@kodax-ai/kodax 0.7.78 → 0.7.80

package/dist/types-chunks/{guardrail.d-CXDYRgZ3.d.ts → guardrail.d-DM-OK0m3.d.ts}

@@ -1,10 +1,10 @@
 import { b as McpServersConfig, M as McpConnectMode, a as McpServerConfig, c as McpTransportKind } from './config.d-CJy1WENT.js';
-import { K as KodaXBaseProvider } from './base.d-4e74xDdy.js';
+import { K as KodaXBaseProvider } from './base.d-DxG0m09Z.js';
 import { a as CostTracker } from './cost-tracker.d-BeaenODW.js';
-import { dT as RunnerToolCall } from './types.d-BA-Jwpfs.js';
-import { d as ToolGuardrail } from './guardrail.d-BRE_ErEj.js';
-import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
-import { S as SideQueryDiagnostics } from './side-query.d-DTuLPcC5.js';
+import { e2 as RunnerToolCall, ez as ToolGuardrail } from './controller.d-C2aHqzHj.js';
+import { k as KodaXMessage } from './types.d-CgrXrFrq.js';
+import { S as SideQueryDiagnostics } from './side-query.d-CP1LiRiH.js';
+import { by as ToolSideEffect } from './bash-prefix-extractor.d-DStqKIlu.js';
 
 /**
  * FEATURE_200 Phase F (v0.7.45) — MCP domain types extracted from types.ts.
@@ -54,6 +54,50 @@ declare function loadAgentsFiles(options?: LoadAgentsOptions): AgentsFile[];
  */
 declare function formatAgentsForPrompt(files: AgentsFile[]): string;
 
