@te-river/opencode-team-mode 1.6.2 → 1.7.1

package/dist/host/v2-offload.d.ts

@@ -108,7 +108,7 @@ interface OffloadDeps {
  * take a `ref` out of the snapshot, so a preview that drops the ref tokens does not
  * save the model a round-trip — it makes it click the wrong element, or spend a call
  * re-snapshotting.  For these two the text stays in context, capped, with the handle
- * kept for the tail.  1 200 tokens is the budget tm_browser's own snapshot already
+ * kept for the tail.  1 200 tokens is the budget a native snapshot already
  * runs at, so the governed door and the native one cost the same window space.
  */
 export declare const ADDRESSING_NATIVE_TOOLS: ReadonlySet<string>;

package/dist/host/v2-offload.js

@@ -70,7 +70,7 @@ export const NATIVE_GOVERNED_TOOLS = new Set([
      * `session.hook("context")` carrying a single message and no
      * `<task id=… state="completed">` envelope at all -- so v1's chat.message offload
      * has no anchor on v2, and rewriting the message list against a guessed shape is
-     * how evidence gets deleted silently (the same reason host-hooks.ts declines
+     * how evidence gets deleted silently (the same reason we decline
      * `experimental.chat.messages.transform`).  Consequence stated plainly: a
      * BACKGROUND child's reply, which the host injects later, is NOT governed here --
      * closing that needs the ctx.event/ctx.session rebuild, which is an open decision.
@@ -115,7 +115,7 @@ function locatableText(result) {
  * take a `ref` out of the snapshot, so a preview that drops the ref tokens does not
  * save the model a round-trip — it makes it click the wrong element, or spend a call
  * re-snapshotting.  For these two the text stays in context, capped, with the handle
- * kept for the tail.  1 200 tokens is the budget tm_browser's own snapshot already
+ * kept for the tail.  1 200 tokens is the budget a native snapshot already
  * runs at, so the governed door and the native one cost the same window space.
  */
 export const ADDRESSING_NATIVE_TOOLS = new Set(["browser_snapshot", "browser_find"]);

package/dist/host/v2-permissions.d.ts

@@ -1,11 +1,11 @@
 /**
- * v1's flat permission map -> v2's ordered `{action, resource, effect}` rules.
+ * The agent permission matrix -> v2's ordered `{action, resource, effect}` rules.
  *
- * v1 expressed an agent's whitelist as an object keyed by tool name, with two
+ * The matrix expresses a whitelist as an object keyed by tool name, with two
  * tricks the v2 schema cannot hold: a value may be an OBJECT of
  * pattern->effect (the bash escalation that made the host's official dialog
- * fire for the R6/R2 faces), and `"tm_*"` was a literal wildcard KEY that
- * matched our whole tool family.  v2 takes only flat triples, so:
+ * fire for the R6/R2 faces), and `"tm_*"` is a literal wildcard KEY that
+ * matches our whole tool family.  v2 takes only flat triples, so:
  *
  *  - a plain `tool: "allow"|"deny"|"ask"` becomes `{action: tool, resource:"*", effect}`;
  *  - an escalation object becomes ONE `ask` triple for that action — the object
@@ -25,9 +25,10 @@ export interface PermissionTriple {
     effect: PermissionEffect;
 }
 /**
- * v1 named its built-in tools differently.  Measured against the live v2
- * surface (probed `session.context.tools`: edit glob grep question read shell
- * skill subagent webfetch websearch write, plus patch/browser_*):
+ * The matrix names three built-in tools differently from the host's v2 tool
+ * ids.  Measured against the live v2 surface (probed `session.context.tools`:
+ * edit glob grep question read shell skill subagent webfetch websearch write,
+ * plus patch/browser_*):
  *
  *   bash → shell · task → subagent · apply_patch → patch
  *
@@ -38,41 +39,41 @@ export interface PermissionTriple {
  */
 export declare const V2_ACTION_NAMES: Readonly<Record<string, string>>;
 /**
- * Tools the v1 personality registers and the v2 one does NOT — the host's own
- * `execute` (Code Mode) already covers `tm_ptc_run` on v2 (proved against a live
- * session: parallel governed calls, results still offloaded through handles).
+ * RETIRED TOOLS — names the v1 personality used to register and this package
+ * no longer ships.  v1 support was removed in 1.7.0, so these are historical
+ * names; the set survives because it still has three live jobs:
  *
- * This is the single source for that fact: `v2.ts` skips them when registering,
- * and `scripts/gen-v2-config.mjs` drops their permission triples, because an
- * `allow` for an action the host has never heard of claims a capability that
- * does not exist.
