@xingjisoft/neutrino 0.6.2 → 0.7.0

package/dist/fast/worker.js

@@ -0,0 +1,185 @@
+import { outputAllowance, prepareContext } from "../llm/context.js";
+import { currentTask, TaskControlError } from "../llm/runtime.js";
+import { FastTaskError } from "./scheduler.js";
+// Fast-only guidance; batching never changes tool availability, ordering or approval.
+export const FAST_INSPECTION_POLICY = "Read known required paths directly without a separate directory-listing round. If a listing is needed, request it together with independent reads whose paths are already known. Discover unknown paths before reading them. ";
+export const FAST_COMMAND_POLICY = "When commands are available and necessary, combine related reads, computation, writes and read-back assertions for THIS task in one command when the full sequence is known. Preserve prerequisite order and stop on failed assertions. Split calls when later actions require diagnosis or a separate safety decision. The full command body still requires normal approval. Keep independent verification in its separate agent scope. ";
+const FINISH = "finish_task";
+const list = (value) => Array.isArray(value) ? value.filter((s) => typeof s === "string") : [];
+function finishTool(verification) {
+    return { type: "function", function: {
+            name: FINISH,
+            description: verification
+                ? "Finish independent local verification with an explicit boolean verdict. Completed/true means all original acceptance criteria and actual necessary checks passed. Cite actual evidence and use false/partial for unresolved work."
+                : "Finish this work task with a factual self-contained report. Keep original evidence and state unresolved work. A separate verifier checks every acceptance criterion.",
+            parameters: { type: "object", properties: {
+                    status: { type: "string", enum: ["completed", "partial", "blocked", "failed"], description: "Status of THIS task_goal/output_contract only. Other DAG tasks and later global integration do not make this task partial." },
+                    report: { type: "string" }, conclusions: { type: "array", items: { type: "string" } },
+                    evidence: { type: "array", items: { type: "string" } }, assumptions: { type: "array", items: { type: "string" } },
+                    unresolved: { type: "array", items: { type: "string" }, description: "Only unmet acceptance criteria of THIS task. Use [] when none. Do not list 'none', harmless presentation differences, out-of-scope tasks or future integration." },
+                    ...(verification ? { verification_passed: { type: "boolean" } } : {}),
+                }, required: ["status", "report", "unresolved", ...(verification ? ["verification_passed"] : [])] },
+        } };
+}
+/** Strict control results with correction inside the same private conversation. Standard's child loop is untouched. */
+export async function runFastWorker(options) {
+    const runtime = options.runtime;
+    return runtime.child("subagent", options.task, async (scope) => runtime.withSignal(options.signal, async () => {
+        const signal = currentTask().signal;
+        const records = () => runtime.evidenceFor(scope.runId);
+        const controlRejected = (reason_code) => runtime.diagnostics?.emit("control_rejected", { reason_code }, currentTask());
+        const sideEffects = () => records().some(e => !["read_file", "list_files", "web_search", "delegate", "read_task_evidence"].includes(e.name) && e.status !== "denied");
+        const messages = [{ role: "system", content: `${options.system}\n\n${runtime.instructions()}\n\nUse finish_task to conclude. ` +
+                    "Your scope is this DAG task, not the entire global request. Preserve every global constraint. Status and unresolved refer only to THIS task's acceptance criteria, not to remaining DAG tasks. Use unresolved: [] when this task has no blockers; out-of-scope future work belongs in assumptions, not unresolved. " +
+                    (options.verification
+                        ? "Perform the independent acceptance checks for this task against original sources and requested outputs. A scratch helper or verifier script is not a deliverable unless the user requested it. Do not test the tests, inject faults into scratch copies, replay an already evidenced pipeline in a new directory, or add cleanliness/byte-forensics checks unless the original request explicitly requires that coverage or an actual contradictory result requires diagnosis. Required negative/edge tests for the delivered product remain mandatory. Reuse actual execution evidence to audit recorded actions. All necessary source and correctness checks remain mandatory. "
+                        : "Produce the task output and necessary self-checks. The separate verifier owns independent acceptance checks; do not repeat a full independent/global audit in this worker. Prefer read_file/list_files for inspection, and run_command for necessary computation or tests. ") +
+                    FAST_INSPECTION_POLICY + (scope.policy.readOnly ? "" : FAST_COMMAND_POLICY) +
