@open-everywhere/core 0.1.0

package/dist/agent/commands/core.js

@@ -0,0 +1,541 @@
+// The "/oe" ZERO-INFERENCE slash command core — backlog item 23. Slash commands are the
+// control-plane escape hatch: pure logic, instant code-rendered responses, NO model turn —
+// so they keep working regardless of spend caps (a ⛔'d channel still answers "/oe budget"),
+// engagement state, or a model/gateway outage. This module is PLATFORM-NEUTRAL: it owns the
+// command grammar (`OeCommand`), the pure renderers, and the (I/O-light) execution glue.
+// Discord's wire-shape parsing lives in discord-commands.ts (nested SUB_COMMAND_GROUP
+// options); Slack's free-text parsing lives here (`parseSlackCommandText`) since it's just
+// whitespace-splitting; the Slack HTTP route itself lives in channels/slack-commands.ts.
+//
+// DELIBERATELY NOT SPEND-GATED: nothing in this file calls spend/check.ts's scopeOverBudget
+// (the turn-declining gate). That would defeat the entire point of a zero-inference command —
+// it must answer even while the scope is over budget. `/oe budget raise|clear` still goes
+// through the REAL approval-card machinery (requestApproval), which is a proposal, not a
+// spend event — an admin's click is what actually mutates anything.
+//
+// Command set (v1), namespace "oe":
+//   /oe budget                 — status: effective caps (tokens + USD) + current-month spend
+//                                 for this surface AND its workspace.
+//   /oe budget raise <usd>     — freeze + post a spend.set approval card (reuses
+//                                 tools/set_spend_limit.ts's planSetSpendLimit verbatim).
+//   /oe budget clear           — freeze + post a spend.clear approval card (reuses
+//                                 tools/clear_spend_limit.ts's planClearSpendLimit verbatim).
+//   /oe status                 — deploy sanity: deployment sha, eve pin, primary/utility model,
+//                                 memory provider, telemetry. TWO LINES ARE CONDITIONAL, and
+//                                 their absence is design rather than defect: the app version
+//                                 rides the title only where the build carries a real one
+//                                 (OPE-1057 — this repo never bumps its root package.json, so a
+//                                 stock deploy prints none and the sha is the build identity),
+//                                 and the context-window/compaction-threshold line renders only
+//                                 where the app registered both numbers (OPE-715).
+//   /oe stop                   — STOP the turn running in this channel (OPE-418). The free,
+//                                 pre-model, over-cap-proof half of the stop affordance: it
+//                                 resolves the channel's in-flight turn from the durable anchor
+//                                 registry and cancels it WITHOUT minting a session. Inference
+//                                 cannot do this job — the agent is the thing that is busy, and a
+//                                 mid-turn message queues behind the very turn it would stop.
+//   /oe rate <1-5>             — mark the model A/B test (OPE-34): record a human rating of the
+//                                 room's last champion/challenger turn. Lives in commands/rate.ts;
+//                                 this file only dispatches to it. Says "nothing to rate" — the
+//                                 normal answer — on a deployment that has not armed the test.
+//   /oe help                   — list the commands.
+//
+// Every response is EPHEMERAL (only the invoker sees the text reply) except the approval
+// card itself, which posts PUBLICLY in the channel — exactly like the model-driven
+// set_spend_limit/clear_spend_limit tools already do; slash commands just skip the model turn
+// that would otherwise have called those tools.
+import { unattendedFrom } from "../identity/binding.js";
+import { cancelAnchoredTurn } from "../channels/turn-cancel.js";
+import { turnChannelKey } from "../channels/turn-registry.js";
+import { periodOf } from "../spend/spend.js";
+import { effectiveCaps, domainNameForScope } from "../spend/caps.js";
+import { surfaceTokens, workspaceTokens } from "../spend/store.js";
+import { scopeUsdSpend } from "../spend/check.js";
+import { getProvider } from "../memory/provider.js";
+import { getConfig } from "../access/config.js";
+import { telemetryStatusLine } from "../observability/telemetry.js";
+import { domainForChannel } from "../memory/domain.js";
+import { requestApproval } from "../approvals/flow.js";
+import { friendlyScopeLabel } from "../approvals/scope-label.js";
+import { defaultScopeKey, approvalPostDeps, planSetSpendLimit, requireCardPathHere, readSpendCoverage, frozenCoverage, } from "../tools/set_spend_limit.js";
+import { planClearSpendLimit } from "../tools/clear_spend_limit.js";
+import { domainSpendWindow, reportDomainForBinding } from "../spend/reporting.js";
+import { parseRateTokens, runRate, RATE_HELP_LINE } from "./rate.js";
+/** The command namespace every registered command name / prefix rides under. */
+export const OE_COMMAND_NAME = "oe";
+/**
+ * What the app-version field answers when the build carries no version of its own (OPE-1057).
+ *
+ * THE PROBLEM IT CLOSES. `/oe status` printed `v0.0.0` on every build this repo has ever made, and
+ * `0.0.0` was the HONEST value: the root `package.json` is `private` and never bumps, so the number
+ * conveyed nothing and could not separate any two builds. A reader assumes a version field means
+ * something, so a field that is always the same is worse than no field at all.
+ *
+ * WHY A SENTINEL AND NOT A NEW VERSIONING RITUAL. This repo already decided what identifies a
+ * build: the commit sha. The release records key on it
+ * (docs/deploy/self-upgrade-release-records.md), `deploymentSha` reports it, and no npm package is
+ * published to key a semantic version against. Bumping a root version on release would add a step a
+ * maintainer has to remember for a field nothing consumes.
+ *
+ * WHY THE FIELD SURVIVES AT ALL. It is inert for THIS repo, not for every deployment. An operator
+ * fork that versions its own deploy registers a real value here and keeps a real answer. The
+ * sentinel says "this build carries no version", which is a fact; `0.0.0` said "this build is
+ * version zero", which reads as one.
