@visual-z/xeno 0.8.4 → 0.9.1

package/src/core/theme.ts

@@ -1,166 +0,0 @@
-/**
- * Theme schema and validation. Pure: a file is read elsewhere, this module
- * only turns JSON into a complete Theme plus named problems.
- *
- * A broken theme must still produce a usable Theme (the dark builtin).
- * Throwing here would take the agent down the moment the user edited a
- * comma, which is when they most need it (feat-theming design).
- */
-
-export const THEME_TOKENS = [
-  "text",
-  "thinkingText",
-  "toolTitle",
-  "toolOutput",
-  "error",
-  "toolDiffAdded",
-  "toolDiffRemoved",
-  "status",
-  "prompt",
-  "selectedBg",
-  "muted",
-  "warning",
-  "mdHeading",
-  "mdCode",
-  "mdLink",
-  "userMessageBg",
-  "toolPendingBg",
-  "toolSuccessBg",
-  "toolErrorBg",
-  "thinkingLow",
-  "thinkingMedium",
-  "thinkingHigh",
-  "thinkingXhigh",
-  "thinkingMax",
-] as const;
-
-export type ThemeToken = (typeof THEME_TOKENS)[number];
-
-export type ThemeColors = { readonly [K in ThemeToken]: string } & Readonly<Record<string, string>>;
-const PI_THEME_TOKENS: readonly string[] = ["background","accent","border","borderAccent","borderMuted","success","error","warning","muted","dim","text","thinkingText","scrollbarTrack","scrollbarThumb","searchMatchText","userMessageText","customMessageText","customMessageLabel","toolTitle","toolOutput","mdHeading","mdLink","mdLinkUrl","mdCode","mdCodeBlock","mdCodeBlockBorder","mdQuote","mdQuoteBorder","mdHr","mdListBullet","toolDiffAdded","toolDiffRemoved","toolDiffContext","syntaxComment","syntaxKeyword","syntaxFunction","syntaxVariable","syntaxString","syntaxNumber","syntaxType","syntaxOperator","syntaxPunctuation","thinkingOff","thinkingMinimal","thinkingLow","thinkingMedium","thinkingHigh","thinkingXhigh","thinkingMax","bashMode","selectedBg","searchMatchBg","userMessageBg","customMessageBg","toolPendingBg","toolSuccessBg","toolErrorBg"];
-
-export interface Theme {
-  readonly name: string;
-  readonly colors: ThemeColors;
-}
-
-export interface ThemeParse {
-  readonly theme: Theme;
-  readonly diagnostics: readonly string[];
-}
-
-/**
- * Built-in appearances own no colours of their own: every token is one of the
- * terminal's 16 slots or its default (empty), and no token paints a
- * background (docs/tasks/refactor-tui-terminal-colors.md). The interactive
- * view derives finer greys from the terminal's reported palette; these
- * tokens are what line mode and an unreporting terminal get.
- *
- * `dark` and `light` differ only in which half of the palette stays legible:
- * bright slots on a dark ground, normal slots on a light one. Muted text is a
- * grey slot, never SGR faint (faint made muted arguments unreadable).
