@pugi/cli 0.1.0-beta.10 → 0.1.0-beta.101

package/dist/core/edits/dispatch.js

@@ -1,15 +1,16 @@
 /**
- * Diff dispatch — α6.6 escalation Phase 1.
+ * Diff dispatch — escalation Phase 1, β1b Pl8 transactional layer
+ * .
  *
  * Reads a raw model response containing one or more SEARCH/REPLACE
  * envelopes, normalises them through `marker-parser`, and routes each
  * parsed edit to the correct applicator:
  *
- *   - `layer-a` → applyLayerA
- *   - `layer-b` → applyLayerB
- *   - `layer-c` → applyLayerC
- *   - `layer-d` → throws LayerDDeferredError, surfaced as a clean
- *                 dispatch failure (Layer D ships in α6.6b)
+ *  - `layer-a` → applyLayerA
+ *  - `layer-b` → applyLayerB
+ *  - `layer-c` → applyLayerC
+ *  - `layer-d` → throws LayerDDeferredError, surfaced as a clean
+ *                dispatch failure (Layer D ships in )
  *
  * Per-edit results are aggregated into `DispatchResult[]` so callers
  * can render the full apply transcript even when some edits failed.
@@ -21,16 +22,39 @@
  * the writeFile. A crash between the two leaves a recoverable trail —
  * the operator (or `pugi resume`) sees the intent and can re-attempt.
  *
+ * β1b Pl8 — transactional rollback: when the caller supplies
+ * `transactional: { sessionId, taskId, workspaceRoot }`, the dispatcher
+ * wraps the multi-file edits in a session journal (see
+ * `core/edits/journal.ts`). On non-zero exit / budget kill / partial
+ * fail it runs `rollbackDispatch()`:
+ *
+ *  - tracked files that EXISTED before → `git restore -- <file>`
+ *  - newly created files (existed=false) → `fs.unlink`
+ *  - untracked files that EXISTED before → restore from in-memory
+ *    pre-content snapshot (sha256_before validated)
+ *
+ * Pattern mirrors `tools/apply-patch.ts::rollbackFiles` (PR). The
+ * journal is the durability layer that lets a process crash recover
+ * across PIDs; the in-memory snapshot covers the single-process case
+ * where the journal write itself failed.
+ *
  * The dispatcher is intentionally side-effect-light: no logging, no
  * stdout writes, no exit-code mutation. The CLI integration layer in
  * `cli.ts` owns operator-facing rendering; the dispatcher returns
  * structured data and lets the caller decide UX.
  */
+import { spawnSync } from 'node:child_process';
+import { readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { resolve, sep } from 'node:path';
+import { commitCheckpoint, formatCheckpointMessage, initShadowRepo, ShadowGitUnavailableError, } from '../checkpoints/shadow-git.js';
+import { detectEditFormat } from './format-detector.js';
 import { LayerDDeferredError, applyLayerD } from './layer-d-ast.js';
 import { applyLayerA } from './layer-a-apply.js';
+import { applyLayerAFuzzy } from './layer-a-fuzzy-apply.js';
 import { applyLayerB } from './layer-b-apply.js';
 import { applyLayerC } from './layer-c-apply.js';
 import { MarkerParseError, parseMarkers, } from './marker-parser.js';
+import { appendEntry, snapshotForDispatch, } from './journal.js';
 /**
  * Parse `raw` into edits and apply each in order. Aggregate results,
  * preserving order. Never throws — parse failures surface as a single
@@ -39,6 +63,15 @@ import { MarkerParseError, parseMarkers, } from './marker-parser.js';
  */
 export async function dispatchEdit(raw, opts) {
     const family = resolveFamily(opts.modelTag);
+    // PUGI-79 — resolve the preferred-layer chain ONCE per dispatch.
+    // Caller supplied wins; otherwise the detector derives from modelTag.
+    // The chain is informational here (the parser still routes per
+    // envelope); a future fuzzy-ladder change can read it to influence
+    // retry ordering without revisiting the dispatcher's escalation
+    // contract.
