agent-nuvira 3.3.10 → 3.3.12

package/dist/config/capability-mode.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Capability mode — the one switch that decides how much the agent spends on
+ * REASONING versus how much it saves.
+ *
+ * The product decision behind it: an agent is judged on whether it DELIVERS on
+ * the ask, with depth, and navigates its own failures — and a single bad
+ * experience is enough to lose a user. Cost-saving that produces a weak, nagging
+ * agent is a false economy. But cost is real, so the user owns the trade:
+ *
+ *   - `balanced` (DEFAULT) — the agent uses the best model available for
+ *     COMPLEX/CRITICAL work, cheaper models for simple/moderate work, and
+ *     escalates when it detects a real stall. This is the recommended default:
+ *     ~most of the reliability at a fraction of the cost.
+ *   - `max` — cost is not a concern. Every turn routes to the strongest
+ *     available model, paid models are always allowed, cost ceilings are lifted,
+ *     and the loop is given the longest reasoning budget. This is "let the agent
+ *     act with full depth, whatever it costs."
+ *
+ * What it deliberately does NOT change: every deterministic SAFETY invariant
+ * (deny-first commands, the workspace boundary, the git gates, effect
+ * verification). A model must never decide what is destructive, in either mode —
+ * so this switch can widen AUTONOMY and MODEL QUALITY, never the safety surface.
+ *
+ * Resolution order (highest wins): the process environment (`NUVIRA_CAPABILITY_MODE`
+ * or the legacy `BUFF_CAPABILITY_MODE`), then `routing.capabilityMode` in the
+ * config file, then the default. Read fresh on every turn, so a change applies to
+ * the next turn without a restart — the same rule the size limits follow.
+ */
+import type { ConfigManager } from './manager.js';
+import type { ReasoningEffort } from './types.js';
+/** The two modes. `balanced` is the default; `max` ignores cost. */
+export type CapabilityMode = 'balanced' | 'max';
+/**
+ * `max` mode's model-level REASONING floor — the difference between "prefer
+ * strong" (a scoring nudge that a cheap-but-strong-enough model can still win)
+ * and "require strong" (a hard eligibility gate). This is what makes the max
+ * promise checkable: candidates whose SERVED model scores below it are
+ * eliminated.
+ *
+ * 0.7 is the same calibration the router already trusts for the asks that must
+ * not be served by a weak model (effect-observing `verification`/`debugging`,
+ * and `planning`): it drops stacked fast-lite ids (`…-flash-lite` ≈ 0.65) and
+ * small models, while keeping a 70B id (≈ 0.80), a single `-flash` id (≈ 0.75)
+ * and frontier-family ids. It is NEVER a dead-end — the router's benign
+ * fallback restores the full ranking when the floor would eliminate everyone,
+ * so a deployment whose only credentialed provider is weak still gets served.
+ */
+export declare const MAX_CAPABILITY_MIN_REASONING = 0.7;
+/**
+ * The reasoning depth `max` requests from a routed model, when that model is
+ * verified to accept a reasoning-effort parameter. `high` is the strongest
+ * value the OpenAI-compatible family accepts, and the largest thinking budget
+ * for the native families — i.e. "as much as this model will give."
+ */
+export declare const MAX_CAPABILITY_REASONING_EFFORT: ReasoningEffort;
+/** The default when nothing is configured. */
+export declare const DEFAULT_CAPABILITY_MODE: CapabilityMode;
+/**
+ * Parse a raw value into a mode. Accepts the two canonical names plus the
+ * intuitive synonyms a user might type, so a typo cannot silently leave the
+ * agent on the cheaper mode when the user asked for maximum depth:
+ *   - `max` / `maximum` / `unlimited` / `performance` / `performance-first` → 'max'
+ *   - `balanced` / `balance` / `default` → 'balanced'
+ * Returns null for anything unrecognized (the caller then falls through to the
+ * next source rather than guessing).
+ */
+export declare function parseCapabilityMode(raw: string | undefined | null): CapabilityMode | null;
+/**
+ * The effective capability mode for this process.
+ *
+ * Reads the environment first (a shell export wins over the file, exactly like
+ * every other process switch), then the config file, then the default. Pure and
+ * never throws — a config read failure falls back to the default rather than
+ * breaking a turn.
+ */
+export declare function resolveCapabilityMode(cm?: ConfigManager): CapabilityMode;
+/** True when the user has asked for maximum capability (cost is not a concern). */
+export declare function isMaxCapability(cm?: ConfigManager): boolean;
+/**
+ * The routing knobs a capability mode implies — the SINGLE mapping consumed by
+ * the resolve-options assembly, so every entry point (chat, execute, orchestrator)
+ * reads the mode the same way and no surface gets a degraded routing experience.
+ *
+ * `balanced` leaves every knob untouched (`undefined` = "use the configured
+ * value"), so the existing behaviour is byte-identical when the mode is default.
