@noopolis/daimon 0.1.2 → 0.2.1

package/dist/runtime/grokBrokerTurnMeter.js

@@ -0,0 +1,337 @@
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { sumEngineBrokerTurnUsage } from "./engineBrokerTurnAccounting.js";
+/**
+ * The weight a cached prompt read carries against the token ceiling.
+ *
+ * The ceiling exists to bound spend, and a cached read is billed at a quarter
+ * of a fresh input token (xAI's published cached-input rate for the Grok 4
+ * family). Counting it at full weight made the ceiling a context-size limit
+ * instead: a writing or composing turn re-reads its whole conversation on
+ * every request, 85–90% of it from cache, and production turns died at a
+ * 1.1M "ceiling" having spent about a third of that. Fresh input, output and
+ * reasoning still count in full; the sealed usage and ledgers are unchanged
+ * and keep every cached token at its raw count.
+ */
+export const GROK_CACHED_INPUT_TOKEN_WEIGHT = 0.25;
+/** What one request's usage costs against `maxTokens`: everything at full weight except cached reads. */
+export const grokCeilingTokens = (usage) => usage.total - usage.cacheRead + Math.ceil(usage.cacheRead * GROK_CACHED_INPUT_TOKEN_WEIGHT);
+/**
+ * The proxy's per-turn spend gate.
+ *
+ * Every forwarded model request of one turn passes through {@link admit}
+ * *before* a bearer is attached, so the checks are hard for requests and
+ * elapsed time and between-requests for tokens:
+ *
+ * - `maxRequests`: request `maxRequests + 1` is refused; upstream never sees it.
+ * - `timeoutMs`: a request arriving after the deadline is refused (the broker's
+ *   own timer additionally kills a worker that is mid-request).
+ * - `maxTokens`: checked against the running total of upstream-reported usage
+ *   of the requests already answered. A request is admitted while that total is
+ *   still below the ceiling, so the overshoot is bounded by exactly one
+ *   request's usage — the last admitted one. Cached prompt reads count at
+ *   {@link GROK_CACHED_INPUT_TOKEN_WEIGHT} ({@link grokCeilingTokens}); an
+ *   uncached replay (P0 observed one at +55%) is fresh input and counts in full.
+ *
+ * The first limit that fires is sticky: every later request is refused with
+ * the same reason, and `onLimit` runs once.
+ *
+ * The token bound is only a bound if no request can be admitted on a total
+ * that an in-flight request has not yet reported into. So a turn has at most
+ * ONE upstream request in flight: a second request arriving before the first
+ * settled is refused (`busy`, HTTP 429) without being counted or tripping a
+ * limit. Grok's headless loop is sequential — every live capture (P1
+ * live-round1, P2 live) shows each request ending before the next starts — so
+ * this refuses only a worker that is not behaving like Grok. Tripping a limit
+ * (including the broker's timer) aborts that in-flight upstream call through
+ * its own `AbortSignal` rather than letting it run to completion.
+ */
+export class GrokBrokerTurnMeter {
+    limits;
+    onLimit;
+    now;
+    startedAt;
+    timings = [];
+    tokens = 0;
+    reason = "none";
+    inFlight;
+    final;
+    activityAt;
+    constructor(limits, onLimit = () => undefined, now = Date.now) {
+        this.limits = limits;
+        this.onLimit = onLimit;
+        this.now = now;
+        this.startedAt = now();
+        this.activityAt = this.startedAt;
+    }
+    /** Returns the request index and its upstream abort signal when admitted, the limit that refused it, or `busy` while another request is in flight. */
+    admit() {
+        if (this.reason === "none") {
+            if (this.now() - this.startedAt >= this.limits.timeoutMs)
+                this.trip("timeout");
+            else if (this.timings.length >= this.limits.maxRequests)
+                this.trip("requests");
+            else if (this.tokens >= this.limits.maxTokens)
+                this.trip("tokens");
+        }
+        if (this.reason !== "none")
+            return { refused: this.reason };
+        if (this.inFlight !== undefined)
+            return { busy: true };
+        this.timings.push({ startedAt: new Date(this.now()).toISOString() });
+        // A new request means the previous answer was not the last one.
+        this.final = undefined;
+        this.activityAt = this.now();
+        const controller = new AbortController();
+        this.inFlight = { index: this.timings.length - 1, controller };
+        return { index: this.inFlight.index, signal: controller.signal };
+    }
+    /**
+     * Records one admitted request's end, its usage, and the tool-call names its
+     * response carried. A response without valid usage (absent, malformed,
+     * implausible, or a failed/aborted call) is charged a conservative estimate
+     * from the request body size, so a missing `usage` can never silently disable
+     * the token ceiling. `toolCalls` is observation only: it never affects
+     * admission, the running total, or any limit.
