@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/grokBrokerTurnMeter.d.ts

@@ -0,0 +1,128 @@
+import { type EngineBrokerLimitReason, type EngineBrokerTurnLimits, type EngineBrokerTurnUsage } from "./engineBrokerTurnAccounting.js";
+/**
+ * `estimated` marks a request whose response carried no valid usage and was
+ * charged {@link estimateGrokRequestUsage}. `toolCalls` are the tool-call names
+ * that request's response carried, names only ({@link parseGrokResponseToolNames});
+ * absent means the response could not be decoded, `[]` that it called nothing.
+ */
+export type GrokBrokerRequestTiming = Readonly<{
+    startedAt: string;
+    endedAt?: string;
+    usage?: EngineBrokerTurnUsage;
+    estimated?: true;
+    toolCalls?: readonly string[];
+}>;
+export type GrokBrokerTurnMeterSnapshot = Readonly<{
+    requests: number;
+    tokens: number;
+    limitReason: EngineBrokerLimitReason;
+    usage: EngineBrokerTurnUsage | null;
+    estimatedRequests: number;
+    timings: readonly GrokBrokerRequestTiming[];
+}>;
+/**
+ * The proxy's per-turn spend gate.
+ *
+ * Every forwarded model request of one turn passes through {@link admit}
+ * *before* a bearer is attached, so the checks are hard for requests and
+ * elapsed time and between-requests for tokens:
+ *
+ * - `maxRequests`: request `maxRequests + 1` is refused; upstream never sees it.
+ * - `timeoutMs`: a request arriving after the deadline is refused (the broker's
+ *   own timer additionally kills a worker that is mid-request).
+ * - `maxTokens`: checked against the running total of upstream-reported usage
+ *   of the requests already answered. A request is admitted while that total is
+ *   still below the ceiling, so the overshoot is bounded by exactly one
+ *   request's usage — the last admitted one. Usage counts total input
+ *   *including* cached tokens (P0 observed an uncached replay at +55%).
+ *
+ * The first limit that fires is sticky: every later request is refused with
+ * the same reason, and `onLimit` runs once.
+ *
+ * The token bound is only a bound if no request can be admitted on a total
+ * that an in-flight request has not yet reported into. So a turn has at most
+ * ONE upstream request in flight: a second request arriving before the first
+ * settled is refused (`busy`, HTTP 429) without being counted or tripping a
+ * limit. Grok's headless loop is sequential — every live capture (P1
+ * live-round1, P2 live) shows each request ending before the next starts — so
+ * this refuses only a worker that is not behaving like Grok. Tripping a limit
+ * (including the broker's timer) aborts that in-flight upstream call through
+ * its own `AbortSignal` rather than letting it run to completion.
+ */
+export declare class GrokBrokerTurnMeter {
+    readonly limits: EngineBrokerTurnLimits;
+    private readonly onLimit;
+    private readonly now;
+    private readonly startedAt;
+    private readonly timings;
+    private tokens;
+    private reason;
+    private inFlight;
+    constructor(limits: EngineBrokerTurnLimits, onLimit?: (reason: Exclude<EngineBrokerLimitReason, "none">) => void, now?: () => number);
+    /** Returns the request index and its upstream abort signal when admitted, the limit that refused it, or `busy` while another request is in flight. */
+    admit(): Readonly<{
+        index: number;
+        signal: AbortSignal;
+    } | {
+        refused: Exclude<EngineBrokerLimitReason, "none">;
+    } | {
+        busy: true;
+    }>;
+    /**
+     * Records one admitted request's end, its usage, and the tool-call names its
+     * response carried. A response without valid usage (absent, malformed,
+     * implausible, or a failed/aborted call) is charged a conservative estimate
+     * from the request body size, so a missing `usage` can never silently disable
+     * the token ceiling. `toolCalls` is observation only: it never affects
+     * admission, the running total, or any limit.
+     */
+    settle(index: number, usage: EngineBrokerTurnUsage | undefined, requestBytes: number, toolCalls?: readonly string[]): void;
+    /** Trips a limit from outside the request path (the broker's wall-clock timer). */
+    trip(reason: Exclude<EngineBrokerLimitReason, "none">): void;
+    /** Aborts the in-flight upstream call, if any (limit trip, or the broker ending the turn). */
+    abortInFlight(): void;
+    snapshot(): GrokBrokerTurnMeterSnapshot;
+}
+/** The charge for a request without valid usage: `ceil(bodyBytes / 2)` input plus a fixed output allowance. */
+export declare const estimateGrokRequestUsage: (requestBytes: number) => EngineBrokerTurnUsage;
+/**
+ * Upstream-reported usage of one chat-completions response, or `undefined`.