+ * `max` applies the cost-relaxing overrides:
+ *   - `preferenceMode: 'performance-first'` — the router stops preferring cheap
+ *     candidates and scores on capability;
+ *   - `allowPaid: true` — paid/high-capacity models are always eligible, even
+ *     for simple tasks;
+ *   - `maxCostUsd: undefined` — no per-call cost ceiling;
+ *   - `minReasoning: MAX_CAPABILITY_MIN_REASONING` — require a strong served
+ *     model (see the constant), so "max" cannot be satisfied by a cheap, weak
+ *     model that merely happens to be allowed.
+ */
+export interface CapabilityRoutingPolicy {
+    preferenceMode?: 'balanced' | 'performance-first';
+    allowPaid?: boolean;
+    maxCostUsd?: number;
+    /** Served-model reasoning floor (0–1); candidates below it are eliminated. */
+    minReasoning?: number;
+    /**
+     * Provider-neutral request for more reasoning depth, applied at the adapter
+     * boundary ONLY when the routed provider × model has been verified to accept
+     * the corresponding parameter (default-deny; see reasoning-effort.ts).
+     * `balanced` leaves this undefined (no request-side change at all); `max`
+     * asks for the strongest reasoning a model supports. This is the ceiling the
+     * routing floor alone cannot raise: a floor PICKS a strong model, this asks
+     * that model to THINK harder.
+     */
+    reasoningEffort?: ReasoningEffort;
+}
+/**
+ * The reasoning depth the current capability mode asks for, or `undefined`
+ * when the mode does not request one (`balanced`). Convenience over
+ * `capabilityRoutingPolicy(resolveCapabilityMode(cm))` for call sites that
+ * only need this one knob. Reading it is cheap and never throws.
+ */
+export declare function capabilityReasoningEffort(cm?: ConfigManager): ReasoningEffort | undefined;
+/** The routing policy for a mode. `balanced` returns an empty object (no overrides). */
+export declare function capabilityRoutingPolicy(mode: CapabilityMode): CapabilityRoutingPolicy;
+//# sourceMappingURL=capability-mode.d.ts.map

package/dist/config/capability-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-mode.d.ts","sourceRoot":"","sources":["../../src/config/capability-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,oEAAoE;AACpE,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,KAAK,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,EAAE,eAAwB,CAAC;AAEvE,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,EAAE,cAA2B,CAAC;AAKlE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,cAAc,GAAG,IAAI,CAQzF;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,cAAc,CAaxE;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAE3D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,cAAc,CAAC,EAAE,UAAU,GAAG,mBAAmB,CAAC;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,eAAe,GAAG,SAAS,CAEzF;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,uBAAuB,CAgBrF"}

package/dist/config/capability-mode.js

@@ -0,0 +1,132 @@
+/**
+ * Capability mode — the one switch that decides how much the agent spends on
+ * REASONING versus how much it saves.
+ *
+ * The product decision behind it: an agent is judged on whether it DELIVERS on
+ * the ask, with depth, and navigates its own failures — and a single bad
+ * experience is enough to lose a user. Cost-saving that produces a weak, nagging
+ * agent is a false economy. But cost is real, so the user owns the trade:
+ *
+ *   - `balanced` (DEFAULT) — the agent uses the best model available for
+ *     COMPLEX/CRITICAL work, cheaper models for simple/moderate work, and
+ *     escalates when it detects a real stall. This is the recommended default:
+ *     ~most of the reliability at a fraction of the cost.
+ *   - `max` — cost is not a concern. Every turn routes to the strongest
+ *     available model, paid models are always allowed, cost ceilings are lifted,
+ *     and the loop is given the longest reasoning budget. This is "let the agent
+ *     act with full depth, whatever it costs."
+ *
+ * What it deliberately does NOT change: every deterministic SAFETY invariant
+ * (deny-first commands, the workspace boundary, the git gates, effect
+ * verification). A model must never decide what is destructive, in either mode —
+ * so this switch can widen AUTONOMY and MODEL QUALITY, never the safety surface.
+ *
+ * Resolution order (highest wins): the process environment (`NUVIRA_CAPABILITY_MODE`
+ * or the legacy `BUFF_CAPABILITY_MODE`), then `routing.capabilityMode` in the
+ * config file, then the default. Read fresh on every turn, so a change applies to
+ * the next turn without a restart — the same rule the size limits follow.
+ */
+/**
+ * `max` mode's model-level REASONING floor — the difference between "prefer
+ * strong" (a scoring nudge that a cheap-but-strong-enough model can still win)
+ * and "require strong" (a hard eligibility gate). This is what makes the max
+ * promise checkable: candidates whose SERVED model scores below it are
+ * eliminated.
