@te-river/opencode-team-mode 1.6.0 → 1.6.1

package/dist/host/v2-guard.js

@@ -0,0 +1,199 @@
+/**
+ * The v2 permission-guard layer (#7).
+ *
+ * v1 enforced two things in code that v2 can enforce one level lower — at the
+ * host's own `permission.hook("evaluate")`, whose `effect` is mutable and whose
+ * `resources` carry the concrete command line or URL (live-probed: `action`
+ * arrives as shell / read / edit / external_directory with the real payload).
+ *
+ *  1. THE EGRESS RED LINE ON THE HOST'S OWN WEB TOOL.  v1 never had to think
+ *     about this because native `webfetch` was denied in the whitelist; on v2 a
+ *     Build-class agent has it, and it has no notion of `169.254.169.254` — the
+ *     cloud metadata endpoint whose response is temporary credentials.  The
+ *     domain allowlist answers "is this host on the list"; only `checkWebUrl`
+ *     asks the address question, and that question has to be asked of the native
+ *     path too or the port becomes a way around it.
+ *  2. R6's per-command precision.  v2's closest thing to v1's pattern-object
+ *     escalation is currently "ask on every shell command", which is honest but
+ *     coarse.  The classifier can restore the per-command shape — but only if
+ *     the host actually calls `evaluate` for shell, which has not been proven on
+ *     a live 2.0.16 yet.  So the strictening hook is installed either way and
+ *     COUNTS what it sees, while the config-level coarse ask stays in force
+ *     until `TM_R6_FINE_ASK=on` says otherwise.  A guard that fails open because
+ *     we trusted an unproven hook is the opposite of this product.
+ *
+ * The hook only ever makes a decision STRICTER (allow -> ask, anything -> deny on
+ * a red line).  It never loosens what the host or the user's own rules chose.
+ */
+import { R2_DANGER_BASH_ASK_PATTERNS, R6_ENV_BASH_ASK_PATTERNS, commandMatchesAnyAskPattern, isEnvFilePath, } from "../envprotect.js";
+import { classifyHost } from "../tm/egress.js";
+const rank = { allow: 0, ask: 1, deny: 2 };
+/** A resource may be a full URL or a bare host; both have to be answered, since
+ *  the host's own tool is free to hand us either shape. */
+function hostOf(text) {
+    const s = text.trim();
+    if (!s)
+        return null;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(s)) {
+        try {
+            return new URL(s).hostname;
+        }
+        catch {
+            return null;
+        }
+    }
+    // A path-shaped resource is not a host.
+    if (s.startsWith("/") || s.includes(" "))
+        return null;
+    return s;
+}
+/** The address question, asked of the host's native web path. */
+export function webGuard(resources) {
+    for (const raw of resources) {
+        const text = String(raw ?? "");
+        if (isEnvFilePath(text)) {
+            return { effect: "deny", why: "env-file URL", message: "R6 红线：这个 URL 指向环境文件（.env / shell rc 家族），不授权、不弹窗。" };
+        }
+        const host = hostOf(text);
+        if (!host)
+            continue;
+        const verdict = classifyHost(host);
+        if (verdict.level === "forbidden") {
+            return {
+                effect: "deny",
+                why: `egress:${verdict.via ?? "forbidden"}`,
+                message: `${host} 是元数据/链路本地/保留地址（${verdict.via ?? "特殊用途"}），拿它的响应等于把临时凭据读进上下文和轨迹。这条不可授权，配置里的 "*" 也不算授权。`,
+            };
+        }
+        if (verdict.level === "private") {
+            return {
+                effect: "ask",
+                why: `egress-private:${verdict.via ?? "private"}`,
+                message: `${host} 是私网/回环地址（${verdict.via ?? "私有"}）。v1 在这里要求用户逐次批准；v2 的插件弹不出对话框，所以交给宿主自己的确认——不要重复调用绕过它。`,
+            };
+        }
+    }
+    return null;
+}
+/** R6's env face and R2's danger face, per command line. */
+export function shellGuard(command, mode) {
+    const text = String(command ?? "").trim();
+    if (!text || mode === "off")
+        return null;
+    if (commandMatchesAnyAskPattern(text, R2_DANGER_BASH_ASK_PATTERNS)) {
+        return { effect: "ask", why: "r2-danger", message: "这条命令落在 R2 危险面上（删除/推送/发布/杀进程一类），要人批准一次。" };
+    }
+    if (commandMatchesAnyAskPattern(text, R6_ENV_BASH_ASK_PATTERNS)) {
+        return { effect: "ask", why: "r6-env", message: "这条命令读环境变量（R6），要人批准一次。" };
+    }
+    return null;
+}
+/**
+ * Every sub-agent dispatch runs in the background.