+     *
+     * `finalReply` is the answer text of a response that called no tool and
+     * stopped ({@link parseGrokFinalReply}). It is recorded only when the same
+     * response decoded to zero tool calls, and only for the request still the
+     * latest: it is what lets the broker end a turn whose worker has finished but
+     * not exited, and report finished work whose stdout the launcher refused.
+     */
+    settle(index, usage, requestBytes, toolCalls, finalReply) {
+        const timing = this.timings[index];
+        if (timing === undefined || timing.endedAt !== undefined)
+            return;
+        if (this.inFlight?.index === index)
+            this.inFlight = undefined;
+        timing.endedAt = new Date(this.now()).toISOString();
+        if (usage === undefined) {
+            timing.usage = estimateGrokRequestUsage(requestBytes);
+            timing.estimated = true;
+        }
+        else
+            timing.usage = usage;
+        if (toolCalls !== undefined)
+            timing.toolCalls = toolCalls;
+        this.tokens += grokCeilingTokens(timing.usage);
+        this.activityAt = this.now();
+        if (finalReply !== undefined && toolCalls !== undefined && toolCalls.length === 0 && index === this.timings.length - 1)
+            this.final = { index, text: finalReply, at: this.activityAt };
+    }
+    /** The turn's final reply, while no later request has been admitted. */
+    finalReply() { return this.final; }
+    /** Whether a model request is in flight right now. */
+    busy() { return this.inFlight !== undefined; }
+    /** When a model request last started or settled (the meter's construction before any). */
+    lastActivityAt() { return this.activityAt; }
+    /** Trips a limit from outside the request path (the broker's wall-clock timer). */
+    trip(reason) {
+        if (this.reason !== "none")
+            return;
+        this.reason = reason;
+        this.abortInFlight();
+        this.onLimit(reason);
+    }
+    /** Aborts the in-flight upstream call, if any (limit trip, or the broker ending the turn). */
+    abortInFlight() { this.inFlight?.controller.abort(); }
+    snapshot() {
+        const measured = this.timings.flatMap((timing) => timing.usage === undefined ? [] : [timing.usage]);
+        return { requests: this.timings.length, tokens: this.tokens, limitReason: this.reason, usage: sumEngineBrokerTurnUsage(measured), estimatedRequests: this.timings.filter((timing) => timing.estimated === true).length, timings: this.timings.map((timing) => Object.freeze({ ...timing })) };
+    }
+}
+const { requestUsageMaxTokens, missingUsageEstimate } = GROK_ENGINE_BROKER.turnLimits;
+/** The charge for a request without valid usage: `ceil(bodyBytes / 2)` input plus a fixed output allowance. */
+export const estimateGrokRequestUsage = (requestBytes) => {
+    const input = Math.ceil(Math.max(0, requestBytes) / missingUsageEstimate.inputBytesPerToken), output = missingUsageEstimate.outputTokens;
+    return { input, cacheRead: 0, cacheWrite: 0, output, total: input + output };
+};
+const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const count = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+/**
+ * Upstream-reported usage of one chat-completions response, or `undefined`.
+ *
+ * The proxy buffers the whole upstream body, so the last `usage` object of an
+ * SSE stream (`stream_options.include_usage`) or of a JSON body is available
+ * before the body is returned to the worker. OpenAI-shaped `prompt_tokens`
+ * include cached tokens; they are split into disjoint buckets here, and any
+ * reasoning tokens reported outside `completion_tokens` (visible as
+ * `total_tokens` above prompt + completion) are folded into `output` so the
+ * total invariant holds. A malformed block, or one whose total exceeds
+ * `GROK_ENGINE_BROKER.turnLimits.requestUsageMaxTokens`, is invalid: never
+ * zero-filled and never added — the meter charges an estimate instead.
+ */
+export function parseGrokUpstreamUsage(body, contentType) {
+    let found;
+    for (const candidate of decodeUpstreamResponse(body, contentType) ?? []) {
+        if (!isRecord(candidate) || !isRecord(candidate.usage))
+            continue;
+        // Last usage block wins even when invalid: an implausible final report
+        // must not fall back to an earlier, smaller block (the request is then
+        // charged the estimate instead).
+        found = decodeOpenAiUsage(candidate.usage);
+    }
+    return found;
+}
+/**
+ * Every decodable JSON object of one upstream response: each `data:` event of
+ * an SSE stream, or the single body of a JSON response.
+ *
+ * `undefined` means *nothing* decoded — an unparseable or non-JSON response.
