@phuetz/code-buddy 1.6.0 → 2.0.0

package/dist/agent/session-end-flush.js

@@ -26,6 +26,7 @@ import * as path from 'path';
 import { isFeatureEnabled } from '../config/feature-flags.js';
 import { redactSecrets } from '../fleet/privacy-lint.js';
 import { logger } from '../utils/logger.js';
+import { writeFileAtomicSync } from '../utils/atomic-write.js';
 // ============================================================================
 // Gates & heuristics
 // ============================================================================
@@ -154,7 +155,7 @@ export function writeHandoffSync(history, workDir = process.cwd(), options = {})
     const target = path.join(dir, 'HANDOFF.md');
     try {
         fs.mkdirSync(dir, { recursive: true });
-        fs.writeFileSync(target, content, 'utf8');
+        writeFileAtomicSync(target, content, { mode: 0o600 });
         handoffWrittenFor = history;
         return target;
     }

package/dist/agent/specialized/agent-registry.d.ts

@@ -62,6 +62,7 @@ export declare class AgentRegistry extends EventEmitter {
      * Execute a task on a specific agent
      */
     executeOn(agentId: string, task: AgentTask): Promise<AgentResult>;
+    private executeVerifierOnDelegate;
     /**
      * Initialize all registered agents
      */

package/dist/agent/specialized/agent-registry.js

@@ -14,9 +14,50 @@ import { getArchiveAgent } from './archive-agent.js';
 import { getCodeGuardianAgent } from './code-guardian-agent.js';
 import { getSecurityReviewAgent } from './security-review-agent.js';
 import { getSWEAgent } from './swe-agent-adapter.js';
+import { getVerifierAgent, VerifierAgent } from './verifier-agent.js';
+import { ThreadTaskRunner } from '../delegation/thread-task-runner.js';
 import { getErrorMessage } from '../../types/index.js';
 import { getAgentParams } from '../../config/agent-defaults.js';
 import { logger } from '../../utils/logger.js';
+const VERIFIER_DELEGATION_PARENT_BUDGET = {
+    maxTurns: 12,
+    maxCostUsd: 1,
+    maxContextTokens: 32_000,
+};
+/**
+ * Parameter keys that would smuggle the PARENT conversation into the Verifier.
+ * The Verifier's public contract is an independent, fresh-context review: it
+ * must judge the work from the instruction, the files and its own oracles, not
+ * from the transcript that produced the work. The delegation boundary is where
+ * that contract is enforced, so a future reader of `task.params` cannot
+ * resurrect the parent's messages.
+ */
+const PARENT_CONTEXT_PARAM_KEYS = [
+    'parentHistory',
+    'history',
+    'messages',
+    'parentMessages',
+    'conversation',
+    'chatHistory',
+];
+/** Drop the parent conversation channels from a delegated Verifier task. */
+function stripParentContext(task) {
+    if (!task.params)
+        return task;
+    const leaked = PARENT_CONTEXT_PARAM_KEYS.filter((key) => key in task.params);
+    if (leaked.length === 0)
+        return task;
+    const params = { ...task.params };
+    for (const key of leaked)
+        delete params[key];
+    logger.debug(`Verifier delegation dropped parent context params: ${leaked.join(', ')}`, { source: 'AgentRegistry' });
+    return { ...task, params };
+}
+function boundedPositiveInteger(value, limit) {
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0)
+        return limit;
+    return Math.min(Math.floor(value), limit);
+}
 // ============================================================================
 // Agent Registry Implementation
 // ============================================================================
@@ -44,6 +85,7 @@ export class AgentRegistry extends EventEmitter {
             getCodeGuardianAgent(),
             getSecurityReviewAgent(),
             getSWEAgent(),
+            getVerifierAgent(),
         ];
         for (const agent of agents) {
             this.register(agent);
@@ -205,11 +247,87 @@ export class AgentRegistry extends EventEmitter {
                 error: `Agent not found: ${agentId}`,
             };
         }
+        // The Verifier's public contract is a fresh, isolated conversation. Route
+        // every explicit execution through a new bounded delegate rather than the
+        // cached registry singleton used by deterministic specialized agents.
+        if (agentId === 'verifier') {
+            return this.executeVerifierOnDelegate(task);
+        }
         if (this.config.autoInitialize && !agent.isReady()) {
             await agent.initialize();
         }
         return agent.execute(task);
     }
+    async executeVerifierOnDelegate(task) {
+        const readSessionCost = typeof task.params?.getSessionCost === 'function'
+            ? task.params.getSessionCost
+            : null;
+        const initialCost = readSessionCost?.() ?? 0;
+        let childBudget = null;
+        const runner = new ThreadTaskRunner({
+            parentBudget: VERIFIER_DELEGATION_PARENT_BUDGET,
+            createAgent: async ({ budget }) => {
+                childBudget = budget;
+                const verifier = new VerifierAgent();
+                await verifier.initialize();
+                return {
+                    execute: (input) => {
+                        const maxSteps = boundedPositiveInteger(input.params?.maxSteps, budget.maxTurns);
+                        // Keep cumulative observations within the reduced context budget.
+                        // Three chars/token is deliberately conservative for source/test logs.
+                        const perStepObserveLimit = Math.max(512, Math.floor((budget.maxContextTokens * 3) / maxSteps));
+                        const maxObserve = boundedPositiveInteger(input.params?.maxObserve ?? 10_000, perStepObserveLimit);
+                        return verifier.execute({
+                            ...input,
+                            params: {
+                                ...input.params,
+                                maxSteps,
+                                maxObserve,
+                            },
+                        });
+                    },
+                    abortCurrentOperation() { },
+                    dispose: () => verifier.cleanup(),
+                    getSessionCost: () => {
+                        const current = readSessionCost?.() ?? initialCost;
+                        return Math.max(0, current - initialCost);
+                    },
+                };
+            },
+        });
+        const eventPump = (async () => {
+            for await (const event of runner.events()) {
+                this.emit('delegate:event', event);
+            }
+        })();
+        try {
+            const outcome = await runner.submit('verifier', stripParentContext(task));
+            if (!outcome.success || !outcome.output) {
+                const detail = outcome.message ?? outcome.reason ?? 'delegate returned no result';
+                return {
+                    success: false,
+                    error: `Verifier delegate incomplete: ${detail}`,
+                    metadata: {
+                        verdict: 'NEEDS REVIEW',
+                        delegated: true,
+                        ...(outcome.reason ? { reason: outcome.reason } : {}),
+                    },
+                };
+            }
+            return {
+                ...outcome.output,
+                metadata: {
+                    ...outcome.output.metadata,
+                    delegated: true,
+                    ...(childBudget ? { delegateBudget: childBudget } : {}),
+                },
+            };
+        }
+        finally {
+            await runner.close();
+            await eventPump;
+        }
+    }
     /**
      * Initialize all registered agents
      */

