@theokit/sdk 4.63.4 → 5.0.0-next.2

package/dist/{run-BYSHf58D.d.cts → run-CTAdRU3U.d.ts}

@@ -1,6 +1,10 @@
 import * as zod from 'zod';
 
 /**
+ * Owner: `types/` (2 of 2 importers: conversation.ts, updates.ts). The only module in this folder
+ * whose owner IS the layer — it exists to break a type-only cycle BETWEEN two of its siblings, so
+ * pointing it at a subsystem would name something that does not use it.
+ *
  * Type-leaf — base message types shared between `conversation.ts` and
  * `updates.ts`. Extracted to break LOW type-only cycle #6 (audit
  * `architecture-output/final_report.md`) per plan arch-review-fixes-2026-06-06
@@ -21,6 +25,12 @@ interface UserMessage {
     text: string;
 }
 
+/**
+ * Owner: `internal/agent-loop/` (1 of 1 importers). Derived from the import graph, not declared —
+ * `tests/lint/types-name-their-owner.test.ts` re-derives it.
+ *
+ */
+
 /**
  * Single tool call event. The internal `args` and `result` shapes are NOT stable.
  *
@@ -201,148 +211,9 @@ interface ShellOutputDeltaUpdate {
 type InteractionUpdate = TextDeltaUpdate | ThinkingDeltaUpdate | ThinkingCompletedUpdate | ToolCallStartedUpdate | ToolCallCompletedUpdate | PartialToolCallUpdate | TokenDeltaUpdate | StepStartedUpdate | StepCompletedUpdate | TurnEndedUpdate | UserMessageAppendedUpdate | SummaryUpdate | SummaryStartedUpdate | SummaryCompletedUpdate | ShellOutputDeltaUpdate;
 