+/**
+ * Parse the auto-mode classifier's output — FEATURE_092 Phase 2b.3 (v0.7.33).
+ *
+ * Preferred format:
+ *   <decision>allow|ask</decision><hazard>...</hazard><reason>...</reason>
+ * Legacy `<block>` output remains parseable during the protocol rollout so a
+ * valid decision from an older prompt/provider cache is not misreported as an
+ * infrastructure failure.
+ *
+ * Robustness:
+ *   - case-insensitive yes/no
+ *   - whitespace inside / around tags tolerated
+ *   - one valid decision is authoritative; hazard/reason defects are retained
+ *     as warnings and never become a second decision mechanism
+ *   - reasons longer than 500 chars are truncated (defense against
+ *     pathological model outputs)
+ *   - missing, invalid, duplicate, or mixed decisions remain contract errors;
+ *     surrounding prose and malformed auxiliary fields are diagnostic only
+ */
+type ClassifierDecision = {
+    readonly kind: 'block';
+    readonly reason: string;
+    readonly hazard?: ClassifierHazard;
+    readonly protocol: ClassifierProtocol;
+    readonly warnings?: readonly ClassifierOutputWarningCode[];
+} | {
+    readonly kind: 'allow';
+    readonly reason: string;
+    readonly hazard?: 'none';
+    readonly protocol: ClassifierProtocol;
+    readonly warnings?: readonly ClassifierOutputWarningCode[];
+} | {
+    readonly kind: 'unparseable';
+    readonly raw: string;
+    readonly failureCode: ClassifierParseFailureCode;
+    readonly observedProtocol: ClassifierObservedProtocol;
+};
+type ClassifierProtocol = 'structured_v2' | 'legacy_v1';
+type ClassifierObservedProtocol = ClassifierProtocol | 'unknown';
+type ClassifierParseFailureCode = 'missing_decision' | 'invalid_decision' | 'ambiguous_decision' | 'missing_hazard' | 'invalid_hazard' | 'decision_hazard_conflict' | 'decision_reason_conflict' | 'missing_reason' | 'structured_format_violation' | 'legacy_format_violation';
+type ClassifierOutputWarningCode = Exclude<ClassifierParseFailureCode, 'missing_decision' | 'invalid_decision' | 'ambiguous_decision'>;
+type ClassifierHazard = 'none' | 'protected_read' | 'outside_write' | 'destructive_loss' | 'credential_exposure' | 'network_exfiltration' | 'remote_code_execution' | 'dependency_poisoning' | 'production_change' | 'privilege_change' | 'intent_conflict';
+declare function parseClassifierOutput(raw: string): ClassifierDecision;
+
 /**
  * Auto-Mode Rules Loader — FEATURE_092 Phase 2b.2 (v0.7.33).
  *
@@ -72,11 +116,15 @@ declare function formatAgentsForPrompt(files: AgentsFile[]): string;
  *
  * Schema (each field optional, defaults to []):
  *   {
- *     "allow":       string[],   // patterns the classifier defaults to allowing
- *     "soft_deny":   string[],   // patterns the classifier defaults to blocking
+ *     "allow":       string[],   // contextual examples supporting an allow
+ *     "soft_deny":   string[],   // contextual cautions for the classifier to inspect
  *     "environment": string[]    // background context the classifier sees verbatim
  *   }
  *
+ * These strings are classifier context, never independent verdicts. In
+ * Auto[LLM], even `soft_deny` cannot create an approval class beyond the two
+ * evidence-based ask classes defined by the classifier contract.
+ *
  * Merge: layers concatenated in order (user → project → local). Identical
  * strings deduplicated by stable insertion (later layers win position only
  * when the string is unique per layer).
@@ -136,7 +184,7 @@ declare function loadAutoRules(opts: LoadAutoRulesOptions): Promise<RulesLoadRes
  *
  * Mechanical pattern matches over a tool call. Signals are NOT verdicts;
  * the classifier consumes them as informational input alongside transcript
- * + user rules and produces the final decision (allow / block / escalate).
+ * + user rules and produces the final Auto[LLM] decision (allow / ask).
  *
  * Two invariants the producers must hold:
  *
@@ -150,10 +198,9 @@ declare function loadAutoRules(opts: LoadAutoRulesOptions): Promise<RulesLoadRes
  *      so the classifier can weight signals, but the verdict is not encoded
  *      here.
  *
- * Tier 0 (absolute deny) is a separate module — signals are pre-verdict
- * material consumed by Tier 2 (LLM classifier). The two paths are not
- * coupled: Tier 0 catches a fixed catastrophic-pattern set; signals
- * describe a wider surface for the classifier to reason about.
+ * The historical Tier 0 detector is a separate module, but its matches are
+ * also pre-verdict facts in Auto[LLM]. Only explicit Auto[Rules] treats that
+ * detector as a legacy approval gate.
  *
  * Design ref: ADR-025, FEATURE_158 (docs/features/v0.7.39.md).
  */
@@ -248,6 +295,12 @@ interface PermissionIntentEvidence {
     /** Latest genuine user request, kept separate as the authoritative intent. */
     readonly currentUserContent?: string;
     readonly currentUserContentTruncated?: boolean;
+    /** Runtime-delegated task context; informative, never a replacement for root authority. */
+    readonly delegatedObjective?: string;
+    readonly delegatedObjectiveTruncated?: boolean;
+    readonly bindingConstraints?: readonly string[];
+    readonly scopeHint?: string;
+    readonly readOnly?: boolean;
     readonly content: string;
     readonly sourceBytes: number;
     readonly includedBytes: number;
@@ -371,6 +424,9 @@ interface ClassifierAttemptDiagnostics {
     readonly attempt: number;
     readonly outcome: ClassifierAttemptOutcome;
     readonly diagnostics?: SideQueryDiagnostics;
+    readonly observedProtocol?: ClassifierObservedProtocol;
+    readonly parseFailureCode?: ClassifierParseFailureCode | 'tool_use';
+    readonly outputWarnings?: readonly ClassifierOutputWarningCode[];
 }
 interface ClassifyDecisionDetails {
     readonly reason: string;
@@ -389,72 +445,25 @@ type ClassifyDecision = ({
 /**
  * The deadline includes connection setup, provider-side queueing, inference,
  * and any Retry-After/backoff handled by the provider adapter. Keep it bounded
- * so infrastructure failure degrades to an explicit user decision.
+ * so infrastructure failure reaches the configured Accept-edits fallback.
  */
-declare const DEFAULT_CLASSIFIER_TIMEOUT_MS = 20000;
+declare const DEFAULT_CLASSIFIER_TIMEOUT_MS = 45000;
+/** A retry gets a longer deadline because its expanded response budget can take longer to emit. */
+declare const DEFAULT_CLASSIFIER_RETRY_TIMEOUT_MS = 90000;
+/** The classifier returns three short XML tags; a coding-turn-sized budget is wasteful. */
+declare const CLASSIFIER_MAX_OUTPUT_TOKENS = 256;
 declare function classify(opts: ClassifyOptions): Promise<ClassifyDecision>;
 