+ *
+ * The proxy buffers the whole upstream body, so the last `usage` object of an
+ * SSE stream (`stream_options.include_usage`) or of a JSON body is available
+ * before the body is returned to the worker. OpenAI-shaped `prompt_tokens`
+ * include cached tokens; they are split into disjoint buckets here, and any
+ * reasoning tokens reported outside `completion_tokens` (visible as
+ * `total_tokens` above prompt + completion) are folded into `output` so the
+ * total invariant holds. A malformed block, or one whose total exceeds
+ * `GROK_ENGINE_BROKER.turnLimits.requestUsageMaxTokens`, is invalid: never
+ * zero-filled and never added — the meter charges an estimate instead.
+ */
+export declare function parseGrokUpstreamUsage(body: Uint8Array, contentType: string | undefined): EngineBrokerTurnUsage | undefined;
+/** At most this many names per request row; a longer list ends in {@link GROK_TOOL_CALL_TRUNCATED}. */
+export declare const GROK_REQUEST_TOOL_CALLS_MAX = 16;
+/** A `name` that is not a plain short identifier is counted, never passed through. */
+export declare const GROK_TOOL_CALL_INVALID = "<invalid>";
+export declare const GROK_TOOL_CALL_TRUNCATED = "<truncated>";
+/**
+ * The tool-call NAMES one upstream response carried, and nothing else.
+ *
+ * Two live turns could not answer "did the model ever try `use_tool` or
+ * `search_tool`", because the per-request rows recorded timings and tokens but
+ * never an attempt. This is that answer, under four rules:
+ *
+ * - names only. No arguments, no message content, no tokens, no header. A
+ *   `name` that is not a plain short identifier is recorded as
+ *   {@link GROK_TOOL_CALL_INVALID} rather than passing provider bytes through;
+ * - bounded. At most {@link GROK_REQUEST_TOOL_CALLS_MAX} entries, the last being
+ *   {@link GROK_TOOL_CALL_TRUNCATED} when the response carried more, so a
+ *   pathological response cannot write an unbounded row;
+ * - absence stays absence. A decoded response that called nothing returns `[]`;
+ *   a response that could not be decoded returns `undefined` and the row records
+ *   no field at all;
+ * - one streaming call names itself in one delta and streams its arguments in
+ *   the rest, so a repeat of the same `(choice, call)` index is that same call,
+ *   not a second attempt.
+ */
+export declare function parseGrokResponseToolNames(body: Uint8Array, contentType: string | undefined): readonly string[] | undefined;
+//# sourceMappingURL=grokBrokerTurnMeter.d.ts.map

package/dist/runtime/grokBrokerTurnMeter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerTurnMeter.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerTurnMeter.ts"],"names":[],"mappings":"AACA,OAAO,EAA4B,KAAK,uBAAuB,EAAE,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAElK;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AACxK,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAC;IAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAA;CAAE,CAAC,CAAC;AAE5O;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,mBAAmB;IAMlB,QAAQ,CAAC,MAAM,EAAE,sBAAsB;IAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAgF,OAAO,CAAC,QAAQ,CAAC,GAAG;IALjL,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiI;IACzJ,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,QAAQ,CAA6D;gBACxD,MAAM,EAAE,sBAAsB,EAAmB,OAAO,GAAE,CAAC,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,KAAK,IAAsB,EAAmB,GAAG,GAAE,MAAM,MAAiB;IAI1M,sJAAsJ;IACtJ,KAAK,IAAI,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC;IAclI;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAW1H,mFAAmF;IACnF,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,GAAG,IAAI;IAO5D,8FAA8F;IAC9F,aAAa,IAAI,IAAI;IAErB,QAAQ,IAAI,2BAA2B;CAIxC;AAID,+GAA+G;AAC/G,eAAO,MAAM,wBAAwB,GAAI,cAAc,MAAM,KAAG,qBAG/D,CAAC;AAMF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,qBAAqB,GAAG,SAAS,CAU3H;AA0BD,uGAAuG;AACvG,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,sFAAsF;AACtF,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAClD,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAGtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CA2B3H"}

package/dist/runtime/grokBrokerTurnMeter.js

@@ -0,0 +1,251 @@
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { sumEngineBrokerTurnUsage } from "./engineBrokerTurnAccounting.js";
+/**
+ * The proxy's per-turn spend gate.
+ *
+ * Every forwarded model request of one turn passes through {@link admit}
+ * *before* a bearer is attached, so the checks are hard for requests and
+ * elapsed time and between-requests for tokens:
+ *
+ * - `maxRequests`: request `maxRequests + 1` is refused; upstream never sees it.
+ * - `timeoutMs`: a request arriving after the deadline is refused (the broker's
+ *   own timer additionally kills a worker that is mid-request).
