
 }
+interface KodaXShellSandboxPrepareInput {
+    readonly toolCallId?: string;
+    readonly toolInput: Readonly<Record<string, unknown>>;
+    readonly command: string;
+    readonly executable?: string;
+    readonly args?: readonly string[];
+    readonly cwd: string;
+    readonly env: NodeJS.ProcessEnv;
+    readonly windowsVerbatimArguments?: boolean;
+    /** Caller cancellation while waiting for sandbox admission/preparation. */
+    readonly signal?: AbortSignal;
+    /** Absolute wall-clock deadline shared with the command timeout. */
+    readonly deadlineAt?: number;
+    readonly reportObservation?: (observation: KodaXShellSandboxObservation) => void;
+}
+interface KodaXPreparedShellSandboxInvocation {
+    readonly executable: string;
+    readonly args: readonly string[];
+    readonly env: NodeJS.ProcessEnv;
+    readonly windowsVerbatimArguments?: boolean;
+    cleanup(): Promise<KodaXShellSandboxObservation | undefined>;
+}
+/** Runtime-owned OS sandbox broker for selected concrete shell calls. */
+interface KodaXShellSandbox {
+    prepare(input: KodaXShellSandboxPrepareInput): Promise<KodaXPreparedShellSandboxInvocation | undefined>;
+}
 interface KodaXContextOptions {
+    /** Runtime-owner config home used by Memory, review inbox, and Learned Area routing. */
+    configHome?: string;
     /** Runtime-internal shared work ledger inherited by every descendant Agent run. */
     managedWorkBudget?: KodaXManagedWorkBudget;
     /** FEATURE_260 runtime-owned identity used for scoped memory reads. */
@@ -2787,6 +2853,8 @@ interface KodaXContextOptions {
     executionCwd?: string;
     /** Optional host-owned shell/environment resolution policy for command tools. */
     shellExecution?: KodaXShellExecutionContract;
+    /** Runtime-owned OS sandbox broker; never accepted from serialized model input. */
+    shellSandbox?: KodaXShellSandbox;
     /** Fail-closed host policy applied to every concrete file a read tool opens. */
     assertReadablePath?: (candidate: string) => void;
     /**
@@ -2827,6 +2895,30 @@ interface KodaXContextOptions {
     skillsPrompt?: string;
     /** Optional run-scoped registry used to pin and restrict Skill invocation. */
     skillRegistry?: ISkillRegistry;
+    /** Runtime-owned complete formal-name inventory used to prevent learned Skill shadowing. */
+    protectedFormalSkillNames?: readonly string[];
+    /**
+     * Opaque root-run binding used to correlate learned Skill usage with the
+     * exact Memory episode produced by that run.
+     *
+     * @internal
+     */
+    learnedSkillBindingId?: string;
+    /** Runtime-owner admission for exact learned Skill revisions. */
+    admitLearnedSkillInvocation?: (input: {
+        readonly sessionId: string;
+        readonly capabilityId: string;
+        readonly revision: number;
+        readonly fingerprint: string;
+    }) => Promise<{
+        readonly invocationId: string;
+    }>;
+    /** Runtime-owner outcome correlation for learned Skill canaries. */
+    completeLearnedSkillOutcomes?: (input: {
+        readonly sessionId: string;
+        readonly outcome: 'verified_success' | 'credible_negative' | 'inconclusive';
+        readonly evidenceRefs: readonly string[];
+    }) => Promise<void>;
     /** Remote-runtime broker for explicitly admitted, OS-sandboxed Skill scripts. */
     skillScriptRunner?: KodaXSkillScriptRunner;
     rawUserInput?: string;
@@ -3020,6 +3112,8 @@ interface KodaXOptions {
     context?: KodaXContextOptions;
     events?: KodaXEvents;
     memoryReviewer?: MemoryReviewRunner;
+    /** One-call F263 reviewer. When present it replaces the memory-only reviewer for episode jobs. */
+    learningReviewer?: UnifiedLearningReviewRunner;
     /** Optional host-owned semantic selector for sparse governed memory interventions. */
     memoryRecallRunner?: MemoryRecallRunner;
     extensionRuntime?: ExtensionRuntimeContract;
@@ -3387,6 +3481,24 @@ interface KodaXToolExecutionContext {
         readonly content: string;
         readonly evidenceRefs: readonly string[];
     } | undefined>;
+    /**
+     * Root-session-only submission channel for explicit user Memory intent.
+     * The host validates an exact current-user quote and captures one intent for
+     * end-of-episode governed submission; this callback never creates a durable
+     * review job or writes Memory directly.
+     */
+    memoryIntent?: (input: {
+        readonly operation: 'remember' | 'correct';
+        readonly statement: string;
+        readonly userQuote: string;
+    }) => Promise<{
+        readonly status: 'captured';
+        readonly operation: 'remember' | 'correct';
+        readonly evidenceRef: string;
+    } | {
+        readonly status: 'rejected';
+        readonly reason: string;
+    }>;
     /** Exact persisted history loader for the current root or isolated worker Session. */
     loadSessionHistory?: () => Promise<KodaXSessionLineage | null>;
     /** Git root directory - Git 鏍圭洰褰?*/
@@ -3427,12 +3539,18 @@ interface KodaXToolExecutionContext {
     skillDynamicContext?: KodaXSkillDynamicContextPolicy;
     /** Runtime-bound Skill registry; avoids process-global cross-session drift. */
     skillRegistry?: ISkillRegistry;
+    /** Runtime-owner admission for exact learned Skill revisions. */
+    admitLearnedSkillInvocation?: KodaXContextOptions['admitLearnedSkillInvocation'];
     /** Present only when the host admitted exact Skill scripts for this run. */
     skillScriptRunner?: KodaXSkillScriptRunner;
     /** Working directory used to resolve relative paths and execute shell commands. */
     executionCwd?: string;
     /** Validated shell execution policy inherited by native child runtimes. */
     shellExecution?: KodaXShellExecutionContract;
+    /** Runtime-owned OS sandbox broker for selected concrete shell calls. */
+    shellSandbox?: KodaXShellSandbox;
+    /** Structured containment metadata; never model-visible or persisted as conversation text. */
+    reportToolSandboxObservation?: (observation: KodaXShellSandboxObservation) => void;
     /**
      * Exact credential variable names owned by registered Providers.
      * Used only to remove non-standard `apiKeyEnv` names from child processes.
@@ -3881,5 +3999,5 @@ interface CreateBashPrefixExtractorOptions {
  */
 declare function createBashPrefixExtractor(opts: CreateBashPrefixExtractorOptions): BashPrefixExtractor;
 
