@kodax-ai/kodax 0.7.77 → 0.7.79

package/dist/types-chunks/{guardrail.d-B0PwAZVR.d.ts → guardrail.d-1NLSFTyN.d.ts}

@@ -1,8 +1,9 @@
 import { b as McpServersConfig, M as McpConnectMode, a as McpServerConfig, c as McpTransportKind } from './config.d-CJy1WENT.js';
-import { K as KodaXBaseProvider } from './base.d-4e74xDdy.js';
+import { K as KodaXBaseProvider } from './base.d-DxG0m09Z.js';
 import { a as CostTracker } from './cost-tracker.d-BeaenODW.js';
-import { d6 as RunnerToolCall } from './types.d-RdWRfUEs.js';
-import { d as ToolGuardrail } from './guardrail.d-CJx9RRd3.js';
+import { e1 as RunnerToolCall, ey as ToolGuardrail } from './controller.d-RGV7Pjv9.js';
+import { k as KodaXMessage } from './types.d-CgrXrFrq.js';
+import { S as SideQueryDiagnostics } from './side-query.d-CP1LiRiH.js';
 
 /**
  * FEATURE_200 Phase F (v0.7.45) — MCP domain types extracted from types.ts.
@@ -52,6 +53,50 @@ declare function loadAgentsFiles(options?: LoadAgentsOptions): AgentsFile[];
  */
 declare function formatAgentsForPrompt(files: AgentsFile[]): string;
 
+/**
+ * Parse the auto-mode classifier's output — FEATURE_092 Phase 2b.3 (v0.7.33).
+ *
+ * Preferred format:
+ *   <decision>allow|ask</decision><hazard>...</hazard><reason>...</reason>
+ * Legacy `<block>` output remains parseable during the protocol rollout so a
+ * valid decision from an older prompt/provider cache is not misreported as an
+ * infrastructure failure.
+ *
+ * Robustness:
+ *   - case-insensitive yes/no
+ *   - whitespace inside / around tags tolerated
+ *   - one valid decision is authoritative; hazard/reason defects are retained
+ *     as warnings and never become a second decision mechanism
+ *   - reasons longer than 500 chars are truncated (defense against
+ *     pathological model outputs)
+ *   - missing, invalid, duplicate, or mixed decisions remain contract errors;
+ *     surrounding prose and malformed auxiliary fields are diagnostic only
+ */
+type ClassifierDecision = {
+    readonly kind: 'block';
+    readonly reason: string;
+    readonly hazard?: ClassifierHazard;
+    readonly protocol: ClassifierProtocol;
+    readonly warnings?: readonly ClassifierOutputWarningCode[];
+} | {
+    readonly kind: 'allow';
+    readonly reason: string;
+    readonly hazard?: 'none';
+    readonly protocol: ClassifierProtocol;
+    readonly warnings?: readonly ClassifierOutputWarningCode[];
+} | {
+    readonly kind: 'unparseable';
+    readonly raw: string;
+    readonly failureCode: ClassifierParseFailureCode;
+    readonly observedProtocol: ClassifierObservedProtocol;
+};
+type ClassifierProtocol = 'structured_v2' | 'legacy_v1';
+type ClassifierObservedProtocol = ClassifierProtocol | 'unknown';
+type ClassifierParseFailureCode = 'missing_decision' | 'invalid_decision' | 'ambiguous_decision' | 'missing_hazard' | 'invalid_hazard' | 'decision_hazard_conflict' | 'decision_reason_conflict' | 'missing_reason' | 'structured_format_violation' | 'legacy_format_violation';
+type ClassifierOutputWarningCode = Exclude<ClassifierParseFailureCode, 'missing_decision' | 'invalid_decision' | 'ambiguous_decision'>;
+type ClassifierHazard = 'none' | 'protected_read' | 'outside_write' | 'destructive_loss' | 'credential_exposure' | 'network_exfiltration' | 'remote_code_execution' | 'dependency_poisoning' | 'production_change' | 'privilege_change' | 'intent_conflict';
+declare function parseClassifierOutput(raw: string): ClassifierDecision;
+
 /**
  * Auto-Mode Rules Loader — FEATURE_092 Phase 2b.2 (v0.7.33).
  *
@@ -70,11 +115,15 @@ declare function formatAgentsForPrompt(files: AgentsFile[]): string;
  *
  * Schema (each field optional, defaults to []):
  *   {
- *     "allow":       string[],   // patterns the classifier defaults to allowing
- *     "soft_deny":   string[],   // patterns the classifier defaults to blocking
+ *     "allow":       string[],   // contextual examples supporting an allow
+ *     "soft_deny":   string[],   // contextual cautions for the classifier to inspect
  *     "environment": string[]    // background context the classifier sees verbatim
  *   }
  *
+ * These strings are classifier context, never independent verdicts. In
+ * Auto[LLM], even `soft_deny` cannot create an approval class beyond the two
+ * evidence-based ask classes defined by the classifier contract.