 /**
- * `PermissionEngine` — first-match permission rules for tool invocations.
- *
- * Evaluates a tool name (and optional arguments, #55) against an ordered list
- * of rules. First matching rule wins; when no rule matches the `defaultAction`
- * is returned. #55 — the default is now `"ask"` (FAIL-CLOSED): a permission
- * engine that cannot positively allow must not silently allow. Opt back into
- * the previous fail-open behavior with `{ defaultAction: "allow" }`.
- */
-type PermissionAction = "allow" | "deny" | "ask";
-/**
- * SE1 — a per-run permission MODE that adjusts the rule-engine verdict globally.
- * A PURE post-processor of the verdict (no tool-safety metadata needed, so it fits
- * a bring-your-own-tools runtime). Grounded in a peer project (plan agent = deny-all,
- * `dangerously-skip-permissions`) + Codex (`AskForApproval`: `OnRequest` default,
- * `Never`, `UnlessTrusted`). See {@link applyMode} for the exact table.
- *
- * - `default` — verdict as-is (rules decide; unmatched ⇒ `ask`, fail-closed).
- * - `plan` — read-only: `allow` rules pass, everything else ⇒ `deny` (mutations blocked).
- *   NOTE: `plan` gates on the resolved verdict, so an engine configured with
- *   `{ defaultAction: "allow" }` still yields `allow` for UNMATCHED calls under
- *   `plan` — pair `plan` with the default fail-closed engine (`defaultAction: "ask"`)
- *   for full read-only behavior.
- * - `acceptEdits` — auto-approve the UNMATCHED verdict, but STILL honor an explicit
- *   `ask` rule (a caller gates a risky tool with an ask rule). Codex `UnlessTrusted`.
- * - `bypass` (alias `bypassPermissions`, the Anthropic-exact name) — everything ⇒
- *   `allow` EXCEPT an explicit `deny` rule. Never asks. a peer project
- *   `dangerously-skip-permissions` / Codex `Never` / Anthropic `bypassPermissions`.
- */
-type PermissionMode = "default" | "plan" | "acceptEdits" | "bypass" | "bypassPermissions";
-/**
- * SE1 — apply a {@link PermissionMode} to a rule-engine verdict. Pure.
- *
- * `explicit` is `true` when the verdict came from a rule that matched by name (and
- * args), `false` when it is the fail-closed default for an unmatched call. The flag
- * is load-bearing for `acceptEdits`, which auto-approves the unmatched default but
- * keeps honoring an explicit `ask` rule (unlike `bypass`, which allows even that).
- *
- * INVARIANT (both a peer project + Codex): an explicit `deny` is immune to EVERY
- * auto-approve mode — `bypass`/`acceptEdits` never un-deny.
- */
-declare function applyMode(verdict: PermissionAction, mode: PermissionMode, explicit: boolean): PermissionAction;
-/**
- * #55 — an argument matcher. A rule with `args` gates on the tool's argument
- * VALUES, not just its name: an exact string, a RegExp (tested against the
- * stringified value), or a predicate. Every declared arg must match for the
- * rule to apply — so `{ tool: "shell", args: { command: /rm\s+-rf/ } }` denies
- * a destructive shell call while leaving `ls` to fall through.
- */
-type ArgMatcher = string | RegExp | ((value: unknown) => boolean);
-/**
- * One entry in a {@link PermissionEngine}'s ordered rule list.
- *
- * Order is the semantics. The engine walks the list and the first rule whose `tool` matches — and
- * whose `args` matchers all pass, when it declares any — decides; nothing after it is consulted. Put
- * the narrow rules first: a catch-all `tool` RegExp placed above a specific deny makes that deny
- * unreachable, and nothing warns you.
- *
- * `args` is what lets one tool name resolve differently depending on what it is asked to do —
- * `{ tool: "shell", args: { command: /rm\s+-rf/ }, action: "deny" }` blocks the destructive call and
- * leaves `ls` to fall through to a later rule. Every declared matcher must pass.
- *
- * **A missing argument is NOT handled uniformly, and the difference bites in the unsafe direction.**
- * For a string or RegExp matcher, an argument the call did not supply fails the matcher, so the rule
- * does not match and evaluation continues. For a PREDICATE matcher the function is called anyway,
- * with `undefined`:
- *
- * ```ts
- * { tool: "shell", args: { command: (v) => v !== "prod" }, action: "allow" }
- * // evaluate("shell", {}) → the predicate gets `undefined`, returns true, the rule MATCHES,
- * // and a call that supplied no arguments at all is authorized.
+ * Owner: `internal/agent-loop/` (3 of 11 importers). Derived from the import graph, not declared —
+ * `tests/lint/types-name-their-owner.test.ts` re-derives it.
  *
- * { tool: "shell", args: { command: (v) => v.includes("rm") }, action: "deny" }
- * // evaluate("shell", {}) → TypeError thrown out of the permission gate.
- * ```
- *
- * Until that is fixed (issue #367), guard the parameter in every predicate you write —
- * `(v) => typeof v === "string" && v !== "prod"` — rather than relying on the matcher never being
- * reached.
- *
- * A rule that matches yields an EXPLICIT verdict, and that is what makes it survive a permissive
- * `PermissionMode`: `acceptEdits` auto-approves the unmatched default but still honours an explicit
- * `ask` rule, and an explicit `deny` is immune to every mode, `bypass` included.
- */
-interface PermissionRule {
-    /** Tool name (exact string) or pattern (RegExp). */
-    tool: string | RegExp;
-    /**
-     * #55 — optional per-argument matchers. When present, the rule matches only
-     * if the tool name matches AND every declared arg predicate matches the
-     * corresponding call argument. A missing/undefined arg fails its predicate
-     * (the rule does not match) — never throws.
-     */
-    args?: Record<string, ArgMatcher>;
-    /** Action to take when rule matches. */
-    action: PermissionAction;
-}
-/** Options for {@link PermissionEngine}. */
-interface PermissionEngineOptions {
-    /**
-     * Action when no rule matches. #55 — default is now `"ask"` (fail-closed): a
-     * permission engine that cannot positively allow must not silently allow.
-     * Pass `"allow"` to restore the previous fail-open behavior.
-     */
-    readonly defaultAction?: PermissionAction;
-}
-/**
- * Ordered first-match permission rules for tool invocations — the policy object you hand to
- * `PermissionPlugin.create()` to have it enforced.
- *
- * On its own it enforces nothing. `evaluate(toolName, args, mode)` is a pure function returning
- * `"allow" | "deny" | "ask"`, and no part of the SDK calls it until the engine is wrapped in a plugin
- * and that plugin is registered on an agent. The plugin is where a verdict becomes behaviour: `deny`
- * blocks the tool call, `allow` passes it through, and `ask` is routed to the host's `canUseTool`
- * gate — with no gate configured, `ask` blocks. So constructing an engine and never registering it
- * is a policy that does nothing, which is the mistake worth knowing about first.
- *
- * It is fail-closed by default: a call no rule matches resolves to `"ask"`, not `"allow"`, so a tool
- * the rules never mention needs a human — or an explicit `{ defaultAction: "allow" }` — before it
- * runs. Keep that default if you intend to use `PermissionMode: "plan"` for read-only behaviour,
- * because `plan` gates on the RESOLVED verdict: an engine built with `defaultAction: "allow"` still
- * allows every unmatched call under `plan`.
- *
- * The rules array is stored by reference and walked afresh on every `evaluate` call. Mutating the
- * array you passed in therefore changes the policy of a live engine; build a new engine when you
- * want a policy change to be a deliberate, visible event.
- */
-declare class PermissionEngine {
-    #private;
-    private readonly rules;
-    private readonly defaultAction;
-    constructor(rules: PermissionRule[], options?: PermissionEngineOptions);
-    /**
-     * Evaluate a tool name (and optional arguments) against the rules. First
-     * match wins; falls back to the configured `defaultAction` (default `"ask"`,
-     * fail-closed) when no rule matches. #55 — a rule with `args` gates on the
-     * argument values, so the same tool name can resolve to different actions
-     * depending on what it is asked to do.
-     */
-    evaluate(toolName: string, args?: Record<string, unknown>, mode?: PermissionMode): PermissionAction;
-}
-
-/**
  * SE2 — typed runtime EVENT stream, ADDITIVE to the `SDKMessage` content stream.
  *
  * `Run.stream()` yields `SDKMessage`s (the conversation content). `RunEvent`s are
@@ -360,7 +231,7 @@ declare class PermissionEngine {
  *
  * @public
  */
-type RunEvent = RunToolProgressEvent | RunRateLimitEvent | RunPermissionDeniedEvent | RunTaskStartedEvent | RunTaskUpdatedEvent | RunTaskCompletedEvent | RunCompactBoundaryEvent | RunCompactionFallbackEvent | RunTripwireEvent | RunCompletionCheckEvent | RunMcpServerFailedEvent | RunMcpServerReadyEvent;
+type RunEvent = RunToolProgressEvent | RunRateLimitEvent | RunPermissionDeniedEvent | RunTaskStartedEvent | RunTaskUpdatedEvent | RunTaskCompletedEvent | RunCompactBoundaryEvent | RunCompactionFallbackEvent | RunTripwireEvent | RunCompletionCheckEvent | RunMcpServerFailedEvent | RunMcpServerReadyEvent | RunMemoryDegradedEvent;
 /**
  * theokit#188 — an MCP server was configured but its tools could not be listed, so NONE of its
  * tools exist for this run.
@@ -501,19 +372,46 @@ interface RunCompactionFallbackEvent {
     readonly window: number;
 }
 /**
- * SE2 — the opt-in sink for {@link RunEvent}s. Supplied via `SendOptions.onRunEvent`.
- * Synchronous + best-effort: a throwing sink must never break the run (the emitter
- * try-catches it), so keep it fast (push to a queue, don't await).
+ * A memory stage failed and the run continued without it.
+ *
+ * The same shape of gap {@link RunMcpServerFailedEvent} closed for MCP, in the module next door.
+ * `initLoopContext` had three bare `catch { <field> = <empty> }` blocks: an init failure meant no
+ * memory tool was registered, a `buildTools` failure meant no provider tools, and a `runActivePass`
+ * failure meant no recalled context in the system prompt. The agent then answered without the memory
+ * it was configured with, and nothing recorded it — not stderr, not this sink, not the span in scope.
+ *
+ * Degrading to a working agent is the right BEHAVIOUR. This event exists because the degradation was
+ * unobservable, so a host UI showed a healthy run.
+ *
+ * Emitted once per failing stage per run.
+ *
+ * @public
  */
-type RunEventSink = (event: RunEvent) => void;
+interface RunMemoryDegradedEvent {
+    readonly type: "memory_degraded";
+    /** Which stage failed: `init`, `buildTools`, or `activePass`. */
+    readonly stage: string;
+    /** Why it failed, as the provider reported it. */
+    readonly message: string;
+}
 /**
- * SE2 — emit a {@link RunEvent} to an optional sink, swallowing any sink error so
- * observability can never break the run (fail-safe, mirrors the EventBus EC-2
- * contract). No-op when the sink is absent.
+ * Receives every {@link RunEvent} a run emits, in emission order.
+ *
+ * Wired through `onRunEvent` on the run options. The sink is observability, never control flow: it
+ * cannot cancel, alter, or delay the run, and {@link emitRunEvent} swallows anything it throws — a
+ * broken sink degrades what you can see, never what the agent does.
+ *
+ * Synchronous by signature, so a slow sink slows the run. Hand work off rather than awaiting inside
+ * it; returning a promise here would be ignored, not awaited.
+ *
+ * @public
  */
-declare function emitRunEvent(sink: RunEventSink | undefined, event: RunEvent): void;
+type RunEventSink = (event: RunEvent) => void;
 