-export { ALWAYS_RESIDENT_TOOL_NAMES as A, BASH_POLICY_SPEC as B, LSP_SERVERS as aW, LspService as aY, buildGoalRuntimeBinding as bC, consumeCompactionCooldown as bD, createBashPrefixExtractor as bE, createCompactionAntiThrashState as bF, createExternalActorTurnExecutor as bG, createLocalCodingActorControl as bH, createRuntimeContextBudgetSnapshot as bI, decideWorkflowInvocation as bJ, drainPendingSwaps as bK, estimateToolSchemaTokens as bL, extractCommandPrefix as bM, getDefaultLspService as bN, hasExplicitNaturalLanguageWorkflowIntent as bO, hasPendingSwap as bP, makeDisabledGoalToolsContext as bQ, normalizeKodaXAgentMode as bR, planToolExposure as bS, providerResilienceConfigFromTimeouts as bT, recordCompactionSavings as bU, resolveConstructedAgent as bV, shouldSkipLlmCompaction as bW, shutdownDefaultLspService as bX, withGoalBeforeNextTurn as bY, withGoalStopHook as bZ, workflowStartOutcomeConsumesTurn as b_, CodingActorSession as d };
-export type { KodaXManualTopicInput as $, CapabilityRuntimeContract as C, DiagnosticsRequest as D, ExtensionRuntimeContract as E, FailureStage as F, GoalBlockedResult as G, KodaXChildContextBundle as H, KodaXChildExecutionResult as I, KodaXCompactionOverride as J, KodaXActivityEventMeta as K, KodaXContextCompactionFinishedEvent as L, KodaXContextIdentity as M, KodaXContextOptions as N, KodaXContextTokenSnapshot as O, KodaXEffectiveTaskConfig as P, KodaXEvents as Q, KodaXLiveEventMeta as R, KodaXManagedBudgetSnapshot as S, KodaXManagedProtocolPayload as T, KodaXManagedTask as U, KodaXManagedTaskRuntimeState as V, KodaXManagedTaskStatusEvent as W, KodaXManualIndexTopic as X, KodaXManualSource as Y, KodaXManualTopic as Z, KodaXManualTopicId as _, BashPrefixExtractor as a, ProviderRecoveryEvent as a$, KodaXMemoryStrategy as a0, KodaXOptions as a1, KodaXOrchestrationVerdict as a2, KodaXParentReductionContract as a3, KodaXPromptCacheDiagnosticEvent as a4, KodaXProviderPolicyHints as a5, KodaXRepoIntelligenceCapability as a6, KodaXRepoIntelligenceMode as a7, KodaXRepoIntelligenceResolvedMode as a8, KodaXRepoIntelligenceTrace as a9, KodaXTaskRole as aA, KodaXTaskRoleAssignment as aB, KodaXTaskStatus as aC, KodaXTaskSurface as aD, KodaXTaskToolPolicy as aE, KodaXTaskVerificationContract as aF, KodaXTaskVerificationCriterion as aG, KodaXTaskWorkItem as aH, KodaXTimeoutConfig as aI, KodaXToolEventMeta as aJ, KodaXToolExecutionContext as aK, KodaXToolVisibilityMeta as aL, KodaXToolVisibilityPolicy as aM, KodaXTurnCompletedEvent as aN, KodaXTurnDeliveryKind as aO, KodaXTurnFailedEvent as aP, KodaXTurnStartedEvent as aQ, KodaXVerificationScorecard as aR, KodaXVerificationScorecardCriterion as aS, KodaXWorkflowAgentDigestEvent as aT, KodaXWorkflowEventMeta as aU, KodaXWorkflowTimeoutConfig as aV, LspServerInfo as aX, LspServiceConfig as aZ, ProviderExecutionState as a_, KodaXRepoIntelligenceTraceEvent as aa, KodaXRepoRoutingSignals as ab, KodaXResult as ac, KodaXRoleRoundSummary as ad, KodaXRuntimeVerificationContract as ae, KodaXSelfManualConfig as af, KodaXSessionControl as ag, KodaXSessionMutators as ah, KodaXSessionOptions as ai, KodaXShellExecutionContract as aj, KodaXShellKind as ak, KodaXShellProfileMode as al, KodaXSidecarMessageEvent as am, KodaXSkillDynamicContextPolicy as an, KodaXSkillInvocationContext as ao, KodaXSkillMap as ap, KodaXSkillProjectionConfidence as aq, KodaXSkillScriptInputFile as ar, KodaXSkillScriptOutputFile as as, KodaXSkillScriptRunInput as at, KodaXSkillScriptRunner as au, KodaXTaskCapabilityHint as av, KodaXTaskContract as aw, KodaXTaskEvidenceArtifact as ax, KodaXTaskEvidenceBundle as ay, KodaXTaskEvidenceEntry as az, BashPrefixResult as b, ProviderResilienceConfig as b0, ProviderResiliencePolicy as b1, RecoveryAction as b2, RecoveryDecision as b3, RecoveryLadderStep as b4, RecoveryResult as b5, ResilienceClassification as b6, ResilienceErrorClass as b7, ResolveKodaXManualInput as b8, ResolveKodaXManualOptions as b9, WorkflowToolHostResult as bA, WorkflowToolHostStartResult as bB, ResolveKodaXManualResult as ba, RuntimeCompactionSkippedEvent as bb, RuntimeContextBudgetBreakdown as bc, RuntimeContextBudgetRecommendation as bd, RuntimeContextBudgetSnapshot as be, RuntimeContextBudgetSnapshotInput as bf, RuntimeContextOptimizationProfile as bg, RuntimeContextPressure as bh, RuntimeDefaultsSnapshot as bi, RuntimeToolExposureDecision as bj, RuntimeToolExposureMode as bk, RuntimeToolExposurePlan as bl, RuntimeToolExposurePlanInput as bm, RuntimeToolExposureReason as bn, TodoItem as bo, TodoList as bp, TodoStatus as bq, ToolSideEffect as br, WorkflowHostPolicy as bs, WorkflowInvocationAction as bt, WorkflowInvocationPolicyDecision as bu, WorkflowInvocationPolicyInput as bv, WorkflowInvocationSource as bw, WorkflowStartOutcome as bx, WorkflowToolHost as by, WorkflowToolHostInlineInput as bz, BoundExtensionRuntimeController as c, CodingActorSessionOptions as e, CompactionAntiThrashConfig as f, CompactionAntiThrashState as g, CompactionSavingsDecision as h, CompactionSavingsSample as i, CompactionSkipReason as j, CreateBashPrefixExtractorOptions as k, ExtractCommandPrefixOptions as l, GoalCompleteResult as m, GoalCreateInput as n, GoalLifecycleContext as o, GoalRuntimeBinding as p, GoalRuntimeBindingDeps as q, GoalToolsContext as r, KodaXActorHost as s, KodaXAgentMode as t, KodaXAgentProfile as u, KodaXAgentScope as v, KodaXBudgetDisclosureZone as w, KodaXBudgetExtensionRequest as x, KodaXCanonicalAgentMode as y, KodaXChildAgentResult as z };
