@theoremjs/agents 0.3.0 → 0.3.1

package/esm/src/guardrails/progressive-yield.js

@@ -1,63 +1,36 @@
 import { canaryOpeningFrom, createCanaryScanner, promptLeakCarry, RELEASED_LOOKBACK, } from './canary.js';
-import { CANARY_HIT, promptEchoHits, runEnforcer } from './egress.js';
-import { streamPlanOf } from './egress-stream.js';
-import { TheoremError } from './error.js';
+import { detectReads, scopeOf } from './detect-at.js';
+import { createDetectStream } from './detect-stream.js';
+import { promptEchoHits } from './egress.js';
+import { loadEgressAutomata } from './egress-stream.js';
+import { CANARY_HIT } from './hits.js';
 import { promptEchoHoldFrom, promptEchoScanFrom } from './prompt-echo.js';
-import { EGRESS_RULES } from './rules.js';
-/** Default lookback under a host `egress.enforce` the gate cannot read. */
-const DEFAULT_HOLDBACK = 256;
-/**
- * Default lookback on Live under a host policy the gate cannot read, where the
- * held transcript holds back audio too: the shortest that shows the host no
- * character of any egress corpus match however the transcript is chunked
- * (88), with a margin.
- */
-const LIVE_DEFAULT_HOLDBACK = 96;
-const PEM_BEGIN = '-----BEGIN';
-/**
- * Fixed lookback for a host policy the gate cannot read: `holdback`, or
- * `DEFAULT_HOLDBACK`. The canary, the prompt echo and the bundled policy need
- * none — each holds exactly the tail that could still start a match.
- */
-function resolveHoldback(options, exact) {
-    if (exact) {
-        if (options.holdback !== undefined) {
-            throw new TheoremError('config', 'holdback applies only to a host egress.enforce; the bundled policy holds exactly');
-        }
-        return 0;
-    }
-    return options.holdback ?? (options.enforce ? DEFAULT_HOLDBACK : 0);
-}
-function holdbackForWindow(window, base) {
-    // Incomplete PEM bodies can be large; do not release past BEGIN until END/flush.
-    const begin = window.lastIndexOf(PEM_BEGIN);
-    if (begin < 0)
-        return base;
-    const fromBegin = window.slice(begin);
-    if (/-----END (?:RSA )?PRIVATE KEY-----/.test(fromBegin))
-        return base;
-    return Math.max(base, window.length - begin);
-}
-/**
- * The verdict for a match the stream settled: the policy's own, run on the
- * window. The stream only ever settles a match the policy finds, so a policy
- * that does not block here is out of step with it: blocked anyway.
- */
-async function streamHitVerdict(enforce, hit, window, context) {
-    const verdict = await runEnforcer(enforce, { text: window }, context);
-    if ((verdict.action === 'block' || verdict.action === 'redact') && verdict.hits.length > 0) {
-        return verdict.hits;
-    }
-    return [{ rule: hit.rule, severity: hit.severity }];
-}
 /** Call `flush` when the stream ends to release the held tail. */
-function createProgressiveYieldGate(options) {
+async function createProgressiveYieldGate(options) {
+    if (options.detect)
+        await loadEgressAutomata();
+    return progressiveYieldGate(options);
+}
+/** `createProgressiveYieldGate`, once the automata are loaded: a Live cycle opens its next gate mid-stream. */
+function progressiveYieldGate(options) {
     const { context } = options;
-    const stream = options.enforce
-        ? streamPlanOf(options.enforce)?.(context)
+    const reads = options.detect;
+    const detecting = reads
+        ? createDetectStream(reads.boundary, reads.matrix, reads.scope)
         : undefined;
-    const baseHoldback = resolveHoldback(options, stream !== undefined);
-    const carry = context.canary ? (options.carry ?? '') : '';
+    /** What a match of one of ours does at this gate's boundary. A gate given no matrix stops on it. */
+    const ours = (detector) => reads ? reads.matrix[detector][reads.boundary] : 'block';
+    const canaryAction = ours('canary_leak');
