@kontextmind/kxm 0.7.158 → 0.7.160

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.158",
+      "version": "0.7.160",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -414,22 +414,14 @@ All notable user-facing changes are documented here. The project follows [Semant
   reply for any declared outcome *word* and, failing that, returned `passed`. So
   `"the gate did not pass, so I would not call this passed"` settled the step as passed — the
   word was all it took — and an empty or prose-only reply was passed by default. Only a declared
-  result counts now: a reply that is one JSON object, or prose carrying an explicit
-  `{"outcome": "…"}` block, and only when the step declares that outcome. Anything else is
+  result counts now, and only when the step declares that outcome. Anything else is
   `failed`; an undeclared value still lands in `outcome_unknown` and terminates as `failed`, so a
   step without a `failed` transition cannot pass on a bad reply either. This matches the rule the
   one-shot producer already enforced, and `docs/contracts/lifecycles.md` now states it where
   `result_recorded` is defined. Three usage-capture fixtures that had been replying in prose now
   declare their result, which is what they were always supposed to do; the new test in
-  `test/core/pi-producer.test.ts` covers prose, empty, out-of-vocabulary, and both accepted
-  structured shapes. Review of that first cut found two more ways to mint success, both now
-  closed: a result block was matched **anywhere** in the reply, so
-  `Example: {"outcome": "passed"}. Actual result: {"outcome": "failed"}` returned `passed`;
-  a declaration is now a standalone JSON object — the whole reply, or one object on its own
-  line, with the **last** such object winning so an illustration cannot outrank the answer, and
-  the whole reply settling `failed` when anything after that line still looks like an outcome
-  key, because at that point the producer cannot tell which declaration was meant.
-  And cancellation fell through to `allowedOutcomes[0]` when a step declared neither
+  `test/core/pi-producer.test.ts` covers prose, empty, and out-of-vocabulary replies.
+  Cancellation fell through to `allowedOutcomes[0]` when a step declared neither
   `cancelled` nor `failed`, so aborting a `passed`-only step reported `passed`; a cancel now
   reports `cancelled` unconditionally and the engine terminates it `failed` when the step
   does not declare that outcome.
@@ -572,9 +564,7 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 ### Fixed
 
-- **A one-shot outcome is the JSON object that ends the reply.** One forward scan tracks strings, escapes, and brace depth. The newest top-level object, opened at depth 0, must close at the end of the trimmed text (one closing code fence and trailing whitespace allowed). `JSON.parse` runs once on that slice. The `outcome` must be a string in the step's declared values. Braces inside a string do not count as structure, so a summary may contain any number of `{` characters. A bare object, a fenced object, and prose followed by an object that ends the reply settle when the outcome is allowed. Prose after the object, a reply with no object, a disallowed outcome, a stray `"` in the prose, and an inner object at the end of a truncated outer object settle `failed`.
-
-- **A committed checkout counts as authored work.** The authoring witness includes `HEAD` with porcelain status and both diffs, so a write that commits its edits is `changed` and can stay `passed`. A `rev-parse` failure keeps that empty head term only when the repository has no commits; any other git failure is `unwitnessed`.
+- **A one-shot outcome is the last top-level JSON object that ends the reply.** It is accepted only when the prefix before it leaves every string, object, and array closed (a naive state machine plus a container lexer over the last container openers). Anything ambiguous, truncated, or followed by prose fails closed. The authoring witness counts `HEAD`, so a writer that commits is credited.
 
 - **The test suite no longer passes `--test-timeout`.** Under `node --test` that flag bounds each file, so coverage on CI timed out `test/core/engine.test.ts` at three minutes. The wall clock in `scripts/run-bounded.mjs` still bounds each script.
 
@@ -892,8 +882,6 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 - **Dry-run ship status no longer rewrites `.git/index`.** `git status` refreshes the index under an optional lock. The ship-status read passes `--no-optional-locks`, so a dry run leaves the checkout untouched.
 