- */
-const DARK_COLORS: ThemeColors = terminalTokens({ muted: "37", red: "91", green: "92", yellow: "93", blue: "94", magenta: "95", cyan: "96", rule: "90" });
-const LIGHT_COLORS: ThemeColors = terminalTokens({ muted: "90", red: "31", green: "32", yellow: "33", blue: "34", magenta: "35", cyan: "36", rule: "37" });
-
-function terminalTokens(slot: { muted: string; red: string; green: string; yellow: string; blue: string; magenta: string; cyan: string; rule: string }): ThemeColors {
-  return {
-    text: "", prompt: "", background: "",
-    thinkingText: slot.magenta, toolTitle: "", toolOutput: slot.muted,
-    error: slot.red, toolDiffAdded: slot.green, toolDiffRemoved: slot.red,
-    status: slot.muted, muted: slot.muted, dim: slot.muted, warning: slot.yellow, success: slot.green, accent: slot.blue,
-    mdHeading: slot.blue, mdCode: slot.cyan, mdLink: slot.blue,
-    selectedBg: "", userMessageBg: "", toolPendingBg: "", toolSuccessBg: "", toolErrorBg: "",
-    border: slot.rule, borderMuted: slot.rule,
-    thinkingOff: slot.muted, thinkingMinimal: slot.magenta, thinkingLow: slot.magenta, thinkingMedium: slot.magenta,
-    thinkingHigh: slot.magenta, thinkingXhigh: slot.magenta, thinkingMax: slot.magenta,
-    syntaxKeyword: slot.magenta, syntaxString: slot.green, syntaxNumber: slot.yellow, syntaxFunction: slot.blue, syntaxComment: slot.muted,
-  };
-}
-
-export function builtinTheme(name: "dark" | "light"): Theme {
-  return name === "light"
-    ? { name: "light", colors: LIGHT_COLORS }
-    : { name: "dark", colors: DARK_COLORS };
-}
-
-/**
- * A built-in appearance (dark, light, or system/auto, which reuse them) as
- * opposed to a theme file. Identity, not name: a file may call itself "dark",
- * and parseTheme always copies colours into a new object.
- */
-export function isBuiltinTheme(theme: Theme): boolean {
-  return theme.colors === DARK_COLORS || theme.colors === LIGHT_COLORS;
-}
-
-export function parseTheme(json: unknown): ThemeParse {
-  const fallback = builtinTheme("dark");
-  if (typeof json !== "object" || json === null || Array.isArray(json)) {
-    return {
-      theme: fallback,
-      diagnostics: ["theme is not an object; using dark"],
-    };
-  }
-  const rec = json as { readonly [k: string]: unknown };
-  const diagnostics: string[] = [];
-  const name = typeof rec["name"] === "string" && rec["name"].length > 0 ? rec["name"] : "custom";
-  const rawColors = rec["colors"];
-  const src: { readonly [k: string]: unknown } =
-    typeof rawColors === "object" && rawColors !== null && !Array.isArray(rawColors)
-      ? (rawColors as { readonly [k: string]: unknown })
-      : (() => {
-          diagnostics.push("theme.colors is missing or not an object; filling from dark");
-          return {};
-        })();
-
-  for (const key of Object.keys(src)) {
-    if (!isThemeToken(key) && !PI_THEME_TOKENS.includes(key)) diagnostics.push(`unknown token: ${key}`);
-  }
-
-  const colors: { [K in ThemeToken]: string } & Record<string, string> = { ...fallback.colors };
-  const vars = typeof rec["vars"] === "object" && rec["vars"] !== null ? rec["vars"] as Record<string, unknown> : {};
-  const resolve = (value: unknown, seen = new Set<string>()): unknown => {
-    if (typeof value !== "string" || !(value in vars)) return value;
-    if (seen.has(value)) return null;
-    return resolve(vars[value], new Set([...seen, value]));
-  };
-  for (const token of new Set<string>([...THEME_TOKENS, ...PI_THEME_TOKENS])) {
-    if (!(token in src)) continue;
-    const parsed = parseColor(resolve(src[token]));
-    if (parsed === null) {
-      diagnostics.push(`invalid colour for ${token}; using built-in`);
-      continue;
-    }
-    colors[token] = (token.endsWith("Bg") || token === "background") ? parsed.replace(/^38;/, "48;") : parsed;
-  }
-
-  if (!("status" in src) && "dim" in colors) colors.status = colors["dim"]!;
-  if (!("prompt" in src)) colors.prompt = colors.text;
-  return { theme: { name, colors }, diagnostics };
-}
-
-function isThemeToken(key: string): key is ThemeToken {
-  return (THEME_TOKENS as readonly string[]).includes(key);
-}
-
-/**
- * Accept SGR params (`31`, `38;5;180`, `38;2;r;g;b`), `#RRGGBB`, a 256-colour
- * index, or empty (terminal default). Anything else is invalid.