+                    "Keep the report factual and concise; include requested findings and cite actual evidence IDs. Do not reproduce raw records, command bodies or long checklists already preserved in the ledger unless the output contract requires them. conclusions/evidence/assumptions are optional when they add no new facts; all actual tool evidence is attached automatically. This does not reduce reasoning or verification requirements. " +
+                    (options.verification ? "Your result MUST include top-level verification_passed (boolean), unresolved (string[]), and a factual report. Merely writing PASS or verification_passed=true inside prose is insufficient. " : "") +
+                    "Correct tool/input mistakes in this conversation, preserving actual failed and successful evidence. Do not repeat a denied call unchanged. Never claim that missing checks passed." },
+            { role: "user", content: options.task }];
+        const control = finishTool(options.verification);
+        const tools = runtime.availableTools([...options.tools.filter(t => t.function.name !== FINISH), control]);
+        const names = new Set(tools.map(t => t.function.name));
+        let lastPromptTokens = 0, denied = false, lastReport = "";
+        const accept = (value) => {
+            const result = typeof value.report === "string" ? value.report : typeof value.result === "string" ? value.result : "";
+            const status = typeof value.status === "string" ? value.status : "completed";
+            if (!result.trim() || !["completed", "partial", "blocked", "failed"].includes(status))
+                return undefined;
+            if (options.verification && (typeof value.verification_passed !== "boolean" || !Array.isArray(value.unresolved) || value.unresolved.some(v => typeof v !== "string")))
+                return undefined;
+            if (options.verification && value.verification_passed === true && (status !== "completed" || list(value.unresolved).length))
+                return undefined;
+            if (denied || status === "blocked" || status === "failed")
+                throw new FastTaskError(`${status}: ${result}`, sideEffects());
+            const pending = list(value.unresolved);
+            if (status === "partial" && !pending.length)
+                pending.push("Worker explicitly reported partial work; independent verification must resolve it.");
+            const output = { result, conclusions: list(value.conclusions),
+                evidence: [...new Set([...records().map(e => e.id), ...list(value.evidence)])],
+                assumptions: list(value.assumptions), unresolved: pending, side_effects: sideEffects(),
+                ...(options.verification ? { verification_passed: status === "completed" && value.verification_passed === true } : {}),
+            };
+            runtime.recordResult({ runId: scope.runId, status: status === "partial" ? "partial" : "completed", report: JSON.stringify(output),
+                evidenceIds: records().map(e => e.id), artifacts: records().filter(e => e.name === "write_file" && e.status === "completed").map(e => String(e.arguments.path)), blockers: pending });
+            return output;
+        };
+        try {
+            for (let round = 1; round <= options.maxRounds; round++) {
+                if (signal.aborted)
+                    throw new FastTaskError(String(signal.reason), sideEffects());
+                // Like ordinary children, the last round is for reporting, with no filesystem/network tools.
+                const available = round === options.maxRounds ? [control] : tools;
+                if (round === options.maxRounds)
+                    messages.push({ role: "user", content: "Final report round. Only finish_task is available. Return the actual verified result or report partial/blocked; do not invent completion." });
+                await prepareContext({ messages, tools: available, capacity: options.contextWindow, lastPromptTokens,
+                    createClient: options.createClient, stream: { signal }, preserveBrief: true });
+                const client = options.createClient();
+                let text = "";
+                for await (const chunk of client.streamTurn(messages, available, { signal, maxOutputTokens: outputAllowance(options.contextWindow), final: round === options.maxRounds }))
+                    text += chunk;
+                lastPromptTokens = client.usage?.prompt ?? 0;
+                if (signal.aborted || client.outcome?.status === "cancelled")
+                    throw new FastTaskError(String(signal.reason ?? "Cancelled"), sideEffects());
+                if (client.outcome?.status === "failed")
+                    throw new FastTaskError(client.outcome.error?.message ?? "Worker request failed", sideEffects());
+                lastReport = text || lastReport;
+                const calls = client.toolCalls;
+                messages.push({ role: "assistant", content: text,
+                    ...(client.reasoningContent ? { reasoning_content: client.reasoningContent } : {}),
+                    ...(client.anthropicContent.length ? { anthropic_content: client.anthropicContent } : {}),
+                    ...(calls.length ? { tool_calls: calls.map(call => ({ id: call.id, type: "function", function: { name: call.name, arguments: call.arguments } })) } : {}),
+                });
+                if (!calls.length) {
+                    // A provider returning the requested JSON directly is equivalent to a control call.
