@leuduan/lagent 0.1.2 → 44.0.0

package/dist/context.d.ts

@@ -1,16 +1,25 @@
 import type { Scoped } from '@leuduan/cordis';
 import type { JournalCommitError, PluginJournal } from './journal/index.js';
 import type { ModelRequestDraft, ModelStep, SentRequest, StopVerdict, ToolAuthorizationRequest, ToolPolicyDecision, ToolInvocation, ToolOutcome, TurnStop } from './loop/index.js';
-import type { StreamingLLMResponse } from './llm/index.js';
+import type { StreamingLLMResponse } from './llm/client.js';
 import type { AgentsService } from './services/agents.js';
 import type { LlmService } from './services/llm.js';
-import type { LaunchesService } from './services/launches.js';
+import type { ConfinementOperation, ConfinementService } from './services/confinement/service.js';
 import type { PromptsService } from './services/prompts.js';
-import type { ThreadDirsService } from './services/threadDirs.js';
-import type { PresetsService } from './services/presets.js';
-import type { Threads } from './services/threads.js';
+import type { PresetsService } from './services/presets/installations.js';
+import type { Threads } from './services/threads/index.js';
 import type { ToolsService } from './services/tools.js';
-import type { Thread } from './services/thread.js';
+import type { Thread } from './services/threads/index.js';
+declare module './loop/tool.js' {
+    interface InvocationContext {
+        /**
+         * The call's confinement operation: its file access (`files`) and the launches of any process it
+         * starts, under one snapshot taken on first use. Opened for the call and ended with it, so a
+         * reference that outlives the call is dead.
+         */
+        readonly operation: ConfinementOperation;
+    }
+}
 declare module '@leuduan/cordis' {
     interface Context {
         /** The journal: the one durable state, and the folds over it; a plugin appends its own `ext` rows. */
@@ -25,12 +34,10 @@ declare module '@leuduan/cordis' {
         prompts: PromptsService;
         /** Starting and finding threads, and what happens to them as a set; one thread is driven through its `Thread`. */
         threads: Threads;
-        /** Each thread's own directory under the application data directory. */
-        threadDirs: ThreadDirsService;
         /** Presets a thread can install, their validation, hand-downs and restoration. */
         presets: PresetsService;
         /** How model-driven processes launch: plain, or through the one handler a host registers. */
-        launches: LaunchesService;
+        confinement: ConfinementService;
     }
     interface Events {
         /**
@@ -65,7 +72,8 @@ declare module '@leuduan/cordis' {
          * A turn's answer — a reply with no tool calls, or a result that concluded the turn — is about
          * to become the thread's answer. Return `undefined` to accept it, `{ decision: 'continue',
          * message }` to send the model back in the same turn, or `{ decision: 'reject', reason, source }`
-         * to end the turn `rejected`. Any rejection wins, then any continuation. Consulted whatever the
+         * to end the turn `rejected`, or `{ decision: 'prepare', request }` to plan a runtime operation
+         * before final judgment. Rejection wins, then continuation, then preparation. Consulted whatever the
          * step budget, and again after a crash, abort or failure left the answer unjudged. A check
          * declares the facts its verdict rests on with `stop.observe(read)`; the judgment is discarded if
          * one reads differently when it is recorded.

