@miller-tech/uap 1.173.0 → 1.174.0

package/dist/delivery/bash-sweep.js

@@ -0,0 +1,610 @@
+/**
+ * Turn-end substance sweep for files written through `run_bash`.
+ *
+ * The stub guard covers `write_file` and `edit_file`. `run_bash` bypasses both:
+ * `cat > f <<'EOF' … EOF`, `sed -i` and `python -c "open(...).write(...)"` all
+ * land content without passing through a tool handler. That was recorded as a
+ * known limit when the guard shipped (PR #611) rather than papered over, and
+ * this closes it.
+ *
+ * WHY A SWEEP AND NOT A CHECK IN THE HANDLER
+ * The other run_bash protections work by SNAPSHOTTING a known set — protected
+ * tests, locked contracts, gate configs — and restoring whatever the command
+ * touched. That works because those sets are enumerable up front. The set of
+ * files a shell command might write is not, so there is nothing to snapshot by
+ * name. The sweep instead takes a baseline of the tree at the first command and
+ * compares at turn end, which is the only way to attribute an arbitrary write.
+ *
+ * THE COST MODEL IS INVERTED FROM THE WRITE PATH, AND THAT DRIVES EVERYTHING
+ * On the write path a false positive costs one retry: the write is refused and
+ * the model tries again. Here a false positive touches a file that already
+ * exists, so it costs WORK. Four consequences, each of which an earlier version
+ * of this file got wrong and each of which now has a test:
+ *
+ *  1. Absence of baseline CONTENT never implies absence of the FILE. Existence
+ *     is recorded for every path with no read and no byte budget, so a file the
+ *     content baseline skipped — capped, oversized, unreadable — is still known
+ *     to have existed. Only a path absent from `known` may be treated as created
+ *     this turn. Without that split, a file the baseline had skipped was DELETED
+ *     when the shell shrank it, and on a tree past the cap files the shell never
+ *     touched became deletion candidates.
+ *  2. Nothing the harness has SEEN is destroyed, and nothing leaves the project.
+ *     Every removal and every revert preserves the current content under
+ *     `.uap/bash-sweep-backup/` first, a failed preserve aborts the action, and
+ *     every destination is proven to resolve inside that directory. The limit is
+ *     worth stating precisely, because a broader claim would be false: a revert
+ *     restores the last content the harness AUTHORISED, so if one shell command
+ *     writes real code and a later command in the SAME turn hollows it, the
+ *     intermediate version — which no tool handler ever saw — is not recovered.
+ *     The rejected content is preserved; the unobserved good version is not. `relative()` used to be run through
+ *     `.split('\\')`, which is correct on Windows and WRONG on POSIX where a
+ *     backslash is a legal filename character: one directory entry named
+ *     `..\..\..\..\x.js` produced a traversing key and the sweep wrote and
+ *     RENAMED outside the project root. (Reproduced; test below. The harness
+ *     already documents that the small model mangles paths, so this needed no
+ *     adversary.)
+ *  3. An existing file is only reverted when the change made it STRICTLY WORSE —
+ *     more empty bodies than the content we authorised. A formatter or codemod
+ *     that rewrites an already-stubby file without emptying anything further is
+ *     left alone, because reverting it would be both wrong and unexplainable
+ *     ("your shell command wrote SKELETONS" about `prettier --write`).
+ *  4. Silence must mean "nothing changed", not "we could not look". Coverage
+ *     gaps are reported — but ONLY for files that actually changed. Reporting
+ *     every unreadable path made a single `logo.png` emit a coverage warning on
+ *     every bash turn of every asset-bearing project, into a prompt slot that is
+ *     head-truncated.
+ *
+ * WHAT COUNTS AS THE BASELINE
+ * Per file, the last content this harness knows it authorised: what a guarded
+ * tool wrote this turn if one did, otherwise the content at the first command.