+ *
+ * The user's standing instruction (2026-09-25). It is not a preference tweak: a
+ * foreground `subagent` call blocks the lead for the whole child run, which is
+ * the one thing the throughput mandate cannot survive — and on v2 background is
+ * a first-class host capability (`subagent {background:true}` returns
+ * immediately and the parent is notified when the child finishes), so nothing
+ * has to be opted into at the environment level the way v1 needed
+ * `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS`.
+ *
+ * `execute.before` takes a mutable `input` (docs say "inspect or REPLACE"; a
+ * live host confirmed the write lands), so this is the honest place to enforce
+ * it — a prompt rule thousands of tokens earlier is not the same thing.  An
+ * input that is not an object is left alone rather than invented.
+ */
+export async function applyV2BackgroundForce(ctx, opts = {}) {
+    const report = { seen: 0, forced: 0 };
+    const tool = ctx.tool;
+    if (!tool || typeof tool.hook !== "function")
+        return { registrations: [], report };
+    const registrations = [
+        await tool.hook("execute.before", (event) => {
+            if (String(event?.tool ?? "") !== "subagent")
+                return;
+            // #22: rewriting the input of a call that is not ours is the clearest kind
+            // of side effect — a user who chose a synchronous dispatch in build mode
+            // would have it taken away by a plugin installed for Team.
+            if (opts.scope && opts.scope.count(opts.scope.decide(event)) !== "ours")
+                return;
+            const input = event.input;
+            if (!input || typeof input !== "object" || Array.isArray(input))
+                return;
+            report.seen++;
+            if (input.background === true)
+                return;
+            input.background = true;
+            report.forced++;
+        }),
+    ];
+    return { registrations, report };
+}
+export async function applyV2PermissionGuards(ctx, opts) {
+    const report = { seen: 0, byAction: {}, strictened: 0, denied: 0, shellMatched: 0, foreignSkipped: 0 };
+    const permission = ctx.permission;
+    if (!permission || typeof permission.hook !== "function") {
+        return { registrations: [], report, installed: false };
+    }
+    const registrations = [
+        await permission.hook("evaluate", (event) => {
+            const action = String(event?.action ?? "");
+            const resources = (Array.isArray(event?.resources) ? event.resources : []).map(String);
+            report.seen++;
+            report.byAction[action] = (report.byAction[action] ?? 0) + 1;
+            // #22: the host evaluates permissions for every agent.  Tightening a rule a
+            // build/plan session is running under is a change to somebody else's mode,
+            // so inside Team only — and the count says how much of that floor is
+            // therefore NOT ours to enforce (see the note in the boot line).
+            if (opts.scope && opts.scope.count(opts.scope.decide(event)) !== "ours") {
+                report.foreignSkipped++;
+                return;
+            }
+            const decision = action === "webfetch" || action === "websearch"
+                ? webGuard(resources)
+                : action === "shell"
+                    ? shellGuard(resources[0], opts.envProtectMode)
+                    : null;
+            if (!decision)
+                return;
+            if (action === "shell")
+                report.shellMatched++;
+            // Only ever stricter.  A host that already decided to ask or deny keeps
+            // that decision — our classifier is a floor, not an override of the user.
+            if (rank[decision.effect] <= rank[event.effect ?? "allow"])
+                return;
+            event.effect = decision.effect;
+            if (decision.message)
+                event.message = decision.message;
+            if (decision.effect === "deny")
+                report.denied++;
+            else
+                report.strictened++;
+        }),
+    ];
+    return { registrations, report, installed: true };
+}
+/** Does the config still need the coarse `shell -> ask` escalation?  Only while
+ *  the fine path is switched off; with the classifier in charge, escalating every
+ *  command would mask it.
+ *  Was the coarse default until a live host proved the seam exists: a
+ * `--standalone` run of the v2 personality recorded
+ * `{action:"shell", resourceCount:1, hasUrl:false}` reaching `evaluate` for a real
+ * `git status --short` (2026-09-25), which is the observation this function was
+ * waiting for.  So the classifier is in charge by default and the escalation is
+ * the fallback again — `TM_R6_FINE_ASK=off` restores "every command asks", which is
+ * what a user should reach for if their host build turns out not to fire the hook.
+ * An absent hook still forces coarse: no seam, no per-command judgement.
+ */
+export function needsCoarseShellAsk(env, guardsInstalled) {
+    if (!guardsInstalled)
+        return true;
+    const v = String(env.TM_R6_FINE_ASK ?? "").trim();
+    // Only an EXPLICIT off falls back; an empty or unparseable value keeps the
+    // classifier, because "unset" is now the supported configuration.