package/dist/index.d.ts

@@ -4,11 +4,12 @@
  *
  * The package has a few doors and nothing else: this one for applications, `@leuduan/lagent/plugin`
  * for plugin authors, `@leuduan/lagent/llm` for the model and provider contracts,
- * `@leuduan/lagent/providers` for the shipped providers, `@leuduan/lagent/sqlite` for the SQLite store
- * (which needs `node:sqlite`), `@leuduan/lagent/models` for the serialized shapes, one
+ * `@leuduan/lagent/providers` for the shipped providers, `@leuduan/lagent/stores/sqlite` for the SQLite store
+ * (which needs `node:sqlite`), `@leuduan/lagent/records` for the serialized shapes, one
  * `@leuduan/lagent/plugins/<name>` per shipped plugin, and `@leuduan/lagent/testing` for test doubles. A
  * value lives on one door: this one holds what an application constructs (the core, the memory
- * store), catches (the errors) or composes from `presets/`; a shipped plugin's exports, its presets
+ * store), catches (the errors), composes from `compositions/` or runs as a host-owned process
+ * (`spawnCommand`, `runToCompletion`: servers and probes the host starts, never a tool's work); a shipped plugin's exports, its presets
  * included, are on its own door. The core's services are reached as `ctx.<name>`, so their classes
  * are exported as types only. Keep this
  * entry point small enough that an embedder can understand it without first learning the engine
@@ -22,26 +23,33 @@ export type { ToolsService } from './services/tools.js';
 export { registerProvider } from './services/llm.js';
 export type { LlmService, RetryPolicy } from './services/llm.js';
 export type { PromptsService } from './services/prompts.js';
-export { registerPreset } from './services/presets.js';
-export type { ConfigurationPlan, InitialInstallationInput, InstallationInput, PresetsService, } from './services/presets.js';
-export { UNCONFINED_LAUNCH } from './services/launches.js';
-export type { LaunchesService, Launched, LaunchHandle, LaunchHandler, LaunchOptions, LaunchProvenance, LaunchRequest, PreparedLaunch, } from './services/launches.js';
-export type { ThreadDirsConfig, ThreadDirsService } from './services/threadDirs.js';
-export type { ConfigurationChange, ConfigurationResult, RetainOptions, RetainedMembers, Retention, ThreadFilter, Threads, ThreadsConfig, ThreadsService, } from './services/threads.js';
-export type { MissingDetail, OwnerHandle, OwnerReadiness, OwnerRegistration, StartOptions, StartupPolicy, ThreadInspection, WaitResolution, WaitValue, } from './services/owner.js';
-export { heldOrSettled, UnknownRunError, waitForRun } from './services/runEvents.js';
-export type { RunEvent, RunSource, RunState } from './services/runEvents.js';
-export type { BirthChoice, BirthInput, CreateThreadOptions, ForkCut, ForkOptions, Opening, Reuse, } from './services/birth.js';
-export { Thread } from './services/thread.js';
-export type { ThreadView } from './services/threadView.js';
-export type { CancelOptions, ConfirmationAnswer } from './services/thread.js';
-export { repositoryReadRoots } from './sys/git.js';
-export { buildSpawnEnvironment, CODEX_ENVIRONMENT_POLICY, NON_INTERACTIVE_ENVIRONMENT, resolveTrustedPrograms, } from './sys/environment.js';
+export { registerPreset } from './services/presets/installations.js';
+export type { ConfigurationPlan, InitialInstallationInput, InstallationInput, PresetsService, } from './services/presets/installations.js';
+export { UNCONFINED_LAUNCH } from './services/confinement/service.js';
+export { FileAccessError } from './services/confinement/files.js';
+export type { DirEntry, DirListing, FileScope, PathOptions, ReadHandle, WriteHandle, } from './services/confinement/files.js';
+export type { ConfinementHandle, ConfinementHandler, ConfinementOperation, ConfinementService, ConfinementSnapshot, FileAccess, FilePolicy, FileVerdict, Launched, LaunchOptions, LaunchProgram, LaunchProvenance, LaunchRequest, PreparedLaunch, } from './services/confinement/service.js';
+export type { ConfigurationChange, ConfigurationResult, RetainOptions, RetainedMembers, Retention, ThreadFilter, Threads, ThreadsConfig, ThreadsService, } from './services/threads/index.js';
+export type { MissingDetail, OwnerHandle, OwnerReadiness, OwnerRegistration, StartOptions, StartupPolicy, ThreadInspection, WaitResolution, WaitValue, } from './services/threads/index.js';
+export { heldOrSettled, UnknownRunError, waitForRun } from './services/threads/index.js';
+export type { RunEvent, RunSource, RunState } from './services/threads/index.js';
+export type { BirthChoice, BirthInput, CreateThreadOptions, ForkCut, ForkOptions, Opening, Reuse, } from './services/threads/index.js';
+export type { Thread } from './services/threads/index.js';
+export type { ThreadView } from './services/threads/index.js';
+export type { CancelOptions, ConfirmationAnswer } from './services/threads/index.js';
+export { buildSpawnEnvironment, NON_INTERACTIVE_ENVIRONMENT, resolveTrustedPrograms } from './sys/environment.js';
+export { CODEX_ENVIRONMENT_POLICY } from './compositions/codex.js';
 export type { SpawnEnvironmentPolicy, TrustedPrograms } from './sys/environment.js';
-export type { ChainStanding, CompactOptions, ConfirmationState, ForkPoint, InputFate, InstallationRecord, ModelSelection, ReplacementRule, RouteStatement, Target, ConstraintAnswer, Hold, HoldBasis, HoldReason, BirthConflict, BirthSpec, ForkOpening, FreshOpening, Refusal, RowRef, RunOutcome, RowsResult, RowsWrite, InputReceipt, SendOptions, SendOutcome, StreamedChunk, SurfacePrepareOutcome, TurnLimits, WaitDeclaration, WaitEntry, WithdrawOptions, WithdrawOutcome, WithdrawRows, } from './loop/index.js';
-export { AuxiliaryRefusedError, BirthConflictError, ConfirmationAnsweredError, CorruptHistoryError, DepthExceededError, ForkCutError, ReplacementRefusedError, RestoreFailedError, RouteConflictError, RouteUnavailableError, ThreadActivatingError, ThreadBusyError, ThreadUnsettledError, UnknownAgentError, UnknownThreadError, WriteRefusedError, } from './loop/index.js';
+export { runToCompletion, spawnCommand } from './sys/spawn.js';
+export type { SpawnEnvironment, SpawnOptions, SpawnResult, SpawnStdio, SpawnedCommand, SpawnedGroup, SpawnedPipes, StopCause, } from './sys/spawn.js';
+export type { ChainStanding, ConfirmationState, ForkPoint, InputFate, InstallationRecord, ReplacementRule, RouteStatement, Target, ConstraintAnswer, Hold, HoldBasis, HoldReason, BirthSpec, ForkOpening, FreshOpening, Refusal, RowRef, RunOutcome, RowsResult, RowsWrite, InputReceipt, SendOptions, SendOutcome, TurnLimits, WaitDeclaration, WaitEntry, WithdrawOptions, WithdrawOutcome, WithdrawRows, } from './state/index.js';
+export type { CompactOptions, BirthConflict, StreamedChunk, SurfacePrepareOutcome } from './loop/index.js';
+export type { ModelSelection } from './llm/provider.js';
+export { AuxiliaryRefusedError, BirthConflictError, ConfirmationAnsweredError, CorruptHistoryError, DepthExceededError, RestoreFailedError, ThreadActivatingError, ThreadBusyError, ThreadUnsettledError, UnknownAgentError, WriteRefusedError, } from './loop/index.js';
+export { ForkCutError, ReplacementRefusedError, RouteConflictError, RouteUnavailableError, UnknownThreadError, } from './state/index.js';
 export { CorruptJournalError, forkChain, IncompatibleJournalError, InvalidOriginError, JournalBusyError, JournalCommitError, StoreBusyError, } from './journal/index.js';
 export type { AppendOutcome, Attempt, ForkLink, InvalidOriginReason, JournalStore, ThreadIndexEntry, ThreadSummaryCore, WriterLease, } from './journal/index.js';
-export { MemoryJournalStore } from './plugins/store/memory.js';
-export { base, codexPreset } from './presets/index.js';
-export { COMMUNICATION_GUIDANCE_PROMPT, FORMATTING_PROMPT } from './presets/prompts.js';
+export { MemoryJournalStore } from './stores/memory.js';
+export { base } from './compositions/base.js';
+export { codexPreset } from './compositions/codex.js';
+export { COMMUNICATION_GUIDANCE_PROMPT, FORMATTING_PROMPT } from './compositions/codexPrompts.js';