+ * Using "was it written by a guarded tool" as a plain skip would leave a hole —
+ * write the real implementation with write_file, then hollow it out with sed,
+ * and the path is on the allow-list. Comparing against the authorised CONTENT
+ * closes it. A file CREATED this turn is judged on its own content regardless of
+ * authorisation, which closes the mirror hole: the shell writes a skeleton, then
+ * a single edit_file fills one body and the monotone-progress rule — measuring
+ * against the skeleton itself — stamps the rest as authorised.
+ *
+ * SCOPE, STATED PLAINLY
+ * This is a correctness guard against confused generation, not a security
+ * boundary. A model holding a shell can do anything a shell can do, including
+ * removing this check; run_bash is gated on kernel containment for that reason.
+ * The sweep judges SUBSTANCE only — a command that deletes a real file is a
+ * different failure and is not restored here. And a quarantine can leave the
+ * tree in a state neither the model nor the gates have seen: a `main.js` written
+ * by write_file may import a `player.js` the sweep removed. The gates see that
+ * and the note names the repair, which is the intended outcome, but it is a real
+ * intermediate state rather than a clean rollback.
+ */
+import { readdirSync, statSync, fstatSync, writeFileSync, mkdirSync, renameSync, realpathSync, lstatSync, existsSync, openSync, readSync, closeSync, constants as fsConstants, } from 'fs';
+import { join, relative, resolve, dirname, sep } from 'path';
+import { detectStub, stubGuardDisabled } from './stub-detector.js';
+import { CONTEXT_BUDGET_MARKER } from './context-budget.js';
+/**
+ * Never walked at any depth: version control, dependencies, harness state,
+ * language caches and vendored third-party trees. `.git` and `node_modules` also
+ * hold code that would be judged as if the model had authored it — and the
+ * harness actively steers models to vendor dependencies locally when a CDN fetch
+ * fails, so `vendor`/`third_party` are the same case by another name.
+ */
+const ALWAYS_SKIP = new Set([
+    '.git',
+    'node_modules',
+    '.uap',
+    '.uap-deliver',
+    '.uap-backups',
+    '__pycache__',
+    '.pytest_cache',
+    '.mypy_cache',
+    '.ruff_cache',
+    '.tox',
+    '.venv',
+    'venv',
+    '.cache',
+    '.next',
+    '.nuxt',
+    '.svelte-kit',
+    '.turbo',
+    'vendor',
+    'third_party',
+    // Every other tree-walk in this package excludes these; this one omitted them.
+    // A sweep rooted at a repo that follows the worktree workflow would otherwise
+    // walk N full checkouts, and `agents/` holds the memory/coordination SQLite
+    // stores and the vector index.
+    '.worktrees',
+    'agents',
+]);
+/**
+ * Build output — skipped only at the PROJECT ROOT. Matching these at any depth
+ * made `src/build/`, `app/out/` and `pkg/target/` permanent blind spots, and for
+ * a web mission the deliverable itself sometimes lives in `build/` or `out/`.
+ */
+const ROOT_ONLY_SKIP = new Set(['dist', 'build', 'out', 'coverage', 'target']);
+/**
+ * A delivery target is an application, not a monorepo, so these sit far above
+ * any real project — they exist so a mission pointed at something huge degrades
+ * predictably instead of reading gigabytes inside a turn boundary. Injectable so
+ * tests exercise the capped paths for real rather than setting a flag by hand.
+ */
+export const DEFAULT_LIMITS = {
+    maxFiles: 3000,
+    maxTotalBytes: 16 * 1024 * 1024,
+    maxFileBytes: 200_000,
+};
+/** Where displaced content goes. Inside `.uap`, so the sweep never re-walks it. */
+export const BACKUP_DIR = join('.uap', 'bash-sweep-backup');
+/** Fresh on every call: a shared singleton lets one caller's mutation leak. */
+function emptyOutcome() {
+    return { reverted: [], removed: [], uncovered: [], failed: [], note: '' };
+}
+/** A sweep that never fires — for callers with bash disabled. */
+export function disabledSweep() {
+    return {
+        enabled: false,
+        projectRoot: '',
+        bashRan: false,
+        baselined: false,
+        swept: false,
+        authorised: new Map(),
+        baseline: new Map(),
+        known: new Set(),
+        statAt: new Map(),
+        truncated: false,
+        limits: DEFAULT_LIMITS,
+    };
+}
+/**
+ * Project-relative key for a walked path.