+export { ALWAYS_RESIDENT_TOOL_NAMES as A, BASH_POLICY_SPEC as B, resolveConstructedAgent as b$, LSP_SERVERS as b0, LspService as b2, buildGoalRuntimeBinding as bI, consumeCompactionCooldown as bJ, createBashPrefixExtractor as bK, createCompactionAntiThrashState as bL, createExternalActorTurnExecutor as bM, createLocalCodingActorControl as bN, createRuntimeContextBudgetSnapshot as bO, decideWorkflowInvocation as bP, drainPendingSwaps as bQ, estimateToolSchemaTokens as bR, extractCommandPrefix as bS, getDefaultLspService as bT, hasExplicitNaturalLanguageWorkflowIntent as bU, hasPendingSwap as bV, makeDisabledGoalToolsContext as bW, normalizeKodaXAgentMode as bX, planToolExposure as bY, providerResilienceConfigFromTimeouts as bZ, recordCompactionSavings as b_, shouldSkipLlmCompaction as c0, shutdownDefaultLspService as c1, withGoalBeforeNextTurn as c2, withGoalStopHook as c3, workflowStartOutcomeConsumesTurn as c4, CodingActorSession as d };
+export type { KodaXManualTopicInput as $, CapabilityRuntimeContract as C, DiagnosticsRequest as D, ExtensionRuntimeContract as E, FailureStage as F, GoalBlockedResult as G, KodaXChildContextBundle as H, KodaXChildExecutionResult as I, KodaXCompactionOverride as J, KodaXActivityEventMeta as K, KodaXContextCompactionFinishedEvent as L, KodaXContextIdentity as M, KodaXContextOptions as N, KodaXContextTokenSnapshot as O, KodaXEffectiveTaskConfig as P, KodaXEvents as Q, KodaXLiveEventMeta as R, KodaXManagedBudgetSnapshot as S, KodaXManagedProtocolPayload as T, KodaXManagedTask as U, KodaXManagedTaskRuntimeState as V, KodaXManagedTaskStatusEvent as W, KodaXManualIndexTopic as X, KodaXManualSource as Y, KodaXManualTopic as Z, KodaXManualTopicId as _, BashPrefixExtractor as a, KodaXWorkflowTimeoutConfig as a$, KodaXMemoryStrategy as a0, KodaXOptions as a1, KodaXOrchestrationVerdict as a2, KodaXParentReductionContract as a3, KodaXPreparedShellSandboxInvocation as a4, KodaXPromptCacheDiagnosticEvent as a5, KodaXProviderPolicyHints as a6, KodaXRepoIntelligenceCapability as a7, KodaXRepoIntelligenceMode as a8, KodaXRepoIntelligenceResolvedMode as a9, KodaXTaskCapabilityHint as aA, KodaXTaskContract as aB, KodaXTaskEvidenceArtifact as aC, KodaXTaskEvidenceBundle as aD, KodaXTaskEvidenceEntry as aE, KodaXTaskRole as aF, KodaXTaskRoleAssignment as aG, KodaXTaskStatus as aH, KodaXTaskSurface as aI, KodaXTaskToolPolicy as aJ, KodaXTaskVerificationContract as aK, KodaXTaskVerificationCriterion as aL, KodaXTaskWorkItem as aM, KodaXTimeoutConfig as aN, KodaXToolEventMeta as aO, KodaXToolExecutionContext as aP, KodaXToolSandboxObservationUpdate as aQ, KodaXToolVisibilityMeta as aR, KodaXToolVisibilityPolicy as aS, KodaXTurnCompletedEvent as aT, KodaXTurnDeliveryKind as aU, KodaXTurnFailedEvent as aV, KodaXTurnStartedEvent as aW, KodaXVerificationScorecard as aX, KodaXVerificationScorecardCriterion as aY, KodaXWorkflowAgentDigestEvent as aZ, KodaXWorkflowEventMeta as a_, KodaXRepoIntelligenceTrace as aa, KodaXRepoIntelligenceTraceEvent as ab, KodaXRepoRoutingSignals as ac, KodaXResult as ad, KodaXRoleRoundSummary as ae, KodaXRuntimeVerificationContract as af, KodaXSelfManualConfig as ag, KodaXSessionControl as ah, KodaXSessionMutators as ai, KodaXSessionOptions as aj, KodaXShellExecutionContract as ak, KodaXShellKind as al, KodaXShellProfileMode as am, KodaXShellSandbox as an, KodaXShellSandboxBackend as ao, KodaXShellSandboxObservation as ap, KodaXShellSandboxPrepareInput as aq, KodaXSidecarMessageEvent as ar, KodaXSkillDynamicContextPolicy as as, KodaXSkillInvocationContext as at, KodaXSkillMap as au, KodaXSkillProjectionConfidence as av, KodaXSkillScriptInputFile as aw, KodaXSkillScriptOutputFile as ax, KodaXSkillScriptRunInput as ay, KodaXSkillScriptRunner as az, BashPrefixResult as b, LspServerInfo as b1, LspServiceConfig as b3, ProviderExecutionState as b4, ProviderRecoveryEvent as b5, ProviderResilienceConfig as b6, ProviderResiliencePolicy as b7, RecoveryAction as b8, RecoveryDecision as b9, WorkflowInvocationPolicyDecision as bA, WorkflowInvocationPolicyInput as bB, WorkflowInvocationSource as bC, WorkflowStartOutcome as bD, WorkflowToolHost as bE, WorkflowToolHostInlineInput as bF, WorkflowToolHostResult as bG, WorkflowToolHostStartResult as bH, RecoveryLadderStep as ba, RecoveryResult as bb, ResilienceClassification as bc, ResilienceErrorClass as bd, ResolveKodaXManualInput as be, ResolveKodaXManualOptions as bf, ResolveKodaXManualResult as bg, RuntimeCompactionSkippedEvent as bh, RuntimeContextBudgetBreakdown as bi, RuntimeContextBudgetRecommendation as bj, RuntimeContextBudgetSnapshot as bk, RuntimeContextBudgetSnapshotInput as bl, RuntimeContextOptimizationProfile as bm, RuntimeContextPressure as bn, RuntimeDefaultsSnapshot as bo, RuntimeToolExposureDecision as bp, RuntimeToolExposureMode as bq, RuntimeToolExposurePlan as br, RuntimeToolExposurePlanInput as bs, RuntimeToolExposureReason as bt, TodoItem as bu, TodoList as bv, TodoStatus as bw, ToolSideEffect as bx, WorkflowHostPolicy as by, WorkflowInvocationAction as bz, BoundExtensionRuntimeController as c, CodingActorSessionOptions as e, CompactionAntiThrashConfig as f, CompactionAntiThrashState as g, CompactionSavingsDecision as h, CompactionSavingsSample as i, CompactionSkipReason as j, CreateBashPrefixExtractorOptions as k, ExtractCommandPrefixOptions as l, GoalCompleteResult as m, GoalCreateInput as n, GoalLifecycleContext as o, GoalRuntimeBinding as p, GoalRuntimeBindingDeps as q, GoalToolsContext as r, KodaXActorHost as s, KodaXAgentMode as t, KodaXAgentProfile as u, KodaXAgentScope as v, KodaXBudgetDisclosureZone as w, KodaXBudgetExtensionRequest as x, KodaXCanonicalAgentMode as y, KodaXChildAgentResult as z };

