@nurix/nustack 0.23.17 → 0.23.19

package/dist/lib/desktop-agents/publish.js

@@ -0,0 +1,98 @@
+import { execFile } from "node:child_process";
+import { gitOutcome } from "../session-engine/worktree.js";
+import { proposalBranchName } from "./checkout.js";
+const PUSH_TIMEOUT_MS = 5 * 60_000;
+const PULL_REQUEST_URL = /https?:\/\/\S+\/pull\/(\d+)/;
+export function commitSubject(label, task) {
+    const first = task.split("\n").find((line) => line.trim() !== "")?.trim() ?? "agent run";
+    return `${label}: ${first}`.slice(0, 120);
+}
+async function gitOk(args, cwd, timeoutMs) {
+    return (await gitOutcome(args, cwd, timeoutMs)).ok;
+}
+async function commitLeftovers(worktree, subject) {
+    const status = await gitOutcome(["status", "--porcelain"], worktree);
+    if (!status.ok || status.stdout === "")
+        return;
+    await gitOutcome(["add", "-A"], worktree);
+    await gitOutcome(["commit", "-m", subject], worktree);
+}
+async function commitsAhead(worktree, base) {
+    const counted = await gitOutcome(["rev-list", "--count", `origin/${base}..HEAD`], worktree);
+    return counted.ok ? Number(counted.stdout) || 0 : 0;
+}
+async function dropLocalBranch(worktree, branch) {
+    await gitOutcome(["checkout", "--detach"], worktree);
+    await gitOutcome(["branch", "-D", branch], worktree);
+}
+function openPullRequest(cwd, args, env) {
+    return new Promise((resolve) => {
+        try {
+            execFile("gh", ["pr", "create", "--base", args.base, "--head", args.head, "--title", args.title, "--body", args.body], { cwd, env, timeout: PUSH_TIMEOUT_MS }, (error, stdout) => {
+                if (error)
+                    return resolve(null);
+                const match = PULL_REQUEST_URL.exec(stdout);
+                resolve(match ? { url: match[0], number: Number(match[1]) } : null);
+            });
+        }
+        catch {
+            resolve(null);
+        }
+    });
+}
+async function pushAndOpen(worktree, branch, base, title, body, env) {
+    if (!(await gitOk(["push", "-u", "origin", branch], worktree, PUSH_TIMEOUT_MS)))
+        return null;
+    const opened = await openPullRequest(worktree, { base, head: branch, title, body }, env);
+    return addressOf(branch, opened);
+}
+export function addressOf(branch, opened) {
+    if (!opened)
+        return { result: { kind: "branch", ref: branch }, pullRequestUrl: null };
+    return { result: { kind: "pull_request", ref: branch, number: opened.number }, pullRequestUrl: opened.url };
+}
+export function pullRequestNumberOf(url) {
+    const match = PULL_REQUEST_URL.exec(url);
+    return match ? Number(match[1]) : null;
+}
+export async function publishRun(request, worktree, branch, base, body, env) {
+    if (request.publish === "none") {
+        await gitOutcome(["reset", "--hard"], worktree);
+        await dropLocalBranch(worktree, branch);
+        return { result: null, pullRequestUrl: null };
+    }
+    const subject = commitSubject(request.agent.label, request.task);
+    await commitLeftovers(worktree, subject);
+    if ((await commitsAhead(worktree, base)) === 0) {
+        await dropLocalBranch(worktree, branch);
+        return { result: null, pullRequestUrl: null };
+    }
+    if (request.publish === "local") {
+        await gitOutcome(["checkout", "--detach"], worktree);
+        return { result: { kind: "branch", ref: branch }, pullRequestUrl: null };
+    }
+    const published = await pushAndOpen(worktree, branch, base, subject, body, env);
+    if (!published) {
+        await gitOutcome(["checkout", "--detach"], worktree);
+        return { result: { kind: "branch", ref: branch }, pullRequestUrl: null };
+    }
+    await dropLocalBranch(worktree, branch);
+    return published;
+}
+function slugOf(branch, runId) {
+    const parts = branch.split("/");
+    return parts.length >= 2 && parts.at(-1) === runId ? (parts.at(-2) ?? "agent") : "agent";
+}
+export async function publishProposal(request, env) {
+    const proposal = proposalBranchName(slugOf(request.branch, request.runId), request.runId);
+    if (!(await gitOk(["branch", "-M", request.branch, proposal], request.checkoutPath)))
+        return null;
+    const body = `Memory proposal from a desktop distillation run (${request.runId}), approved on this device.`;
+    const published = await pushAndOpen(request.checkoutPath, proposal, request.base, request.title, body, env);
+    if (published)
+        await gitOutcome(["branch", "-D", proposal], request.checkoutPath);
+    return published;
+}
+export async function discardProposal(request) {
+    return gitOk(["branch", "-D", request.branch], request.checkoutPath);
+}