+    const promptAction = ours('prompt_leak');
+    /** The canary a reply must not repeat: none when it was given (`canaryGiven`), or not read here. */
+    const token = context.canaryGiven || canaryAction === 'ignore' ? undefined : context.canary;
+    /** The private system instruction a reply must not repeat: none when not read here. */
+    const privateSystem = promptAction === 'ignore' ? undefined : context.privateSystem;
+    const guarded = token !== undefined || privateSystem !== undefined;
+    const carry = guarded ? (options.carry ?? '') : '';
+    /** The leaks set to `flag` found since the last release, and the rules already reported. */
+    let noted = [];
+    const reported = new Set();
     let accumulated = '';
     let emitted = 0;
     /** The window from `emitted` on. Each piece of the reply is kept apart, so no step rereads the whole. */
@@ -78,71 +51,65 @@ function createProgressiveYieldGate(options) {
     let openingBase = 0;
     let openingFrom = 0;
     /** Reads the carry, then the window as it grows. */
-    const scanner = context.canary ? createCanaryScanner(context.canary) : undefined;
+    const scanner = token ? createCanaryScanner(token) : undefined;
     scanner?.push(carry);
     /**
-     * The system-prompt leak hits (canary, prompt echo) in the carry and this
-     * window. The canary scan reads each character once (`createCanaryScanner`)
-     * and the echo check rereads only its own short lookback
-     * (`promptEchoScanFrom`), so a long reply costs time in proportion to its
-     * length, not its square.
-     */
-    function canaryWindowHits(fresh) {
-        const scanned = echoed.length;
-        echoed += fresh;
-        const from = promptEchoScanFrom(echoed, scanned);
-        echoed = echoed.slice(from);
-        echoedFrom += from;
-        return [
-            ...(scanner?.push(fresh) ? [CANARY_HIT] : []),
-            ...(context.privateSystem
-                ? promptEchoHits(echoed, context.privateSystem, context.canary)
-                : []),
-        ];
-    }
-    /**
-     * The host policy's hits on the window. The bundled policy reads only the
-     * new fragment (`egress-stream.ts`) and runs whole only when a match
-     * settles; a policy the gate cannot read runs whole at every step. At the
-     * end (`fragment` unset) every policy runs whole.
+     * The leaks of what is ours (canary, prompt echo) in the carry and this
+     * window that stop the reply. One set to `flag` is noted for the next
+     * release instead, once. The canary scan reads each character once
+     * (`createCanaryScanner`) and the echo check rereads only its own short
+     * lookback (`promptEchoScanFrom`), so a long reply costs time in proportion
+     * to its length, not its square.
      */
-    async function policyHits(window, fragment) {
-        if (!options.enforce) {
-            return null;
-        }
-        if (stream && fragment !== undefined) {
-            const hit = stream.push(fragment);
-            return hit ? await streamHitVerdict(options.enforce, hit, window, context) : null;
+    function leakStops(fresh) {
+        const found = [];
+        if (scanner?.push(fresh))
+            found.push([canaryAction, CANARY_HIT]);
+        if (privateSystem) {
+            const scanned = echoed.length;
+            echoed += fresh;
+            const from = promptEchoScanFrom(echoed, scanned);
+            echoed = echoed.slice(from);
+            echoedFrom += from;
+            const [hit] = promptEchoHits(echoed, privateSystem, context.canary);
+            if (hit)
+                found.push([promptAction, hit]);
         }
-        // Mid-stream the gate can only release or stop: emitted prefixes cannot be
-        // rewritten, so `redact` stops here and end-of-attempt egress applies the
-        // full verdict. `flag` is advisory and keeps the stream flowing.