+ * Callers must keep that distinct from a decoded response that said nothing,
+ * because the ledger never fabricates an observation it did not make.
+ */
+function decodeUpstreamResponse(body, contentType) {
+    const text = Buffer.from(body.buffer, body.byteOffset, body.byteLength).toString("utf8");
+    const candidates = [];
+    if (contentType?.includes("text/event-stream") === true || text.startsWith("data:")) {
+        for (const line of text.split(/\r?\n/u)) {
+            if (!line.startsWith("data:"))
+                continue;
+            const payload = line.slice(5).trim();
+            if (payload === "[DONE]" || payload.length === 0)
+                continue;
+            try {
+                candidates.push(JSON.parse(payload));
+            }
+            catch { /* a non-JSON event carries neither usage nor a tool call */ }
+        }
+    }
+    else {
+        try {
+            candidates.push(JSON.parse(text));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return candidates.length === 0 ? undefined : candidates;
+}
+/** At most this many names per request row; a longer list ends in {@link GROK_TOOL_CALL_TRUNCATED}. */
+export const GROK_REQUEST_TOOL_CALLS_MAX = 16;
+/** A `name` that is not a plain short identifier is counted, never passed through. */
+export const GROK_TOOL_CALL_INVALID = "<invalid>";
+export const GROK_TOOL_CALL_TRUNCATED = "<truncated>";
+const TOOL_CALL_NAME = /^[A-Za-z0-9_.-]{1,64}$/u;
+/**
+ * The tool-call NAMES one upstream response carried, and nothing else.
+ *
+ * Two live turns could not answer "did the model ever try `use_tool` or
+ * `search_tool`", because the per-request rows recorded timings and tokens but
+ * never an attempt. This is that answer, under four rules:
+ *
+ * - names only. No arguments, no message content, no tokens, no header. A
+ *   `name` that is not a plain short identifier is recorded as
+ *   {@link GROK_TOOL_CALL_INVALID} rather than passing provider bytes through;
+ * - bounded. At most {@link GROK_REQUEST_TOOL_CALLS_MAX} entries, the last being
+ *   {@link GROK_TOOL_CALL_TRUNCATED} when the response carried more, so a
+ *   pathological response cannot write an unbounded row;
+ * - absence stays absence. A decoded response that called nothing returns `[]`;
+ *   a response that could not be decoded returns `undefined` and the row records
+ *   no field at all;
+ * - one streaming call names itself in one delta and streams its arguments in
+ *   the rest, so a repeat of the same `(choice, call)` index is that same call,
+ *   not a second attempt.
+ */
+export function parseGrokResponseToolNames(body, contentType) {
+    const candidates = decodeUpstreamResponse(body, contentType);
+    if (candidates === undefined)
+        return undefined;
+    const names = [], seen = new Set();
+    scan: for (const candidate of candidates) {
+        if (!isRecord(candidate) || !Array.isArray(candidate.choices))
+            continue;
+        for (const choice of candidate.choices) {
+            if (!isRecord(choice))
+                continue;
+            for (const source of [choice.delta, choice.message]) {
+                if (!isRecord(source) || !Array.isArray(source.tool_calls))
+                    continue;
+                for (const call of source.tool_calls) {
+                    if (!isRecord(call) || !isRecord(call.function))
+                        continue;
+                    const name = call.function.name;
+                    // An arguments-only delta names nothing; it is not an attempt of its own.
+                    if (typeof name !== "string" || name.length === 0)
+                        continue;
+                    if (typeof choice.index === "number" && typeof call.index === "number") {
+                        const key = `${choice.index}:${call.index}`;
+                        if (seen.has(key))
+                            continue;
+                        seen.add(key);
+                    }
+                    names.push(TOOL_CALL_NAME.test(name) ? name : GROK_TOOL_CALL_INVALID);
+                    if (names.length > GROK_REQUEST_TOOL_CALLS_MAX)
+                        break scan;
+                }
+            }
+        }
+    }
+    return names.length > GROK_REQUEST_TOOL_CALLS_MAX ? [...names.slice(0, GROK_REQUEST_TOOL_CALLS_MAX - 1), GROK_TOOL_CALL_TRUNCATED] : names;
+}
+/** The most of a final reply the broker reports; the rest is cut at a marker that says how much. */
+export const GROK_FINAL_REPLY_MAX_BYTES = 64 * 1024;
+/**
+ * The answer text of a response that *stopped*: every `delta.content` of a
+ * streamed response (or the `message.content` of a JSON one) in order, when
+ * some choice finished with `finish_reason: "stop"` and none with anything else.