 /**
+ * Owner: `internal/runtime/processors/` (3 of 4 importers). Derived from the import graph, not declared —
+ * `tests/lint/types-name-their-owner.test.ts` re-derives it.
+ *
  * SE24 — guardrail processor pipeline. A `Processor` inspects/transforms/blocks
  * the user message (input) or the model's final text (output). Processors run in
  * order; each may rewrite its payload, `abort(reason)` to stop the run (surfaced
@@ -599,6 +497,9 @@ interface ProcessorTripwire {
 }
 
 /**
+ * Owner: `src/` (2 of 7 importers). Derived from the import graph, not declared —
+ * `tests/lint/types-name-their-owner.test.ts` re-derives it.
+ *
  * Leaf module for content-block types shared by `messages.ts` (assistant/user
  * content) and `agent-prims.ts` (`CustomTool` handler results). Kept
  * import-free so both can depend on it WITHOUT the `agent-prims ↔ messages`
@@ -647,6 +548,9 @@ interface ImageBlock {
 type ToolResultContentBlock = TextBlock | ImageBlock;
 
 /**
+ * Owner: `internal/agent-loop/` (3 of 11 importers). Derived from the import graph, not
+ * declared — `tests/lint/types-name-their-owner.test.ts` re-derives it.
+ *
  * Type-leaf — primitives shared between `agent.ts`, `run.ts`, and
  * `messages.ts`. Extracted to break LOW type-only cycles #5 and #7
  * (audit `architecture-output/final_report.md`) per plan
@@ -762,6 +666,30 @@ interface CustomTool {
         threadId?: string;
     }) => string | ToolResultContentBlock[] | Promise<string | ToolResultContentBlock[]>;
 }
+/**
+ * How the permission engine treats the UNMATCHED verdict.
+ *
+ * - `default` — ask.
+ * - `plan` — read-only.
+ * - `acceptEdits` — auto-approve the unmatched verdict, but still honour an explicit `ask` rule.
+ * - `bypass` (alias `bypassPermissions`, the Anthropic-exact name) — everything allowed EXCEPT an
+ *   explicit `deny`. Never asks.
+ *
+ * G7 / DIP — defined in this type leaf rather than in `permission-engine.ts`, which is a RUNTIME
+ * module. `types/agent.ts`, `types/run.ts` and `types/plugin.ts` all need the union, and each one
+ * used to reach into the engine for it: three of the nine violations the `types-dont-import-runtime`
+ * rule reported the moment it was able to see type-only edges at all. The engine re-exports it, so
+ * `import type { PermissionMode } from "@theokit/sdk"` is unchanged.
+ *
+ * @public
+ */
+type PermissionMode = "default" | "plan" | "acceptEdits" | "bypass" | "bypassPermissions";
+
+/**
+ * Owner: `internal/agent-loop/` (4 of 8 importers). Derived from the import graph, not
+ * declared — `tests/lint/types-name-their-owner.test.ts` re-derives it.
+ *
+ */
 
 /**
  * Plain assistant message in a conversation history.
@@ -884,6 +812,9 @@ type ConversationTurn = {
 };
 
 /**
+ * Owner: `sandbox/` (1 of 2 importers). Derived from the import graph, not
+ * declared — `tests/lint/types-name-their-owner.test.ts` re-derives it.
+ *
  * Child-process environment policy contract (#54).
  *
  * The DIP-correct home for the `EnvPolicy` contract type: the domain `types/`
@@ -902,6 +833,12 @@ type ConversationTurn = {
  */
 type EnvPolicy = "inherit-scrubbed" | "core" | "all";
 
+/**
+ * Owner: `internal/mcp/` (2 of 5 importers). Derived from the import graph, not declared —
+ * `tests/lint/types-name-their-owner.test.ts` re-derives it.
+ *
+ */
+
 /**
  * MCP server configuration accepted by `Agent.create()` and `agent.send()`.
  *
@@ -987,6 +924,12 @@ type McpHttpServerConfig = {
  */
 type McpServerConfig = McpStdioServerConfig | McpHttpServerConfig;
 
+/**
+ * Owner: `internal/agent-loop/` (4 of 16 importers). Derived from the import graph, not declared —
+ * `tests/lint/types-name-their-owner.test.ts` re-derives it.
+ *
+ */
+
 /**
  * Tool invocation block emitted by the assistant.
  *
@@ -1142,6 +1085,9 @@ interface SDKObjectDelta {
 type SDKMessage = SDKSystemMessage | SDKUserMessageEvent | SDKAssistantMessage | SDKThinkingMessage | SDKToolUseMessage | SDKStatusMessage | SDKTaskMessage | SDKRequestMessage | SDKObjectDelta;
 
 /**
+ * Owner: `internal/budget/` (3 of 8 importers). Derived from the import graph, not declared —
+ * `tests/lint/types-name-their-owner.test.ts` re-derives it.
+ *
  * Public type contract for token usage + cost tracking (ADRs D376-D379).
  *
  * Surfaces via `RunResult.usage` + `RunResult.cost` after every Run.
@@ -1184,7 +1130,7 @@ type CostSource = "openrouter_api" | "litellm_snapshot" | "user_override" | "sub
 /**
  * Cost breakdown attached to `RunResult.cost`. When `status === "unknown"`,
  * `amountUsd` is `undefined` — DO NOT default to 0 (a lie). The UI shows
- * `n/a` para unknown, `~$1.23` para estimated, `$1.23` para actual.
+ * `n/a` for unknown, `~$1.23` for estimated, `$1.23` for actual.
  */
 interface CostBreakdown {
     readonly amountUsd: number | undefined;
@@ -1507,6 +1453,28 @@ interface SDKUserMessage {
 /**
  * Per-send overrides and callbacks.
  *
+ * ## Which options do I need?
+ *
+ * Twenty-one optional fields with genuinely different audiences, so most callers read all of them to
+ * find their two. This table is the fix that was chosen; the alternative — nesting the groups under
+ * `observe?` and `toolPolicy?` and carrying the flat keys as deprecated aliases for one major — would
+ * have added surface to remove surface, and the harm here is the READING cost, not a representable
+ * illegal state. There is no measured defect behind this grouping and no consumer census; the fields
+ * and the audiences are what was measured.
+ *
+ * | If you are… | you want |
+ * |---|---|
+ * | rendering a live UI | `onDelta`, `onStep`, `onRunEvent` |
+ * | applying a policy | `permissionMode`, `activeTools`, `toolChoice`, `toolResultGuard`, `perToolTimeoutMs` |
+ * | running an eval or a harness | `maxIterations`, `completionCheck`, `doomLoop`, `signal` |
+ * | orchestrating agents | `origin`, `task`, `context` |
+ * | overriding this one send | `model`, `systemPrompt`, `tools`, `mcpServers`, `contextPaths`, `local` |
+ *
+ * Every field appears in exactly one row, and
+ * `tests/lint/send-options-audience-table.test.ts` fails when one is added without a row — a table
+ * that silently stops covering the type is worse than none, because a reader trusts it and stops
+ * looking.
+ *
  * @public
  */
 interface SendOptions {
@@ -1842,4 +1810,4 @@ interface GenerateRunResult<O> {
     };
 }
 