-- **A committed checkout counts as authored work, and a one-shot outcome must be a standalone JSON object.** The authoring witness includes `HEAD` with porcelain status and both diffs, so a write that commits its edits is `changed` and can stay `passed`. A `rev-parse` failure keeps that empty head term only when the repository has no commits; any other git failure is `unwitnessed`. A one-shot outcome is accepted when the whole reply is one JSON object, or when that object stands alone on the final line. A closing code fence around the final object is allowed. An object followed by prose, a truncated reply, and an ambiguous tail settle `failed`.
-
 ## 0.7.0 - 2026-09-11
 
 ### Added

package/docs/contracts/lifecycles.md

@@ -106,17 +106,28 @@ created → accepted → dispatched → executing → result_recorded → termin
 | `terminal` | The logical assignment outcome is final and immutable: passed, failed, or cancelled |
 
 A producer reply becomes a terminal outcome **only** through a declared result. A one-shot
-reply declares that result when one forward scan finds a JSON object that closes at the
-end of the trimmed text. The scan tracks strings, escapes, and brace depth together. A
-`{` outside a string at depth 0 opens a top-level object, and the newest object that
-returns to depth 0 is the candidate. One closing code fence may follow the object, with
-whitespace. The object may be the whole reply, a fenced reply, or the end of surrounding
-prose, on one line or several. `JSON.parse` runs once on that slice. The value must be a
-plain object whose `outcome` string is one of the step's declared values. Braces inside
-strings do not change depth. A stray `"` leaves the scan inside a string, so a following
-object is not top-level and settles `failed`. Prose after the object, a reply with no
-such object, a disallowed outcome, and an inner object at the end of a truncated outer
-object settle `failed`.
+reply declares that result when a candidate slice from a `{` to a `}` parses as a JSON
+object that closes at the end of the trimmed text. Candidates are tried nearest last.
+The walk considers at most the last 32 closers and the last 32 openers, skips a slice
+whose UTF-8 size is over 256 KiB, and stops after 1 MiB of UTF-8 bytes from parsed
+slices. One closing code fence may follow the object, with whitespace. The object may be the whole reply, a fenced reply,
+or the end of surrounding prose, on one line or several. `JSON.parse` is the authority
+for strings and escapes inside the slice. The value must be a plain object whose
+`outcome` string is one of the step's declared values. The prefix before that opener,
+with trailing whitespace removed, is scanned by a naive JSON lexer: an unescaped quote
+toggles string state, a backslash escapes the next character inside a string, and `{`
+and `[` track depth. Extra `}` and `]` do not drive depth below zero. The candidate is
+accepted only when that scan ends at depth 0 for both braces and arrays, outside a
+string, with no dangling escape. Any other end state is truncated or ambiguous, so
+that candidate is rejected and the next one is tried. The naive machine plus a
+container-lexer guard reject truncation. For each of the last 16 `{` or `[`
+openers in the prefix, a lexer from that opener through the end of the body
+rejects the candidate when the scan stays valid and ends inside a container or
+a string. A quote is not an opener. Prose with an odd quote count fails closed.
+Quotes, backticks, and balanced braces in the prose do not hide an
+object that ends the reply. Prose after the object, a reply with no such object, a
+disallowed outcome, an inner object at the end of a truncated outer object or array,
+and an object inside an unclosed string settle `failed`.
 
 Naming an outcome *word* anywhere in a reply is not a result. `"the gate did not pass, so I
 would not call this passed"` must not advance a step, and an empty or unstructured reply is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.158",
+  "version": "0.7.160",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.158",
+  "version": "0.7.160",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -27105,6 +27105,7 @@ var init_engine = __esm({
 });
 
 // plugins/kxm/src/oneshot-producer.ts
+var MAX_OUTCOME_SLICE_BYTES, MAX_OUTCOME_PARSE_BYTES;
 var init_oneshot_producer = __esm({
   "plugins/kxm/src/oneshot-producer.ts"() {
     "use strict";
@@ -27114,6 +27115,8 @@ var init_oneshot_producer = __esm({
     init_harness();
     init_prices();
     init_engine();
+    MAX_OUTCOME_SLICE_BYTES = 256 * 1024;
+    MAX_OUTCOME_PARSE_BYTES = 1024 * 1024;
   }
 });
 

package/plugins/kxm/dist/mcp-server.js

@@ -17313,7 +17313,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.158";
+var VERSION = "0.7.160";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/dist/runtime-supervisor.js