+    if (/^(0|false|no|off)$/i.test(v))
+        return true;
+    return false;
+}
+//# sourceMappingURL=v2-guard.js.map

package/dist/host/v2-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-guard.js","sourceRoot":"","sources":["../../src/host/v2-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,2BAA2B,EAC3B,aAAa,GAEd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAW9C,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAW,CAAA;AAEnD;2DAC2D;AAC3D,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACrB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,wCAAwC;IACxC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,SAA4B;IACnD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QAC9B,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAA;QAC7G,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,UAAU,OAAO,CAAC,GAAG,IAAI,WAAW,EAAE;gBAC3C,OAAO,EAAE,GAAG,IAAI,mBAAmB,OAAO,CAAC,GAAG,IAAI,MAAM,+CAA+C;aACxG,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,SAAS,EAAE;gBACjD,OAAO,EAAE,GAAG,IAAI,aAAa,OAAO,CAAC,GAAG,IAAI,IAAI,uDAAuD;aACxG,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,OAA2B,EAAE,IAAoB;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,2BAA2B,CAAC,IAAI,EAAE,2BAA2B,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAA;IAC/F,CAAC;IACD,IAAI,2BAA2B,CAAC,IAAI,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAqBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAc,EACd,OAA8B,EAAE;IAEhC,MAAM,MAAM,GAA0B,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;IAClF,MAAM,aAAa,GAAG;QACpB,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1C,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,UAAU;gBAAE,OAAM;YACpD,2EAA2E;YAC3E,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM;gBAAE,OAAM;YAC/E,MAAM,KAAK,GAAG,KAAK,CAAC,KAA4C,CAAA;YAChE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAM;YACvE,MAAM,CAAC,IAAI,EAAE,CAAA;YACb,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAM;YACrC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAA;YACvB,MAAM,CAAC,MAAM,EAAE,CAAA;QACjB,CAAC,CAAC;KACH,CAAA;IACD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAA;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAc,EACd,IAA2D;IAE3D,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAA;IACnH,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAA;IACjC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACzD,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAA;YAC1C,MAAM,SAAS,GAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChG,MAAM,CAAC,IAAI,EAAE,CAAA;YACb,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;YAC5D,4EAA4E;YAC5E,2EAA2E;YAC3E,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACxE,MAAM,CAAC,cAAc,EAAE,CAAA;gBACvB,OAAM;YACR,CAAC;YAED,MAAM,QAAQ,GACZ,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,WAAW;gBAC7C,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACrB,CAAC,CAAC,MAAM,KAAK,OAAO;oBAClB,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC;oBAC/C,CAAC,CAAC,IAAI,CAAA;YACZ,IAAI,CAAC,QAAQ;gBAAE,OAAM;YAErB,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,CAAC,YAAY,EAAE,CAAA;YAC7C,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC;gBAAE,OAAM;YAClE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YAC9B,IAAI,QAAQ,CAAC,OAAO;gBAAE,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;YACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM,CAAC,MAAM,EAAE,CAAA;;gBAC1C,MAAM,CAAC,UAAU,EAAE,CAAA;QAC1B,CAAC,CAAC;KACH,CAAA;IAED,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAsB,EAAE,eAAwB;IAClF,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACjD,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9C,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/host/v2-offload.d.ts

@@ -0,0 +1,148 @@
+import type { V2Registration } from "./v2-types.js";
+import type { TeamScope } from "./v2-scope.js";
+import { detectContentType } from "../tm/preview.js";
+/**
+ * JIT context governance over the HOST's own tools.
+ *
+ * The whole product rests on one promise: an oversized tool result never enters
+ * the context window — it lands in the run store and the model gets an
+ * ≤80-token preview plus a handle.  That promise was true only inside our own
+ * `tm_*` tools, which is what made `tm_read`/`tm_grep`/`tm_bash` load-bearing
+ * rather than merely nicer.  The moment a role is allowed the native `read` or
+ * `shell` (which is the retirement plan for those three), an un-governed native
+ * result would put the promise back to zero for exactly the tools a user would
+ * most plausibly enable — and the promise would then depend on which tool the
+ * model happened to pick, which is not a guarantee at all.
+ *
+ * So the governance moves to the seam that does not care what the model chose.
+ * `tool.execute.after` hands us the finished result for EVERY tool (measured
+ * live: `{action:"shell"}` reaches `permission.evaluate`, and the same call
+ * reaches `execute.after` with `resultKeys: content / metadata / output`), and
+ * the host documents `result` as mutable.  One hook, both worlds.
+ *
+ * Design constraints this file is written under:
+ * - **It only ever shrinks what reaches the context, never what the tool did.**
+ *   The bytes on disk are the host's; a preview plus a handle replaces the text
+ *   part.  `metadata` and any non-text part (an image attachment) pass through
+ *   untouched — dropping a screenshot to save tokens would be a bad trade.