package/dist/types-chunks/{capsule.d-CxCm1KZz.d.ts → capsule.d-BlSv9l3V.d.ts}

@@ -1,5 +1,5 @@
 import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
-import { a8 as AgentMessage, de as SessionEntry, dc as Session, dg as SessionExtension, bM as KodaXSessionLineage, by as KodaXJsonValue, aP as CompactionDetails, bl as KodaXCompactMemorySeed, bI as KodaXSessionEntry, bW as KodaXSessionTreeNode, bL as KodaXSessionLabelEntry, bK as KodaXSessionGoalEntry, bF as KodaXSessionClientNoticeEntry, bS as KodaXSessionRewindMarkerEntry, bN as KodaXSessionMemoryOutcomeDigestEntry, bO as KodaXSessionMemoryReviewReceiptEntry, bR as KodaXSessionNavigationOptions, bD as KodaXSessionArtifactLedgerEntry, b9 as FileOperations, dV as WorkflowMeta, dW as WorkflowModelHint, dX as WorkflowModule } from './types.d-RdWRfUEs.js';
+import { ab as AgentMessage, d$ as SessionEntry, dZ as Session, e1 as SessionExtension, bU as KodaXSessionLineage, bF as KodaXJsonValue, aT as CompactionDetails, bs as KodaXCompactMemorySeed, bQ as KodaXSessionEntry, c2 as KodaXSessionTreeNode, bT as KodaXSessionLabelEntry, bS as KodaXSessionGoalEntry, bN as KodaXSessionClientNoticeEntry, b_ as KodaXSessionRewindMarkerEntry, bV as KodaXSessionMemoryOutcomeDigestEntry, bW as KodaXSessionMemoryReviewReceiptEntry, bZ as KodaXSessionNavigationOptions, bL as KodaXSessionArtifactLedgerEntry, bg as FileOperations, eJ as WorkflowMeta, eK as WorkflowModelHint, eL as WorkflowModule } from './types.d-BA-Jwpfs.js';
 