@@ -30790,18 +30790,46 @@ function stripOneClosingFence(trimmed) {
   if (lineBreak < 0) return "";
   return trimmed.slice(0, lineBreak).trimEnd();
 }
-function determineOutcome(text, allowedOutcomes) {
-  const trimmed = text.trim();
-  if (!trimmed) return "failed";
-  const body = stripOneClosingFence(trimmed);
-  if (!body) return "failed";
-  let depth = 0;
+var MAX_OUTCOME_CLOSERS = 32;
+var MAX_OUTCOME_OPENERS = 32;
+var MAX_OUTCOME_SLICE_BYTES = 256 * 1024;
+var MAX_OUTCOME_PARSE_BYTES = 1024 * 1024;
+var MAX_PREFIX_CONTAINER_OPENERS = 16;
+function outcomePrefixIsAnchored(prefix) {
+  let objectDepth = 0;
+  let arrayDepth = 0;
+  let inString = false;
+  let escape2 = false;
+  for (let i = 0; i < prefix.length; i++) {
+    const ch = prefix[i];
+    if (inString) {
+      if (escape2) {
+        escape2 = false;
+        continue;
+      }
+      if (ch === "\\") {
+        escape2 = true;
+        continue;
+      }
+      if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      continue;
+    }
+    if (ch === "{") objectDepth += 1;
+    else if (ch === "}" && objectDepth > 0) objectDepth -= 1;
+    else if (ch === "[") arrayDepth += 1;
+    else if (ch === "]" && arrayDepth > 0) arrayDepth -= 1;
+  }
+  return objectDepth === 0 && arrayDepth === 0 && !inString && !escape2;
+}
+function containerLexIsTruncated(body, start) {
+  const stack = [];
   let inString = false;
   let escape2 = false;
-  let currentStart = -1;
-  let objectStart = -1;
-  let objectEnd = -1;
-  for (let i = 0; i < body.length; i++) {
+  for (let i = start; i < body.length; i++) {
     const ch = body[i];
     if (inString) {
       if (escape2) {
@@ -30819,31 +30847,67 @@ function determineOutcome(text, allowedOutcomes) {
       inString = true;
       continue;
     }
-    if (ch === "{") {
-      if (depth === 0) currentStart = i;
-      depth++;
+    if (ch === "{" || ch === "[") {
+      stack.push(ch);
       continue;
     }
-    if (ch === "}") {
-      if (depth === 0) continue;
-      depth--;
-      if (depth === 0) {
-        objectStart = currentStart;
-        objectEnd = i;
-      }
+    if (ch === "}" || ch === "]") {
+      const open2 = ch === "}" ? "{" : "[";
+      const top = stack[stack.length - 1];
+      if (top !== open2) return false;
+      stack.pop();
     }
   }
-  if (objectStart < 0 || objectEnd !== body.length - 1) return "failed";
-  let result;
-  try {
-    result = JSON.parse(body.slice(objectStart, objectEnd + 1));
-  } catch {
-    return "failed";
+  return stack.length > 0 || inString || escape2;
+}
+function prefixHidesTruncatedContainer(body, openAt) {
+  let seen = 0;
+  for (let i = openAt - 1; i >= 0; i--) {
+    const ch = body[i];
+    if (ch !== "{" && ch !== "[") continue;
+    if (seen >= MAX_PREFIX_CONTAINER_OPENERS) return true;
+    seen++;
+    if (containerLexIsTruncated(body, i)) return true;
+  }
+  return false;
+}
+function determineOutcome(text, allowedOutcomes) {
+  const trimmed = text.trim();
+  if (!trimmed) return "failed";
+  const body = stripOneClosingFence(trimmed);
+  if (!body) return "failed";
+  let seenClosers = 0;
+  let parseBytes = 0;
+  for (let closeAt = body.length - 1; closeAt >= 0 && seenClosers < MAX_OUTCOME_CLOSERS; closeAt--) {
+    if (body[closeAt] !== "}") continue;
+    seenClosers++;
+    const end = closeAt + 1;
+    if (end !== body.length) continue;
+    let seenOpeners = 0;
+    for (let openAt = closeAt - 1; openAt >= 0 && seenOpeners < MAX_OUTCOME_OPENERS; openAt--) {
+      if (body[openAt] !== "{") continue;
+      seenOpeners++;
+      const slice = body.slice(openAt, end);
+      const sliceBytes = Buffer.byteLength(slice, "utf8");
+      if (sliceBytes > MAX_OUTCOME_SLICE_BYTES) break;
+      if (parseBytes + sliceBytes > MAX_OUTCOME_PARSE_BYTES) return "failed";
+      parseBytes += sliceBytes;
+      let result;
+      try {
+        result = JSON.parse(slice);
+      } catch {
+        continue;
+      }
+      if (!result || typeof result !== "object" || Array.isArray(result)) continue;
+      const outcome = result.outcome;
+      if (typeof outcome !== "string" || !allowedOutcomes.includes(outcome)) continue;
+      const prefix = body.slice(0, openAt).trimEnd();
+      if (!outcomePrefixIsAnchored(prefix)) continue;
+      if (prefixHidesTruncatedContainer(body, openAt)) continue;
+      return outcome;
+    }
   }
-  if (!result || typeof result !== "object" || Array.isArray(result)) return "failed";
-  const outcome = result.outcome;
-  if (typeof outcome !== "string" || !allowedOutcomes.includes(outcome)) return "failed";
-  return outcome;
+  return "failed";
 }
 function createKxmOneShotProducer(options = {}) {
   const running = /* @__PURE__ */ new Map();