- */
-export function parseColor(value: unknown): string | null {
-  if (typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 255) {
-    return `38;5;${value}`;
-  }
-  if (typeof value !== "string") return null;
-  if (value === "") return "";
-  const hex = /^#([0-9a-fA-F]{6})$/.exec(value);
-  if (hex) {
-    const n = Number.parseInt(hex[1]!, 16);
-    const r = (n >> 16) & 255;
-    const g = (n >> 8) & 255;
-    const b = n & 255;
-    return `38;2;${r};${g};${b}`;
-  }
-  if (/^[0-9]+(?:;[0-9]+)*$/.test(value)) return value;
-  return null;
-}

package/src/core/thinking.ts

@@ -1,26 +0,0 @@
-/** Ported from Pi (MIT), ai/models.ts at 02eed88. Capability policy, independent of provider I/O. */
-export const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
-export type ThinkingLevel = (typeof THINKING_LEVELS)[number];
-export interface ThinkingModel {
-  readonly reasoning: boolean;
-  readonly thinkingLevelMap?: Partial<Record<ThinkingLevel, string | null>>;
-}
-export function asThinkingLevel(value: unknown): ThinkingLevel | undefined {
-  return typeof value === "string" && (THINKING_LEVELS as readonly string[]).includes(value) ? value as ThinkingLevel : undefined;
-}
-export function supportedThinkingLevels(model: ThinkingModel): ThinkingLevel[] {
-  if (!model.reasoning) return ["off"];
-  return THINKING_LEVELS.filter(level => {
-    const mapped = model.thinkingLevelMap?.[level];
-    if (mapped === null) return false;
-    return level === "xhigh" || level === "max" ? mapped !== undefined : true;
-  });
-}
-export function clampThinkingLevel(model: ThinkingModel, requested: ThinkingLevel): ThinkingLevel {
-  const available = supportedThinkingLevels(model);
-  const index = THINKING_LEVELS.indexOf(requested);
-  for (const level of [...THINKING_LEVELS.slice(index), ...THINKING_LEVELS.slice(0, index).reverse()]) {
-    if (available.includes(level)) return level;
-  }
-  return "off";
-}

package/src/core/tokens.ts

@@ -1,151 +0,0 @@
-/**
- * Token accounting.
- *
- * The default here is an ESTIMATE and is labelled as one. Real counting needs the
- * provider's own counter (Anthropic's `messages.count_tokens`); a bundled
- * tokenizer would drift from whatever model is actually in use and would be wrong
- * in a way nobody notices. The boundary logic therefore takes a counter as a
- * parameter, so wiring the real one in is a one-line change and nothing in the
- * core pretends to be authoritative.
- */
-
-import type { Message } from "./project.ts";
-import { estimateImageTokens } from "./images.ts";
-
-export interface TokenCounter {
-  readonly kind: "estimate" | "exact";
-  /**
-   * Counts everything the API bills as prompt: tool schemas, the system
-   * prompt and the messages.
-   *
-   * Tools are a parameter because leaving them out made two sides of a
-   * boundary decision incomparable -- one came from the provider's billed
-   * figure, which includes schemas, the other from a count that silently
-   * skipped them, and the difference read as work the node had done.
-   */
-  count(messages: readonly Message[], system: string, tools?: readonly unknown[]): number;
-}
-
-/**
- * Estimated tokens for one string.
- *
- * ASCII keeps the original chars/3.6: code and JSON tokenize more densely than
- * prose, so this sits below the usual chars/4 rule, and every measured cut
- * point so far was taken with it. Ideographic scripts are a different
- * regime -- one Han character is roughly 0.6-1.5 tokens across current
- * tokenizers, where chars/3.6 would say 0.28 -- so they are charged a full
- * token each. Overestimating only moves a cut earlier; underestimating is a
- * 400 from the provider. Other non-ASCII (accents, symbols, emoji) sits
- * between the two at half a token per code point.