+ * - **It reuses the same threshold, preview builder, store and HMAC handles as
+ *   `tm_*`**, because a second implementation would drift, and the drift would
+ *   show up as "the same 40 KB was free through one tool and offloaded through
+ *   another".
+ * - **A native result is rendered as native-shaped text.** `tm_*` returns our own
+ *   structured object; overwriting a host tool's text part with `{offloaded:true,
+ *   ref:…}` would hand the model a shape it has no reason to understand.  The
+ *   sentence below says the same facts in prose the tm_* tools already train it
+ *   to act on: how much was saved, the handle, how to page it in.
+ * - Nothing here may throw into somebody's tool call: a governance failure
+ *   degrades to the host's verbatim result, and says so in the trajectory.
+ */
+/** Tools whose NATIVE output we govern.  Deliberately a closed list: the built-in
+ *  agent/patch/question results have shapes nobody has observed here, and rewriting
+ *  a shape you guessed at is content destruction, not governance.
+ *
+ *  `execute` is on the list for one specific reason, and it is the reason the
+ *  native browser can be governed at all: the Team's direct tool surface on v2 is
+ *  six tools (edit / execute / question / shell / subagent / write), so
+ *  `tools.browser.*` -- every snapshot, tab list and evaluate result -- reaches the
+ *  context window ONLY as the aggregate return of one Code Mode program.  There is
+ *  no other door, so governing `execute` IS "put JIT on the native browser". */
+export declare const NATIVE_GOVERNED_TOOLS: ReadonlySet<string>;
+/** Is this tool's output inside the governed surface?  The host's browser catalog is
+ *  45 tools sharing one namespace (`browser_*`, each registered with
+ *  `permission:"browser"`), and a snapshot from any of them is exactly the oversized
+ *  payload the offload promise is about — enumerating 45 names would only guarantee
+ *  that a host adding the 46th escapes us.  Unknown RESULT shapes are still left
+ *  untouched; that test is per payload, not per name. */
+export declare function isGovernedNative(tool: string): boolean;
+export interface V2OffloadReport {
+    seen: number;
+    /** every execute.after we resolved to a Team session, governed tool or not — the
+     *  denominator the coverage sentence is read against (#23: "most tool calls are
+     *  JIT-governed" has to be a number, not a feeling) */
+    ours: number;
+    /** ours, for a tool whose output we do not touch (unknown tool, or a name the
+     *  governed set has not been widened to) — counted rather than invisible */
+    unmatched: number;
+    considered: number;
+    offloaded: number;
+    /** addressing results (native browser snapshots) that stayed IN context, capped
+     *  rather than replaced by a handle — the tokens they cost are counted, and so is
+     *  the fact that we chose a usable `ref` over the smaller number */
+    capped: number;
+    /** report-shaped payloads (tables kept, prose dropped) — a third outcome, because
+     *  "offloaded" and "capped" answer different questions about what entered context */
+    reportCapped: number;
+    /** envelopes RECOGNISED, whether or not they needed rewriting — a counter that
+     *  moves only on a rewrite cannot tell "the channel is alive, nothing was big"
+     *  apart from "this host's format is not the one we match" (which is exactly how
+     *  the v1 `<task id=` matcher read as zero on v2). */
+    envelopes: number;
+    degraded: number;
+    tokensSaved: number;
+    byTool: Record<string, {
+        seen: number;
+        offloaded: number;
+    }>;
+}
+interface OffloadDeps {
+    /** the shared tm pipeline instance — one store, one step counter, one threshold table */
+    pipelines: {
+        nextStepId: () => string;
+        govern: (stepId: string, tool: string, content: string, opts: {
+            contentType: ReturnType<typeof detectContentType>;
+            clue?: string;
+        }) => unknown;
+    };
+    env?: Record<string, string | undefined>;
+    /** Team-scope isolation (#22): a non-Team session's result is nobody's to rewrite
+     *  but the host's, and an unknown owner is treated as not-ours and COUNTED — a
+     *  governance layer that silently stopped applying is the same overstated claim
+     *  this product exists to refuse. */
+    scope?: TeamScope;
+}
+/** Rendered in the user's tool-output language (the tm_* strings are Chinese and
+ *  flow into every reply an agent writes about them). */
+/**
+ * Tools whose result IS an addressing table: native `browser_click` / `browser_fill`
+ * take a `ref` out of the snapshot, so a preview that drops the ref tokens does not
+ * save the model a round-trip — it makes it click the wrong element, or spend a call
+ * re-snapshotting.  For these two the text stays in context, capped, with the handle
+ * kept for the tail.  1 200 tokens is the budget tm_browser's own snapshot already
+ * runs at, so the governed door and the native one cost the same window space.