+ */
+export const APP_VERSION_UNVERSIONED = "unversioned";
+/** The npm placeholder a repo that never bumps its root `package.json` carries. */
+const UNVERSIONED_PLACEHOLDER = "0.0.0";
+/**
+ * Map a raw registered version to what the two version surfaces answer. The npm placeholder and an
+ * empty string both mean "this build carries no version", so both collapse to
+ * {@link APP_VERSION_UNVERSIONED}. Everything else passes through untouched, so a fork that versions
+ * itself is unaffected.
+ *
+ * 🔴 `"unknown"` IS LEFT ALONE, and the two words are not synonyms. `unknown` means this deployment
+ * does not expose the fact — the unregistered default, and the same word `deploymentSha` and
+ * `evePin` use for the same reason (OPE-991). `unversioned` means the app DID register, and what it
+ * registered was a placeholder. Collapsing them would delete the difference between "nobody told us"
+ * and "there is nothing to tell".
+ *
+ * Applied at REGISTRATION, which is the only place both consumers share. `/oe status` and the
+ * `agent_version` tool read the same fact bag on purpose (tools/agent_version.ts), and a normaliser
+ * either of them applied for itself could drift from the other's.
+ */
+export function normalizeAppVersion(raw) {
+    const v = raw.trim();
+    if (v === "" || v === UNVERSIONED_PLACEHOLDER)
+        return APP_VERSION_UNVERSIONED;
+    return v;
+}
+/** Does this deployment carry a version worth printing as one? False for BOTH non-answers — a
+ *  placeholder build and an app that never registered. Neither should render as `v<something>`. */
+export function hasRealAppVersion(info) {
+    return info.version !== APP_VERSION_UNVERSIONED && info.version !== "unknown";
+}
+const UNKNOWN_APP_INFO = {
+    version: "unknown",
+    primaryModel: "unknown",
+    utilityModel: "unknown",
+    deploymentSha: "unknown",
+    evePin: "unknown",
+};
+let registeredAppInfo = UNKNOWN_APP_INFO;
+/** Register the deploy's display info for `/oe status`. Called once at startup. The version is
+ *  normalised HERE so both version surfaces answer the same word — see {@link normalizeAppVersion}. */
+export function registerAppInfo(info) {
+    registeredAppInfo = { ...info, version: normalizeAppVersion(info.version) };
+}
+export function getAppInfo() {
+    return registeredAppInfo;
+}
+/** Test seam: reset to the unregistered default. */
+export function resetAppInfo() {
+    registeredAppInfo = UNKNOWN_APP_INFO;
+}
+/**
+ * Parse a "budget" subcommand's rest-tokens (shared by Slack's whitespace-split text).
+ * Exported so both the Slack parser below and tests can exercise it directly.
+ */
+function parseBudgetTokens(rest) {
+    const [action, amountRaw] = rest;
+    if (!action || action === "status")
+        return { kind: "budget-status" };
+    if (action === "clear")
+        return { kind: "budget-clear" };
+    if (action === "raise") {
+        const usd = Number(amountRaw);
+        if (!amountRaw || !Number.isFinite(usd) || usd <= 0) {
+            return {
+                kind: "error",
+                message: `"/oe budget raise" needs a positive USD amount, e.g. "/oe budget raise 25" (got ${JSON.stringify(amountRaw ?? "")}).`,
+            };
+        }
+        return { kind: "budget-raise", usd };
+    }
+    return { kind: "error", message: `Unknown "budget" action "${action}" — try "budget", "budget raise <usd>", or "budget clear".` };
+}
+/**
+ * Parse a whitespace-split token list into an `OeCommand` — Slack's grammar (free `text`).
+ * No tokens (bare `/oe`) defaults to help, the friendliest landing. NEVER throws: any garbage
+ * input resolves to an `"error"` variant with a user-facing message, never an exception.
+ */
+export function parseOeCommandTokens(tokens) {
+    const [sub, ...rest] = tokens;
+    if (!sub || sub === "help")
+        return { kind: "help" };
+    if (sub === "status")
+        return { kind: "status" };
+    if (sub === "stop")
+        return { kind: "stop" };
+    if (sub === "rate")
+        return parseRateTokens(rest);
+    if (sub === "budget")
+        return parseBudgetTokens(rest);
+    return { kind: "error", message: `Unknown command "${sub}" — try "/oe help" to see what's available.` };
+}
+/** Parse Slack's slash-command free `text` field ("budget raise 5", "status", "", …). */
+export function parseSlackCommandText(text) {
+    const tokens = (text ?? "")
+        .trim()
+        .split(/\s+/)
+        .filter((t) => t.length > 0);
+    return parseOeCommandTokens(tokens);
+}
+// --- pure renderers -------------------------------------------------------------------------
+export function renderHelp() {
+    return [
+        "*/oe* — zero-inference control-plane commands (pure logic, code-rendered, no model turn — " +
+            "these work even during a spend-cap decline or a model/gateway outage):",
+        // NAMES ONLY WHAT IT ALWAYS PRINTS, then names the two conditional lines AS conditional. The
+        // app version rides the title only on a build that carries one (OPE-1057) and the window line
+        // renders only where the app registered both numbers (OPE-715), so listing either as a plain
+        // field made its absence read as a defect.