-        const verdict = await runEnforcer(options.enforce, { text: window }, context);
-        if (verdict.action === 'block' || verdict.action === 'redact') {
-            return verdict.hits.length > 0
-                ? verdict.hits
-                : [{ rule: EGRESS_RULES.blocked, severity: 'high' }];
+        for (const [action, hit] of found) {
+            if (action !== 'flag' || reported.has(hit.rule))
+                continue;
+            reported.add(hit.rule);
+            noted.push(hit);
         }
-        return null;
+        return found.filter(([action]) => action !== 'flag').map(([, hit]) => hit);
     }
-    async function scan(window, fragment) {
-        // The system-prompt leak checks always run, under a host policy too: it adds
-        // checks, it never replaces these (the guardrail invariant).
-        const leaks = context.canary ? canaryWindowHits(fragment ?? '') : [];
-        if (leaks.length > 0) {
-            return leaks;
-        }
-        return await policyHits(window, fragment);
+    /** What stops the reply at this step: a leak of ours, read at the gate's boundary. */
+    function scan(fragment) {
+        const leaks = guarded ? leakStops(fragment ?? '') : [];
+        if (fragment)
+            detecting?.push(fragment);
+        if (leaks.length === 0)
+            return null;
+        return { hits: leaks, ...(reads ? { boundary: reads.boundary } : {}) };
     }
-    /** Where the leak checks hold from: a canary opening, or words a prompt echo could grow from. */
+    /**
+     * Where the leak checks hold from: a canary opening, or words a prompt echo
+     * could grow from. A leak set to `flag` holds nothing: it is shown.
+     */
     function leakHoldFrom() {
-        if (!context.canary) {
-            return accumulated.length;
-        }
-        const echo = context.privateSystem
-            ? echoHoldFrom(context.privateSystem, context.canary)
+        const canary = token && canaryAction !== 'flag' ? canaryFrom(token) : held.length;
+        const echo = privateSystem && promptAction !== 'flag'
+            ? echoHoldFrom(privateSystem, context.canary)
             : held.length;
-        return emitted + Math.min(canaryFrom(context.canary), echo);
+        return emitted + Math.min(canary, echo);
+    }
+    /** `result` with the leaks noted since the last release reported in it. */
+    function withNoted(result) {
+        if (noted.length === 0)
+            return result;
+        const hits = [...noted, ...(result.found?.hits ?? [])];
+        noted = [];
+        return { ...result, found: { action: result.found?.action ?? 'flag', hits } };
     }
     /** `canaryHoldFrom` on the held text, read from where an opening could start. */
     function canaryFrom(canary) {
@@ -151,7 +118,7 @@ function createProgressiveYieldGate(options) {
         const lead = Math.max(openingBase, from - RELEASED_LOOKBACK);
         let at = lead + canaryOpeningFrom(opening.slice(lead - openingBase), canary);
         if (at < from && from > shownTo) {
-            // An opening the bound rules out: read the held text whole, and from there on.
+            // why: An opening the bound rules out: read the held text whole, and from there on.
             opening = released + held;
             openingBase = shownTo - released.length;
             at = openingBase + canaryOpeningFrom(opening, canary);
@@ -164,74 +131,151 @@ function createProgressiveYieldGate(options) {
     }
     /** `promptEchoHoldFrom` on the held text, read from its last few words. */
     function echoHoldFrom(privateSystem, canary) {
-        // Until this window releases anything, its opening may continue the carry.
+        // why: Until this window releases anything, its opening may continue the carry.