package/dist/agent/specialized/excel-agent.js

@@ -4,10 +4,23 @@
  * Specialized agent for Excel and CSV file manipulation.
  * Uses xlsx library for Excel files and built-in parsing for CSV.
  */
-import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { existsSync, readFileSync, statSync, writeFileSync } from 'fs';
 import { basename, extname } from 'path';
 import { SpecializedAgent, } from './types.js';
 import { getErrorMessage } from '../../types/index.js';
+const DEFAULT_MAX_EXCEL_BYTES = 25 * 1024 * 1024;
+function maxExcelBytes() {
+    const configured = Number(process.env.CODEBUDDY_MAX_EXCEL_BYTES);
+    return Number.isFinite(configured) && configured > 0 ? configured : DEFAULT_MAX_EXCEL_BYTES;
+}
+function assertExcelFileWithinLimit(filePath) {
+    const size = statSync(filePath).size;
+    const maxBytes = maxExcelBytes();
+    if (size > maxBytes) {
+        throw new Error(`Excel file is too large to parse safely (${size} bytes > ${maxBytes} bytes). ` +
+            'Set CODEBUDDY_MAX_EXCEL_BYTES to override.');
+    }
+}
 // ============================================================================
 // Configuration
 // ============================================================================
@@ -483,6 +496,7 @@ export class ExcelAgent extends SpecializedAgent {
         };
     }
     readExcelFile(filePath) {
+        assertExcelFileWithinLimit(filePath);
         const buffer = readFileSync(filePath);
         const wb = this.xlsx.read(buffer, { type: 'buffer' });
         const sheets = wb.SheetNames.map((name, index) => {