- */
-/**
- * Tools v1 keeps and v2 does not register.
+ *  - `v2.ts` skips them when registering, so a stale build or a future re-add
+ *    cannot slip one back onto the tool surface;
+ *  - `triplesFromAgentPermission` drops any permission rule naming one, and
+ *    `mergeTriples` reclaims such a rule from an upgraded config — an `allow`
+ *    for an action the host has never heard of claims a capability that does
+ *    not exist;
+ *  - `scripts/gen-v2-config.mjs` drops their triples from the generated
+ *    markdown for the same reason.
  *
- * `tm_ptc_run` left because the host's own Code Mode does the job.  The other
- * three left for the opposite reason: on v2 the NATIVE read/grep/shell are the
- * better tools (paged reads, image/PDF attachment, background shell, and — since
- * 1.7.0's offload layer — they are now governed too, measured at 12,902 tokens
- * arriving as a 78-token preview).  Retiring them is only safe in that order,
- * which is why the governance moved to `execute.after` FIRST and this list is the
- * step that follows it, not the one that precedes it.
- *
- * v1 keeps all three: its `tool.execute.before` can rewrite arguments but not
- * results, so deleting them there would delete offload itself.
+ * Why each left: `tm_ptc_run` because the host's own Code Mode does the job
+ * (one program, N governed calls, zero round-trips, proved against a live
+ * session: parallel governed calls, results still offloaded through handles).
+ * `tm_read`/`tm_grep`/`tm_bash` because the NATIVE read/grep/shell are the
+ * better tools (paged reads, image/PDF attachment, background shell, and —
+ * since the offload layer — they are governed too, measured at 12,902 tokens
+ * arriving as a 78-token preview).  Retiring them was only safe in that order,
+ * which is why the governance moved to `execute.after` FIRST and this list is
+ * the step that follows it, not the one that precedes it.
  */
 export declare const V1_ONLY_TOOLS: ReadonlySet<string>;
 /**
- * The v2 file/shell ladder runs through the host's own tools, so the triples that
+ * The file/shell ladder runs through the host's own tools, so the triples that
  * DENY them must not be projected: v2-session.ts deletes every literal-`deny`
  * action from the request, and denying `read` while `tm_read` is unregistered
  * would leave a role with no way to open a file at all.  This is a translation
- * decision, not an edit to src/agents.ts — v1's matrix keeps its denies and the
- * two personalities' ladders genuinely differ now.
+ * decision, not an edit to src/agents.ts — the matrix keeps its denies and the
+ * ladder is applied at translation time.
  *
  * Both halves have to agree, so the SAME set is consulted by `toolsToRemove()` in
  * v2-session.ts; this constant is the one source.  Letting the native file tools
- * back in does not lower a red line: v1's P2 scope ("stay inside the project +
+ * back in does not lower a red line: the P2 scope ("stay inside the project +
  * the store dirs") is the host's own `external_directory` permission action on v2,
  * observed live answering `effect:"ask"` with a `permission.asked` behind it — a
  * real dialog where our code used to hard-throw.  The two red lines the host does
@@ -83,25 +84,25 @@ export declare const V1_ONLY_TOOLS: ReadonlySet<string>;
 export declare const V2_LADDER_ACTIONS: ReadonlySet<string>;
 export interface TranslateOptions {
     /**
-     * With R6 on, v1 escalated `bash` to a pattern object so the host's OFFICIAL
-     * dialog fired.  A plugin cannot raise a dialog on v2 (probed) — but the host
-     * does honor an `ask` EFFECT it evaluates itself, so escalating the mapped
-     * `shell` action to `ask` is the closest honest equivalent: the human is
-     * asked, just per command rather than per pattern.  #94 refines the
+     * With R6 on, the matrix escalates `bash` to a pattern object so the host's
+     * OFFICIAL dialog fires.  A plugin cannot raise a dialog on v2 (probed) — but
+     * the host does honor an `ask` EFFECT it evaluates itself, so escalating the
+     * mapped `shell` action to `ask` is the closest honest equivalent: the human
+     * is asked, just per command rather than per pattern.  #94 refines the
      * per-pattern half through `permission.hook("evaluate")`.
      */
     escalateShellAsk?: boolean;
     /**
-     * Which role these triples are for.  Needed for the ONE tool that exists only on this
-     * personality: `tm_ledger` is not in the v1 permission map (v1 has the host's
-     * `todowrite`), so nothing would ever name it, and an unruled action is the host's
-     * default rather than our stated rule.  The lead's list is the lead's: `allow` for it,
-     * `deny` for the five specialists, which also makes the runtime gate
-     * (`onlyAgent: "team"`) visible in the config the user can read.