+ *
+ * `undefined` means the response is not known to be final — undecodable, no
+ * finish reason, or one that asks for a tool. The caller additionally requires
+ * the same body to have decoded to zero tool calls. The text is bounded by
+ * {@link boundGrokFinalReply}, so a runaway answer can never make the turn's
+ * own report the thing that fails it.
+ */
+export function parseGrokFinalReply(body, contentType) {
+    const candidates = decodeUpstreamResponse(body, contentType);
+    if (candidates === undefined)
+        return undefined;
+    let text = "", stopped = false;
+    for (const candidate of candidates) {
+        if (!isRecord(candidate) || !Array.isArray(candidate.choices))
+            continue;
+        for (const choice of candidate.choices) {
+            if (!isRecord(choice))
+                continue;
+            for (const source of [choice.delta, choice.message])
+                if (isRecord(source) && typeof source.content === "string")
+                    text += source.content;
+            // Only `stop` is a finished answer: `length` was cut off mid-answer and
+            // `content_filter` withheld it, so neither is work done.
+            if (typeof choice.finish_reason === "string" && choice.finish_reason.length > 0) {
+                if (choice.finish_reason !== "stop")
+                    return undefined;
+                stopped = true;
+            }
+        }
+    }
+    return stopped ? boundGrokFinalReply(text) : undefined;
+}
+/** `text` whole when it fits {@link GROK_FINAL_REPLY_MAX_BYTES}, else its head and a marker naming what was cut — never a failure. */
+export function boundGrokFinalReply(text, maxBytes = GROK_FINAL_REPLY_MAX_BYTES) {
+    const bytes = Buffer.byteLength(text, "utf8");
+    if (bytes <= maxBytes)
+        return text;
+    const marker = (cut) => `\n[… ${cut} bytes truncated by the Daimon broker …]`;
+    const budget = Math.max(0, maxBytes - Buffer.byteLength(marker(bytes)));
+    // Cut on a code point: a byte-counted window must not leave half a character behind.
+    const head = new TextDecoder("utf-8", { fatal: false }).decode(Buffer.from(text, "utf8").subarray(0, budget)).replace(/\uFFFD$/u, "");
+    return `${head}${marker(bytes - Buffer.byteLength(head, "utf8"))}`;
+}
+function decodeOpenAiUsage(usage) {
+    const prompt = count(usage.prompt_tokens), completion = count(usage.completion_tokens);
+    if (prompt === undefined || completion === undefined)
+        return undefined;
+    const details = isRecord(usage.prompt_tokens_details) ? usage.prompt_tokens_details : {};
+    const cached = details.cached_tokens === undefined ? 0 : count(details.cached_tokens);
+    const reported = usage.total_tokens === undefined ? prompt + completion : count(usage.total_tokens);
+    if (cached === undefined || reported === undefined || cached > prompt)
+        return undefined;
+    const total = Math.max(reported, prompt + completion);
+    const completionDetails = isRecord(usage.completion_tokens_details) ? usage.completion_tokens_details : {};
+    const reasoning = count(completionDetails.reasoning_tokens);
+    const output = total - prompt;
+    if (total > requestUsageMaxTokens)
+        return undefined;
+    return { input: prompt - cached, cacheRead: cached, cacheWrite: 0, output, total, ...(reasoning === undefined || reasoning > output ? {} : { reasoning }) };
+}

package/dist/runtime/grokBrokerWorkerConfig.d.ts

@@ -0,0 +1,89 @@
+import { type GrokWorkerConfigVariant } from "../contracts/grokBrokerTaskClock.js";
+import { type GrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
+export { DAIMON_GROK_SYSTEM_PROMPT, GROK_WORKER_MAX_TURNS, GROK_WORKER_TOOL_IDS, GROK_WORKER_VISIBLE_TOOLS } from "../contracts/grokWorkerContract.js";
+/**
+ * Bundled skills shipped by Grok CLI 1.0.34. Names are version-specific:
+ * `[skills] disabled` removed all ~2.1k skill tokens in the P0 matrix, and a
+ * CLI bump must re-derive this list rather than inherit it.