- */
-export function estimateText(text: string): number {
-  let ascii = 0;
-  let weighted = 0;
-  for (let i = 0; i < text.length; i++) {
-    const code = text.charCodeAt(i);
-    if (code < 0x80) { ascii++; continue; }
-    // A surrogate pair is one code point; charge it once, at its high half.
-    if (code >= 0xdc00 && code <= 0xdfff) continue;
-    const ideographic =
-      (code >= 0x2e80 && code <= 0x9fff) || // CJK radicals .. unified ideographs, kana, bopomofo
-      (code >= 0xac00 && code <= 0xd7af) || // Hangul syllables
-      (code >= 0xf900 && code <= 0xfaff) || // CJK compatibility ideographs
-      (code >= 0xff00 && code <= 0xffef); // full-width forms
-    weighted += ideographic ? 1 : 0.5;
-  }
-  return ascii / 3.6 + weighted;
-}
-
-/**
- * estimateText across message and system text, plus serialized schemas and
- * per-message framing. Expect roughly +/-20% on ASCII; treat the trigger
- * threshold as approximate until an exact counter is wired in.
- */
-export const estimateTokens: TokenCounter = {
-  kind: "estimate",
-  count(messages, system, tools = []) {
-    // Serialized schemas are what goes on the wire, so their length is the
-    // right proxy -- and they are billed on every single request.
-    let tokens = estimateText(system) + (tools.length > 0 ? estimateText(JSON.stringify(tools)) : 0);
-    for (const m of messages) {
-      for (const b of m.content) {
-        if (b.type === "text") tokens += estimateText(b.text);
-        // Thinking is opaque here; its serialized size is the best proxy.
-        else if (b.type === "thinking") tokens += estimateText(JSON.stringify(b.raw));
-        else if (b.type === "tool_use") tokens += estimateText(b.name) + estimateText(JSON.stringify(b.input));
-        else if (b.type === "tool_result") tokens += estimateText(b.content);
-        else if (b.type === "image") tokens += estimateImageTokens(b.image);
-      }
-      // Per-message framing overhead, roughly.
-      tokens += 8 / 3.6;
-    }
-    return Math.ceil(tokens);
-  },
-};
-
-/**
- * A counter whose every count is multiplied by `factor`.
- *
- * Used once the provider has rejected a prompt the estimate said would fit:
- * that is a measurement that this content tokenizes `factor` times denser
- * than estimated, and sizing the retained context with the unscaled counter
- * would reproduce the overflow.
- */
-export function scaledCounter(counter: TokenCounter, factor: number): TokenCounter {
-  return { kind: "estimate", count: (messages, system, tools) => Math.ceil(counter.count(messages, system, tools) * factor) };
-}
-
-/**
- * An anchor: the prompt size a provider actually charged, and how far into the
- * conversation that measurement covered.
- *
- * Measuring the estimator against a real tokenizer showed it running between
- * -21% and +38% across realistic content -- prose, source, JSON and YAML all
- * tokenize at different densities, so no single chars-per-token constant fits
- * them at once. Underestimating source by a fifth is the dangerous direction:
- * a 30k trigger would fire at an actual 38k.
- *
- * Calibrating the constant would not fix that, because the error depends on
- * what the content happens to be. Anchoring does: every response reports the
- * prompt it was actually billed for, so everything up to that point is known
- * exactly and only the delta since needs estimating. The error then scales
- * with one turn instead of with the whole conversation.
- */
-export interface Anchor {
-  /** Sum of uncached, cache-write and cache-read input tokens. */
-  promptTokens: number;
-  /** Tokens the model generated, which become part of the next prompt. */
-  outputTokens: number;
-  /** Number of messages the measurement covered. */
-  messageCount: number;
-}
-
-/**
- * Prompt size for the next request: exact up to the anchor, estimated after.
- *
- * Falls back to a plain estimate before the first response, which is the only
- * point where nothing has been measured yet.