+ *
  * Merge: layers concatenated in order (user → project → local). Identical
  * strings deduplicated by stable insertion (later layers win position only
  * when the string is unique per layer).
@@ -134,7 +183,7 @@ declare function loadAutoRules(opts: LoadAutoRulesOptions): Promise<RulesLoadRes
  *
  * Mechanical pattern matches over a tool call. Signals are NOT verdicts;
  * the classifier consumes them as informational input alongside transcript
- * + user rules and produces the final decision (allow / block / escalate).
+ * + user rules and produces the final Auto[LLM] decision (allow / ask).
  *
  * Two invariants the producers must hold:
  *
@@ -148,10 +197,9 @@ declare function loadAutoRules(opts: LoadAutoRulesOptions): Promise<RulesLoadRes
  *      so the classifier can weight signals, but the verdict is not encoded
  *      here.
  *
- * Tier 0 (absolute deny) is a separate module — signals are pre-verdict
- * material consumed by Tier 2 (LLM classifier). The two paths are not
- * coupled: Tier 0 catches a fixed catastrophic-pattern set; signals
- * describe a wider surface for the classifier to reason about.
+ * The historical Tier 0 detector is a separate module, but its matches are
+ * also pre-verdict facts in Auto[LLM]. Only explicit Auto[Rules] treats that
+ * detector as a legacy approval gate.
  *
  * Design ref: ADR-025, FEATURE_158 (docs/features/v0.7.39.md).
  */
@@ -241,11 +289,174 @@ interface SignalCollector {
  */
 declare function collectAllSignals(call: RunnerToolCall, projectRoot: string, collectors: readonly SignalCollector[], executionCwd?: string): readonly ToolCallSignal[];
 
+interface PermissionIntentEvidence {
+    readonly status: 'complete' | 'targeted' | 'missing';
+    /** Latest genuine user request, kept separate as the authoritative intent. */
+    readonly currentUserContent?: string;
+    readonly currentUserContentTruncated?: boolean;
+    /** Runtime-delegated task context; informative, never a replacement for root authority. */
+    readonly delegatedObjective?: string;
+    readonly delegatedObjectiveTruncated?: boolean;
+    readonly bindingConstraints?: readonly string[];
+    readonly scopeHint?: string;
+    readonly readOnly?: boolean;
+    readonly content: string;
+    readonly sourceBytes: number;
+    readonly includedBytes: number;
+    readonly omittedBytes: number;
+    readonly sha256: string;
+}
+
+/**
+ * Classifier Projection Helpers — FEATURE_092 (v0.7.33)
+ *
+ * Typed tools implement `toClassifierInput(input): string` to project their
+ * input into a compact action the auto-mode classifier evaluates. Runtime
+ * registration supplies a fail-closed semantic fallback for legacy JavaScript,
+ * extension, and constructed tools that lack a trusted projector.
+ *
+ * ============== EXAMPLES BY CATEGORY ==============
+ *
+ *   --- FILE OPERATIONS (path + size, never raw contents) ---
+ *     write.ts:        (i) => `Write ${i.path} (${i.content.length} bytes)`
+ *     edit.ts:         (i) => `Edit ${i.path} [${describeEdit(i)}]`
+ *     multi-edit:      (i) => `MultiEdit ${i.path}: ${i.edits.length} edits`
+ *
+ *   --- SHELL / EXEC (command verbatim, ignore noise fields) ---
+ *     bash.ts:         (i) => `Bash: ${i.command}`
+ *
+ *   --- NETWORK (URL is THE risk surface) ---
+ *     web_fetch:       (i) => `WebFetch ${i.url}`
+ *
+ *   --- CHILD AGENT SPAWN (routing + execution controls) ---
+ *     spawn_agent:     objective size + scope/read_only/isolation/provider/model
+ *
+ *   --- MCP CALLS (semantic fields + shape-only unknowns) ---
+ *     mcp_call:        (i) => mcpToClassifierInput(i.server, i.tool, i.input)
+ *
+ *   --- READ-ONLY (Tier 1 — fully skipped) ---
+ *     read.ts:         () => ''
+ *     grep.ts:         () => ''
+ *     glob.ts:         () => ''
+ *
+ *   --- UNKNOWN / CONSTRUCTED (semantic fail-closed fallback) ---
+ *     extension:       (i) => safeFallbackToClassifierInput(name, i)
+ *
+ * ============== ANTI-PATTERNS ==============
+ *
+ *   ❌ JSON.stringify(input) as default
+ *      → leaks raw content; hard for LLM to scan
+ *
+ *   ❌ Returning input.description / input.rationale verbatim
+ *      → these are LLM-emitted, manipulable; classifier should see facts
+ *
+ *   ❌ Including raw file contents in Write/Edit projections
+ *      → privacy + token cost; use bytes/line count as proxy
+ *
+ *   ❌ Returning '' for a high-risk tool to "skip the classifier"
+ *      → defeats Tier 1's "safe-only" semantics
+ *
+ *   ❌ Truncating without indicating it ('foo' instead of 'foo…')
+ *      → classifier may make decisions on false-complete information
+ */
+type ClassifierToolProjectionResolver = (toolName: string) => ((input: unknown) => string) | undefined;
+
+/**
+ * Auto-Mode Classifier Orchestrator — FEATURE_092 Phase 2b.3 (v0.7.33).