package/dist/agent/specialized/index.d.ts

@@ -17,4 +17,5 @@ export { SQLAgent, getSQLAgent, createSQLAgent } from './sql-agent.js';
 export { ArchiveAgent, getArchiveAgent, createArchiveAgent } from './archive-agent.js';
 export { CodeGuardianAgent, getCodeGuardianAgent, resetCodeGuardianAgent, CODE_GUARDIAN_CONFIG, ACTION_HELP, SUPPORTED_ACTIONS, formatSize, getSeverityIcon, groupIssuesBySeverity, formatFileAnalysis, formatCodeAnalysis, formatRefactorSuggestions, formatPatchPlan, formatPatchDiffs, formatIssuesList, formatDependencyGraph, } from './code-guardian-agent.js';
 export type { CodeGuardianMode, IssueSeverity, IssueType, CodeIssue, FileDependency, FileAnalysis, CodeAnalysis, RefactorSuggestion, PatchStep, PatchPlan, PatchDiff, } from './code-guardian-agent.js';
+export { VerifierAgent, getVerifierAgent, resetVerifierAgent, VERIFIER_SYSTEM_PROMPT, VERIFIER_AGENT_CONFIG, VERIFIER_ALLOWED_TOOLS, VERIFIER_DENIED_TOOLS, } from './verifier-agent.js';
 export { AgentRegistry, getAgentRegistry, initializeAgentRegistry, type AgentRegistryConfig, type AgentMatch, } from './agent-registry.js';

package/dist/agent/specialized/index.js

@@ -23,6 +23,8 @@ export { SQLAgent, getSQLAgent, createSQLAgent } from './sql-agent.js';
 export { ArchiveAgent, getArchiveAgent, createArchiveAgent } from './archive-agent.js';
 // Code Guardian Agent (re-exports from code-guardian/ subdirectory)
 export { CodeGuardianAgent, getCodeGuardianAgent, resetCodeGuardianAgent, CODE_GUARDIAN_CONFIG, ACTION_HELP, SUPPORTED_ACTIONS, formatSize, getSeverityIcon, groupIssuesBySeverity, formatFileAnalysis, formatCodeAnalysis, formatRefactorSuggestions, formatPatchPlan, formatPatchDiffs, formatIssuesList, formatDependencyGraph, } from './code-guardian-agent.js';
+// Verifier Agent (independent fresh-context verifier — evidence over claims)
+export { VerifierAgent, getVerifierAgent, resetVerifierAgent, VERIFIER_SYSTEM_PROMPT, VERIFIER_AGENT_CONFIG, VERIFIER_ALLOWED_TOOLS, VERIFIER_DENIED_TOOLS, } from './verifier-agent.js';
 // Agent Registry
 export { AgentRegistry, getAgentRegistry, initializeAgentRegistry, } from './agent-registry.js';
 //# sourceMappingURL=index.js.map

package/dist/agent/specialized/pdf-agent.js

@@ -8,6 +8,7 @@ import { existsSync, readFileSync, statSync } from 'fs';
 import { extname } from 'path';
 import { SpecializedAgent, } from './types.js';
 import { getErrorMessage } from '../../types/index.js';
+const PDF_PARSE_SPECIFIER = 'pdf-parse';
 // ============================================================================
 // Configuration
 // ============================================================================
@@ -31,8 +32,9 @@ export class PDFAgent extends SpecializedAgent {
     async initialize() {
         try {
             // Dynamic import of pdf-parse
-            const pdfParseModule = await import('pdf-parse');
-            this.pdfParse = pdfParseModule.default || pdfParseModule;
+            const pdfParseModule = await import(PDF_PARSE_SPECIFIER);
+            this.pdfParse = pdfParseModule.default
+                ?? pdfParseModule;
             this.isInitialized = true;
             this.emit('initialized');
         }

package/dist/agent/specialized/swe-agent-adapter.js

@@ -45,6 +45,14 @@ export class SWESpecializedAgent extends SpecializedAgent {
                 maxObserve: task.params?.maxObserve ?? configOptions.maxTokens ?? 10000,
                 llmCall: llmCall,
                 executeTool: executeTool,
+                model: typeof task.params?.model === 'string' ? task.params.model : undefined,
+                contextWindow: typeof task.params?.contextWindow === 'number' ? task.params.contextWindow : undefined,
+                responseReserveTokens: typeof task.params?.responseReserveTokens === 'number'
+                    ? task.params.responseReserveTokens
+                    : undefined,
+                workspaceRoot: typeof task.params?.workspaceRoot === 'string'
+                    ? task.params.workspaceRoot
+                    : process.cwd(),
             });
             const prompt = this.buildPrompt(task);
             const result = await agent.run(prompt);