+ *
+ * Separator translation happens ONLY on Windows. Doing it unconditionally is the
+ * bug described in the header: on POSIX a backslash is a legal filename
+ * character, so translating it manufactures `..` segments out of a single
+ * directory entry.
+ */
+function relKey(projectRoot, abs) {
+    const rel = relative(projectRoot, abs);
+    return sep === '\\' ? rel.split('\\').join('/') : rel;
+}
+/**
+ * Read a file as text, or null when it is binary, unreadable, or not a regular
+ * file by the time it is opened.
+ *
+ * Opened non-blocking and re-checked through `fstat` on the open descriptor: a
+ * background process left running by the command can swap a file for a FIFO
+ * between the directory read and this open, and a blocking open on a FIFO with
+ * no writer hangs forever — inside the turn boundary, which stops the deliver
+ * heartbeat and invites the lock's wedge-reclaim to kill a run that is merely
+ * blocked.
+ */
+function readText(abs, maxBytes) {
+    let fd = -1;
+    try {
+        fd = openSync(abs, fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
+        const st = fstatSync(fd);
+        if (!st.isFile() || st.size > maxBytes)
+            return null;
+        const buf = Buffer.alloc(st.size);
+        let off = 0;
+        while (off < st.size) {
+            const n = readSync(fd, buf, off, st.size - off, off);
+            if (n <= 0)
+                break;
+            off += n;
+        }
+        // Binary sniff. The detector exempts a fixed list of extensions and scans
+        // everything else — right for a write path (the model writes source) and wrong
+        // for a whole-tree walk, where a .png/.wasm/.db under the read cap would be
+        // decoded as UTF-8, held in the baseline, and fed to a brace scanner.
+        if (buf.subarray(0, Math.min(off, 8192)).includes(0))
+            return null;
+        const text = buf.subarray(0, off).toString('utf-8');
+        // The decoded string is what gets written BACK on a revert, so a lossy decode
+        // would silently corrupt the file it is meant to restore. Latin-1 source, or a
+        // NUL past the 8 KB sniff window, round-trips through U+FFFD; a byte-length
+        // mismatch is the cheap, exact test for that. Treat it as out of scope.
+        if (Buffer.byteLength(text, 'utf-8') !== off)
+            return null;
+        return text;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd >= 0) {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+}
+/** Walk project files, calling `onFile` for each. Continues past unreadable dirs. */
+function walk(projectRoot, onFile) {
+    const stack = [projectRoot];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue; // unreadable directory — not a reason to fail the turn
+        }
+        const atRoot = dir === projectRoot;
+        for (const e of entries) {
+            if (e.isSymbolicLink())
+                continue; // never follow: a link can leave the root
+            const abs = join(dir, e.name);
+            if (e.isDirectory()) {
+                if (ALWAYS_SKIP.has(e.name))
+                    continue;
+                if (atRoot && ROOT_ONLY_SKIP.has(e.name))
+                    continue;
+                stack.push(abs);
+                continue;
+            }
+            if (!e.isFile())
+                continue;
+            let st;
+            try {
+                st = statSync(abs);
+            }
+            catch {
+                continue;
+            }
+            onFile(relKey(projectRoot, abs), abs, st.size, st.mtimeMs);
+        }
+    }
+}
+const ACTIVE_ROOTS = new Set();
+/**
+ * Arm the sweep for a turn. Deliberately does NOT walk anything.
+ *
+ * The baseline is captured lazily, at the first command, so a bash-enabled
+ * session that does not actually shell out in a given turn pays nothing.
+ * Deferring is safe because of what `authorised` holds: anything that changed
+ * BEFORE the first command can only have come from a guarded tool, and those
+ * writes are recorded by content as they happen.