package/dist/index.js

@@ -1,77 +1 @@
-import{d as L}from"./chunks/3LQHQRIU.js";import{a as S}from"./chunks/ADHERZLW.js";import{a as N,b as A}from"./chunks/BM3S37EZ.js";import{a as F}from"./chunks/TOOIB6J2.js";import{c as d}from"./chunks/X65X4KP5.js";import{a as B}from"./chunks/IJ2WNMD5.js";import{a as s,b as x,c as i}from"./chunks/ENWFSU27.js";import{a as Me,b as Ue,c as Ye,d as Ke}from"./chunks/2O7ZGEIT.js";import{a as C,b as m,c as D,d as f}from"./chunks/P5ZHHOOM.js";import"./chunks/6ECI2GGV.js";import{e as W}from"./chunks/UCTEU62F.js";import{b as Y}from"./chunks/UC3FVVJ2.js";import"./chunks/4XVRUSCQ.js";import{a as G}from"./chunks/O4PPOM5Z.js";import{c as Fe}from"./chunks/OVZFGILJ.js";import{t as U}from"./chunks/EGZI4XQX.js";import{b as De,c as We,d as Ge}from"./chunks/UD3VJER6.js";import{b as v,c as M}from"./chunks/SGGMBSBA.js";import{b as Ce,c as I}from"./chunks/3QCW4WDJ.js";import"./chunks/C5LYCXJG.js";import"./chunks/J5S4URAW.js";import{e as w}from"./chunks/G74AGRAJ.js";import"./chunks/SL2YLB2F.js";import{b as Be,c as je,d as Ve,f as qe}from"./chunks/JPZFKSWT.js";import{b as p}from"./chunks/RK3VP2Q4.js";import"./chunks/74HKUGRR.js";import"./chunks/QMMLQJBS.js";import"./chunks/YIR5MYGU.js";import{a as P}from"./chunks/L3N4FIEN.js";import"./chunks/NAOUTU7A.js";import"./chunks/UKXMCHHT.js";import"./chunks/WUUKTSRT.js";import"./chunks/NDIM7MEW.js";import"./chunks/34KW6VNQ.js";import"./chunks/PUSUPTAT.js";import"./chunks/CDQG7RKA.js";import"./chunks/G6RXC3AL.js";import{b as Se}from"./chunks/GQGNVSKB.js";import"./chunks/DXFXAYDN.js";import"./chunks/DRYAN665.js";import"./chunks/2OSESBIL.js";import{A as ve,B as Pe,C as Ie,D as xe,E as Ne,H as Ae,I as Le,r as we,s as ye,t as ke,u as Oe,v as Ee,w as Te,x as be,y as Re,z as _e}from"./chunks/YLNJXQ3Z.js";import"./chunks/DDANMY45.js";import{b as ce,c as le,l as ue,m as ge,q as pe,u as me,x as fe}from"./chunks/37YOGDGY.js";import{a as _}from"./chunks/KESCTXGO.js";import"./chunks/TYTQRLTX.js";import"./chunks/D7E6EWIE.js";var y=["edit_files"],j={name:"main",basePrompt:"You are a helpful AI assistant."};var He={name:"lagent:base",inject:["agents"],async apply(e){v(e,j),await e.plugin(S),await e.plugin(L),await e.plugin(N,{confirm:A})}};import{z as R}from"zod";var V="You are a coding agent working in the user's workspace. You and the user share its files: with the tools you are given, you read, search and change them and run commands there. Your job is to carry the user's task through to a result they can review.",q=`- Carry the task through to the end within the turn: understand it, make the change, validate it, and report. Do not stop at analysis, a proposal or a half-finished fix.
-- Unless the user asks a question, asks for a plan or a review, or is brainstorming, assume they want the change made, and make it rather than describe it.
-- When you hit a blocker, try to work through it yourself first. Ask the user, with ask_question, only when the answer changes what you would do and you cannot find it out yourself.
-- Do not guess or make up an answer: read the code, run the command, look it up.
-- Messages may arrive while you work. When they conflict, the newest one steers; otherwise honour every request since your last answer, and make sure your final answer responds to the newest.`,K='Before a group of related tool calls, write one short line saying what you are about to do, and after the first, how it follows from what you found; for example "The loader is in src/config.ts; now checking its callers." Group related calls under one line instead of narrating each, and write none before a trivial read. Before a large edit, say what you are changing.',k=`- Read the code you are about to change, and let it show you how to change it: follow the repository's existing patterns, helpers and style.
-- Fix the problem at its root cause rather than patching the symptom, and keep the solution as simple as the problem allows. Add an abstraction only when it removes real complexity.
-- Follow the AGENTS.md files you are told for the files you touch. Each governs its directory's tree and the deeper one wins on a conflict; the user's direct instructions beat any of them. Working below your working directory, look for AGENTS.md there too.
-- Keep the change to what the task needs. Do not fix unrelated bugs or failing tests; mention them in your final answer.
-- Update the documentation your change makes wrong.
-- Default to ASCII in files, and add a comment only where the code does not explain itself.
-- Never add copyright or licence headers unless asked. Do not commit or create branches unless asked.`,c="- Make every change to a file with edit_files: creating, updating, moving or deleting it. Never write a file through a command, such as a shell heredoc, `echo >`, `sed -i` or a script; running the project's own formatter or code generator is fine.\n- Read the lines you change before editing them: an edit's old text must match the file as it is now.\n- edit_files answers with the diff it applied. Trust it, and do not re-read the file to check.\n- If an edit is interrupted, or applies only some of its files, re-read the files it named before editing them again.",l="The worktree may hold changes you did not make. Assume they are the user's, and never revert them unless asked.\n- Leave changes unrelated to your task alone.\n- In files you are working on, read the changes carefully and work with them.\n- Never run `git reset --hard`, `git checkout --`, `git restore`, `git clean` or anything else that discards changes unless the user clearly asked for that operation; when the request is ambiguous, ask first.\n- If those changes make your task impossible, ask the user how to proceed.",O=`- When the project can be built or tested, use that to check your work. Start with the tests closest to what you changed, then widen as you gain confidence.
-- Let coverage scale with risk: focused for a narrow change, broader when the change touches shared behaviour, contracts between modules, or what users do.
-- Add a test where the codebase has an obvious place for one. Do not add a test suite or a formatter to a repository that has none, and do not write tests that only mirror the implementation.
-- Run the project's formatter and linter on the files you changed when it has them.
-- A failure your change did not cause is not yours to fix: mention it.`,H=`- Independent tool calls can run in parallel: make every call that does not need another's result in the same response. When a call depends on an earlier one's output, wait for that result first.
-- Hand work to a sub-agent when you do not need to see its steps, so your conversation keeps only its outcome:
-  - explore: find and understand things in the workspace, such as where something is handled, how a module works or what a change would affect. It only reads.
-  - delegate: a self-contained task that needs nothing from this conversation but the task you write, including one that changes files or runs commands, such as updating every call site of a function and making the tests pass, or finding out why a command fails and fixing it.
-  - fork: a task of several steps that needs your context: answering a question by experiment, working out why something fails, checking whether an approach works.
-  - review: a second reading of a change, or of any code, when the user asks for one or a change is large or subtle enough that one helps; never as a routine step. Its findings are evidence: weigh each against the code before acting on it. To get them fixed, delegate the findings with their evidence. Check the repository's status before asking for a review of uncommitted work: an empty change still starts a reviewer.
-- Work directly when one or two calls will do, when you need the raw output yourself (the exact lines you are about to edit, command output you must reason over), when the next step waits on a decision, or when the answer is already in the conversation.
-- Give independent parts separate calls in one response, so they run concurrently. Write each task as an outcome: what to find out or do, and what to return, such as "the function that validates tokens, with its file and line" rather than "look at the auth code". Explore, delegate and review see only the task you write; a fork sees your conversation too. Either way, name the target (for a review, "the uncommitted changes", "the current work against main", "commit abc123" or the code to read), the outcome you expect, the constraints, and which files you or other sub-agents are changing and which commands share outputs, such as test discovery, a build directory or a server port.
-- Start a review only after the work it reviews has settled, in a later response than the calls that make that work: a waiting call does not stop the others in its response.