+ *
+ * 0.7 is the same calibration the router already trusts for the asks that must
+ * not be served by a weak model (effect-observing `verification`/`debugging`,
+ * and `planning`): it drops stacked fast-lite ids (`…-flash-lite` ≈ 0.65) and
+ * small models, while keeping a 70B id (≈ 0.80), a single `-flash` id (≈ 0.75)
+ * and frontier-family ids. It is NEVER a dead-end — the router's benign
+ * fallback restores the full ranking when the floor would eliminate everyone,
+ * so a deployment whose only credentialed provider is weak still gets served.
+ */
+export const MAX_CAPABILITY_MIN_REASONING = 0.7;
+/**
+ * The reasoning depth `max` requests from a routed model, when that model is
+ * verified to accept a reasoning-effort parameter. `high` is the strongest
+ * value the OpenAI-compatible family accepts, and the largest thinking budget
+ * for the native families — i.e. "as much as this model will give."
+ */
+export const MAX_CAPABILITY_REASONING_EFFORT = 'high';
+/** The default when nothing is configured. */
+export const DEFAULT_CAPABILITY_MODE = 'balanced';
+/** Env names, `NUVIRA_*` first with the legacy `BUFF_*` alias accepted. */
+const ENV_NAMES = ['NUVIRA_CAPABILITY_MODE', 'BUFF_CAPABILITY_MODE'];
+/**
+ * Parse a raw value into a mode. Accepts the two canonical names plus the
+ * intuitive synonyms a user might type, so a typo cannot silently leave the
+ * agent on the cheaper mode when the user asked for maximum depth:
+ *   - `max` / `maximum` / `unlimited` / `performance` / `performance-first` → 'max'
+ *   - `balanced` / `balance` / `default` → 'balanced'
+ * Returns null for anything unrecognized (the caller then falls through to the
+ * next source rather than guessing).
+ */
+export function parseCapabilityMode(raw) {
+    const v = String(raw ?? '').trim().toLowerCase();
+    if (!v)
+        return null;
+    if (v === 'max' || v === 'maximum' || v === 'unlimited' || v === 'performance' || v === 'performance-first') {
+        return 'max';
+    }
+    if (v === 'balanced' || v === 'balance' || v === 'default')
+        return 'balanced';
+    return null;
+}
+/**
+ * The effective capability mode for this process.
+ *
+ * Reads the environment first (a shell export wins over the file, exactly like
+ * every other process switch), then the config file, then the default. Pure and
+ * never throws — a config read failure falls back to the default rather than
+ * breaking a turn.
+ */
+export function resolveCapabilityMode(cm) {
+    for (const name of ENV_NAMES) {
+        const parsed = parseCapabilityMode(process.env[name]);
+        if (parsed)
+            return parsed;
+    }
+    try {
+        const routing = cm?.getAll?.()?.routing;
+        const parsed = parseCapabilityMode(typeof routing?.capabilityMode === 'string' ? routing.capabilityMode : undefined);
+        if (parsed)
+            return parsed;
+    }
+    catch {
+        // Best-effort — a config failure must not break routing.
+    }
+    return DEFAULT_CAPABILITY_MODE;
+}
+/** True when the user has asked for maximum capability (cost is not a concern). */
+export function isMaxCapability(cm) {
+    return resolveCapabilityMode(cm) === 'max';
+}
+/**
+ * The reasoning depth the current capability mode asks for, or `undefined`
+ * when the mode does not request one (`balanced`). Convenience over
+ * `capabilityRoutingPolicy(resolveCapabilityMode(cm))` for call sites that
+ * only need this one knob. Reading it is cheap and never throws.
+ */
+export function capabilityReasoningEffort(cm) {
+    return capabilityRoutingPolicy(resolveCapabilityMode(cm)).reasoningEffort;
+}
+/** The routing policy for a mode. `balanced` returns an empty object (no overrides). */
+export function capabilityRoutingPolicy(mode) {
+    if (mode === 'max') {
+        return {
+            preferenceMode: 'performance-first',
+            allowPaid: true,
+            maxCostUsd: undefined,
+            // Not just "prefer capability" — require it. A paid-but-weak model must
+            // not satisfy a mode whose whole promise is "the strongest model."
+            minReasoning: MAX_CAPABILITY_MIN_REASONING,
+            // And having PICKED a strong model, ask it to reason deeply. Gated
+            // per-model (default-deny) so this can never break a model that lacks the
+            // parameter. See reasoning-effort.ts.
+            reasoningEffort: MAX_CAPABILITY_REASONING_EFFORT,
+        };
+    }
+    return {};
+}
+//# sourceMappingURL=capability-mode.js.map

package/dist/config/capability-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-mode.js","sourceRoot":"","sources":["../../src/config/capability-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAQH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAoB,MAAM,CAAC;AAEvE,8CAA8C;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAAmB,UAAU,CAAC;AAElE,2EAA2E;AAC3E,MAAM,SAAS,GAAG,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAA8B;IAChE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,mBAAmB,EAAE,CAAC;QAC5G,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,EAAkB;IACtD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAmD,CAAC;QACpF,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,OAAO,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrH,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;IAC3D,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,EAAkB;IAChD,OAAO,qBAAqB,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC;AAC7C,CAAC;AAqCD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,EAAkB;IAC1D,OAAO,uBAAuB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;AAC5E,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,IAAoB;IAC1D,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO;YACL,cAAc,EAAE,mBAAmB;YACnC,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,SAAS;YACrB,wEAAwE;YACxE,mEAAmE;YACnE,YAAY,EAAE,4BAA4B;YAC1C,mEAAmE;YACnE,0EAA0E;YAC1E,sCAAsC;YACtC,eAAe,EAAE,+BAA+B;SACjD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/config/limits.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Configurable size limits — how much text one read may carry into a turn.
