create-walle 0.9.30 → 0.9.32

package/template/wall-e/llm/routing-policy.js

@@ -2,7 +2,13 @@
 
 const providerRegistry = require('./registry');
 const { isCliBinaryAvailable, _internals: fallbackInternals } = require('./default-fallback');
-const { getProviderHealthStatus } = require('./provider-health-state');
+const {
+  DEFAULT_PROVIDER_STATUS_MAX_AGE_MS,
+  getFirstProviderModelCircuit,
+  getFirstProviderModelCircuitStats,
+  getProviderHealthStatus,
+  listProviderModelCircuits,
+} = require('./provider-health-state');
 
 const POLICY_KEYS = {
   mode: 'model_routing_policy_mode',
@@ -11,6 +17,7 @@ const POLICY_KEYS = {
   lastRefreshAt: 'model_routing_policy_last_refresh_at',
 };
 
+const ROUTING_POLICY_DISPLAY_HEALTH_MAX_AGE_MS = DEFAULT_PROVIDER_STATUS_MAX_AGE_MS;
 const VALID_MODES = new Set(['smart', 'strict']);
 const LOCAL_PROVIDER_TYPES = new Set(['ollama', 'mlx', 'lmstudio']);
 const GATEWAY_ONLY_TYPES = new Set(['portkey_gateway']);
@@ -164,17 +171,126 @@ function providerRuntimeAccess(row = {}, env = process.env) {
   return { ok: false, kind: 'missing_credential', reason: 'No stored credential or environment key.' };
 }
 