-- In a forked task, do the work yourself rather than forking again.`,E="A long task can outgrow your context. The conversation may then be compacted: a checkpoint stands in for the messages it condensed. Compaction does not end the task. Continue from the checkpoint without restarting or redoing finished work, and keep the original objective together with every correction the user made since.",J="When you need the exact text of something condensed, such as the user's wording or a command's output, read it back with history_read or find it with history_search rather than reconstructing it.",u=`- Your file tools read and change files in the working directory and the application data directory, and also read the read roots your workspace notice names. Do not go looking through the rest of the machine, such as other projects or the home directory, unless the task needs it.
-- Avoid destructive or irreversible commands, such as deleting what you did not create, force-pushing or dropping data, unless the user asked for them.
-- Do not push, publish, deploy or send anything to others unless asked.
-- Do not search for, print or copy out secrets such as credentials, API keys and tokens.`,$=`- For a task with no prior context, where the user is starting something new, be ambitious and show creativity in the implementation.
-- In an existing codebase, do exactly what the user asks with surgical precision. Treat the surrounding code with respect and do not overstep, for example by renaming files or variables unnecessarily, while still being proactive enough to finish the task well.
-- Use judicious initiative to choose the right level of detail and complexity for the user's needs: high-value, creative touches when the scope is vague; surgical, targeted work when it is tightly specified; no gold-plating either way.`,X=`- Lead with the outcome, then give what the user needs to trust it and act on it, like a concise teammate handing off work.
-- Size the answer by the change: a sentence or two for a small fix, a short walkthrough grouped by theme for a large one, a plain conversational reply to a casual question. Even a large one keeps to the points that matter, well under fifty lines.
-- Say what you ran to validate the work, and what you did not run and why.
-- Point to code as \`path:line\`, with the path relative to the working directory and a single line rather than a range.
-- Do not paste before-and-after code or the contents of files you wrote: the user has the files. Never ask them to save or copy anything.
-- Mention the problems you noticed but left alone, and anything you could not do.
-- When there is an obvious next step, such as running the wider test suite, committing, or building the next piece, offer it as a short question rather than doing it unasked.`,T=`- Write in English unless the user asks for another language.
-- Be direct and concise, and state the assumptions you made. Leave out flattery, filler and needless apologies.
-- Use plain characters: no emoji unless asked, and no look-alike or invisible Unicode, such as an en dash for a hyphen.`,b=`- Answer in Markdown, with only as much structure as helps: short paragraphs by default, flat lists for parallel items, and a heading only when a long answer has distinct parts.
-- Put code, commands and multi-line output in fenced code blocks labelled with their language.
-- Wrap file paths, commands, environment variables and code identifiers in backticks.`,z=e=>{let t=e("rg_search"),o=e("rg_files");return`You are an exploration sub-agent: you investigate the workspace to answer the task you are given, and report what you found without changing anything.
-
-Use read_file${t?" and rg_search to inspect and search":" to inspect"} code; read_file reads by line, so read the part you need.
-Use ${o?"rg_files to find files by name pattern, and ":""}list_dir to see what a directory holds or for an overview of the workspace.
-Request only the output you need, since tool output may be truncated, and make several targeted calls rather than one broad one.
-Answer with your findings, pointing to code as \`path:line\`, and say what you looked for but could not find.`},Q="Sub-agent that explores the workspace without changing it: codebase exploration, file discovery and code understanding. It reports its findings.",Z="Fork yourself to execute one sub-task in isolation. The forked thread gets a clone of your current conversation context, executes the task independently, and its result is returned to you. Use this when you want to 'clone yourself' to do a sub-task without polluting your main conversation thread. Call this tool once per task; several calls in one response run concurrently.",ee="Sub-agents inherit your permissions and share your working directory. Give sub-agents that run at the same time disjoint files to write, or let only one of them write; disjoint files still share test discovery, build output and ports, so do not run tests or builds in two of them at once.",Je="You are a sub-agent: another agent handed you one task, which you carry out in the user's workspace with the tools you are given, reading, searching and changing its files and running commands there. You do not see the conversation that led to the task: the task is all you know of it. Your answer goes back to the agent that asked, not to the user.",te=`- Where these instructions say to ask the user, you cannot: stop there, and put the question in your answer, with what you found and what each answer would change.
-- Before you answer, wait for every background command whose result you rely on, and stop every background command you started.`,$e=`Your answer is all the agent that asked gets back, so make it complete on its own:
-- Lead with the outcome: what you did, or what you found.
-- Point to code as \`path:line\`, with the path relative to the working directory.
-- Say what you ran to check it, each command exactly, and what it showed.
-- Say what is left undone, what you could not do, and what you are unsure of.`,Xe="You are a code review sub-agent: another agent asked you for a second reading of code in the user's workspace, a change or code as it stands, and you report the problems you find, with their evidence. You do not see the conversation that led to the task: the task names what to review and anything to focus on. Your answer goes back to the agent that asked, not to the user.",ze="- Read the change with git through run_command: a diff of the uncommitted changes, of the current work against a branch's merge base, or of one commit, with the repository's status and log. Note which commits you compared. Read the code around each change, and the code that depends on it, as far as you need to judge it. When the task names code rather than a change, review that code as it stands.\n- Review and report; do not fix. Run a command only when a finding needs the evidence: an existing test, the type checker, a linter, or a small reproduction. Prefer existing tests.\n- When a check needs a file inside the repository, create a new, uniquely named file with edit_files. Never change a file that existed before you started, the user's untracked files included.\n- Clean up what you created. Just before deleting a temporary file, read it again, and delete it only if it is still exactly what you wrote. Never restore the workspace wholesale, such as with `git checkout`, `git restore`, `git stash` or `git clean`.\n- Running tests writes caches and build output, which is fine: what you keep intact is the user's work.\n- When the target is a commit, or anything but the current work, your commands run on the checkout, not on the reviewed revision. Say which HEAD and which local changes they ran on, and do not claim that a check passing there shows the reviewed revision passes.\n- If files your findings rely on change while you review, check those findings again, or mark them uncertain.",Qe=`Flag a problem only when all of these hold:
-- It meaningfully affects the correctness, performance, security or maintainability of the code.
-- It is discrete and actionable: one issue, not a remark about the codebase in general or several issues together.
-- When the task names a change, the change introduced it: problems that were there before are not flagged. When it names code, the problem is in that code.
-- You can show it from the code or from what you ran. Speculating that something may break elsewhere is not enough: name the code that is affected. It must not rest on assumptions about the codebase or the author's intent that you have not stated.
-- It is clearly not a deliberate choice, and the author would fix it if they knew.
-- Fixing it does not demand more rigour than the rest of the codebase shows.
-