+ */
+export function beginBashSweep(projectRoot, enabled, limits = DEFAULT_LIMITS) {
+    if (!enabled || stubGuardDisabled())
+        return disabledSweep();
+    // Two live sweeps over ONE tree would cross-attribute: A's baseline predates
+    // B's guarded writes, so A can revert or quarantine a file B legitimately
+    // created, and both would write the same backup paths. Nothing in the current
+    // wiring runs concurrent agentic executors on a shared root, but that is a
+    // decision in another file and this module is exported. Degrade to no sweep
+    // rather than trust it: a missed check is recoverable, a wrong revert is not.
+    if (ACTIVE_ROOTS.has(projectRoot))
+        return disabledSweep();
+    ACTIVE_ROOTS.add(projectRoot);
+    return {
+        enabled: true,
+        projectRoot,
+        bashRan: false,
+        baselined: false,
+        swept: false,
+        authorised: new Map(),
+        baseline: new Map(),
+        known: new Set(),
+        statAt: new Map(),
+        truncated: false,
+        limits,
+    };
+}
+/**
+ * Arm for a command: mark that the shell ran, and capture the baseline once.
+ *
+ * Called from the run_bash handler BEFORE the spawn — a command that times out
+ * or is killed may still have written files, and a sweep with nothing to compare
+ * against would be worse than none, reporting "checked" over the messiest case.
+ */
+export function armSweepForCommand(sweep) {
+    if (!sweep.enabled)
+        return;
+    sweep.bashRan = true;
+    if (sweep.baselined)
+        return;
+    sweep.baselined = true;
+    let bytes = 0;
+    walk(sweep.projectRoot, (rel, abs, size, mtimeMs) => {
+        // EXISTENCE and STAT are recorded for every file, unconditionally. Existence
+        // stops a gap in the content baseline from being read as "this file is new";
+        // size is what lets a later change to an unbaselined file still be noticed,
+        // so coverage warnings name files that actually moved.
+        sweep.known.add(rel);
+        sweep.statAt.set(rel, { size, mtimeMs });
+        if (size > sweep.limits.maxFileBytes)
+            return; // handled via sizeAt, not a truncation
+        if (sweep.baseline.size >= sweep.limits.maxFiles || bytes + size > sweep.limits.maxTotalBytes) {
+            sweep.truncated = true;
+            return; // keep walking: existence still needs the rest of the tree
+        }
+        const text = readText(abs, sweep.limits.maxFileBytes);
+        if (text === null)
+            return; // binary — out of scope, and not a coverage gap
+        sweep.baseline.set(rel, text);
+        bytes += size;
+    });
+}
+/** Record what a guarded tool wrote, so a later shell write is distinguishable. */
+export function recordAuthorisedWrite(sweep, rel, content) {
+    if (sweep.enabled)
+        sweep.authorised.set(rel, content);
+}
+/** Empty bodies in a verdict — the quantity the "strictly worse" test compares. */
+function emptyCount(v) {
+    return Math.round(v.emptyRatio * v.callables);
+}
+/**
+ * Resolve the backup root and prove it is really inside the project.
+ *
+ * The walk never follows symlinks, so no path it yields can escape — but the
+ * backup root is a path this module CONSTRUCTS rather than discovers, and `.uap`
+ * is a directory a shell command can replace with a link. Measured before this
+ * check existed: `ln -s /elsewhere .uap` and the sweep's own backups landed
+ * outside the project root. Returns null when the location cannot be trusted,
+ * which disables every mutation rather than performing an unbacked-up one.
+ */
+function resolveBackupRoot(projectRoot) {
+    try {
+        const holder = join(projectRoot, '.uap');
+        // Check the component we create THROUGH before creating anything, so a
+        // redirected root does not even leave an empty directory behind.
+        try {
+            if (lstatSync(holder).isSymbolicLink())
+                return null;
+        }
+        catch {
+            /* absent — mkdir below creates it inside the project */
+        }
+        const dest = join(projectRoot, BACKUP_DIR);
+        mkdirSync(dest, { recursive: true });
+        const realDest = realpathSync(dest);
+        const realRoot = realpathSync(projectRoot);
+        return realDest === realRoot || realDest.startsWith(realRoot + sep) ? realDest : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Destination inside the backup root for `rel`, or null if it would escape.