+ * - `maxTokens`: checked against the running total of upstream-reported usage
+ *   of the requests already answered. A request is admitted while that total is
+ *   still below the ceiling, so the overshoot is bounded by exactly one
+ *   request's usage — the last admitted one. Usage counts total input
+ *   *including* cached tokens (P0 observed an uncached replay at +55%).
+ *
+ * The first limit that fires is sticky: every later request is refused with
+ * the same reason, and `onLimit` runs once.
+ *
+ * The token bound is only a bound if no request can be admitted on a total
+ * that an in-flight request has not yet reported into. So a turn has at most
+ * ONE upstream request in flight: a second request arriving before the first
+ * settled is refused (`busy`, HTTP 429) without being counted or tripping a
+ * limit. Grok's headless loop is sequential — every live capture (P1
+ * live-round1, P2 live) shows each request ending before the next starts — so
+ * this refuses only a worker that is not behaving like Grok. Tripping a limit
+ * (including the broker's timer) aborts that in-flight upstream call through
+ * its own `AbortSignal` rather than letting it run to completion.
+ */
+export class GrokBrokerTurnMeter {
+    limits;
+    onLimit;
+    now;
+    startedAt;
+    timings = [];
+    tokens = 0;
+    reason = "none";
+    inFlight;
+    constructor(limits, onLimit = () => undefined, now = Date.now) {
+        this.limits = limits;
+        this.onLimit = onLimit;
+        this.now = now;
+        this.startedAt = now();
+    }
+    /** Returns the request index and its upstream abort signal when admitted, the limit that refused it, or `busy` while another request is in flight. */
+    admit() {
+        if (this.reason === "none") {
+            if (this.now() - this.startedAt >= this.limits.timeoutMs)
+                this.trip("timeout");
+            else if (this.timings.length >= this.limits.maxRequests)
+                this.trip("requests");
+            else if (this.tokens >= this.limits.maxTokens)
+                this.trip("tokens");
+        }
+        if (this.reason !== "none")
+            return { refused: this.reason };
+        if (this.inFlight !== undefined)
+            return { busy: true };
+        this.timings.push({ startedAt: new Date(this.now()).toISOString() });
+        const controller = new AbortController();
+        this.inFlight = { index: this.timings.length - 1, controller };
+        return { index: this.inFlight.index, signal: controller.signal };
+    }
+    /**
+     * Records one admitted request's end, its usage, and the tool-call names its
+     * response carried. A response without valid usage (absent, malformed,
+     * implausible, or a failed/aborted call) is charged a conservative estimate
+     * from the request body size, so a missing `usage` can never silently disable
+     * the token ceiling. `toolCalls` is observation only: it never affects
+     * admission, the running total, or any limit.
+     */
+    settle(index, usage, requestBytes, toolCalls) {
+        const timing = this.timings[index];
+        if (timing === undefined || timing.endedAt !== undefined)
+            return;
+        if (this.inFlight?.index === index)
+            this.inFlight = undefined;
+        timing.endedAt = new Date(this.now()).toISOString();
+        if (usage === undefined) {
+            timing.usage = estimateGrokRequestUsage(requestBytes);
+            timing.estimated = true;
+        }
+        else
+            timing.usage = usage;
+        if (toolCalls !== undefined)
+            timing.toolCalls = toolCalls;
+        this.tokens += timing.usage.total;
+    }
+    /** Trips a limit from outside the request path (the broker's wall-clock timer). */
+    trip(reason) {
+        if (this.reason !== "none")
+            return;
+        this.reason = reason;
+        this.abortInFlight();
+        this.onLimit(reason);
+    }
+    /** Aborts the in-flight upstream call, if any (limit trip, or the broker ending the turn). */
+    abortInFlight() { this.inFlight?.controller.abort(); }
+    snapshot() {
+        const measured = this.timings.flatMap((timing) => timing.usage === undefined ? [] : [timing.usage]);
+        return { requests: this.timings.length, tokens: this.tokens, limitReason: this.reason, usage: sumEngineBrokerTurnUsage(measured), estimatedRequests: this.timings.filter((timing) => timing.estimated === true).length, timings: this.timings.map((timing) => Object.freeze({ ...timing })) };
+    }
+}
+const { requestUsageMaxTokens, missingUsageEstimate } = GROK_ENGINE_BROKER.turnLimits;
+/** The charge for a request without valid usage: `ceil(bodyBytes / 2)` input plus a fixed output allowance. */
+export const estimateGrokRequestUsage = (requestBytes) => {
+    const input = Math.ceil(Math.max(0, requestBytes) / missingUsageEstimate.inputBytesPerToken), output = missingUsageEstimate.outputTokens;
+    return { input, cacheRead: 0, cacheWrite: 0, output, total: input + output };
+};
+const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const count = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+/**
+ * Upstream-reported usage of one chat-completions response, or `undefined`.