package/dist/lib/desktop-agents/request.js

@@ -0,0 +1,152 @@
+export const DESKTOP_AGENT_REQUEST_VERSION = 1;
+export const DESKTOP_AGENT_REFUSAL_CODES = ["REQUEST_INVALID", "REQUEST_VERSION_UNSUPPORTED"];
+export const DESKTOP_AGENT_RUN_REASONS = [
+    "checkout_unbound",
+    "harness_unmounted",
+    "wall_clock",
+    "engine_mismatch",
+    "model_failed",
+    "app_exit",
+    "cli_output_unreadable",
+];
+export const DESKTOP_AGENT_REF_SEGMENT = /^[A-Za-z0-9_-]+$/;
+export const DESKTOP_AGENT_PR_BASES = ["change", "default"];
+export const DESKTOP_AGENT_PUBLISH_MODES = ["push", "local", "none"];
+export const DESKTOP_AGENT_TOOL_PROFILES = ["change", "review"];
+export const DESKTOP_AGENT_ENGINES = ["api_key", "local_model", "seat"];
+export const DESKTOP_AGENT_MOUNT_VALUES = ["nustack", "none", "etna"];
+function invalid(field, expected) {
+    return { ok: false, code: "REQUEST_INVALID", message: `${field} must be ${expected}.` };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim() !== "";
+}
+function isNullableString(value) {
+    return value === null || typeof value === "string";
+}
+function oneOf(values, value) {
+    return typeof value === "string" && values.includes(value);
+}
+function readVersion(raw) {
+    if (typeof raw.requestVersion !== "number" || !Number.isInteger(raw.requestVersion))
+        return invalid("requestVersion", "an integer");
+    if (raw.requestVersion !== DESKTOP_AGENT_REQUEST_VERSION) {
+        return { ok: false, code: "REQUEST_VERSION_UNSUPPORTED", message: `requestVersion ${raw.requestVersion} is not supported; this CLI reads ${DESKTOP_AGENT_REQUEST_VERSION}.` };
+    }
+    return null;
+}
+export function parseRunRequest(raw) {
+    if (!isRecord(raw))
+        return invalid("the request", "a JSON object");
+    const version = readVersion(raw);
+    if (version)
+        return version;
+    if (!isNonEmptyString(raw.runId) || !DESKTOP_AGENT_REF_SEGMENT.test(raw.runId))
+        return invalid("runId", "a string of letters, digits, '_' or '-'");
+    if (!isNonEmptyString(raw.projectId))
+        return invalid("projectId", "a non-empty string");
+    if (!(raw.sessionId === null || isNonEmptyString(raw.sessionId)))
+        return invalid("sessionId", "a non-empty string or null");
+    if (!isNonEmptyString(raw.checkoutPath))
+        return invalid("checkoutPath", "a non-empty string");
+    const agent = raw.agent;
+    if (!isRecord(agent))
+        return invalid("agent", "an object");
+    if (!isNonEmptyString(agent.slug) || !DESKTOP_AGENT_REF_SEGMENT.test(agent.slug))
+        return invalid("agent.slug", "a string of letters, digits, '_' or '-'");
+    if (!isNonEmptyString(agent.label))
+        return invalid("agent.label", "a non-empty string");
+    if (!isNullableString(agent.mandate))
+        return invalid("agent.mandate", "a string or null");
+    if (!isNullableString(agent.model))
+        return invalid("agent.model", "a string or null");
+    if (typeof raw.task !== "string")
+        return invalid("task", "a string");
+    if (!isNullableString(raw.instructions))
+        return invalid("instructions", "a string or null");
+    if (raw.localRows !== undefined && !(Array.isArray(raw.localRows) && raw.localRows.every(isRecord)))
+        return invalid("localRows", "an array of objects");
+    if (raw.dismissals !== undefined && !(Array.isArray(raw.dismissals) && raw.dismissals.every(isRecord)))