package/dist/agent/specialized/swe-agent.d.ts

@@ -16,9 +16,15 @@ export interface SWEAgentConfig {
     /** LLM call function */
     llmCall: (messages: SWEMessage[], tools: SWETool[]) => Promise<SWELLMResponse>;
     /** Tool execution function */
-    executeTool: (name: string, args: Record<string, unknown>) => Promise<SWEToolResult>;
+    executeTool: (name: string, args: Record<string, unknown>, executionExtra?: Record<string, unknown>) => Promise<SWEToolResult>;
     /** Optional code graph for file context injection */
     graph?: KnowledgeGraph;
+    /** Model metadata used to allocate observation budgets. */
+    model?: string;
+    contextWindow?: number;
+    responseReserveTokens?: number;
+    /** Workspace used for disk-backed raw-observation recovery. */
+    workspaceRoot?: string;
 }
 export interface SWEMessage {
     role: 'system' | 'user' | 'assistant' | 'tool';
@@ -68,6 +74,10 @@ export declare class SWEAgent extends EventEmitter {
     private config;
     private stateMachine;
     private memory;
+    private rawToolObservations;
+    /** Opaque scope for disk-backed observations owned by this SWE agent. */
+    private readonly recoverySessionId;
+    private currentRequest;
     constructor(config: SWEAgentConfig);
     /** Current state */
     get status(): AgentStatus;
@@ -75,6 +85,7 @@ export declare class SWEAgent extends EventEmitter {
     run(request: string): Promise<string>;
     /** Single think-act step. Returns string if terminal, null to continue. */
     private step;
+    private restoreCurrentRunObservation;
     /** Get conversation memory */
     getMemory(): ReadonlyArray<SWEMessage>;
     /** Get state machine snapshot */
@@ -89,4 +100,8 @@ export declare function createSWEAgent(config: {
     maxObserve?: number;
     llmCall: SWEAgentConfig['llmCall'];
     executeTool: SWEAgentConfig['executeTool'];
+    model?: string;
+    contextWindow?: number;
+    responseReserveTokens?: number;
+    workspaceRoot?: string;
 }): SWEAgent;

package/dist/agent/specialized/swe-agent.js

@@ -5,14 +5,18 @@
  * Follows the SWE-agent ACI pattern (Agent-Computer Interface).
  */
 import { EventEmitter } from 'events';
+import { randomUUID } from 'crypto';
 import { AgentStateMachine, AgentStatus } from '../state-machine.js';
 import { TERMINATE_SIGNAL } from '../../tools/terminate-tool.js';
+import { formatToolResultForRecovery } from '../../context/restorable-compression.js';
+import { commandFromToolArguments, prepareToolObservationForPrompt, } from '../prompt-tool-observation.js';
 /** SWE-specific system prompt */
 const SWE_SYSTEM_PROMPT = `You are a software engineering agent specialized in code editing, debugging, and repository-level tasks.
 
 ## Available Tools
 - **bash**: Execute shell commands (git, npm, grep, find, test runners, etc.)
 - **str_replace_editor**: View, create, and edit files with precise string replacement
+- **restore_context**: Recover an exact earlier tool result by its tool call ID
 - **terminate**: Signal when the task is complete
 