+    const preferredChain = resolvePreferredChain(opts);
+    if (preferredChain)
+        opts.onPreferredLayer?.(preferredChain);
     let parsed;
     try {
         parsed = parseMarkers(raw, family);
@@ -52,6 +85,7 @@ export async function dispatchEdit(raw, opts) {
                 bytesWritten: 0,
                 reason: 'marker_parse_error',
                 detail: `${error.message}${error.atLine ? ` (line ${error.atLine})` : ''} — modelHint=${error.modelHint}`,
+                ...(preferredChain ? { expectedLayer: preferredChain.primary } : {}),
             };
             opts.onResult?.(result);
             return [result];
@@ -65,16 +99,286 @@ export async function dispatchEdit(raw, opts) {
         // render "no edits proposed".
         return [];
     }
+    // β1b Pl8 — transactional path. When enabled, snapshot every target
+    // file BEFORE the first applicator runs so we can roll back if a
+    // later edit fails. Snapshot also drives the journal entry so a
+    // post-crash recovery can replay rollback in a fresh process.
+    //
+    // The journal write itself is best-effort: a disk-full / EACCES
+    // failure must NOT block the dispatch. The in-memory snapshot
+    // still carries every pre-existing file's content, so single-
+    // process rollback degrades cleanly. The operator sees the
+    // journal-failed warning via the session events mirror (caller's
+    // responsibility to emit).
+    let snapshot = null;
+    let preContent = null;
+    if (opts.transactional && !opts.dryRun) {
+        const targets = Array.from(new Set(parsed.map((e) => editFile(e))));
+        snapshot = snapshotForDispatch(opts.transactional.workspaceRoot, targets);
+        preContent = new Map();
+        for (const e of snapshot) {
+            if (!e.existed)
+                continue;
+            const abs = resolve(opts.transactional.workspaceRoot, e.path);
+            try {
+                preContent.set(e.path, readFileSync(abs));
+            }
+            catch {
+                /* file vanished between snapshot + read — treat as not-snapshotted */
+            }
+        }
+        appendEntry(opts.transactional.workspaceRoot, opts.transactional.sessionId, {
+            ts: Date.now(),
+            taskId: opts.transactional.taskId,
+            files: snapshot,
+        });
+    }
+    // Per-task shadow git checkpoint hook (backlog). Init the
+    // shadow once per dispatch, then commit after every successful
+    // edit. The init is best-effort — a missing `git` binary or a
+    // chmod failure surfaces through `onCheckpointError` but does not
+    // disable the dispatch.
+    let checkpointStep = opts.checkpoint?.stepStart && Number.isFinite(opts.checkpoint.stepStart)
+        ? Math.max(1, Math.floor(opts.checkpoint.stepStart))
+        : 1;
+    let checkpointEnabled = false;
+    if (opts.checkpoint && !opts.dryRun) {
+        try {
+            initShadowRepo(opts.cwd, opts.checkpoint.taskId);
+            checkpointEnabled = true;
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error(String(error));
+            opts.checkpoint.onCheckpointError?.(err, '');
+        }
+    }
+    const expectedLayer = preferredChain?.primary;
     const out = [];
+    let crashError = null;
     for (const edit of parsed) {
         const intent = makeIntent(edit);
         opts.onIntent?.(intent);
-        const result = await applyOne(edit, opts);
+        let result;
+        try {
+            result = await applyOne(edit, opts);
+        }
+        catch (error) {
+            // applyOne does not throw today (errors are returned as
+            // `ok: false`), but a future applicator that does throw —
+            // or a budget-kill that arrives mid-write — needs deterministic
+            // rollback. Catch + record + break so the rollback below runs.
+            crashError = error;
+            const msg = error instanceof Error ? error.message : String(error);
+            result = {
+                layer: 'layer-a',
+                file: editFile(edit),
+                ok: false,
+                bytesWritten: 0,
+                reason: 'apply_error',
+                detail: `dispatch threw: ${msg}`,
+            };
+        }
+        if (expectedLayer !== undefined) {
+            // PUGI-79: stamp the expected layer on every result so
+            // observability surfaces can compute drift (expected vs actual)
+            // per family. The actual `layer` field is unchanged — the
+            // hint is informational, not a routing override.
+            result = { ...result, expectedLayer };
+        }
         out.push(result);
         opts.onResult?.(result);
+        if (result.ok && checkpointEnabled && opts.checkpoint && !opts.dryRun) {
+            // Best-effort shadow commit. Failures here MUST NOT block the
+            // dispatch — the operator already has the edit applied; the
+            // checkpoint is a customer-trust safety net, not a hard gate.