         const lead = emitted === 0 ? carry : '';
         const leadFrom = carry.length + emitted - lead.length;
         const [text, from] = echoedFrom >= leadFrom ? [echoed, echoedFrom] : [lead + held, leadFrom];
         return Math.max(0, from + promptEchoHoldFrom(text, privateSystem, canary) - carry.length - emitted);
     }
-    /** Where the host policy holds from: exactly for the bundled one, a fixed lookback otherwise. */
-    function policyHoldFrom() {
-        if (stream) {
-            return stream.holdFrom();
+    function release(fragment) {
+        const stop = scan(fragment);
+        if (stop) {
+            return { blocked: true, ...stop };
         }
-        const hold = options.enforce ? holdbackForWindow(accumulated, baseHoldback) : baseHoldback;
-        return accumulated.length - hold;
-    }
-    async function release(fragment) {
-        const hits = await scan(accumulated, fragment);
-        if (hits) {
-            return { blocked: true, hits };
+        const ended = fragment === undefined;
+        const end = ended
+            ? accumulated.length
+            : Math.min(leakHoldFrom(), detecting?.holdFrom() ?? accumulated.length);
+        const length = Math.max(0, end - emitted);
+        if (!(reads && detecting)) {
+            return withNoted({ blocked: false, emit: take(length) });
+        }
+        const read = detecting.take(emitted, emitted + length, ended);
+        if (read.action === 'block' || (read.action === 'redact' && !reads.rewrite)) {
+            return { blocked: true, hits: read.hits, boundary: reads.boundary };
         }
-        const end = fragment === undefined ? accumulated.length : Math.min(leakHoldFrom(), policyHoldFrom());
-        const emit = take(Math.max(0, end - emitted));
-        return { blocked: false, emit };
+        take(read.taken);
+        return withNoted({
+            blocked: false,
+            emit: read.text ?? '',
+            ...(read.action === 'allow' ? {} : { found: { action: read.action, hits: read.hits } }),
+        });
     }
-    /** Release the first `length` characters held. */
+    /** Release the first `length` characters held, as written. */
     function take(length) {
         const emit = held.slice(0, length);
         held = held.slice(length);
         emitted += emit.length;
-        if (context.canary)
+        if (guarded)
             released = (released + emit).slice(-RELEASED_LOOKBACK);
         return emit;
     }
     return {
-        async process(fragment) {
+        process(fragment) {
             if (!fragment) {
                 return { blocked: false, emit: '' };
             }
             accumulated += fragment;
             held += fragment;
-            if (context.canary)
+            if (guarded)
                 opening += fragment;
-            return await release(fragment);
-        },
-        async flush() {
-            return await release();
+            return release(fragment);
         },
+        flush: () => release(),
         accumulated: () => accumulated,
         unreleased: () => held,
         drainUnreleased: () => take(held.length),
-        carryOut: () => context.canary
-            ? promptLeakCarry(carry + accumulated, context.canary, context.privateSystem)
-            : '',
+        carryOut: () => (guarded ? promptLeakCarry(carry + accumulated, token, privateSystem) : ''),
     };
 }
 /**
- * Shared constructor for runTurn + Live: gate when canary and/or egress.enforce
- * is active. `context.canary` is set only when the profile enabled canary minting.
+ * Whether a reply read at `boundaries` gets a verdict once it has ended: a
+ * detector reads one of them. A gate that stops such a reply withholds it for
+ * that verdict.
+ */
+function replyIsJudged(policy, boundaries, scope) {
+    return detectReads(boundaries, policy.detect, scope);
+}
+/**
+ * Shared constructor for runTurn + Live: a gate when a detector reads
+ * `boundary`. `context.canary` is set only while `canary_leak` is above
+ * `ignore` somewhere, and `context.privateSystem` while `prompt_leak` is.
  */
-function createOutboundProgressiveGate(policy, context, carry) {
-    const egress = policy.egress;
-    if (!egress?.enforce && !context.canary) {
+async function createOutboundProgressiveGate(policy, context, boundary, carry) {
+    if (!replyIsJudged(policy, [boundary], context))
+        return null;
+    await loadEgressAutomata();
+    return outboundProgressiveGate(policy, context, boundary, carry);
+}
+/** `createOutboundProgressiveGate`, once the automata are loaded. */
+function outboundProgressiveGate(policy, context, boundary, carry) {
+    if (!replyIsJudged(policy, [boundary], context)) {
         return null;
     }
-    return createProgressiveYieldGate({
+    return progressiveYieldGate({
         context,
-        ...(egress?.enforce ? { enforce: egress.enforce } : {}),
-        ...(egress?.holdback === undefined ? {} : { holdback: egress.holdback }),
+        detect: {
+            matrix: policy.detect,
+            boundary,
+            rewrite: boundary === 'reply',
+            scope: scopeOf(policy, context),
+        },
         ...(carry ? { carry } : {}),
     });
 }
-export { createOutboundProgressiveGate, createProgressiveYieldGate, DEFAULT_HOLDBACK, LIVE_DEFAULT_HOLDBACK, };
+/**
+ * A gate for a draft read at `boundary`, where the whole it previews is read before the host sees
+ * it: a tool call the model is still writing, a tool's output as the tool writes it, or a
+ * structured reply's JSON as the model writes it. It never
+ * rewrites: a match the whole's check would replace or stop stops the draft instead, because the
+ * host gets the whole only as that check leaves it. `scope` is what that check reads against;
+ * left out, the turn's (`scopeOf`).