-function publicRuntimeHealth(id, type, model, health, brain) {
-  const runtime = id && health?.getProviderHealth ? health.getProviderHealth(id) : null;
-  const persisted = getProviderHealthStatus(type, model, { brain });
+function uniqueTruthy(values = []) {
+  const out = [];
+  const seen = new Set();
+  for (const value of values) {
+    const text = String(value || '').trim();
+    if (!text) continue;
+    const key = text.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(text);
+  }
+  return out;
+}
+
+function firstRuntimeHealthWithEvidence(ids = [], health) {
+  if (!health || typeof health.getProviderHealth !== 'function') return null;
+  for (const id of uniqueTruthy(ids)) {
+    let runtime = null;
+    try { runtime = health.getProviderHealth(id); } catch {}
+    if (runtime && Number(runtime.totalCalls || 0) > 0) return runtime;
+  }
+  return null;
+}
+
+function firstPersistedHealthStatus(providers = [], model, brain, options = {}) {
+  for (const provider of uniqueTruthy(providers)) {
+    const persisted = getProviderHealthStatus(provider, model, {
+      brain,
+      maxAgeMs: options.persistedMaxAgeMs,
+    });
+    if (persisted) return persisted;
+  }
+  return null;
+}
+
+function failureRateSummary({ circuit, circuitStats, runtime, persisted, runtimeHasEvidence } = {}) {
+  const fromCircuit = circuit || circuitStats;
+  if (fromCircuit && Number(fromCircuit.total || 0) > 0) {
+    return {
+      failures: Number(fromCircuit.failures || 0),
+      total: Number(fromCircuit.total || 0),
+      failure_rate: Number(fromCircuit.failure_rate || 0),
+      failure_rate_pct: Number(fromCircuit.failure_rate_pct || Math.round(Number(fromCircuit.failure_rate || 0) * 100)),
+      source: fromCircuit.state === 'open' ? 'circuit_open' : 'recent_window',
+      window_ms: Number(fromCircuit.window_ms || 0) || null,
+      threshold: Number(fromCircuit.threshold || 0),
+      min_calls: Number(fromCircuit.min_calls || 0),
+      min_failures: Number(fromCircuit.min_failures || 0),
+      low_sample: fromCircuit.low_sample === true,
+    };
+  }
+  if (runtimeHasEvidence) {
+    const failureRate = Number(runtime?.failureRate || 0);
+    const total = Number(runtime?.totalCalls || 0);
+    return {
+      failures: Number.isFinite(failureRate) ? Math.round(failureRate * total) : null,
+      total,
+      failure_rate: Number.isFinite(failureRate) ? failureRate : null,
+      failure_rate_pct: Number.isFinite(failureRate) ? Math.round(failureRate * 100) : null,
+      source: 'runtime',
+      window_ms: null,
+      threshold: null,
+      min_calls: null,
+      min_failures: null,
+      low_sample: false,
+    };
+  }
+  if (persisted) {
+    const ok = persisted.ok === true;
+    return {
+      failures: ok ? 0 : 1,
+      total: 1,
+      failure_rate: ok ? 0 : 1,
+      failure_rate_pct: ok ? 0 : 100,
+      source: 'last_check',
+      window_ms: null,
+      threshold: null,
+      min_calls: null,
+      min_failures: null,
+      low_sample: true,
+    };
+  }
+  return null;
+}
+
+function publicRuntimeHealth(id, type, model, health, brain, options = {}) {
+  const runtimeType = options.runtimeType || type;
+  const providerType = options.providerType || type;
+  const nowMs = options.nowMs || Date.now();
+  const runtime = firstRuntimeHealthWithEvidence([id, runtimeType, providerType], health);
+  const persisted = firstPersistedHealthStatus([runtimeType, providerType, id], model, brain, options);
+  const circuit = getFirstProviderModelCircuit([runtimeType, providerType, id], model, {
+    brain,
+    nowMs,
+  });
+  const circuitStats = circuit || getFirstProviderModelCircuitStats([runtimeType, providerType, id], model, {
+    brain,
+    nowMs,
+  });
   const runtimeHasEvidence = runtime && Number(runtime.totalCalls || 0) > 0;
-  const status = runtimeHasEvidence ? runtime.status : (persisted ? persisted.status : 'unknown');
+  const rate = failureRateSummary({ circuit, circuitStats, runtime, persisted, runtimeHasEvidence });
+  const status = circuit ? 'error' : (runtimeHasEvidence ? runtime.status : (persisted ? persisted.status : 'unknown'));
   return {
     status,
     consecutive_failures: runtimeHasEvidence ? (runtime?.consecutiveFailures || 0) : 0,
-    last_error: runtime?.lastError?.message || persisted?.error || '',
+    failures: rate?.failures ?? null,
+    total: rate?.total ?? 0,
+    failure_rate: rate?.failure_rate ?? null,
+    failure_rate_pct: rate?.failure_rate_pct ?? null,
+    failure_rate_source: rate?.source || '',
+    failure_rate_window_ms: rate?.window_ms ?? null,
+    failure_rate_threshold: rate?.threshold ?? null,
+    min_calls: rate?.min_calls ?? null,
+    min_failures: rate?.min_failures ?? null,
+    low_sample: rate?.low_sample === true,
+    last_error: circuit?.error || runtime?.lastError?.message || persisted?.error || '',
     last_success_at: runtimeHasEvidence && runtime?.lastSuccess ? runtime.lastSuccess.toISOString?.() || String(runtime.lastSuccess) : null,
     persisted_status: persisted || null,
+    circuit_breaker: circuit || null,
+    circuit_stats: circuitStats || null,
   };
 }
 