+ *
+ * The proxy buffers the whole upstream body, so the last `usage` object of an
+ * SSE stream (`stream_options.include_usage`) or of a JSON body is available
+ * before the body is returned to the worker. OpenAI-shaped `prompt_tokens`
+ * include cached tokens; they are split into disjoint buckets here, and any
+ * reasoning tokens reported outside `completion_tokens` (visible as
+ * `total_tokens` above prompt + completion) are folded into `output` so the
+ * total invariant holds. A malformed block, or one whose total exceeds
+ * `GROK_ENGINE_BROKER.turnLimits.requestUsageMaxTokens`, is invalid: never
+ * zero-filled and never added — the meter charges an estimate instead.
+ */
+export function parseGrokUpstreamUsage(body, contentType) {
+    let found;
+    for (const candidate of decodeUpstreamResponse(body, contentType) ?? []) {
+        if (!isRecord(candidate) || !isRecord(candidate.usage))
+            continue;
+        // Last usage block wins even when invalid: an implausible final report
+        // must not fall back to an earlier, smaller block (the request is then
+        // charged the estimate instead).
+        found = decodeOpenAiUsage(candidate.usage);
+    }
+    return found;
+}
+/**
+ * Every decodable JSON object of one upstream response: each `data:` event of
+ * an SSE stream, or the single body of a JSON response.
+ *
+ * `undefined` means *nothing* decoded — an unparseable or non-JSON response.
+ * Callers must keep that distinct from a decoded response that said nothing,
+ * because the ledger never fabricates an observation it did not make.
+ */
+function decodeUpstreamResponse(body, contentType) {
+    const text = Buffer.from(body.buffer, body.byteOffset, body.byteLength).toString("utf8");
+    const candidates = [];
+    if (contentType?.includes("text/event-stream") === true || text.startsWith("data:")) {
+        for (const line of text.split(/\r?\n/u)) {
+            if (!line.startsWith("data:"))
+                continue;
+            const payload = line.slice(5).trim();
+            if (payload === "[DONE]" || payload.length === 0)
+                continue;
+            try {
+                candidates.push(JSON.parse(payload));
+            }
+            catch { /* a non-JSON event carries neither usage nor a tool call */ }
+        }
+    }
+    else {
+        try {
+            candidates.push(JSON.parse(text));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return candidates.length === 0 ? undefined : candidates;
+}
+/** At most this many names per request row; a longer list ends in {@link GROK_TOOL_CALL_TRUNCATED}. */
+export const GROK_REQUEST_TOOL_CALLS_MAX = 16;
+/** A `name` that is not a plain short identifier is counted, never passed through. */
+export const GROK_TOOL_CALL_INVALID = "<invalid>";
+export const GROK_TOOL_CALL_TRUNCATED = "<truncated>";
+const TOOL_CALL_NAME = /^[A-Za-z0-9_.-]{1,64}$/u;
+/**
+ * The tool-call NAMES one upstream response carried, and nothing else.
+ *
+ * Two live turns could not answer "did the model ever try `use_tool` or
+ * `search_tool`", because the per-request rows recorded timings and tokens but
+ * never an attempt. This is that answer, under four rules:
+ *
+ * - names only. No arguments, no message content, no tokens, no header. A
+ *   `name` that is not a plain short identifier is recorded as
+ *   {@link GROK_TOOL_CALL_INVALID} rather than passing provider bytes through;
+ * - bounded. At most {@link GROK_REQUEST_TOOL_CALLS_MAX} entries, the last being
+ *   {@link GROK_TOOL_CALL_TRUNCATED} when the response carried more, so a
+ *   pathological response cannot write an unbounded row;
+ * - absence stays absence. A decoded response that called nothing returns `[]`;
+ *   a response that could not be decoded returns `undefined` and the row records
+ *   no field at all;
+ * - one streaming call names itself in one delta and streams its arguments in
+ *   the rest, so a repeat of the same `(choice, call)` index is that same call,
+ *   not a second attempt.
+ */
+export function parseGrokResponseToolNames(body, contentType) {
+    const candidates = decodeUpstreamResponse(body, contentType);
+    if (candidates === undefined)
+        return undefined;
+    const names = [], seen = new Set();
+    scan: for (const candidate of candidates) {
+        if (!isRecord(candidate) || !Array.isArray(candidate.choices))
+            continue;
+        for (const choice of candidate.choices) {
+            if (!isRecord(choice))
+                continue;
+            for (const source of [choice.delta, choice.message]) {
+                if (!isRecord(source) || !Array.isArray(source.tool_calls))
+                    continue;
+                for (const call of source.tool_calls) {
+                    if (!isRecord(call) || !isRecord(call.function))
+                        continue;
+                    const name = call.function.name;
+                    // An arguments-only delta names nothing; it is not an attempt of its own.