+                    let value;
+                    try {
+                        value = JSON.parse(text.trim().replace(/^```json\s*/i, "").replace(/\s*```$/, ""));
+                    }
+                    catch {
+                        value = null;
+                    }
+                    if (value && typeof value === "object" && !Array.isArray(value)) {
+                        const output = accept(value);
+                        if (output)
+                            return output;
+                    }
+                    controlRejected("missing_control_fields");
+                    messages.push({ role: "user", content: "The final result is missing required machine-readable fields. Conclude with finish_task using status, report, conclusions, evidence, assumptions, unresolved" +
+                            (options.verification ? ", and top-level verification_passed: true/false. Keep all original evidence; do not rerun completed writes to fix output formatting." : ". Do not rerun completed writes to fix output formatting.") });
+                    continue;
+                }
+                for (const call of calls) {
+                    if (signal.aborted)
+                        throw new FastTaskError(String(signal.reason), sideEffects());
+                    let args;
+                    try {
+                        const parsed = JSON.parse(call.arguments);
+                        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                            throw new Error("Arguments must be an object");
+                        args = parsed;
+                    }
+                    catch {
+                        controlRejected("invalid_tool_arguments");
+                        messages.push({ role: "tool", tool_call_id: call.id, content: "Invalid JSON object; correct the arguments." });
+                        continue;
+                    }
+                    if (call.name === FINISH) {
+                        if (calls.length !== 1) {
+                            controlRejected("mixed_control_and_tools");
+                            messages.push({ role: "tool", tool_call_id: call.id, content: "finish_task must be sent alone after all requested operations settle. Complete the other calls, then return the final result." });
+                            continue;
+                        }
+                        const output = accept(args);
+                        if (output)
+                            return output;
+                        controlRejected("contradictory_control_result");
+                        messages.push({ role: "tool", tool_call_id: call.id, content: "Invalid or contradictory final result. Include a nonempty report, unresolved array and, for verification, a top-level boolean verification_passed. Status and unresolved concern only THIS task's acceptance criteria. If those passed, use completed/true and unresolved: []; put out-of-scope work in assumptions. If a criterion remains unmet, state it and use false. Clarify using existing evidence without replaying writes or omitting necessary checks." });
+                        continue;
+                    }
+                    let result;
+                    if (!names.has(call.name) || round === options.maxRounds) {
+                        result = "Tool unavailable in this scope/round; use finish_task or correct the call.";
+                        runtime.recordTool(call.name, args, result, "denied");
+                        denied = true;
+                    }
+                    else {
+                        let decision;
+                        try {
+                            runtime.assertTool(call.name, args);
+                            decision = await options.approve(call.name, args);
+                        }
+                        catch (error) {
+                            if (!(error instanceof TaskControlError) || error.code !== "workspace_scope")
+                                throw error;
+                            decision = { approved: false, source: "input", reason: error.message };
+                        }
+                        if (signal.aborted)
+                            throw new FastTaskError(String(signal.reason), sideEffects());
+                        if (decision.approved)
+                            result = await runtime.tool(call.name, args, () => options.execute(call.name, args));
+                        else {
+                            result = `Not executed: ${decision.reason}. Do not retry a denied call unchanged.`;
+                            runtime.recordTool(call.name, args, result, "denied");
+                            // An input scope error ran nothing and can be corrected locally. A safety/human refusal remains a blocker.