+     * Which role these triples are for.  Needed for the ONE tool the matrix does
+     * not name: `tm_ledger` is not in the permission map, so nothing would ever
+     * name it, and an unruled action is the host's default rather than our stated
+     * rule.  The lead's list is the lead's: `allow` for it, `deny` for the five
+     * specialists, which also makes the runtime gate (`onlyAgent: "Team"`)
+     * visible in the config the user can read.
      */
     agentName?: string;
 }
-/** The v1 `permission` block, as loosely as the host hands it to us. */
+/** The agent `permission` block, as loosely as the config hands it to us. */
 export declare function triplesFromAgentPermission(permission: Record<string, unknown> | undefined | null, options?: TranslateOptions): {
     triples: PermissionTriple[];
     unmapped: string[];
@@ -113,7 +114,7 @@ export declare function triplesFromAgentPermission(permission: Record<string, un
  * it).  Idempotent: running it twice changes nothing.
  *
  * `drop` is the reclaim path for an upgrade: a rule naming an action this
- * personality never registers (a v1-only tool) can only have come from us, and
+ * package never registers (a retired tool) can only have come from us, and
  * leaving it behind would keep claiming a capability the host does not have.
  */
 export declare function mergeTriples(existing: ReadonlyArray<PermissionTriple> | undefined | null, ours: ReadonlyArray<PermissionTriple>, drop?: ReadonlySet<string>): {

package/dist/host/v2-permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"v2-permissions.d.ts","sourceRoot":"","sources":["../../src/host/v2-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI5D,CAAA;AAED;;;;;;;;;GASG;AACH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAe5C,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAA;AAQvF,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,EACtD,OAAO,GAAE,gBAAqB,GAC7B;IAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA0DrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,SAAS,GAAG,IAAI,EAC5D,IAAI,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACrC,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB;IAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAcnD"}
+{"version":3,"file":"v2-permissions.d.ts","sourceRoot":"","sources":["../../src/host/v2-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAID;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI5D,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAe5C,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAA;AAQvF,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,6EAA6E;AAC7E,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,EACtD,OAAO,GAAE,gBAAqB,GAC7B;IAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAuDrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,GAAG,SAAS,GAAG,IAAI,EAC5D,IAAI,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACrC,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB;IAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAcnD"}

package/dist/host/v2-permissions.js

@@ -1,11 +1,11 @@
 /**
- * v1's flat permission map -> v2's ordered `{action, resource, effect}` rules.
+ * The agent permission matrix -> v2's ordered `{action, resource, effect}` rules.
  *
- * v1 expressed an agent's whitelist as an object keyed by tool name, with two
+ * The matrix expresses a whitelist as an object keyed by tool name, with two
  * tricks the v2 schema cannot hold: a value may be an OBJECT of
  * pattern->effect (the bash escalation that made the host's official dialog
- * fire for the R6/R2 faces), and `"tm_*"` was a literal wildcard KEY that
- * matched our whole tool family.  v2 takes only flat triples, so:
+ * fire for the R6/R2 faces), and `"tm_*"` is a literal wildcard KEY that
+ * matches our whole tool family.  v2 takes only flat triples, so:
  *
  *  - a plain `tool: "allow"|"deny"|"ask"` becomes `{action: tool, resource:"*", effect}`;
  *  - an escalation object becomes ONE `ask` triple for that action — the object
@@ -18,11 +18,13 @@
  * rather than guessed at: a rule the host cannot parse is worse than no rule,
  * because it may fail closed on the whole agent.
  */
+import { isLeadAgent } from "../identity.js";
 const EFFECTS = new Set(["allow", "deny", "ask"]);
 /**
- * v1 named its built-in tools differently.  Measured against the live v2
- * surface (probed `session.context.tools`: edit glob grep question read shell
- * skill subagent webfetch websearch write, plus patch/browser_*):
+ * The matrix names three built-in tools differently from the host's v2 tool
+ * ids.  Measured against the live v2 surface (probed `session.context.tools`:
+ * edit glob grep question read shell skill subagent webfetch websearch write,
+ * plus patch/browser_*):
  *
  *   bash → shell · task → subagent · apply_patch → patch
  *
@@ -37,28 +39,28 @@ export const V2_ACTION_NAMES = {
     apply_patch: "patch",
 };
 /**
- * Tools the v1 personality registers and the v2 one does NOT — the host's own
- * `execute` (Code Mode) already covers `tm_ptc_run` on v2 (proved against a live
- * session: parallel governed calls, results still offloaded through handles).
