@skein-code/cli 0.3.16 → 0.3.18

package/README.md

@@ -45,10 +45,12 @@ inspectable index for code retrieval and no retrieval service dependency.
   enforcement, changed-file telemetry, and persisted tool results.
 - **Repository reuse guard:** the first substantive implementation addition gets
   a warning-only, content-free receipt of current helper candidates and read
-  evidence. After a successful TS/JS write, Skein also compares newly added or
+  evidence. After a successful TS/JS write, Skein compares newly added or
   significantly expanded functions with the pre-write index generation using
-  normalized fingerprints. Docs, config, fixtures, generated files, deletions,
-  small functions, and ordinary local edits stay quiet.
+  normalized fingerprints. Calibrated Type-1/2 matches block completion until
+  reuse, removal, or exact audited suppression; Type-3 remains warning-only.
+  Docs, config, fixtures, generated files, deletions, small functions, and
+  ordinary local edits stay quiet.
 - **Bounded tool context:** large tool results cannot crowd the task out of the
   model window. Skein keeps a token-budgeted head/tail receipt and, when the
   producer captured the complete result, retains a redacted session-scoped

package/dist/cli.js

@@ -220,7 +220,7 @@ function isSqliteBusy(error) {
 // package.json
 var package_default = {
   name: "@skein-code/cli",
-  version: "0.3.16",
+  version: "0.3.18",
   description: "A context-first, model-agnostic coding agent with an auditable terminal workspace.",
   type: "module",
   license: "MIT",
@@ -236,6 +236,12 @@ var package_default = {
   },
   skein: {
     releaseNotes: [
+      "Large MCP catalogs now disclose at most eight request-relevant schemas per run while preserving network permissions",
+      "Token Ledger receipts report deferred progressive schemas and selected definitions remain stable across tool turns",
+      "A deterministic Token Economy replay benchmark guards evidence, output-firewall, and no-progress invariants",
+      "Calibrated Type-1/2 duplication matches now block completion until reuse or exact audited suppression",
+      "Type-3 duplication remains warning-only and Type-4 semantic equivalence remains explicitly unsupported",
+      "Duplication benchmark fixtures report deterministic recall, precision, false-positive rate, and latency",
       "Duplication warnings now aggregate into the single completion receipt without changing verified status",
       "Exact match ids support bounded, reason-coded suppression with audit and credential/code-block safeguards",
       "Duplication audit tools are disclosed only when active warnings exist and repaired paths clear stale matches",
@@ -274,6 +280,8 @@ var package_default = {
     "pretest:pty": "npm run build",
     "test:pty": "sh test/pty/run-visual.sh",
     "benchmark:context": "tsx scripts/benchmark-local-index.ts",
+    "benchmark:duplication": "tsx scripts/benchmark-duplication.ts",
+    "benchmark:token-economy": "tsx scripts/benchmark-token-economy.ts",
     "verify:package": "node scripts/verify-package.mjs",
     "release:verify": "npm run check && npm run verify:package --",
     typecheck: "tsc --noEmit",
@@ -5674,7 +5682,7 @@ var reuseReceiptSchema = z5.object({
   indexGeneration: z5.string().optional(),
   changeSequence: z5.number().int().nonnegative(),
   status: z5.enum(["warning", "skipped", "unresolved"]),
-  warningOnly: z5.literal(true)
+  warningOnly: z5.boolean()
 }).strict();
 var duplicationMatchSchema = z5.object({
   matchId: z5.string().regex(/^[a-f0-9]{24}$/u).optional(),
@@ -5689,7 +5697,8 @@ var duplicationAuditSchema = z5.object({
   baselineGeneration: z5.string().min(1),
   changeSequence: z5.number().int().nonnegative(),
   status: z5.enum(["clear", "warning", "unresolved"]),
-  warningOnly: z5.literal(true),
+  warningOnly: z5.boolean(),
+  enforcement: z5.enum(["warning", "blocking"]).optional(),
   checkedFunctions: z5.number().int().nonnegative(),
   skippedSmallFunctions: z5.number().int().nonnegative(),
   matches: z5.array(duplicationMatchSchema).max(8),
@@ -5759,7 +5768,7 @@ var lastRunSchema = z5.object({
   detail: z5.string(),
   mutationTracking: z5.enum(["complete", "unknown"]).optional(),
   duplication: z5.object({
-    enforcement: z5.literal("warning"),