@@ -207,11 +323,16 @@ function rowCandidate(row, context) {
   const runtimeType = providerRuntimeType(row);
   const access = providerRuntimeAccess(row, context.env);
   const firstModel = firstEnabledModelForProvider(context.brain, row.id);
-  const model = runtimeType.endsWith('-cli')
-    ? defaultModelForProvider(runtimeType)
-    : modelForProvider(context.brain, type, firstModel);
-  const health = publicRuntimeHealth(row.id, runtimeType, model, context.health, context.brain);
-  const isDown = health.status === 'down' || health.status === 'error';
+  const providerModel = modelForProvider(context.brain, type, firstModel);
+  const model = runtimeType !== type && runtimeType.endsWith('-cli')
+    ? (modelMatchesProvider(providerModel, runtimeType) ? providerModel : defaultModelForProvider(runtimeType))
+    : providerModel;
+  const health = publicRuntimeHealth(row.id, runtimeType, model, context.health, context.brain, {
+    providerType: type,
+    runtimeType,
+  });
+  const circuitOpen = !!health.circuit_breaker;
+  const isDown = circuitOpen || health.status === 'down';
   const routePolicy = typeof context.brain?.getProviderRoutePolicy === 'function'
     ? context.brain.getProviderRoutePolicy(type)
     : 'auto';
@@ -229,7 +350,7 @@ function rowCandidate(row, context) {
     route_policy: routePolicy,
     runtime_access: access.kind,
     included,
-    excluded_reason: included ? '' : (isDown ? 'Provider is marked down by runtime health.' : access.reason),
+    excluded_reason: included ? '' : (circuitOpen ? 'Rolling error rate crossed the fallback threshold; auto-fallback is active until recovery probes succeed.' : (isDown ? 'Provider is marked down by runtime health.' : access.reason)),
     health,
     updated_at: row.updated_at || '',
   };
@@ -240,6 +361,9 @@ function envCandidate(type, context) {
   if (!fallbackInternals._hasEnvKey(providerType, context.env)) return null;
   const model = modelForProvider(context.brain, providerType, '');
   const id = `${providerType}-env`;
+  const health = publicRuntimeHealth(id, providerType, model, context.health, context.brain);
+  const circuitOpen = !!health.circuit_breaker;
+  const isDown = circuitOpen || health.status === 'down';
   return {
     id,
     provider_id: null,
@@ -252,9 +376,9 @@ function envCandidate(type, context) {
     connection_kind: 'environment',
     route_policy: 'auto',
     runtime_access: 'environment',
-    included: true,
-    excluded_reason: '',
-    health: publicRuntimeHealth(id, providerType, model, context.health, context.brain),
+    included: !isDown,
+    excluded_reason: isDown ? (circuitOpen ? 'Rolling error rate crossed the fallback threshold; auto-fallback is active until recovery probes succeed.' : 'Provider is marked down by runtime health.') : '',
+    health,
     updated_at: '',
   };
 }
@@ -262,6 +386,9 @@ function envCandidate(type, context) {
 function cliCandidate(id, bin, context) {
   const available = context.settings.cli_tail && context.isCliAvailable(bin);
   const model = defaultModelForProvider(id);
+  const health = publicRuntimeHealth(id, id, model, context.health, context.brain);
+  const circuitOpen = !!health.circuit_breaker;
+  const isDown = circuitOpen || health.status === 'down';
   return {
     id,
     provider_id: null,
@@ -274,9 +401,11 @@ function cliCandidate(id, bin, context) {
     connection_kind: 'cli',
     route_policy: 'auto',
     runtime_access: available ? 'cli' : 'missing_cli',
-    included: available,
-    excluded_reason: available ? '' : `${bin} CLI not found or CLI fallback is disabled.`,
-    health: publicRuntimeHealth(id, id, model, context.health, context.brain),
+    included: available && !isDown,
+    excluded_reason: available
+      ? (isDown ? (circuitOpen ? 'Rolling error rate crossed the fallback threshold; auto-fallback is active until recovery probes succeed.' : 'Provider is marked down by runtime health.') : '')
+      : `${bin} CLI not found or CLI fallback is disabled.`,
+    health,
     updated_at: '',
   };
 }
@@ -455,6 +584,7 @@ function buildRoutingPolicy(options = {}) {
     chain,
     candidates: ordered,
     excluded: ordered.filter((candidate) => !candidate.included),
+    circuit_breakers: listProviderModelCircuits({ brain }),
     recommendations: [],
     actions: [],
   };
@@ -585,6 +715,49 @@ function _defaultFromPersisted(brain, chain = [], settings = {}) {
   };
 }
 