+ *
+ * Wires the classifier prompt + sideQuery + output parser into a single
+ * `classify(...)` call. Caller supplies the rules, transcript, and the
+ * tool-call action being classified; gets back a `ClassifyDecision`.
+ *
+ * Failure → decision mapping:
+ *
+ *   sideQuery.stopReason   parsedOutput   → ClassifyDecision
+ *   ───────────────────────────────────────────────────────
+ *   end_turn / max_tokens  block          → confirm (with reason)
+ *   end_turn / max_tokens  allow          → allow
+ *   end_turn / max_tokens  unparseable    → retry, then failure
+ *   end_turn / max_tokens  + tool_use     → retry, then failure
+ *                          (sideQuery returns stopReason='error' here)
+ *   timeout                —              → retry, then failure
+ *   aborted                —              → throw AbortError to caller
+ *   error                  —              → retry, then failure
+ *
+ * Every non-abort failure receives one immediate retry. The caller applies
+ * its configured safety fallback after the second failure; a valid model
+ * concern always means "ask the user", never a direct hard block.
+ */
+
+interface ClassifyOptions {
+    readonly provider: KodaXBaseProvider;
+    readonly model: string;
+    readonly rules: AutoRules;
+    readonly claudeMd?: string;
+    readonly transcript: readonly KodaXMessage[];
+    readonly action: string;
+    readonly intentEvidence?: PermissionIntentEvidence;
+    /** Resolve canonical per-tool projections for safe historical context. */
+    readonly getToolProjection?: ClassifierToolProjectionResolver;
+    /**
+     * FEATURE_158 (v0.7.39): static-analysis signals forwarded to the
+     * classifier prompt. Empty / undefined preserves the FEATURE_092 prompt
+     * shape (no `<signals>` block emitted). When supplied, the classifier
+     * sees signals between `<transcript>` and `<action>` as informational
+     * input — not verdicts.
+     */
+    readonly signals?: readonly ToolCallSignal[];
+    readonly timeoutMs?: number;
+    readonly abortSignal?: AbortSignal;
+    readonly costTracker?: CostTracker;
+    /**
+     * Optional setter — invoked once after `sideQuery` returns when the
+     * classifier successfully recorded its token usage. The CostTracker is
+     * immutable, so `sideQuery` produces a fresh tracker copy with the new
+     * record; without this setter the recorded call is silently dropped.
+     * Wired by the AutoModeToolGuardrail so the agent's tracker accumulates
+     * classifier calls under role='auto_mode'.
+     */
+    readonly setCostTracker?: (next: CostTracker) => void;
+}
+type ClassifierFailureKind = 'timeout' | 'provider_error' | 'contract_error' | 'input_budget';
+type ClassifierAttemptOutcome = 'allow' | 'confirm' | ClassifierFailureKind;
+interface ClassifierAttemptDiagnostics {
+    readonly attempt: number;
+    readonly outcome: ClassifierAttemptOutcome;
+    readonly diagnostics?: SideQueryDiagnostics;
+    readonly observedProtocol?: ClassifierObservedProtocol;
+    readonly parseFailureCode?: ClassifierParseFailureCode | 'tool_use';
+    readonly outputWarnings?: readonly ClassifierOutputWarningCode[];
+}
+interface ClassifyDecisionDetails {
+    readonly reason: string;
+    /** Structured request metadata only; never includes prompt or response text. */
+    readonly diagnostics?: SideQueryDiagnostics;
+    readonly attempts: readonly ClassifierAttemptDiagnostics[];
+}
+type ClassifyDecision = ({
+    readonly kind: 'allow';
+} & ClassifyDecisionDetails) | ({
+    readonly kind: 'confirm';
+} & ClassifyDecisionDetails) | ({
+    readonly kind: 'failure';
+    readonly failureKind: ClassifierFailureKind;
+} & ClassifyDecisionDetails);
+/**
+ * The deadline includes connection setup, provider-side queueing, inference,
+ * and any Retry-After/backoff handled by the provider adapter. Keep it bounded
+ * so infrastructure failure reaches the configured Accept-edits fallback.