+ */
+export declare const GROK_1_0_34_BUNDLED_SKILLS: readonly ["build-with-ai", "code-review", "create-skill", "create-workflow", "design", "docx", "execute-plan", "game-animation-frames", "game-asset-core", "game-character-consistency", "game-tilesets", "game-ui-icons", "imagine", "implement", "learn", "long-running-background-tasks", "pdf", "pptx", "pr-babysit", "resume-claude", "resume-codex", "resume-cursor", "review", "skill-design-principles", "statusline"];
+/** The worker's only model id; the argv selects it and the proxy never sees another. */
+export declare const GROK_BROKER_WORKER_MODEL_ID: "daimon-broker-grok";
+/**
+ * Grok 1.0.34 sends a `session_title` model request before every headless
+ * turn, and no config key or environment variable disables it
+ * (`features.title_refresh` governs only the later refresh; verified against a
+ * loopback stub). `[models] session_summary` does select the model it uses, so
+ * the title goes to a hidden model whose endpoint is the broker's own provider
+ * proxy with a placeholder key that can never be a turn capability (shorter
+ * than the 40-character capability alphabet). The proxy refuses it before any
+ * capability lookup, isolation guard, credential read, or upstream call, and
+ * Grok falls back to the truncated prompt as the title. The endpoint is always
+ * listening while a worker runs, so the refusal is bounded by one loopback
+ * round trip rather than by a connect timeout, and a prompt-derived title is
+ * never delivered anywhere but Daimon's own proxy.
+ */
+export declare const GROK_SESSION_TITLE_SINK_MODEL_ID: "daimon-session-title-disabled";
+export declare const GROK_SESSION_TITLE_SINK_KEY: "session-title-disabled";
+/**
+ * The turn-scoped proxy capability reaches the worker's only model through
+ * `env_key`, set by the native launcher. Grok 1.0.34 accepts
+ * `[auth_provider.<name>]` tables but never runs the helper for a custom model
+ * (verified against a loopback stub: no helper invocation and no Authorization
+ * header, with and without `args`, `api_backend`, `model_providers`, or a
+ * passwd-home config), while `env_key` attaches the bearer on every request.
+ * The capability is exactly as exposed as `DAIMON_MCP_CAPABILITY`: visible to
+ * the worker's own tool children, which run network-restricted, and revoked
+ * when the turn ends.
+ */
+export declare const GROK_BROKER_PROVIDER_CAPABILITY_ENV: "DAIMON_PROVIDER_CAPABILITY";
+type WorkerEndpoints = Readonly<{
+    proxyPort: number;
+    mcpUrl: string;
+}>;
+/**
+ * Sections shared by every Grok worker Daimon configures, broker or direct.
+ *
+ * Each toggle is either measured (skills −2.1k tokens, workflows −314, the
+ * per-turn `session_title` model request) or behavioural hardening that P0
+ * showed to be token-neutral and warning-free on 1.0.34.
+ */
+export declare const renderGrokLeanBaseConfig: () => string;
+/**
+ * `max_retries = 0` on the worker's own model, for the same reason its two
+ * siblings already carry it (the session-title sink above,
+ * `grokInferenceClientConfig.ts` for the evaluator): with Grok 1.0.34's
+ * default, a refused or failed request is retried with backoff **past 45 s**
+ * instead of failing in ~0.35 s, and the retries are blind — one live turn
+ * emitted the same refusal fifteen times over five minutes, spent $0, and died
+ * with no account of why. Only this model block was left on the default, so
+ * the one request path that spends money was also the only one that could
+ * stall a turn for minutes after its work was done. Daimon owns the retry
+ * decision here because the proxy is the thing being retried: a genuinely
+ * transient fault is already answered 503 and is the broker's to retry, and
+ * anything else is a refusal that repeating cannot fix. The worker instead
+ * fails fast and the turn reaches the host with a status.
+ */
+/**
+ * The only source of broker worker `config.toml` bytes.
+ *
+ * Effort is declared here, not on the compiled launcher argv: the argv is one
+ * constant for every registration while effort is declared per deployment, and
+ * Grok 1.0.34 drops both `--reasoning-effort` and `[models]
+ * default_reasoning_effort` unless the model advertises effort support. A
+ * one-entry `reasoning_efforts` table makes the declared effort the model's
+ * default *and* its closed enum, so it reaches the request body and nothing
+ * else can be selected; the proxy then re-verifies it on every body.
+ */
+export declare function renderGrokBrokerWorkerConfig(policy?: Partial<GrokBrokerModelPolicy>, variant?: GrokWorkerConfigVariant, slot?: number): string;
+/** Explicit-endpoint variant for the local live probe; production bytes come only from the function above. */
+export declare function renderGrokBrokerWorkerConfigWith(policy: GrokBrokerModelPolicy, endpoints: WorkerEndpoints): string;
+export declare const grokBrokerWorkerConfigSha256: (policy?: Partial<GrokBrokerModelPolicy>, variant?: GrokWorkerConfigVariant, slot?: number) => string;
+/** Validate the slot-zero template pin before deriving bytes for another canonical slot path. */
+export declare function grokBrokerWorkerConfigPins(policy: GrokBrokerModelPolicy, slot?: number): Readonly<Record<GrokWorkerConfigVariant, string>>;
+/**
+ * TypeScript mirror of the argv compiled into `native/engineBrokerLauncherCore.inc`.