+        "• `/oe status` — deploy sanity: deployment sha, eve pin, model config, memory provider, telemetry — plus the app version and the context window with its compaction threshold, each where this deployment carries one.",
+        "• `/oe stop` — stand down the turn running in this channel (free, instant, works over a spend cap).",
+        "• `/oe budget` — this channel's and workspace's effective spend caps + current-month spend.",
+        "• `/oe budget raise <usd>` — propose a new monthly USD cap for this channel (posts an approval card; an admin decides).",
+        "• `/oe budget clear` — propose clearing this channel's spend-limit override back to config (posts an approval card).",
+        RATE_HELP_LINE,
+        "• `/oe help` — this message.",
+    ].join("\n");
+}
+/** Group a token count with commas. NOT `toLocaleString()`: that reads the host's locale, so the
+ *  same deploy would render `1,050,000` or `1.050.000` depending on the machine, and a test that
+ *  pins the string would go red on a runner with a different `LANG`. */
+function fmtTokenCount(n) {
+    return String(Math.trunc(n)).replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+}
+export function renderStatus(info, memoryProviderId, telemetryStatus = "unknown") {
+    const { contextWindowTokens: windowTokens, compactionThresholdTokens: thresholdTokens } = info;
+    return [
+        // OPE-1057 — the version rides the title ONLY when the build carries a real one. A deployment
+        // that never bumps its root package.json prints no version at all: the line below is the
+        // identity that answers "which build am I?", and a constant `v0.0.0` above it read as a second
+        // answer to the same question while conveying nothing.
+        hasRealAppVersion(info) ? `*Open Everywhere* v${info.version}` : "*Open Everywhere*",
+        `• deployment sha: \`${info.deploymentSha}\``,
+        `• eve: \`${info.evePin}\``,
+        `• primary model: \`${info.primaryModel}\``,
+        `• utility model: \`${info.utilityModel}\``,
+        // Rendered only when the app registered BOTH. The percent is recomputed from the pair rather
+        // than carried as a third field: it is display sugar, and one derived number cannot disagree
+        // with itself the way two registered ones can.
+        // The `> 0` is not defensive noise: a zero window would make the percent below `NaN%`, and a
+        // status line is the last surface that should render one.
+        ...(windowTokens !== undefined && thresholdTokens !== undefined && windowTokens > 0
+            ? [
+                `• context window: \`${fmtTokenCount(windowTokens)}\` tokens — compaction fires at ` +
+                    `\`${fmtTokenCount(thresholdTokens)}\` (${Math.round((thresholdTokens / windowTokens) * 100)}%)`,
+            ]
+            : []),
+        `• memory provider: \`${memoryProviderId}\``,
+        `• telemetry: \`${telemetryStatus}\``,
+    ].join("\n");
+}
+/** Token caps group through {@link fmtTokenCount} for the same reason the status line does: one
+ *  grouping rule for every token count this file prints, and none of them locale-dependent. */
+function fmtCap(n, unit) {
+    if (n == null)
+        return "uncapped";
+    return unit === "usd" ? `$${n.toFixed(2)}` : fmtTokenCount(n);
+}
+export function renderBudgetStatus(f) {
+    return [
+        "*Spend status* (current calendar month)",
+        // The SPENT counts group through `fmtTokenCount` exactly as the caps beside them do. They used
+        // `toLocaleString()`, which is the one thing that helper's own comment forbids: it reads the
+        // host's locale, so one deploy rendered `1,050,000` or `1.050.000` by the runner's `LANG`, and
+        // the two halves of a single line could disagree about what a thousands separator is.
+        `• this channel (\`${f.surfaceKey}\`): ${fmtTokenCount(f.surfaceTokens)} / ${fmtCap(f.caps.surfaceMonthlyTokens, "tokens")} tokens · ` +
+            `~$${f.surfaceUsd.toFixed(2)} / ${fmtCap(f.caps.surfaceMonthlyUsd, "usd")}`,
+        `• whole workspace (\`${f.workspaceKey}\`): ${fmtTokenCount(f.workspaceTokens)} / ${fmtCap(f.caps.workspaceMonthlyTokens, "tokens")} tokens · ` +
+            `~$${f.workspaceUsd.toFixed(2)} / ${fmtCap(f.caps.workspaceMonthlyUsd, "usd")}`,
+        "_propose a change with `/oe budget raise <usd>` or `/oe budget clear`._",
+    ].join("\n");
+}
+/** `<@id>` renders as a mention on BOTH Slack (mrkdwn) and Discord (message content) —
+ *  the one piece of wire syntax the two platforms happen to share. Falls back to a plain
+ *  label on the (should-never-happen) case a command reached here with no principal. */
+function mentionFor(binding) {
+    return binding.principalId ? `<@${binding.principalId}>` : "an unidentified user";
+}
+export async function computeBudgetStatusFacts(binding, deps = {}) {
+    const effectiveCapsFn = deps.effectiveCaps ?? effectiveCaps;
+    const surfaceTokensFn = deps.surfaceTokens ?? surfaceTokens;
+    const workspaceTokensFn = deps.workspaceTokens ?? workspaceTokens;
+    const scopeUsdSpendFn = deps.scopeUsdSpend ?? scopeUsdSpend;
+    const nowISO = deps.nowISO ? deps.nowISO() : new Date().toISOString();
+    // Reuse defaultScopeKey (set_spend_limit.ts) — the SAME `${platform}/${workspace}[/${surface}]`
+    // derivation the propose tools use, so the scope keys shown here are exactly the ones a
+    // follow-up "/oe budget raise"/"clear" (or the model's own set_spend_limit) would target.
+    const surfaceKey = defaultScopeKey(binding, "surface");
+    const workspaceKey = defaultScopeKey(binding, "workspace");
+    const period = periodOf(nowISO);
+    // The perDomain layer (explicit domain, or the dm/public criteria domain — binding
+    // already carries both mode + trust here, so the full classification applies).
+    const domainName = domainNameForScope(surfaceKey, binding.mode, binding.trust);
+    const [caps, st, wt, usd] = await Promise.all([
+        effectiveCapsFn(binding.org, workspaceKey, surfaceKey, domainName),
+        surfaceTokensFn(binding.org, surfaceKey, period),
+        workspaceTokensFn(binding.org, workspaceKey, period),
+        scopeUsdSpendFn(binding.org, workspaceKey, surfaceKey, nowISO),
+    ]);
+    return {
+        surfaceKey,
+        workspaceKey,
+        surfaceTokens: st,
+        workspaceTokens: wt,
+        surfaceUsd: usd.surfaceUsd,
+        workspaceUsd: usd.workspaceUsd,
+        caps,
+    };
+}
+/**
+ * Why a `/oe budget raise` ack shows no domain spend — the SLASH-COMMAND wording for the shared
+ * refusal reasons.