package/plugins/kxm/dist/runtime.js

@@ -31538,18 +31538,46 @@ function stripOneClosingFence(trimmed) {
   if (lineBreak < 0) return "";
   return trimmed.slice(0, lineBreak).trimEnd();
 }
-function determineOutcome(text, allowedOutcomes) {
-  const trimmed = text.trim();
-  if (!trimmed) return "failed";
-  const body = stripOneClosingFence(trimmed);
-  if (!body) return "failed";
-  let depth = 0;
+var MAX_OUTCOME_CLOSERS = 32;
+var MAX_OUTCOME_OPENERS = 32;
+var MAX_OUTCOME_SLICE_BYTES = 256 * 1024;
+var MAX_OUTCOME_PARSE_BYTES = 1024 * 1024;
+var MAX_PREFIX_CONTAINER_OPENERS = 16;
+function outcomePrefixIsAnchored(prefix) {
+  let objectDepth = 0;
+  let arrayDepth = 0;
+  let inString = false;
+  let escape2 = false;
+  for (let i = 0; i < prefix.length; i++) {
+    const ch = prefix[i];
+    if (inString) {
+      if (escape2) {
+        escape2 = false;
+        continue;
+      }
+      if (ch === "\\") {
+        escape2 = true;
+        continue;
+      }
+      if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      continue;
+    }
+    if (ch === "{") objectDepth += 1;
+    else if (ch === "}" && objectDepth > 0) objectDepth -= 1;
+    else if (ch === "[") arrayDepth += 1;
+    else if (ch === "]" && arrayDepth > 0) arrayDepth -= 1;
+  }
+  return objectDepth === 0 && arrayDepth === 0 && !inString && !escape2;
+}
+function containerLexIsTruncated(body, start) {
+  const stack = [];
   let inString = false;
   let escape2 = false;
-  let currentStart = -1;
-  let objectStart = -1;
-  let objectEnd = -1;
-  for (let i = 0; i < body.length; i++) {
+  for (let i = start; i < body.length; i++) {
     const ch = body[i];
     if (inString) {
       if (escape2) {
@@ -31567,31 +31595,67 @@ function determineOutcome(text, allowedOutcomes) {
       inString = true;
       continue;
     }
-    if (ch === "{") {
-      if (depth === 0) currentStart = i;
-      depth++;
+    if (ch === "{" || ch === "[") {
+      stack.push(ch);
       continue;
     }
-    if (ch === "}") {
-      if (depth === 0) continue;
-      depth--;
-      if (depth === 0) {
-        objectStart = currentStart;
-        objectEnd = i;
-      }
+    if (ch === "}" || ch === "]") {
+      const open2 = ch === "}" ? "{" : "[";
+      const top = stack[stack.length - 1];
+      if (top !== open2) return false;
+      stack.pop();
     }
   }
-  if (objectStart < 0 || objectEnd !== body.length - 1) return "failed";
-  let result;
-  try {
-    result = JSON.parse(body.slice(objectStart, objectEnd + 1));
-  } catch {
-    return "failed";
+  return stack.length > 0 || inString || escape2;
+}
+function prefixHidesTruncatedContainer(body, openAt) {
+  let seen = 0;
+  for (let i = openAt - 1; i >= 0; i--) {
+    const ch = body[i];
+    if (ch !== "{" && ch !== "[") continue;
+    if (seen >= MAX_PREFIX_CONTAINER_OPENERS) return true;
+    seen++;
+    if (containerLexIsTruncated(body, i)) return true;
+  }
+  return false;
+}
+function determineOutcome(text, allowedOutcomes) {
+  const trimmed = text.trim();
+  if (!trimmed) return "failed";
+  const body = stripOneClosingFence(trimmed);
+  if (!body) return "failed";
+  let seenClosers = 0;
+  let parseBytes = 0;
+  for (let closeAt = body.length - 1; closeAt >= 0 && seenClosers < MAX_OUTCOME_CLOSERS; closeAt--) {
+    if (body[closeAt] !== "}") continue;
+    seenClosers++;
+    const end = closeAt + 1;
+    if (end !== body.length) continue;
+    let seenOpeners = 0;
+    for (let openAt = closeAt - 1; openAt >= 0 && seenOpeners < MAX_OUTCOME_OPENERS; openAt--) {
+      if (body[openAt] !== "{") continue;
+      seenOpeners++;
+      const slice = body.slice(openAt, end);
+      const sliceBytes = Buffer.byteLength(slice, "utf8");
+      if (sliceBytes > MAX_OUTCOME_SLICE_BYTES) break;
+      if (parseBytes + sliceBytes > MAX_OUTCOME_PARSE_BYTES) return "failed";
+      parseBytes += sliceBytes;
+      let result;
+      try {
+        result = JSON.parse(slice);
+      } catch {
+        continue;
+      }
+      if (!result || typeof result !== "object" || Array.isArray(result)) continue;
+      const outcome = result.outcome;
+      if (typeof outcome !== "string" || !allowedOutcomes.includes(outcome)) continue;
+      const prefix = body.slice(0, openAt).trimEnd();
+      if (!outcomePrefixIsAnchored(prefix)) continue;
+      if (prefixHidesTruncatedContainer(body, openAt)) continue;
+      return outcome;
+    }
   }
-  if (!result || typeof result !== "object" || Array.isArray(result)) return "failed";
-  const outcome = result.outcome;
-  if (typeof outcome !== "string" || !allowedOutcomes.includes(outcome)) return "failed";
-  return outcome;
+  return "failed";
 }
 function createKxmOneShotProducer(options = {}) {
   const running = /* @__PURE__ */ new Map();