+function _hydratePersistedRouteHealth(brain, route = {}, options = {}) {
+  const runtimeType = route.runtime_type || route.runtimeType || route.provider_type || route.providerType;
+  const providerType = route.provider_type || route.providerType || route.type;
+  const model = route.model || route.model_id || route.modelId || '';
+  const health = publicRuntimeHealth(
+    route.provider_id || route.providerId || route.id,
+    runtimeType || providerType,
+    model,
+    options.health,
+    brain,
+    {
+      providerType,
+      runtimeType,
+      persistedMaxAgeMs: options.persistedMaxAgeMs ?? ROUTING_POLICY_DISPLAY_HEALTH_MAX_AGE_MS,
+    }
+  );
+  return {
+    ...route,
+    health_status: health.status,
+    health,
+  };
+}
+
+function _routeCircuitOpen(route = {}) {
+  return route?.health?.circuit_breaker?.state === 'open';
+}
+
+function _circuitExcludedRoute(route = {}) {
+  const circuit = route?.health?.circuit_breaker || {};
+  const failures = Number(circuit.failures || 0);
+  const total = Number(circuit.total || 0);
+  const rate = circuit.failure_rate_pct != null
+    ? Number(circuit.failure_rate_pct)
+    : Math.round(Number(circuit.failure_rate || 0) * 100);
+  const hours = Number(circuit.window_ms || 0) / (60 * 60 * 1000);
+  const windowLabel = hours >= 1 ? `${Math.round(hours)}h` : 'rolling window';
+  return {
+    ...route,
+    included: false,
+    excluded_reason: `Auto-fallback active: ${rate}% errors over ${windowLabel} (${failures}/${total}); route stays skipped until recovery probes succeed.`,
+  };
+}
+
 function _publicPolicyFromPersisted(brain, snapshot = {}, extras = {}) {
   const policyRow = snapshot.policy || {};
   const routes = snapshot.routes || {};
@@ -593,20 +766,28 @@ function _publicPolicyFromPersisted(brain, snapshot = {}, extras = {}) {
   const generated = Array.isArray(routes.generated) ? routes.generated : [];
   const user = Array.isArray(routes.user) ? routes.user : [];
   const chainSource = effective.length ? 'effective' : (generated.length ? 'generated' : 'empty');
-  const chain = (effective.length ? effective : generated).map((route, index) => ({
-    ...route,
+  const hydratedEffective = (effective.length ? effective : generated).map((route, index) => ({
+    ..._hydratePersistedRouteHealth(brain, route, extras),
     route_key: _routeKey(route),
     order: index + 1,
     role: index === 0 ? 'primary' : 'fallback',
   }));
+  const circuitExcluded = hydratedEffective.filter(_routeCircuitOpen).map(_circuitExcludedRoute);
+  const chain = hydratedEffective
+    .filter((route) => !_routeCircuitOpen(route))
+    .map((route, index) => ({
+      ...route,
+      order: index + 1,
+      role: index === 0 ? 'primary' : 'fallback',
+    }));
   const publicUserRoutes = user.map((route, index) => ({
-    ...route,
+    ..._hydratePersistedRouteHealth(brain, route, extras),
     route_key: _routeKey(route),
     order: index + 1,
     role: route.role || 'fallback',
   }));
   const publicGeneratedRoutes = generated.map((route, index) => ({
-    ...route,
+    ..._hydratePersistedRouteHealth(brain, route, extras),
     route_key: _routeKey(route),
     order: index + 1,
     role: index === 0 ? 'primary' : 'fallback',
@@ -620,8 +801,9 @@ function _publicPolicyFromPersisted(brain, snapshot = {}, extras = {}) {
     trigger_classes: Array.from(fallbackInternals.FALLTHROUGH_CLASSES || []),
     default: _defaultFromPersisted(brain, chain, settings),
     chain,
-    candidates: chain,
-    excluded: [],
+    candidates: chain.concat(circuitExcluded),
+    excluded: circuitExcluded,
+    circuit_breakers: listProviderModelCircuits({ brain }),
     recommendations: extras.recommendations || [],
     actions: extras.actions || [],
     sources: {
@@ -634,6 +816,44 @@ function _publicPolicyFromPersisted(brain, snapshot = {}, extras = {}) {
   };
 }
 