+ *
+ * Two limits used to be hardcoded constants that a user could not move:
+ *
+ *   - `read_extract` capped one extraction at 40,000 characters. A 66,021-char
+ *     lab report was therefore read only in part, and — worse — the truncation
+ *     was reported in `metadata.truncated` but NOT in the text, so the model
+ *     could (and did) assess half a document as if it were the whole one.
+ *   - the dashboard composer refused any attachment over 300 KB. A project file
+ *     larger than that had no route in at all.
+ *
+ * Both are now read from the environment on every call (so a change takes effect
+ * on the NEXT turn, and a value exported in a shell wins over the file, exactly
+ * like every other process switch), with the historical values as the defaults.
+ * The readers are pure and never throw: a malformed value falls back to the
+ * default rather than breaking a read.
+ *
+ * Names are `NUVIRA_*`; the `BUFF_*` aliases are accepted for compatibility.
+ */
+/** The historical `read_extract` cap, in characters. */
+export declare const DEFAULT_EXTRACT_MAX_CHARS = 40000;
+/** The historical dashboard attachment cap, in bytes (~300 KB). */
+export declare const DEFAULT_ATTACHMENT_MAX_BYTES = 300000;
+/**
+ * A sane upper bound, so a typo cannot ask for a gigabyte of extraction text and
+ * take the process out. 8M characters is ~2M tokens — already far past any
+ * model's window, so this only ever bites a mistake.
+ */
+export declare const MAX_EXTRACT_MAX_CHARS_CEILING = 8000000;
+/** Ceiling on the attachment cap, in bytes (256 MB). */
+export declare const MAX_ATTACHMENT_MAX_BYTES_CEILING: number;
+/**
+ * The character budget for one `read_extract` call.
+ *
+ * Read fresh on every call, so setting the env var (from the dashboard's Process
+ * Environment page, the CLI, or a shell export) applies to the next read without
+ * a restart.
+ */
+export declare function resolveExtractMaxChars(): number;
+/**
+ * The size cap for one composer attachment, in bytes.
+ *
+ * Read fresh on every hydration, so raising it takes effect on the next turn.
+ */
+export declare function resolveAttachmentMaxBytes(): number;
+//# sourceMappingURL=limits.d.ts.map

package/dist/config/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/config/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,mEAAmE;AACnE,eAAO,MAAM,4BAA4B,SAAU,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,UAAY,CAAC;AAEvD,wDAAwD;AACxD,eAAO,MAAM,gCAAgC,QAAoB,CAAC;AAclE;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAO/C;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAOlD"}

package/dist/config/limits.js

@@ -0,0 +1,64 @@
+/**
+ * Configurable size limits — how much text one read may carry into a turn.
+ *
+ * Two limits used to be hardcoded constants that a user could not move:
+ *
+ *   - `read_extract` capped one extraction at 40,000 characters. A 66,021-char
+ *     lab report was therefore read only in part, and — worse — the truncation
+ *     was reported in `metadata.truncated` but NOT in the text, so the model
+ *     could (and did) assess half a document as if it were the whole one.
+ *   - the dashboard composer refused any attachment over 300 KB. A project file
+ *     larger than that had no route in at all.
+ *
+ * Both are now read from the environment on every call (so a change takes effect
+ * on the NEXT turn, and a value exported in a shell wins over the file, exactly
+ * like every other process switch), with the historical values as the defaults.
+ * The readers are pure and never throw: a malformed value falls back to the
+ * default rather than breaking a read.
+ *
+ * Names are `NUVIRA_*`; the `BUFF_*` aliases are accepted for compatibility.
+ */
+/** The historical `read_extract` cap, in characters. */
+export const DEFAULT_EXTRACT_MAX_CHARS = 40_000;
+/** The historical dashboard attachment cap, in bytes (~300 KB). */
+export const DEFAULT_ATTACHMENT_MAX_BYTES = 300_000;
+/**
+ * A sane upper bound, so a typo cannot ask for a gigabyte of extraction text and
+ * take the process out. 8M characters is ~2M tokens — already far past any
+ * model's window, so this only ever bites a mistake.