 ## Workflow
@@ -73,6 +77,20 @@ const SWE_TOOLS = [
             },
         },
     },
+    {
+        type: 'function',
+        function: {
+            name: 'restore_context',
+            description: 'Restore the exact raw output of an earlier tool call in this SWE run by call ID.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    identifier: { type: 'string', description: 'Exact earlier tool call ID' },
+                },
+                required: ['identifier'],
+            },
+        },
+    },
     {
         type: 'function',
         function: {
@@ -179,6 +197,10 @@ export class SWEAgent extends EventEmitter {
     config;
     stateMachine;
     memory = [];
+    rawToolObservations = new Map();
+    /** Opaque scope for disk-backed observations owned by this SWE agent. */
+    recoverySessionId = `swe-${randomUUID()}`;
+    currentRequest = '';
     constructor(config) {
         super();
         this.config = config;
@@ -196,6 +218,8 @@ export class SWEAgent extends EventEmitter {
     async run(request) {
         // Initialize
         this.memory = [{ role: 'system', content: SWE_SYSTEM_PROMPT }];
+        this.rawToolObservations.clear();
+        this.currentRequest = request;
         // Inject code graph context if available
         if (this.config.graph) {
             const codeContext = suggestFilesForTask(request, this.config.graph);
@@ -291,7 +315,11 @@ export class SWEAgent extends EventEmitter {
             catch {
                 args = { raw: toolCall.function.arguments };
             }
-            const result = await this.config.executeTool(name, args);
+            const result = name === 'restore_context'
+                ? this.restoreCurrentRunObservation(args)
+                : await this.config.executeTool(name, args, {
+                    recoverySessionId: this.recoverySessionId,
+                });
             // Check for terminate signal
             if (result.output?.startsWith(TERMINATE_SIGNAL)) {
                 const status = result.output.replace(TERMINATE_SIGNAL, '').trim();
@@ -303,12 +331,35 @@ export class SWEAgent extends EventEmitter {
                 });
                 return status;
             }
-            // Truncate large outputs
-            let output = result.success
-                ? result.output || 'Success (no output)'
-                : `Error: ${result.error || 'Unknown error'}`;
-            if (output.length > this.config.maxObserve) {
-                output = output.substring(0, this.config.maxObserve) + `\n... (truncated, ${output.length} chars total)`;
+            const rawOutput = formatToolResultForRecovery(result);
+            const observation = await prepareToolObservationForPrompt({
+                toolName: name,
+                toolCallId: toolCall.id,
+                content: rawOutput,
+                fallbackContent: result.success ? rawOutput : `Error: ${rawOutput}`,
+                success: result.success,
+                exitCode: result.success ? 0 : 1,
+                ...(result.error === undefined ? {} : { error: result.error }),
+                command: commandFromToolArguments(args),
+                query: this.currentRequest,
+                workspaceRoot: this.config.workspaceRoot ?? process.cwd(),
+                sessionId: this.recoverySessionId,
+                model: this.config.model,
+                messages: this.memory,
+                contextWindow: this.config.contextWindow,
+                responseReserveTokens: this.config.responseReserveTokens,
+                allowOptimization: true,
+            });
+            if (name !== 'restore_context') {
+                this.rawToolObservations.set(toolCall.id, observation.rawContent);
+            }
+            // Keep the historical SWE observation ceiling as a last-resort bound,
+            // but preserve a recovery instruction instead of silently losing data.
+            let output = observation.content;
+            if (name !== 'restore_context' && output.length > this.config.maxObserve) {
+                const suffix = `\n... [truncated; exact raw output: restore_context(identifier=${JSON.stringify(toolCall.id)})]`;
+                const visibleChars = Math.max(0, this.config.maxObserve - suffix.length);
+                output = output.substring(0, visibleChars) + suffix;
             }
             this.memory.push({
                 role: 'tool',
@@ -322,6 +373,19 @@ export class SWEAgent extends EventEmitter {
         this.stateMachine.transition(AgentStatus.RUNNING, 'Tools executed');
         return null;
     }
+    restoreCurrentRunObservation(args) {
+        const identifier = typeof args.identifier === 'string' ? args.identifier : '';
+        if (!identifier)
+            return { success: false, error: 'identifier is required' };
+        const raw = this.rawToolObservations.get(identifier);
+        if (raw === undefined) {
+            return {
+                success: false,
+                error: `Tool call ${identifier} is not available in this SWE run`,
+            };
+        }
+        return { success: true, output: raw };
+    }
     /** Get conversation memory */
     getMemory() {
         return this.memory;
@@ -341,6 +405,10 @@ export function createSWEAgent(config) {
         maxObserve: config.maxObserve ?? 10000,
         llmCall: config.llmCall,
         executeTool: config.executeTool,
+        model: config.model,
+        contextWindow: config.contextWindow,
+        responseReserveTokens: config.responseReserveTokens,
+        workspaceRoot: config.workspaceRoot,
     });
 }
 //# sourceMappingURL=swe-agent.js.map