 /**
  * @kodax-ai/agent Constants

package/dist/types-chunks/{guardrail.d-CJx9RRd3.d.ts → guardrail.d-BRE_ErEj.d.ts}

@@ -1,4 +1,4 @@
-import { bb as Guardrail, d6 as RunnerToolCall, f as Agent, a8 as AgentMessage, d9 as RunnerToolResult, dk as Span } from './types.d-RdWRfUEs.js';
+import { bi as Guardrail, dT as RunnerToolCall, f as Agent, ab as AgentMessage, dW as RunnerToolResult, e5 as Span } from './types.d-BA-Jwpfs.js';
 
 /**
  * Guardrail Runtime — FEATURE_085 (v0.7.26).

package/dist/types-chunks/{guardrail.d-B0PwAZVR.d.ts → guardrail.d-CXDYRgZ3.d.ts}

@@ -1,8 +1,10 @@
 import { b as McpServersConfig, M as McpConnectMode, a as McpServerConfig, c as McpTransportKind } from './config.d-CJy1WENT.js';
 import { K as KodaXBaseProvider } from './base.d-4e74xDdy.js';
 import { a as CostTracker } from './cost-tracker.d-BeaenODW.js';
-import { d6 as RunnerToolCall } from './types.d-RdWRfUEs.js';
-import { d as ToolGuardrail } from './guardrail.d-CJx9RRd3.js';
+import { dT as RunnerToolCall } from './types.d-BA-Jwpfs.js';
+import { d as ToolGuardrail } from './guardrail.d-BRE_ErEj.js';
+import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
+import { S as SideQueryDiagnostics } from './side-query.d-DTuLPcC5.js';
 
 /**
  * FEATURE_200 Phase F (v0.7.45) — MCP domain types extracted from types.ts.
@@ -241,6 +243,157 @@ interface SignalCollector {
  */
 declare function collectAllSignals(call: RunnerToolCall, projectRoot: string, collectors: readonly SignalCollector[], executionCwd?: string): readonly ToolCallSignal[];
 