+ */
+export declare const ADDRESSING_NATIVE_TOOLS: ReadonlySet<string>;
+export declare const NATIVE_SNAPSHOT_MAX_TOKENS = 1200;
+export declare function snapshotTokenBudget(env: Record<string, string | undefined> | undefined): number;
+export declare function renderAddressingCap(tool: string, capped: string, governed: {
+    ref: string;
+    access_token: string;
+    expire_at: number;
+    tokens: number;
+}): string;
+/** The budget a report (a `tm_stats`-shaped answer, a `tm_join` summary) keeps in
+ *  context: tables win the space, prose is what gets dropped. Pinned separately from
+ *  the snapshot budget because a report has more prose per table. */
+export declare const NATIVE_REPORT_MAX_TOKENS = 1600;
+export declare function reportTokenBudget(env: Record<string, string | undefined> | undefined): number;
+export declare function renderReportCap(tool: string, capped: string, governed: {
+    ref: string;
+    access_token: string;
+    expire_at: number;
+    tokens: number;
+}, tablesDropped: number): string;
+export declare function renderNativeOffload(tool: string, governed: {
+    offloaded: true;
+    ref: string;
+    access_token: string;
+    expire_at: number;
+    tokens: number;
+    preview: string;
+}): string;
+export declare function applyV2NativeOffload(ctx: unknown, deps: OffloadDeps): {
+    registrations: Promise<V2Registration>[];
+    report: V2OffloadReport;
+    active: boolean;
+};
+export {};
+//# sourceMappingURL=v2-offload.d.ts.map

package/dist/host/v2-offload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-offload.d.ts","sourceRoot":"","sources":["../../src/host/v2-offload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAqD,iBAAiB,EAAoB,MAAM,kBAAkB,CAAA;AAIzH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;;;;;;;;gFASgF;AAChF,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CA6BpD,CAAA;AAEF;;;;;yDAKyD;AACzD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ;;2DAEuD;IACvD,IAAI,EAAE,MAAM,CAAA;IACZ;gFAC4E;IAC5E,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB;;wEAEoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd;yFACqF;IACrF,YAAY,EAAE,MAAM,CAAA;IACpB;;;0DAGsD;IACtD,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5D;AAED,UAAU,WAAW;IACnB,yFAAyF;IACzF,SAAS,EAAE;QACT,UAAU,EAAE,MAAM,MAAM,CAAA;QACxB,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;YAAE,WAAW,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAA;KAC/I,CAAA;IACD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACxC;;;yCAGqC;IACrC,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB;AAuBD;yDACyD;AACzD;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAiD,CAAA;AACzG,eAAO,MAAM,0BAA0B,OAAO,CAAA;AAE9C,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,GAAG,MAAM,CAG/F;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjF,MAAM,CAUR;AAED;;qEAEqE;AACrE,eAAO,MAAM,wBAAwB,OAAO,CAAA;AAE5C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,GAAG,MAAM,CAG7F;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAClF,aAAa,EAAE,MAAM,GACpB,MAAM,CAWR;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnH,MAAM,CAUR;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,WAAW,GAChB;IAAE,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CA0HxF"}

package/dist/host/v2-offload.js

@@ -0,0 +1,288 @@
+import { capKeepingAddressing, capKeepingTables, detectContentType, hasMarkdownTable } from "../tm/preview.js";
+import { parseHostEnvelope, renderOffloadedSubagent } from "../task-offload.js";
+import { estimateTokens } from "../tm/config.js";
+/**
+ * JIT context governance over the HOST's own tools.
+ *
+ * The whole product rests on one promise: an oversized tool result never enters
+ * the context window — it lands in the run store and the model gets an
+ * ≤80-token preview plus a handle.  That promise was true only inside our own
+ * `tm_*` tools, which is what made `tm_read`/`tm_grep`/`tm_bash` load-bearing
+ * rather than merely nicer.  The moment a role is allowed the native `read` or
+ * `shell` (which is the retirement plan for those three), an un-governed native
+ * result would put the promise back to zero for exactly the tools a user would
+ * most plausibly enable — and the promise would then depend on which tool the
+ * model happened to pick, which is not a guarantee at all.
+ *
+ * So the governance moves to the seam that does not care what the model chose.
+ * `tool.execute.after` hands us the finished result for EVERY tool (measured
+ * live: `{action:"shell"}` reaches `permission.evaluate`, and the same call
+ * reaches `execute.after` with `resultKeys: content / metadata / output`), and
+ * the host documents `result` as mutable.  One hook, both worlds.
+ *
+ * Design constraints this file is written under:
+ * - **It only ever shrinks what reaches the context, never what the tool did.**
+ *   The bytes on disk are the host's; a preview plus a handle replaces the text
+ *   part.  `metadata` and any non-text part (an image attachment) pass through
+ *   untouched — dropping a screenshot to save tokens would be a bad trade.