+ *
+ * This is a third wording, and it exists for the reason `spend/reporting.ts`'s
+ * `reportDomainRefusalMessage` is a second one. That sentence tells its reader to `pass
+ * scope:"org"`. `scope` is an argument of a model-driven TOOL. A slash command takes no such
+ * argument, so the hint would send its reader after something they cannot do. The REASONS still
+ * come from the one shared resolver; only the sentence is per-surface.
+ */
+function noDomainSpendReason(reason) {
+    switch (reason) {
+        case "dm":
+            return "a DM belongs to no memory domain";
+        case "mpim":
+            return "a group chat belongs to no memory domain";
+        case "external":
+            return "an externally-shared or unconfirmed channel reports no domain spend";
+        case "unassigned":
+            return "this channel is in no memory domain, and no org-wide default domain is configured";
+    }
+}
+/** The window `/oe budget raise` scans — the ticket's ask (OPE-1631), and the same NOMINAL 30 days
+ *  the pricing-coverage read uses. The two are not the same read: coverage walks `usage_events`
+ *  over a rolling 30 days, while this scan sums `spend_ledger` over whole calendar months, because
+ *  a ledger row is keyed by month and holds no finer window. */
+export const BUDGET_RAISE_SCAN_DAYS = 30;
+/**
+ * The own-domain spend sentence `/oe budget raise` appends to its ack (OPE-1631) — the requester's
+ * evidence for the number they just proposed, read WITHOUT any privileged capability.
+ *
+ * 🔴 THE SCAN NEVER REACHES THE CARD. This sentence is built after the card is posted and goes only
+ * into the ephemeral ack the requester alone sees. Freezing it into `plan.args` would put an
+ * aggregate the approver did not ask for onto a governance record, and would change the `spend.set`
+ * dedup identity — the coverage freeze (OPE-1482) is on the card because the APPROVER needs it; this
+ * read is for the ASKER, and it stays out.
+ *
+ * 🔴 THE RAISE STAYS ADMIN-GATED. Nothing here touches `planSetSpendLimit`, `requestApproval` or the
+ * approver chain: an unprivileged caller reads a number and still cannot raise a cap.
+ *
+ * FAIL-SOFT, and it says which way it failed — the same contract `readSpendCoverage` keeps. A
+ * broken ledger read must not turn a working proposal into an error, so it returns a sentence
+ * saying the ledger could not be read. It never returns silence on a failure: silence beside a
+ * proposal would read as "your domain spent nothing".
+ */
+async function budgetRaiseSpendSentence(binding, deps) {
+    // ONE domain roster, read once and passed to both halves. The resolution below decides which
+    // domain the line NAMES and the scan decides which rows it SUMS: reading the config twice would
+    // let a mid-call config swap make the two disagree, which is the one way this line could name a
+    // domain whose figures it is not showing.
+    const domains = deps.domains ?? getConfig().loadDomains();
+    const resolved = reportDomainForBinding(binding, domains);
+    // No domain, no scan — a DM, a group chat, an external channel, or an unassigned channel with no
+    // `org` pseudo-domain. Saying so is the point: an absent figure must not read as a zero one.
+    if (resolved.domain === null)
+        return `\n_No domain spend to show — ${noDomainSpendReason(resolved.reason)}._`;
+    try {
+        const scan = await (deps.domainSpendWindow ?? domainSpendWindow)(binding.org, resolved.domain, deps.nowISO ? deps.nowISO() : new Date().toISOString(), BUDGET_RAISE_SCAN_DAYS, { domains });
+        // The periods are named, never implied. The ledger is keyed by calendar month, so this window
+        // covers WHOLE months — it over-covers the last 30 days, and a line that claimed exactly 30
+        // days would claim more than the ledger can support (spend/reporting.ts).
+        return (`\n_Domain \`${scan.domain}\` spent ~$${scan.usd.toFixed(2)} on ${fmtTokenCount(scan.tokens)} tokens over ${fmtTokenCount(scan.calls)} calls ` +
+            `in ${scan.periods.join(", ")} — the whole calendar months holding the last ${BUDGET_RAISE_SCAN_DAYS} days, which is the finest window the spend ledger keeps._`);
+    }
+    catch (e) {
+        const why = e instanceof Error ? e.message : String(e);
+        console.warn(`[open-everywhere:spend] "/oe budget raise" could not scan domain "${resolved.domain}" spend: ${why}`);
+        return `\n_Domain spend NOT shown — the spend ledger could not be read on this turn._`;
+    }
+}
+function requireChannelId(binding) {
+    const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+    if (!channelId) {
+        throw new Error("couldn't resolve this channel's id — try this from a real channel or DM, not a synthetic context.");
+    }
+    return channelId;
+}
+export async function runBudgetRaise(binding, usd, deps = {}) {
+    requireCardPathHere('"/oe budget raise"', binding.platform);
+    const effectiveCapsFn = deps.effectiveCaps ?? effectiveCaps;
+    const requestApprovalFn = deps.requestApproval ?? requestApproval;
+    const friendlyScopeLabelFn = deps.friendlyScopeLabel ?? friendlyScopeLabel;
+    const level = "surface";
+    const scopeKey = defaultScopeKey(binding, level);
+    const workspaceKey = defaultScopeKey(binding, "workspace");
+    // Approver domain = the TARGET scope's explicit domain (see set_spend_limit.ts's execute()
+    // for why: it decides WHO may approve, so it must be resolved from the scope being changed).