+ */
+declare const DEFAULT_CLASSIFIER_TIMEOUT_MS = 30000;
+/** The classifier returns three short XML tags; a coding-turn-sized budget is wasteful. */
+declare const CLASSIFIER_MAX_OUTPUT_TOKENS = 256;
+declare function classify(opts: ClassifyOptions): Promise<ClassifyDecision>;
+
 /**
  * Denial Tracker — FEATURE_092 Phase 2b.4 (v0.7.33).
  *
  * Tracks classifier blocks per session. When either threshold is crossed,
- * the auto-mode engine downgrades from `llm` to `rules` (mode stays `auto`).
+ * threshold state is exposed for diagnostics and does not mutate the selected
+ * Auto engine.
  *
  *   - 3 consecutive blocks → likely an unproductive loop (agent not adapting)
  *   - 20 cumulative blocks → broader classifier-noise pattern in this session
@@ -271,8 +482,9 @@ declare function shouldFallback$1(t: DenialTracker): boolean;
  *
  * Sliding-window error counter for classifier failures (timeouts, 5xx, 429,
  * unparseable outputs). When ≥ 5 errors land within a 10-minute window, the
- * auto-mode engine downgrades from `llm` to `rules` (mode stays `auto`) so
- * the user is not blocked by a degraded classifier path.
+ * callers temporarily skip classifier calls and apply the Accept-edits
+ * failure boundary. The selected Auto engine remains `llm`; health state is
+ * diagnostic, not a mode change.
  *
  * Pure functional API: each operation returns a new breaker. No mutation.
  * Memory bound: stale timestamps are pruned on each recordError call so
@@ -288,20 +500,15 @@ declare function recordError(b: CircuitBreaker, now: number): CircuitBreaker;
 declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
 
 /**
- * Tier 0 — Absolute Denylist — FEATURE_158 Step 4 (v0.7.39).
+ * Historical Tier 0 high-impact pattern detector — FEATURE_158 Step 4.
  *
- * The narrowest possible set of catastrophic patterns that must NEVER reach
- * the LLM classifier (which is fallible / can be prompt-injected). Per
- * ADR-025: every entry here must satisfy BOTH gates:
+ * The exported names remain source-compatible with FEATURE_158. Auto[LLM]
+ * now treats matches as deterministic facts for the classifier, whose
+ * decision is final. Explicit Auto[Rules] mode retains the legacy approval
+ * gate. The narrow list still identifies high-impact operations worth
+ * describing precisely:
  *
- *   (a) "is there any legitimate context in which this should be allowed?"
- *       — answer must be **no**.
- *   (b) "could the LLM be convinced to allow it under prompt injection?"
- *       — answer must be **yes** (otherwise classifier is sufficient).
- *
- * The 5-item list is **frozen** by ADR-025; adding entries requires a new
- * ADR addendum answering (a)+(b) again. Removing entries requires evidence
- * of high-volume false-positive friction.
+ * The detector must not expand into a second Auto[LLM] approval policy.
  *
  * Patterns:
  *
@@ -309,7 +516,7 @@ declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
  *                        / -fr variants). Excludes `rm -rf /tmp/foo` (which
  *                        is a `dangerous_pattern` signal but reaches LLM).
  *   2. mkfs_or_format  — `mkfs.* /dev/sd*`, `fdisk /dev/sd*`, `format C:`.
- *                        Block formatting any disk device.
+ *                        Identifies formatting of a disk device.
  *   3. dd_disk_write   — `dd of=/dev/sd*` (raw-disk write). Excludes
  *                        `dd of=test.bin` (file write — reaches LLM as
  *                        dangerous_pattern signal).
@@ -317,13 +524,12 @@ declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
  *   5. user_kodax_write — write/edit to any path under `~/.kodax/`
  *                        (credentials zone — internal kodax config writes
  *                        use the TypeScript API, not bash/tools, so the
- *                        only path here is LLM-emitted shell which is
- *                        always wrong).
+ *                        only path here is normally an LLM-emitted shell).
  *
  * Layer note: bash-level `~/.kodax/` writes (e.g. `echo x > ~/.kodax/y`)
  * require AST path-extraction which lives in `@kodax/repl`. The REPL-side
- * collector wired through `extraCollectors` (Step 7) escalates those to
- * Tier 0 by emitting a synthetic `user_kodax_write` denial via the same
+ * collector wired through `extraCollectors` (Step 7) identifies those as
+ * Tier 0 by emitting a synthetic `user_kodax_write` match via the same
  * `AbsoluteDenyResult` shape. This module handles the file-tool path
  * directly (the most common attack vector) and the four command-string
  * patterns that don't need path extraction.