+ * RETIRED TOOLS — names the v1 personality used to register and this package
+ * no longer ships.  v1 support was removed in 1.7.0, so these are historical
+ * names; the set survives because it still has three live jobs:
  *
- * This is the single source for that fact: `v2.ts` skips them when registering,
- * and `scripts/gen-v2-config.mjs` drops their permission triples, because an
- * `allow` for an action the host has never heard of claims a capability that
- * does not exist.
- */
-/**
- * Tools v1 keeps and v2 does not register.
+ *  - `v2.ts` skips them when registering, so a stale build or a future re-add
+ *    cannot slip one back onto the tool surface;
+ *  - `triplesFromAgentPermission` drops any permission rule naming one, and
+ *    `mergeTriples` reclaims such a rule from an upgraded config — an `allow`
+ *    for an action the host has never heard of claims a capability that does
+ *    not exist;
+ *  - `scripts/gen-v2-config.mjs` drops their triples from the generated
+ *    markdown for the same reason.
  *
- * `tm_ptc_run` left because the host's own Code Mode does the job.  The other
- * three left for the opposite reason: on v2 the NATIVE read/grep/shell are the
- * better tools (paged reads, image/PDF attachment, background shell, and — since
- * 1.7.0's offload layer — they are now governed too, measured at 12,902 tokens
- * arriving as a 78-token preview).  Retiring them is only safe in that order,
- * which is why the governance moved to `execute.after` FIRST and this list is the
- * step that follows it, not the one that precedes it.
- *
- * v1 keeps all three: its `tool.execute.before` can rewrite arguments but not
- * results, so deleting them there would delete offload itself.
+ * Why each left: `tm_ptc_run` because the host's own Code Mode does the job
+ * (one program, N governed calls, zero round-trips, proved against a live
+ * session: parallel governed calls, results still offloaded through handles).
+ * `tm_read`/`tm_grep`/`tm_bash` because the NATIVE read/grep/shell are the
+ * better tools (paged reads, image/PDF attachment, background shell, and —
+ * since the offload layer — they are governed too, measured at 12,902 tokens
+ * arriving as a 78-token preview).  Retiring them was only safe in that order,
+ * which is why the governance moved to `execute.after` FIRST and this list is
+ * the step that follows it, not the one that precedes it.
  */
 export const V1_ONLY_TOOLS = new Set([
     "tm_ptc_run",
@@ -69,7 +71,7 @@ export const V1_ONLY_TOOLS = new Set([
      * `tm_pty` executes on the host's OWN terminal sessions through `client.pty.*`,
      * and the v2 plugin context has no pty domain at all — so registering it meant
      * shipping a tool whose every start answers "宿主 pty 接口不可用". A tool that
-     * cannot work is the overstated claim, not the fallback. v1 keeps it.
+     * cannot work is the overstated claim, not the fallback.
      * Revisit only when #28 measures the native `shell` background round-trip
      (what returns, how output is retrieved, how it is cancelled); if the host's own
      * background shell covers it, this stays retired and the prompt says `shell`.
@@ -77,16 +79,16 @@ export const V1_ONLY_TOOLS = new Set([
     "tm_pty",
 ]);
 /**
- * The v2 file/shell ladder runs through the host's own tools, so the triples that
+ * The file/shell ladder runs through the host's own tools, so the triples that
  * DENY them must not be projected: v2-session.ts deletes every literal-`deny`
  * action from the request, and denying `read` while `tm_read` is unregistered
  * would leave a role with no way to open a file at all.  This is a translation
- * decision, not an edit to src/agents.ts — v1's matrix keeps its denies and the
- * two personalities' ladders genuinely differ now.
+ * decision, not an edit to src/agents.ts — the matrix keeps its denies and the
+ * ladder is applied at translation time.