+interface PermissionIntentEvidence {
+    readonly status: 'complete' | 'targeted' | 'missing';
+    /** Latest genuine user request, kept separate as the authoritative intent. */
+    readonly currentUserContent?: string;
+    readonly currentUserContentTruncated?: boolean;
+    readonly content: string;
+    readonly sourceBytes: number;
+    readonly includedBytes: number;
+    readonly omittedBytes: number;
+    readonly sha256: string;
+}
+
+/**
+ * Classifier Projection Helpers — FEATURE_092 (v0.7.33)
+ *
+ * Typed tools implement `toClassifierInput(input): string` to project their
+ * input into a compact action the auto-mode classifier evaluates. Runtime
+ * registration supplies a fail-closed semantic fallback for legacy JavaScript,
+ * extension, and constructed tools that lack a trusted projector.
+ *
+ * ============== EXAMPLES BY CATEGORY ==============
+ *
+ *   --- FILE OPERATIONS (path + size, never raw contents) ---
+ *     write.ts:        (i) => `Write ${i.path} (${i.content.length} bytes)`
+ *     edit.ts:         (i) => `Edit ${i.path} [${describeEdit(i)}]`
+ *     multi-edit:      (i) => `MultiEdit ${i.path}: ${i.edits.length} edits`
+ *
+ *   --- SHELL / EXEC (command verbatim, ignore noise fields) ---
+ *     bash.ts:         (i) => `Bash: ${i.command}`
+ *
+ *   --- NETWORK (URL is THE risk surface) ---
+ *     web_fetch:       (i) => `WebFetch ${i.url}`
+ *
+ *   --- CHILD AGENT SPAWN (routing + execution controls) ---
+ *     spawn_agent:     objective size + scope/read_only/isolation/provider/model
+ *
+ *   --- MCP CALLS (semantic fields + shape-only unknowns) ---
+ *     mcp_call:        (i) => mcpToClassifierInput(i.server, i.tool, i.input)
+ *
+ *   --- READ-ONLY (Tier 1 — fully skipped) ---
+ *     read.ts:         () => ''
+ *     grep.ts:         () => ''
+ *     glob.ts:         () => ''
+ *
+ *   --- UNKNOWN / CONSTRUCTED (semantic fail-closed fallback) ---
+ *     extension:       (i) => safeFallbackToClassifierInput(name, i)
+ *
+ * ============== ANTI-PATTERNS ==============
+ *
+ *   ❌ JSON.stringify(input) as default
+ *      → leaks raw content; hard for LLM to scan
+ *
+ *   ❌ Returning input.description / input.rationale verbatim
+ *      → these are LLM-emitted, manipulable; classifier should see facts
+ *
+ *   ❌ Including raw file contents in Write/Edit projections
+ *      → privacy + token cost; use bytes/line count as proxy
+ *
+ *   ❌ Returning '' for a high-risk tool to "skip the classifier"
+ *      → defeats Tier 1's "safe-only" semantics
+ *
+ *   ❌ Truncating without indicating it ('foo' instead of 'foo…')
+ *      → classifier may make decisions on false-complete information
+ */
+type ClassifierToolProjectionResolver = (toolName: string) => ((input: unknown) => string) | undefined;
+
+/**
+ * Auto-Mode Classifier Orchestrator — FEATURE_092 Phase 2b.3 (v0.7.33).
+ *
+ * Wires the classifier prompt + sideQuery + output parser into a single
+ * `classify(...)` call. Caller supplies the rules, transcript, and the
+ * tool-call action being classified; gets back a `ClassifyDecision`.
+ *
+ * Failure → decision mapping:
+ *
+ *   sideQuery.stopReason   parsedOutput   → ClassifyDecision
+ *   ───────────────────────────────────────────────────────
+ *   end_turn / max_tokens  block          → confirm (with reason)
+ *   end_turn / max_tokens  allow          → allow
+ *   end_turn / max_tokens  unparseable    → retry, then failure
+ *   end_turn / max_tokens  + tool_use     → retry, then failure
+ *                          (sideQuery returns stopReason='error' here)
+ *   timeout                —              → retry, then failure
+ *   aborted                —              → throw AbortError to caller
+ *   error                  —              → retry, then failure
+ *
+ * Every non-abort failure receives one immediate retry. The caller applies
+ * its configured safety fallback after the second failure; a valid model
+ * concern always means "ask the user", never a direct hard block.
+ */
+
+interface ClassifyOptions {
+    readonly provider: KodaXBaseProvider;
+    readonly model: string;
+    readonly rules: AutoRules;
+    readonly claudeMd?: string;
+    readonly transcript: readonly KodaXMessage[];
+    readonly action: string;
+    readonly intentEvidence?: PermissionIntentEvidence;
+    /** Resolve canonical per-tool projections for safe historical context. */
+    readonly getToolProjection?: ClassifierToolProjectionResolver;
+    /**
+     * FEATURE_158 (v0.7.39): static-analysis signals forwarded to the
+     * classifier prompt. Empty / undefined preserves the FEATURE_092 prompt
+     * shape (no `<signals>` block emitted). When supplied, the classifier
+     * sees signals between `<transcript>` and `<action>` as informational
+     * input — not verdicts.
+     */
+    readonly signals?: readonly ToolCallSignal[];
+    readonly timeoutMs?: number;
+    readonly abortSignal?: AbortSignal;
+    readonly costTracker?: CostTracker;
+    /**
+     * Optional setter — invoked once after `sideQuery` returns when the
+     * classifier successfully recorded its token usage. The CostTracker is
+     * immutable, so `sideQuery` produces a fresh tracker copy with the new
+     * record; without this setter the recorded call is silently dropped.
+     * Wired by the AutoModeToolGuardrail so the agent's tracker accumulates
+     * classifier calls under role='auto_mode'.
+     */
+    readonly setCostTracker?: (next: CostTracker) => void;
+}
+type ClassifierFailureKind = 'timeout' | 'provider_error' | 'contract_error' | 'input_budget';
+type ClassifierAttemptOutcome = 'allow' | 'confirm' | ClassifierFailureKind;
+interface ClassifierAttemptDiagnostics {
+    readonly attempt: number;
+    readonly outcome: ClassifierAttemptOutcome;
+    readonly diagnostics?: SideQueryDiagnostics;
+}
+interface ClassifyDecisionDetails {
+    readonly reason: string;
+    /** Structured request metadata only; never includes prompt or response text. */
+    readonly diagnostics?: SideQueryDiagnostics;
+    readonly attempts: readonly ClassifierAttemptDiagnostics[];
+}
+type ClassifyDecision = ({
+    readonly kind: 'allow';
+} & ClassifyDecisionDetails) | ({
+    readonly kind: 'confirm';
+} & ClassifyDecisionDetails) | ({
+    readonly kind: 'failure';
+    readonly failureKind: ClassifierFailureKind;
+} & ClassifyDecisionDetails);
+/**
+ * The deadline includes connection setup, provider-side queueing, inference,
+ * and any Retry-After/backoff handled by the provider adapter. Keep it bounded
+ * so infrastructure failure degrades to an explicit user decision.
+ */
+declare const DEFAULT_CLASSIFIER_TIMEOUT_MS = 20000;
+declare function classify(opts: ClassifyOptions): Promise<ClassifyDecision>;
+
 /**
  * Denial Tracker — FEATURE_092 Phase 2b.4 (v0.7.33).
  *
@@ -365,18 +518,19 @@ declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, ex
  *
  * Decision flow (per design doc "三层权限金字塔"):
  *
- *   1. Tier-0 deterministic deny             → block
- *   2. Tool projection is '' (Tier 1)        → allow (zero token cost)
- *   3. Engine is rules → deterministic Tier 2, otherwise user confirms
- *   4. denial/circuit threshold              → engine downgrade, then escalate
- *   5. classify(...) sideQuery
- *        allow                               → allow (record allow → reset consecutive)
- *        block                               → block + reason (record block)
- *        escalate                            → escalate + reason (record error)
- *        AbortError thrown                   → re-throw (propagate user cancel)
+ *   1. Tier-0 deterministic critical match   → user confirmation