+    enforcement: z5.enum(["warning", "blocking"]),
     status: z5.enum(["clear", "warning", "unresolved", "suppressed"]),
     warningCount: z5.number().int().nonnegative(),
     unresolvedCount: z5.number().int().nonnegative(),
@@ -8397,6 +8406,16 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
       ...duplication ? { duplication } : {}
     };
   }
+  if (duplication?.enforcement === "blocking" && duplication.warningCount > 0) {
+    return {
+      status: "unverified",
+      changedFiles: files,
+      checks: [],
+      detail: "A high-confidence duplicate implementation requires reuse, extension, or an exact audited suppression before completion.",
+      ...acceptance ? { acceptance: acceptanceForCompletion(acceptance, "unverified") } : {},
+      duplication
+    };
+  }
   const latestByCommand = /* @__PURE__ */ new Map();
   for (const item of evidence) {
     if (item.changeSequence === currentChangeSequence) {
@@ -8445,6 +8464,13 @@ function buildRunCompletion(changedFiles, evidence, currentChangeSequence, mutat
   };
 }
 function completionRecoveryDirective(completion) {
+  if (completion.duplication?.enforcement === "blocking" && completion.duplication.warningCount > 0) {
+    const matches = completion.duplication.matches.filter((match) => match.kind === "type-1-or-2").map((match) => `- ${match.matchId}: ${match.changedPath} ${match.changedSymbol} duplicates ${match.candidatePath} ${match.candidateSymbol}`).join("\n");
+    return `<runtime-completion-gate status="duplication_blocking" authorization="none">
+High-confidence Type-1/2 duplication was detected. Reuse or extend the existing implementation, remove the duplicate, or call the read-only duplication_audit tool to suppress an exact match with an audited reason. Suppression never waives verification, safety, accessibility, error handling, concurrency, or correctness requirements.
+${matches || "- Active duplicate match details are unavailable."}
+</runtime-completion-gate>`;
+  }
   if (completion.acceptance && acceptanceUnresolved(completion.acceptance)) {
     const unresolved2 = completion.acceptance.unresolved.map((item) => `- [${item.status}] ${item.id}: ${item.description}`).join("\n");
     const failed = completion.checks.filter((check) => !check.ok).map((check) => `- ${check.command} (tool call ${check.toolCallId})`).join("\n");
@@ -8885,8 +8911,9 @@ function buildDuplicationCompletion(audit, suppressions = [], runStartedAt) {
   const suppressedIds = new Set(suppressions.filter((item) => activeIds.has(item.matchId)).map((item) => item.matchId));
   const warnings = [...active.values()].filter((match) => !suppressedIds.has(match.matchId));
   const suppressedCount = active.size - warnings.length;
+  const enforcement = warnings.some((match) => match.kind === "type-1-or-2") ? "blocking" : "warning";
   return {
-    enforcement: "warning",
+    enforcement,
     status: unresolved2.size ? "unresolved" : warnings.length ? "warning" : suppressedCount ? "suppressed" : "clear",
     warningCount: warnings.length,
     unresolvedCount: unresolved2.size,
@@ -9807,9 +9834,13 @@ function roundScore(value) {
 // src/agent/duplication-audit.ts
 import { createHash as createHash14 } from "node:crypto";
 import { readFile as readFile15 } from "node:fs/promises";
-var NEAR_CLONE_THRESHOLD = 0.55;
+var DEFAULT_NEAR_CLONE_THRESHOLD = 0.55;
 var MAX_MATCHES = 8;
 async function auditChangedFunctions(input2) {
+  const nearCloneThreshold = input2.nearCloneThreshold ?? DEFAULT_NEAR_CLONE_THRESHOLD;
+  if (!Number.isFinite(nearCloneThreshold) || nearCloneThreshold < 0 || nearCloneThreshold > 1) {
+    throw new Error("nearCloneThreshold must be a finite number between 0 and 1.");
+  }
   const auditableFiles = input2.changedFiles.filter(supportsFunctionFingerprintPath);
   if (!auditableFiles.length) return void 0;
   const reports = [];
@@ -9836,7 +9867,7 @@ async function auditChangedFunctions(input2) {
   }
   if (!input2.baseline) return unresolved(input2.changeSequence);
   const lookup = createBaselineLookup(input2.baseline.functions);
-  const previousByCurrent = matchCurrentFunctions(input2.baseline.functions, currentFunctions);
+  const previousByCurrent = matchCurrentFunctions(input2.baseline.functions, currentFunctions, nearCloneThreshold);