+function _configuredDefaultCircuit(brain) {
+  const configuredType = normalizeProviderType(getKv(brain, 'walle_provider') || process.env.WALLE_PROVIDER || '');
+  if (!configuredType) return null;
+  const rows = loadProviderRows(brain);
+  const row = rows.find((candidate) => normalizeProviderType(candidate.type || candidate.provider_type) === configuredType) || null;
+  const runtimeType = row ? providerRuntimeType(row) : configuredType;
+  const configuredModel = getKv(brain, 'walle_model') || process.env.WALLE_MODEL || '';
+  const firstModel = row?.id ? firstEnabledModelForProvider(brain, row.id) : '';
+  let model = configuredModel || modelForProvider(brain, configuredType, firstModel);
+  if (runtimeType !== configuredType && runtimeType.endsWith('-cli')) {
+    model = modelMatchesProvider(model, runtimeType) ? model : defaultModelForProvider(runtimeType);
+  }
+  return getFirstProviderModelCircuit([runtimeType, configuredType, row?.id], model, { brain });
+}
+
+function _persistedPolicyIsStale(brain, snapshot = {}) {
+  const effective = Array.isArray(snapshot.routes?.effective) ? snapshot.routes.effective : [];
+  const generated = Array.isArray(snapshot.routes?.generated) ? snapshot.routes.generated : [];
+  const primary = effective[0] || generated[0] || null;
+  const configuredType = normalizeProviderType(getKv(brain, 'walle_provider') || process.env.WALLE_PROVIDER || '');
+  if (!primary || !configuredType) return false;
+  const primaryProvider = normalizeProviderType(primary.provider_type || primary.providerType || primary.type || '');
+  const primaryRuntime = normalizeProviderType(primary.runtime_type || primary.runtimeType || primaryProvider || '');
+  const configuredCircuit = _configuredDefaultCircuit(brain);
+  if (primaryProvider !== configuredType && primaryRuntime !== configuredType) return !configuredCircuit;
+  const configuredModel = getKv(brain, 'walle_model') || process.env.WALLE_MODEL || '';
+  if (!configuredModel) return false;
+  const primaryModel = primary.model || primary.model_id || primary.modelId || '';
+  let effectiveConfiguredModel = configuredModel;
+  if (primaryRuntime !== configuredType && primaryRuntime.endsWith('-cli')) {
+    effectiveConfiguredModel = modelMatchesProvider(configuredModel, primaryRuntime)
+      ? configuredModel
+      : defaultModelForProvider(primaryRuntime);
+  }
+  if (!modelMatchesProvider(effectiveConfiguredModel, primaryRuntime || configuredType)) return false;
+  return !configuredCircuit && !!primaryModel && primaryModel !== effectiveConfiguredModel;
+}
+
 function getPersistedRoutingPolicy(options = {}) {
   const brain = options.brain;
   if (!brain || typeof brain.getModelRoutingPolicy !== 'function') {
@@ -645,7 +865,16 @@ function getPersistedRoutingPolicy(options = {}) {
   if (!hasEffective && !hasGenerated && options.generateIfMissing !== false) {
     return materializeRoutingPolicy(options);
   }
-  return _publicPolicyFromPersisted(brain, snapshot);
+  if (
+    options.generateIfMissing !== false
+    && options.repairStale !== false
+    && _persistedPolicyIsStale(brain, snapshot)
+  ) {
+    return materializeRoutingPolicy({ ...options, repairDefault: false });
+  }
+  return _publicPolicyFromPersisted(brain, snapshot, {
+    health: options.health || safeDefaultHealth(),
+  });
 }
 
 function materializeRoutingPolicy(options = {}) {
@@ -790,6 +1019,7 @@ module.exports = {
     providerRuntimeAccess,
     providerRuntimeType,
     defaultModelForProvider,
+    _persistedPolicyIsStale,
     _mergeEffectiveRoutes,
     _routeKey,
   },