+ *   2. exact safe read/workspace-temp effect → allow (zero token cost)
+ *   3. Tool projection is '' (Tier 1)        → allow
+ *   4. Engine is rules → deterministic Tier 2, otherwise user confirms
+ *   5. degraded classifier infrastructure    → Accept-edits fallback
+ *   6. classify(...) sideQuery
+ *        allow                                → allow (record allow → reset consecutive)
+ *        confirm                              → user confirmation (record concern)
+ *        failure                              → Accept-edits fallback (record error)
+ *        AbortError thrown                    → re-throw (propagate user cancel)
  *
  * State (mutable, session-scoped):
- *   - engine: 'llm' | 'rules' (starts at 'llm', downgrades on threshold)
+ *   - engine: 'llm' | 'rules' (user-selected; classifier health never changes it)
  *   - denialTracker (immutable type, swapped on each event)
  *   - circuitBreaker (immutable type, swapped on each event)
  *
@@ -402,15 +556,20 @@ interface AutoModeSharedState {
  * User answer for an escalated tool-call. The guardrail translates this into
  * the actual `GuardrailVerdict` returned to the Runner. `'block'` preserves
  * the original escalation reason as the verdict reason so downstream consumers
- * see why the tool was blocked.
+ * see why the tool was blocked. `'timeout'` reports that the action was not
+ * executed and gives the main model a bounded recovery instruction.
  */
-type AutoModeAskUserVerdict = 'allow' | 'block';
+type AutoModeAskUserVerdict = 'allow' | 'block' | 'timeout';
+interface AutoModeDecisionDiagnostics {
+    readonly source: 'classifier_confirm' | 'classifier_failure' | 'classifier_circuit_breaker' | 'configuration';
+    readonly classifierFailureKind?: ClassifierFailureKind;
+    readonly classifierAttempts?: readonly ClassifierAttemptDiagnostics[];
+}
 /**
- * Optional REPL-supplied prompt callback for the 6 escalate paths in
- * `beforeTool` (engine-downgraded, denial-threshold-just-crossed,
- * breaker-just-tripped, classifier-error, classifier-decision-escalate,
- * provider-not-configured). When supplied, the guardrail calls this and
- * translates the user's answer into `'allow'` or `'block'`. When NOT
+ * Optional REPL-supplied prompt callback for calls that require a human
+ * decision (rules escalation, classifier concern/failure, or configuration
+ * failure). When supplied, the guardrail calls this and
+ * translates the user's answer into allow/block/timeout semantics. When NOT
  * supplied, the guardrail returns `'escalate'` as before — the Runner will
  * then throw `GuardrailEscalateError` (preserves backward compat with
  * SDK-side guardrail consumers that have no askUser surface).
@@ -425,7 +584,7 @@ type AutoModeAskUser = (call: RunnerToolCall, reason: string,
  * keep working. REPL uses these to render Scope/Risk labels on the
  * confirm dialog (replacing the input-marker path from FEATURE_066).
  */
-signals?: readonly ToolCallSignal[]) => Promise<AutoModeAskUserVerdict>;
+signals?: readonly ToolCallSignal[], diagnostics?: AutoModeDecisionDiagnostics) => Promise<AutoModeAskUserVerdict>;
 interface AutoModeRulesContext {
     readonly projectRoot: string;
     readonly executionCwd: string;
@@ -498,6 +657,15 @@ interface AutoModeGuardrailConfig {
      * paths. See `AutoModeAskUser` for semantics.
      */
     readonly askUser?: AutoModeAskUser;
+    /**
+     * Runtime-owned Accept-edits fallback used only when classifier
+     * infrastructure or its response contract fails.
+     */
+    readonly allowOnClassifierFailure?: (call: RunnerToolCall) => boolean | Promise<boolean>;
+    /** Whether ordinary bash calls can be enforced by an OS workspace sandbox. */
+    readonly workspaceShellSandboxAvailable?: boolean;
+    /** Mint one exact bash call for workspace-sandboxed execution. */
+    readonly admitWorkspaceSandboxCall?: (call: RunnerToolCall, review: AutoModePermissionReview) => void;
     /**
      * Runtime-owned deterministic Tier-2 evaluator. It is injected rather than
      * implemented in @kodax/coding because canonical path and shell-AST helpers
@@ -544,12 +712,11 @@ interface AutoModeGuardrailConfig {
      */
     readonly getCostTracker?: () => CostTracker | undefined;
     readonly setCostTracker?: (t: CostTracker) => void;
-    /** Optional logger for engine-downgrade and config warnings. */
+    /** Optional logger for classifier-health and configuration warnings. */
     readonly log?: (level: 'info' | 'warn', msg: string) => void;
     /**
-     * Fired whenever the active engine changes — both on automatic downgrades
-     * (denial threshold / circuit breaker) AND on manual `setEngine(...)`
-     * calls. UI surfaces (status bar engine indicator, slash-command
+     * Fired whenever the active engine changes through `setEngine(...)`.
+     * UI surfaces (status bar engine indicator, slash-command
      * confirmations) subscribe here so the displayed engine stays in sync
      * with the guardrail's internal state without the user having to trigger
      * another mode toggle just to refresh the bar.
@@ -558,8 +725,8 @@ interface AutoModeGuardrailConfig {
     /**
      * Optional shared state for subagent threshold-bypass defense
      * (design doc "防绕阈值"). When supplied, the parent and child
-     * guardrails reference the SAME object — engine downgrades and
-     * tracker advances are visible across the session boundary.
+     * guardrails reference the SAME object — engine changes and tracker
+     * advances are visible across the session boundary.
      */
     readonly sharedState?: AutoModeSharedState;
     /**
@@ -625,8 +792,8 @@ interface AutoModeGuardrailConfig {
      * (late-verdict adoption). The window therefore only controls "fast path
      * vs wait", never "dialog vs no dialog": an `allow` never surfaces a
      * confirm dialog regardless of how long the classifier takes, and only an
-     * `escalate` verdict (explicit LLM escalation, classifier timeout, or infra
-     * error — all mapped to `escalate` by classify()) reaches the user.
+     * confirmation/failure verdict reaches the configured user or Accept-edits
+     * fallback path.
      * The background classifier's cost is settled exactly once inside
      * classify(), so awaiting it after window expiry does not double-count.
      *
@@ -645,6 +812,7 @@ interface AutoModeGuardrailConfig {
  */
 interface AutoModeStats {
     readonly engine: AutoModeEngine;
+    readonly classifierHealth: 'healthy' | 'degraded';
     readonly classifierModel?: string;
     readonly denials: DenialTracker;
     readonly breaker: CircuitBreaker;
@@ -656,19 +824,17 @@ interface AutoModeToolGuardrail extends ToolGuardrail {
     getStats(): AutoModeStats;
     /**
      * Manually set the engine. Used by `/auto-engine` slash command to flip
-     * back to 'llm' after an automatic downgrade or to flip to 'rules' for
-     * manual testing. The downgrade thresholds still operate normally — a
-     * subsequent threshold cross will downgrade again.
+     * between 'llm' and 'rules' after an explicit user or host choice.
      */
     setEngine(engine: AutoModeEngine): void;
     /** Test-only alias for getEngine(). Backward-compat for test files. */
     getEngineForTest(): AutoModeEngine;
     /** Test-only alias for getStats(). Backward-compat for test files. */
     getStatsForTest(): AutoModeStats;
-    /** Test-only override: swap the provider mid-test (for downgrade scenarios). */
+    /** Test-only override: swap the provider mid-test. */
     setProviderForTest(provider: KodaXBaseProvider): void;
 }
 declare function createAutoModeToolGuardrail(config: AutoModeGuardrailConfig): AutoModeToolGuardrail;
 