+ */
+export const MAX_EXTRACT_MAX_CHARS_CEILING = 8_000_000;
+/** Ceiling on the attachment cap, in bytes (256 MB). */
+export const MAX_ATTACHMENT_MAX_BYTES_CEILING = 256 * 1024 * 1024;
+/** Read an integer from the environment, falling back to `fallback` on anything invalid. */
+function intFromEnv(names, fallback, min, max) {
+    for (const name of names) {
+        const raw = process.env[name];
+        if (raw === undefined || raw.trim() === '')
+            continue;
+        const n = Number(raw.trim());
+        if (!Number.isFinite(n) || !Number.isInteger(n) || n < min)
+            continue;
+        return Math.min(n, max);
+    }
+    return fallback;
+}
+/**
+ * The character budget for one `read_extract` call.
+ *
+ * Read fresh on every call, so setting the env var (from the dashboard's Process
+ * Environment page, the CLI, or a shell export) applies to the next read without
+ * a restart.
+ */
+export function resolveExtractMaxChars() {
+    return intFromEnv(['NUVIRA_EXTRACT_MAX_CHARS', 'BUFF_EXTRACT_MAX_CHARS'], DEFAULT_EXTRACT_MAX_CHARS, 1, MAX_EXTRACT_MAX_CHARS_CEILING);
+}
+/**
+ * The size cap for one composer attachment, in bytes.
+ *
+ * Read fresh on every hydration, so raising it takes effect on the next turn.
+ */
+export function resolveAttachmentMaxBytes() {
+    return intFromEnv(['NUVIRA_ATTACHMENT_MAX_BYTES', 'BUFF_ATTACHMENT_MAX_BYTES'], DEFAULT_ATTACHMENT_MAX_BYTES, 1, MAX_ATTACHMENT_MAX_BYTES_CEILING);
+}
+//# sourceMappingURL=limits.js.map

package/dist/config/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/config/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,wDAAwD;AACxD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEhD,mEAAmE;AACnE,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAEvD,wDAAwD;AACxD,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAElE,4FAA4F;AAC5F,SAAS,UAAU,CAAC,KAAe,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IAC7E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACrD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,SAAS;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,UAAU,CACf,CAAC,0BAA0B,EAAE,wBAAwB,CAAC,EACtD,yBAAyB,EACzB,CAAC,EACD,6BAA6B,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,UAAU,CACf,CAAC,6BAA6B,EAAE,2BAA2B,CAAC,EAC5D,4BAA4B,EAC5B,CAAC,EACD,gCAAgC,CACjC,CAAC;AACJ,CAAC"}

package/dist/config/process-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-env.d.ts","sourceRoot":"","sources":["../../src/config/process-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,eAAe,GAAG,OAAO,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,MAAM,kBAAkB;AAC5B,qEAAqE;AACnE,MAAM;AACR,kGAAkG;GAChG,QAAQ;AACV,4DAA4D;GAC1D,YAAY;AACd,0GAA0G;GACxG,eAAe,CAAC;AAEpB,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,eAAe,CAAC;IACvB;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,iDAAiD;IACjD,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,iBAAiB,EAwHxD,CAAC;AAEF,wCAAwC;AACxC,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAMD,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;AAEtG,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAoB3E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAkBtG"}
+{"version":3,"file":"process-env.d.ts","sourceRoot":"","sources":["../../src/config/process-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,gFAAgF;AAChF,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,eAAe,GAAG,OAAO,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,MAAM,kBAAkB;AAC5B,qEAAqE;AACnE,MAAM;AACR,kGAAkG;GAChG,QAAQ;AACV,4DAA4D;GAC1D,YAAY;AACd,0GAA0G;GACxG,eAAe,CAAC;AAEpB,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,eAAe,CAAC;IACvB;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,iDAAiD;IACjD,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,iBAAiB,EAwKxD,CAAC;AAEF,wCAAwC;AACxC,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D;AAMD,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,CAAC;AAEtG,0EAA0E;AAC1E,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,GACV;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAoB3E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAkBtG"}

package/dist/config/process-env.js

@@ -84,6 +84,50 @@ export const PROCESS_ENV_VARS = [
         unsetMeans: 'Semantic recall is ON (the default). This switch turns it off.',
         cliEquivalent: 'nuvira execute --no-session-recall  ·  memory.sessionRecall in buffconfig.json',
     },
+    {
+        name: 'NUVIRA_EXTRACT_MAX_CHARS',
+        label: 'Document extraction budget',
+        group: 'turn',
+        kind: 'text',
+        placeholder: '40000',
+        valueLabel: 'Save',
+        description: 'How many characters one read_extract call may return. A document larger than this is read only in part, and the truncation is stated in the returned text. Raise it to read a large report in one pass (up to 8,000,000).',
+        unsetMeans: '40,000 characters — about 10,000 words.',
+        cliEquivalent: 'nuvira config limit set extract-max-chars <n>  ·  NUVIRA_EXTRACT_MAX_CHARS',
+    },
+    {
+        name: 'NUVIRA_ATTACHMENT_MAX_BYTES',
+        label: 'Attachment size cap (bytes)',
+        group: 'turn',
+        kind: 'text',