+                    if (typeof name !== "string" || name.length === 0)
+                        continue;
+                    if (typeof choice.index === "number" && typeof call.index === "number") {
+                        const key = `${choice.index}:${call.index}`;
+                        if (seen.has(key))
+                            continue;
+                        seen.add(key);
+                    }
+                    names.push(TOOL_CALL_NAME.test(name) ? name : GROK_TOOL_CALL_INVALID);
+                    if (names.length > GROK_REQUEST_TOOL_CALLS_MAX)
+                        break scan;
+                }
+            }
+        }
+    }
+    return names.length > GROK_REQUEST_TOOL_CALLS_MAX ? [...names.slice(0, GROK_REQUEST_TOOL_CALLS_MAX - 1), GROK_TOOL_CALL_TRUNCATED] : names;
+}
+function decodeOpenAiUsage(usage) {
+    const prompt = count(usage.prompt_tokens), completion = count(usage.completion_tokens);
+    if (prompt === undefined || completion === undefined)
+        return undefined;
+    const details = isRecord(usage.prompt_tokens_details) ? usage.prompt_tokens_details : {};
+    const cached = details.cached_tokens === undefined ? 0 : count(details.cached_tokens);
+    const reported = usage.total_tokens === undefined ? prompt + completion : count(usage.total_tokens);
+    if (cached === undefined || reported === undefined || cached > prompt)
+        return undefined;
+    const total = Math.max(reported, prompt + completion);
+    const completionDetails = isRecord(usage.completion_tokens_details) ? usage.completion_tokens_details : {};
+    const reasoning = count(completionDetails.reasoning_tokens);
+    const output = total - prompt;
+    if (total > requestUsageMaxTokens)
+        return undefined;
+    return { input: prompt - cached, cacheRead: cached, cacheWrite: 0, output, total, ...(reasoning === undefined || reasoning > output ? {} : { reasoning }) };
+}

package/dist/runtime/grokBrokerWorkerConfig.d.ts

@@ -0,0 +1,86 @@
+import { type GrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
+export { DAIMON_GROK_SYSTEM_PROMPT, GROK_WORKER_MAX_TURNS, GROK_WORKER_TOOL_IDS, GROK_WORKER_VISIBLE_TOOLS } from "../contracts/grokWorkerContract.js";
+/**
+ * Bundled skills shipped by Grok CLI 1.0.34. Names are version-specific:
+ * `[skills] disabled` removed all ~2.1k skill tokens in the P0 matrix, and a
+ * CLI bump must re-derive this list rather than inherit it.
+ */
+export declare const GROK_1_0_34_BUNDLED_SKILLS: readonly ["build-with-ai", "code-review", "create-skill", "create-workflow", "design", "docx", "execute-plan", "game-animation-frames", "game-asset-core", "game-character-consistency", "game-tilesets", "game-ui-icons", "imagine", "implement", "learn", "long-running-background-tasks", "pdf", "pptx", "pr-babysit", "resume-claude", "resume-codex", "resume-cursor", "review", "skill-design-principles", "statusline"];
+/** The worker's only model id; the argv selects it and the proxy never sees another. */
+export declare const GROK_BROKER_WORKER_MODEL_ID: "daimon-broker-grok";
+/**
+ * Grok 1.0.34 sends a `session_title` model request before every headless
+ * turn, and no config key or environment variable disables it
+ * (`features.title_refresh` governs only the later refresh; verified against a
+ * loopback stub). `[models] session_summary` does select the model it uses, so
+ * the title goes to a hidden model whose endpoint is the broker's own provider
+ * proxy with a placeholder key that can never be a turn capability (shorter
+ * than the 40-character capability alphabet). The proxy refuses it before any
+ * capability lookup, isolation guard, credential read, or upstream call, and
+ * Grok falls back to the truncated prompt as the title. The endpoint is always
+ * listening while a worker runs, so the refusal is bounded by one loopback
+ * round trip rather than by a connect timeout, and a prompt-derived title is
+ * never delivered anywhere but Daimon's own proxy.
+ */
+export declare const GROK_SESSION_TITLE_SINK_MODEL_ID: "daimon-session-title-disabled";
+export declare const GROK_SESSION_TITLE_SINK_KEY: "session-title-disabled";
+/**
+ * The turn-scoped proxy capability reaches the worker's only model through
+ * `env_key`, set by the native launcher. Grok 1.0.34 accepts
+ * `[auth_provider.<name>]` tables but never runs the helper for a custom model
+ * (verified against a loopback stub: no helper invocation and no Authorization
+ * header, with and without `args`, `api_backend`, `model_providers`, or a
+ * passwd-home config), while `env_key` attaches the bearer on every request.