+    const domain = domainForChannel(scopeKey, getConfig().loadDomains())?.name ?? null;
+    const caps = await effectiveCapsFn(binding.org, workspaceKey, scopeKey, domainNameForScope(scopeKey, binding.mode, binding.trust));
+    const current = { tokens: caps.surfaceMonthlyTokens ?? null, usd: caps.surfaceMonthlyUsd ?? null };
+    const input = {
+        monthlyUsd: usd,
+        reason: `requested via "/oe budget raise" by ${mentionFor(binding)}`,
+    };
+    // Throws a user-facing error for: no verified sender (the no-card-path refusal is the
+    // `requireCardPathHere` guard at the top of this function since OPE-312) — every message is
+    // already written for a human to read, so callers can render it verbatim on failure.
+    //
+    // A DM does NOT throw here (OPE-267). `level` above is fixed at "surface", and a DM's own
+    // surface key is enforced by the gate now that `checkCap`'s blanket `mode: "dm"` exemption is
+    // gone — so "/oe budget raise" from a DM proposes a cap on that DM, which is both meaningful
+    // and the most natural ask from one. The `workspace`/`domain` defaults are still refused from
+    // a DM (assertScopableFromHere), but this command never asks for either.
+    const plan = planSetSpendLimit(binding, input, current, domain);
+    const channelId = requireChannelId(binding);
+    const scopeLabel = await friendlyScopeLabelFn(plan.scopeKey);
+    // 🔴 THIS DOOR FREEZES COVERAGE TOO (OPE-1482). "/oe budget raise" proposes a USD cap every single
+    // time, so a door that skipped the read would post exactly the card the ticket exists to remove:
+    // a $ figure with no statement of which traffic it fails to meter. The reader is shared with the
+    // model-driven tool, and it fails soft — a broken ledger read freezes "not measured", never an
+    // empty list that would read as a clean bill.
+    const coverageReport = await (deps.readSpendCoverage ?? readSpendCoverage)(plan.args.org, plan.args.level, plan.args.scopeKey, plan.args.monthlyUsd);
+    const coverage = coverageReport === undefined ? undefined : frozenCoverage(coverageReport);
+    // approval-authority: headless — slash commands execute without a model turn or wake envelope.
+    const posted = await requestApprovalFn({
+        org: plan.args.org,
+        kind: plan.kind,
+        args: { ...plan.args, ...(scopeLabel ? { scopeLabel } : {}), ...(coverage ? { coverage } : {}) },
+        scopeKey: plan.scopeKey,
+        domain: plan.domain,
+        requestedBy: binding.principalId,
+        channelId,
+        // Slash commands carry no thread anchor — a fresh top-level card, same as a Discord
+        // model-driven proposal (Discord turns never carry a threadTs either).
+        threadTs: binding.threadTs ?? null,
+        chain: { unattended: unattendedFrom(binding) },
+    }, approvalPostDeps(binding.platform));
+    // OPE-1631 — the requester's own evidence, read after the proposal is recorded so it reports the
+    // ledger as of the moment they read the ack. Both branches carry it: both are `/oe budget raise`
+    // answers, and the number that informs a raise informs it either way.
+    const spendSentence = await budgetRaiseSpendSentence(binding, deps);
+    // Chain-lowered (OPE-296) ⇒ no card and no click: the cap is already in force. The slash-command
+    // reply IS the whole user-facing answer here (there is no model turn to relay a tool result), so
+    // it says what happened rather than pointing at a card that was never posted.
+    if (posted.autoApproved) {
+        return (`Done — $${usd.toFixed(2)}/month on \`${plan.scopeKey}\` is already in force: the approver chain auto-approved it ` +
+            `(${posted.autoApproved.resolvedBy}), so no card was posted — ${posted.autoApproved.outcome}` +
+            spendSentence);
+    }
+    return (`Card posted in this channel — proposing $${usd.toFixed(2)}/month on \`${plan.scopeKey}\` ` +
+        `(pending \`${posted.id}\`, expires ${posted.expiresAt}). An admin needs to Approve it.` +
+        spendSentence);
+}
+export async function runBudgetClear(binding, deps = {}) {
+    requireCardPathHere('"/oe budget clear"', binding.platform);
+    const effectiveCapsFn = deps.effectiveCaps ?? effectiveCaps;
+    const requestApprovalFn = deps.requestApproval ?? requestApproval;
+    const friendlyScopeLabelFn = deps.friendlyScopeLabel ?? friendlyScopeLabel;
+    const level = "surface";
+    const scopeKey = defaultScopeKey(binding, level);
+    const workspaceKey = defaultScopeKey(binding, "workspace");
+    const domain = domainForChannel(scopeKey, getConfig().loadDomains())?.name ?? null;
+    const caps = await effectiveCapsFn(binding.org, workspaceKey, scopeKey, domainNameForScope(scopeKey, binding.mode, binding.trust));
+    const current = { tokens: caps.surfaceMonthlyTokens ?? null, usd: caps.surfaceMonthlyUsd ?? null };
+    const input = {};
+    const plan = planClearSpendLimit(binding, input, current, domain);
+    const channelId = requireChannelId(binding);
+    const scopeLabel = await friendlyScopeLabelFn(plan.scopeKey);
+    // approval-authority: headless — slash commands execute without a model turn or wake envelope.
+    const posted = await requestApprovalFn({
+        org: plan.args.org,
+        kind: plan.kind,
+        args: { ...plan.args, ...(scopeLabel ? { scopeLabel } : {}) },
+        scopeKey: plan.scopeKey,
+        domain: plan.domain,
+        requestedBy: binding.principalId,
+        channelId,
+        threadTs: binding.threadTs ?? null,
+        chain: { unattended: unattendedFrom(binding) },
+    }, approvalPostDeps(binding.platform));
+    // Chain-lowered (OPE-296) — see runBudgetRaise above for why this branch exists.