+ */
+async function createDraftGate(policy, context, boundary, scope) {
+    if (!replyIsJudged(policy, [boundary], scope ?? context))
+        return null;
+    await loadEgressAutomata();
+    return progressiveYieldGate({
+        context,
+        detect: {
+            matrix: policy.detect,
+            boundary,
+            rewrite: false,
+            scope: scope ?? scopeOf(policy, context),
+        },
+    });
+}
+/**
+ * One stream of drafts read through one draft gate, opened on the first draft. A match stops
+ * the rest of the stream; with no gate (nothing is judged there), every draft passes as is.
+ */
+class DraftReader {
+    open;
+    gate;
+    constructor(open) {
+        this.open = open;
+    }
+    /** What of `text` may be shown now: empty while the gate holds it, or once a match stopped the stream. */
+    async read(text) {
+        if (this.gate === undefined)
+            this.gate = await this.open();
+        if (this.gate === 'stopped')
+            return '';
+        if (!this.gate)
+            return text;
+        const result = this.gate.process(text);
+        if (result.blocked) {
+            this.gate = 'stopped';
+            return '';
+        }
+        return result.emit;
+    }
+    /** The tail the gate still holds, once the stream has ended. */
+    end() {
+        if (!this.gate || this.gate === 'stopped')
+            return '';
+        const result = this.gate.flush();
+        return result.blocked ? '' : result.emit;
+    }
+}
+export { createDraftGate, createOutboundProgressiveGate, createProgressiveYieldGate, DraftReader, outboundProgressiveGate, replyIsJudged, };

package/esm/src/guardrails/prompt-echo.d.ts

@@ -8,8 +8,10 @@
  * not read, and no run reaches across it. Words are
  * compared case-folded after Unicode compatibility folding, punctuation and
  * markup between them ignored, and bare numbers skipped, so reformatting a
- * dump as a numbered or bulleted list does not hide it. Where the prompt has
- * the canary, any one word or none continues a run: a model told to hide the
+ * dump as a numbered or bulleted list does not hide it. Nor does encoding it:
+ * the prompt is also read backwards and in rot13, and both it and the reply
+ * with leetspeak decoded. Where the prompt has
+ * the canary, any one word, or none continues a run: a model told to hide the
  * canary echoes the prompt around a stand-in for it. A streamed reply holds
  * the words an echo could still grow from (`promptEchoHoldFrom`), so none of
  * an echo reaches the host.

package/esm/src/guardrails/prompt-echo.js

@@ -8,14 +8,17 @@
  * not read, and no run reaches across it. Words are
  * compared case-folded after Unicode compatibility folding, punctuation and
  * markup between them ignored, and bare numbers skipped, so reformatting a
- * dump as a numbered or bulleted list does not hide it. Where the prompt has
- * the canary, any one word or none continues a run: a model told to hide the
+ * dump as a numbered or bulleted list does not hide it. Nor does encoding it:
+ * the prompt is also read backwards and in rot13, and both it and the reply
+ * with leetspeak decoded. Where the prompt has
+ * the canary, any one word, or none continues a run: a model told to hide the
  * canary echoes the prompt around a stand-in for it. A streamed reply holds
  * the words an echo could still grow from (`promptEchoHoldFrom`), so none of
  * an echo reaches the host.