+            try {
+                const absPath = result.absPath ?? resolve(opts.cwd, result.file);
+                const message = formatCheckpointMessage({
+                    taskId: opts.checkpoint.taskId,
+                    step: checkpointStep,
+                    toolName: result.layer,
+                    cwd: opts.cwd,
+                    absPath,
+                });
+                commitCheckpoint(opts.cwd, opts.checkpoint.taskId, message);
+            }
+            catch (error) {
+                const err = error instanceof Error ? error : new Error(String(error));
+                // Disable the shadow hook for the rest of this dispatch if
+                // the git binary is unavailable — repeated probes burn CPU
+                // and add no signal beyond the first failure.
+                if (err instanceof ShadowGitUnavailableError) {
+                    checkpointEnabled = false;
+                }
+                opts.checkpoint.onCheckpointError?.(err, result.file);
+            }
+            checkpointStep += 1;
+        }
+        if (!result.ok && opts.transactional && snapshot && preContent) {
+            // Rollback every snapshotted file then break out — partial
+            // success is unacceptable in transactional mode.
+            const rollback = rollbackDispatch(opts.transactional.workspaceRoot, snapshot, preContent);
+            if (!rollback.ok) {
+                // Surface the rollback failure as an additional synthetic
+                // result so the caller can render the operator-facing
+                // message without losing the original failure context.
+                const failure = {
+                    layer: 'layer-a',
+                    file: '',
+                    ok: false,
+                    bytesWritten: 0,
+                    reason: 'rollback_failed',
+                    detail: rollback.detail,
+                };
+                out.push(failure);
+                opts.onResult?.(failure);
+            }
+            if (crashError) {
+                // Re-throw post-rollback so the caller learns the dispatch
+                // crashed (vs returned ok: false). Rollback already completed
+                // so the workspace is consistent.
+                throw crashError;
+            }
+            break;
+        }
     }
     return out;
 }
+/**
+ * Workspace-relative path for a parsed edit, regardless of layer.
+ * Hoisted because the snapshot + intent both need the same answer.
+ */
+function editFile(edit) {
+    switch (edit.kind) {
+        case 'layer-a':
+        case 'layer-b':
+        case 'layer-c':
+        case 'layer-d':
+            return edit.edit.file;
+    }
+}
+/**
+ * Roll the workspace back to the pre-dispatch state captured in
+ * `snapshot`. Mirrors `tools/apply-patch.ts::rollbackFiles`:
+ *
+ *  - existed-before + git-tracked → `git restore -- <file>` (cheap
+ *    + atomic against the index).
+ *  - existed-before + untracked  → restore from the in-memory
+ *    preContent buffer (sha256_before validates the snapshot still
+ *    matches what we hold; if not we punt with `partial_rollback`).
+ *  - newly created               → fs.unlink (force).
+ *
+ * Best-effort: every per-file failure is collected into the detail
+ * string so the operator can manually fix the residual state. The
+ * dispatcher does not abort on the first error so an unrelated
+ * permission glitch on one file doesn't strand the others.
+ *
+ * Exported for the spec suite + a future operator command
+ * (`pugi resume --rollback <taskId>` ships in β2).
+ */
+export function rollbackDispatch(workspaceRoot, snapshot, preContent) {
+    if (snapshot.length === 0)
+        return { ok: true };
+    // Filter to workspace-internal paths only. A snapshot entry that
+    // escaped the workspace would already have aborted upstream; the
+    // filter is belt + braces against a future bug.
+    const safe = snapshot.filter((e) => {
+        const abs = resolve(workspaceRoot, e.path);
+        return abs === workspaceRoot || abs.startsWith(workspaceRoot + sep);
+    });
+    const failures = [];
+    const tracked = listTrackedFiles(workspaceRoot, safe.map((e) => e.path));
+    for (const entry of safe) {
+        const abs = resolve(workspaceRoot, entry.path);
+        if (!entry.existed) {
+            try {
+                // β1b r1: `recursive: true` so rollback handles the case where
+                // the dispatcher created an intermediate directory (e.g. a new
+                // `src/feature/` tree). Without it the unlink fails on a dir
+                // and the journal-replay leaves an orphan workspace path.