-Ignore style, formatting, naming and typos unless they hide a bug or break a rule the repository's AGENTS.md files state. When a rule supports a finding, cite the AGENTS.md file and line it comes from.
-
-Report every finding the author would want to fix, not only the first; when nothing clearly qualifies, report none. For each finding:
-- A short title tagged with its priority: [P0] blocks a release or major use, whatever the inputs; [P1] urgent, for the next cycle; [P2] normal, to fix eventually; [P3] low, nice to have.
-- Its location as \`path:line\` in the reviewed code, with the path relative to the repository, keeping the range as short as possible.
-- One short paragraph saying why it is a problem and the inputs, scenarios or environments it needs, so its severity is clear, and the evidence: what you read or ran. Claim no more severity than it has, quote no more than three lines of code, and keep the tone matter-of-fact, with no praise.
-
-When the task asks for a design assessment, alternatives or improvements, give them after the findings, under a heading of their own, apart from the problems you showed. When it asks for a severity scale or an output format, follow it instead of these.
-
-End with:
-- the scope you reviewed, and for a git target the commits you compared;
-- the checks you ran, each command exactly, with its result;
-- every experiment, what it left behind, and where its reproduction is kept, with how to run it;
-- the limits of the review: what you did not read or could not check.
-Then a one-line verdict: whether the reviewed code is correct, meaning existing code and tests will not break and it has no blocking problem. Non-blocking issues such as style do not count against it. "No qualifying findings" is not a guarantee of correctness: when you found none, say so plainly, with what you covered.
-
-Answer in plain text, not JSON. The task may narrow what to look at, and the repository's AGENTS.md files may add rules; both take precedence over these guidelines.`,oe=(e,t)=>[e,...t.map(([o,a])=>_(o,a))].join(`
-
-`),re=oe(Je,[["codebase",k],["editing",c],["dirtyWorktree",l],["validation",O],["safety",u],["subAgent",te],["answer",$e]]),ne=oe(Xe,[["evidence",ze],["editing",c],["dirtyWorktree",l],["safety",u],["subAgent",te],["rubric",Qe]]),ae="Sub-agent that carries out one self-contained task in the workspace with a fresh context: it reads, changes files, runs commands, and reports what it did and found. It sees only the task you write, not this conversation, so state the target, the outcome you expect and any constraints.",se="Sub-agent that reviews code in the workspace with a fresh context: a change (the uncommitted changes, the current work against a branch such as main, or one commit) or code as it stands. It may run tests and reproductions to gather evidence, changes nothing of yours, and reports the problems it can show, each tagged [P0] to [P3] at a file and line. Name the target and any focus in the task.";var Ze=[...s,...y,...w,...i,d,...U],et=[{tool:d,plugin:"skills"}],tt=[{tag:"autonomy",render:()=>q},{tag:"preambles",render:()=>K},{tag:"codebase",render:()=>k},{tag:"editing",render:()=>c},{tag:"dirtyWorktree",render:()=>l},{tag:"validation",render:()=>O},{tag:"delegation",render:()=>H},{tag:"forking",render:()=>ee},{tag:"longWork",render:({tools:e})=>Y.every(t=>e.some(o=>o.name===t))?`${E}
-
-${J}`:E},{tag:"safety",render:()=>u},{tag:"ambitionPrecision",render:()=>$},{tag:"finalAnswer",render:()=>X},{tag:"communication",render:()=>T},{tag:"formatting",render:()=>b}],ot=R.strictObject({explore:R.strictObject({web:R.boolean().default(!1)}).prefault({}),agentsMd:C}),rt="codex.explore",nt="codex.general",at="codex.review",he=[...x,"web_search"],st=(e,t)=>[...s,...e?i:[]].filter(o=>t(o)||!he.includes(o)),ie=e=>[...s,...y,...w,...i,d].filter(t=>e(t)||!he.includes(t)),it=P({id:"codex#2",placement:"thread",schema:ot,inject:["tools","prompts","journal","threadDirs"],async setup(e,{explore:t,agentsMd:o},a){let r=[a.thread.agentName];if(e.get("presets")?.has(m)!==!0)throw new Error("codex hands down agents-md, which is not registered: register agentsMdPreset at startup");for(let{tool:n,plugin:g}of et)if(!e.tools.has(void 0,n))throw new Error(`codex grants ${n}, which is not registered: mount the ${g} plugin on the root`);for(let n of Ze)M(e,n,r);p(e,{tag:"base",slot:"base",agents:r,render:()=>V}),tt.forEach(({tag:n,render:g},de)=>p(e,{tag:n,slot:"instruction",agents:r,order:de,render:g})),a.kind==="installation"?(f(e,{holder:`codex in installation ${a.installationId}`,...o}),I(e,{presetId:m,config:o,installationId:D})):f(e,{holder:"codex for its agents",...o}),await e.plugin(F),await e.plugin(W,{agents:r});let h=n=>e.tools.has(void 0,n);await e.plugin(B,{endpoints:[{toolName:"explore",callers:r,description:Q,target:{kind:"role",id:rt,basePrompt:z(h),tools:st(t.web,h)}},{toolName:"delegate",callers:r,description:ae,target:{kind:"role",id:nt,basePrompt:re,tools:ie(h)}},{toolName:"fork",callers:r,description:Z,target:{kind:"fork"}},{toolName:"review",callers:r,description:se,target:{kind:"role",id:at,basePrompt:ne,tools:ie(h)}}]}),await e.plugin(G,{agents:r})}});export{Ne as AuxiliaryRefusedError,be as BirthConflictError,je as CODEX_ENVIRONMENT_POLICY,T as COMMUNICATION_GUIDANCE_PROMPT,ve as ConfirmationAnsweredError,xe as CorruptHistoryError,pe as CorruptJournalError,Ee as DepthExceededError,b as FORMATTING_PROMPT,Te as ForkCutError,me as IncompatibleJournalError,ce as InvalidOriginError,ue as JournalBusyError,fe as JournalCommitError,Ke as MemoryJournalStore,Be as NON_INTERACTIVE_ENVIRONMENT,Ie as ReplacementRefusedError,Oe as RestoreFailedError,Ae as RouteConflictError,Le as RouteUnavailableError,ge as StoreBusyError,Ue as Thread,_e as ThreadActivatingError,ke as ThreadBusyError,Pe as ThreadUnsettledError,Se as UNCONFINED_LAUNCH,we as UnknownAgentError,De as UnknownRunError,ye as UnknownThreadError,Re as WriteRefusedError,He as base,Ve as buildSpawnEnvironment,it as codexPreset,Ye as core,le as forkChain,Ge as heldOrSettled,Ce as registerPreset,Me as registerProvider,Fe as repositoryReadRoots,qe as resolveTrustedPrograms,We as waitForRun};
+import{a as n}from"./chunks/Q7S5LFGN.js";import{a as e,b as t}from"./chunks/ASSQZH3F.js";import{b,c as J,d as V,e as G,f as H,g as W,h as Y}from"./chunks/B4FXK5ER.js";import"./chunks/SS3B5W34.js";import"./chunks/IAAEP6VL.js";import"./chunks/OCBPT7KE.js";import"./chunks/2P47AHNK.js";import"./chunks/MHC6VPB4.js";import"./chunks/EMRB4KCN.js";import"./chunks/RCIHV3KG.js";import"./chunks/2GCIWSOA.js";import"./chunks/GGSVIIWJ.js";import{b as S,c as k,d as v}from"./chunks/CANPZYTH.js";import"./chunks/VYMT4TXD.js";import"./chunks/MNJ4SRF7.js";import"./chunks/JFZZXVWD.js";import{b as B,c as D,e as L}from"./chunks/N6IXG2VL.js";import{b as M}from"./chunks/6DRCKZ2C.js";import{c as h,d as y}from"./chunks/7LI64H5X.js";import{a as U}from"./chunks/3UMZMPWW.js";import"./chunks/Q75FUN7D.js";import"./chunks/PUSUPTAT.js";import"./chunks/34KW6VNQ.js";import"./chunks/DDZ7YF26.js";import"./chunks/KUZCL2SH.js";import{b as F}from"./chunks/CQEVREBT.js";import"./chunks/HK6ZSONF.js";import"./chunks/7VAPNE3L.js";import"./chunks/EPYQ5M3B.js";import"./chunks/5IRF47YB.js";import"./chunks/OL5A6ITQ.js";import"./chunks/JFX2MXBA.js";import"./chunks/S34ZA2R6.js";import"./chunks/6FRNHMCV.js";import{b as o}from"./chunks/CUK7CGC7.js";import{J as N,K as T,L as c,M as R,N as O,O as A,P as I,Q as g,R as P,S as w,T as _,j as l,k as u,u as d,v as x,w as C}from"./chunks/BPRCULZH.js";import"./chunks/FJLU4UH3.js";import"./chunks/DDANMY45.js";import{a,b as i,l as m,m as E,q as p,u as s,x as f}from"./chunks/BBCW2FZK.js";import"./chunks/MMNNZCBO.js";import"./chunks/G44LG6VL.js";import"./chunks/D4PQP5MA.js";var j={name:"lagent:base",inject:["agents"],async apply(r){o(r,X),await r.plugin(n),await r.plugin(e,{confirm:t})}},X={name:"main",basePrompt:"You are a helpful AI assistant."};export{_ as AuxiliaryRefusedError,O as BirthConflictError,H as CODEX_ENVIRONMENT_POLICY,V as COMMUNICATION_GUIDANCE_PROMPT,g as ConfirmationAnsweredError,w as CorruptHistoryError,p as CorruptJournalError,R as DepthExceededError,G as FORMATTING_PROMPT,U as FileAccessError,x as ForkCutError,s as IncompatibleJournalError,a as InvalidOriginError,m as JournalBusyError,f as JournalCommitError,Y as MemoryJournalStore,B as NON_INTERACTIVE_ENVIRONMENT,C as ReplacementRefusedError,c as RestoreFailedError,l as RouteConflictError,u as RouteUnavailableError,E as StoreBusyError,I as ThreadActivatingError,T as ThreadBusyError,P as ThreadUnsettledError,M as UNCONFINED_LAUNCH,N as UnknownAgentError,S as UnknownRunError,d as UnknownThreadError,A as WriteRefusedError,j as base,D as buildSpawnEnvironment,W as codexPreset,J as core,i as forkChain,v as heldOrSettled,F as registerPreset,b as registerProvider,L as resolveTrustedPrograms,y as runToCompletion,h as spawnCommand,k as waitForRun};