@@ -341,13 +547,15 @@ interface AbsoluteDenyMiss {
 type AbsoluteDenyResult = AbsoluteDenyMatch | AbsoluteDenyMiss;
 type AbsoluteDenyCheck = (call: RunnerToolCall, projectRoot: string, executionCwd: string) => AbsoluteDenyResult;
 /**
- * Check a tool call against the Tier 0 absolute denylist. Returns the
- * first matching pattern, or `{ denied: false }` if no pattern fires.
+ * Check a tool call against the historical Tier 0 pattern list. Returns the
+ * first matching pattern, or `{ denied: false }` if no pattern fires. A match
+ * is classifier evidence in Auto[LLM] and a legacy approval gate only in
+ * explicit Auto[Rules].
  *
  * Order is deterministic — patterns checked in the order defined above.
  * Multiple matches would be possible (e.g. `rm -rf / ; :(){...};:`) but
- * we return the first hit since the guardrail acts on `denied: true`
- * regardless and the reason string is one-shot.
+ * we return the first hit because one precise fact is sufficient for the
+ * classifier and the reason string is one-shot.
  *
  * **Pure**: deterministic given (call, projectRoot, stable env).
  * **Fast**: ~5 regex tests + 1-2 string ops; safe to run on every
@@ -365,18 +573,21 @@ declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, ex
  *
  * Decision flow (per design doc "三层权限金字塔"):
  *
- *   1. Tier-0 deterministic deny             → block
- *   2. Tool projection is '' (Tier 1)        → allow (zero token cost)
- *   3. Engine is rules → deterministic Tier 2, otherwise user confirms
- *   4. denial/circuit threshold              → engine downgrade, then escalate
- *   5. classify(...) sideQuery
- *        allow                               → allow (record allow → reset consecutive)
- *        block                               → block + reason (record block)
- *        escalate                            → escalate + reason (record error)
- *        AbortError thrown                   → re-throw (propagate user cancel)
+ *   1. exact safe read/workspace-temp effect → allow (zero token cost)
+ *   2. Explicitly exempt empty projection    → allow
+ *   3. Static/high-impact pattern match      → classifier facts in LLM;
+ *                                               legacy gate in explicit Rules
+ *   4. Recoverable projection/analyzer fault → safe facts to classifier
+ *   5. Engine is rules → deterministic Tier 2, otherwise user confirms
+ *   6. degraded classifier infrastructure    → Accept-edits fallback
+ *   7. classify(...) sideQuery (sole Auto[LLM] decision owner)
+ *        allow                                → allow (record allow → reset consecutive)
+ *        confirm                              → user confirmation (record concern)
+ *        failure                              → Accept-edits fallback (record error)
+ *        AbortError thrown                    → re-throw (propagate user cancel)
  *
  * State (mutable, session-scoped):
- *   - engine: 'llm' | 'rules' (starts at 'llm', downgrades on threshold)
+ *   - engine: 'llm' | 'rules' (user-selected; classifier health never changes it)
  *   - denialTracker (immutable type, swapped on each event)
  *   - circuitBreaker (immutable type, swapped on each event)
  *
@@ -401,16 +612,22 @@ interface AutoModeSharedState {
 /**
  * User answer for an escalated tool-call. The guardrail translates this into
  * the actual `GuardrailVerdict` returned to the Runner. `'block'` preserves
- * the original escalation reason as the verdict reason so downstream consumers
- * see why the tool was blocked.
+ * a clear call-local user-declined result while retaining the review reason.
+ * It does not create a persistent denial: a safer follow-up is reviewed as a
+ * new call. `'timeout'` reports that the action was not executed and gives the
+ * main model a bounded recovery instruction.
  */
-type AutoModeAskUserVerdict = 'allow' | 'block';
+type AutoModeAskUserVerdict = 'allow' | 'block' | 'timeout';
+interface AutoModeDecisionDiagnostics {
+    readonly source: 'classifier_confirm' | 'classifier_failure' | 'classifier_circuit_breaker' | 'configuration';
+    readonly classifierFailureKind?: ClassifierFailureKind;
+    readonly classifierAttempts?: readonly ClassifierAttemptDiagnostics[];
+}
 /**
- * Optional REPL-supplied prompt callback for the 6 escalate paths in
- * `beforeTool` (engine-downgraded, denial-threshold-just-crossed,
- * breaker-just-tripped, classifier-error, classifier-decision-escalate,
- * provider-not-configured). When supplied, the guardrail calls this and
- * translates the user's answer into `'allow'` or `'block'`. When NOT
+ * Optional REPL-supplied prompt callback for calls that require a human
+ * decision (rules escalation, classifier concern/failure, or configuration
+ * failure). When supplied, the guardrail calls this and
+ * translates the user's answer into allow/block/timeout semantics. When NOT
  * supplied, the guardrail returns `'escalate'` as before — the Runner will
  * then throw `GuardrailEscalateError` (preserves backward compat with
  * SDK-side guardrail consumers that have no askUser surface).