+        return invalid("dismissals", "an array of objects");
+    if (!oneOf(DESKTOP_AGENT_PR_BASES, raw.prBase))
+        return invalid("prBase", `one of ${DESKTOP_AGENT_PR_BASES.join(", ")}`);
+    if (!oneOf(DESKTOP_AGENT_PUBLISH_MODES, raw.publish))
+        return invalid("publish", `one of ${DESKTOP_AGENT_PUBLISH_MODES.join(", ")}`);
+    if (!oneOf(DESKTOP_AGENT_TOOL_PROFILES, raw.toolProfile))
+        return invalid("toolProfile", `one of ${DESKTOP_AGENT_TOOL_PROFILES.join(", ")}`);
+    if (!oneOf(DESKTOP_AGENT_ENGINES, raw.engine))
+        return invalid("engine", `one of ${DESKTOP_AGENT_ENGINES.join(", ")}`);
+    if (!(raw.budgetCents === null || (typeof raw.budgetCents === "number" && Number.isInteger(raw.budgetCents) && raw.budgetCents >= 0))) {
+        return invalid("budgetCents", "a whole number of cents or null");
+    }
+    if (typeof raw.wallSeconds !== "number" || !Number.isInteger(raw.wallSeconds) || raw.wallSeconds <= 0)
+        return invalid("wallSeconds", "a positive whole number");
+    return {
+        ok: true,
+        value: {
+            requestVersion: DESKTOP_AGENT_REQUEST_VERSION,
+            runId: raw.runId,
+            projectId: raw.projectId,
+            sessionId: raw.sessionId,
+            checkoutPath: raw.checkoutPath,
+            agent: { slug: agent.slug, label: agent.label, mandate: agent.mandate, model: agent.model },
+            task: raw.task,
+            instructions: raw.instructions,
+            ...(raw.localRows ? { localRows: raw.localRows } : {}),
+            ...(raw.dismissals ? { dismissals: raw.dismissals } : {}),
+            prBase: raw.prBase,
+            publish: raw.publish,
+            toolProfile: raw.toolProfile,
+            engine: raw.engine,
+            budgetCents: raw.budgetCents,
+            wallSeconds: raw.wallSeconds,
+        },
+    };
+}
+export function parseProposalRequest(raw) {
+    if (!isRecord(raw))
+        return invalid("the request", "a JSON object");
+    const version = readVersion(raw);
+    if (version)
+        return version;
+    if (!isNonEmptyString(raw.runId) || !DESKTOP_AGENT_REF_SEGMENT.test(raw.runId))
+        return invalid("runId", "a string of letters, digits, '_' or '-'");
+    if (!isNonEmptyString(raw.projectId))
+        return invalid("projectId", "a non-empty string");
+    if (!isNonEmptyString(raw.checkoutPath))
+        return invalid("checkoutPath", "a non-empty string");
+    if (!isNonEmptyString(raw.branch))
+        return invalid("branch", "a non-empty string");
+    if (!isNonEmptyString(raw.base))
+        return invalid("base", "a non-empty string");
+    if (typeof raw.title !== "string")
+        return invalid("title", "a string");
+    return {
+        ok: true,
+        value: {
+            requestVersion: DESKTOP_AGENT_REQUEST_VERSION,
+            runId: raw.runId,
+            projectId: raw.projectId,
+            checkoutPath: raw.checkoutPath,
+            branch: raw.branch,
+            base: raw.base,
+            title: raw.title,
+        },
+    };
+}
+export function failedResult(reason, mount, partial = {}) {
+    return {
+        outcome: "failed",
+        reason,
+        vendorSessionId: null,
+        costCents: 0,
+        result: null,
+        pullRequestUrl: null,
+        engineCheck: { apiKeySource: null, model: null },
+        mount,
+        ...partial,
+    };
+}