 /**
- * Denial Tracker — FEATURE_092 Phase 2b.4 (v0.7.33).
- *
- * Tracks classifier blocks per session. When either threshold is crossed,
- * the auto-mode engine downgrades from `llm` to `rules` (mode stays `auto`).
- *
- *   - 3 consecutive blocks → likely an unproductive loop (agent not adapting)
- *   - 20 cumulative blocks → broader classifier-noise pattern in this session
- *
- * Both are session-scoped, shared with subagents (per design doc, to defend
- * against threshold-bypass via spawning).
- *
- * Pure functional API: each operation returns a new tracker. No mutation.
- */
-declare const CONSECUTIVE_THRESHOLD = 3;
-declare const CUMULATIVE_THRESHOLD = 20;
-interface DenialTracker {
-    readonly consecutive: number;
-    readonly cumulative: number;
-}
-declare function createDenialTracker(): DenialTracker;
-declare function recordBlock(t: DenialTracker): DenialTracker;
-declare function recordAllow(t: DenialTracker): DenialTracker;
-declare function shouldFallback$1(t: DenialTracker): boolean;
-
-/**
- * Circuit Breaker — FEATURE_092 Phase 2b.4 (v0.7.33).
- *
- * Sliding-window error counter for classifier failures (timeouts, 5xx, 429,
- * unparseable outputs). When ≥ 5 errors land within a 10-minute window, the
- * auto-mode engine downgrades from `llm` to `rules` (mode stays `auto`) so
- * the user is not blocked by a degraded classifier path.
+ * Historical Tier 0 high-impact pattern detector — FEATURE_158 Step 4.
  *
- * Pure functional API: each operation returns a new breaker. No mutation.
- * Memory bound: stale timestamps are pruned on each recordError call so
- * the timestamps array never grows unbounded.
- */
-declare const ERROR_THRESHOLD = 5;
-declare const WINDOW_MS: number;
-interface CircuitBreaker {
-    readonly timestamps: readonly number[];
-}
-declare function createCircuitBreaker(): CircuitBreaker;
-declare function recordError(b: CircuitBreaker, now: number): CircuitBreaker;
-declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
-
-/**
- * Tier 0 — Absolute Denylist — FEATURE_158 Step 4 (v0.7.39).
+ * The exported names remain source-compatible with FEATURE_158. Auto[LLM]
+ * now treats matches as deterministic facts for the classifier, whose
+ * decision is final. Explicit Auto[Rules] mode retains the legacy approval
+ * gate. The narrow list still identifies high-impact operations worth
+ * describing precisely:
  *
- * The narrowest possible set of catastrophic patterns that must NEVER reach
- * the LLM classifier (which is fallible / can be prompt-injected). Per
- * ADR-025: every entry here must satisfy BOTH gates:
- *
- *   (a) "is there any legitimate context in which this should be allowed?"
- *       — answer must be **no**.
- *   (b) "could the LLM be convinced to allow it under prompt injection?"
- *       — answer must be **yes** (otherwise classifier is sufficient).
- *
- * The 5-item list is **frozen** by ADR-025; adding entries requires a new
- * ADR addendum answering (a)+(b) again. Removing entries requires evidence
- * of high-volume false-positive friction.
+ * The detector must not expand into a second Auto[LLM] approval policy.
  *
  * Patterns:
  *
@@ -462,7 +471,7 @@ declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
  *                        / -fr variants). Excludes `rm -rf /tmp/foo` (which
  *                        is a `dangerous_pattern` signal but reaches LLM).
  *   2. mkfs_or_format  — `mkfs.* /dev/sd*`, `fdisk /dev/sd*`, `format C:`.
- *                        Block formatting any disk device.
+ *                        Identifies formatting of a disk device.
  *   3. dd_disk_write   — `dd of=/dev/sd*` (raw-disk write). Excludes
  *                        `dd of=test.bin` (file write — reaches LLM as
  *                        dangerous_pattern signal).
@@ -470,13 +479,12 @@ declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
  *   5. user_kodax_write — write/edit to any path under `~/.kodax/`
  *                        (credentials zone — internal kodax config writes
  *                        use the TypeScript API, not bash/tools, so the
- *                        only path here is LLM-emitted shell which is
- *                        always wrong).
+ *                        only path here is normally an LLM-emitted shell).
  *
  * Layer note: bash-level `~/.kodax/` writes (e.g. `echo x > ~/.kodax/y`)
- * require AST path-extraction which lives in `@kodax/repl`. The REPL-side
- * collector wired through `extraCollectors` (Step 7) escalates those to
- * Tier 0 by emitting a synthetic `user_kodax_write` denial via the same
+ * require AST path-extraction. The REPL-side collector wired through
+ * `extraCollectors` (Step 7) identifies those as
+ * Tier 0 by emitting a synthetic `user_kodax_write` match via the same
  * `AbsoluteDenyResult` shape. This module handles the file-tool path
  * directly (the most common attack vector) and the four command-string
  * patterns that don't need path extraction.
@@ -494,13 +502,15 @@ interface AbsoluteDenyMiss {
 type AbsoluteDenyResult = AbsoluteDenyMatch | AbsoluteDenyMiss;
 type AbsoluteDenyCheck = (call: RunnerToolCall, projectRoot: string, executionCwd: string) => AbsoluteDenyResult;
 /**
- * Check a tool call against the Tier 0 absolute denylist. Returns the
- * first matching pattern, or `{ denied: false }` if no pattern fires.
+ * Check a tool call against the historical Tier 0 pattern list. Returns the
+ * first matching pattern, or `{ denied: false }` if no pattern fires. A match
+ * is classifier evidence in Auto[LLM] and a legacy approval gate only in
+ * explicit Auto[Rules].
  *
  * Order is deterministic — patterns checked in the order defined above.
  * Multiple matches would be possible (e.g. `rm -rf / ; :(){...};:`) but
- * we return the first hit since the guardrail acts on `denied: true`
- * regardless and the reason string is one-shot.
+ * we return the first hit because one precise fact is sufficient for the
+ * classifier and the reason string is one-shot.
  *
  * **Pure**: deterministic given (call, projectRoot, stable env).
  * **Fast**: ~5 regex tests + 1-2 string ops; safe to run on every
@@ -508,6 +518,54 @@ type AbsoluteDenyCheck = (call: RunnerToolCall, projectRoot: string, executionCw
  */
 declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, executionCwd?: string): AbsoluteDenyResult;
 