+                            if (decision.source !== "input")
+                                denied = true;
+                        }
+                    }
+                    const evidence = records().at(-1);
+                    messages.push({ role: "tool", tool_call_id: call.id, content: result + (evidence ? `\n[Evidence ${evidence.id}; status=${evidence.status}]` : "") });
+                }
+            }
+            throw new FastTaskError(`Worker exhausted its configured ${options.maxRounds} rounds. Partial report: ${lastReport}`, sideEffects());
+        }
+        catch (error) {
+            runtime.recordResult({ runId: scope.runId, status: signal.aborted ? "cancelled" : "failed", report: lastReport,
+                evidenceIds: records().map(e => e.id), artifacts: [], blockers: [error instanceof Error ? error.message : String(error)] });
+            if (error instanceof FastTaskError)
+                throw error;
+            throw new FastTaskError(error instanceof Error ? error.message : String(error), sideEffects());
+        }
+    }), { readOnly: options.readOnly, writePaths: options.writePaths });
+}

package/dist/header.d.ts

@@ -0,0 +1,3 @@
+import type { Buffer } from "./terminal/buffer.js";
+import type { AppState } from "./state.js";
+export declare function drawHeader(buf: Buffer, state: AppState): void;

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { App } from "./app.js";
+export { defaultState, type AppState } from "./state.js";
+export { INTENSITY_LEVELS, INTENSITY_PARAMS, DEFAULT_MODELS, MODES, normalizeMode, normalizeIntensity, modelIntensities, intensityForModel, findConfiguredModel, loadModels, saveModels, loadConfig, saveConfig, listSessions, loadSession, deleteSession, saveSession, type Mode, type ModelsData, type ModelInfo, type Provider, type SessionData, type SessionMeta, } from "./config.js";
+export { LLMClient, type ToolCall } from "./llm/client.js";
+export { executeTool, getToolDefinitions } from "./llm/tools.js";

package/dist/llm/approval.d.ts

@@ -0,0 +1,204 @@
+/**
+ * Approval gate for risky tool calls.
+ *
+ * Three ways a call can be cleared:
+ *
+ *   1. The user's prompt opted out. `无需审批` covers the `high` class only;
+ *      `我已知悉风险，同意给予完整权限，无需任何审批` also covers delete-class
+ *      (`extreme`) commands.
+ *   2. Independent safety reviews clear it; task relevance is advisory except
+ *      for a unanimously identified, extreme and obvious task mismatch.
+ *      This only happens when the conversation's Auto Approval switch is on;
+ *      `extreme` also requires the "extreme-risk auto-approval" setting and
+ *      then runs that panel three times, in three separate rounds, each of
+ *      which has to approve on its own.
+ *   3. A human presses "approve".
+ *
+ * The reviewer is a separate agent with its own system prompt. It never runs
+ * tools; it only reads what is about to happen and answers with JSON.
+ */
+import type { ModelInfo } from "../config.js";
+import { LLMClient } from "./client.js";
+import type { RiskAssessment } from "./risk.js";
+/** Opt out of approval for the `high` class. */
+export declare const NO_APPROVAL_PHRASE = "\u65E0\u9700\u5BA1\u6279";
+/** Opt out of approval for every class, acknowledging the risk. */
+export declare const FULL_TRUST_PHRASE = "\u6211\u5DF2\u77E5\u6089\u98CE\u9669\uFF0C\u540C\u610F\u7ED9\u4E88\u5B8C\u6574\u6743\u9650\uFF0C\u65E0\u9700\u4EFB\u4F55\u5BA1\u6279";
+/** Every automatically reviewed tool call receives two fresh assessments. */
+export declare const AUTO_REVIEWERS = 2;
+/**
+ * Delete-class commands are reviewed this many times once extreme-risk
+ * auto-approval is on: a separate round each time, with fresh reviewers, and
+ * every round has to approve. One confident round cannot carry a deletion.