- */
-export function anchoredCount(
-  messages: readonly Message[],
-  system: string,
-  anchor: Anchor | null,
-  counter: TokenCounter = estimateTokens,
-  tools: readonly unknown[] = [],
-): { tokens: number; exactUpTo: number } {
-  if (anchor === null || anchor.messageCount > messages.length) {
-    return { tokens: counter.count(messages, system, tools), exactUpTo: 0 };
-  }
-  // The anchored prompt already includes the system prompt and the tools, so
-  // the delta is counted without either to avoid charging for them twice.
-  // The measured output is already the first assistant message after the
-  // measured prompt. Its billed count replaces, rather than adds to, an
-  // estimate of that same message (D1).
-  const outputIndex = messages[anchor.messageCount]?.role === "assistant" ? 1 : 0;
-  const since = messages.slice(anchor.messageCount + outputIndex);
-  const delta = counter.count(since, "", []);
-  return {
-    tokens: anchor.promptTokens + anchor.outputTokens + delta,
-    exactUpTo: anchor.promptTokens,
-  };
-}

package/src/core/tool-contract.ts

@@ -1,153 +0,0 @@
-/** O.3: one declarative input contract serves model schemas and runtime admission. */
-export type JsonValue = null | boolean | number | string | readonly JsonValue[] | { readonly [key: string]: JsonValue };
-export type ToolDiagnostic = {
-  code: "invalid_input" | "version_mismatch" | "not_found" | "ambiguous_edit" | "permission_denied" | "execution_failed" |
-    "environment_missing" | "transient" | "cancelled" | "timeout" | "unknown_effect" | "command_failed";
-  message: string;
-  recover?: { tool: string; input: { readonly [key: string]: JsonValue } };
-  /** R3: optional only for legacy records; supplied together by current failure owners. */
-  execution?: "not_started" | "started" | "unknown";
-  effects?: "none" | "possible";
-  retry?: "never" | "after_change" | "after_inspection" | "backoff";
-  next?: string;
-  /** A schema-valid shape with placeholders, never an automatically executable recovery. */
-  example?: { readonly [key: string]: JsonValue };
-};
-
-export function isJsonValue(value: unknown): value is JsonValue {
-  if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-  if (typeof value === "number") return Number.isFinite(value);
-  return typeof value === "object" && (Array.isArray(value) ? value : Object.values(value)).every(isJsonValue);
-}
-
-export function isToolDiagnostic(value: unknown): value is ToolDiagnostic {
-  if (value === null || typeof value !== "object") return false;
-  const item = value as Record<string, unknown>;
-  if (!["invalid_input", "version_mismatch", "not_found", "ambiguous_edit", "permission_denied", "execution_failed",
-    "environment_missing", "transient", "cancelled", "timeout", "unknown_effect", "command_failed"].includes(String(item["code"])) || typeof item["message"] !== "string") return false;
-  if (["execution", "effects", "retry", "next"].some(key => item[key] !== undefined)) {
-    if (!["not_started", "started", "unknown"].includes(String(item["execution"])) ||
-      !["none", "possible"].includes(String(item["effects"])) ||
-      !["never", "after_change", "after_inspection", "backoff"].includes(String(item["retry"])) || typeof item["next"] !== "string") return false;
-    if (item["retry"] === "backoff" && (item["code"] !== "transient" || item["effects"] !== "none")) return false;
-    if (item["code"] === "permission_denied" && (item["retry"] !== "never" || item["recover"] !== undefined)) return false;
-    if (item["code"] === "unknown_effect" && item["retry"] !== "after_inspection") return false;
-  }
-  if (item["example"] !== undefined && (item["example"] === null || typeof item["example"] !== "object" || Array.isArray(item["example"]) || !isJsonValue(item["example"]))) return false;
-  const recover = item["recover"];
-  if (recover === undefined) return true;
-  if (recover === null || typeof recover !== "object") return false;
-  const recovery = recover as Record<string, unknown>;