+/**
+ * Circuit Breaker — FEATURE_092 Phase 2b.4 (v0.7.33).
+ *
+ * Sliding-window error counter for classifier failures (timeouts, 5xx, 429,
+ * unparseable outputs). When ≥ 5 errors land within a 10-minute window, the
+ * callers temporarily skip classifier calls and apply the Accept-edits
+ * failure boundary. The selected Auto engine remains `llm`; health state is
+ * diagnostic, not a mode change.
+ *
+ * Pure functional API: each operation returns a new breaker. No mutation.
+ * Memory bound: stale timestamps are pruned on each recordError call so
+ * the timestamps array never grows unbounded.
+ */
+declare const ERROR_THRESHOLD = 5;
+declare const WINDOW_MS: number;
+interface CircuitBreaker {
+    readonly timestamps: readonly number[];
+}
+declare function createCircuitBreaker(): CircuitBreaker;
+declare function recordError(b: CircuitBreaker, now: number): CircuitBreaker;
+declare function shouldFallback$1(b: CircuitBreaker, now: number): boolean;
+
+/**
+ * Denial Tracker — FEATURE_092 Phase 2b.4 (v0.7.33).
+ *
+ * Tracks classifier blocks per session. When either threshold is crossed,
+ * threshold state is exposed for diagnostics and does not mutate the selected
+ * Auto engine.
+ *
+ *   - 3 consecutive blocks → likely an unproductive loop (agent not adapting)
+ *   - 20 cumulative blocks → broader classifier-noise pattern in this session
+ *
+ * Both are session-scoped, shared with subagents (per design doc, to defend
+ * against threshold-bypass via spawning).
+ *
+ * Pure functional API: each operation returns a new tracker. No mutation.
+ */
+declare const CONSECUTIVE_THRESHOLD = 3;
+declare const CUMULATIVE_THRESHOLD = 20;
+interface DenialTracker {
+    readonly consecutive: number;
+    readonly cumulative: number;
+}
+declare function createDenialTracker(): DenialTracker;
+declare function recordBlock(t: DenialTracker): DenialTracker;
+declare function recordAllow(t: DenialTracker): DenialTracker;
+declare function shouldFallback(t: DenialTracker): boolean;
+
 /**
  * AutoModeToolGuardrail — FEATURE_092 Phase 2b.6 (v0.7.33).
  *
@@ -518,12 +576,14 @@ declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, ex
  *
  * Decision flow (per design doc "三层权限金字塔"):
  *
- *   1. Tier-0 deterministic critical match   → user confirmation
- *   2. exact safe read/workspace-temp effect → allow (zero token cost)
- *   3. Tool projection is '' (Tier 1)        → allow
- *   4. Engine is rules → deterministic Tier 2, otherwise user confirms
- *   5. degraded classifier infrastructure    → Accept-edits fallback
- *   6. classify(...) sideQuery
+ *   1. exact safe read/workspace-temp effect → allow (zero token cost)
+ *   2. Explicitly exempt empty projection    → allow
+ *   3. Static/high-impact pattern match      → classifier facts in LLM;
+ *                                               legacy gate in explicit Rules
+ *   4. Recoverable projection/analyzer fault → safe facts to classifier
+ *   5. Engine is rules → deterministic Tier 2, otherwise user confirms
+ *   6. degraded classifier infrastructure    → Accept-edits fallback
+ *   7. classify(...) sideQuery (sole Auto[LLM] decision owner)
  *        allow                                → allow (record allow → reset consecutive)
  *        confirm                              → user confirmation (record concern)
  *        failure                              → Accept-edits fallback (record error)
@@ -541,9 +601,8 @@ declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, ex
  *   independent.
  *
  * Provider capability checks and the explicit `supportsAutoModeClassifier`
- * flag are deferred to follow-up phases. Tier 2 is supplied by the Runtime
- * host because canonical filesystem and shell parsing live in @kodax/repl;
- * the guardrail remains the single decision point.
+ * flag are deferred to follow-up phases. Coding owns the default analyzer and
+ * Tier 2 evaluator so direct SDK and REPL consumers share one decision path.
  */
 