package/template/wall-e/llm/tool-call-validator.js

@@ -0,0 +1,156 @@
+'use strict';
+
+/**
+ * Schema-driven tool-call validation + repair prompts.
+ *
+ * Small local models (e.g. Gemma E4B) fail tool-use in two avoidable ways the
+ * training log documented repeatedly:
+ *   - they emit a tool call with empty `{}` args (v1: "six run_shell with empty
+ *     arguments"), or missing required fields;
+ *   - they emit a no-op edit where old_string === new_string (v6).
+ *
+ * Both are fixable at the harness level — no fine-tuning — by validating the
+ * call against the tool's own JSON schema (`input_schema.required`) and, when a
+ * turn produced only invalid calls, feeding back a corrective prompt that names
+ * the tool and the exact fields it must supply. This is provider/tool-agnostic:
+ * it reads whatever tool catalog the run was given.
+ */
+
+const EDIT_TOOLS = new Set(['edit_file', 'multi_edit', 'apply_patch']);
+
+function toolByName(tools = [], name = '') {
+  return (Array.isArray(tools) ? tools : []).find((tool) => (tool?.name || tool?.tool) === name) || null;
+}
+
+/** Required field names for a tool, or null if the tool is unknown. */
+function toolRequiredFields(tools = [], name = '') {
+  const tool = toolByName(tools, name);
+  if (!tool) return null;
+  const schema = tool.input_schema || tool.inputSchema || tool.parameters || {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  return required.map(String);
+}
+
+function isBlank(value) {
+  if (value === undefined || value === null) return true;
+  if (typeof value === 'string') return value.trim() === '';
+  if (Array.isArray(value)) return value.length === 0;
+  if (typeof value === 'object') return Object.keys(value).length === 0;
+  return false;
+}
+
+function callInput(call = {}) {
+  const input = call.input || call.args || call.arguments || {};
+  return input && typeof input === 'object' && !Array.isArray(input) ? input : {};
+}
+
+/**
+ * Validate one tool call against the catalog.
+ * @returns {{ ok: boolean, problem: string|null, missing: string[], name: string }}
+ */
+function validateToolCall(call = {}, tools = []) {
+  const name = String(call.name || call.tool || '').trim();
+  const input = callInput(call);
+
+  if (!name) return { ok: false, problem: 'unknown_tool', missing: [], name };
+  const required = toolRequiredFields(tools, name);
+  if (required === null) return { ok: false, problem: 'unknown_tool', missing: [], name };
+
+  const missing = required.filter((field) => isBlank(input[field]));
+  if (missing.length) {
+    const allMissing = missing.length === required.length;
+    return { ok: false, problem: allMissing ? 'empty_args' : 'missing_required', missing, name };
+  }
+
+  if (EDIT_TOOLS.has(name) && typeof input.old_string === 'string' && input.old_string === input.new_string) {
+    return { ok: false, problem: 'noop_edit', missing: [], name };
+  }
+
+  return { ok: true, problem: null, missing: [], name };
+}
+
+/**
+ * Validate a batch of calls from one turn.
+ * @returns {{ valid, invalid, proseOnly, allInvalid, malformedCount, problems }}
+ */
+function validateToolCalls(calls = [], tools = []) {
+  const list = Array.isArray(calls) ? calls : [];
+  const valid = [];
+  const invalid = [];