+                rmSync(abs, { force: true, recursive: true });
+            }
+            catch (error) {
+                failures.push(`${entry.path}: unlink failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            continue;
+        }
+        if (tracked.has(entry.path)) {
+            const result = spawnSync('git', ['restore', '--', entry.path], {
+                cwd: workspaceRoot,
+                encoding: 'utf8',
+            });
+            if (result.status !== 0) {
+                failures.push(`${entry.path}: git restore failed: ${(result.stderr ?? '').trim() || 'non-zero exit'}`);
+            }
+            continue;
+        }
+        // Untracked-but-existed: write back from memory.
+        const buf = preContent.get(entry.path);
+        if (!buf) {
+            failures.push(`${entry.path}: pre-content snapshot missing (partial rollback)`);
+            continue;
+        }
+        try {
+            writeFileSync(abs, buf);
+        }
+        catch (error) {
+            failures.push(`${entry.path}: rewrite failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (failures.length === 0)
+        return { ok: true };
+    return { ok: false, detail: failures.join('; ') };
+}
+/**
+ * Ask git which of `paths` are tracked. A single `git ls-files
+ * --error-unmatch` call would fail-fast on the first untracked path,
+ * so we use `git ls-files -- <paths...>` which lists only tracked
+ * matches. Returns a Set of workspace-relative paths.
+ *
+ * Pure-stdlib fallback when git is unavailable: returns an empty
+ * Set — every "existed" entry then routes to the untracked-restore
+ * path via the in-memory preContent map. Slower per file but still
+ * correct.
+ */
+function listTrackedFiles(cwd, paths) {
+    if (paths.length === 0)
+        return new Set();
+    const result = spawnSync('git', ['ls-files', '--', ...paths], {
+        cwd,
+        encoding: 'utf8',
+    });
+    if (result.status !== 0)
+        return new Set();
+    const out = new Set();
+    for (const line of (result.stdout ?? '').split('\n')) {
+        const trimmed = line.trim();
+        if (trimmed.length > 0)
+            out.add(trimmed);
+    }
+    return out;
+}
+/**
+ * PUGI-79 helper — resolve the preferred-layer chain for this
+ * dispatch. Caller-supplied `preferredLayer` wins; otherwise the
+ * detector derives from `modelTag`. Returns null when neither path
+ * yields a chain (no caller hint AND no model tag) — the dispatcher
+ * skips the observability hook in that case so we do not emit a
+ * misleading wildcard reading.
+ */
+function resolvePreferredChain(opts) {
+    if (opts.preferredLayer) {
+        // Defensive clone so caller mutations after dispatchEdit returns
+        // cannot poison subsequent calls that share the chain reference.
+        return {
+            primary: opts.preferredLayer.primary,
+            fallback: [...opts.preferredLayer.fallback],
+        };
+    }
+    if (opts.modelTag)
+        return detectEditFormat(opts.modelTag);
+    return null;
+}
 /**
  * Public helper exposed for the marker parser tests + CLI surface that
  * may want to know the resolved family without re-running the auto
@@ -125,6 +429,28 @@ async function applyOne(edit, opts) {
     switch (edit.kind) {
         case 'layer-a': {
             const r = await applyLayerA(edit.edit, applyOpts);
+            // Backlog — Layer A.5 escalation. The fuzzy ladder is the
+            // ONLY retry path: every other Layer A failure mode (ambiguous,
+            // file_missing, identical_replacement, security gate denial)
+            // bubbles up untouched because the ladder can't fix them.
+            // ambiguous in particular MUST stay loud — a fuzzy retry on top
+            // of an ambiguous strict match would just pick one of the
+            // strict candidates silently, defeating the disambiguation
+            // contract.
+            if (!r.ok && r.reason === 'no_match' && opts.fuzzy === true) {
+                const fuzzy = await applyLayerAFuzzy(edit.edit, {
+                    cwd: opts.cwd,
+                    dryRun: opts.dryRun,
+                    minRatio: opts.fuzzyMinRatio,
+                    lengthFlex: opts.fuzzyLengthFlex,
+                });
+                const base = toResult('layer-a-fuzzy', edit.edit.file, fuzzy);
+                return {
+                    ...base,
+                    ...(fuzzy.fuzzyTier ? { fuzzyTier: fuzzy.fuzzyTier } : {}),
+                    ...(fuzzy.fuzzyScore !== undefined ? { fuzzyScore: fuzzy.fuzzyScore } : {}),
+                };
+            }
             return toResult('layer-a', edit.edit.file, r);
         }
         case 'layer-b': {

package/dist/core/edits/format-detector.js

@@ -0,0 +1,260 @@
+/**
+ * Edit-format auto-select (PUGI-79).