 type AutoModeEngine = 'llm' | 'rules';
@@ -555,9 +614,10 @@ interface AutoModeSharedState {
 /**
  * User answer for an escalated tool-call. The guardrail translates this into
  * the actual `GuardrailVerdict` returned to the Runner. `'block'` preserves
- * the original escalation reason as the verdict reason so downstream consumers
- * see why the tool was blocked. `'timeout'` reports that the action was not
- * executed and gives the main model a bounded recovery instruction.
+ * a clear call-local user-declined result while retaining the review reason.
+ * It does not create a persistent denial: a safer follow-up is reviewed as a
+ * new call. `'timeout'` reports that the action was not executed and gives the
+ * main model a bounded recovery instruction.
  */
 type AutoModeAskUserVerdict = 'allow' | 'block' | 'timeout';
 interface AutoModeDecisionDiagnostics {
@@ -589,6 +649,15 @@ interface AutoModeRulesContext {
     readonly projectRoot: string;
     readonly executionCwd: string;
     readonly signals: readonly ToolCallSignal[];
+    /**
+     * Whether shell environment aliases such as `%TEMP%` and `$env:TEMP`
+     * are known to resolve from this Node process. Runtime shell profiles can
+     * rewrite them before execution, so embedders must set this to false when
+     * that equivalence cannot be proven.
+     */
+    readonly trustProcessEnvironmentPathExpansion?: boolean;
+    /** Trusted host metadata used when a tool has no path-specific analyzer. */
+    readonly toolSideEffect?: ToolSideEffect;
 }
 type AutoModePermissionBoundary = 'workspace' | 'system-temp' | 'outside-workspace' | 'protected' | 'unresolved';
 interface AutoModePermissionTarget {
@@ -621,7 +690,7 @@ interface AutoModePermissionReview {
     readonly operations: readonly AutoModePermissionOperation[];
     readonly risks: readonly string[];
 }
-type AutoModeCallAnalyzer = (call: RunnerToolCall, context: AutoModeRulesContext) => AutoModePermissionReview | Promise<AutoModePermissionReview>;
+type AutoModeCallAnalyzer = (call: RunnerToolCall, context: AutoModeRulesContext) => AutoModePermissionReview | undefined | Promise<AutoModePermissionReview | undefined>;
 type AutoModeRulesDecision = {
     readonly action: 'allow';
 } | {
@@ -667,15 +736,12 @@ interface AutoModeGuardrailConfig {
     /** Mint one exact bash call for workspace-sandboxed execution. */
     readonly admitWorkspaceSandboxCall?: (call: RunnerToolCall, review: AutoModePermissionReview) => void;
     /**
-     * Runtime-owned deterministic Tier-2 evaluator. It is injected rather than
-     * implemented in @kodax/coding because canonical path and shell-AST helpers
-     * live in @kodax/repl. Omitting it preserves fail-closed SDK compatibility:
-     * every non-Tier-1 rules call escalates.
+     * Override for the coding-owned deterministic Tier-2 evaluator.
      */
     readonly evaluateRulesCall?: AutoModeRulesEvaluator;
     /**
-     * Runtime-owned compact facts used by deterministic read admission and the
-     * LLM permission reviewer. Direct read tools fail closed when this is absent.
+     * Override for the coding-owned compact permission analyzer. An override may
+     * return undefined to decline a call and leave it on the classifier path.
      */
     readonly analyzeCall?: AutoModeCallAnalyzer;
     /**
@@ -684,6 +750,8 @@ interface AutoModeGuardrailConfig {
      * receive a metadata-only fail-closed projection rather than a Tier-1 skip.
      */
     readonly getToolProjection: (toolName: string) => ((input: unknown) => string) | undefined;