@@ -425,11 +642,18 @@ type AutoModeAskUser = (call: RunnerToolCall, reason: string,
  * keep working. REPL uses these to render Scope/Risk labels on the
  * confirm dialog (replacing the input-marker path from FEATURE_066).
  */
-signals?: readonly ToolCallSignal[]) => Promise<AutoModeAskUserVerdict>;
+signals?: readonly ToolCallSignal[], diagnostics?: AutoModeDecisionDiagnostics) => Promise<AutoModeAskUserVerdict>;
 interface AutoModeRulesContext {
     readonly projectRoot: string;
     readonly executionCwd: string;
     readonly signals: readonly ToolCallSignal[];
+    /**
+     * Whether shell environment aliases such as `%TEMP%` and `$env:TEMP`
+     * are known to resolve from this Node process. Runtime shell profiles can
+     * rewrite them before execution, so embedders must set this to false when
+     * that equivalence cannot be proven.
+     */
+    readonly trustProcessEnvironmentPathExpansion?: boolean;
 }
 type AutoModePermissionBoundary = 'workspace' | 'system-temp' | 'outside-workspace' | 'protected' | 'unresolved';
 interface AutoModePermissionTarget {
@@ -498,6 +722,15 @@ interface AutoModeGuardrailConfig {
      * paths. See `AutoModeAskUser` for semantics.
      */
     readonly askUser?: AutoModeAskUser;
+    /**
+     * Runtime-owned Accept-edits fallback used only when classifier
+     * infrastructure or its response contract fails.
+     */
+    readonly allowOnClassifierFailure?: (call: RunnerToolCall) => boolean | Promise<boolean>;
+    /** Whether ordinary bash calls can be enforced by an OS workspace sandbox. */
+    readonly workspaceShellSandboxAvailable?: boolean;
+    /** Mint one exact bash call for workspace-sandboxed execution. */
+    readonly admitWorkspaceSandboxCall?: (call: RunnerToolCall, review: AutoModePermissionReview) => void;
     /**
      * Runtime-owned deterministic Tier-2 evaluator. It is injected rather than
      * implemented in @kodax/coding because canonical path and shell-AST helpers
@@ -507,7 +740,8 @@ interface AutoModeGuardrailConfig {
     readonly evaluateRulesCall?: AutoModeRulesEvaluator;
     /**
      * Runtime-owned compact facts used by deterministic read admission and the
-     * LLM permission reviewer. Direct read tools fail closed when this is absent.
+     * LLM permission reviewer. When absent or faulty, direct read tools use a
+     * bounded metadata-only projection and remain LLM-reviewed.
      */
     readonly analyzeCall?: AutoModeCallAnalyzer;
     /**
@@ -544,12 +778,11 @@ interface AutoModeGuardrailConfig {
      */
     readonly getCostTracker?: () => CostTracker | undefined;
     readonly setCostTracker?: (t: CostTracker) => void;
-    /** Optional logger for engine-downgrade and config warnings. */
+    /** Optional logger for classifier-health and configuration warnings. */
     readonly log?: (level: 'info' | 'warn', msg: string) => void;
     /**
-     * Fired whenever the active engine changes — both on automatic downgrades
-     * (denial threshold / circuit breaker) AND on manual `setEngine(...)`
-     * calls. UI surfaces (status bar engine indicator, slash-command
+     * Fired whenever the active engine changes through `setEngine(...)`.
+     * UI surfaces (status bar engine indicator, slash-command
      * confirmations) subscribe here so the displayed engine stays in sync
      * with the guardrail's internal state without the user having to trigger
      * another mode toggle just to refresh the bar.
@@ -558,8 +791,8 @@ interface AutoModeGuardrailConfig {
     /**
      * Optional shared state for subagent threshold-bypass defense
      * (design doc "防绕阈值"). When supplied, the parent and child
-     * guardrails reference the SAME object — engine downgrades and
-     * tracker advances are visible across the session boundary.
+     * guardrails reference the SAME object — engine changes and tracker
+     * advances are visible across the session boundary.
      */
     readonly sharedState?: AutoModeSharedState;
     /**
@@ -572,7 +805,7 @@ interface AutoModeGuardrailConfig {
     readonly initialEngine?: AutoModeEngine;
     /**
      * FEATURE_092 phase 2b.7b slice C: classifier sideQuery timeout in ms.
-     * Defaults to 20_000. Resolved by the REPL from `~/.kodax/config.json`
+     * Defaults to 30_000. Resolved by the REPL from `~/.kodax/config.json`
      * `autoMode.timeoutMs`.
      */
     readonly timeoutMs?: number;
@@ -591,6 +824,11 @@ interface AutoModeGuardrailConfig {
     readonly projectRoot?: string;
     /** Directory used to resolve relative tool paths. Defaults to projectRoot. */
     readonly executionCwd?: string;
+    /**
+     * Set to false when the shell profile or execution contract can rewrite
+     * process-derived path aliases such as `%TEMP%` or `$env:TEMP`.