package/dist/journal/catalog.d.ts

@@ -1,4 +1,4 @@
-import type { ThreadOrigin, ThreadSummary } from '../models/index.js';
+import type { ThreadOrigin, ThreadSummary } from '../records/journal.js';
 /**
  * Why a walk up the origin tree stopped short of a thread with no caller: `missing`, the caller is
  * not in the catalog; `cycle`, the caller was already met. `at` is the last thread the walk reached,

package/dist/journal/journal.d.ts

@@ -1,4 +1,4 @@
-import type { JournalEventInput, JournalEventType, JournalEvent, Seq, ThreadSummary } from '../models/index.js';
+import type { JournalEventInput, JournalEventType, JournalEvent, Seq, ThreadSummary } from '../records/journal.js';
 import { type JsonValue } from '../util/json.js';
 import type { ReadonlyState } from '../util/foldState.js';
 import type { CoreFold, PluginProjection, Projection } from './projection.js';
@@ -111,7 +111,7 @@ export type JournalOptions = {
  * The append-only journal, the folds over it, and the catalog of its threads.
  *
  * Everything the loop needs to resume is a projection of these events, never a snapshot beside
- * them (`docs/architecture.md#state-and-lifetimes`).
+ * them (`docs/guides/architecture.md#state-and-lifetimes`).
  *
  * **Writes** go through one queue. `transact(threadId, build)` runs `build` once every earlier write
  * has landed and been folded, synchronously, against durable state, and appends what it returns in
@@ -131,7 +131,7 @@ export type JournalOptions = {
  * the catalog takes them, so a read hands out the journal's own and copies nothing.
  *
  * A thread may be a fork: its thread-scoped state is the fold over its **lineage**, the source's up
- * to the row its spawn row names, then its own rows (`docs/forks.md`). Seqs are global, so one bound
+ * to the row its spawn row names, then its own rows (`docs/records/forks.md`). Seqs are global, so one bound
  * applies at every hop of a fork of a fork.
  *
  * The journal parses what it is given and writes it. A row whose meaning depends on the state it

package/dist/journal/projection.d.ts

@@ -1,4 +1,4 @@
-import { type JournalEvent } from '../models/index.js';
+import { type JournalEvent } from '../records/journal.js';
 /**
  * A fold over the journal, as the journal itself holds it.
  *

package/dist/journal/store.d.ts

@@ -1,4 +1,4 @@
-import type { JournalEvent, Seq, ThreadSummary } from '../models/index.js';
+import type { JournalEvent, Seq, ThreadSummary } from '../records/journal.js';
 /**
  * One group's write: a fresh identity, the head it was numbered from, the writer's acquisition, and
  * the rows. Immutable once made, so a write whose answer was lost can be sent again as it was.
@@ -31,7 +31,7 @@ export type WriterLease = {
  * Durable backing for the journal: the rows, one thread at a time, an index of the threads, the
  * catalog of summaries beside them, and the record of who may write. Every method is asynchronous,
  * so a store across a network implements the same contract as SQLite; the conformance suite
- * (`plugins/store/conformance.ts`) is what every store passes.
+ * (`stores/testing/conformance.ts`) is what every store passes.
  *
  * `append` must be durable enough that a crash after it resolves still replays the rows, because
  * nothing else records them. That is also why `read` refuses a row it cannot parse rather than
@@ -166,7 +166,7 @@ export declare function parseStoredSummary(payload: string): ThreadSummary;
  * A breaking change to persisted rows bumps it too, a plugin's extension row version bump included.
  * Indexes enforcing existing invariants do not change the format.
  */
-export declare const JOURNAL_VERSION = 38;
+export declare const JOURNAL_VERSION = 44;
 /** A journal written by a build whose format this one cannot read. */
 export declare class IncompatibleJournalError extends Error {
     readonly found: number;