+        placeholder: '300000',
+        valueLabel: 'Save',
+        description: 'The largest single file the dashboard composer will accept, in bytes. A file over this cap is refused before it is sent. Raise it for a project file larger than ~300 KB (up to 268435456 = 256 MB).',
+        unsetMeans: '300,000 bytes (~293 KB) per attachment, 10 attachments per turn.',
+        cliEquivalent: 'nuvira config limit set attachment-max-kb <n>  ·  NUVIRA_ATTACHMENT_MAX_BYTES',
+    },
+    {
+        name: 'NUVIRA_CAPABILITY_MODE',
+        label: 'Capability mode',
+        group: 'turn',
+        kind: 'text',
+        placeholder: 'balanced',
+        valueLabel: 'Save',
+        description: 'How much the agent spends on REASONING versus how much it saves. balanced (default): the best model for complex/critical work, cheaper models for simple work, and escalation when a stall is detected. max: cost is not a concern — every turn routes to the strongest model (a reasoning floor requires a strong served model, not merely a paid one), paid models are always allowed, cost ceilings are lifted, and the loop gets its longest reasoning budget.',
+        unsetMeans: 'balanced — the recommended default.',
+        cliEquivalent: 'nuvira config capability set <balanced|max>  ·  NUVIRA_CAPABILITY_MODE',
+    },
+    {
+        name: 'NUVIRA_WORK_DIGEST',
+        label: 'Work digest scope',
+        group: 'turn',
+        kind: 'text',
+        placeholder: 'all',
+        valueLabel: 'Save',
+        description: 'When the loop compacts a long turn\'s context, it can keep a short digest of what the turn has done (files changed, commands and whether they passed, tools used). all (default): always keep the digest. max: only under the max capability mode. off: never.',
+        unsetMeans: 'all — the digest is kept in every mode.',
+        cliEquivalent: 'NUVIRA_WORK_DIGEST=all|max|off',
+    },
     {
         name: 'NUVIRA_STRICT_MODEL',
         label: 'Refuse model substitution',

package/dist/config/process-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-env.js","sourceRoot":"","sources":["../../src/config/process-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAwDH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAiC;IAC5D;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,8GAA8G;QAChH,UAAU,EAAE,8CAA8C;QAC1D,aAAa,EAAE,wBAAwB;KACxC;IACD;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,uBAAuB;QAC9B,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,eAAe;QACrB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,qCAAqC;QAClD,WAAW,EACT,qGAAqG;QACvG,UAAU,EAAE,8CAA8C;QAC1D,aAAa,EAAE,2BAA2B;KAC3C;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,gCAAgC;QACvC,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,6MAA6M;QAC/M,UAAU,EAAE,2DAA2D;QACvE,aAAa,EAAE,8EAA8E;KAC9F;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,0BAA0B;QACjC,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,yKAAyK;QAC3K,UAAU,EAAE,gEAAgE;QAC5E,aAAa,EAAE,gFAAgF;KAChG;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,2BAA2B;QAClC,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,8HAA8H;QAChI,UAAU,EAAE,uFAAuF;KACpG;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,2BAA2B;QAClC,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,4GAA4G;QAC9G,UAAU,EAAE,oBAAoB;KACjC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,wGAAwG;QAC1G,UAAU,EAAE,oEAAoE;KACjF;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,yBAAyB;QAChC,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uBAAuB;QACpC,WAAW,EACT,0IAA0I;QAC5I,UAAU,EAAE,sFAAsF;KACnG;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uBAAuB;QACpC,WAAW,EACT,mJAAmJ;QACrJ,UAAU,EAAE,8EAA8E;QAC1F,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EACT,6IAA6I;QAC/I,UAAU,EAAE,6EAA6E;QACzF,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,0BAA0B;QACjC,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,kEAAkE;QAC/E,UAAU,EAAE,8EAA8E;QAC1F,aAAa,EAAE,gCAAgC;KAChD;CACF,CAAC;AAEF,wCAAwC;AACxC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAKvD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExD,4EAA4E;IAC5E,8EAA8E;IAC9E,qDAAqD;IACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAElE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAEzF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAErD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAoC,EAAE,KAAoB;IAC3F,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC;QAC5F,KAAK,MAAM;YACT,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC;QAC3D,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;QAC9B,KAAK,eAAe;YAClB,uEAAuE;YACvE,6DAA6D;YAC7D,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC;QACzD;YACE,uEAAuE;YACvE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}