-  return typeof recovery["tool"] === "string" && recovery["input"] !== null &&
-    typeof recovery["input"] === "object" && !Array.isArray(recovery["input"]) && isJsonValue(recovery["input"]);
-}
-
-/** Required fields only; examples express a valid shape, not permission or a safe command. */
-export function minimalInput(schema: unknown): JsonValue | undefined {
-  if (schema === null || typeof schema !== "object") return undefined;
-  const s = schema as Record<string, unknown>;
-  if (Array.isArray(s["enum"]) && s["enum"].length && isJsonValue(s["enum"][0])) return s["enum"][0];
-  switch (s["type"]) {
-    case "string": return "<value>".padEnd(typeof s["minLength"] === "number" ? Math.min(4096, s["minLength"]) : 0, "x");
-    case "number": case "integer": return typeof s["minimum"] === "number" ? s["minimum"] : 0;
-    case "boolean": return false;
-    case "array": return [];
-    case "object": {
-      const value: { [key: string]: JsonValue } = {};
-      const properties = s["properties"];
-      for (const key of Array.isArray(s["required"]) ? s["required"] : []) {
-        if (typeof key !== "string" || properties === null || typeof properties !== "object") return undefined;
-        const item = minimalInput((properties as Record<string, unknown>)[key]);
-        if (item === undefined) return undefined;
-        value[key] = item;
-      }
-      return value;
-    }
-    default: return null;
-  }
-}
-
-/** Diagnostics are projected as tool data; they never become trusted system instructions. */
-export function diagnosticContent(content: string, diagnostic?: ToolDiagnostic): string {
-  if (diagnostic?.execution === undefined) return content;
-  return content + "\nTool diagnostic: " + JSON.stringify(diagnostic);
-}
-
-import { editDistance } from "./text-normalize.ts";
-
-/**
- * Names models send for arguments that exist under another name here. Edit
- * distance cannot see these (cwd and workdir share no letters in order);
- * each entry is a spelling another harness uses for the same argument.
- */
-const SYNONYMS: Readonly<Record<string, readonly string[]>> = {
-  cwd: ["workdir"], dir: ["workdir", "path"], directory: ["workdir", "path"],
-  file: ["path"], file_path: ["path"], filepath: ["path"], filename: ["path"],
-  cmd: ["command"], script: ["command"],
-  text: ["content"], contents: ["content"], old_str: ["old_string"], new_str: ["new_string"],
-  query: ["pattern"], regex: ["pattern"], timeout_ms: ["timeout"], offset: ["start"], limit: ["end", "limit"],
-  // Different units from max_output_tokens, so a hint rather than a silent conversion.
-  max_output_chars: ["max_output_tokens"], max_output_bytes: ["max_output_tokens"], max_tokens: ["max_output_tokens"],
-};
-
-/** The candidate nearest to `name`, when it is near enough to be the likely intent. */
-export function closestName(name: string, candidates: readonly string[]): string | undefined {
-  const synonym = SYNONYMS[name.toLowerCase()]?.find((alias) => candidates.includes(alias));
-  if (synonym !== undefined) return synonym;
-  let best: string | undefined, distance = Infinity;
-  for (const candidate of candidates) {
-    const d = Math.min(editDistance(name.toLowerCase(), candidate.toLowerCase()),
-      // A common drift is a synonym sharing a stem (replaceAll / replace_all).
-      editDistance(name.toLowerCase().replace(/[_-]/g, ""), candidate.toLowerCase().replace(/[_-]/g, "")));
-    if (d < distance) { best = candidate; distance = d; }
-  }
-  return best !== undefined && distance <= Math.max(2, Math.floor(best.length / 2)) ? best : undefined;
-}
-
-/**
- * Validate the schema vocabulary used by built-ins; semantic constraints stay with their owner.
- *
- * An argument the schema does not declare is an error, not noise: a model
- * that sends `cwd` believes it changed directory, and dropping the field
- * silently runs the command somewhere it did not intend. `hidden` names
- * internal arguments accepted at the top level without being advertised.