-export { type RunToCompletionOptions as $, type AgentConversationTurn as A, type ProcessorControls as B, type CustomTool as C, type DoomLoopThresholds as D, type ProcessorTripwire as E, type ProcessorViolation as F, type GenerateOptions as G, type RunCompactBoundaryEvent as H, type ImageBlock as I, type RunCompletionCheckEvent as J, type RunErrorDetail as K, type RunEvent as L, type ModelSelection as M, type RunGitInfo as N, type OutputProcessorContext as O, type Processor as P, type RunOperation as Q, type RunResult as R, type SDKMessage as S, type ToolResultContentBlock as T, type RunPermissionDeniedEvent as U, type RunRateLimitEvent as V, type RunStatus as W, type RunTaskCompletedEvent as X, type RunTaskStartedEvent as Y, type RunTaskUpdatedEvent as Z, type RunTimelineEvent as _, type McpServerConfig as a, type RunToCompletionResult as a0, type RunToolProgressEvent as a1, type RunTripwireEvent as a2, type SDKAssistantMessage as a3, type SDKImage as a4, type SDKImageDimension as a5, type SDKObjectDelta as a6, type SDKRequestMessage as a7, type SDKStatusMessage as a8, type SDKSystemMessage as a9, type ToolContextMessage as aA, type ToolResult as aB, type ToolResultGuardOptions as aC, type ToolUseBlock as aD, type TurnEndedUpdate as aE, type UserMessage as aF, type UserMessageAppendedUpdate as aG, applyMode as aH, emitRunEvent as aI, type SDKTaskMessage as aa, type SDKThinkingMessage as ab, type SDKToolUseMessage as ac, type SDKUserMessage as ad, type SDKUserMessageEvent as ae, type SendOptions as af, type ShellCommand as ag, type ShellConversationTurn as ah, type ShellOutput as ai, type ShellOutputDeltaUpdate as aj, type StepCompletedUpdate as ak, type StepStartedUpdate as al, type StreamToCompletionResult as am, type SummaryCompletedUpdate as an, type SummaryStartedUpdate as ao, type SummaryUpdate as ap, type TextBlock as aq, type TextDeltaUpdate as ar, type ThinkingCompletedUpdate as as, type ThinkingDeltaUpdate as at, type ThinkingMessage as au, type TokenDeltaUpdate as av, type TokenUsage as aw, type ToolCall as ax, type ToolCallCompletedUpdate as ay, type ToolCallStartedUpdate as az, type Run as b, type PermissionMode as c, PermissionEngine as d, type RunEventSink as e, type AssistantMessage as f, type CompletionCheck as g, type CompletionCheckResult as h, type ConversationStep as i, type ConversationTurn as j, type CostBreakdown as k, type CostSource as l, type CostStatus as m, type GenerateRunResult as n, type InputProcessorContext as o, type InteractionUpdate as p, type McpAuthConfig as q, type McpHttpServerConfig as r, type McpOAuthConfig as s, type McpStdioServerConfig as t, type MessageOrigin as u, type ModelParameterValue as v, type PartialToolCallUpdate as w, type PermissionAction as x, type PermissionEngineOptions as y, type PermissionRule as z };
+export type { RunTripwireEvent as $, AgentConversationTurn as A, RunCompletionCheckEvent as B, CustomTool as C, DoomLoopThresholds as D, RunErrorDetail as E, RunEvent as F, GenerateOptions as G, RunGitInfo as H, ImageBlock as I, RunMemoryDegradedEvent as J, RunOperation as K, RunPermissionDeniedEvent as L, ModelSelection as M, RunRateLimitEvent as N, OutputProcessorContext as O, Processor as P, RunStatus as Q, RunResult as R, SDKMessage as S, ToolResultContentBlock as T, RunTaskCompletedEvent as U, RunTaskStartedEvent as V, RunTaskUpdatedEvent as W, RunTimelineEvent as X, RunToCompletionOptions as Y, RunToCompletionResult as Z, RunToolProgressEvent as _, McpServerConfig as a, SDKAssistantMessage as a0, SDKImage as a1, SDKImageDimension as a2, SDKObjectDelta as a3, SDKRequestMessage as a4, SDKStatusMessage as a5, SDKSystemMessage as a6, SDKTaskMessage as a7, SDKThinkingMessage as a8, SDKToolUseMessage as a9, ToolUseBlock as aA, TurnEndedUpdate as aB, UserMessage as aC, UserMessageAppendedUpdate as aD, SDKUserMessage as aa, SDKUserMessageEvent as ab, SendOptions as ac, ShellCommand as ad, ShellConversationTurn as ae, ShellOutput as af, ShellOutputDeltaUpdate as ag, StepCompletedUpdate as ah, StepStartedUpdate as ai, StreamToCompletionResult as aj, SummaryCompletedUpdate as ak, SummaryStartedUpdate as al, SummaryUpdate as am, TextBlock as an, TextDeltaUpdate as ao, ThinkingCompletedUpdate as ap, ThinkingDeltaUpdate as aq, ThinkingMessage as ar, TokenDeltaUpdate as as, TokenUsage as at, ToolCall as au, ToolCallCompletedUpdate as av, ToolCallStartedUpdate as aw, ToolContextMessage as ax, ToolResult as ay, ToolResultGuardOptions as az, Run as b, PermissionMode as c, RunEventSink as d, AssistantMessage as e, CompletionCheck as f, CompletionCheckResult as g, ConversationStep as h, ConversationTurn as i, CostBreakdown as j, CostSource as k, CostStatus as l, GenerateRunResult as m, InputProcessorContext as n, InteractionUpdate as o, McpAuthConfig as p, McpHttpServerConfig as q, McpOAuthConfig as r, McpStdioServerConfig as s, MessageOrigin as t, ModelParameterValue as u, PartialToolCallUpdate as v, ProcessorControls as w, ProcessorTripwire as x, ProcessorViolation as y, RunCompactBoundaryEvent as z };

package/dist/{run-until-HEQOUVU6.js → run-until-6D6TQ4JN.js}

@@ -1,6 +1,12 @@
 import { GOAL_CONTINUATION_MARKER } from './chunk-PY2RQOA7.js';
 