package/dist/llm/index.d.ts

@@ -1,16 +1,22 @@
 /**
- * The model layer's entry point inside the package: the model-facing alphabet and the provider
- * contract, every name its modules export. Outer layers import from here only. What the package
- * offers others is the narrower `door.ts` (`@leuduan/lagent/llm`).
+ * `@leuduan/lagent/llm`: the model and provider contracts as the package offers them, for a provider
+ * written outside it and a host that calls a model. Every type the contract mentions, and the values
+ * a consumer uses; the schemas and helpers the engine uses itself stay in their modules, which the
+ * package imports directly.
  *
- * It depends on `zod` alone, so a provider client built on it works in any harness, not only in a
- * lagent session.
+ * It depends on `zod` alone, so a provider client built on it works in any harness.
  */
-export * from './client.js';
-export * from './content.js';
-export * from './failure.js';
-export * from './primitives.js';
-export * from './prompt.js';
-export * from './provider.js';
-export * from './readLedger.js';
-export * from './request.js';
+export { ContextOverflowError, ProviderUnsupportedError, ResponseInterruptedError, ResponseSettlementError, StreamIdleError, } from './client.js';
+export type { LLMClient, ModelCapacity, ModelOption, ResponseSettlementKind, StreamingLLMResponse } from './client.js';
+export { contentText } from './content.js';
+export { ModelCallError } from './failure.js';
+export type { FailureClassification, FailureKind, ModelCallClient, ModelCallHandle } from './failure.js';
+export type { DeepReadonly, ReadonlyJsonValue } from '../util/json.js';
+export type { ContentPart, ContentPartInput, ContentPartKind } from './content.js';
+export { conversationMessage, LLMStreamChunkSchema, messageText, ThinkingEffortSchema } from './primitives.js';
+export type { ConversationMessage, JsonObject, LLMStreamChunk, LLMUsage, MalformedToolCall, MessageRole, ModelResponse, ParsedToolCall, ProviderCall, ProviderState, ResponseFinish, ThinkingEffort, ToolCall, ToolSpec, } from './primitives.js';
+export { renderPromptBlocks } from './prompt.js';
+export type { PromptBlock } from './prompt.js';
+export { defaultRoute } from './provider.js';
+export type { LLMProvider, ModelRoute } from './provider.js';
+export type { ModelRequest, RequestPurpose, ResponseFormat, ToolChoice } from './request.js';

package/dist/llm/index.js

@@ -0,0 +1 @@
+import{b as m,e as l}from"../chunks/G44LG6VL.js";import{A as d,d as r,f as e,o,q as t,r as n,u as p,v as s,w as f,x as a,y as x}from"../chunks/D4PQP5MA.js";export{s as ContextOverflowError,o as LLMStreamChunkSchema,l as ModelCallError,p as ProviderUnsupportedError,x as ResponseInterruptedError,f as ResponseSettlementError,a as StreamIdleError,e as ThinkingEffortSchema,r as contentText,t as conversationMessage,m as defaultRoute,n as messageText,d as renderPromptBlocks};

package/dist/llm/provider.d.ts

@@ -23,6 +23,17 @@ export declare const ModelRouteSchema: z.ZodObject<{
     }>>;
 }, z.core.$strip>;
 export type ModelRoute = z.infer<typeof ModelRouteSchema>;
+/**
+ * Route fields to fold over a route (`LlmService.resolveRoute`): absent fields keep the route's own;
+ * naming a different provider resets what is left unnamed to that provider's defaults. A `null`
+ * effort names the provider's own default, as a route records it, so a complete route resolves to
+ * itself.
+ */
+export type ModelSelection = {
+    readonly provider?: string;
+    readonly model?: string;
+    readonly thinkingEffort?: ThinkingEffort | null;
+};
 /** A model provider plugin registers one of these. */
 export interface LLMProvider {
     readonly name: string;

package/dist/loop/agent.d.ts

@@ -1,134 +1,18 @@
-import type { Seq, TurnEndReason } from '../models/index.js';
-import type { DeepReadonly, JsonValue } from '../util/json.js';
-import type { SurfacePrepareOutcome } from './hooks.js';
-import type { Lease, LoopRuntime } from './runtime.js';
+import { z } from 'zod';
 /**
- * What one `compact()` is given: a cancellation signal, and options for the strategy, which the
- * engine passes on as they are and never reads.
+ * One agent: its name and the base of its prompt. Registered programmatically with
+ * `ctx.agents.register` (usually through `registerAgent`); the name is how threads
+ * and other agents refer to it.
+ *
+ * Strict: an agent says who it is, and nothing else. What it may call is granted to it by name
+ * (`grantTool`) by the plugins that compose the application; instruction and context sections come
+ * from plugins through `ctx.prompts`; how callers see it, a description and guidance, belongs to the
+ * `subAgents` endpoint that offers it. A plugin that needs per-agent configuration keys it by agent
+ * name in its own config, so a misspelled key is rejected here instead of silently ignored there.
  */
-export type CompactOptions = {
-    readonly signal?: AbortSignal;
-    readonly options?: JsonValue;
-};
-/**
- * The run request an execution serves, as its turns see it: the id every `turn/start` records, the
- * attempt cutoff of the execution, and the continuation decision, asked after each turn whether to
- * open another.
- */
-export type ServedRun = {
-    readonly id: string;
-    readonly attemptCutoff: Seq;
-    continueAfter(ending: DeepReadonly<TurnEndReason>, turnStart: Seq): boolean;
-};
-/** Executes journal-driven turns. Admission, readiness and cancellation ownership live outside the loop. */
-export declare class LoopAgent {
-    private readonly runtime;
-    private readonly threadId;
-    private readonly agentName;
-    private readonly inbox;
-    constructor(options: {
-        runtime: LoopRuntime;
-        threadId: string;
-        agentName: string;
-    });
-    private stepsTaken;
-    /**
-     * The caller already owns the lease, has resolved the agent in a ready runtime, has decided the
-     * run should advance, and supplies a combined turn signal and the run it serves. Opens a turn,
-     * then another for as long as the run's continuation decision says to advance.
-     */
-    run(options: {
-        signal: AbortSignal;
-        lease: Lease;
-        served: ServedRun;
-    }): Promise<void>;
-    /**
-     * One turn: decide, do it, append what happened, decide again.
-     *
-     * Every branch of the decision lives in {@link nextAction}; this only carries out what it asked
-     * for.
-     */
-    private turn;
-    /**
-     * Why a judgment made under `fence` may not stand, or `null` when it does. `activation-changed`:
-     * the activation's plugins changed since readiness, and takes precedence. `judgment-invalidated`:
-     * the constraint registrations the thread requires, by origin too, are not those it was judged
-     * under, one missing or replaced, or a fact a check declared it observed reads differently now.
-     * Such a registration's owner, or a plugin of the activation, can be the checker that would
-     * object, and core accepts whatever no check objects to; one that came back meanwhile did not
-     * judge it; and a verdict resting on a fact that moved while another check awaited is no verdict
-     * on the answer as it stands. Read inside the write that records the judgment.
-     */
-    private fenced;
-    /**
-     * Records how a judged turn ends, `ending` the checks' verdict or their failure, decided inside
-     * the write: one whose fence broke ends the turn `interrupted` instead, the answer still owed its
-     * checks, so a later run judges it again, held while a required owner is missing, rather than
-     * accepting it unchecked or failing the task because its checker was briefly gone or a fact it
-     * read moved. Returns the reason recorded.
-     */
-    private endJudged;
-    /**
-     * Records `turn/start` with the thread's route and the run the turn serves, decided in the write's
-     * builder, the turn's opening point: a cancel that landed while the loop awaited opens nothing,
-     * and a route whose provider is not registered opens nothing either, claims no input, and throws
-     * `RouteUnavailableError`, which fails the run before the turn. A provider lost once the row is
-     * built, its append still waiting on storage included, fails the opened turn.
-     *
-     * The route is the turn's for good, since every model step builds its client from it; it cannot
-     * change under an execution, which holds the thread while its request is pending.
-     */
-    private openTurn;
-    /** The thread's route as its rows stand. */
-    private threadRoute;
-    /**
-     * Asks the thread's strategy for a plan for a caller between turns (the `request` trigger): no turn
-     * opens, no step hook runs and no queued input is claimed; the route is resolved as a turn's would
-     * be. The caller owns the lease, as for a run, and composed the signal as a run's is. An
-     * interrupted open turn is closed first, as a run closes it; a thread with a tool call unanswered,
-     * a confirmation open or an answer unjudged is refused with `ThreadUnsettledError`. Resolves with
-     * the outcome, cancellation included.
-     */
-    compact(options: {
-        signal: AbortSignal;
-        lease: Lease;
-        options: JsonValue | null;
-    }): Promise<SurfacePrepareOutcome>;
-    /** One request to the thread's strategy, carried out by the engine. */
-    private prepare;
-    /**
-     * Asks the stop checks about the provisional answer. Returns how the turn ends — accepted as
-     * `completed`, or `rejected` — or `null` once their continuation messages are recorded.
-     *
-     * An acceptance ends the turn at once. Steering that arrived while the checks ran is still in the
-     * `next-step` inbox, and `run()` opens another turn for it.
-     */
-    private judge;
-    /**
-     * Lets the surface be prepared (`pressure`), then records plugin contributions and the claimed
-     * input, then asks the model.
-     *
-     * The dispatch is the first `await` between deciding this step and recording its input, and the
-     * lease does not exclude `send()` or `withdraw()`. So once it settles the signal is checked and the
-     * inbox read again: only input this step was decided on that is still queued is claimed, so a
-     * withdrawn input stays withdrawn, and input that arrived meanwhile waits for the next step. A step
-     * left with nothing to claim and no reply owed ends without a model call, and the decider decides
-     * again.
-     */
-    private askModel;
-    /** Reports a dispatch a listener ended in failure; one that was cancelled is the turn's to report. */
-    private reportFailedDispatch;
-    /** Runs a step's tool calls. What they did — answered, waited, ended the turn — lands in the journal. */
-    private answerCalls;
-    /**
-     * One model call. What it produced goes to the journal — `assistant/message`, or
-     * `assistant/attempt` when the stream gave nothing usable, which keeps it off the conversation.
-     *
-     * A request the provider refused as longer than the context window is recorded as an attempt
-     * marked `overflow`, and the thread's strategy is asked with `overflow` inside this step, before
-     * any `error` row. The rule is one sentence: an overflow fails the turn unless that request
-     * committed a replacement, however it ended. When it did, the step ends without an error and the
-     * decider asks the model again, from the replaced surface, in a new step.
-     */
-    private callModel;
-}
+export declare const AgentDefinitionSchema: z.ZodObject<{
+    name: z.ZodString;
+    basePrompt: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export type AgentDefinition = z.infer<typeof AgentDefinitionSchema>;
+export type AgentDefinitionInput = z.input<typeof AgentDefinitionSchema>;