+  for (const call of list) {
+    const verdict = validateToolCall(call, tools);
+    if (verdict.ok) valid.push({ call, verdict });
+    else invalid.push({ call, verdict });
+  }
+  return {
+    valid,
+    invalid,
+    proseOnly: list.length === 0,
+    allInvalid: list.length > 0 && valid.length === 0,
+    malformedCount: invalid.length,
+    problems: invalid.map((entry) => entry.verdict),
+  };
+}
+
+function describeRequired(tools, name) {
+  const required = toolRequiredFields(tools, name);
+  if (!required || !required.length) return '';
+  return ` Required fields for ${name}: ${required.join(', ')}.`;
+}
+
+/** A corrective message to feed back to the model after a bad turn. */
+function buildToolRepairMessage(validation = {}, tools = []) {
+  if (validation.proseOnly) {
+    return '[SYSTEM] You did not call any tool. Respond with exactly one tool call (not prose) '
+      + 'to make progress, using a tool from the provided catalog with all required fields filled in.';
+  }
+  const lines = ['[SYSTEM] Your previous tool call(s) were invalid and were not executed. Fix and retry:'];
+  for (const problem of validation.problems || []) {
+    if (problem.problem === 'unknown_tool') {
+      lines.push(`- "${problem.name || 'unknown'}" is not a known tool. Use a tool from the provided catalog.`);
+    } else if (problem.problem === 'empty_args') {
+      lines.push(`- ${problem.name} was called with empty arguments.${describeRequired(tools, problem.name)}`);
+    } else if (problem.problem === 'missing_required') {
+      lines.push(`- ${problem.name} is missing required field(s): ${problem.missing.join(', ')}.${describeRequired(tools, problem.name)}`);
+    } else if (problem.problem === 'noop_edit') {
+      lines.push(`- ${problem.name} had old_string identical to new_string (no-op). Provide a real change.`);
+    }
+  }
+  return lines.join('\n');
+}
+
+/**
+ * Decide whether a turn should trigger a corrective re-prompt. Pure so the
+ * orchestrator's wiring is unit-testable without a live model.
+ * @returns {{ shouldRepair: boolean, reason: string, message: string|null, problems: object[] }}
+ */
+function planToolCallRepair({ toolCalls = [], tools = [], repairs = 0, maxRepairs = 2, enabled = true } = {}) {
+  if (!enabled) return { shouldRepair: false, reason: 'disabled', message: null, problems: [] };
+  // Prose-only (no calls) is handled by the no-action guard, not here.
+  if (!Array.isArray(toolCalls) || toolCalls.length === 0) {
+    return { shouldRepair: false, reason: 'no_calls', message: null, problems: [] };
+  }
+  const validation = validateToolCalls(toolCalls, tools);
+  if (!validation.allInvalid) {
+    return { shouldRepair: false, reason: 'has_valid_call', message: null, problems: validation.problems };
+  }
+  if (repairs >= maxRepairs) {
+    return { shouldRepair: false, reason: 'budget_exhausted', message: null, problems: validation.problems };
+  }
+  return {
+    shouldRepair: true,
+    reason: 'all_invalid',
+    message: buildToolRepairMessage(validation, tools),
+    problems: validation.problems,
+  };
+}
+
+module.exports = {
+  EDIT_TOOLS,
+  toolByName,
+  toolRequiredFields,
+  validateToolCall,
+  validateToolCalls,
+  buildToolRepairMessage,
+  planToolCallRepair,
+};