+ * The capability is exactly as exposed as `DAIMON_MCP_CAPABILITY`: visible to
+ * the worker's own tool children, which run network-restricted, and revoked
+ * when the turn ends.
+ */
+export declare const GROK_BROKER_PROVIDER_CAPABILITY_ENV: "DAIMON_PROVIDER_CAPABILITY";
+type WorkerEndpoints = Readonly<{
+    proxyPort: number;
+    mcpUrl: string;
+}>;
+/**
+ * Sections shared by every Grok worker Daimon configures, broker or direct.
+ *
+ * Each toggle is either measured (skills −2.1k tokens, workflows −314, the
+ * per-turn `session_title` model request) or behavioural hardening that P0
+ * showed to be token-neutral and warning-free on 1.0.34.
+ */
+export declare const renderGrokLeanBaseConfig: () => string;
+/**
+ * `max_retries = 0` on the worker's own model, for the same reason its two
+ * siblings already carry it (the session-title sink above,
+ * `grokInferenceClientConfig.ts` for the evaluator): with Grok 1.0.34's
+ * default, a refused or failed request is retried with backoff **past 45 s**
+ * instead of failing in ~0.35 s, and the retries are blind — one live turn
+ * emitted the same refusal fifteen times over five minutes, spent $0, and died
+ * with no account of why. Only this model block was left on the default, so
+ * the one request path that spends money was also the only one that could
+ * stall a turn for minutes after its work was done. Daimon owns the retry
+ * decision here because the proxy is the thing being retried: a genuinely
+ * transient fault is already answered 503 and is the broker's to retry, and
+ * anything else is a refusal that repeating cannot fix. The worker instead
+ * fails fast and the turn reaches the host with a status.
+ */
+/**
+ * The only source of broker worker `config.toml` bytes.
+ *
+ * Effort is declared here, not on the compiled launcher argv: the argv is one
+ * constant for every registration while effort is declared per deployment, and
+ * Grok 1.0.34 drops both `--reasoning-effort` and `[models]
+ * default_reasoning_effort` unless the model advertises effort support. A
+ * one-entry `reasoning_efforts` table makes the declared effort the model's
+ * default *and* its closed enum, so it reaches the request body and nothing
+ * else can be selected; the proxy then re-verifies it on every body.
+ */
+export declare function renderGrokBrokerWorkerConfig(policy?: Partial<GrokBrokerModelPolicy>): string;
+/** Explicit-endpoint variant for the local live probe; production bytes come only from the function above. */
+export declare function renderGrokBrokerWorkerConfigWith(policy: GrokBrokerModelPolicy, endpoints: WorkerEndpoints): string;
+export declare const grokBrokerWorkerConfigSha256: (policy?: Partial<GrokBrokerModelPolicy>) => string;
+/**
+ * TypeScript mirror of the argv compiled into `native/engineBrokerLauncherCore.inc`.
+ * `native/launcherArgv.test.ts` parses the C source and fails on any divergence.
+ */
+export declare const renderGrokBrokerWorkerArgs: (promptFile: string, cwd: string) => readonly string[];
+//# sourceMappingURL=grokBrokerWorkerConfig.d.ts.map

package/dist/runtime/grokBrokerWorkerConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerWorkerConfig.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerWorkerConfig.ts"],"names":[],"mappings":"AAKA,OAAO,EAA8B,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEvJ;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,gaAK5B,CAAC;AAEZ,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,EAAG,oBAA6B,CAAC;AAEzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC,EAAG,+BAAwC,CAAC;AACzF,eAAO,MAAM,2BAA2B,EAAG,wBAAiC,CAAC;AAM7E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC,EAAG,4BAAqC,CAAC;AAEzF,KAAK,eAAe,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAMvE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAAO,MAQhC,CAAC;AAEb;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,GAAE,OAAO,CAAC,qBAAqB,CAAM,GAAG,MAAM,CAEhG;AAED,8GAA8G;AAC9G,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,eAAe,GAAG,MAAM,CAgBlH;AAED,eAAO,MAAM,4BAA4B,GAAI,SAAQ,OAAO,CAAC,qBAAqB,CAAM,KAAG,MACV,CAAC;AAElF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,GAAI,YAAY,MAAM,EAAE,KAAK,MAAM,KAAG,SAAS,MAAM,EAU3F,CAAC"}

package/dist/runtime/grokBrokerWorkerConfig.js

@@ -0,0 +1,135 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { DAIMON_GROK_SYSTEM_PROMPT, GROK_WORKER_MAX_TURNS, GROK_WORKER_TOOL_IDS } from "../contracts/grokWorkerContract.js";
+import { parseGrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
+export { DAIMON_GROK_SYSTEM_PROMPT, GROK_WORKER_MAX_TURNS, GROK_WORKER_TOOL_IDS, GROK_WORKER_VISIBLE_TOOLS } from "../contracts/grokWorkerContract.js";
+/**
+ * Bundled skills shipped by Grok CLI 1.0.34. Names are version-specific:
+ * `[skills] disabled` removed all ~2.1k skill tokens in the P0 matrix, and a
+ * CLI bump must re-derive this list rather than inherit it.