- */
-export function inputError(schema: unknown, value: unknown, path = "input", hidden: readonly string[] = []): string | null {
-  if (schema === null || typeof schema !== "object") return null;
-  const s = schema as Record<string, unknown>;
-  const type = s["type"];
-  if (type === "object" && (value === null || typeof value !== "object" || Array.isArray(value))) return `${path} must be an object`;
-  if (type === "array" && !Array.isArray(value)) return `${path} must be an array`;
-  if (["string", "boolean", "number"].includes(String(type)) && typeof value !== type) return `${path} must be ${String(type)}`;
-  if (type === "integer" && (typeof value !== "number" || !Number.isSafeInteger(value))) return `${path} must be a positive integer or zero where allowed`;
-  if (typeof value === "number" && !Number.isFinite(value)) return `${path} must be finite`;
-  if (typeof value === "number" && typeof s["minimum"] === "number" && value < s["minimum"]) return `${path} must be >= ${s["minimum"]}`;
-  if (typeof value === "number" && typeof s["maximum"] === "number" && value > s["maximum"]) return `${path} must be <= ${s["maximum"]}`;
-  if (typeof value === "string" && typeof s["minLength"] === "number" && value.length < s["minLength"]) return `${path} must not be empty`;
-  if (Array.isArray(s["enum"]) && !s["enum"].includes(value)) return `${path} must be one of ${s["enum"].join(", ")}`;
-  if (type === "array" && Array.isArray(value)) {
-    for (let i = 0; i < value.length; i++) { const error = inputError(s["items"], value[i], `${path}[${i}]`); if (error) return error; }
-  }
-  if (type === "object" && value !== null && typeof value === "object") {
-    const object = value as Record<string, unknown>;
-    for (const key of Array.isArray(s["required"]) ? s["required"] : []) {
-      if (typeof key === "string" && object[key] === undefined) return `${path}.${key} is required`;
-    }
-    const properties = s["properties"];
-    if (properties !== null && typeof properties === "object") {
-      const declared = Object.keys(properties);
-      for (const key of Object.keys(object)) {
-        if (declared.includes(key) || hidden.includes(key) || object[key] === undefined) continue;
-        const near = closestName(key, declared);
-        return `unknown argument ${path === "input" ? key : `${path}.${key}`}` + (near === undefined ? "" : `; did you mean ${near}?`) +
-          ` Valid arguments: ${[...declared].sort().join(", ")}`;
-      }
-    }
-    if (properties !== null && typeof properties === "object") for (const [key, property] of Object.entries(properties)) {
-      if (object[key] === undefined) continue;
-      const error = inputError(property, object[key], `${path}.${key}`);
-      if (error) return error;
-    }
-  }
-  return null;
-}

package/src/core/tool-discovery.ts

@@ -1,87 +0,0 @@
-/** R11 / D6 / D8: local discovery proposes declarations; only a paired checkpoint installs them. */
-import type { LogEvent, ToolInvocationEvent } from "./events.ts";
-
-/** Assumed response bounds, not measured model optima; prevent a directory dump from replacing a lookup. */
-export const MAX_DISCOVERY_RESULTS = 8;
-export const MAX_DISCOVERY_QUERY = 256;
-const MAX_PARAMETER_HINTS = 8;
-const MAX_PURPOSE_CHARS = 320;
-
-export interface DiscoverableTool {
-  readonly name: string;
-  readonly description: string;
-  readonly input_schema: { readonly properties: Readonly<Record<string, unknown>>; readonly required: readonly string[] };
-}
-export interface DeclarationRequest { readonly name: string; readonly fingerprint: string }
-export interface DiscoveryMatch {
-  name: string; purpose: string; inputs: { name: string; type: string; required: boolean }[]; omitted_inputs: number;
-}
-export function declaredToolNames(tools: readonly unknown[]): string[] {
-  return tools.flatMap(tool => tool !== null && typeof tool === "object" && "name" in tool && typeof tool.name === "string" ? [tool.name] : []);
-}
-const compare = (a: string, b: string) => a < b ? -1 : a > b ? 1 : 0;