package/template/wall-e/skills/skill-dispatch-decision.js

@@ -33,6 +33,58 @@ function backoffForFailureCount(consecutiveFailures, schedule = DEFAULT_BACKOFF_
   return schedule[Math.max(0, idx)] ?? schedule[schedule.length - 1];
 }
 
+/**
+ * Self-heal (half-open circuit breaker) defaults. Once a skill is
+ * auto-disabled (10 consecutive failures), the dispatcher periodically runs a
+ * single "probe" — one real execution — to test whether the underlying fault
+ * has cleared. The planner closes the breaker on success (re-enable + reset)
+ * and, after MAX_PROBE_ATTEMPTS failed probes, escalates to a human and stops
+ * probing. From skill-self-heal design 2026-06-24.
+ *
+ * The schedule grows so transient faults (expired token, network blip) heal
+ * within the hour while permanent faults (revoked permission, missing binary)
+ * don't thrash: 1h → 6h → 24h.
+ */
+const DEFAULT_PROBE_SCHEDULE_MS = [
+  60 * 60_000,        // probe 1: 1h after auto-disable
+  6 * 60 * 60_000,    // probe 2: 6h after probe 1
+  24 * 60 * 60_000,   // probe 3: 24h after probe 2
+];
+const DEFAULT_MAX_PROBE_ATTEMPTS = 3;
+const PROBE_JITTER_FRACTION = 0.1; // ±10% spread to avoid a thundering herd
+
+// Small deterministic string hash (FNV-1a, 32-bit) used to derive STABLE
+// per-(skill, attempt) jitter. Stable matters: if jitter used Math.random the
+// computed next-probe time would jump every tick and the "is it due yet" gate
+// would flap. Deterministic jitter still de-synchronizes different skills.
+function _hashString(str) {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < str.length; i++) {
+    h ^= str.charCodeAt(i);
+    h = Math.imul(h, 0x01000193);
+  }
+  return h >>> 0;
+}
+
+/**
+ * Delay (ms) before the next recovery probe, with deterministic jitter.
+ * @param {number} attempts - probes already made (0 = first probe)
+ * @param {Object} [opts]
+ * @param {string} [opts.seed] - stable per-skill seed (id/name); omit for no jitter
+ * @param {Array<number>} [opts.schedule]
+ * @returns {number}
+ */
+function probeDelayFor(attempts, opts = {}) {
+  const schedule = Array.isArray(opts.schedule) && opts.schedule.length
+    ? opts.schedule
+    : DEFAULT_PROBE_SCHEDULE_MS;
+  const base = schedule[Math.min(Math.max(0, attempts), schedule.length - 1)];
+  if (!opts.seed) return base;
+  const frac = (_hashString(`${opts.seed}:${attempts}`) % 1000) / 1000; // 0..1
+  const delta = base * PROBE_JITTER_FRACTION * (frac * 2 - 1);          // ±10%
+  return Math.round(base + delta);
+}
+
 /**
  * Pure decision function for skill dispatch.
  *
@@ -113,10 +165,35 @@ function decideSkillDispatch(skill, ctx) {
   // one was an explicit choice.
   if (!skill.enabled) {
     if (skill.auto_disabled_at) {
+      // Half-open self-heal: after a growing cooldown, allow ONE probe run to
+      // test whether the fault cleared. Gated by ctx.selfHealEnabled (default
+      // ON). Only auto_disabled rows are probed; user-disabled / deprecated
+      // rows (no auto_disabled_at) are never resurrected. From skill-self-heal
+      // design 2026-06-24.
+      const selfHeal = ctx?.selfHealEnabled !== false;
+      const maxAttempts = ctx?.maxProbeAttempts ?? DEFAULT_MAX_PROBE_ATTEMPTS;
+      const attempts = skill.auto_disabled_attempts || 0;
+      const base = { since: skill.auto_disabled_at, why: skill.auto_disabled_reason || 'consecutive_failures' };
+      if (selfHeal && attempts < maxAttempts) {
+        const anchorRaw = new Date(skill.last_probe_at || skill.auto_disabled_at).getTime();
+        const anchor = Number.isFinite(anchorRaw) ? anchorRaw : now;
+        const delay = probeDelayFor(attempts, { seed: skill.id || skill.name, schedule: ctx?.probeSchedule });
+        const nextProbeAt = anchor + delay;
+        if (now >= nextProbeAt) {
+          return { decision: 'run', reason: 'probe', details: { attempt: attempts + 1, max: maxAttempts } };
+        }
+        return {
+          decision: 'skip',
+          reason: 'auto_disabled',
+          details: { ...base, attempts, next_probe_at: new Date(nextProbeAt).toISOString() },
+        };
+      }
+      // Probes exhausted (or self-heal disabled) → stay disabled. The
+      // exhausted reason lets the UI show "needs attention" vs "recovering".
       return {
         decision: 'skip',
-        reason: 'auto_disabled',
-        details: { since: skill.auto_disabled_at, why: skill.auto_disabled_reason || 'consecutive_failures' },
+        reason: (selfHeal && attempts >= maxAttempts) ? 'auto_disabled_exhausted' : 'auto_disabled',
+        details: { ...base, attempts },
       };
     }
     return { decision: 'skip', reason: 'disabled' };
@@ -189,4 +266,7 @@ module.exports = {
   decideSkillDispatch,
   DEFAULT_BACKOFF_SCHEDULE_MS,
   backoffForFailureCount,
+  DEFAULT_PROBE_SCHEDULE_MS,
+  DEFAULT_MAX_PROBE_ATTEMPTS,
+  probeDelayFor,
 };