package/dist/agent/specialized/types.d.ts

@@ -4,7 +4,7 @@
  * Common types and interfaces for specialized agents.
  */
 import { EventEmitter } from 'events';
-export type AgentCapability = 'pdf-extract' | 'pdf-analyze' | 'excel-read' | 'excel-write' | 'csv-parse' | 'data-transform' | 'data-visualize' | 'sql-query' | 'archive-extract' | 'archive-create' | 'code-analyze' | 'code-review' | 'code-refactor' | 'code-security' | 'code-edit' | 'code-debug';
+export type AgentCapability = 'pdf-extract' | 'pdf-analyze' | 'excel-read' | 'excel-write' | 'csv-parse' | 'data-transform' | 'data-visualize' | 'sql-query' | 'archive-extract' | 'archive-create' | 'code-analyze' | 'code-review' | 'code-refactor' | 'code-security' | 'code-edit' | 'code-debug' | 'code-verify';
 export interface SpecializedAgentConfig {
     /** Unique agent identifier */
     id: string;
@@ -20,6 +20,23 @@ export interface SpecializedAgentConfig {
     maxFileSize?: number;
     /** Required external tools/binaries */
     requiredTools?: string[];
+    /**
+     * Role/doctrine system prompt for LLM-driven agents (e.g. the Verifier).
+     * Deterministic agents (PDF, Excel, …) leave this unset.
+     */
+    systemPrompt?: string;
+    /**
+     * Positive allowlist of tool names this agent may execute. When set and
+     * non-empty, any tool outside the list is refused by `isToolAllowed()`.
+     * Unset/empty ⇒ no allowlist restriction.
+     */
+    allowedTools?: string[];
+    /**
+     * Explicit denylist of tool names (e.g. destructive writes for a read-only
+     * verifier). A denied tool is refused even if it also appears in the
+     * allowlist — deny wins (fail-closed).
+     */
+    deniedTools?: string[];
     /** Optional configuration */
     options?: Record<string, unknown>;
 }
@@ -67,6 +84,19 @@ export declare abstract class SpecializedAgent extends EventEmitter {
     hasCapability(capability: AgentCapability): boolean;
     /** Check if agent can handle a file extension */
     canHandleExtension(ext: string): boolean;
+    /** Role/doctrine system prompt, if this agent is LLM-driven */
+    getSystemPrompt(): string | undefined;
+    /** Tools this agent is explicitly allowed to execute (allowlist, may be empty) */
+    getAllowedTools(): string[];
+    /** Tools this agent is explicitly forbidden from executing */
+    getDeniedTools(): string[];
+    /**
+     * Toolset gate. Deny wins (fail-closed): a denied tool is never permitted.
+     * If an allowlist is configured, only listed tools pass; with no allowlist
+     * the agent is unrestricted (backwards-compatible for the deterministic
+     * agents, which set neither field).
+     */
+    isToolAllowed(tool: string): boolean;
     /** Initialize the agent (check dependencies, etc.) */
     abstract initialize(): Promise<void>;
     /** Check if agent is ready to execute tasks */

package/dist/agent/specialized/types.js

@@ -41,6 +41,32 @@ export class SpecializedAgent extends EventEmitter {
         const normalizedExt = ext.startsWith('.') ? ext.slice(1) : ext;
         return this.config.fileExtensions.includes(normalizedExt.toLowerCase());
     }
+    /** Role/doctrine system prompt, if this agent is LLM-driven */
+    getSystemPrompt() {
+        return this.config.systemPrompt;
+    }
+    /** Tools this agent is explicitly allowed to execute (allowlist, may be empty) */
+    getAllowedTools() {
+        return this.config.allowedTools ?? [];
+    }
+    /** Tools this agent is explicitly forbidden from executing */
+    getDeniedTools() {
+        return this.config.deniedTools ?? [];
+    }
+    /**
+     * Toolset gate. Deny wins (fail-closed): a denied tool is never permitted.
+     * If an allowlist is configured, only listed tools pass; with no allowlist
+     * the agent is unrestricted (backwards-compatible for the deterministic
+     * agents, which set neither field).
+     */
+    isToolAllowed(tool) {
+        if (this.config.deniedTools?.includes(tool))
+            return false;
+        const allow = this.config.allowedTools;
+        if (allow && allow.length > 0)
+            return allow.includes(tool);
+        return true;
+    }
     /** Check if agent is ready to execute tasks */
     isReady() {
         return this.isInitialized;