package/dist/lib/desktop_settings.js

@@ -17,7 +17,7 @@ function sectionOf(value) {
 export function readDesktopSettings() {
     const defaults = {
         placement: { memory: DEFAULT_PLACEMENT, securityFindings: DEFAULT_PLACEMENT },
-        routing: { localReader: false, gateThresholdTokens: null, digestBudgetMs: null },
+        routing: { localReader: false, gateThresholdTokens: null, digestBudgetMs: null, lane: false },
     };
     let parsed;
     try {
@@ -39,6 +39,7 @@ export function readDesktopSettings() {
             localReader: routing.localReader === true,
             gateThresholdTokens: boundedIntegerOf(routing.gateThresholdTokens, GATE_THRESHOLD_TOKENS_MIN, GATE_THRESHOLD_TOKENS_MAX),
             digestBudgetMs: boundedIntegerOf(routing.digestBudgetMs, DIGEST_BUDGET_MS_MIN, DIGEST_BUDGET_MS_MAX),
+            lane: routing.lane === true,
         },
     };
 }

package/dist/lib/gate/agentHook.js

@@ -0,0 +1,130 @@
+import { readdirSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { readDesktopSettings } from "../desktop_settings.js";
+import { readSettingsLayers } from "../lane/credential.js";
+import { LANE_AGENT_NAME, LANE_AGENT_ROUTE, LANE_MODEL_ID } from "../lane/install.js";
+import { isUnderPrefix, readProxy } from "../lane/proxyRecord.js";
+import { GateInputError } from "./readGate.js";
+export const READ_ONLY_TOOLS = new Set(["Read", "Grep", "Glob", "LS", "NotebookRead"]);
+export const PASS_ON_AGENT_PERMISSION_RULE = true;
+function parseAgentCall(text) {
+    let payload;
+    try {
+        payload = JSON.parse(text);
+    }
+    catch {
+        throw new GateInputError("stdin is not JSON");
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload))
+        throw new GateInputError("stdin is not a JSON object");
+    const fields = payload;
+    if (typeof fields.session_id !== "string" || fields.session_id === "")
+        throw new GateInputError("session_id is missing");
+    if (typeof fields.cwd !== "string" || fields.cwd === "")
+        throw new GateInputError("cwd is missing");
+    const toolInput = fields.tool_input;
+    if (toolInput === null || typeof toolInput !== "object" || Array.isArray(toolInput))
+        throw new GateInputError("tool_input is missing");
+    return { sessionId: fields.session_id, cwd: fields.cwd, toolInput: toolInput };
+}
+function frontmatterOf(content) {
+    const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(content);
+    return match ? match[1] : null;
+}
+export function declaredTools(frontmatter) {
+    const lines = frontmatter.split(/\r?\n/);
+    const index = lines.findIndex((line) => /^tools\s*:/.test(line));
+    if (index === -1)
+        return null;
+    const inline = lines[index].replace(/^tools\s*:/, "").trim();
+    let items;
+    if (inline !== "") {
+        items = inline.replace(/^\[|\]$/g, "").split(",");
+    }
+    else {
+        items = [];
+        for (const line of lines.slice(index + 1)) {
+            const item = /^\s*-\s*(.+)$/.exec(line);
+            if (!item)
+                break;
+            items.push(item[1]);
+        }
+    }
+    const tools = items.map((item) => item.trim().replace(/^["']|["']$/g, "")).filter((item) => item !== "");
+    return tools.length === 0 ? null : tools;
+}
+function nameOf(frontmatter) {
+    const match = /^name\s*:\s*(.+)$/m.exec(frontmatter);
+    return match ? match[1].trim().replace(/^["']|["']$/g, "") : null;
+}
+export function isReadOnlyDefinition(type, cwd, home) {
+    for (const folder of [path.join(cwd, ".claude", "agents"), path.join(home, ".claude", "agents")]) {
+        let entries;
+        try {
+            entries = readdirSync(folder).filter((entry) => entry.endsWith(".md"));
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            let content;
+            try {
+                content = readFileSync(path.join(folder, entry), "utf8");
+            }
+            catch {
+                continue;
+            }
+            const frontmatter = frontmatterOf(content);
+            if (frontmatter === null || nameOf(frontmatter) !== type)
+                continue;
+            const tools = declaredTools(frontmatter);
+            return tools !== null && tools.every((tool) => READ_ONLY_TOOLS.has(tool));
+        }
+    }
+    return false;
+}
+export function hasAgentPermissionRule(layers) {
+    return layers.some((layer) => ["allow", "ask", "deny"].some((kind) => {
+        const rules = layer.permissions?.[kind];
+        return Array.isArray(rules) && rules.some((rule) => typeof rule === "string" && /^Agent(\(|$)/.test(rule.trim()));
+    }));
+}
+async function isLaneLatched(sessionId) {
+    const [{ openLocalStoreReadOnly }, { isLatched }] = await Promise.all([import("../local_store/database.js"), import("../local_store/routing.js")]);
+    const store = await openLocalStoreReadOnly();
+    if (store === null)
+        return false;
+    try {
+        return isLatched(store, sessionId, "lane.subagent");
+    }
+    catch {
+        return false;
+    }
+    finally {
+        store.close();
+    }
+}
+export async function answerAgentCall(text, env, home = os.homedir()) {
+    const call = parseAgentCall(text);
+    const baseUrl = env.ANTHROPIC_BASE_URL ?? "";
+    const proxy = readProxy();
+    if (!proxy.live || !isUnderPrefix(baseUrl, proxy.prefix))
+        return null;
+    if (!readDesktopSettings().routing.lane)
+        return null;
+    const model = call.toolInput.model;
+    if (model !== undefined && model !== null && model !== "haiku")
+        return null;
+    const type = call.toolInput.subagent_type;
+    if (typeof type !== "string")
+        return null;
+    if (type !== "Explore" && !isReadOnlyDefinition(type, call.cwd, home))
+        return null;
+    if (PASS_ON_AGENT_PERMISSION_RULE && hasAgentPermissionRule(readSettingsLayers({ env, cwd: call.cwd, home })))
+        return null;
+    if (await isLaneLatched(call.sessionId))
+        return null;
+    const updatedInput = LANE_AGENT_ROUTE === "model" ? { ...call.toolInput, model: LANE_MODEL_ID } : { ...call.toolInput, subagent_type: LANE_AGENT_NAME };
+    return `${JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput } })}\n`;
+}