  *
  * Both halves have to agree, so the SAME set is consulted by `toolsToRemove()` in
  * v2-session.ts; this constant is the one source.  Letting the native file tools
- * back in does not lower a red line: v1's P2 scope ("stay inside the project +
+ * back in does not lower a red line: the P2 scope ("stay inside the project +
  * the store dirs") is the host's own `external_directory` permission action on v2,
  * observed live answering `effect:"ask"` with a `permission.asked` behind it — a
  * real dialog where our code used to hard-throw.  The two red lines the host does
@@ -99,20 +101,20 @@ const V2_ONLY_ACTIONS = new Set(["list", "todowrite", "lsp"]);
 function normalizeEffect(value) {
     return typeof value === "string" && EFFECTS.has(value) ? value : null;
 }
-/** The v1 `permission` block, as loosely as the host hands it to us. */
+/** The agent `permission` block, as loosely as the config hands it to us. */
 export function triplesFromAgentPermission(permission, options = {}) {
     const triples = [];
     const unmapped = [];
     if (!permission || typeof permission !== "object")
         return { triples, unmapped };
-    for (const [v1Action, value] of Object.entries(permission)) {
-        if (!v1Action)
+    for (const [matrixAction, value] of Object.entries(permission)) {
+        if (!matrixAction)
             continue;
-        if (V2_ONLY_ACTIONS.has(v1Action)) {
-            unmapped.push(v1Action);
+        if (V2_ONLY_ACTIONS.has(matrixAction)) {
+            unmapped.push(matrixAction);
             continue;
         }
-        const action = V2_ACTION_NAMES[v1Action] ?? v1Action;
+        const action = V2_ACTION_NAMES[matrixAction] ?? matrixAction;
         // A rule for an action v2 never registers claims a capability that does not
         // exist, and `permission.evaluate` cannot even see it to enforce it.  One
         // source for the decision: this is the same set v2.ts skips when registering
@@ -128,16 +130,13 @@ export function triplesFromAgentPermission(permission, options = {}) {
             if (V2_LADDER_ACTIONS.has(action) && direct === "deny")
                 continue;
             const effect = options.escalateShellAsk && action === "shell" && direct === "allow" ? "ask" : direct;
+            // The host's 45 `browser_*` tools share ONE permission action named
+            // `browser` (read from the binary), and they are NOT in the direct tool
+            // surface — so deleting `browser_*` from `event.tools` at the request layer
+            // removes a catalog the assembled request never contained.  The matrix now
+            // names that action directly (`browser`), so the deny reaches the host's
+            // own evaluator, which is the only lever that speaks their language.
             triples.push({ action, resource: "*", effect });
-            // The host's 45 `browser_*` tools share ONE permission action named `browser`
-            // (read from the binary), and they are NOT in the direct tool surface — so
-            // deleting `browser_*` from `event.tools` at the request layer removes a
-            // catalog the assembled request never contained, while a role that is denied
-            // `tm_browser` can still reach every one of them from inside `execute`.
-            // Projecting the deny is the only lever that speaks their language.
-            if (action === "tm_browser" && direct === "deny") {
-                triples.push({ action: "browser", resource: "*", effect: "deny" });
-            }
             continue;
         }
         if (value && typeof value === "object" && !Array.isArray(value)) {
@@ -155,7 +154,7 @@ export function triplesFromAgentPermission(permission, options = {}) {
         }
     }
     if (options.agentName) {
-        const ledgerEffect = options.agentName === "team" ? "allow" : "deny";
+        const ledgerEffect = isLeadAgent(options.agentName) ? "allow" : "deny";
         if (!triples.some((x) => x.action === "tm_ledger")) {
             triples.push({ action: "tm_ledger", resource: "*", effect: ledgerEffect });
         }
@@ -169,7 +168,7 @@ export function triplesFromAgentPermission(permission, options = {}) {
  * it).  Idempotent: running it twice changes nothing.
  *
  * `drop` is the reclaim path for an upgrade: a rule naming an action this
- * personality never registers (a v1-only tool) can only have come from us, and
+ * package never registers (a retired tool) can only have come from us, and
  * leaving it behind would keep claiming a capability the host does not have.