+ */
+export declare const EXTREME_ROUNDS = 3;
+export interface PromptDirectives {
+    /** `无需审批`: high-risk actions run without asking. */
+    noApproval: boolean;
+    /** Full-trust sentence: every class runs without asking. */
+    fullTrust: boolean;
+}
+/** Read the approval directives out of the user's prompt for this turn. */
+export declare function parsePromptDirectives(prompt: string): PromptDirectives;
+export interface ApprovalContext {
+    /** Literal user message for this turn, kept separate from historical data. */
+    prompt: string;
+    /** Earlier user messages, in order, for resolving follow-ups like "repeat". */
+    priorUserRequests: string[];
+    /** Supporting historical activity, never a source of user authorization. */
+    context: string;
+}
+interface ReviewMessage {
+    role: string;
+    content?: string;
+    name?: string;
+    result?: string;
+}
+/** Capture original user messages before compression or queued input can change the turn. */
+export declare function captureApprovalContext(messages: readonly ReviewMessage[]): ApprovalContext;
+/** Include the actual input in a denial so context mistakes can be diagnosed. */
+export declare function describeApprovalIntent(context: ApprovalContext): string;
+export interface ApprovalRequest {
+    /** Tool name, e.g. `run_command`. */
+    tool: string;
+    /** Parsed tool arguments. */
+    args: Record<string, unknown>;
+    /** Directory the tool will run in. */
+    cwd: string;
+    /** The user message that started this turn. */
+    prompt: string;
+    priorUserRequests?: string[];
+    context?: string;
+    risk: RiskAssessment;
+}
+export type ApprovalSource = "prompt" | "human" | "ai"
+/** The request itself was malformed: nobody was asked and nothing ran. */
+ | "input";
+export interface ApprovalVote {
+    approved: boolean;
+    reason: string;
+    /** Which reviewer produced this vote (1-based, within its round). */
+    reviewer: number;
+    /** Which review round produced this vote (1-based). */
+    round?: number;
+    safetyScore?: number;
+    relevanceScore?: number;
+    hardBlock?: boolean;
+    obviousMismatch?: boolean;
+    mismatchEvidence?: string;
+    /** A failed review is not a low-confidence vote that another can outweigh. */
+    failed?: boolean;
+}
+export interface ApprovalDecision {
+    approved: boolean;
+    source: ApprovalSource;
+    /** One-line explanation, written into the transcript. */
+    reason: string;
+    /** Reviewer votes, when the decision came from the reviewer agent. */
+    votes?: ApprovalVote[];
+    /** Relevance is diagnostic only; combined mirrors safety for older consumers. */
+    assessment?: {
+        safety: number;
+        relevance: number;
+        combined: number;
+    };
+}
+/**
+ * How long a single reviewer may take before it is treated as a denial.
+ *
+ * The reviewer sits on the critical path of a tool call, so an unreachable or
+ * wedged provider must not be able to freeze the conversation: a slow verdict
+ * is a "no", not a hang.
+ */
+export declare const REVIEW_TIMEOUT_MS = 45000;
+export interface ApprovalGateOptions {
+    /** True approves, false denies, null reroutes after a mode change. */
+    askHuman(request: ApprovalRequest): Promise<boolean | null>;
+    /** Route requests to the reviewer agent. Prompt text cannot enable this. */
+    autoApprovalEnabled?(): boolean;
+    /** Reviewer model; defaults to the chat model. */
+    reviewer(): {
+        model: ModelInfo;
+        provider: string;
+        intensity: string;
+    };
+    /** Pro selects its independent reviewer from the resolved task team. */
+    createReviewerClient?(): LLMClient;
+    /** Role instructions supplement, but never replace, the approval policy. */
+    reviewerSystemPrompt?(): string;
+    /** A stopped Pro turn also stops its in-flight independent reviews. */
+    cancelled?(): boolean;
+    /** Whether automatic review may also clear delete-class commands. */
+    extremeAutoApprovalEnabled(): boolean;
+    /** Recent conversation, for the reviewer's context. */
+    context?(): string;
+    /**
+     * Called with the reviewer count when an automated review starts (and again
+     * at each new round), then with null when it finishes, so the UI can explain
+     * the wait.
+     */
+    onReview?(info: {
+        total: number;
+        round?: number;
+        rounds?: number;
+    } | null): void;
+    /** Overridable only so tests do not have to wait 45 s. */
+    reviewTimeoutMs?(): number;
+}
+/** Tool argument that must carry the requester's own justification. */
+export declare const REASON_ARG = "reason";
+/** Shorter justifications are placeholders ("ok", "test"), not reasons. */
+export declare const MIN_REASON_CHARS = 4;
+/** Longest justification passed through to reviewers and the UIs. */
+export declare const MAX_REASON_CHARS = 600;
+/**
+ * The agent's stated reason for a call, folded onto one line, or null when it
+ * gave nothing usable.
+ *
+ * This text is a claim made by whoever proposed the call, never evidence. The
+ * reviewers are told to check it against the actual arguments, because a
+ * fabricated reason ("the user already approved this") would otherwise be a way
+ * to talk the gate into approving something the user never asked for.
+ */
+export declare function statedReason(args: Record<string, unknown> | undefined): string | null;
+export declare class ApprovalGate {
+    private readonly options;
+    constructor(options: ApprovalGateOptions);
+    /**
+     * The single entry point for callers.
+     *
+     * Anything unexpected inside the gate (unreadable config, no reviewer model,
+     * a throwing UI callback) must not escape as a rejection: callers treat that
+     * as a crashed turn, and an error must never read as consent. It becomes an
+     * explicit denial instead.