+ * - **It reuses the same threshold, preview builder, store and HMAC handles as
+ *   `tm_*`**, because a second implementation would drift, and the drift would
+ *   show up as "the same 40 KB was free through one tool and offloaded through
+ *   another".
+ * - **A native result is rendered as native-shaped text.** `tm_*` returns our own
+ *   structured object; overwriting a host tool's text part with `{offloaded:true,
+ *   ref:…}` would hand the model a shape it has no reason to understand.  The
+ *   sentence below says the same facts in prose the tm_* tools already train it
+ *   to act on: how much was saved, the handle, how to page it in.
+ * - Nothing here may throw into somebody's tool call: a governance failure
+ *   degrades to the host's verbatim result, and says so in the trajectory.
+ */
+/** Tools whose NATIVE output we govern.  Deliberately a closed list: the built-in
+ *  agent/patch/question results have shapes nobody has observed here, and rewriting
+ *  a shape you guessed at is content destruction, not governance.
+ *
+ *  `execute` is on the list for one specific reason, and it is the reason the
+ *  native browser can be governed at all: the Team's direct tool surface on v2 is
+ *  six tools (edit / execute / question / shell / subagent / write), so
+ *  `tools.browser.*` -- every snapshot, tab list and evaluate result -- reaches the
+ *  context window ONLY as the aggregate return of one Code Mode program.  There is
+ *  no other door, so governing `execute` IS "put JIT on the native browser". */
+export const NATIVE_GOVERNED_TOOLS = new Set([
+    "read",
+    "grep",
+    "glob",
+    "shell",
+    "bash",
+    "webfetch",
+    "websearch",
+    "execute",
+    "edit",
+    "write",
+    "patch",
+    "question",
+    /*
+     * `subagent` is v2's version of Plan B, and it is here because of what was
+     * MEASURED rather than what v1 did.  A live run recorded
+     * `execute.before subagent {agent,background,description,prompt}` ->
+     * `permission.evaluate action=subagent` -> `execute.after subagent
+     * {content,metadata,output}`: a synchronous child's whole reply arrives as THIS
+     * tool's result, so one hook governs it.  The same run showed
+     * `session.hook("context")` carrying a single message and no
+     * `<task id=… state="completed">` envelope at all -- so v1's chat.message offload
+     * has no anchor on v2, and rewriting the message list against a guessed shape is
+     * how evidence gets deleted silently (the same reason host-hooks.ts declines
+     * `experimental.chat.messages.transform`).  Consequence stated plainly: a
+     * BACKGROUND child's reply, which the host injects later, is NOT governed here --
+     * closing that needs the ctx.event/ctx.session rebuild, which is an open decision.
+     */
+    "subagent",
+]);
+/** Is this tool's output inside the governed surface?  The host's browser catalog is
+ *  45 tools sharing one namespace (`browser_*`, each registered with
+ *  `permission:"browser"`), and a snapshot from any of them is exactly the oversized
+ *  payload the offload promise is about — enumerating 45 names would only guarantee
+ *  that a host adding the 46th escapes us.  Unknown RESULT shapes are still left
+ *  untouched; that test is per payload, not per name. */
+export function isGovernedNative(tool) {
+    return NATIVE_GOVERNED_TOOLS.has(tool) || tool.startsWith("browser_");
+}
+const textPart = (p) => !!p && typeof p === "object" && p.type === "text" && typeof p.text === "string";
+/** The host's result shape, as measured: `{content, metadata, output}` with
+ *  `content` an array of parts.  Every other shape is left alone rather than
+ *  interpreted — an unknown shape we rewrite is content destruction. */
+function locatableText(result) {
+    const r = result;
+    if (!r || !Array.isArray(r.content))
+        return null;
+    let joined = "";
+    let index = -1;
+    for (let i = 0; i < r.content.length; i++) {
+        const p = r.content[i];
+        if (!textPart(p))
+            continue;
+        if (index < 0)
+            index = i;
+        joined += (index === i && joined === "" ? "" : joined ? "\n" : "") + p.text;
+    }
+    if (index < 0 || !joined)
+        return null;
+    return { parts: r.content, index, text: joined };
+}
+/** Rendered in the user's tool-output language (the tm_* strings are Chinese and
+ *  flow into every reply an agent writes about them). */
+/**
+ * Tools whose result IS an addressing table: native `browser_click` / `browser_fill`
+ * take a `ref` out of the snapshot, so a preview that drops the ref tokens does not
+ * save the model a round-trip — it makes it click the wrong element, or spend a call
+ * re-snapshotting.  For these two the text stays in context, capped, with the handle
+ * kept for the tail.  1 200 tokens is the budget tm_browser's own snapshot already
+ * runs at, so the governed door and the native one cost the same window space.