package/dist/agent/specialized/verifier-agent.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Verifier Agent — the tester is not the coder, and it hands back evidence.
+ *
+ * A 9th built-in specialized agent implementing the Replit-Agent-3 /
+ * Claude-Code doctrine "show evidence rather than asserting success". The
+ * Verifier runs with a FRESH context and inherits none of the coder's claims:
+ * its job is to establish whether a task actually works by reproducing it and
+ * running real oracles (app_server → web_test → console/network/server logs,
+ * or the real test suite, or a real API request), then to return a STRUCTURED
+ * verdict backed by the raw evidence — CONFIRMED or NEEDS REVIEW.
+ *
+ * It is delegated explicitly (like CodeGuardian / SecurityReview) via
+ * `AgentRegistry.executeOn('verifier', task)`; it never auto-triggers and
+ * never routes by file extension (fileExtensions is empty on purpose so it
+ * stays out of the file-based auto-matcher and cannot shadow SWE/CodeGuardian).
+ *
+ * Toolset: read + execute verification tools only. Destructive write tools
+ * (create_file, write_file, str_replace_editor, multi_edit, apply_patch) are
+ * denied and refused fail-closed — a verifier inspects and runs, it does not
+ * code.
+ */
+import { SpecializedAgent, type SpecializedAgentConfig, type AgentTask, type AgentResult } from './types.js';
+/**
+ * The Verifier's role/doctrine. The uppercase contract markers
+ * (CONFIRMED / NEEDS REVIEW) and the "evidence" / "never assert success
+ * without proof" phrasing are stable and asserted by tests — keep them.
+ */
+export declare const VERIFIER_SYSTEM_PROMPT = "You are an INDEPENDENT VERIFIER running with a FRESH CONTEXT.\n\nYour mission is to establish whether a piece of work ACTUALLY WORKS \u2014 not whether someone claims it does. You inherit NONE of the coder's assumptions or self-reported success. The coder is not the tester; you are the tester, and you hand back evidence.\n\n## Method: reproduce -> run real oracles -> SHOW THE EVIDENCE\n1. Reproduce the change/flow in a real environment.\n2. Run real oracles for what is being verified:\n   - Web UI: start the dev server with `app_server`, then run `web_test` (with assertions, and interaction steps if a flow is involved), and read the console / network / server-log evidence it returns; stop the server with `app_server` when done.\n   - Code: run the real test suite (`task_verify` / the project's tests) and re-read the diff.\n   - API: make a real request and inspect the real response/status.\n3. Collect the RAW evidence \u2014 actual test output, the web_test report, network status codes, log excerpts \u2014 never a paraphrase.\n\n## Rules\n- NEVER assert success without proof. A claim with no evidence is NEEDS REVIEW.\n- A FAILED test is useful INFORMATION, not a failure of your mission: report it with its evidence.\n- Prefer \"NEEDS REVIEW\" to optimistic doubt. If you could not run an oracle, say so and why.\n- You are read-only: you may read, search, run tests, and drive the app, but you MUST NOT edit, write, or patch files.\n\n## Output: a structured verdict\n- WHAT WAS VERIFIED: the checks you attempted.\n- RESULT PER CHECK: pass / fail for each, one line each.\n- EVIDENCE: the real output for each check (test output, web_test report, network status, log excerpt) \u2014 quoted, not summarized.\n- FINAL VERDICT: exactly one of\n  - CONFIRMED \u2014 every check passed with evidence to back it.\n  - NEEDS REVIEW \u2014 something failed, was unproven, or could not be run (list what is missing).";
+/** Read + execute verification tools the Verifier is allowed to drive. */
+export declare const VERIFIER_ALLOWED_TOOLS: string[];
+/** Destructive write tools — a verifier reads and executes, it does not code. */
+export declare const VERIFIER_DENIED_TOOLS: string[];
+export declare const VERIFIER_AGENT_CONFIG: SpecializedAgentConfig;
+/**
+ * SpecializedAgent-compatible Verifier. Delegated via
+ * `registry.executeOn('verifier', { action: 'verify', params: { llmCall, executeTool, instruction } })`.
+ */
+export declare class VerifierAgent extends SpecializedAgent {
+    constructor();
+    initialize(): Promise<void>;
+    getSupportedActions(): string[];
+    getActionHelp(action: string): string;
+    execute(task: AgentTask): Promise<AgentResult>;
+    /**
+     * Wrap executeTool with the toolset gate: a denied/non-allowed tool is
+     * refused fail-closed and never reaches the real executor.
+     */
+    private gate;
+    private buildRequest;
+    private runVerificationLoop;
+}
+export declare function getVerifierAgent(): VerifierAgent;
+export declare function resetVerifierAgent(): void;