+     */
+    decide(request: ApprovalRequest): Promise<ApprovalDecision>;
+    /** Route one request to the prompt, the human, or the reviewers. */
+    private route;
+    private human;
+    private automated;
+    /**
+     * Combine the review rounds into one decision.
+     *
+     * With more than one round the votes are deliberately not pooled: each round
+     * is judged on its own and every round must clear the call, so one confident
+     * round can never outweigh another round's objection. The averaged scores are
+     * reported for diagnosis only; they never overturn a round.
+     */
+    private fromVotes;
+    /**
+     * Independent reviews for this call.
+     *
+     * Rounds run one after another and never see each other's verdicts, so an
+     * approval cannot ride on an earlier yes. A round that denies ends the
+     * sequence: a delete-class command does not get further chances to pass.
+     */
+    private reviewAll;
+    /** Missing context only makes a review less informed, never a failure. */
+    private conversationContext;
+    /** Progress callbacks are best-effort: a broken UI must not fail the gate. */
+    private notifyReview;
+    /** One reviewer = one fresh agent with its own client and prompt. */
+    private review;
+}
+export {};

package/dist/llm/approval.js

@@ -1,4 +1,5 @@
 import { LLMClient } from "./client.js";
+import { currentTask } from "./runtime.js";
 /** Opt out of approval for the `high` class. */
 export const NO_APPROVAL_PHRASE = "无需审批";
 /** Opt out of approval for every class, acknowledging the risk. */
@@ -307,8 +308,12 @@ export class ApprovalGate {
      * explicit denial instead.
      */
     async decide(request) {
+        const scope = currentTask();
+        const span = scope?.runtime.diagnostics?.span("approval_decision", { tool_name: request.tool }, scope);
         try {
-            return await this.route(request, 0);
+            const decision = await this.route(request, 0);
+            span?.end({ approved: decision.approved, status: decision.source });
+            return decision;
         }
         catch (err) {
             const detail = err instanceof Error ? err.message : String(err);
@@ -318,6 +323,9 @@ export class ApprovalGate {
                 reason: `the approval gate could not run (${detail}); the call was not approved`,
             };
         }
+        finally {
+            span?.end();
+        }
     }
     /** Route one request to the prompt, the human, or the reviewers. */
     async route(request, depth = 0) {
@@ -363,7 +371,9 @@ export class ApprovalGate {
         const malformed = refuseUnjustified(request);
         if (malformed)
             return malformed;
-        const approved = await this.options.askHuman(request);
+        const scope = currentTask();
+        const span = scope?.runtime.diagnostics?.span("human_approval", { tool_name: request.tool }, scope);
+        const approved = await this.options.askHuman(request).finally(() => span?.end());
         // A mode change reroutes the same request without treating it as consent.
         if (approved === null)
             return this.route(request, depth + 1);
@@ -516,7 +526,8 @@ export class ApprovalGate {
             const rolePrompt = this.options.reviewerSystemPrompt?.();
             const system = rolePrompt ? `${rolePrompt}\n\n${REVIEW_SYSTEM_PROMPT}` : REVIEW_SYSTEM_PROMPT;
             const controller = new AbortController();
-            const raw = await withTimeout(client.complete(system, prompt, { signal: controller.signal, cancelled: this.options.cancelled }), timeout)
+            const raw = await withTimeout(client.complete(system, prompt, { signal: controller.signal, cancelled: this.options.cancelled,
+                ...(currentTask()?.runtime.diagnostics ? { diagnostic: { role: "approval" } } : {}) }), timeout)
                 .finally(() => controller.abort());
             if (raw === null) {
                 // Fail closed: a reviewer that never answers must not stall the turn.