+ *
+ * The 4-layer diff dispatcher (Layer A single-block, B ordered batch,
+ * C sha256-gated rewrite, D AST-aware) is layer-agnostic at the wire
+ * — the model emits whichever marker family it was prompted with, and
+ * `dispatch.ts` routes per envelope. Empirically though, different
+ * model families have markedly different success rates per layer:
+ *
+ *   - Anthropic Claude family — native function-calling shape;
+ *     produces clean single-block Layer A edits with high recall
+ *     against `+++ NEW / --- OLD / ===` markers.
+ *   - Open-weight Qwen3 / Kimi / DeepSeek — historically stronger
+ *     with whole-file Layer C rewrites OR sha256-gated patches; the
+ *     conflict-marker (Gemini-style) Layer A surface has higher
+ *     ambiguity rates on these models.
+ *   - DeepSeek-coder family — anchors well on Layer C primary with
+ *     Layer A as fallback (their RLHF set leaned hard on patch-style
+ *     emit).
+ *   - Reasoning models (o-series, gpt-5) — handle Layer D AST-aware
+ *     operations when an LSP bridge is available; Layer C primary
+ *     otherwise.
+ *
+ * The existing `format-matrix.ts` keyed exact slugs only — fine for
+ * the canonical set but blind to vendor-prefixed slugs that come back
+ * from the Anvil gateway (e.g. `anthropic/claude-sonnet-4-20250514`,
+ * `qwen/qwen3-coder`, `deepseek/deepseek-chat-v3.1`). This detector
+ * layers ON TOP of the matrix:
+ *
+ *   1. exact-key match against `EDIT_FORMAT_MATRIX` — wins outright.
+ *   2. vendor-prefix strip → second exact-key probe (so
+ *      `anthropic/claude-sonnet-4-6` resolves the same as `claude-sonnet-4-6`).
+ *   3. family inference from the (possibly prefixed) slug — returns
+ *      the family-default chain (see `FAMILY_DEFAULTS`).
+ *   4. unknown — wildcard `*` from the matrix.
+ *
+ * The output is the same `EditFormatChain` shape the matrix already
+ * exposes so callers (dispatcher hint, persona prompt hint) consume a
+ * single contract.
+ *
+ * NOT a routing decision: the dispatcher's per-layer routing is still
+ * driven by what the model actually emits. The detector's output is a
+ * HINT — surfaced to the persona prompt so the model has the right
+ * marker template loaded, and surfaced to the dispatcher's fuzzy ladder
+ * / fallback ordering so an ambiguous response gets retried in an order
+ * that matches the model's empirical strengths.
+ *
+ * Spec: this is the PUGI-79 implementation; the issue ships the
+ * detector + dispatcher hint + persona hint together.
+ */
+import { EDIT_FORMAT_MATRIX, } from './format-matrix.js';
+/**
+ * Family-level default chains. These are deliberately CONSERVATIVE —
+ * each family's primary is the layer with the highest observed apply-
+ * rate across the 2026-05 dogfood corpus; fallbacks rank in observed
+ * success order. The exact-slug entries in `EDIT_FORMAT_MATRIX` can
+ * override per-model; family defaults are the floor.
+ *
+ * Anthropic:
+ *   The Anvil corpus shows Claude family hitting ~95% Layer A apply on
+ *   first try; Layer C is the rescue when the file is large enough
+ *   that the operator's region selection ambiguates. Matrix entries
+ *   for `claude-opus-4-7` + `claude-sonnet-4-6` override to Layer C
+ *   primary because the larger context windows let those models hold
+ *   the whole file comfortably.
+ *
+ * Open-weight (qwen / deepseek / kimi):
+ *   These ship whole-file rewrites more reliably than partial diffs —
+ *   the patch-style envelopes their fine-tune sets prefer match Layer
+ *   C semantics. Layer A is the fallback because they can still emit
+ *   sensible search/replace pairs when prompted explicitly.
+ *
+ * Reasoning (gpt-5 / o-series):
+ *   Layer C primary because the longer reasoning trace burns through
+ *   the partial-diff format's positional constraints. Layer D rides
+ *   the wire when an LSP is bridged; the matrix entries override per-
+ *   model when that's available (see `qwen3-coder-480b → D`).
+ *
+ * Unknown:
+ *   Defers to the wildcard chain from the matrix (Layer A primary).