+ *
+ * Belt-and-braces now that `relKey` no longer manufactures `..` segments, but
+ * this is the check that actually contains the failure rather than the one that
+ * avoids provoking it — and it is two lines.
+ */
+function backupDest(backupRoot, rel) {
+    const dest = resolve(backupRoot, rel);
+    return dest.startsWith(backupRoot + sep) ? dest : null;
+}
+/**
+ * A destination that will not clobber an earlier turn's backup.
+ *
+ * "Nothing is destroyed" has to hold ACROSS turns, and the retry loop is
+ * designed to re-attempt the same file — so the same `rel` being quarantined
+ * twice is the common case, not an edge one.
+ */
+function freeDest(dest) {
+    if (!existsSync(dest))
+        return dest;
+    for (let i = 2; i < 1000; i++) {
+        const candidate = `${dest}.${i}`;
+        if (!existsSync(candidate))
+            return candidate;
+    }
+    return `${dest}.overflow`;
+}
+/** Copy content into the backup root. False means the caller must NOT mutate. */
+function backup(backupRoot, rel, content) {
+    const dest = backupDest(backupRoot, rel);
+    if (dest === null)
+        return null;
+    try {
+        const target = freeDest(dest);
+        mkdirSync(dirname(target), { recursive: true });
+        writeFileSync(target, content, 'utf-8');
+        return target;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Compare the tree against the baseline and undo unattributed stub writes.
+ * Returns an empty outcome when bash never ran, so the common path is a boolean.
+ */
+export function finishBashSweep(sweep) {
+    if (!sweep.enabled)
+        return emptyOutcome();
+    // Released here rather than by the caller: the executor's `finally` guarantees
+    // this runs, and a root left marked active would silently disable the guard for
+    // every later turn.
+    ACTIVE_ROOTS.delete(sweep.projectRoot);
+    if (!sweep.bashRan || sweep.swept || stubGuardDisabled())
+        return emptyOutcome();
+    sweep.swept = true;
+    const reverted = [];
+    const removed = [];
+    const uncovered = [];
+    const failed = [];
+    // Established once, before anything is touched. A backup location that cannot
+    // be proven inside the project means no mutation happens at all this turn.
+    const backupRoot = resolveBackupRoot(sweep.projectRoot);
+    walk(sweep.projectRoot, (rel, abs, size, mtimeMs) => {
+        const existedBefore = sweep.known.has(rel);
+        const before = sweep.statAt.get(rel);
+        const changedStat = before === undefined || before.size !== size || before.mtimeMs !== mtimeMs;
+        // Unmoved and not written by a guarded tool this turn: nothing to judge, and
+        // no reason to pay a full read. This is most of the tree on most turns.
+        if (!changedStat && !sweep.authorised.has(rel))
+            return;
+        // The last content this harness authorised: a guarded write this turn, else
+        // whatever was there when the first command ran.
+        const authorised = sweep.authorised.get(rel) ?? sweep.baseline.get(rel);
+        if (size > sweep.limits.maxFileBytes) {
+            // Too big to read now, so it can be neither judged nor reverted. Report it
+            // only if it demonstrably moved — otherwise every project with a large
+            // lockfile emits a coverage warning on every single bash turn.
+            if (existedBefore ? changedStat : true)
+                uncovered.push(rel);
+            return;
+        }
+        const current = readText(abs, sweep.limits.maxFileBytes);
+        if (current === null)
+            return; // binary or unreadable — out of scope entirely
+        if (existedBefore && authorised === undefined) {
+            // Known to have existed, but no content is held for it — the content
+            // baseline was capped. Report only a real change; guessing here is what
+            // deleted pre-existing files in the first version of this module.
+            uncovered.push(rel);
+            return;
+        }
+        if (!existedBefore) {
+            // Created this turn. Judged on its own content REGARDLESS of authorisation,
+            // and BEFORE the unchanged-since-authorised skip below — that skip is what
+            // made the laundering hole real: the shell writes a skeleton, one edit_file
+            // fills a single body (legitimately allowed, since monotone progress is
+            // measured against the skeleton itself), the file is stamped as authorised,
+            // and a content comparison then matches and skips it forever.