+     */
+    readonly trustProcessEnvironmentPathExpansion?: boolean;
     /**
      * Override the default signal-collector set. When unset, defaults to
      * `[bashSignalCollector, fileSignalCollector]` — coding-side
@@ -613,7 +851,10 @@ interface AutoModeGuardrailConfig {
      * signal order).
      */
     readonly extraCollectors?: readonly SignalCollector[];
-    /** Layer-owned Tier-0 checks that run after the coding-side frozen list. */
+    /**
+     * Layer-owned high-impact pattern checks. In LLM mode they add classifier
+     * evidence; in explicitly selected Rules mode they retain the legacy gate.
+     */
     readonly extraAbsoluteDenyChecks?: readonly AbsoluteDenyCheck[];
     /**
      * Speculative-classify quiet window (ms). When a classifier promise
@@ -625,8 +866,8 @@ interface AutoModeGuardrailConfig {
      * (late-verdict adoption). The window therefore only controls "fast path
      * vs wait", never "dialog vs no dialog": an `allow` never surfaces a
      * confirm dialog regardless of how long the classifier takes, and only an
-     * `escalate` verdict (explicit LLM escalation, classifier timeout, or infra
-     * error — all mapped to `escalate` by classify()) reaches the user.
+     * confirmation/failure verdict reaches the configured user or Accept-edits
+     * fallback path.
      * The background classifier's cost is settled exactly once inside
      * classify(), so awaiting it after window expiry does not double-count.
      *
@@ -645,6 +886,7 @@ interface AutoModeGuardrailConfig {
  */
 interface AutoModeStats {
     readonly engine: AutoModeEngine;
+    readonly classifierHealth: 'healthy' | 'degraded';
     readonly classifierModel?: string;
     readonly denials: DenialTracker;
     readonly breaker: CircuitBreaker;
@@ -656,19 +898,17 @@ interface AutoModeToolGuardrail extends ToolGuardrail {
     getStats(): AutoModeStats;
     /**
      * Manually set the engine. Used by `/auto-engine` slash command to flip
-     * back to 'llm' after an automatic downgrade or to flip to 'rules' for
-     * manual testing. The downgrade thresholds still operate normally — a
-     * subsequent threshold cross will downgrade again.
+     * between 'llm' and 'rules' after an explicit user or host choice.
      */
     setEngine(engine: AutoModeEngine): void;
     /** Test-only alias for getEngine(). Backward-compat for test files. */
     getEngineForTest(): AutoModeEngine;
     /** Test-only alias for getStats(). Backward-compat for test files. */
     getStatsForTest(): AutoModeStats;
-    /** Test-only override: swap the provider mid-test (for downgrade scenarios). */
+    /** Test-only override: swap the provider mid-test. */
     setProviderForTest(provider: KodaXBaseProvider): void;
 }
 declare function createAutoModeToolGuardrail(config: AutoModeGuardrailConfig): AutoModeToolGuardrail;
 
-export { recordBlock as $, CONSECUTIVE_THRESHOLD as C, ERROR_THRESHOLD as E, checkAbsoluteDeny as I, collectAllSignals as J, computeRulesFingerprint as M, createAutoModeToolGuardrail as N, createCircuitBreaker as O, createDenialTracker as P, formatAgentsForPrompt as Q, getKodaxGlobalDir as U, loadAgentsFiles as V, WINDOW_MS as W, loadAutoRules as X, parseAutoRules as Y, readTrustState as Z, recordAllow as _, recordError as a0, shouldFallback$1 as a1, shouldFallback as a2, trustProjectRules as a3, CUMULATIVE_THRESHOLD as u };
-export type { AbsoluteDenyCheck as A, RulesLoadResult as B, DenialTracker as D, SkippedRulesSource as F, ToolCallSignal as G, TrustState as H, KodaXMcpConnectMode as K, LoadAgentsOptions as L, RulesLoadError as R, SignalCollector as S, TierZeroPatternId as T, AbsoluteDenyMatch as a, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeEngine as h, AutoModeGuardrailConfig as i, AutoModePermissionBoundary as j, AutoModePermissionOperation as k, AutoModePermissionReview as l, AutoModePermissionTarget as m, AutoModeRulesContext as n, AutoModeRulesDecision as o, AutoModeRulesEvaluator as p, AutoModeSharedState as q, AutoModeStats as r, AutoModeToolGuardrail as s, AutoRules as t, CircuitBreaker as v, KodaXMcpServerConfig as w, KodaXMcpServersConfig as x, KodaXMcpTransport as y, LoadedRulesSource as z };