package/dist/lib/gate/grounding.js

@@ -0,0 +1,121 @@
+import { readFileSync, statSync } from "node:fs";
+import path from "node:path";
+export const GROUNDING_MAX_PATHS = 50;
+export const GROUNDING_MAX_IDENTIFIERS = 100;
+export const GROUNDING_MAX_FILE_BYTES = 2 * 1024 * 1024;
+const FILE_EXTENSIONS = new Set("ts tsx js jsx mjs cjs json md mdx rs py go toml yaml yml css scss html sh txt lock sql swift kt java c h cpp hpp rb php vue svelte astro proto graphql xml ini env cfg conf csv".split(" "));
+const LINE_SUFFIX = String.raw `(?::(\d+)(?:-(\d+))?)?`;
+const SLASHED_PATH = new RegExp(String.raw `(?<![\w./:-])((?:[\w.@-]+/)+[\w.@-]+\.[A-Za-z0-9]+)${LINE_SUFFIX}`, "g");
+const BACKTICKED = /`([^`\n]+)`/g;
+const BACKTICKED_FILE = new RegExp(String.raw `^([\w.@-]+\.([A-Za-z0-9]+))${LINE_SUFFIX}$`);
+const IDENTIFIER = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)?$/;
+function lineOf(text) {
+    return text === undefined ? null : Number.parseInt(text, 10);
+}
+function pushPath(paths, seen, claim) {
+    const key = `${claim.path}:${claim.startLine ?? ""}-${claim.endLine ?? ""}`;
+    if (seen.has(key) || paths.length >= GROUNDING_MAX_PATHS)
+        return;
+    seen.add(key);
+    paths.push(claim);
+}
+export function extractClaims(text) {
+    const paths = [];
+    const identifiers = [];
+    const seenPaths = new Set();
+    const seenIdentifiers = new Set();
+    for (const match of text.matchAll(SLASHED_PATH)) {
+        const before = text.slice(Math.max(0, (match.index ?? 0) - 3), match.index ?? 0);
+        if (before.endsWith("://"))
+            continue;
+        pushPath(paths, seenPaths, { path: match[1], startLine: lineOf(match[2]), endLine: lineOf(match[3]) });
+    }
+    for (const match of text.matchAll(BACKTICKED)) {
+        const token = match[1].trim();
+        if (token.includes("/"))
+            continue;
+        const file = BACKTICKED_FILE.exec(token);
+        if (file && FILE_EXTENSIONS.has(file[2].toLowerCase())) {
+            pushPath(paths, seenPaths, { path: file[1], startLine: lineOf(file[3]), endLine: lineOf(file[4]) });
+            continue;
+        }
+        if (token.length < 3 || !IDENTIFIER.test(token) || seenIdentifiers.has(token))
+            continue;
+        if (identifiers.length >= GROUNDING_MAX_IDENTIFIERS)
+            continue;
+        seenIdentifiers.add(token);
+        identifiers.push(token);
+    }
+    return { paths, identifiers };
+}
+function sizeOf(file) {
+    try {
+        const stats = statSync(file);
+        return stats.isFile() ? stats.size : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readSmall(file) {
+    const size = sizeOf(file);
+    if (size === null || size > GROUNDING_MAX_FILE_BYTES)
+        return null;
+    try {
+        return readFileSync(file, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+function lineCountOf(content) {
+    if (content === "")
+        return 0;
+    const lines = content.split("\n").length;
+    return content.endsWith("\n") ? lines - 1 : lines;
+}
+function resolveClaim(claim, cwd, readFiles) {
+    const direct = path.isAbsolute(claim.path) ? claim.path : path.resolve(cwd, claim.path);
+    if (sizeOf(direct) !== null)
+        return direct;
+    if (!claim.path.includes("/")) {
+        const byName = readFiles.find((file) => path.basename(file) === claim.path && sizeOf(file) !== null);
+        if (byName)
+            return byName;
+    }
+    return null;
+}
+export function verifyClaims(claims, cwd, readFiles) {
+    const citedFiles = [];
+    const fail = (failure) => ({ result: "fail", failure, citedFiles });
+    for (const claim of claims.paths) {
+        const file = resolveClaim(claim, cwd, readFiles);
+        if (file === null)
+            return fail(`no file ${claim.path}`);
+        if (!citedFiles.includes(file))
+            citedFiles.push(file);
+        const lastLine = Math.max(claim.startLine ?? 0, claim.endLine ?? 0);
+        if (lastLine === 0)
+            continue;
+        const content = readSmall(file);
+        if (content === null)
+            continue;
+        if (lastLine > lineCountOf(content))
+            return fail(`${claim.path}:${lastLine} is past the end of the file`);
+    }
+    const searchable = [...citedFiles, ...readFiles.map((file) => path.resolve(cwd, file)).filter((file) => !citedFiles.includes(file))];
+    const contents = new Map();
+    const contentOf = (file) => {
+        if (!contents.has(file))
+            contents.set(file, readSmall(file));
+        return contents.get(file) ?? null;
+    };
+    const hasSearchable = searchable.some((file) => contentOf(file) !== null);
+    if (hasSearchable) {
+        for (const identifier of claims.identifiers) {
+            if (!searchable.some((file) => contentOf(file)?.includes(identifier)))
+                return fail(`\`${identifier}\` appears in no cited or read file`);
+        }
+    }
+    return { result: "pass", failure: null, citedFiles };
+}