  */
 export function mergeTriples(existing, ours, drop) {

package/dist/host/v2-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"v2-permissions.js","sourceRoot":"","sources":["../../src/host/v2-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAUH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAEzD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqC;IAC/D,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,OAAO;CACrB,CAAA;AAED;;;;;;;;;GASG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACxD,YAAY;IACZ,SAAS;IACT,SAAS;IACT,SAAS;IACT;;;;;;;;OAQG;IACH,QAAQ;CACT,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAEvF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;AAE7D,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA0B,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7F,CAAC;AAuBD,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CACxC,UAAsD,EACtD,UAA4B,EAAE;IAE9B,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAC/E,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,QAAQ;YAAE,SAAQ;QACvB,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACvB,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAA;QACpD,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,2DAA2D;QAC3D,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAQ;QACvC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,2EAA2E;YAC3E,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,MAAM;gBAAE,SAAQ;YAChE,MAAM,MAAM,GACV,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;YACvF,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;YAC/C,8EAA8E;YAC9E,2EAA2E;YAC3E,yEAAyE;YACzE,6EAA6E;YAC7E,wEAAwE;YACxE,oEAAoE;YACpE,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YACpE,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;iBACjC,GAAG,CAAC,eAAe,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;YACnD,MAAM,MAAM,GAAqB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;QACpE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,QAA4D,EAC5D,IAAqC,EACrC,IAA0B;IAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;IACpD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACxG,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IACzI,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC"}
+{"version":3,"file":"v2-permissions.js","sourceRoot":"","sources":["../../src/host/v2-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAU5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAEzD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqC;IAC/D,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,OAAO;CACrB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACxD,YAAY;IACZ,SAAS;IACT,SAAS;IACT,SAAS;IACT;;;;;;;;OAQG;IACH,QAAQ;CACT,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAEvF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAA;AAE7D,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA0B,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7F,CAAC;AAuBD,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CACxC,UAAsD,EACtD,UAA4B,EAAE;IAE9B,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IAC/E,KAAK,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,YAAY;YAAE,SAAQ;QAC3B,IAAI,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAC3B,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,YAAY,CAAA;QAC5D,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,2DAA2D;QAC3D,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAQ;QACvC,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,2EAA2E;YAC3E,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,MAAM;gBAAE,SAAQ;YAChE,MAAM,MAAM,GACV,OAAO,CAAC,gBAAgB,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;YACvF,oEAAoE;YACpE,wEAAwE;YACxE,4EAA4E;YAC5E,2EAA2E;YAC3E,yEAAyE;YACzE,qEAAqE;YACrE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;YAC/C,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;iBACjC,GAAG,CAAC,eAAe,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;YACnD,MAAM,MAAM,GAAqB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACtD,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;QACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,QAA4D,EAC5D,IAAqC,EACrC,IAA0B;IAE1B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;IACpD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACxG,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IACzI,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAC9B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC"}

package/dist/host/v2-probe-chain.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Code Mode adoption guard (#35, 2026-10-06).
+ *
+ * The v2 retirement moved the file/command ladder onto the HOST's native
+ * `read` / `grep` / `glob` / `shell`, and the host's `execute` (Code Mode) is the
+ * one program that folds N governed calls into a single round-trip.  A model that
+ * keeps reaching for the native tools one at a time pays N rounds for what one
+ * `execute` program answers — the exact inefficiency the retirement was supposed
+ * to remove, wearing the opposite face.
+ *
+ * This is an ADOPTION HINT, not a gate: after a run of consecutive native
+ * file/command calls it APPENDS one line to the next result naming `execute`.
+ * It never rewrites the body, never touches args, never refuses a call — the
+ * same shape as `src/tm/dupe-guard.ts` (append a directive + count + trajectory
+ * event), minus the escalation, because a hint that blocks would cost the user
+ * the very round it is trying to save.
+ *
+ * Discipline, copied from the layers beside it:
+ *  - Team-scoped through the shared `scope.decide` gate — a foreign session's
+ *    result is nobody's to annotate;
+ *  - it may NEVER throw into somebody's tool call: a failure is swallowed and
+ *    COUNTED (`threw`), and the host's verbatim result passes through;
+ *  - the append is IDEMPOTENT (a marker check), because the host reloads plugins
+ *    in-process and a replayed hook must not stack two lines.
+ */
+import type { V2Registration } from "./v2-types.js";
+import type { TeamScope } from "./v2-scope.js";
+/** The native tools whose repeated use is what `execute` folds into one program.
+ *  A closed list on purpose: `question`, `edit`, `subagent` … are not "one more
+ *  read", and counting them would make the streak mean nothing. */
+export declare const NATIVE_CHAIN_TOOLS: ReadonlySet<string>;
+/** The tool that RESETS the streak: it is the alternative the hint points at, so
+ *  using it is the behaviour the guard exists to encourage. */
+export declare const CHAIN_RESET_TOOL = "execute";
+/** Stable marker so a replayed hook cannot append the line twice. */
+export declare const PROBE_CHAIN_MARKER = "\uFF08Code Mode \u91C7\u7528\u7387\u63D0\u793A\uFF09";
+export declare const DEFAULT_PROBE_CHAIN_AFTER = 3;
+export interface ProbeChainReport {
+    /** chain-tool calls observed in a Team session */
+    seen: number;
+    /** results that actually got the appended line */
+    advised: number;
+    /** `execute` calls that reset the streak */
+    reset: number;
+    /** non-Team sessions left completely alone */
+    foreignSkipped: number;
+    /** a throw inside the hook, swallowed and counted (never a reason to fail a call) */
+    threw: number;
+}
+export interface ProbeChainVerdict {
+    /** the current run of consecutive native file/command calls */
+    count: number;
+    /** should the line be appended to THIS result? */
+    advise: boolean;
+}
+/**
+ * The pure ledger.  `threshold` is the number of consecutive native calls after
+ * which the NEXT result carries the hint: with the default 3, calls 1-3 are
+ * silent and the 4th (and every one after it, until a reset) is advised.  A
+ * non-chain tool is transparent — it neither counts nor resets — and `execute`
+ * resets, because it is the alternative.