+export { CLASSIFIER_MAX_OUTPUT_TOKENS as C, DEFAULT_CLASSIFIER_TIMEOUT_MS as M, ERROR_THRESHOLD as O, WINDOW_MS as a1, checkAbsoluteDeny as a2, classify as a3, collectAllSignals as a4, computeRulesFingerprint as a5, createAutoModeToolGuardrail as a6, createCircuitBreaker as a7, createDenialTracker as a8, formatAgentsForPrompt as a9, getKodaxGlobalDir as aa, loadAgentsFiles as ab, loadAutoRules as ac, parseAutoRules as ad, parseClassifierOutput as ae, readTrustState as af, recordAllow as ag, recordBlock as ah, recordError as ai, shouldFallback$1 as aj, shouldFallback as ak, trustProjectRules as al, CONSECUTIVE_THRESHOLD as v, CUMULATIVE_THRESHOLD as w };
+export type { ToolCallSignal as $, AbsoluteDenyCheck as A, ClassifierDecision as B, ClassifierFailureKind as D, ClassifierHazard as E, ClassifierObservedProtocol as F, ClassifierOutputWarningCode as G, ClassifierParseFailureCode as H, ClassifierProtocol as I, ClassifierToolProjectionResolver as J, ClassifyDecision as K, ClassifyOptions as L, DenialTracker as N, KodaXMcpConnectMode as P, KodaXMcpServerConfig as Q, KodaXMcpServersConfig as R, KodaXMcpTransport as S, LoadAgentsOptions as T, LoadedRulesSource as U, PermissionIntentEvidence as V, RulesLoadError as W, RulesLoadResult as X, SignalCollector as Y, SkippedRulesSource as Z, TierZeroPatternId as _, AbsoluteDenyMatch as a, TrustState as a0, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeEngine as i, AutoModeGuardrailConfig as j, AutoModePermissionBoundary as k, AutoModePermissionOperation as l, AutoModePermissionReview as m, AutoModePermissionTarget as n, AutoModeRulesContext as o, AutoModeRulesDecision as p, AutoModeRulesEvaluator as q, AutoModeSharedState as r, AutoModeStats as s, AutoModeToolGuardrail as t, AutoRules as u, CircuitBreaker as x, ClassifierAttemptDiagnostics as y, ClassifierAttemptOutcome as z };

package/dist/types-chunks/{history-retrieval.d-B__aEN62.d.ts → history-retrieval.d-BAegI14A.d.ts}

@@ -1,5 +1,5 @@
-import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
-import { bM as KodaXSessionLineage } from './types.d-RdWRfUEs.js';
+import { k as KodaXMessage } from './types.d-CgrXrFrq.js';
+import { c1 as KodaXSessionLineage } from './controller.d-RGV7Pjv9.js';
 
 type KodaXSessionHistoryScope = 'compacted' | 'all';
 type KodaXSessionHistorySource = 'user' | 'assistant' | 'system' | 'tool' | 'child_task';
@@ -25,6 +25,12 @@ interface KodaXSessionHistorySearchResult {
     revision: string;
     hits: KodaXSessionHistoryHit[];
 }
+/** @internal Cooperative control used by Runtime history reads. */
+interface KodaXSessionHistorySearchControl {
+    readonly revision: string;
+    checkpoint(): void;
+    yieldControl(): Promise<void>;
+}
 interface KodaXSessionHistoryReadOptions {
     entryId: string;
     revision?: string;
@@ -51,7 +57,14 @@ type KodaXSessionHistoryReadResult = {
     citation: string;
 };
 declare function searchSessionHistory(lineage: KodaXSessionLineage, options: KodaXSessionHistorySearchOptions): KodaXSessionHistorySearchResult;
+/** @internal Runtime preflight; kept out of the public package barrels. */
+declare function validateSessionHistorySearchQuery(query: string): void;
+/**
+ * Runtime-facing history search that yields between bounded batches so
+ * timeout/cancel signals can be observed while indexing large transcripts.
+ */
+declare function searchSessionHistoryCooperatively(lineage: KodaXSessionLineage, options: KodaXSessionHistorySearchOptions, control: KodaXSessionHistorySearchControl): Promise<KodaXSessionHistorySearchResult>;
 declare function readSessionHistoryEntry(lineage: KodaXSessionLineage, options: KodaXSessionHistoryReadOptions): KodaXSessionHistoryReadResult;
 
-export { readSessionHistoryEntry as r, searchSessionHistory as s };
+export { searchSessionHistoryCooperatively as g, readSessionHistoryEntry as r, searchSessionHistory as s, validateSessionHistorySearchQuery as v };
 export type { KodaXSessionHistoryHit as K, KodaXSessionHistoryReadOptions as a, KodaXSessionHistoryReadResult as b, KodaXSessionHistoryScope as c, KodaXSessionHistorySearchOptions as d, KodaXSessionHistorySearchResult as e, KodaXSessionHistorySource as f };