+    /** Optional trusted side-effect metadata for analyzer-less tools. */
+    readonly getToolSideEffect?: (toolName: string) => ToolSideEffect | undefined;
     /**
      * Resolve a provider name to an instance. Returns `undefined` when
      * unconfigured / unknown — the guardrail then escalates.
@@ -739,8 +807,8 @@ interface AutoModeGuardrailConfig {
     readonly initialEngine?: AutoModeEngine;
     /**
      * FEATURE_092 phase 2b.7b slice C: classifier sideQuery timeout in ms.
-     * Defaults to 20_000. Resolved by the REPL from `~/.kodax/config.json`
-     * `autoMode.timeoutMs`.
+     * Defaults to 45_000 for the first attempt and 90_000 for the retry.
+     * A configured value applies to both attempts.
      */
     readonly timeoutMs?: number;
     /**
@@ -749,15 +817,18 @@ interface AutoModeGuardrailConfig {
      * doesn't use it (command-string-level) but threads it for uniform
      * collector contract.
      *
-     * Required by FEATURE_158: if omitted, the default coding-side
-     * collectors produce no `outside_project` signal (degrades gracefully),
-     * but **REPL-injected `extraCollectors` will likely require it**.
-     * SDK consumers without a project root should set `projectRoot: ''`
-     * and supply no `extraCollectors`.
+     * When omitted or blank, the guardrail uses `executionCwd`. If neither is
+     * available, path-bearing calls remain unresolved instead of borrowing the
+     * embedder process's ambient cwd as an authorization boundary.
      */
     readonly projectRoot?: string;
     /** Directory used to resolve relative tool paths. Defaults to projectRoot. */
     readonly executionCwd?: string;
+    /**
+     * Set to false when the shell profile or execution contract can rewrite
+     * process-derived path aliases such as `%TEMP%` or `$env:TEMP`.
+     */
+    readonly trustProcessEnvironmentPathExpansion?: boolean;
     /**
      * Override the default signal-collector set. When unset, defaults to
      * `[bashSignalCollector, fileSignalCollector]` — coding-side
@@ -770,17 +841,17 @@ interface AutoModeGuardrailConfig {
     readonly signalCollectors?: readonly SignalCollector[];
     /**
      * Additional signal collectors to merge with `signalCollectors`.
-     * Primary use: REPL injects a path-aware bash collector built on its
-     * own `extractPathsFromCommand` / `isAlwaysConfirmPath` utilities
-     * (those live in `@kodax/repl` for historical reasons; lifting them
-     * is out-of-scope for FEATURE_158 — see design doc layer-boundary
-     * decision).
+     * Primary use: REPL injects its path-aware bash signal collector. The
+     * underlying shell and path permission utilities are coding-owned.
      *
      * Order: defaults run first, then extras (preserves per-collector
      * signal order).
      */
     readonly extraCollectors?: readonly SignalCollector[];
-    /** Layer-owned Tier-0 checks that run after the coding-side frozen list. */
+    /**
+     * Layer-owned high-impact pattern checks. In LLM mode they add classifier
+     * evidence; in explicitly selected Rules mode they retain the legacy gate.
+     */
     readonly extraAbsoluteDenyChecks?: readonly AbsoluteDenyCheck[];
     /**
      * Speculative-classify quiet window (ms). When a classifier promise
@@ -836,5 +907,5 @@ interface AutoModeToolGuardrail extends ToolGuardrail {
 }
 declare function createAutoModeToolGuardrail(config: AutoModeGuardrailConfig): AutoModeToolGuardrail;
 