+ */
+export declare function createProbeChain(threshold: number): {
+    observe: (tool: string) => ProbeChainVerdict;
+    streak: () => number;
+};
+/** The appended line, in the tool-output language the tm_* strings use. */
+export declare function renderProbeChainNote(count: number): string;
+/**
+ * Append the line to the result's first text part, byte-exact otherwise.  Returns
+ * true only when a line was actually added — an unknown result shape, a missing
+ * text part, or an already-marked body all return false (the caller counts the
+ * difference).  The body is never rewritten: the original text is preserved
+ * verbatim and the line is appended after it.
+ */
+export declare function appendProbeChainNote(result: unknown, line: string): boolean;
+export interface ProbeChainDeps {
+    /** Team-scope isolation: a foreign or unattributable session is left alone. */
+    scope?: TeamScope;
+    env?: Record<string, string | undefined>;
+    /** the trajectory sink — wired in v2.ts, same shape as the browser gate's `onSerp` */
+    onAdvise?: (info: {
+        tool: string;
+        count: number;
+        sessionID?: unknown;
+    }) => void;
+}
+export declare function applyV2ProbeChain(ctx: unknown, deps: ProbeChainDeps): {
+    registrations: Promise<V2Registration>[];
+    report: ProbeChainReport;
+    active: boolean;
+};
+//# sourceMappingURL=v2-probe-chain.d.ts.map

package/dist/host/v2-probe-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-probe-chain.d.ts","sourceRoot":"","sources":["../../src/host/v2-probe-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAE9C;;mEAEmE;AACnE,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAA8C,CAAA;AAEjG;+DAC+D;AAC/D,eAAO,MAAM,gBAAgB,YAAY,CAAA;AAEzC,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,yDAAsB,CAAA;AAErD,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAA;IACZ,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAA;IACf,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAA;IACb,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAA;IACtB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAA;IACb,kDAAkD;IAClD,MAAM,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG;IACnD,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,iBAAiB,CAAA;IAC5C,MAAM,EAAE,MAAM,MAAM,CAAA;CACrB,CAcA;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM1D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAY3E;AAED,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACxC,sFAAsF;IACtF,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAA;CAChF;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,cAAc,GACnB;IAAE,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAkDzF"}

package/dist/host/v2-probe-chain.js

@@ -0,0 +1,146 @@
+/**
+ * Code Mode adoption guard (#35, 2026-10-06).
+ *
+ * The v2 retirement moved the file/command ladder onto the HOST's native
+ * `read` / `grep` / `glob` / `shell`, and the host's `execute` (Code Mode) is the
+ * one program that folds N governed calls into a single round-trip.  A model that
+ * keeps reaching for the native tools one at a time pays N rounds for what one
+ * `execute` program answers — the exact inefficiency the retirement was supposed
+ * to remove, wearing the opposite face.
+ *
+ * This is an ADOPTION HINT, not a gate: after a run of consecutive native
+ * file/command calls it APPENDS one line to the next result naming `execute`.
+ * It never rewrites the body, never touches args, never refuses a call — the
+ * same shape as `src/tm/dupe-guard.ts` (append a directive + count + trajectory
+ * event), minus the escalation, because a hint that blocks would cost the user
+ * the very round it is trying to save.
+ *
+ * Discipline, copied from the layers beside it:
+ *  - Team-scoped through the shared `scope.decide` gate — a foreign session's
+ *    result is nobody's to annotate;
+ *  - it may NEVER throw into somebody's tool call: a failure is swallowed and
+ *    COUNTED (`threw`), and the host's verbatim result passes through;
+ *  - the append is IDEMPOTENT (a marker check), because the host reloads plugins
+ *    in-process and a replayed hook must not stack two lines.
+ */
+/** The native tools whose repeated use is what `execute` folds into one program.
+ *  A closed list on purpose: `question`, `edit`, `subagent` … are not "one more
+ *  read", and counting them would make the streak mean nothing. */
+export const NATIVE_CHAIN_TOOLS = new Set(["read", "grep", "glob", "shell"]);
+/** The tool that RESETS the streak: it is the alternative the hint points at, so
+ *  using it is the behaviour the guard exists to encourage. */
+export const CHAIN_RESET_TOOL = "execute";
+/** Stable marker so a replayed hook cannot append the line twice. */
+export const PROBE_CHAIN_MARKER = "（Code Mode 采用率提示）";
+export const DEFAULT_PROBE_CHAIN_AFTER = 3;
+/**
+ * The pure ledger.  `threshold` is the number of consecutive native calls after
+ * which the NEXT result carries the hint: with the default 3, calls 1-3 are
+ * silent and the 4th (and every one after it, until a reset) is advised.  A
+ * non-chain tool is transparent — it neither counts nor resets — and `execute`
+ * resets, because it is the alternative.