  *
  * @module
  */
+import { LEET_MAP, tryRot13 } from './injection.js';
 /** Consecutive system-prompt words that make a reply an echo of it. */
 const PROMPT_ECHO_WORDS = 12;
 /** Words a scan rereads before new text: an echo run ending in it starts no earlier. */
@@ -40,10 +43,30 @@ function echoWords(text) {
 /** Where the canary stood in the prompt's words: any one word or none matches it. */
 const SLOT = '\u0000';
 /**
- * The private stretches' words as a run can repeat them: as written, with the
- * canary left out, and with the canary as `SLOT`.
+ * The prompt as a reply can encode it: written backwards, by code point, in
+ * rot13, or as the decoded leetspeak reply reads it.
+ */
+const PROMPT_VIEWS = [
+    (text) => text,
+    (text) => [...text].reverse().join(''),
+    tryRot13,
+    decodeLeet,
+];
+/**
+ * The private stretches' words as a run can repeat them, in each of
+ * `PROMPT_VIEWS`: as written, with the canary left out, and with the canary
+ * as `SLOT`.
  */
 function promptReadings(stretches, canary) {
+    const readings = { plain: [], slotted: [] };
+    for (const view of PROMPT_VIEWS) {
+        const read = viewReadings(stretches.map(view), canary === undefined ? undefined : view(canary));
+        readings.plain.push(...read.plain);
+        readings.slotted.push(...read.slotted);
+    }
+    return readings;
+}
+function viewReadings(stretches, canary) {
     const token = canary ? echoWords(canary).map((entry) => entry.word) : [];
     const readings = { plain: [], slotted: [] };
     for (const stretch of stretches) {
@@ -71,7 +94,7 @@ function promptReadings(stretches, canary) {
 }
 /** A run with a slot, keyed by where the slot is and the words around it. */
 function slotKey(run, slot) {
-    // Bare numbers are never words here, so the slot's index leads unambiguously.
+    // why: Bare numbers are never words here, so the slot's index leads unambiguously.
     return [slot, ...run.filter((_, k) => k !== slot)].join(' ');
 }
 /** A run may not start on the canary's place unless `leading`: a stand-in for it is not prompt text. */
@@ -164,7 +187,20 @@ function mayBecomePromptWord(partial, shape) {
  * word. Any echo that completes later starts there or after.
  */
 function promptEchoHoldFrom(text, stretches, canary) {
+    for (let reach = TAIL_REACH;; reach *= 2) {
+        const start = decodableFrom(text, text.length - reach);
+        const holds = replyViews(text.slice(start)).map((view) => holdFrom(view, stretches, canary));
+        if (start === 0 || holds.every(({ tail }) => tail > 0)) {
+            return start + Math.min(...holds.map(({ hold }) => hold));
+        }
+    }
+}
+/** The hold in `text`, and where the words it was read from start: at 0, `text` may be too short a tail. */
+function holdFrom(text, stretches, canary) {
     const tail = promptEchoScanFrom(text, text.length);
+    return { hold: holdIn(text, tail, stretches, canary), tail };
+}
+function holdIn(text, tail, stretches, canary) {
     const words = echoWords(text.slice(tail));
     let writing = text.length;
     while (writing > 0 && WORD_CHAR.test(text.charAt(writing - 1)))
@@ -180,8 +216,39 @@ function promptEchoHoldFrom(text, stretches, canary) {
     }
     return hold;
 }
+/** A leetspeak letter, or a list number that stays one; `!` only before a word goes on. */
+const LEET = /(?<=^|\n)[ \t]*\p{N}+[.)]|[0-9@]|!(?=[\p{L}\p{N}@])/gu;
+/** How far back a tail is first read from; a tail with too few words in it is doubled. */
+const TAIL_REACH = 512;
+const LIST_NUMBER_CHAR = /[ \t\p{N}]/u;
+const NUMBER_CHAR = /\p{N}/u;
+/**
+ * A start at or before `at` from which `text` decodes as it does whole: a
+ * list number is one from its line's start, so the start is no later than the
+ * character before the blanks and digits leading up to `at`.