   const added = currentFunctions.flatMap((current) => {
     const previous = previousByCurrent.get(locationIdentity(current));
     const recheck = input2.recheckFunctions?.has(identity(current)) || previous !== void 0 && input2.recheckFunctions?.has(identity(previous));
@@ -9849,7 +9880,7 @@ async function auditChangedFunctions(input2) {
     for (const candidate of findCandidateFunctions(lookup, item)) {
       if (previous && locationIdentity(candidate) === locationIdentity(previous)) continue;
       const similarity = fingerprintSimilarity(item, candidate);
-      if (similarity < NEAR_CLONE_THRESHOLD || best && best.similarity >= similarity) continue;
+      if (similarity < nearCloneThreshold || best && best.similarity >= similarity) continue;
       best = { candidate, similarity };
     }
     if (!best) continue;
@@ -9865,11 +9896,13 @@ async function auditChangedFunctions(input2) {
   }
   matches.sort((left, right) => right.similarity - left.similarity || left.changedPath.localeCompare(right.changedPath));
   const bounded = matches.slice(0, MAX_MATCHES);
+  const enforcement = bounded.some((match) => match.kind === "type-1-or-2") ? "blocking" : "warning";
   return {
     baselineGeneration: input2.baseline.generation,
     changeSequence: input2.changeSequence,
     status: bounded.length ? "warning" : "clear",
-    warningOnly: true,
+    warningOnly: enforcement === "warning",
+    enforcement,
     checkedFunctions: added.length,
     skippedSmallFunctions,
     matches: bounded,
@@ -9882,6 +9915,7 @@ function clear(baselineGeneration, changeSequence, skippedSmallFunctions) {
     changeSequence,
     status: "clear",
     warningOnly: true,
+    enforcement: "warning",
     checkedFunctions: 0,
     skippedSmallFunctions,
     matches: [],
@@ -9931,15 +9965,15 @@ function findCandidateFunctions(lookup, current) {
   }
   return [...candidates.values()];
 }
-function matchCurrentFunctions(baseline, current) {
+function matchCurrentFunctions(baseline, current, nearCloneThreshold) {
   const matches = /* @__PURE__ */ new Map();
   const available = new Map(baseline.map((item) => [locationIdentity(item), item]));
-  assignMatches(current, matches, available, (item) => [...available.values()].filter((candidate) => identity(candidate) === identity(item) && linesOverlap(candidate, item)), false);
-  assignMatches(current, matches, available, (item) => [...available.values()].filter((candidate) => identity(candidate) === identity(item)), true);
-  assignMatches(current, matches, available, (item) => [...available.values()].filter((candidate) => candidate.path === item.path && linesOverlap(candidate, item)), true);
+  assignMatches(current, matches, available, (item) => [...available.values()].filter((candidate) => identity(candidate) === identity(item) && linesOverlap(candidate, item)), false, nearCloneThreshold);
+  assignMatches(current, matches, available, (item) => [...available.values()].filter((candidate) => identity(candidate) === identity(item)), true, nearCloneThreshold);
+  assignMatches(current, matches, available, (item) => [...available.values()].filter((candidate) => candidate.path === item.path && linesOverlap(candidate, item)), true, nearCloneThreshold);
   return matches;
 }
-function assignMatches(current, matches, available, candidatesFor, requireSimilarity) {
+function assignMatches(current, matches, available, candidatesFor, requireSimilarity, nearCloneThreshold) {
   for (const item of current) {
     const currentId = locationIdentity(item);
     if (matches.has(currentId)) continue;
@@ -9948,7 +9982,7 @@ function assignMatches(current, matches, available, candidatesFor, requireSimila
       const similarity = fingerprintSimilarity(candidate, item);
       if (!best || similarity > best.similarity) best = { candidate, similarity };
     }
-    if (!best || requireSimilarity && best.similarity < NEAR_CLONE_THRESHOLD) continue;
+    if (!best || requireSimilarity && best.similarity < nearCloneThreshold) continue;
     matches.set(currentId, best.candidate);
     available.delete(locationIdentity(best.candidate));
   }
@@ -9962,6 +9996,7 @@ function unresolved(changeSequence, generation = "unavailable") {
     changeSequence,
     status: "unresolved",
     warningOnly: true,