+ */
+export function createProbeChain(threshold) {
+    let count = 0;
+    return {
+        observe(tool) {
+            if (tool === CHAIN_RESET_TOOL) {
+                count = 0;
+                return { count, advise: false };
+            }
+            if (!NATIVE_CHAIN_TOOLS.has(tool))
+                return { count, advise: false };
+            count++;
+            return { count, advise: count > threshold };
+        },
+        streak: () => count,
+    };
+}
+/** The appended line, in the tool-output language the tm_* strings use. */
+export function renderProbeChainNote(count) {
+    return (`${PROBE_CHAIN_MARKER} 你已经连续 ${count} 次用原生 read/grep/glob/shell 逐个取数——` +
+        `这些调用可以折叠成一个 \`execute\`（Code Mode）程序：一次跑完多个受治理调用，只回一份汇总，省下 ${count - 1} 轮。` +
+        `下一步：把接下来的多次读取/搜索写进一个 execute 程序。`);
+}
+/**
+ * Append the line to the result's first text part, byte-exact otherwise.  Returns
+ * true only when a line was actually added — an unknown result shape, a missing
+ * text part, or an already-marked body all return false (the caller counts the
+ * difference).  The body is never rewritten: the original text is preserved
+ * verbatim and the line is appended after it.
+ */
+export function appendProbeChainNote(result, line) {
+    const r = result;
+    if (!r || !Array.isArray(r.content))
+        return false;
+    for (const p of r.content) {
+        if (!p || typeof p !== "object")
+            continue;
+        const part = p;
+        if (part.type !== "text" || typeof part.text !== "string")
+            continue;
+        if (part.text.includes(PROBE_CHAIN_MARKER))
+            return false;
+        part.text = `${part.text}\n\n${line}`;
+        return true;
+    }
+    return false;
+}
+export function applyV2ProbeChain(ctx, deps) {
+    const env = deps.env ?? process.env;
+    const report = { seen: 0, advised: 0, reset: 0, foreignSkipped: 0, threw: 0 };
+    const off = /^(0|false|no|off)$/i.test(String(env.TM_PROBE_CHAIN ?? "").trim());
+    const raw = String(env.TM_PROBE_CHAIN_AFTER ?? "").trim();
+    const parsed = raw === "" ? DEFAULT_PROBE_CHAIN_AFTER : Number(raw);
+    const threshold = Number.isFinite(parsed) ? Math.max(0, Math.floor(parsed)) : DEFAULT_PROBE_CHAIN_AFTER;
+    const disabled = off || threshold <= 0;
+    const hook = ctx?.tool?.hook;
+    if (typeof hook !== "function") {
+        // No seam at all: report it rather than pretending the hint is live.
+        return { registrations: [], report, active: false };
+    }
+    const chain = createProbeChain(threshold);
+    const reg = hook("execute.after", (rawEvent) => {
+        try {
+            const event = rawEvent;
+            const tool = String(event?.tool ?? "");
+            // The owner question comes FIRST: a foreign or unattributable session is
+            // left alone no matter which tool it called.
+            if (deps.scope) {
+                if (deps.scope.count(deps.scope.decide(event)) !== "ours") {
+                    report.foreignSkipped++;
+                    return;
+                }
+                deps.scope.learn(event.agent, event.sessionID);
+            }
+            if (disabled)
+                return;
+            if (tool === CHAIN_RESET_TOOL) {
+                report.reset++;
+                chain.observe(tool);
+                return;
+            }
+            if (!NATIVE_CHAIN_TOOLS.has(tool))
+                return;
+            report.seen++;
+            const verdict = chain.observe(tool);
+            if (!verdict.advise)
+                return;
+            if (!appendProbeChainNote(event.result, renderProbeChainNote(verdict.count)))
+                return;
+            report.advised++;
+            try {
+                deps.onAdvise?.({ tool, count: verdict.count, sessionID: event.sessionID });
+            }
+            catch {
+                /* the trajectory is an extra, never a reason to fail the call */
+            }
+        }
+        catch {
+            // A governance failure must never break somebody's tool call.
+            report.threw++;
+        }
+    });
+    return { registrations: [reg], report, active: !disabled };
+}
+//# sourceMappingURL=v2-probe-chain.js.map