+ */
+function decodableFrom(text, at) {
+    let start = Math.max(0, at);
+    while (start > 0 && LIST_NUMBER_CHAR.test(text.charAt(start - 1)))
+        start--;
+    return Math.max(0, start - 1);
+}
+/** `text` with its leetspeak decoded, letter for letter, so offsets keep. */
+function decodeLeet(text) {
+    return text.replace(LEET, (match) => (match.length === 1 ? (LEET_MAP[match] ?? match) : match));
+}
+/** The reply as written and with its leetspeak decoded. */
+function replyViews(text) {
+    const decoded = decodeLeet(text);
+    return decoded === text ? [text] : [text, decoded];
+}
 /** Offsets `[start, end)` of `text` that repeat a private stretch, ordered by start. */
 function promptEchoRanges(text, stretches, canary) {
+    return replyViews(text)
+        .flatMap((view) => echoRanges(view, stretches, canary))
+        .sort((a, b) => a[0] - b[0]);
+}
+function echoRanges(text, stretches, canary) {
     const grams = promptGrams(stretches, canary);
     if (!text || grams.plain.size === 0) {
         return [];
@@ -193,7 +260,7 @@ function promptEchoRanges(text, stretches, canary) {
         const slot = matchRun(grams, run);
         if (slot === undefined)
             continue;
-        // A stand-in for the canary at either end is the model's, not the prompt's.
+        // why: A stand-in for the canary at either end is the model's, not the prompt's.
         const first = slot === 0 ? from + 1 : from;
         const last = slot === PROMPT_ECHO_WORDS - 1 ? from + slot - 1 : from + PROMPT_ECHO_WORDS - 1;
         ranges.push([words[first]?.at ?? 0, words[last]?.to ?? 0]);
@@ -210,6 +277,20 @@ function scanTextForPromptEcho(text, stretches, canary) {
  * start in.
  */
 function promptEchoScanFrom(text, from) {
+    const end = Math.min(from, text.length);
+    for (let reach = TAIL_REACH;; reach *= 2) {
+        const start = decodableFrom(text, end - reach);
+        // why: What follows `end` decides how the tail's last characters read: a `!` by the next one, digits by the list number they may be.
+        let stop = end;
+        while (stop < text.length && NUMBER_CHAR.test(text.charAt(stop)))
+            stop++;
+        const tail = text.slice(start, stop + 1);
+        const at = Math.min(...replyViews(tail).map((view) => scanFrom(view, end - start)));
+        if (start === 0 || at > 0)
+            return start + at;
+    }
+}
+function scanFrom(text, from) {
     let at = Math.min(from, text.length);
     for (let counted = 0; counted < ECHO_LOOKBACK_WORDS && at > 0;) {
         while (at > 0 && !WORD_CHAR.test(text.charAt(at - 1)))

package/esm/src/guardrails/quota.d.ts

@@ -1,5 +1,6 @@
 import type { Profile } from '../kernel/types.js';
 import { TheoremError } from './theorem-error.js';
+/** What taking a quota slot returned: `ok` (reserved), `busy` (a turn already holds the slot), `quota` (the day's limit is used) or `not_configured` (the profile sets no quota). */
 type QuotaSlotStatus = 'ok' | 'busy' | 'quota' | 'not_configured';
 /** Returns whether a local request lacks the proxy header needed for quota identity. */
 declare function skipQuota(peer: string, req: Request): boolean;

package/esm/src/guardrails/quota.js

@@ -70,7 +70,7 @@ function quotaExhausted(profile) {
     if (!quota) {
         return undefined;
     }
-    return new TheoremError('rate_limit', `${profile.id} used its daily quota of ${quota.perDay} turns`, // lexicon-exempt: internal diagnostic; the user reads the copy key
+    return new TheoremError('rate_limit', `${profile.id} used its daily quota of ${quota.perDay} turns`, // labels-exempt: internal diagnostic; the user reads the copy key
     { copy: { key: 'quota.exhausted', params: { perDay: quota.perDay } } });
 }
 /** Clears all process-local quota counters; intended for tests or host resets. */