-export { createAutoModeToolGuardrail as $, CONSECUTIVE_THRESHOLD as C, DEFAULT_CLASSIFIER_TIMEOUT_MS as F, ERROR_THRESHOLD as H, WINDOW_MS as W, checkAbsoluteDeny as X, classify as Y, collectAllSignals as Z, computeRulesFingerprint as _, createCircuitBreaker as a0, createDenialTracker as a1, formatAgentsForPrompt as a2, getKodaxGlobalDir as a3, loadAgentsFiles as a4, loadAutoRules as a5, parseAutoRules as a6, readTrustState as a7, recordAllow as a8, recordBlock as a9, recordError as aa, shouldFallback$1 as ab, shouldFallback as ac, trustProjectRules as ad, CUMULATIVE_THRESHOLD as v };
-export type { AbsoluteDenyCheck as A, ClassifierToolProjectionResolver as B, ClassifyDecision as D, ClassifyOptions as E, DenialTracker as G, KodaXMcpServerConfig as I, KodaXMcpServersConfig as J, KodaXMcpConnectMode as K, KodaXMcpTransport as L, LoadAgentsOptions as M, LoadedRulesSource as N, RulesLoadResult as O, PermissionIntentEvidence as P, SkippedRulesSource as Q, RulesLoadError as R, SignalCollector as S, TierZeroPatternId as T, ToolCallSignal as U, TrustState as V, AbsoluteDenyMatch as a, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeEngine as i, AutoModeGuardrailConfig as j, AutoModePermissionBoundary as k, AutoModePermissionOperation as l, AutoModePermissionReview as m, AutoModePermissionTarget as n, AutoModeRulesContext as o, AutoModeRulesDecision as p, AutoModeRulesEvaluator as q, AutoModeSharedState as r, AutoModeStats as s, AutoModeToolGuardrail as t, AutoRules as u, CircuitBreaker as w, ClassifierAttemptDiagnostics as x, ClassifierAttemptOutcome as y, ClassifierFailureKind as z };
+export { CLASSIFIER_MAX_OUTPUT_TOKENS as C, DEFAULT_CLASSIFIER_RETRY_TIMEOUT_MS as M, DEFAULT_CLASSIFIER_TIMEOUT_MS as N, ERROR_THRESHOLD as P, WINDOW_MS as a2, checkAbsoluteDeny as a3, classify as a4, collectAllSignals as a5, computeRulesFingerprint as a6, createAutoModeToolGuardrail as a7, createCircuitBreaker as a8, createDenialTracker as a9, formatAgentsForPrompt as aa, getKodaxGlobalDir as ab, loadAgentsFiles as ac, loadAutoRules as ad, parseAutoRules as ae, parseClassifierOutput as af, readTrustState as ag, recordAllow as ah, recordBlock as ai, recordError as aj, shouldFallback as ak, shouldFallback$1 as al, trustProjectRules as am, CONSECUTIVE_THRESHOLD as v, CUMULATIVE_THRESHOLD as w };
+export type { TierZeroPatternId as $, AbsoluteDenyCheck as A, ClassifierDecision as B, ClassifierFailureKind as D, ClassifierHazard as E, ClassifierObservedProtocol as F, ClassifierOutputWarningCode as G, ClassifierParseFailureCode as H, ClassifierProtocol as I, ClassifierToolProjectionResolver as J, ClassifyDecision as K, ClassifyOptions as L, DenialTracker as O, KodaXMcpConnectMode as Q, KodaXMcpServerConfig as R, KodaXMcpServersConfig as S, KodaXMcpTransport as T, LoadAgentsOptions as U, LoadedRulesSource as V, PermissionIntentEvidence as W, RulesLoadError as X, RulesLoadResult as Y, SignalCollector as Z, SkippedRulesSource as _, AbsoluteDenyMatch as a, ToolCallSignal as a0, TrustState as a1, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeEngine as i, AutoModeGuardrailConfig as j, AutoModePermissionBoundary as k, AutoModePermissionOperation as l, AutoModePermissionReview as m, AutoModePermissionTarget as n, AutoModeRulesContext as o, AutoModeRulesDecision as p, AutoModeRulesEvaluator as q, AutoModeSharedState as r, AutoModeStats as s, AutoModeToolGuardrail as t, AutoRules as u, CircuitBreaker as x, ClassifierAttemptDiagnostics as y, ClassifierAttemptOutcome as z };