+{"version":3,"file":"process-env.js","sourceRoot":"","sources":["../../src/config/process-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAwDH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAiC;IAC5D;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,8GAA8G;QAChH,UAAU,EAAE,8CAA8C;QAC1D,aAAa,EAAE,wBAAwB;KACxC;IACD;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,uBAAuB;QAC9B,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,eAAe;QACrB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,qBAAqB;QACjC,WAAW,EAAE,qCAAqC;QAClD,WAAW,EACT,qGAAqG;QACvG,UAAU,EAAE,8CAA8C;QAC1D,aAAa,EAAE,2BAA2B;KAC3C;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,gCAAgC;QACvC,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,6MAA6M;QAC/M,UAAU,EAAE,2DAA2D;QACvE,aAAa,EAAE,8EAA8E;KAC9F;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,0BAA0B;QACjC,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,yKAAyK;QAC3K,UAAU,EAAE,gEAAgE;QAC5E,aAAa,EAAE,gFAAgF;KAChG;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,4BAA4B;QACnC,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,MAAM;QAClB,WAAW,EACT,2NAA2N;QAC7N,UAAU,EAAE,yCAAyC;QACrD,aAAa,EAAE,4EAA4E;KAC5F;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,6BAA6B;QACpC,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,QAAQ;QACrB,UAAU,EAAE,MAAM;QAClB,WAAW,EACT,sMAAsM;QACxM,UAAU,EAAE,kEAAkE;QAC9E,aAAa,EAAE,+EAA+E;KAC/F;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,MAAM;QAClB,WAAW,EACT,ocAAoc;QACtc,UAAU,EAAE,qCAAqC;QACjD,aAAa,EAAE,wEAAwE;KACxF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,MAAM;QAClB,WAAW,EACT,gQAAgQ;QAClQ,UAAU,EAAE,yCAAyC;QACrD,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,2BAA2B;QAClC,KAAK,EAAE,MAAM;QACb,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,8HAA8H;QAChI,UAAU,EAAE,uFAAuF;KACpG;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,2BAA2B;QAClC,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,4GAA4G;QAC9G,UAAU,EAAE,oBAAoB;KACjC;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,wGAAwG;QAC1G,UAAU,EAAE,oEAAoE;KACjF;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,yBAAyB;QAChC,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uBAAuB;QACpC,WAAW,EACT,0IAA0I;QAC5I,UAAU,EAAE,sFAAsF;KACnG;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,oBAAoB;QAC3B,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uBAAuB;QACpC,WAAW,EACT,mJAAmJ;QACrJ,UAAU,EAAE,8EAA8E;QAC1F,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EACT,6IAA6I;QAC/I,UAAU,EAAE,6EAA6E;QACzF,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,0BAA0B;QACjC,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,kEAAkE;QAC/E,UAAU,EAAE,8EAA8E;QAC1F,aAAa,EAAE,gCAAgC;KAChD;CACF,CAAC;AAEF,wCAAwC;AACxC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,2EAA2E;AAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAKvD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAExD,4EAA4E;IAC5E,8EAA8E;IAC9E,qDAAqD;IACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAElE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAEzF,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAErD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAoC,EAAE,KAAoB;IAC3F,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC;QAC5F,KAAK,MAAM;YACT,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC;QAC3D,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;QAC9B,KAAK,eAAe;YAClB,uEAAuE;YACvE,6DAA6D;YAC7D,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,OAAO,CAAC;QACzD;YACE,uEAAuE;YACvE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/config/types.d.ts

@@ -445,6 +445,51 @@ export interface RoutingConfig {
      * served across a mode switch.
      */
     preferenceMode?: 'balanced' | 'performance-first' | 'cost-first' | 'privacy-first';
+    /**
+     * Capability mode — how much the agent spends on REASONING versus how much it
+     * saves. 'balanced' (default): the best model for complex/critical work,
+     * cheaper models for simple work, escalation on a detected stall. 'max': cost
+     * is not a concern — every turn routes to the strongest available model, paid
+     * models are always allowed, and cost ceilings are lifted. Set via
+     * `nuvira config capability <balanced|max>` or `NUVIRA_CAPABILITY_MODE`. The
+     * mode only ever widens MODEL QUALITY and AUTONOMY; every deterministic safety
+     * invariant (deny-first commands, workspace boundary, git gates) is unchanged.
+     * Resolution: env var, then this config value, then the default ('balanced').
+     */
+    capabilityMode?: 'balanced' | 'max';
+    /**
+     * When the loop's within-turn WORK DIGEST is injected on thread compaction.
+     * 'all' (default) — always keep a digest of what the turn did; 'max' — only
+     * under the `max` capability mode; 'off' — never. Set via
+     * `NUVIRA_WORK_DIGEST` or this value. Resolution: env, then config, then
+     * 'all'. See `src/config/work-digest.ts`.
+     */
+    workDigest?: 'all' | 'max' | 'off';
+    /**
+     * Weak-model consent for surfaces that CANNOT ask (gateway channels,
+     * headless/CI). The explicit per-session ask is the primary mechanism on
+     * every interactive surface; this value only governs the non-interactive
+     * fallback. 'ask' (default) — never silently use a weak model: fail over to
+     * a capable one or abort honestly. 'auto-allow' — proceed on the weak model
+     * and record the verdict. 'deny' — never use a weak model. Set via
+     * `NUVIRA_WEAK_MODEL_POLICY` or this value. Resolution: env, then config,
+     * then 'ask'. See `src/learning/agentic-route-gate.ts`.