+ */
+const FAMILY_DEFAULTS = {
+    anthropic: { primary: 'A', fallback: ['C', 'B'] },
+    openai: { primary: 'C', fallback: ['A', 'B'] },
+    gemini: { primary: 'A', fallback: ['C', 'B'] },
+    qwen: { primary: 'A', fallback: ['C', 'B'] },
+    deepseek: { primary: 'C', fallback: ['A', 'B'] },
+    kimi: { primary: 'C', fallback: ['A', 'B'] },
+    unknown: { primary: 'A', fallback: ['B', 'C'] },
+};
+/**
+ * Detect the model family from a slug. Handles vendor-prefixed forms
+ * (`<vendor>/<model>` and `<provider>:<model>`) plus bare-name forms.
+ * Case-insensitive on the family name; case-preserving on the rest.
+ *
+ * Order matters: vendor prefix wins when present (the gateway is
+ * authoritative about which family routed). Otherwise the bare slug
+ * gets prefix-matched against well-known family stems. Unknown slugs
+ * surface as `unknown` — the caller falls back to the matrix wildcard.
+ */
+export function detectModelFamily(modelSlug) {
+    if (!modelSlug)
+        return 'unknown';
+    const raw = modelSlug.trim();
+    if (raw.length === 0)
+        return 'unknown';
+    const lower = raw.toLowerCase();
+    // Vendor-prefix form: `<vendor>/<model>`. The vendor wins outright
+    // because the gateway is authoritative — `anthropic/<anything>`
+    // routes Claude family regardless of the suffix.
+    const slashIdx = lower.indexOf('/');
+    if (slashIdx > 0) {
+        const vendor = lower.slice(0, slashIdx);
+        switch (vendor) {
+            case 'anthropic':
+                return 'anthropic';
+            case 'openai':
+                return 'openai';
+            case 'google':
+            case 'gemini':
+            case 'xai':
+                return 'gemini';
+            case 'qwen':
+            case 'alibaba':
+                return 'qwen';
+            case 'deepseek':
+                return 'deepseek';
+            case 'moonshot':
+            case 'kimi':
+                return 'kimi';
+            default:
+                // Unknown vendor — fall through to bare-name detection on the
+                // suffix. Some gateways (OpenRouter style) put the family
+                // name AFTER the vendor (e.g. `together/qwen-coder`), so the
+                // suffix still carries signal.
+                return detectFamilyFromBareName(lower.slice(slashIdx + 1));
+        }
+    }
+    // Provider-prefix form: `ollama:<model>` (engine-VM local runtime).
+    // The prefix is informational; strip and continue.
+    const colonIdx = lower.indexOf(':');
+    if (colonIdx > 0) {
+        const prefix = lower.slice(0, colonIdx);
+        if (prefix === 'ollama' || prefix === 'lmstudio' || prefix === 'llama-cpp') {
+            return detectFamilyFromBareName(lower.slice(colonIdx + 1));
+        }
+    }
+    return detectFamilyFromBareName(lower);
+}
+/**
+ * Bare-name detector. Lower-case input. Prefix-match against family
+ * stems; longest match wins so `claude-opus-4-7` doesn't accidentally
+ * route through the generic `c*` lane.
+ */
+function detectFamilyFromBareName(name) {
+    if (name.startsWith('claude'))
+        return 'anthropic';
+    if (name.startsWith('gpt') || name.startsWith('o1') || name.startsWith('o3') || name.startsWith('o4')) {
+        return 'openai';
+    }
+    if (name.startsWith('gemini') || name.startsWith('grok'))
+        return 'gemini';
+    if (name.startsWith('qwen'))
+        return 'qwen';
+    if (name.startsWith('deepseek'))
+        return 'deepseek';
+    if (name.startsWith('kimi') || name.startsWith('moonshot'))
+        return 'kimi';
+    return 'unknown';
+}
+/**
+ * Family-default chain. Exported for callers that want the family-
+ * level recommendation without running the full detector pipeline
+ * (e.g. observability surfaces that already resolved the family).
+ */
+export function familyDefaultChain(family) {
+    // Defensive clone: the FAMILY_DEFAULTS table is readonly conceptually
+    // but the EditFormatChain type allows fallback array mutation. Clone
+    // so callers cannot accidentally mutate the table.