-export { recordBlock as $, CONSECUTIVE_THRESHOLD as C, ERROR_THRESHOLD as E, checkAbsoluteDeny as I, collectAllSignals as J, computeRulesFingerprint as M, createAutoModeToolGuardrail as N, createCircuitBreaker as O, createDenialTracker as P, formatAgentsForPrompt as Q, getKodaxGlobalDir as U, loadAgentsFiles as V, WINDOW_MS as W, loadAutoRules as X, parseAutoRules as Y, readTrustState as Z, recordAllow as _, recordError as a0, shouldFallback$1 as a1, shouldFallback as a2, trustProjectRules as a3, CUMULATIVE_THRESHOLD as u };
-export type { AbsoluteDenyCheck as A, RulesLoadResult as B, DenialTracker as D, SkippedRulesSource as F, ToolCallSignal as G, TrustState as H, KodaXMcpConnectMode as K, LoadAgentsOptions as L, RulesLoadError as R, SignalCollector as S, TierZeroPatternId as T, AbsoluteDenyMatch as a, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeEngine as h, AutoModeGuardrailConfig as i, AutoModePermissionBoundary as j, AutoModePermissionOperation as k, AutoModePermissionReview as l, AutoModePermissionTarget as m, AutoModeRulesContext as n, AutoModeRulesDecision as o, AutoModeRulesEvaluator as p, AutoModeSharedState as q, AutoModeStats as r, AutoModeToolGuardrail as s, AutoRules as t, CircuitBreaker as v, KodaXMcpServerConfig as w, KodaXMcpServersConfig as x, KodaXMcpTransport as y, LoadedRulesSource as z };
+export { createAutoModeToolGuardrail as $, CONSECUTIVE_THRESHOLD as C, DEFAULT_CLASSIFIER_TIMEOUT_MS as F, ERROR_THRESHOLD as H, WINDOW_MS as W, checkAbsoluteDeny as X, classify as Y, collectAllSignals as Z, computeRulesFingerprint as _, createCircuitBreaker as a0, createDenialTracker as a1, formatAgentsForPrompt as a2, getKodaxGlobalDir as a3, loadAgentsFiles as a4, loadAutoRules as a5, parseAutoRules as a6, readTrustState as a7, recordAllow as a8, recordBlock as a9, recordError as aa, shouldFallback$1 as ab, shouldFallback as ac, trustProjectRules as ad, CUMULATIVE_THRESHOLD as v };
+export type { AbsoluteDenyCheck as A, ClassifierToolProjectionResolver as B, ClassifyDecision as D, ClassifyOptions as E, DenialTracker as G, KodaXMcpServerConfig as I, KodaXMcpServersConfig as J, KodaXMcpConnectMode as K, KodaXMcpTransport as L, LoadAgentsOptions as M, LoadedRulesSource as N, RulesLoadResult as O, PermissionIntentEvidence as P, SkippedRulesSource as Q, RulesLoadError as R, SignalCollector as S, TierZeroPatternId as T, ToolCallSignal as U, TrustState as V, AbsoluteDenyMatch as a, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeEngine as i, AutoModeGuardrailConfig as j, AutoModePermissionBoundary as k, AutoModePermissionOperation as l, AutoModePermissionReview as m, AutoModePermissionTarget as n, AutoModeRulesContext as o, AutoModeRulesDecision as p, AutoModeRulesEvaluator as q, AutoModeSharedState as r, AutoModeStats as s, AutoModeToolGuardrail as t, AutoRules as u, CircuitBreaker as w, ClassifierAttemptDiagnostics as x, ClassifierAttemptOutcome as y, ClassifierFailureKind as z };

package/dist/types-chunks/{history-retrieval.d-B__aEN62.d.ts → history-retrieval.d-DtCy7x64.d.ts}

@@ -1,5 +1,5 @@
 import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
-import { bM as KodaXSessionLineage } from './types.d-RdWRfUEs.js';
+import { bU as KodaXSessionLineage } from './types.d-BA-Jwpfs.js';
 
 type KodaXSessionHistoryScope = 'compacted' | 'all';
 type KodaXSessionHistorySource = 'user' | 'assistant' | 'system' | 'tool' | 'child_task';