+ * `native/launcherArgv.test.ts` parses the C source and fails on any divergence.
+ */
+export declare const renderGrokBrokerWorkerArgs: (promptFile: string, cwd: string) => readonly string[];
+//# sourceMappingURL=grokBrokerWorkerConfig.d.ts.map

package/dist/runtime/grokBrokerWorkerConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grokBrokerWorkerConfig.d.ts","sourceRoot":"","sources":["../../src/runtime/grokBrokerWorkerConfig.ts"],"names":[],"mappings":"AAGA,OAAO,EAA0B,KAAK,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAK3G,OAAO,EAA8B,KAAK,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEpG,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAEvJ;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,gaAK5B,CAAC;AAEZ,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,EAAG,oBAA6B,CAAC;AAEzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gCAAgC,EAAG,+BAAwC,CAAC;AACzF,eAAO,MAAM,2BAA2B,EAAG,wBAAiC,CAAC;AAM7E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC,EAAG,4BAAqC,CAAC;AAEzF,KAAK,eAAe,GAAG,QAAQ,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAMvE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,QAAO,MAQhC,CAAC;AAEb;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,GAAE,OAAO,CAAC,qBAAqB,CAAM,EAAE,OAAO,GAAE,uBAAqC,EAAE,IAAI,SAAI,GAAG,MAAM,CAS1J;AAED,8GAA8G;AAC9G,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,eAAe,GAAG,MAAM,CAgBlH;AAED,eAAO,MAAM,4BAA4B,GAAI,SAAQ,OAAO,CAAC,qBAAqB,CAAM,EAAE,UAAS,uBAAqC,EAAE,aAAQ,KAAG,MACrD,CAAC;AAEjG,iGAAiG;AACjG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,SAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAKrI;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,GAAI,YAAY,MAAM,EAAE,KAAK,MAAM,KAAG,SAAS,MAAM,EAU3F,CAAC"}

package/dist/runtime/grokBrokerWorkerConfig.js

@@ -0,0 +1,154 @@
+import { brokerTaskClockFileFor } from "./grokBrokerSlot.js";
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { GROK_BROKER_TASK_CLOCK } from "../contracts/grokBrokerTaskClock.js";
+import { shellEnvironmentPolicyEntries } from "../contracts/shellEnvironmentPolicy.js";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { DAIMON_GROK_SYSTEM_PROMPT, GROK_WORKER_MAX_TURNS, GROK_WORKER_TOOL_IDS } from "../contracts/grokWorkerContract.js";
+import { parseGrokBrokerModelPolicy } from "./grokBrokerModelPolicy.js";
+export { DAIMON_GROK_SYSTEM_PROMPT, GROK_WORKER_MAX_TURNS, GROK_WORKER_TOOL_IDS, GROK_WORKER_VISIBLE_TOOLS } from "../contracts/grokWorkerContract.js";
+/**
+ * Bundled skills shipped by Grok CLI 1.0.34. Names are version-specific:
+ * `[skills] disabled` removed all ~2.1k skill tokens in the P0 matrix, and a
+ * CLI bump must re-derive this list rather than inherit it.
+ */
+export const GROK_1_0_34_BUNDLED_SKILLS = Object.freeze([
+    "build-with-ai", "code-review", "create-skill", "create-workflow", "design", "docx", "execute-plan",
+    "game-animation-frames", "game-asset-core", "game-character-consistency", "game-tilesets", "game-ui-icons",
+    "imagine", "implement", "learn", "long-running-background-tasks", "pdf", "pptx", "pr-babysit",
+    "resume-claude", "resume-codex", "resume-cursor", "review", "skill-design-principles", "statusline"
+]);
+/** The worker's only model id; the argv selects it and the proxy never sees another. */
+export const GROK_BROKER_WORKER_MODEL_ID = "daimon-broker-grok";
+/**
+ * Grok 1.0.34 sends a `session_title` model request before every headless
+ * turn, and no config key or environment variable disables it
+ * (`features.title_refresh` governs only the later refresh; verified against a
+ * loopback stub). `[models] session_summary` does select the model it uses, so
+ * the title goes to a hidden model whose endpoint is the broker's own provider
+ * proxy with a placeholder key that can never be a turn capability (shorter
+ * than the 40-character capability alphabet). The proxy refuses it before any
+ * capability lookup, isolation guard, credential read, or upstream call, and
+ * Grok falls back to the truncated prompt as the title. The endpoint is always
+ * listening while a worker runs, so the refusal is bounded by one loopback
+ * round trip rather than by a connect timeout, and a prompt-derived title is
+ * never delivered anywhere but Daimon's own proxy.