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.158",
+  "version": "0.7.160",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.158";
+const VERSION = "0.7.160";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();

package/plugins/kxm/src/oneshot-producer.ts

@@ -65,32 +65,77 @@ function stripOneClosingFence(trimmed: string): string {
   return trimmed.slice(0, lineBreak).trimEnd();
 }
 
-// The outcome object is the newest complete top-level JSON object in the
-// trimmed reply, and that object must close on the reply's last character.
-// One closing code fence may follow it; the fence is removed before the scan.
-// One forward pass tracks string state and brace depth together. A `"` toggles
-// a string, and `\` escapes only inside a string. A `{` outside a string at
-// depth 0 opens a top-level object. When depth returns to 0, that object is
-// the newest complete top-level object. Braces inside strings do not change
-// depth, so the same scan shows that the object started at depth 0 and that
-// quotes in the prefix are closed. After the scan, if that object closes at
-// the end of the body, JSON.parse runs once on the slice. The value must be
-// a plain object whose outcome is a string in allowedOutcomes. Anything else
-// is failed: prose after the object, no object, a disallowed outcome, an
-// inner object at the end of a truncated outer object, a stray quote that
-// leaves a string open, or a prefix whose braces never return to depth 0.
-function determineOutcome(text: string, allowedOutcomes: readonly string[]): string {
-  const trimmed = text.trim();
-  if (!trimmed) return "failed";
-  const body = stripOneClosingFence(trimmed);
-  if (!body) return "failed";
-  let depth = 0;
+// How many `}` characters, counting from the end of the reply, we will try
+// as the end of an outcome object.
+const MAX_OUTCOME_CLOSERS = 32;
+
+// How many `{` openers before that closer we will consider, nearest last.
+const MAX_OUTCOME_OPENERS = 32;
+
+// A candidate whose UTF-8 size is over this is not parsed. Older openers
+// for the same closer contain the nearer slice, so the opener walk stops
+// there. The count is Buffer.byteLength, not JavaScript string length.
+const MAX_OUTCOME_SLICE_BYTES = 256 * 1024;
+
+// Total UTF-8 bytes of candidate slices JSON.parse may see in one lookup.
+// Crossing this budget stops the lookup. Same byte measure as the slice cap.
+const MAX_OUTCOME_PARSE_BYTES = 1024 * 1024;
+
+// How many `{` / `[` openers at the end of the prefix are re-lexed. A `"`
+// is not an opener. Each re-lex walks the body from that opener to the end,
+// so the lexer work is linear in the body per opener checked, per candidate.
+// This cap only limits how many openers are re-lexed. It does not bound the
+// lexer. The slice budgets bound JSON.parse bytes, not these scans. If the
+// walk reaches the cap and another container opener is still earlier in the
+// prefix, the prefix is ambiguous and the candidate is rejected.
+const MAX_PREFIX_CONTAINER_OPENERS = 16;
+
+// Naive prefix scan. Quote handling toggles on every unescaped `"`. Braces
+// and brackets count only outside a string. Extra closers stay at depth 0
+// because they are prose, not an unclosed container. The slice itself is
+// not scanned: JSON.parse owns strings and escapes there. O(prefix).
+function outcomePrefixIsAnchored(prefix: string): boolean {
+  let objectDepth = 0;
+  let arrayDepth = 0;
   let inString = false;