package/dist/lib/gate/hook.js

@@ -56,6 +56,25 @@ function denialOf(reason) {
         },
     })}\n`;
 }
+const LANE_URL_HEAD = "http://127.0.0.1:";
+export function isLaneSessionEnv(env) {
+    const baseUrl = env.ANTHROPIC_BASE_URL;
+    return typeof baseUrl === "string" && baseUrl.startsWith(LANE_URL_HEAD) && baseUrl.includes("/lane/");
+}
+async function runLaneHook(subcommand, io) {
+    const text = await readStdin(io.stdin);
+    if (!isLaneSessionEnv(io.env))
+        return;
+    if (subcommand === "agent") {
+        const { answerAgentCall } = await import("./agentHook.js");
+        const answer = await answerAgentCall(text, io.env);
+        if (answer !== null)
+            io.stdout.write(answer);
+        return;
+    }
+    const { answerSubagentStop } = await import("./subagentStop.js");
+    await answerSubagentStop(text, io.env);
+}
 function deniedPathOf(subcommand, call) {
     const written = subcommand === "read"
         ? call.toolInput.file_path
@@ -89,6 +108,10 @@ export async function runGateHook(subcommand, io = { stdin: process.stdin, stdou
         return;
     }
     try {
+        if (subcommand === "agent" || subcommand === "subagent-stop") {
+            await runLaneHook(subcommand, io);
+            return;
+        }
         const call = parseCall(await readStdin(io.stdin), startedAt);
         let answer;
         if (subcommand === "read")