+ */
+export const GROK_SESSION_TITLE_SINK_MODEL_ID = "daimon-session-title-disabled";
+export const GROK_SESSION_TITLE_SINK_KEY = "session-title-disabled";
+const renderSessionTitleSink = (proxyPort) => [
+    `[model.${GROK_SESSION_TITLE_SINK_MODEL_ID}]`, 'model = "disabled"', `base_url = "http://127.0.0.1:${proxyPort}/v1"`, `api_key = "${GROK_SESSION_TITLE_SINK_KEY}"`,
+    "max_retries = 0", "hidden = true", ""
+];
+/**
+ * The turn-scoped proxy capability reaches the worker's only model through
+ * `env_key`, set by the native launcher. Grok 1.0.34 accepts
+ * `[auth_provider.<name>]` tables but never runs the helper for a custom model
+ * (verified against a loopback stub: no helper invocation and no Authorization
+ * header, with and without `args`, `api_backend`, `model_providers`, or a
+ * passwd-home config), while `env_key` attaches the bearer on every request.
+ * The capability is exactly as exposed as `DAIMON_MCP_CAPABILITY`: visible to
+ * the worker's own tool children, which run network-restricted, and revoked
+ * when the turn ends.
+ */
+export const GROK_BROKER_PROVIDER_CAPABILITY_ENV = "DAIMON_PROVIDER_CAPABILITY";
+const PRODUCTION_ENDPOINTS = Object.freeze({
+    proxyPort: GROK_ENGINE_BROKER.providerProxy.port,
+    mcpUrl: `http://${GROK_ENGINE_BROKER.mcpFacade.host}:${GROK_ENGINE_BROKER.mcpFacade.port}${GROK_ENGINE_BROKER.mcpFacade.path}`
+});
+/**
+ * Sections shared by every Grok worker Daimon configures, broker or direct.
+ *
+ * Each toggle is either measured (skills −2.1k tokens, workflows −314, the
+ * per-turn `session_title` model request) or behavioural hardening that P0
+ * showed to be token-neutral and warning-free on 1.0.34.
+ */
+export const renderGrokLeanBaseConfig = () => [
+    "[cli]", "auto_update = false", "use_leader = false", "show_tips = false", "",
+    "[features]", "telemetry = false", "title_refresh = false", "session_recap = false", "turn_summary = false",
+    "repo_status_in_system_prompt = false", "codebase_indexing = false", "backend_tools = false", "ask_user_question = false",
+    "image_gen = false", "video_gen = false", "web_fetch = false", "campaigns = false", "managed_config = false", "",
+    "[managed_mcps]", "enabled = false", "",
+    "[skills]", `disabled = [${GROK_1_0_34_BUNDLED_SKILLS.map((name) => JSON.stringify(name)).join(", ")}]`, "",
+    "[workflows]", "enabled = false", ""
+].join("\n");
+/**
+ * `max_retries = 0` on the worker's own model, for the same reason its two
+ * siblings already carry it (the session-title sink above,
+ * `grokInferenceClientConfig.ts` for the evaluator): with Grok 1.0.34's
+ * default, a refused or failed request is retried with backoff **past 45 s**
+ * instead of failing in ~0.35 s, and the retries are blind — one live turn
+ * emitted the same refusal fifteen times over five minutes, spent $0, and died
+ * with no account of why. Only this model block was left on the default, so
+ * the one request path that spends money was also the only one that could
+ * stall a turn for minutes after its work was done. Daimon owns the retry
+ * decision here because the proxy is the thing being retried: a genuinely
+ * transient fault is already answered 503 and is the broker's to retry, and
+ * anything else is a refusal that repeating cannot fix. The worker instead
+ * fails fast and the turn reaches the host with a status.
+ */
+/**
+ * The only source of broker worker `config.toml` bytes.
+ *
+ * Effort is declared here, not on the compiled launcher argv: the argv is one
+ * constant for every registration while effort is declared per deployment, and
+ * Grok 1.0.34 drops both `--reasoning-effort` and `[models]
+ * default_reasoning_effort` unless the model advertises effort support. A
+ * one-entry `reasoning_efforts` table makes the declared effort the model's
+ * default *and* its closed enum, so it reaches the request body and nothing
+ * else can be selected; the proxy then re-verifies it on every body.