+ */
+export const ADDRESSING_NATIVE_TOOLS = new Set(["browser_snapshot", "browser_find"]);
+export const NATIVE_SNAPSHOT_MAX_TOKENS = 1200;
+export function snapshotTokenBudget(env) {
+    const raw = Number(String(env?.TM_NATIVE_SNAPSHOT_MAX_TOKENS ?? "").trim());
+    return Number.isFinite(raw) && raw >= 100 ? Math.min(20_000, Math.floor(raw)) : NATIVE_SNAPSHOT_MAX_TOKENS;
+}
+export function renderAddressingCap(tool, capped, governed) {
+    const when = new Date(governed.expire_at).toISOString().replace("T", " ").slice(0, 16);
+    return (capped +
+        `
+
+（原生 ${tool} 的快照按 JIT 治理截到预算内，没有整体卸载：截断部分里的 ref 不在你眼前，` +
+        `需要时用 tm_fetch { ref:"${governed.ref}", access_token:"${governed.access_token}", mode:"lines" } 分段取回再点，` +
+        `不要为了看一眼把全文读回来。原文 ${governed.tokens} token · 过期 ${governed.expire_at} · ${when}）`);
+}
+/** The budget a report (a `tm_stats`-shaped answer, a `tm_join` summary) keeps in
+ *  context: tables win the space, prose is what gets dropped. Pinned separately from
+ *  the snapshot budget because a report has more prose per table. */
+export const NATIVE_REPORT_MAX_TOKENS = 1600;
+export function reportTokenBudget(env) {
+    const raw = Number(String(env?.TM_NATIVE_REPORT_MAX_TOKENS ?? "").trim());
+    return Number.isFinite(raw) && raw >= 200 ? Math.min(20_000, Math.floor(raw)) : NATIVE_REPORT_MAX_TOKENS;
+}
+export function renderReportCap(tool, capped, governed, tablesDropped) {
+    const when = new Date(governed.expire_at).toISOString().replace("T", " ").slice(0, 16);
+    return (capped +
+        `
+
+（原生 ${tool} 的返回是报告形的：表格已整份留在上面，被删掉的只有表格之间的说明文字——` +
+        `全文 ${governed.tokens} token，别为了看一句散文把整份读回来。` +
+        (tablesDropped > 0 ? `注意：预算之外还有 ${tablesDropped} 行表格内容没进来，需要时用 ` : "需要更多行时用 ") +
+        `tm_fetch { ref:"${governed.ref}", access_token:"${governed.access_token}", mode:"lines" } 分段取。过期 ${governed.expire_at} · ${when}）`);
+}
+export function renderNativeOffload(tool, governed) {
+    const when = new Date(governed.expire_at).toISOString().replace("T", " ").slice(0, 16);
+    return [
+        `（原生 ${tool} 的输出过大，已按 JIT 治理卸载：${governed.tokens} token 没有进入上下文——全文在句柄里，不在下面这段里。）`,
+        "",
+        governed.preview,
+        "",
+        `取全文：tm_fetch { ref:"${governed.ref}", access_token:"${governed.access_token}", mode:"structure" | "lines" }（过期 ${governed.expire_at} · ${when}）`,
+        "只要摘要就到此为止；需要具体行请用 mode:\"lines\" 分段取，不要为了看一眼把全文读回来。",
+    ].join("\n");
+}
+export function applyV2NativeOffload(ctx, deps) {
+    const env = deps.env ?? process.env;
+    const off = /^(0|false|no|off)$/i.test(String(env.TM_NATIVE_OFFLOAD ?? "").trim());
+    const report = { seen: 0, ours: 0, unmatched: 0, considered: 0, offloaded: 0, capped: 0, reportCapped: 0, envelopes: 0, degraded: 0, tokensSaved: 0, byTool: {} };
+    const hook = ctx?.tool?.hook;
+    if (typeof hook !== "function") {
+        // No seam at all: report it, do not silently pretend the promise holds.
+        return { registrations: [], report, active: false };
+    }
+    const reg = hook("execute.after", (raw) => {
+        const event = raw;
+        const tool = String(event?.tool ?? "");
+        // The owner question comes FIRST: a foreign or unattributable session is left
+        // alone no matter which tool it called, and the counters then describe every
+        // call we looked at rather than only the ones we recognised a tool for.
+        if (deps.scope) {
+            if (deps.scope.count(deps.scope.decide(event)) !== "ours")
+                return;
+            // A resolved call is also a fact about the session — remember it so a later
+            // event that arrives without `agent` still resolves to ours.