+    if (posted.autoApproved) {
+        return (`Done — the override on \`${plan.scopeKey}\` is already back to the config-as-code cap: the approver chain auto-approved it ` +
+            `(${posted.autoApproved.resolvedBy}), so no card was posted — ${posted.autoApproved.outcome}`);
+    }
+    return (`Card posted in this channel — proposing to clear the override on \`${plan.scopeKey}\` back to the config-as-code cap ` +
+        `(pending \`${posted.id}\`, expires ${posted.expiresAt}). An admin needs to Approve it.`);
+}
+/** Stand down whatever turn is running in this binding's channel. */
+export async function runStop(binding, attachSession) {
+    if (!attachSession) {
+        // A wiring bug, not a user error — but a user is the one reading this, so it names the other
+        // affordance they can reach for rather than an internal seam they cannot.
+        return "Stop isn't wired on this surface yet — react with the raised-hand emoji on the thread instead.";
+    }
+    const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+    const channelKey = turnChannelKey(binding.platform, channelId);
+    if (!channelKey) {
+        return "Couldn't resolve this channel — try `/oe stop` from a real channel or DM, not a synthetic context.";
+    }
+    const result = await cancelAnchoredTurn({
+        org: binding.org,
+        platform: binding.platform,
+        workspace: binding.workspace,
+        ...(binding.principalId ? { requestedBy: binding.principalId } : {}),
+        via: "command",
+        query: { channelKey },
+        attachSession,
+    });
+    return result.message;
+}
+// --- top-level orchestrator ------------------------------------------------------------------
+/**
+ * Execute one parsed `/oe` command against a resolved binding, returning the EPHEMERAL reply
+ * text (the caller wraps it in its platform's response envelope). CAN THROW for
+ * `budget-raise`/`budget-clear` (planSetSpendLimit/planClearSpendLimit's own validation errors,
+ * or a store/network failure from requestApproval) — every message is already user-facing, so
+ * callers should catch and render `err.message` verbatim rather than a generic failure text.
+ * `help`/`status`/`budget-status` never throw (status wraps its own memory-provider read in a
+ * try/catch — "/oe status" must always answer something).
+ */
+export async function runOeCommand(cmd, binding, deps = {}) {
+    switch (cmd.kind) {
+        case "error":
+            return cmd.message;
+        case "help":
+            return renderHelp();
+        case "status": {
+            let memoryProviderId = "unknown";
+            try {
+                memoryProviderId = getProvider().id;
+            }
+            catch {
+                /* best-effort — status must never throw on a misconfigured/unregistered provider */
+            }
+            let telemetryStatus = "unknown";
+            try {
+                telemetryStatus = telemetryStatusLine();
+            }
+            catch {
+                /* best-effort — status must never throw */
+            }
+            return renderStatus(getAppInfo(), memoryProviderId, telemetryStatus);
+        }
+        case "budget-status": {
+            const facts = await computeBudgetStatusFacts(binding);
+            return renderBudgetStatus(facts);
+        }
+        case "budget-raise":
+            return runBudgetRaise(binding, cmd.usd);
+        case "budget-clear":
+            return runBudgetClear(binding);
+        case "stop":
+            return runStop(binding, deps.attachSession);
+        case "rate":
+            return runRate(binding, cmd.score);
+    }
+}
+//# sourceMappingURL=core.js.map

package/dist/agent/commands/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../../agent/commands/core.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,2FAA2F;AAC3F,4FAA4F;AAC5F,4FAA4F;AAC5F,yFAAyF;AACzF,sFAAsF;AACtF,2FAA2F;AAC3F,yFAAyF;AACzF,EAAE;AACF,4FAA4F;AAC5F,8FAA8F;AAC9F,0FAA0F;AAC1F,yFAAyF;AACzF,oEAAoE;AACpE,EAAE;AACF,oCAAoC;AACpC,6FAA6F;AAC7F,sEAAsE;AACtE,iFAAiF;AACjF,0FAA0F;AAC1F,mFAAmF;AACnF,8FAA8F;AAC9F,gGAAgG;AAChG,6FAA6F;AAC7F,8FAA8F;AAC9F,0FAA0F;AAC1F,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,mFAAmF;AACnF,4FAA4F;AAC5F,4FAA4F;AAC5F,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,8FAA8F;AAC9F,gGAAgG;AAChG,mGAAmG;AACnG,gGAAgG;AAChG,+FAA+F;AAC/F,oDAAoD;AACpD,EAAE;AACF,yFAAyF;AACzF,mFAAmF;AACnF,8FAA8F;AAC9F,gDAAgD;AAEhD,OAAO,EAAE,cAAc,EAAuB,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAA+B,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAe,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GAGf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAA6B,MAAM,+BAA+B,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAElF,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAoB,MAAM,WAAW,CAAC;AAEvF,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AA6CpC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAErD,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAExC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,uBAAuB;QAAE,OAAO,uBAAuB,CAAC;IAC9E,OAAO,CAAC,CAAC;AACX,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,IAAa;IAC7C,OAAO,IAAI,CAAC,OAAO,KAAK,uBAAuB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;AAChF,CAAC;AAED,MAAM,gBAAgB,GAAY;IAChC,OAAO,EAAE,SAAS;IAClB,YAAY,EAAE,SAAS;IACvB,YAAY,EAAE,SAAS;IACvB,aAAa,EAAE,SAAS;IACxB,MAAM,EAAE,SAAS;CAClB,CAAC;AACF,IAAI,iBAAiB,GAAY,gBAAgB,CAAC;AAElD;uGACuG;AACvG,MAAM,UAAU,eAAe,CAAC,IAAa;IAC3C,iBAAiB,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,YAAY;IAC1B,iBAAiB,GAAG,gBAAgB,CAAC;AACvC,CAAC;AAiBD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAuB;IAChD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACrE,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACxD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,mFAAmF,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI;aAChI,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,4BAA4B,MAAM,4DAA4D,EAAE,CAAC;AACpI,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC5D,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChD,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