+            if (!detectStub(rel, current).isStub)
+                return;
+            // Rename IS the backup here — the file's own bytes move to the preserved
+            // location. Writing a copy first and then renaming over it, as this did
+            // originally, paid a full write that the rename immediately discarded and
+            // left a stray duplicate whenever the rename failed.
+            const dest = backupRoot === null ? null : backupDest(backupRoot, rel);
+            if (dest === null) {
+                failed.push(rel);
+                return;
+            }
+            try {
+                const target = freeDest(dest);
+                mkdirSync(dirname(target), { recursive: true });
+                renameSync(abs, target);
+                removed.push(rel);
+            }
+            catch {
+                failed.push(rel);
+            }
+            return;
+        }
+        if (authorised === current)
+            return; // untouched since we last saw it
+        // Pre-existing and changed. Act only when the change made it STRICTLY WORSE:
+        // a formatter or codemod that rewrites an already-stubby file without
+        // emptying anything further must survive.
+        const after = detectStub(rel, current);
+        if (!after.isStub)
+            return;
+        const beforeVerdict = detectStub(rel, authorised);
+        // A baseline the detector could not judge (over its scan cap, or an exempt
+        // extension) reports zero callables, which would make ANY later content with
+        // one empty body read as "strictly worse". No comparison, no action.
+        if (beforeVerdict.callables === 0)
+            return;
+        if (emptyCount(after) <= emptyCount(beforeVerdict))
+            return;
+        if (backupRoot === null || backup(backupRoot, rel, current) === null) {
+            failed.push(rel);
+            return;
+        }
+        try {
+            // Temp-then-rename, the pattern this subsystem already uses elsewhere: an
+            // in-place truncating write that dies mid-way leaves a mangled file whose
+            // good content existed only in a JS string the crash takes with it.
+            const tmp = `${abs}.uap-sweep-tmp`;
+            writeFileSync(tmp, authorised, 'utf-8');
+            renameSync(tmp, abs);
+            reverted.push(rel);
+        }
+        catch {
+            failed.push(rel);
+        }
+    });
+    return {
+        reverted,
+        removed,
+        uncovered,
+        failed,
+        note: buildNote({ reverted, removed, uncovered, failed }),
+    };
+}
+/**
+ * Filenames reach the model verbatim, and POSIX allows newlines and brackets in
+ * them — which would let a crafted name inject harness-shaped lines into a note
+ * that flows into the retry prompt, the acceptance judge and the operator log.
+ */
+function safeName(rel) {
+    return rel.replace(/[\r\n\][]/g, '_').slice(0, 120);
+}
+function list(paths, max) {
+    const shown = paths.slice(0, max).map(safeName).join(', ');
+    return paths.length > max ? `${shown}, +${paths.length - max} more` : shown;
+}
+function buildNote(r) {
+    const parts = [];
+    const touched = [...r.removed, ...r.reverted];
+    if (touched.length > 0) {
+        const verb = r.removed.length > 0 && r.reverted.length > 0
+            ? 'removed/reverted'
+            : r.removed.length > 0
+                ? 'removed'
+                : 'reverted';
+        // The previous content IS preserved, but the location is deliberately not
+        // named: it lives under `.uap/`, the one directory read_file and list_dir
+        // refuse, and pointing an agent at a path the harness then hides is a
+        // harness bug this codebase has already had to fix once.
+        parts.push(`[blocked: ${touched.length} file(s) changed outside the write tools were SKELETONS — ` +
+            `an API surface with empty function bodies — and have been ${verb}: ${list(touched, 8)}. ` +
+            `Writing files through the shell does not bypass this check. Write the REAL ` +
+            `implementation with write_file — each function must contain the logic that makes ` +
+            `it work. If a file is deliberately a skeleton, give each body an explicit ` +
+            `throw new Error('TODO: <what>') instead of an empty block.]`);
+    }
+    if (r.failed.length > 0) {
+        // A guard that could not act must never look like a guard that found nothing.