package/dist/lib/gate/subagentStop.js

@@ -0,0 +1,121 @@
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { isUnderPrefix, readProxy } from "../lane/proxyRecord.js";
+import { tokensOfLength } from "./estimate.js";
+import { extractClaims, verifyClaims } from "./grounding.js";
+import { GateInputError } from "./readGate.js";
+function parseStopCall(text) {
+    let payload;
+    try {
+        payload = JSON.parse(text);
+    }
+    catch {
+        throw new GateInputError("stdin is not JSON");
+    }
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload))
+        throw new GateInputError("stdin is not a JSON object");
+    const fields = payload;
+    if (typeof fields.session_id !== "string" || fields.session_id === "")
+        throw new GateInputError("session_id is missing");
+    const transcript = fields.agent_transcript_path;
+    const agentType = fields.agent_type;
+    return {
+        sessionId: fields.session_id,
+        cwd: typeof fields.cwd === "string" && fields.cwd !== "" ? fields.cwd : process.cwd(),
+        transcriptPath: typeof transcript === "string" && transcript !== "" ? transcript : null,
+        agentType: typeof agentType === "string" && agentType !== "" ? agentType : "subagent",
+    };
+}
+function isRoutedModel(model) {
+    return typeof model === "string" && model !== "" && !model.startsWith("claude") && model !== "<synthetic>";
+}
+function numberOf(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.round(value) : 0;
+}
+export function readSubagentRun(content) {
+    let routed = false;
+    let finalText = "";
+    let localTokens = 0;
+    let first = null;
+    let last = null;
+    let agentType = null;
+    const readFiles = [];
+    for (const line of content.split("\n")) {
+        if (line.trim() === "")
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const stamp = typeof entry.timestamp === "string" ? Date.parse(entry.timestamp) : Number.NaN;
+        if (!Number.isNaN(stamp)) {
+            first ??= stamp;
+            last = stamp;
+        }
+        if (agentType === null && typeof entry.agentType === "string")
+            agentType = entry.agentType;
+        if (entry.type !== "assistant")
+            continue;
+        const message = entry.message;
+        if (!message)
+            continue;
+        if (isRoutedModel(message.model)) {
+            routed = true;
+            const usage = message.usage;
+            localTokens += numberOf(usage?.input_tokens) + numberOf(usage?.output_tokens);
+        }
+        const blocks = Array.isArray(message.content) ? message.content : [];
+        const texts = blocks.filter((block) => block?.type === "text" && typeof block.text === "string").map((block) => block.text);
+        if (texts.length > 0)
+            finalText = texts.join("\n");
+        for (const block of blocks) {
+            if (block?.type !== "tool_use" || block.name !== "Read")
+                continue;
+            const filePath = block.input?.file_path;
+            if (typeof filePath === "string" && !readFiles.includes(filePath))
+                readFiles.push(filePath);
+        }
+    }
+    return { routed, finalText, readFiles, localTokens, latencyMs: first !== null && last !== null ? Math.max(0, last - first) : 0, agentType };
+}
+export async function answerSubagentStop(text, env) {
+    const call = parseStopCall(text);
+    const proxy = readProxy();
+    if (!proxy.live || !isUnderPrefix(env.ANTHROPIC_BASE_URL ?? "", proxy.prefix))
+        return;
+    if (call.transcriptPath === null)
+        return;
+    const run = readSubagentRun(readFileSync(call.transcriptPath, "utf8"));
+    if (!run.routed)
+        return;
+    const verdict = verifyClaims(extractClaims(run.finalText), call.cwd, run.readFiles);
+    const [{ openLocalStore, withTransaction }, routing] = await Promise.all([import("../local_store/database.js"), import("../local_store/routing.js")]);
+    const store = await openLocalStore();
+    try {
+        const now = Date.now();
+        withTransaction(store, () => {
+            routing.insertLabelRow(store, {
+                id: `lr_${randomUUID()}`,
+                session_id: call.sessionId,
+                agent_type: call.agentType !== "subagent" ? call.agentType : (run.agentType ?? call.agentType),
+                path: verdict.citedFiles[0] ?? null,
+                estimated_tokens: run.localTokens,
+                returned_tokens: tokensOfLength(run.finalText.length),
+                handler: "local_model",
+                check_result: verdict.result,
+                bypass_used: 0,
+                latency_ms: run.latencyMs,
+                tokens_kept_out: 0,
+                created_at: now,
+            });
+            if (verdict.result === "fail")
+                routing.recordRoutingMiss(store, call.sessionId, "lane.subagent", "failure", now);
+        });
+    }
+    finally {
+        store.close();
+    }
+}

package/dist/lib/gate/subcommands.js

@@ -1 +1 @@
-export const HOOK_SUBCOMMANDS = ["read", "bash"];
+export const HOOK_SUBCOMMANDS = ["read", "bash", "agent", "subagent-stop"];