+    enforcement: "warning",
     checkedFunctions: 0,
     skippedSmallFunctions: 0,
     matches: [],
@@ -10054,6 +10089,7 @@ var AgentRunner = class {
     };
     const changeSequenceAtStart = this.changeSequence;
     const runStartedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const loadedProgressiveTools = /* @__PURE__ */ new Set();
     const runChangedFiles = /* @__PURE__ */ new Set();
     const verificationEvidence = [];
     const toolRecovery = new ToolRecoveryController();
@@ -10217,7 +10253,9 @@ var AgentRunner = class {
           activeDuplicationMatchIds(
             this.session.audit ?? [],
             this.session.duplicationSuppressions ?? []
-          ).size > 0
+          ).size > 0,
+          request,
+          loadedProgressiveTools
         );
         const estimatedInputTokens = estimateMessages2(messages) + estimateToolDefinitions(visibleTools);
         if (availableTokens <= 0 || estimatedInputTokens >= availableTokens) {
@@ -10282,7 +10320,10 @@ var AgentRunner = class {
           },
           inputSource: actualInputTokens === void 0 ? "estimated" : "actual",
           outputSource: actualOutputTokens === void 0 ? "estimated" : "actual",
-          tools: { loaded: visibleTools.map((tool) => tool.name), deferredCount: 0 },
+          tools: {
+            loaded: visibleTools.map((tool) => tool.name),
+            deferredCount: Math.max(0, this.tools.definitions().filter((tool) => tool.progressive).length - visibleTools.filter((tool) => tool.progressive).length)
+          },
           retrieval: tokenRetrievalReceipt(packed)
         });
         await emit({
@@ -10588,7 +10629,8 @@ Tool succeeded, but afterTool hook failed: ${afterHookError.message}` : executio
 
 ${completeContent}`;
       if (duplicationAudit?.status === "warning" || duplicationAudit?.status === "unresolved") {
-        completeContent = `Duplication audit (warning-only): ${duplicationAudit.rationale}
+        const enforcement = duplicationAudit.enforcement === "blocking" ? "completion-blocking Type-1/2" : "warning-only";
+        completeContent = `Duplication audit (${enforcement}): ${duplicationAudit.rationale}
 
 ${completeContent}`;
       }
@@ -11047,10 +11089,25 @@ ${content}` : content,
     ...failure ? { metadata: { failure } } : {}
   };
 }
-function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable, duplicationAvailable) {
-  return tools.definitions().filter(
+function visibleToolDefinitions(tools, askMode, contractEnabled, artifactReadAvailable, duplicationAvailable, request, loadedProgressiveTools) {
+  const eligible = tools.definitions().filter(
     (tool) => (!askMode || tool.category === "read") && (contractEnabled || tool.name !== "task_contract") && (artifactReadAvailable || tool.name !== "read_tool_artifact") && (duplicationAvailable || tool.name !== "duplication_audit")
   );
+  const progressive = eligible.filter((tool) => tool.progressive);
+  if (progressive.length <= 8) return eligible;
+  for (const tool of selectProgressiveTools(progressive, request, 8)) {
+    loadedProgressiveTools.add(tool.name);
+  }
+  return eligible.filter((tool) => !tool.progressive || loadedProgressiveTools.has(tool.name));
+}
+function selectProgressiveTools(tools, request, limit) {
+  const terms = new Set(request.toLocaleLowerCase().match(/[\p{L}\p{N}_-]{2,}/gu) ?? []);
+  return tools.map((tool) => {
+    const searchable = `${tool.name.replaceAll("_", " ")} ${tool.description}`.toLocaleLowerCase();
+    let score = 0;
+    for (const term of terms) if (searchable.includes(term)) score += term.length;
+    return { tool, score };
+  }).sort((left, right) => right.score - left.score || left.tool.name.localeCompare(right.tool.name)).slice(0, limit).map(({ tool }) => tool);
 }
 function formatToolError(error) {
   const normalized = toError(error);
@@ -18963,7 +19020,8 @@ function createMcpToolAdapter(options) {
       // MCP servers are an external trust boundary. Read-only annotations are
       // hints from that server and must not lower the local permission level.
       category: "network",
-      inputSchema: inputSchema13
+      inputSchema: inputSchema13,
+      progressive: true
     },
     permissionCategories: () => ["network"],
     async execute(arguments_, context) {