package/dist/loop/authorization.d.ts

@@ -0,0 +1,41 @@
+import type { AppendEntry, Journal } from '../journal/index.js';
+import type { ExtensionRecord, Seq } from '../records/journal.js';
+import type { LoopRuntime } from './runtime.js';
+import type { ToolAuthorization, ToolAuthorizationRequest } from './hooks.js';
+/**
+ * One owner for authorization ordering: flush policy writes, read approval, collect all policies,
+ * then commit only against the policy state they saw. Authorization and any approval request are
+ * one write guarded against cancellation. Both model and runtime dispatch use it.
+ */
+export declare function authorizeOperation(options: {
+    runtime: LoopRuntime;
+    request: ToolAuthorizationRequest;
+    signal: AbortSignal;
+    approval(): {
+        approved: boolean;
+        rejection_message: string | null;
+    } | undefined;
+    validate?(): void;
+    record(authorization: ToolAuthorization): readonly [AppendEntry<'tool/authorization' | 'execution/authorization'>, ...AppendEntry<'confirm/requested'>[]];
+}): Promise<{
+    kind: 'decided';
+    authorization: ToolAuthorization;
+    attemptSeq: Seq;
+} | {
+    kind: 'rejected';
+    reason: string | null;
+} | {
+    kind: 'unstarted';
+}>;
+/**
+ * Declares the `ext` rows of one plugin event state a `lagent/tool/authorize` listener decides
+ * from: one that lands while a call is authorized sends the decision round again, which no other
+ * `ext` row does. `defineExtensionEvent({ policyState: true })` is the way in.
+ */
+export declare function declarePolicyState(record: Pick<ExtensionRecord, 'plugin' | 'instance_id' | 'kind'>): void;
+/**
+ * Whether policy state — declared `ext` rows or answers (`confirm/resolved`) — landed after `from`
+ * on `threadId` or a thread that called it: what a running thread's policies read. A thread of that
+ * chain that is not loaded counts as changed if anything landed on it.
+ */
+export declare function policyChangedSince(journal: Journal, threadId: string, from: Seq): boolean;

package/dist/loop/auxiliary.d.ts

@@ -1,6 +1,10 @@
-import type { ContentPartInput, ConversationMessage, LLMUsage, ModelRoute, ResponseFinish, ToolChoice } from '../llm/index.js';
-import type { Seq } from '../models/index.js';
-import type { LoopRuntime, ModelSelection } from './runtime.js';
+import type { ContentPartInput } from '../llm/content.js';
+import type { ConversationMessage, LLMUsage, ResponseFinish } from '../llm/primitives.js';
+import type { ToolChoice } from '../llm/request.js';
+import type { ModelRoute } from '../llm/provider.js';
+import type { Seq } from '../records/journal.js';
+import type { LoopRuntime } from './runtime.js';
+import type { ModelSelection } from '../llm/provider.js';
 /**
  * One auxiliary model call as a strategy asks for it. The engine builds the request: the head a step
  * would send now (the recorded prompt and the tools the agent is granted), then the current surface

package/dist/loop/chunks.d.ts

@@ -1,8 +1,8 @@
-import type { LLMStreamChunk } from '../llm/index.js';
+import type { LLMStreamChunk } from '../llm/primitives.js';
 /** One delta off a model stream, with enough context for a frontend to place it. */
 export type StreamedChunk = {
-    readonly thread_id: string;
-    readonly llm_call_id: string;
+    readonly threadId: string;
+    readonly llmCallId: string;
     readonly turn: number;
     readonly step: number;
     readonly chunk: LLMStreamChunk;