 // src/internal/runtime/lifecycle/run-until.ts
+var ABORTED_MID_RUN = "aborted via AbortSignal";
+var pausedBy = (reason) => ({
+  type: "status_change",
+  status: "paused",
+  reason
+});
 async function* runUntilImpl(agent, goal, options, deps) {
   const maxTurns = options?.maxTurns ?? 20;
   const maxFails = options?.maxConsecutiveJudgeFailures ?? 3;
@@ -11,31 +17,28 @@ async function* runUntilImpl(agent, goal, options, deps) {
   let consecutiveFailures = 0;
   let tokensUsed = 0;
   let lastResponse = "";
+  const finish = (status) => ({
+    status,
+    turnsUsed: turn,
+    tokensUsed,
+    finalResponse: lastResponse || void 0
+  });
   if (isAborted()) {
-    yield {
-      type: "status_change",
-      status: "paused",
-      reason: "aborted via AbortSignal before first turn"
-    };
-    return { status: "paused", turnsUsed: 0, tokensUsed, finalResponse: void 0 };
+    yield pausedBy("aborted via AbortSignal before first turn");
+    return finish("paused");
   }
   yield { type: "status_change", status: "active", reason: "Goal started" };
   while (turn < maxTurns) {
     if (isAborted()) {
-      yield { type: "status_change", status: "paused", reason: "aborted via AbortSignal" };
-      return {
-        status: "paused",
-        turnsUsed: turn,
-        tokensUsed,
-        finalResponse: lastResponse || void 0
-      };
+      yield pausedBy(ABORTED_MID_RUN);
+      return finish("paused");
     }
     turn += 1;
     yield { type: "turn_start", turn, goal };
     const continuationPrompt = turn === 1 ? goal : composeContinuation(goal, lastResponse);
     const run = await agent.send(continuationPrompt);
     const cancelOnAbort = () => {
-      void run.cancel?.();
+      void run.cancel();
     };
     if (signal !== void 0) {
       if (signal.aborted) cancelOnAbort();
@@ -47,13 +50,8 @@ async function* runUntilImpl(agent, goal, options, deps) {
     const turnTokens = result.usage?.totalTokens;
     if (typeof turnTokens === "number") tokensUsed += turnTokens;
     if (isAborted()) {
-      yield { type: "status_change", status: "paused", reason: "aborted via AbortSignal" };
-      return {
-        status: "paused",
-        turnsUsed: turn,
-        tokensUsed,
-        finalResponse: lastResponse || void 0
-      };
+      yield pausedBy(ABORTED_MID_RUN);
+      return finish("paused");
     }
     yield { type: "agent_response", turn, content: lastResponse };
     const judgeOpts = {};
@@ -78,33 +76,18 @@ async function* runUntilImpl(agent, goal, options, deps) {
           status: "failed",
           reason: `judge model too unreliable (${consecutiveFailures} parse failures in a row)`
         };
-        return {
-          status: "failed",
-          turnsUsed: turn,
-          tokensUsed,
-          finalResponse: lastResponse || void 0
-        };
+        return finish("failed");
       }
     } else {
       consecutiveFailures = 0;
     }
     if (judgment.verdict === "done") {
       yield { type: "status_change", status: "completed", reason: judgment.reason };
-      return {
-        status: "completed",
-        turnsUsed: turn,
-        tokensUsed,
-        finalResponse: lastResponse || void 0
-      };
+      return finish("completed");
     }
     if (judgment.verdict === "blocked") {
       yield { type: "status_change", status: "blocked", reason: judgment.reason };
-      return {
-        status: "blocked",
-        turnsUsed: turn,
-        tokensUsed,
-        finalResponse: lastResponse || void 0
-      };
+      return finish("blocked");
     }
     if (judgment.verdict === "skipped") {
       yield {
@@ -112,12 +95,7 @@ async function* runUntilImpl(agent, goal, options, deps) {
         status: "completed",
         reason: `skipped: ${judgment.reason}`
       };
-      return {
-        status: "completed",
-        turnsUsed: turn,
-        tokensUsed,
-        finalResponse: lastResponse || void 0
-      };
+      return finish("completed");
     }
     if (tokenBudget !== void 0 && tokensUsed >= tokenBudget) {
       yield {
@@ -125,12 +103,7 @@ async function* runUntilImpl(agent, goal, options, deps) {
         status: "budget_limited",
         reason: `token budget (${tokenBudget}) reached: ${tokensUsed} used`
       };
-      return {
-        status: "budget_limited",
-        turnsUsed: turn,
-        tokensUsed,
-        finalResponse: lastResponse || void 0
-      };
+      return finish("budget_limited");
     }
     yield { type: "continuation", turn, prompt: continuationPrompt };
   }
@@ -139,12 +112,7 @@ async function* runUntilImpl(agent, goal, options, deps) {
     status: "failed",
     reason: `max turns (${maxTurns}) exhausted`
   };
-  return {
-    status: "failed",
-    turnsUsed: turn,
-    tokensUsed,
-    finalResponse: lastResponse || void 0
-  };
+  return finish("failed");
 }
 function composeContinuation(goal, lastResponse) {
   return [
@@ -174,5 +142,5 @@ ${lastResponse.slice(-1e3)}`
 }
 
 export { composeContinuation, runUntilImpl };
-//# sourceMappingURL=run-until-HEQOUVU6.js.map
-//# sourceMappingURL=run-until-HEQOUVU6.js.map
+//# sourceMappingURL=run-until-6D6TQ4JN.js.map
+//# sourceMappingURL=run-until-6D6TQ4JN.js.map