+ */
+export function renderGrokBrokerWorkerConfig(policy = {}, variant = "unclocked", slot = 0) {
+    if (variant !== "unclocked" && variant !== "clocked")
+        throw new TypeError("invalid Grok worker config variant");
+    const base = renderGrokBrokerWorkerConfigWith(parseGrokBrokerModelPolicy(policy), PRODUCTION_ENDPOINTS);
+    return variant === "unclocked" ? base : `${base}\n[shell_environment_policy]\n${shellEnvironmentPolicyEntries({
+        LD_PRELOAD: GROK_BROKER_TASK_CLOCK.preloadPath,
+        FAKETIME_TIMESTAMP_FILE: brokerTaskClockFileFor(slot),
+        FAKETIME_DONT_FAKE_MONOTONIC: "1",
+        LC_ALL: "C"
+    }).join("\n")}\n`;
+}
+/** Explicit-endpoint variant for the local live probe; production bytes come only from the function above. */
+export function renderGrokBrokerWorkerConfigWith(policy, endpoints) {
+    const declared = parseGrokBrokerModelPolicy(policy);
+    const { proxyPort, mcpUrl } = endpoints;
+    if (!Number.isInteger(proxyPort) || proxyPort < 1 || proxyPort > 65_535 || !/^http:\/\/127\.0\.0\.1:\d{1,5}\/mcp$/u.test(mcpUrl)) {
+        throw new TypeError("invalid Grok broker worker configuration");
+    }
+    const label = `${declared.reasoningEffort[0].toUpperCase()}${declared.reasoningEffort.slice(1)}`;
+    return [
+        renderGrokLeanBaseConfig(),
+        "[models]", `default = "${GROK_BROKER_WORKER_MODEL_ID}"`, `default_reasoning_effort = "${declared.reasoningEffort}"`, `session_summary = "${GROK_SESSION_TITLE_SINK_MODEL_ID}"`, "",
+        ...renderSessionTitleSink(proxyPort),
+        `[model.${GROK_BROKER_WORKER_MODEL_ID}]`, `model = "${declared.model}"`, `base_url = "http://127.0.0.1:${proxyPort}/v1"`, `env_key = "${GROK_BROKER_PROVIDER_CAPABILITY_ENV}"`,
+        'api_backend = "chat_completions"', "context_window = 131072", "supports_backend_search = false", "max_retries = 0", "",
+        `[[model.${GROK_BROKER_WORKER_MODEL_ID}.reasoning_efforts]]`, `value = "${declared.reasoningEffort}"`, `label = "${label}"`, "default = true", "",
+        "[mcp_servers.daimon]", `url = "${mcpUrl}"`, 'bearer_token_env_var = "DAIMON_MCP_CAPABILITY"', ""
+    ].join("\n");
+}
+export const grokBrokerWorkerConfigSha256 = (policy = {}, variant = "unclocked", slot = 0) => createHash("sha256").update(renderGrokBrokerWorkerConfig(policy, variant, slot)).digest("hex");
+/** Validate the slot-zero template pin before deriving bytes for another canonical slot path. */
+export function grokBrokerWorkerConfigPins(policy, slot = 0) {
+    const base = GROK_ENGINE_BROKER.worker.clockedConfigSha256[policy.model][policy.reasoningEffort];
+    if (grokBrokerWorkerConfigSha256(policy, "clocked", 0) !== base)
+        throw new Error("Grok clocked config template drifted from manifest");
+    return { unclocked: GROK_ENGINE_BROKER.worker.configSha256[policy.model][policy.reasoningEffort],
+        clocked: grokBrokerWorkerConfigSha256(policy, "clocked", slot) };
+}
+/**
+ * TypeScript mirror of the argv compiled into `native/engineBrokerLauncherCore.inc`.
+ * `native/launcherArgv.test.ts` parses the C source and fails on any divergence.
+ */
+export const renderGrokBrokerWorkerArgs = (promptFile, cwd) => {
+    if (!path.posix.isAbsolute(promptFile) || !path.posix.isAbsolute(cwd))
+        throw new TypeError("invalid Grok broker worker path");
+    return [
+        "--sandbox", "daimon-strict", "--always-approve", "--no-subagents", "--prompt-file", promptFile,
+        "--no-memory", "--disable-web-search", "--no-plan", "--verbatim",
+        "--system-prompt-override", DAIMON_GROK_SYSTEM_PROMPT,
+        "--tools", GROK_WORKER_TOOL_IDS.join(","),
+        "--max-turns", String(GROK_WORKER_MAX_TURNS),
+        "--cwd", cwd, "--output-format", "streaming-messages-json", "--model", GROK_BROKER_WORKER_MODEL_ID
+    ];
+};