   let escape = false;
-  let currentStart = -1;
-  let objectStart = -1;
-  let objectEnd = -1;
-  for (let i = 0; i < body.length; i++) {
+  for (let i = 0; i < prefix.length; i++) {
+    const ch = prefix[i];
+    if (inString) {
+      if (escape) {
+        escape = false;
+        continue;
+      }
+      if (ch === "\\") {
+        escape = true;
+        continue;
+      }
+      if (ch === "\"") inString = false;
+      continue;
+    }
+    if (ch === "\"") {
+      inString = true;
+      continue;
+    }
+    if (ch === "{") objectDepth += 1;
+    else if (ch === "}" && objectDepth > 0) objectDepth -= 1;
+    else if (ch === "[") arrayDepth += 1;
+    else if (ch === "]" && arrayDepth > 0) arrayDepth -= 1;
+  }
+  return objectDepth === 0 && arrayDepth === 0 && !inString && !escape;
+}
+
+// Same string, escape, and depth machine as the prefix scan, started at a
+// `{` or `[`. A closer that does not match an opener this scan pushed is
+// invalid. An invalid scan is not truncation. Truncation is a valid scan
+// that reaches the end of the body still inside a container or a string.
+// One call walks from `start` through the rest of the body. The walk is
+// linear in that span. No byte budget stops it.
+function containerLexIsTruncated(body: string, start: number): boolean {
+  const stack: string[] = [];
+  let inString = false;
+  let escape = false;
+  for (let i = start; i < body.length; i++) {
     const ch = body[i];
     if (inString) {
       if (escape) {
@@ -101,38 +146,103 @@ function determineOutcome(text: string, allowedOutcomes: readonly string[]): str
         escape = true;
         continue;
       }
-      if (ch === '"') inString = false;
+      if (ch === "\"") inString = false;
       continue;
     }
-    if (ch === '"') {
+    if (ch === "\"") {
       inString = true;
       continue;
     }
-    if (ch === "{") {
-      if (depth === 0) currentStart = i;
-      depth++;
+    if (ch === "{" || ch === "[") {
+      stack.push(ch);
       continue;
     }
-    if (ch === "}") {
-      if (depth === 0) continue;
-      depth--;
-      if (depth === 0) {
-        objectStart = currentStart;
-        objectEnd = i;
-      }
+    if (ch === "}" || ch === "]") {
+      const open = ch === "}" ? "{" : "[";
+      const top = stack[stack.length - 1];
+      if (top !== open) return false;
+      stack.pop();
     }
   }
-  if (objectStart < 0 || objectEnd !== body.length - 1) return "failed";
-  let result: unknown;
-  try {
-    result = JSON.parse(body.slice(objectStart, objectEnd + 1));
-  } catch {
-    return "failed";
+  return stack.length > 0 || inString || escape;
+}
+
+// True when one of the last container openers in the prefix lexes as a
+// value that is still open at the end of the body, or when more container
+// openers sit further back than the re-lex cap. Those further openers are
+// not scanned. The prefix is ambiguous, so the candidate fails closed.
+// Quote positions are left to the naive machine.
+function prefixHidesTruncatedContainer(body: string, openAt: number): boolean {
+  let seen = 0;
+  for (let i = openAt - 1; i >= 0; i--) {
+    const ch = body[i];
+    if (ch !== "{" && ch !== "[") continue;
+    if (seen >= MAX_PREFIX_CONTAINER_OPENERS) return true;
+    seen++;
+    if (containerLexIsTruncated(body, i)) return true;
+  }
+  return false;
+}
+
+// The outcome object is a JSON object that ends the trimmed reply. One