+ */
+export const GROK_1_0_34_BUNDLED_SKILLS = Object.freeze([
+    "build-with-ai", "code-review", "create-skill", "create-workflow", "design", "docx", "execute-plan",
+    "game-animation-frames", "game-asset-core", "game-character-consistency", "game-tilesets", "game-ui-icons",
+    "imagine", "implement", "learn", "long-running-background-tasks", "pdf", "pptx", "pr-babysit",
+    "resume-claude", "resume-codex", "resume-cursor", "review", "skill-design-principles", "statusline"
+]);
+/** The worker's only model id; the argv selects it and the proxy never sees another. */
+export const GROK_BROKER_WORKER_MODEL_ID = "daimon-broker-grok";
+/**
+ * Grok 1.0.34 sends a `session_title` model request before every headless
+ * turn, and no config key or environment variable disables it
+ * (`features.title_refresh` governs only the later refresh; verified against a
+ * loopback stub). `[models] session_summary` does select the model it uses, so
+ * the title goes to a hidden model whose endpoint is the broker's own provider
+ * proxy with a placeholder key that can never be a turn capability (shorter
+ * than the 40-character capability alphabet). The proxy refuses it before any
+ * capability lookup, isolation guard, credential read, or upstream call, and
+ * Grok falls back to the truncated prompt as the title. The endpoint is always
+ * listening while a worker runs, so the refusal is bounded by one loopback
+ * round trip rather than by a connect timeout, and a prompt-derived title is
+ * never delivered anywhere but Daimon's own proxy.
+ */
+export const GROK_SESSION_TITLE_SINK_MODEL_ID = "daimon-session-title-disabled";
+export const GROK_SESSION_TITLE_SINK_KEY = "session-title-disabled";
+const renderSessionTitleSink = (proxyPort) => [
+    `[model.${GROK_SESSION_TITLE_SINK_MODEL_ID}]`, 'model = "disabled"', `base_url = "http://127.0.0.1:${proxyPort}/v1"`, `api_key = "${GROK_SESSION_TITLE_SINK_KEY}"`,
+    "max_retries = 0", "hidden = true", ""
+];
+/**
+ * The turn-scoped proxy capability reaches the worker's only model through
+ * `env_key`, set by the native launcher. Grok 1.0.34 accepts
+ * `[auth_provider.<name>]` tables but never runs the helper for a custom model
+ * (verified against a loopback stub: no helper invocation and no Authorization
+ * header, with and without `args`, `api_backend`, `model_providers`, or a
+ * passwd-home config), while `env_key` attaches the bearer on every request.
+ * The capability is exactly as exposed as `DAIMON_MCP_CAPABILITY`: visible to
+ * the worker's own tool children, which run network-restricted, and revoked
+ * when the turn ends.
+ */
+export const GROK_BROKER_PROVIDER_CAPABILITY_ENV = "DAIMON_PROVIDER_CAPABILITY";
+const PRODUCTION_ENDPOINTS = Object.freeze({
+    proxyPort: GROK_ENGINE_BROKER.providerProxy.port,
+    mcpUrl: `http://${GROK_ENGINE_BROKER.mcpFacade.host}:${GROK_ENGINE_BROKER.mcpFacade.port}${GROK_ENGINE_BROKER.mcpFacade.path}`
+});
+/**
+ * Sections shared by every Grok worker Daimon configures, broker or direct.
+ *
+ * Each toggle is either measured (skills −2.1k tokens, workflows −314, the
+ * per-turn `session_title` model request) or behavioural hardening that P0
+ * showed to be token-neutral and warning-free on 1.0.34.