5C,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,GAAG,6CAA6C,EAAE,CAAC;AAC1G,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;SACxB,IAAI,EAAE;SACN,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,+FAA+F;AAE/F,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,4FAA4F;YAC1F,wEAAwE;QAC1E,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,2CAA2C;QAC3C,wNAAwN;QACxN,qGAAqG;QACrG,6FAA6F;QAC7F,yHAAyH;QACzH,sHAAsH;QACtH,cAAc;QACd,8BAA8B;KAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;wEAEwE;AACxE,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,gBAAwB,EAAE,eAAe,GAAG,SAAS;IAC/F,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,yBAAyB,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAC/F,OAAO;QACL,8FAA8F;QAC9F,yFAAyF;QACzF,+FAA+F;QAC/F,uDAAuD;QACvD,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAsB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,mBAAmB;QACpF,uBAAuB,IAAI,CAAC,aAAa,IAAI;QAC7C,YAAY,IAAI,CAAC,MAAM,IAAI;QAC3B,sBAAsB,IAAI,CAAC,YAAY,IAAI;QAC3C,sBAAsB,IAAI,CAAC,YAAY,IAAI;QAC3C,6FAA6F;QAC7F,6FAA6F;QAC7F,+CAA+C;QAC/C,6FAA6F;QAC7F,0DAA0D;QAC1D,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,IAAI,YAAY,GAAG,CAAC;YACjF,CAAC,CAAC;gBACE,uBAAuB,aAAa,CAAC,YAAY,CAAC,kCAAkC;oBAClF,KAAK,aAAa,CAAC,eAAe,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,GAAG,YAAY,CAAC,GAAG,GAAG,CAAC,IAAI;aACnG;YACH,CAAC,CAAC,EAAE,CAAC;QACP,wBAAwB,gBAAgB,IAAI;QAC5C,kBAAkB,eAAe,IAAI;KACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;+FAC+F;AAC/F,SAAS,MAAM,CAAC,CAA4B,EAAE,IAAsB;IAClE,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,UAAU,CAAC;IACjC,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAYD,MAAM,UAAU,kBAAkB,CAAC,CAAoB;IACrD,OAAO;QACL,yCAAyC;QACzC,+FAA+F;QAC/F,6FAA6F;QAC7F,+FAA+F;QAC/F,sFAAsF;QACtF,qBAAqB,CAAC,CAAC,UAAU,QAAQ,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,YAAY;YACpI,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;QAC7E,wBAAwB,CAAC,CAAC,YAAY,QAAQ,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,YAAY;YAC7I,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,EAAE;QACjF,yEAAyE;KAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;wFAEwF;AACxF,SAAS,UAAU,CAAC,OAAuB;IACzC,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC;AACpF,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAuB,EAAE,IAAI,GAAqB,EAAE;IACjG,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC;IAClE,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEtE,gGAAgG;IAChG,wFAAwF;IACxF,0FAA0F;IAC1F,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,mFAAmF;IACnF,+EAA+E;IAC/E,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAE/E,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5C,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC;QAClE,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC;QAChD,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC;QACpD,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC;KAC/D,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,YAAY;QACZ,aAAa,EAAE,EAAE;QACjB,eAAe,EAAE,EAAE;QACnB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,IAAI;KACL,CAAC;AACJ,CAAC;AAqCD;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,MAA0B;IACrD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,IAAI;YACP,OAAO,kCAAkC,CAAC;QAC5C,KAAK,MAAM;YACT,OAAO,0CAA0C,CAAC;QACpD,KAAK,UAAU;YACb,OAAO,qEAAqE,CAAC;QAC/E,KAAK,YAAY;YACf,OAAO,mFAAmF,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;gEAGgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,wBAAwB,CAAC,OAAuB,EAAE,IAAoB;IACnF,6FAA6F;IAC7F,gGAAgG;IAChG,gGAAgG;IAChG,0CAA0C;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1D,iGAAiG;IACjG,6FAA6F;IAC7F,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,gCAAgC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9G,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,CAC9D,OAAO,CAAC,GAAG,EACX,QAAQ,CAAC,MAAM,EACf,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EACtD,sBAAsB,EACtB,EAAE,OAAO,EAAE,CACZ,CAAC;QACF,8FAA8F;QAC9F,4FAA4F;QAC5F,0EAA0E;QAC1E,OAAO,CACL,eAAe,IAAI,CAAC,MAAM,cAAc,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS;YAC9I,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,sBAAsB,4DAA4D,CACjK,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,qEAAqE,QAAQ,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC;QACpH,OAAO,+EAA+E,CAAC;IACzF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE,GAAW,EAAE,IAAI,GAAmB,EAAE;IAClG,mBAAmB,CAAC,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC;IAClE,MAAM,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC;IAE3E,MAAM,KAAK,GAAG,SAAkB,CAAC;IACjC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC3D,2FAA2F;IAC3F,6FAA6F;IAC7F,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACnI,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,oBAAoB,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;IAEhH,MAAM,KAAK,GAAuB;QAChC,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,uCAAuC,UAAU,CAAC,OAAO,CAAC,EAAE;KACrE,CAAC;IACF,sFAAsF;IACtF,4FAA4F;IAC5F,qFAAqF;IACrF,EAAE;IACF,0FAA0F;IAC1F,8FAA8F;IAC9F,6FAA6F;IAC7F,8FAA8F;IAC9F,yEAAyE;IACzE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEhE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,mGAAmG;IACnG,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,8CAA8C;IAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrJ,MAAM,QAAQ,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;IAC3F,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC;QACE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAChG,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,OAAO,CAAC,WAAY;QACjC,SAAS;QACT,oFAAoF;QACpF,uEAAuE;QACvE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE;KAC/C,EACD,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CACnC,CAAC;IACF,iGAAiG;IACjG,iGAAiG;IACjG,sEAAsE;IACtE,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpE,iGAAiG;IACjG,iGAAiG;IACjG,8EAA8E;IAC9E,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CACL,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,QAAQ,8DAA8D;YACnH,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,8BAA8B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE;YAC7F,aAAa,CACd,CAAC;IACJ,CAAC;IACD,OAAO,