-function record(raw: unknown): Record<string, unknown> | undefined {
-  return raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw as Record<string, unknown> : undefined;
-}
-function parameterType(raw: unknown): string {
-  if (raw === null || typeof raw !== "object") return "schema";
-  const type = (raw as Record<string, unknown>)["type"];
-  if (typeof type === "string") return type.slice(0, 64);
-  if (Array.isArray(type) && type.every(item => typeof item === "string")) return type.join("|").slice(0, 64);
-  return "schema";
-}
-
-/** Pure, deterministic matching over the caller's already-selected directory; never perform discovery I/O. */
-export function discoverTools(catalog: readonly DiscoverableTool[], query: string, limit = 5): DiscoveryMatch[] {
-  if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_DISCOVERY_RESULTS) throw new Error("invalid discovery limit");
-  const normalized = query.trim().toLowerCase();
-  if (!normalized || query.length > MAX_DISCOVERY_QUERY) throw new Error("query must contain 1 to 256 characters");
-  const terms = normalized.split(/[^\p{L}\p{N}_-]+/u).filter(Boolean);
-  if (terms.length === 0) return [];
-  return catalog.map(tool => {
-    const name = tool.name.toLowerCase(), text = `${name} ${tool.description.toLowerCase()}`;
-    const score = name === normalized ? 100 : terms.every(term => text.includes(term))
-      ? 1 + terms.filter(term => name.includes(term)).length : 0;
-    return { tool, score };
-  }).filter(item => item.score > 0).sort((a, b) => b.score - a.score || compare(a.tool.name, b.tool.name))
-    .slice(0, limit).map(({ tool }) => {
-      const required = new Set(tool.input_schema.required);
-      const parameters = Object.entries(tool.input_schema.properties).sort(([a], [b]) =>
-        Number(required.has(b)) - Number(required.has(a)) || compare(a, b));
-      return { name: tool.name, purpose: tool.description.slice(0, MAX_PURPOSE_CHARS),
-        inputs: parameters.slice(0, MAX_PARAMETER_HINTS).map(([name, raw]) => ({ name: name.slice(0, 128), type: parameterType(raw), required: required.has(name) })),
-        omitted_inputs: Math.max(0, parameters.length - MAX_PARAMETER_HINTS) };
-    });
-}
-
-/** A model assertion or another extension's data cannot authorize a declaration (D11). */
-export function recordedDeclarations(events: readonly LogEvent[]): DeclarationRequest[] {
-  const invocations = new Map<string, ToolInvocationEvent>();
-  const requested = new Map<string, { request: DeclarationRequest; user: string | undefined }>();
-  let user: string | undefined;
-  for (const event of events) {
-    if (event.t === "user") { user = event.id; continue; }
-    if (event.t === "interrupt") {
-      for (const [name, value] of requested) if (value.user === event.user_id) requested.delete(name);
-      continue;
-    }
-    if (event.t === "tool_invocation") { invocations.set(event.id, event); continue; }
-    if (event.t !== "tool_result" || !event.ok || !event.invocation_ref) continue;
-    if (event.outcome !== undefined && event.outcome.status !== "completed") continue;
-    const invocation = invocations.get(event.invocation_ref.event);
-    if (invocation?.name !== "tool_search" || invocation.call_id !== event.call_id) continue;
-    const data = record(event.data);
-    if (!data || data["kind"] !== "tool_discovery" || data["version"] !== 1) continue;
-    const entries = data["requested"];
-    if (!Array.isArray(entries) || entries.length > MAX_DISCOVERY_RESULTS) continue;
-    for (const entry of entries) {
-      const item = record(entry);
-      if (!item) continue;
-      const name = item["name"], fingerprint = item["fingerprint"];
-      if (typeof name === "string" && /^[a-zA-Z0-9_-]{1,128}$/.test(name) && typeof fingerprint === "string" && /^[a-f0-9]{64}$/.test(fingerprint)) {
-        requested.set(name, { request: { name, fingerprint }, user });
-      }
-    }
-  }
-  return [...requested.values()].map(value => value.request);
-}