package/dist/llm/client.d.ts

@@ -0,0 +1,118 @@
+import { type ModelInfo } from "../config.js";
+import type { ToolDefinition } from "./tools.js";
+import { DiagnosticRequest, type DiagnosticRequestContext } from "./diagnostics.js";
+import { type AgentError } from "./runtime.js";
+import { type RetryNotice, type RetryPolicy } from "./retry.js";
+export { describeError } from "./retry.js";
+export interface ToolCall {
+    id: string;
+    name: string;
+    arguments: string;
+}
+export interface UsageInfo {
+    prompt: number;
+    completion: number;
+    total: number;
+}
+/** OpenAI reasoning models require max_completion_tokens; other compatible APIs use max_tokens. */
+export declare function completionLimit(model: ModelInfo, provider: string, tokens: number): Record<string, number>;
+interface ApiMessage {
+    role: string;
+    content?: string;
+    reasoning_content?: string;
+    tool_calls?: unknown[];
+    tool_call_id?: string;
+    name?: string;
+    /** Original Anthropic blocks, including signed thinking between tool calls. */
+    anthropic_content?: unknown[];
+}
+export interface StreamOptions {
+    /** Internal opt-in timing metadata; never included in a provider payload. */
+    diagnostic?: DiagnosticRequestContext;
+    diagnosticObserver?: DiagnosticRequest;
+    maxOutputTokens?: number;
+    /** Reserved final request after normal request capacity has been spent. */
+    final?: boolean;
+    /** Cancels both the connection and an in-progress response body. */
+    signal?: AbortSignal;
+    /**
+     * Reported before each wait so the UI can explain why the stream went quiet
+     * for up to 160s instead of looking hung.
+     */
+    onRetry?: (notice: RetryNotice) => void;
+    /**
+     * Polled during the waits: a paused turn, a newer message or a quit has no
+     * interest in the reply any more, and must not be held up by a long backoff.
+     */
+    cancelled?: () => boolean;
+    /** Override the policy (tests, or a caller with its own budget). */
+    retry?: Partial<RetryPolicy>;
+}
+export declare class LLMClient {
+    readonly professional: boolean;
+    model: ModelInfo;
+    provider: string;
+    intensity: string;
+    temperature: number;
+    top_p: number;
+    toolCalls: ToolCall[];
+    usage: UsageInfo | null;
+    outcome: {
+        status: "completed" | "failed" | "cancelled";
+        error?: AgentError;
+    } | null;
+    finishReason: string | null;
+    /**
+     * The thinking text streamed alongside the reply. DeepSeek's thinking mode
+     * requires it to be echoed back on the assistant message that carries a tool
+     * call, so the agent loops attach it to that message.
+     */
+    reasoningContent: string;
+    anthropicContent: unknown[];
+    constructor(model: ModelInfo, provider: string, intensity: string, options?: {
+        professional?: boolean;
+    });
+    /**
+     * Ask the model to compress a transcript into a short summary. Returns an
+     * empty string on any failure so the caller can fall back to simply dropping
+     * the old messages. Uses a throw-away request (no tools) via the normal
+     * streaming path, so provider differences are handled for free.
+     */
+    summarize(transcript: string, options?: StreamOptions): Promise<string>;
+    /**
+     * One-shot completion with its own system prompt. The approval reviewers use
+     * this so they never share context with the conversation they are judging.
+     */
+    complete(system: string, user: string, options?: StreamOptions): Promise<string>;
+    streamTurn(messages: ApiMessage[], tools?: ToolDefinition[], options?: StreamOptions): AsyncGenerator<string>;
+    /**
+     * Drive one request, retrying while the failure is transient.
+     *
+     * A response can be cut off on the very first read — "terminated" when a
+     * proxy or the server closes the connection mid-flight — or the request can
+     * never leave at all. Nothing has reached the user yet, so re-issuing is
+     * invisible and cannot duplicate text; the attempts and the 5s/10s/20s/…
+     * backoff live in `retry.ts`.
+     *
+     * Once a token has been emitted a retry would replay the reply from its
+     * beginning, so the error is surfaced instead and the partial text is kept.
+     */
+    private streamOpenAI;
+    /**
+     * DeepSeek's thinking mode rejects a tools-bearing request when any assistant
+     * message in its history carries no `reasoning_content` ("The
+     * `reasoning_content` in the thinking mode must be passed back to the API").
+     * An empty string is accepted, which is the honest value for a message that
+     * predates this turn's thinking: a compressed summary, the planner's plan, an
+     * error note or a session saved before this rule existed. Endpoints outside
+     * thinking mode must not receive the field at all.
+     */
+    private wireMessages;
+    /** A single streaming attempt; see `streamOpenAI` for the retry policy. */
+    private openAIAttempt;
+    /** Anthropic counterpart of `streamOpenAI`, with the same retry policy. */
+    private streamAnthropic;
+    /** A single streaming attempt; see `streamAnthropic` for the retry policy. */
+    private anthropicAttempt;
+    private captureAnthropicContent;
+}