package/dist/run-until-6D6TQ4JN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/lifecycle/run-until.ts"],"names":[],"mappings":";;;AA+BA,IAAM,eAAA,GAAkB,yBAAA;AAOxB,IAAM,QAAA,GAAW,CAAC,MAAA,MAA+B;AAAA,EAC/C,IAAA,EAAM,eAAA;AAAA,EACN,MAAA,EAAQ,QAAA;AAAA,EACR;AACF,CAAA,CAAA;AAGA,gBAAuB,YAAA,CACrB,KAAA,EACA,IAAA,EACA,OAAA,EACA,IAAA,EAC6C;AAC7C,EAAA,MAAM,QAAA,GAAW,SAAS,QAAA,IAAY,EAAA;AACtC,EAAA,MAAM,QAAA,GAAW,SAAS,2BAAA,IAA+B,CAAA;AACzD,EAAA,MAAM,cAAc,OAAA,EAAS,WAAA;AAC7B,EAAA,MAAM,SAAS,OAAA,EAAS,MAAA;AAKxB,EAAA,MAAM,SAAA,GAAY,MAAe,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,OAAA;AAChE,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,IAAI,mBAAA,GAAsB,CAAA;AAC1B,EAAA,IAAI,UAAA,GAAa,CAAA;AACjB,EAAA,IAAI,YAAA,GAAe,EAAA;AAWnB,EAAA,MAAM,MAAA,GAAS,CAAC,MAAA,MAA8C;AAAA,IAC5D,MAAA;AAAA,IACA,SAAA,EAAW,IAAA;AAAA,IACX,UAAA;AAAA,IACA,eAAe,YAAA,IAAgB;AAAA,GACjC,CAAA;AAGA,EAAA,IAAI,WAAU,EAAG;AACf,IAAA,MAAM,SAAS,2CAA2C,CAAA;AAE1D,IAAA,OAAO,OAAO,QAAQ,CAAA;AAAA,EACxB;AAEA,EAAA,MAAM,EAAE,IAAA,EAAM,eAAA,EAAiB,MAAA,EAAQ,QAAA,EAAU,QAAQ,cAAA,EAAe;AAExE,EAAA,OAAO,OAAO,QAAA,EAAU;AACtB,IAAA,IAAI,WAAU,EAAG;AACf,MAAA,MAAM,SAAS,eAAe,CAAA;AAC9B,MAAA,OAAO,OAAO,QAAQ,CAAA;AAAA,IACxB;AAEA,IAAA,IAAA,IAAQ,CAAA;AACR,IAAA,MAAM,EAAE,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,IAAA,EAAK;AAEvC,IAAA,MAAM,qBAAqB,IAAA,KAAS,CAAA,GAAI,IAAA,GAAO,mBAAA,CAAoB,MAAM,YAAY,CAAA;AAErF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,kBAAkB,CAAA;AAS/C,IAAA,MAAM,gBAAgB,MAAY;AAChC,MAAA,KAAK,IAAI,MAAA,EAAO;AAAA,IAClB,CAAA;AACA,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,IAAI,MAAA,CAAO,SAAS,aAAA,EAAc;AAAA,kBACtB,gBAAA,CAAiB,OAAA,EAAS,eAAe,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,IACrE;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,MAAA,CAAO,mBAAA,CAAoB,SAAS,aAAa,CAAA;AAC3E,IAAA,YAAA,GAAe,OAAO,MAAA,IAAU,EAAA;AAEhC,IAAA,MAAM,UAAA,GAAa,OAAO,KAAA,EAAO,WAAA;AACjC,IAAA,IAAI,OAAO,UAAA,KAAe,QAAA,EAAU,UAAA,IAAc,UAAA;AAElD,IAAA,IAAI,WAAU,EAAG;AACf,MAAA,MAAM,SAAS,eAAe,CAAA;AAC9B,MAAA,OAAO,OAAO,QAAQ,CAAA;AAAA,IACxB;AACA,IAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,SAAS,YAAA,EAAa;AAE5D,IAAA,MAAM,YAA0B,EAAC;AACjC,IAAA,IAAI,OAAA,EAAS,UAAA,KAAe,MAAA,EAAW,SAAA,CAAU,aAAa,OAAA,CAAQ,UAAA;AACtE,IAAA,IAAI,OAAA,EAAS,WAAA,KAAgB,MAAA,EAAW,SAAA,CAAU,SAAS,OAAA,CAAQ,WAAA;AAEnE,IAAA,IAAI,OAAA,EAAS,UAAA,KAAe,MAAA,EAAW,SAAA,CAAU,aAAa,OAAA,CAAQ,UAAA;AACtE,IAAA,MAAM,QAAA,GAAyB,EAAE,IAAA,EAAM,YAAA,EAAa;AACpD,IAAA,IAAI,OAAA,EAAS,QAAA,KAAa,MAAA,EAAW,QAAA,CAAS,WAAW,OAAA,CAAQ,QAAA;AACjE,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,UAAU,SAAS,CAAA;AACrD,IAAA,MAAM;AAAA,MACJ,IAAA,EAAM,eAAA;AAAA,MACN,IAAA;AAAA,MACA,SAAS,QAAA,CAAS,OAAA;AAAA,MAClB,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,aAAa,QAAA,CAAS;AAAA,KACxB;AAEA,IAAA,IAAI,SAAS,WAAA,EAAa;AACxB,MAAA,mBAAA,IAAuB,CAAA;AACvB,MAAA,IAAI,uBAAuB,QAAA,EAAU;AACnC,QAAA,MAAM;AAAA,UACJ,IAAA,EAAM,eAAA;AAAA,UACN,MAAA,EAAQ,QAAA;AAAA,UACR,MAAA,EAAQ,+BAA+B,mBAAmB,CAAA,yBAAA;AAAA,SAC5D;AACA,QAAA,OAAO,OAAO,QAAQ,CAAA;AAAA,MACxB;AAAA,IACF,CAAA,MAAO;AACL,MAAA,mBAAA,GAAsB,CAAA;AAAA,IACxB;AAEA,IAAA,IAAI,QAAA,CAAS,YAAY,MAAA,EAAQ;AAC/B,MAAA,MAAM,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAQ,WAAA,EAAa,MAAA,EAAQ,SAAS,MAAA,EAAO;AAC5E,MAAA,OAAO,OAAO,WAAW,CAAA;AAAA,IAC3B;AAKA,IAAA,IAAI,QAAA,CAAS,YAAY,SAAA,EAAW;AAClC,MAAA,MAAM,EAAE,IAAA,EAAM,eAAA,EAAiB,QAAQ,SAAA,EAAW,MAAA,EAAQ,SAAS,MAAA,EAAO;AAC1E,MAAA,OAAO,OAAO,SAAS,CAAA;AAAA,IACzB;AACA,IAAA,IAAI,QAAA,CAAS,YAAY,SAAA,EAAW;AAClC,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,eAAA;AAAA,QACN,MAAA,EAAQ,WAAA;AAAA,QACR,MAAA,EAAQ,CAAA,SAAA,EAAY,QAAA,CAAS,MAAM,CAAA;AAAA,OACrC;AACA,MAAA,OAAO,OAAO,WAAW,CAAA;AAAA,IAC3B;AAGA,IAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,UAAA,IAAc,WAAA,EAAa;AAC1D,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,eAAA;AAAA,QACN,MAAA,EAAQ,gBAAA;AAAA,QACR,MAAA,EAAQ,CAAA,cAAA,EAAiB,WAAW,CAAA,WAAA,EAAc,UAAU,CAAA,KAAA;AAAA,OAC9D;AACA,MAAA,OAAO,OAAO,gBAAgB,CAAA;AAAA,IAChC;AAEA,IAAA,MAAM,EAAE,IAAA,EAAM,cAAA,EAAgB,IAAA,EAAM,QAAQ,kBAAA,EAAmB;AAAA,EACjE;AAEA,EAAA,MAAM;AAAA,IACJ,IAAA,EAAM,eAAA;AAAA,IACN,MAAA,EAAQ,QAAA;AAAA,IACR,MAAA,EAAQ,cAAc,QAAQ,CAAA,WAAA;AAAA,GAChC;AACA,EAAA,OAAO,OAAO,QAAQ,CAAA;AACxB;AASO,SAAS,mBAAA,CAAoB,MAAc,YAAA,EAA8B;AAI9E,EAAA,OAAO;AAAA,IACL,wBAAA;AAAA,IACA,0CAAA;AAAA,IACA,EAAA;AAAA,IACA,CAAA;AAAA,EAAgB,IAAI;AAAA,YAAA,CAAA;AAAA,IACpB,EAAA;AAAA,IACA,wBAAA;AAAA,IACA,kGAAA;AAAA,IACA,mGAAA;AAAA,IACA,2BAAA;AAAA,IACA,EAAA;AAAA,IACA,qBAAA;AAAA,IACA,kGAAA;AAAA,IACA,uGAAA;AAAA,IACA,EAAA;AAAA,IACA,mBAAA;AAAA,IACA,uGAAA;AAAA,IACA,oGAAA;AAAA,IACA,EAAA;AAAA,IACA,CAAA;AAAA,EAA4B,YAAA,CAAa,KAAA,CAAM,IAAK,CAAC,CAAA;AAAA,GACvD,CAAE,KAAK,IAAI,CAAA;AACb","file":"run-until-6D6TQ4JN.js","sourcesContent":["/**\n * Goal-driven Ralph loop (T3.2, ADRs D115-D121).\n *\n * `runUntilImpl` is an `AsyncGenerator<GoalEvent, GoalResult, void>`:\n * yields events as the loop progresses, returns the final result when\n * the goal completes, fails, or is paused. The auxiliary judge model is\n * injected via `deps.judge` so the generator stays free of the `Agent`\n * façade import.\n *\n * EC-C fix: pre-aborted signals emit only `[paused]`, not `[active, paused]`.