package/dist/types-chunks/{history-retrieval.d-DtCy7x64.d.ts → history-retrieval.d-DImTKgO6.d.ts}

@@ -1,5 +1,5 @@
-import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
-import { bU as KodaXSessionLineage } from './types.d-BA-Jwpfs.js';
+import { k as KodaXMessage } from './types.d-CgrXrFrq.js';
+import { c1 as KodaXSessionLineage } from './controller.d-C2aHqzHj.js';
 
 type KodaXSessionHistoryScope = 'compacted' | 'all';
 type KodaXSessionHistorySource = 'user' | 'assistant' | 'system' | 'tool' | 'child_task';
@@ -25,6 +25,12 @@ interface KodaXSessionHistorySearchResult {
     revision: string;
     hits: KodaXSessionHistoryHit[];
 }
+/** @internal Cooperative control used by Runtime history reads. */
+interface KodaXSessionHistorySearchControl {
+    readonly revision: string;
+    checkpoint(): void;
+    yieldControl(): Promise<void>;
+}
 interface KodaXSessionHistoryReadOptions {
     entryId: string;
     revision?: string;
@@ -51,7 +57,14 @@ type KodaXSessionHistoryReadResult = {
     citation: string;
 };
 declare function searchSessionHistory(lineage: KodaXSessionLineage, options: KodaXSessionHistorySearchOptions): KodaXSessionHistorySearchResult;
+/** @internal Runtime preflight; kept out of the public package barrels. */
+declare function validateSessionHistorySearchQuery(query: string): void;
+/**
+ * Runtime-facing history search that yields between bounded batches so
+ * timeout/cancel signals can be observed while indexing large transcripts.
+ */
+declare function searchSessionHistoryCooperatively(lineage: KodaXSessionLineage, options: KodaXSessionHistorySearchOptions, control: KodaXSessionHistorySearchControl): Promise<KodaXSessionHistorySearchResult>;
 declare function readSessionHistoryEntry(lineage: KodaXSessionLineage, options: KodaXSessionHistoryReadOptions): KodaXSessionHistoryReadResult;
 
-export { readSessionHistoryEntry as r, searchSessionHistory as s };
+export { searchSessionHistoryCooperatively as g, readSessionHistoryEntry as r, searchSessionHistory as s, validateSessionHistorySearchQuery as v };
 export type { KodaXSessionHistoryHit as K, KodaXSessionHistoryReadOptions as a, KodaXSessionHistoryReadResult as b, KodaXSessionHistoryScope as c, KodaXSessionHistorySearchOptions as d, KodaXSessionHistorySearchResult as e, KodaXSessionHistorySource as f };

package/dist/types-chunks/{oauth-login.d-Bgb4rdLN.d.ts → oauth-login.d-6i-vidxv.d.ts}

@@ -30,6 +30,10 @@ declare class McpAuthRequiredError extends Error {
     constructor(status: number, wwwAuthenticate?: string | undefined);
 }
 type StdioFraming = 'content-length' | 'ndjson';
+declare class McpTransportCleanupIncompleteError extends Error {
+    readonly code: "mcp_cleanup_incomplete";
+    constructor();
+}
 interface McpTransportOptions {
     stdioFraming?: StdioFraming;
     httpResolvedTransport?: 'streamable-http' | 'sse';
@@ -170,5 +174,5 @@ declare function performOAuthLogin(options: PerformOAuthLoginOptions): Promise<O
  */
 declare function loadValidToken(serverId: string): Promise<OAuthToken | undefined>;
 
-export { McpAuthRequiredError as M, McpExpiredSessionError as a, createMcpTransport as f, discoverAuthorizationServerMetadata as g, discoverOAuthEndpoints as h, discoverProtectedResourceMetadata as i, extractInsufficientScope as j, extractResourceMetadataUrl as k, loadValidToken as l, performOAuthLogin as p, registerOAuthClient as r };
-export type { AuthorizationServerMetadata as A, DiscoveredOAuthEndpoints as D, OAuthClientInfo as O, PerformOAuthLoginOptions as P, WwwAuthenticateChallenge as W, McpTransport as b, McpTransportEvents as c, OAuthLoginConsent as d, ProtectedResourceMetadata as e };
+export { McpAuthRequiredError as M, McpExpiredSessionError as a, McpTransportCleanupIncompleteError as c, createMcpTransport as g, discoverAuthorizationServerMetadata as h, discoverOAuthEndpoints as i, discoverProtectedResourceMetadata as j, extractInsufficientScope as k, extractResourceMetadataUrl as l, loadValidToken as m, performOAuthLogin as p, registerOAuthClient as r };
+export type { AuthorizationServerMetadata as A, DiscoveredOAuthEndpoints as D, OAuthClientInfo as O, PerformOAuthLoginOptions as P, WwwAuthenticateChallenge as W, McpTransport as b, McpTransportEvents as d, OAuthLoginConsent as e, ProtectedResourceMetadata as f };