+    const base = FAMILY_DEFAULTS[family];
+    return { primary: base.primary, fallback: [...base.fallback] };
+}
+/**
+ * Resolve the preferred edit-format chain for a model slug.
+ *
+ * Resolution order:
+ *   1. Exact slug match in EDIT_FORMAT_MATRIX — overrides everything.
+ *      This lets per-model tuning (e.g. `qwen3-coder-480b → D`) win
+ *      over the family default.
+ *   2. Vendor-prefix strip + exact match — so `anthropic/claude-...`
+ *      resolves to the bare `claude-...` entry when present.
+ *   3. Family inference — `FAMILY_DEFAULTS[detectModelFamily(slug)]`.
+ *   4. Wildcard fallback — `EDIT_FORMAT_MATRIX['*']`.
+ *
+ * The returned chain is always a fresh object so caller mutations
+ * cannot leak back into the matrix.
+ */
+export function detectEditFormat(modelSlug) {
+    const fallbackWildcard = EDIT_FORMAT_MATRIX['*'] ?? { primary: 'A', fallback: [] };
+    if (!modelSlug || modelSlug.trim().length === 0) {
+        return { primary: fallbackWildcard.primary, fallback: [...fallbackWildcard.fallback] };
+    }
+    const raw = modelSlug.trim();
+    // Step 1 — exact match wins.
+    const exact = EDIT_FORMAT_MATRIX[raw];
+    if (exact)
+        return { primary: exact.primary, fallback: [...exact.fallback] };
+    // Step 2 — vendor-prefix strip (e.g. `anthropic/claude-sonnet-4-6`).
+    const slashIdx = raw.indexOf('/');
+    if (slashIdx > 0) {
+        const suffix = raw.slice(slashIdx + 1);
+        const stripped = EDIT_FORMAT_MATRIX[suffix];
+        if (stripped)
+            return { primary: stripped.primary, fallback: [...stripped.fallback] };
+    }
+    // Step 3 — family inference.
+    const family = detectModelFamily(raw);
+    if (family !== 'unknown')
+        return familyDefaultChain(family);
+    // Step 4 — wildcard.
+    return { primary: fallbackWildcard.primary, fallback: [...fallbackWildcard.fallback] };
+}
+/**
+ * Render a one-line marker-format hint for the persona prompt. The
+ * dispatcher already accepts every marker family (anthropic / gemini /
+ * openai), so the hint is preference, not gating — surface the
+ * preferred template + alternative so the model knows which envelope
+ * has the highest apply-rate for its family.
+ *
+ * Returns `null` when the slug is unknown / unset; the caller drops
+ * the hint module on null so the prompt is not polluted with empty
+ * sections.
+ */
+export function renderEditFormatHint(modelSlug) {
+    if (!modelSlug || modelSlug.trim().length === 0)
+        return null;
+    const family = detectModelFamily(modelSlug);
+    if (family === 'unknown')
+        return null;
+    const chain = detectEditFormat(modelSlug);
+    const markerStyle = FAMILY_MARKER_TEMPLATE[family];
+    return `# Edit-format hint (auto-selected for ${family})
+Preferred layer: Layer ${chain.primary}${chain.fallback.length > 0 ? ` (fallback: ${chain.fallback.map((l) => `Layer ${l}`).join(' -> ')})` : ''}.
+Marker template: ${markerStyle}
+The dispatcher accepts any marker family; this hint optimises apply-rate for the resolved model.`;
+}
+/**
+ * Marker template literal per family. Mirrors the three envelopes the
+ * marker-parser accepts; used by `renderEditFormatHint` so the model
+ * sees a concrete shape next to the layer recommendation.
+ */
+const FAMILY_MARKER_TEMPLATE = {
+    anthropic: '+++ NEW <file> / <new contents> / --- OLD <file> / <old contents> / ===',
+    openai: '@@@ REWRITE <file> sha256=<hex> / <full new contents> / @@@ END',
+    gemini: '<<<<<<< SEARCH <file> / <old> / ======= / <new> / >>>>>>> REPLACE',
+    qwen: '<<<<<<< SEARCH <file> / <old> / ======= / <new> / >>>>>>> REPLACE',
+    deepseek: '@@@ REWRITE <file> sha256=<hex> / <full new contents> / @@@ END',
+    kimi: '@@@ REWRITE <file> sha256=<hex> / <full new contents> / @@@ END',
+};
+//# sourceMappingURL=format-detector.js.map