\n * EC-D: `maxTurns: 0` is supported (vacuous yield active → failed).\n *\n * @internal\n */\n\nimport type { SDKAgent } from \"../../../types/agent.js\";\nimport type {\n  GoalEvent,\n  GoalOptions,\n  GoalResult,\n  JudgeResult,\n} from \"../../../types/goal-events.js\";\nimport type { JudgeContext, JudgeOptions } from \"../../judge/judge-call.js\";\nimport { GOAL_CONTINUATION_MARKER } from \"./goal-marker.js\";\n\n/** DI contract: the judge is the only external touchpoint. */\nexport interface RunUntilDeps {\n  judge: (ctx: JudgeContext, opts?: JudgeOptions) => Promise<JudgeResult>;\n}\n\n/** The reason both in-loop abort checks report; the pre-loop one distinguishes itself. */\nconst ABORTED_MID_RUN = \"aborted via AbortSignal\";\n\n/**\n * The pause event, built in one place. Three sites emitted the same four-line literal with only the\n * reason varying — the same duplicated-knowledge shape as `finish` below, at the event boundary\n * instead of the result boundary.\n */\nconst pausedBy = (reason: string): GoalEvent => ({\n  type: \"status_change\",\n  status: \"paused\",\n  reason,\n});\n\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: the goal-loop interleaves turn-start, send, judge, continuation, abort-check and failure-bail — extracting the CONTROL FLOW into helpers harms that linear narrative, and this defends only that. What it never covered were the nine hand-built result literals and the three pause events, which moved to `finish` and `pausedBy` above: neither removes a branch. Measured 2026-09-01: 43 -> 31 cognitive, 150 -> 117 lines.\nexport async function* runUntilImpl(\n  agent: SDKAgent,\n  goal: string,\n  options: GoalOptions | undefined,\n  deps: RunUntilDeps,\n): AsyncGenerator<GoalEvent, GoalResult, void> {\n  const maxTurns = options?.maxTurns ?? 20;\n  const maxFails = options?.maxConsecutiveJudgeFailures ?? 3;\n  const tokenBudget = options?.tokenBudget; // M55 — undefined ⇒ unlimited\n  const signal = options?.signal;\n  // Use a function (not direct property access) so TS does not narrow\n  // `signal.aborted` to `false | undefined` after the initial check.\n  // AbortSignal.aborted is a getter that can flip true between calls.\n  // biome-ignore lint/complexity/useOptionalChain: optional-chain would re-narrow signal?.aborted to `false | undefined` after the first check, defeating the purpose of this helper.\n  const isAborted = (): boolean => signal !== undefined && signal.aborted;\n  let turn = 0;\n  let consecutiveFailures = 0;\n  let tokensUsed = 0; // M55 — the observed sum (0 when usage is absent — fail-open)\n  let lastResponse = \"\";\n  /**\n   * The one place a `GoalResult` is built. Every exit went through the same four-field literal with\n   * only the status varying, nine times, each restating the convention that an empty final response\n   * collapses to `undefined` — duplicated KNOWLEDGE, so adding a field to `GoalResult` was a\n   * nine-site edit where missing one produces a result wrong on a single branch.\n   *\n   * It is a closure over `turn`, `tokensUsed` and `lastResponse` rather than a module function\n   * precisely so the call sites stay one word long: the biome-ignore below argues that the loop's\n   * narrative must read linearly, and this removes no branch and moves no decision.\n   */\n  const finish = (status: GoalResult[\"status\"]): GoalResult => ({\n    status,\n    turnsUsed: turn,\n    tokensUsed,\n    finalResponse: lastResponse || undefined,\n  });\n\n  // EC-C: signal already aborted BEFORE first event → emit only [paused].\n  if (isAborted()) {\n    yield pausedBy(\"aborted via AbortSignal before first turn\");\n    // `turn` is 0 and `lastResponse` is \"\" at this point, so this is the literal it replaces.\n    return finish(\"paused\");\n  }\n\n  yield { type: \"status_change\", status: \"active\", reason: \"Goal started\" };\n\n  while (turn < maxTurns) {\n    if (isAborted()) {\n      yield pausedBy(ABORTED_MID_RUN);\n      return finish(\"paused\");\n    }\n\n    turn += 1;\n    yield { type: \"turn_start\", turn, goal };\n\n    const continuationPrompt = turn === 1 ? goal : composeContinuation(goal, lastResponse);\n\n    const run = await agent.send(continuationPrompt);\n    // M55 review HIGH — thread the abort INTO the in-flight run: without this, Esc mid-turn is\n    // cosmetic (the turn keeps mutating the workspace until it finishes on its own). `run.cancel()`\n    // aborts the stream + in-flight tool calls (types/run.ts contract).\n    // Called directly, not through a hand-written shape. `SDKAgent.send()` returns `Promise<Run>`\n    // and `Run.cancel(): Promise<void>` is declared in `types/run.ts` — the cast re-declared, less\n    // precisely, what the compiler already knew, and `cancel?.()` through it meant a rename would\n    // keep compiling while Esc mid-turn silently went back to being cosmetic. Which is the exact\n    // defect the comment above says this was added to fix.\n    const cancelOnAbort = (): void => {\n      void run.cancel();\n    };\n    if (signal !