CACL,4CAA4C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,QAAQ,KAAK;QAC3F,cAAc,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,SAAS,kCAAkC;QACxF,aAAa,CACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE,IAAI,GAAmB,EAAE;IACrF,mBAAmB,CAAC,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC;IAClE,MAAM,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC;IAE3E,MAAM,KAAK,GAAG,SAAkB,CAAC;IACjC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACnI,MAAM,OAAO,GAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,oBAAoB,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;IAEhH,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAElE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7D,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC;QACE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC7D,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,OAAO,CAAC,WAAY;QACjC,SAAS;QACT,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;QAClC,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE;KAC/C,EACD,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CACnC,CAAC;IACF,iFAAiF;IACjF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CACL,4BAA4B,IAAI,CAAC,QAAQ,oFAAoF;YAC7H,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,8BAA8B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,CACL,sEAAsE,IAAI,CAAC,QAAQ,oCAAoC;QACvH,cAAc,MAAM,CAAC,EAAE,eAAe,MAAM,CAAC,SAAS,kCAAkC,CACzF,CAAC;AACJ,CAAC;AAwBD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAuB,EAAE,aAAiD;IACtG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,6FAA6F;QAC7F,0EAA0E;QAC1E,OAAO,gGAAgG,CAAC;IAC1G,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,oGAAoG,CAAC;IAC9G,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,EAAE,UAAU,EAAE;QACrB,aAAa;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,gGAAgG;AAEhG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAc,EAAE,OAAuB,EAAE,IAAI,GAAkB,EAAE;IAClG,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,UAAU,EAAE,CAAC;QACtB,KAAK,QAAQ,EAAE,CAAC;YACd,IAAI,gBAAgB,GAAG,SAAS,CAAC;YACjC,IAAI,CAAC;gBACH,gBAAgB,GAAG,WAAW,EAAE,CAAC,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,oFAAoF;YACtF,CAAC;YACD,IAAI,eAAe,GAAG,SAAS,CAAC;YAChC,IAAI,CAAC;gBACH,eAAe,GAAG,mBAAmB,EAAE,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;YACD,OAAO,YAAY,CAAC,UAAU,EAAE,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,eAAe,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;YACtD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;QACjC,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC9C,KAAK,MAAM;YACT,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;AACH,CAAC"}

package/dist/agent/commands/rate.d.ts

@@ -0,0 +1,55 @@
+import { appendAudit, readAudit } from "../audit/audit.js";
+import type { SurfaceBinding } from "../identity/binding.js";
+import { type ModelArm } from "../model/ab-test.js";
+/** The parsed `/oe rate <score>` command. Carried in `OeCommand`'s union (commands/core.ts). */
+export interface RateCommand {
+    readonly kind: "rate";
+    readonly score: number;
+}
+/** The `/oe help` line for this command — owned here so the command and its help cannot drift. */
+export declare const RATE_HELP_LINE = "\u2022 `/oe rate <1-5>` \u2014 mark the model A/B test: rate the last answer in this channel.";
+/**
+ * Parse the rest-tokens of `/oe rate`. NEVER throws: garbage resolves to an `"error"` variant whose
+ * message is already user-facing, the same contract every other `/oe` parser keeps.
+ *
+ * The bound check is `Number.isInteger`, not a range clamp: a person who typed `9` meant something,
+ * and silently storing `5` would put a number in the ledger nobody chose.
+ */
+export declare function parseRateTokens(rest: readonly string[]): RateCommand | {
+    readonly kind: "error";
+    readonly message: string;
+};
+/** What the room's newest `model.ab_arm` row says. */
+export interface RatedTurn {
+    readonly arm: ModelArm;
+    readonly bucketKey: string;
+    readonly modelId: string;
+    readonly turnId: string;
+    readonly sessionId?: string;
+    readonly ts: string;
+}
+/** Injectable seams — this door is tested without a store, same posture as the budget doors. */
+export interface RateDeps {
+    readonly readAudit?: typeof readAudit;
+    readonly appendAudit?: typeof appendAudit;
+}
+/**
+ * The newest armed turn on `surfaceKey`, or undefined when the room has none. Fail-soft: an
+ * unreadable audit store answers "nothing to rate" rather than throwing at a person who typed a
+ * slash command.
+ *
+ * Pure over its inputs otherwise — exported so the test can drive every shape of row, including a
+ * malformed detail blob (an old row, a hand-edited store), which must be REJECTED rather than
+ * carried onto a rating as `undefined`.
+ */
+export declare function lastArmedTurn(org: string, surfaceKey: string, deps?: RateDeps): Promise<RatedTurn | undefined>;
+/**
+ * Record one human mark. Returns the EPHEMERAL reply text (the caller wraps it in its platform's
+ * envelope). Never throws — every failure path is a sentence a person can read.
+ *
+ * The row it writes is the eval's quality half: `arm` joins it to the cost half (the `modelArm`
+ * key on the turn's usage row), and `sessionId`/`turnId` name the exact turn the mark is about.
+ * `ratedAt` is the arm row's own ts, so a report can see how long after the turn the mark arrived.
+ */
+export declare function runRate(binding: SurfaceBinding, score: number, deps?: RateDeps): Promise<string>;
+//# sourceMappingURL=rate.d.ts.map

package/dist/agent/commands/rate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate.d.ts","sourceRoot":"","sources":["../../../agent/commands/rate.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAyF,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE3I,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,kGAAkG;AAClG,eAAO,MAAM,cAAc,kGAAoI,CAAC;AAEhK;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAY3H;AAED,sDAAsD;AACtD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,gGAAgG;AAChG,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CA2BxH;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA2C1G"}