+            deps.scope.learn(event.agent, event.sessionID);
+        }
+        report.ours++;
+        if (!isGovernedNative(tool)) {
+            report.unmatched++;
+            report.byTool[tool] ??= { seen: 0, offloaded: 0 };
+            report.byTool[tool].seen++;
+            return;
+        }
+        report.seen++;
+        report.byTool[tool] ??= { seen: 0, offloaded: 0 };
+        report.byTool[tool].seen++;
+        if (off)
+            return;
+        const found = locatableText(event?.result);
+        if (!found)
+            return;
+        report.considered++;
+        // A sub-agent reply arrives wrapped in the host's own envelope.  Offloading it
+        // means replacing the BODY and reproducing the wrapper: the host and the UI key
+        // on `<subagent sessionID=…>`, so flattening it into a generic governed result
+        // would delete the very pointer the lead needs to fetch the whole thing back.
+        const envelope = tool === "subagent" ? parseHostEnvelope(found.text) : null;
+        if (envelope)
+            report.envelopes++;
+        const stepId = deps.pipelines.nextStepId();
+        // Content class is inferred from the BODY, not from a path we do not have:
+        // that is the same basis tm_bash uses, so a 30 KB JSON stdout gets the data
+        // tier here and there too.
+        const contentType = detectContentType(found.text);
+        let governed;
+        try {
+            governed = deps.pipelines.govern(stepId, `native:${tool}`, found.text, {
+                contentType,
+                clue: `原生 ${tool} 的结果`,
+            });
+        }
+        catch {
+            report.degraded++;
+            return;
+        }
+        if (!governed || typeof governed !== "object" || governed.offloaded !== true)
+            return;
+        const g = governed;
+        const parts = found.parts;
+        if (ADDRESSING_NATIVE_TOOLS.has(tool)) {
+            // The snapshot is an addressing table, not a document: replacing it with a
+            // handle would strand the next click. Cap it, keep the handle for the tail,
+            // and count the tokens that DID enter.
+            const budget = snapshotTokenBudget(deps.env);
+            const cut = capKeepingAddressing(found.text, budget);
+            const capped = `${cut.text}${cut.fellBack
+                ? `\n\n（这个结果是一整行没有换行的 JSON，按行保留寻址行的做法装不下任何内容，所以退成了从头截断 —— 内容不完整，别把它当成页面是空的；要精确字段就用 tm_fetch mode:"lines" 或改拍一次范围更小的快照。）`
+                : cut.addressesDropped > 0
+                    ? `
+
+（预算 ${budget} token 之内只装下了部分寻址行：另有 ${cut.addressesDropped} 行带 ref 的内容被截掉了，要点对它们先用 tm_fetch mode:"lines" 取回，或缩小范围重新拍一次快照——不要凭猜去点。）`
+                    : ""}`;
+            const rendered = renderAddressingCap(tool, capped, g);
+            parts[found.index] = { type: "text", text: rendered };
+            for (let i = found.index + 1; i < parts.length; i++) {
+                if (textPart(parts[i]))
+                    parts[i] = { type: "text", text: "" };
+            }
+            report.capped++;
+            report.tokensSaved += Math.max(0, estimateTokens(found.text) - estimateTokens(rendered));
+            report.byTool[tool].offloaded++;
+            return;
+        }
+        if (!envelope && hasMarkdownTable(found.text)) {
+            // A report is not a log. Offloading `tm_stats` down to an 80-token preview
+            // (measured live, on a report that came back through Code Mode's `execute` at
+            // 2 917 tokens) leaves the lead describing a table it cannot see and the user
+            // reading prose about numbers instead of the numbers. So the tables stay, the
+            // prose goes, and the handle still carries the whole thing.
+            const budget = reportTokenBudget(deps.env);
+            const cut = capKeepingTables(found.text, budget);
+            const rendered = renderReportCap(tool, cut.text, g, cut.tablesDropped);
+            parts[found.index] = { type: "text", text: rendered };
+            for (let i = found.index + 1; i < parts.length; i++) {
+                if (textPart(parts[i]))
+                    parts[i] = { type: "text", text: "" };
+            }
+            report.reportCapped++;
+            report.tokensSaved += Math.max(0, estimateTokens(found.text) - estimateTokens(rendered));
+            report.byTool[tool].offloaded++;
+            return;
+        }
+        const keepTokens = estimateTokens(g.preview);
+        parts[found.index] = {
+            type: "text",
+            text: envelope ? renderOffloadedSubagent(envelope, g.preview, g.tokens) : renderNativeOffload(tool, g),
+        };
+        for (let i = found.index + 1; i < parts.length; i++) {
+            if (textPart(parts[i]))
+                parts[i] = { type: "text", text: "" };
+        }
+        report.offloaded++;
+        report.tokensSaved += Math.max(0, estimateTokens(found.text) - keepTokens);
+        report.byTool[tool].offloaded++;
+    });
+    return { registrations: [reg], report, active: !off };
+}
+//# sourceMappingURL=v2-offload.js.map