== undefined) {\n      if (signal.aborted) cancelOnAbort();\n      else signal.addEventListener(\"abort\", cancelOnAbort, { once: true });\n    }\n    const result = await run.wait();\n    if (signal !== undefined) signal.removeEventListener(\"abort\", cancelOnAbort);\n    lastResponse = result.result ?? \"\";\n    // M55 — token accounting fails open: it only sums when the run reports usage.\n    const turnTokens = result.usage?.totalTokens;\n    if (typeof turnTokens === \"number\") tokensUsed += turnTokens;\n    // Re-check aborted right after the turn lands: a cancelled turn must NOT spend a judge call.\n    if (isAborted()) {\n      yield pausedBy(ABORTED_MID_RUN);\n      return finish(\"paused\");\n    }\n    yield { type: \"agent_response\", turn, content: lastResponse };\n\n    const judgeOpts: JudgeOptions = {};\n    if (options?.judgeModel !== undefined) judgeOpts.judgeModel = options.judgeModel;\n    if (options?.judgeApiKey !== undefined) judgeOpts.apiKey = options.judgeApiKey;\n    // M80 — forwards the driven agent's model so the judge can derive when `judgeModel` is omitted.\n    if (options?.agentModel !== undefined) judgeOpts.agentModel = options.agentModel;\n    const judgeCtx: JudgeContext = { goal, lastResponse };\n    if (options?.subgoals !== undefined) judgeCtx.subgoals = options.subgoals;\n    const judgment = await deps.judge(judgeCtx, judgeOpts);\n    yield {\n      type: \"judge_verdict\",\n      turn,\n      verdict: judgment.verdict,\n      reason: judgment.reason,\n      parseFailed: judgment.parseFailed,\n    };\n\n    if (judgment.parseFailed) {\n      consecutiveFailures += 1;\n      if (consecutiveFailures >= maxFails) {\n        yield {\n          type: \"status_change\",\n          status: \"failed\",\n          reason: `judge model too unreliable (${consecutiveFailures} parse failures in a row)`,\n        };\n        return finish(\"failed\");\n      }\n    } else {\n      consecutiveFailures = 0;\n    }\n\n    if (judgment.verdict === \"done\") {\n      yield { type: \"status_change\", status: \"completed\", reason: judgment.reason };\n      return finish(\"completed\");\n    }\n    // M80 — the missing arm. Without it, a judge recognizing impossibility could only say\n    // \"continue\", and the loop repeated the same turn until it blew the budget — reporting `failed` on\n    // a limit rather than `blocked` on impossibility. Two distinct causes with the same\n    // visible outcome, and the consumer had to reconcile after the loop to tell them apart.\n    if (judgment.verdict === \"blocked\") {\n      yield { type: \"status_change\", status: \"blocked\", reason: judgment.reason };\n      return finish(\"blocked\");\n    }\n    if (judgment.verdict === \"skipped\") {\n      yield {\n        type: \"status_change\",\n        status: \"completed\",\n        reason: `skipped: ${judgment.reason}`,\n      };\n      return finish(\"completed\");\n    }\n\n    // M55 — token-budget check AFTER the turn (Codex: gentle wind-down, stops the loop).\n    if (tokenBudget !== undefined && tokensUsed >= tokenBudget) {\n      yield {\n        type: \"status_change\",\n        status: \"budget_limited\",\n        reason: `token budget (${tokenBudget}) reached: ${tokensUsed} used`,\n      };\n      return finish(\"budget_limited\");\n    }\n\n    yield { type: \"continuation\", turn, prompt: continuationPrompt };\n  }\n\n  yield {\n    type: \"status_change\",\n    status: \"failed\",\n    reason: `max turns (${maxTurns}) exhausted`,\n  };\n  return finish(\"failed\");\n}\n\n/**\n * Build the continuation user message for turns 2+. Keeps last response\n * preview short so we don't bloat the prompt cache.\n *\n * @internal\n */\n\nexport function composeContinuation(goal: string, lastResponse: string): string {\n  // M55 — Codex-faithful continuation (ext/goal templates/goals/continuation.md): keep the FULL\n  // objective intact, work from current-state evidence, and audit completion requirement-by-requirement\n  // before declaring done. Improves the quality of what the judge then evaluates.\n  return [\n    GOAL_CONTINUATION_MARKER,\n    \"Continue working toward the active goal.\",\n    \"\",\n    `<objective>\\n${goal}\\n</objective>`,\n    \"\",\n    \"Continuation behavior:\",\n    \"- This goal persists across turns. Keep the full objective intact; if it cannot be finished now,\",\n    \"  make concrete progress toward the real requested end state and do not redefine success around a\",\n    \"  smaller or easier task.\",\n    \"\",\n    \"Work from evidence:\",\n    \"- Use the current worktree and external state as authoritative. Inspect the current state before\",\n    \"  relying on it. Improve, replace, or remove existing work as needed to satisfy the actual objective.\",\n    \"\",\n    \"Completion audit:\",\n    \"- Before deciding the goal is achieved, treat completion as unproven and verify it against the actual\",\n    \"  current state, requirement by requirement. Treat uncertain or indirect evidence as not achieved.\",\n    \"\",\n    `Your last response was:\\n${lastResponse.slice(-1000)}`,\n  ].join(\"\\n\");\n}\n"]}