+        parts.push(`[warning: the substance check could not act on ${r.failed.length} file(s) ` +
+            `(${list(r.failed, 4)}) — they were left as-is.]`);
+    }
+    if (r.uncovered.length > 0) {
+        // Gated on files that actually CHANGED, not on `truncated`. A capped baseline
+        // where nothing moved is complete coverage in every way the model cares
+        // about; emitting on the cap alone put a warning on every bash turn of every
+        // project with a big lockfile, in a prompt slot that is head-truncated.
+        // `truncated` remains on the sweep for callers and tests, as a fact about the
+        // baseline rather than a claim about coverage.
+        parts.push(`[note: ${r.uncovered.length} changed file(s) were too large to check this turn: ${list(r.uncovered, 4)}.]`);
+    }
+    return parts.join('\n');
+}
+/**
+ * Put the note FIRST — but never ahead of a protocol marker.
+ *
+ * The retry prompt includes the previous output through `truncateHead`, which
+ * keeps the leading 3000 characters, so a note appended after a long turn summary
+ * is exactly the part that gets cut. That argues for prepending.
+ *
+ * Against it: `decodeBudgetStop` only recognises the context-budget marker within
+ * the first 512 characters, and this note routinely exceeds that on its own. A
+ * budget-stopped turn that was also swept would therefore stop being recognised
+ * as budget-stopped — which silently disables the epic controller's rail-sizing
+ * split, on exactly the long shell-using sessions that blow the rail. So when the
+ * output carries that marker, the note goes after the marker's own line: the
+ * marker keeps position 0, and the note is still near the front.
+ */
+export function prependSweepNote(output, outcome) {
+    if (!outcome.note)
+        return output;
+    if (output.startsWith(CONTEXT_BUDGET_MARKER)) {
+        const nl = output.indexOf('\n');
+        return nl === -1
+            ? `${output}\n${outcome.note}`
+            : `${output.slice(0, nl)}\n${outcome.note}${output.slice(nl)}`;
+    }
+    return `${outcome.note}\n${output}`;
+}
+//# sourceMappingURL=bash-sweep.js.map

package/dist/delivery/bash-sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-sweep.js","sourceRoot":"","sources":["../../src/delivery/bash-sweep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AAEH,OAAO,EACL,WAAW,EACX,QAAQ,EACR,SAAS,EACT,aAAa,EACb,SAAS,EACT,UAAU,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,SAAS,IAAI,WAAW,GACzB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAoB,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM;IACN,cAAc;IACd,MAAM;IACN,cAAc;IACd,cAAc;IACd,aAAa;IACb,eAAe;IACf,aAAa;IACb,aAAa;IACb,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,OAAO;IACP,aAAa;IACb,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,+BAA+B;IAC/B,YAAY;IACZ,QAAQ;CACT,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAW/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC/B,YAAY,EAAE,OAAO;CACtB,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAkD5D,+EAA+E;AAC/E,SAAS,YAAY;IACnB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,KAAK,EAAE,IAAI,GAAG,EAAE;QAChB,MAAM,EAAE,IAAI,GAAG,EAAE;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,cAAc;KACvB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,WAAmB,EAAE,GAAW;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACxD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,QAAgB;IAC7C,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM;YAClB,GAAG,IAAI,CAAC,CAAC;QACX,CAAC;QACD,0EAA0E;QAC1E,+EAA+E;QAC/E,4EAA4E;QAC5E,sEAAsE;QACtE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpD,8EAA8E;QAC9E,+EAA+E;QAC/E,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,IAAI,CACX,WAAmB,EACnB,MAAyE;IAEzE,MAAM,KAAK,GAAa,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAY,CAAC;QAClC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,uDAAuD;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,KAAK,WAAW,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,cAAc,EAAE;gBAAE,SAAS,CAAC,0CAA0C;YAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACtC,IAAI,MAAM,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACnD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC1B,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,WAAmB,EACnB,OAAgB,EAChB,SAAsB,cAAc;IAEpC,IAAI,CAAC,OAAO,IAAI,iBAAiB,EAAE;QAAE,OAAO,aAAa,EAAE,CAAC;IAC5D,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IAC1D,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC9B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,WAAW;QACX,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,KAAK,EAAE,IAAI,GAAG,EAAE;QAChB,MAAM,EAAE,IAAI,GAAG,EAAE;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAgB;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO;IAC3B,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;IACrB,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO;IAC5B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACvB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAClD,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,uDAAuD;QACvD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACzC,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO,CAAC,uCAAuC;QACrF,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9F,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YACvB,OAAO,CAAC,2DAA2D;QACrE,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,gDAAgD;QAC3E,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9B,KAAK,IAAI,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,KAAgB,EAAE,GAAW,EAAE,OAAe;IAClF,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,CAAc;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACzC,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;gBAAE,OAAO,IAAI,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC3C,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC3C,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,UAAkB,EAAE,GAAW;IACjD,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,IAAI,WAAW,CAAC;AAC5B,CAAC;AAED,iFAAiF;AACjF,SAAS,MAAM,CAAC,UAAkB,EAAE,GAAW,EAAE,OAAe;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAgB;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1C,+EAA+E;IAC/E,gFAAgF;IAChF,oBAAoB;IACpB,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;QAAE,OAAO,YAAY,EAAE,CAAC;IAChF,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IAEnB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAClD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC;QAC/F,6EAA6E;QAC7E,wEAAwE;QACxE,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QACvD,4EAA4E;QAC5E,iDAAiD;QACjD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACrC,2EAA2E;YAC3E,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,CAAC,+CAA+C;QAE7E,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC9C,qEAAqE;YACrE,wEAAwE;YACxE,kEAAkE;YAClE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,4EAA4E;YAC5E,2EAA2E;YAC3E,4EAA4E;YAC5E,wEAAwE;YACxE,4EAA4E;YAC5E,8DAA8D;YAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,MAAM;gBAAE,OAAO;YAC7C,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,qDAAqD;YACrD,MAAM,IAAI,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACtE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC9B,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,UAAU,KAAK,OAAO;YAAE,OAAO,CAAC,iCAAiC;QAErE,6EAA6E;QAC7E,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO;QAC1B,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,UAAoB,CAAC,CAAC;QAC5D,2EAA2E;QAC3E,6EAA6E;QAC7E,qEAAqE;QACrE,IAAI,aAAa,CAAC,SAAS,KAAK,CAAC;YAAE,OAAO;QAC1C,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO;QAC3D,IAAI,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,0EAA0E;YAC1E,0EAA0E;YAC1E,oEAAoE;YACpE,MAAM,GAAG,GAAG,GAAG,GAAG,gBAAgB,CAAC;YACnC,aAAa,CAAC,GAAG,EAAE,UAAoB,EAAE,OAAO,CAAC,CAAC;YAClD,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,OAAO;QACP,SAAS;QACT,MAAM;QACN,IAAI,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,IAAI,CAAC,KAAe,EAAE,GAAW;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,CAKlB;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GACR,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC3C,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACpB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,UAAU,CAAC;QACnB,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,yDAAyD;QACzD,KAAK,CAAC,IAAI,CACR,aAAa,OAAO,CAAC,MAAM,4DAA4D;YACrF,6DAA6D,IAAI,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI;YAC1F,6EAA6E;YAC7E,mFAAmF;YACnF,4EAA4E;YAC5E,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,8EAA8E;QAC9E,KAAK,CAAC,IAAI,CACR,kDAAkD,CAAC,CAAC,MAAM,CAAC,MAAM,WAAW;YAC1E,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,4BAA4B,CACpD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,8EAA8E;QAC9E,wEAAwE;QACxE,6EAA6E;QAC7E,wEAAwE;QACxE,8EAA8E;QAC9E,+CAA+C;QAC/C,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,MAAM,uDAAuD,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,OAAqB;IACpE,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,KAAK,CAAC,CAAC;YACd,CAAC,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,IAAI,EAAE;YAC9B,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;AACtC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.173.0",
+  "version": "1.174.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",