+ */
+export const renderGrokLeanBaseConfig = () => [
+    "[cli]", "auto_update = false", "use_leader = false", "show_tips = false", "",
+    "[features]", "telemetry = false", "title_refresh = false", "session_recap = false", "turn_summary = false",
+    "repo_status_in_system_prompt = false", "codebase_indexing = false", "backend_tools = false", "ask_user_question = false",
+    "image_gen = false", "video_gen = false", "web_fetch = false", "campaigns = false", "managed_config = false", "",
+    "[managed_mcps]", "enabled = false", "",
+    "[skills]", `disabled = [${GROK_1_0_34_BUNDLED_SKILLS.map((name) => JSON.stringify(name)).join(", ")}]`, "",
+    "[workflows]", "enabled = false", ""
+].join("\n");
+/**
+ * `max_retries = 0` on the worker's own model, for the same reason its two
+ * siblings already carry it (the session-title sink above,
+ * `grokInferenceClientConfig.ts` for the evaluator): with Grok 1.0.34's
+ * default, a refused or failed request is retried with backoff **past 45 s**
+ * instead of failing in ~0.35 s, and the retries are blind — one live turn
+ * emitted the same refusal fifteen times over five minutes, spent $0, and died
+ * with no account of why. Only this model block was left on the default, so
+ * the one request path that spends money was also the only one that could
+ * stall a turn for minutes after its work was done. Daimon owns the retry
+ * decision here because the proxy is the thing being retried: a genuinely
+ * transient fault is already answered 503 and is the broker's to retry, and
+ * anything else is a refusal that repeating cannot fix. The worker instead
+ * fails fast and the turn reaches the host with a status.
+ */
+/**
+ * The only source of broker worker `config.toml` bytes.
+ *
+ * Effort is declared here, not on the compiled launcher argv: the argv is one
+ * constant for every registration while effort is declared per deployment, and
+ * Grok 1.0.34 drops both `--reasoning-effort` and `[models]
+ * default_reasoning_effort` unless the model advertises effort support. A
+ * one-entry `reasoning_efforts` table makes the declared effort the model's
+ * default *and* its closed enum, so it reaches the request body and nothing
+ * else can be selected; the proxy then re-verifies it on every body.
+ */
+export function renderGrokBrokerWorkerConfig(policy = {}) {
+    return renderGrokBrokerWorkerConfigWith(parseGrokBrokerModelPolicy(policy), PRODUCTION_ENDPOINTS);
+}
+/** Explicit-endpoint variant for the local live probe; production bytes come only from the function above. */
+export function renderGrokBrokerWorkerConfigWith(policy, endpoints) {
+    const declared = parseGrokBrokerModelPolicy(policy);
+    const { proxyPort, mcpUrl } = endpoints;
+    if (!Number.isInteger(proxyPort) || proxyPort < 1 || proxyPort > 65_535 || !/^http:\/\/127\.0\.0\.1:\d{1,5}\/mcp$/u.test(mcpUrl)) {
+        throw new TypeError("invalid Grok broker worker configuration");
+    }
+    const label = `${declared.reasoningEffort[0].toUpperCase()}${declared.reasoningEffort.slice(1)}`;
+    return [
+        renderGrokLeanBaseConfig(),
+        "[models]", `default = "${GROK_BROKER_WORKER_MODEL_ID}"`, `default_reasoning_effort = "${declared.reasoningEffort}"`, `session_summary = "${GROK_SESSION_TITLE_SINK_MODEL_ID}"`, "",
+        ...renderSessionTitleSink(proxyPort),
+        `[model.${GROK_BROKER_WORKER_MODEL_ID}]`, `model = "${declared.model}"`, `base_url = "http://127.0.0.1:${proxyPort}/v1"`, `env_key = "${GROK_BROKER_PROVIDER_CAPABILITY_ENV}"`,
+        'api_backend = "chat_completions"', "context_window = 131072", "supports_backend_search = false", "max_retries = 0", "",
+        `[[model.${GROK_BROKER_WORKER_MODEL_ID}.reasoning_efforts]]`, `value = "${declared.reasoningEffort}"`, `label = "${label}"`, "default = true", "",
+        "[mcp_servers.daimon]", `url = "${mcpUrl}"`, 'bearer_token_env_var = "DAIMON_MCP_CAPABILITY"', ""
+    ].join("\n");
+}
+export const grokBrokerWorkerConfigSha256 = (policy = {}) => createHash("sha256").update(renderGrokBrokerWorkerConfig(policy)).digest("hex");
+/**
+ * TypeScript mirror of the argv compiled into `native/engineBrokerLauncherCore.inc`.
+ * `native/launcherArgv.test.ts` parses the C source and fails on any divergence.
+ */
+export const renderGrokBrokerWorkerArgs = (promptFile, cwd) => {
+    if (!path.posix.isAbsolute(promptFile) || !path.posix.isAbsolute(cwd))
+        throw new TypeError("invalid Grok broker worker path");
+    return [
+        "--sandbox", "daimon-strict", "--always-approve", "--no-subagents", "--prompt-file", promptFile,
+        "--no-memory", "--disable-web-search", "--no-plan", "--verbatim",
+        "--system-prompt-override", DAIMON_GROK_SYSTEM_PROMPT,
+        "--tools", GROK_WORKER_TOOL_IDS.join(","),
+        "--max-turns", String(GROK_WORKER_MAX_TURNS),
+        "--cwd", cwd, "--output-format", "streaming-messages-json", "--model", GROK_BROKER_WORKER_MODEL_ID
+    ];
+};