+// closing code fence may follow it; the fence is removed before the walk.
+// Candidates are slices from a `{` to a recent `}`, nearest last. Only the
+// last 32 closers are visited, and only a closer on the reply's last
+// character can end the reply. For that closer the last 32 openers are
+// tried. A slice whose UTF-8 size is over 256 KiB is skipped. Parsed slices
+// share a 1 MiB UTF-8 budget, and crossing it stops the lookup. Both limits
+// use Buffer.byteLength. JSON.parse is the only
+// string and escape authority inside the slice. A slice that parses to a
+// plain object whose outcome is a string in allowedOutcomes is a candidate.
+// The prefix before that opener, with trailing whitespace removed, must end
+// at depth 0 for both braces and arrays, outside a string, with no dangling
+// escape. Any other end state is truncated or ambiguous, so the candidate
+// is rejected and the next one is tried. The naive machine plus the
+// container-lexer guard reject truncation. A prefix with more container
+// openers than the re-lex cap is ambiguous and fails closed. Prose with an
+// odd quote count fails closed. An accepted candidate ends the lookup.
+// Nothing left is failed: prose after the object, no object, a disallowed
+// outcome, an inner object at the end of a truncated outer object or array,
+// an object inside an unclosed string, an ambiguous prefix past the re-lex
+// cap, or a budget exhausted before a candidate.
+function determineOutcome(text: string, allowedOutcomes: readonly string[]): string {
+  const trimmed = text.trim();
+  if (!trimmed) return "failed";
+  const body = stripOneClosingFence(trimmed);
+  if (!body) return "failed";
+  let seenClosers = 0;
+  let parseBytes = 0;
+  for (let closeAt = body.length - 1; closeAt >= 0 && seenClosers < MAX_OUTCOME_CLOSERS; closeAt--) {
+    if (body[closeAt] !== "}") continue;
+    seenClosers++;
+    const end = closeAt + 1;
+    // A candidate has to end the reply. One closer can sit at that position.
+    if (end !== body.length) continue;
+    let seenOpeners = 0;
+    for (let openAt = closeAt - 1; openAt >= 0 && seenOpeners < MAX_OUTCOME_OPENERS; openAt--) {
+      if (body[openAt] !== "{") continue;
+      seenOpeners++;
+      const slice = body.slice(openAt, end);
+      const sliceBytes = Buffer.byteLength(slice, "utf8");
+      if (sliceBytes > MAX_OUTCOME_SLICE_BYTES) break;
+      if (parseBytes + sliceBytes > MAX_OUTCOME_PARSE_BYTES) return "failed";
+      parseBytes += sliceBytes;
+      let result: unknown;
+      try {
+        result = JSON.parse(slice);
+      } catch {
+        continue;
+      }
+      if (!result || typeof result !== "object" || Array.isArray(result)) continue;
+      const outcome = (result as Record<string, unknown>).outcome;
+      if (typeof outcome !== "string" || !allowedOutcomes.includes(outcome)) continue;
+      const prefix = body.slice(0, openAt).trimEnd();
+      if (!outcomePrefixIsAnchored(prefix)) continue;
+      if (prefixHidesTruncatedContainer(body, openAt)) continue;
+      return outcome;
+    }
   }
-  if (!result || typeof result !== "object" || Array.isArray(result)) return "failed";
-  const outcome = (result as Record<string, unknown>).outcome;
-  if (typeof outcome !== "string" || !allowedOutcomes.includes(outcome)) return "failed";
-  return outcome;
+  return "failed";
 }
 
 export function createKxmOneShotProducer(options: KxmOneShotProducerOptions = {}): KxmOneShotProducer {