+     */
+    weakModelPolicy?: 'ask' | 'auto-allow' | 'deny';
+    /**
+     * Outbound CONTEXT budget (chars): measurement thresholds + hard ceiling for
+     * the assembled prompt. Overrides `DEFAULT_CONTEXT_BUDGET` in
+     * `src/learning/context-budget.ts` per key. When the total exceeds the
+     * ceiling, optional contributors are dropped lowest-value-first (skill hint →
+     * work digest → recall → …); the identity/tool contract is never trimmed.
+     */
+    promptBudget?: {
+        noteTotal?: number;
+        warnTotal?: number;
+        maxTotal?: number;
+        noteSystem?: number;
+        warnSystem?: number;
+    };
 }
 /**
  * Full configuration schema for .nuviraconfig.json
@@ -567,6 +612,17 @@ export interface SkillsConfig {
      * override (or the built-in default) is used.
      */
     registries?: string[];
+    /**
+     * Which skill hint the chat/execute system prompt carries. See
+     * `resolveSkillHintMode` in `src/tools/loop-skill-hint.ts`.
+     *   - `match` (DEFAULT) — the small keyword-matched hint: ONE skill, only when
+     *     the goal actually matches, else nothing. 3.3.10 behaviour.
+     *   - `catalog` — the full name+description catalog (opt-in; ~24K chars).
+     *   - `names` — the catalog WITHOUT descriptions (names only; a fraction of
+     *     `catalog`; the model can still load one by name).
+     *   - `off` — never inject a skill hint.
+     */
+    catalogHint?: string;
 }
 /**
  * Modality configuration — backend selection for image generation (and, in
@@ -652,11 +708,68 @@ export interface ToolHookConfig {
     /** A name for this hook, used in the report when it vetoes or fails. */
     label?: string;
 }
+/**
+ * How much EXTRA reasoning to ask a model for, in provider-neutral terms.
+ *
+ * This is INTENT, not a wire value. Each adapter translates it into whatever
+ * its provider actually accepts (`reasoning_effort` for the OpenAI-compatible
+ * family, an extended-thinking budget for Anthropic, a thinking budget for
+ * Gemini). A provider that has no such knob simply ignores it — the value is
+ * always optional and never required for a call to succeed.
+ *
+ * Defined here (the config layer) rather than in the inference layer so both
+ * the capability policy and the adapters can name it without an import cycle.
+ */
+export type ReasoningEffort = 'low' | 'medium' | 'high';
+/**
+ * The family of wire parameter used to request extra reasoning. The shape is a
+ * property of the PROVIDER (how it spells the knob), while whether a given
+ * MODEL accepts it is a separate, learned fact (see ModelRegistryEntry.
+ * reasoningCapability).
+ */
+export type ReasoningShape = 'openai-reasoning-effort' | 'anthropic-thinking' | 'gemini-thinking';
+/**
+ * What we have LEARNED about whether one provider × model accepts a
+ * reasoning-effort parameter. Absent/`supported:false` means "do not send it"
+ * (default-deny): the knob is only ever emitted against positive evidence.
+ */
+export interface ReasoningCapability {
+    supported: boolean;
+    /** The exact wire parameter name (e.g. `reasoning_effort`, `thinking`). */
+    param: string;
+    /** The wire family, so a caller knows how to build the value. */
+    shape: ReasoningShape;
+    /** Epoch ms the capability was last established. */
+    verifiedAt: number;
+    /**
+     * How we learned it: the provider ADVERTISED it, a PROBE confirmed it, or a
+     * rejected request taught us it is NOT supported (`learned-unsupported`).
+     */
+    source: 'advertised' | 'probed' | 'learned-unsupported';
+}
 /**
  * Inference options passed to each generation call
  * Note: provider is string to allow plugin-based providers
  */
 export interface InferenceOptions {
+    /**
+     * Request additional reasoning depth from the model, in provider-neutral
+     * terms. Set by the routing layer when the capability mode calls for it
+     * (`max` → `high`); applied by an adapter ONLY when the registry has verified
+     * that the provider × model accepts the corresponding parameter, and retried
+     * WITHOUT the parameter if the provider rejects it. Absent → never sent, so
+     * the default path is byte-identical to before. See
+     * `src/inference/reasoning-effort.ts`.
+     */
+    reasoningEffort?: ReasoningEffort;
+    /**
+     * INTERNAL — probe mode. When true, the adapter emits its provider's
+     * reasoning parameter UNCONDITIONALLY (bypassing the default-deny registry
+     * gate) so a probe can establish whether the model accepts it. The registry
+     * is updated from the outcome. Never set by routing; only the model probe
+     * sets it. See src/inference/model-probe.ts.
+     */
+    reasoningProbe?: boolean;
     model?: string;
     temperature?: number;
     maxTokens?: number;