dsh-autotier 0.1.0

package/lib/index.js

@@ -0,0 +1,2848 @@
+import z from "@deepseek-ai/schemastery";
+import { BlockAssembler, createUserMessage } from "@deepseek-ai/dsh-llm";
+import { Service } from "@deepseek-ai/cordis";
+import { defineTool } from "@deepseek-ai/dsh-tools";
+//#region src/tiers.ts
+/** The adapter-owned effort ladder, cheapest to strongest. */
+const EFFORT_LADDER = [
+	"off",
+	"low",
+	"high",
+	"max"
+];
+/** Position of one effort on the ladder (0..3); unknown ids rank lowest. */
+function effortRank(effort) {
+	const index = EFFORT_LADDER.indexOf(effort);
+	return index === -1 ? 0 : index;
+}
+/**
+* The next effort step above `current`, never above `ceiling`.
+* @param current - the effort currently in force.
+* @param ceiling - the strongest effort to consider (default `max`).
+* @returns the next effort id, or null when already at or above the ceiling.
+*/
+function nextEffortStep(current, ceiling = "max") {
+	const start = effortRank(current);
+	if (start >= effortRank(ceiling)) return null;
+	return EFFORT_LADDER[start + 1] ?? null;
+}
+/** Whether two routes land on the same provider/model/effort triple. */
+function routeEquals(a, b) {
+	return a.provider === b.provider && a.model === b.model && a.effort === b.effort;
+}
+/** One adapter-owned effort id as the LLM call config expects it (branded at the seam). */
+function brandedEffort(effort) {
+	return effort;
+}
+/**
+* Apply one tier route to a request configuration. The sampling scalars the
+* session already chose (`temperature`, `maxTokens`, `stop`) are preserved
+* exactly; the provider/model/effort triple is replaced. Returns the input
+* object unchanged when the route already matches, so the caller can skip a
+* logged header change.
+*
+* @param base - the configuration the loop proposed.
+* @param target - the tier landing to apply.
+* @returns the replacement configuration (or `base` when identical).
+*/
+function resolveRoute(base, target) {
+	if (base.provider === target.provider && base.model === target.model && (target.effort === void 0 || base.reasoningEffort === target.effort)) return base;
+	const next = {
+		provider: target.provider,
+		model: target.model
+	};
+	const effort = target.effort ?? base.reasoningEffort;
+	if (effort !== void 0) next.reasoningEffort = brandedEffort(effort);
+	if (base.temperature !== void 0) next.temperature = base.temperature;
+	if (base.maxTokens !== void 0) next.maxTokens = base.maxTokens;
+	if (base.stop !== void 0) next.stop = base.stop;
+	return next;
+}
+/**
+* Build the effort-first escalation ladder: raise the current model's effort
+* one step at a time (the KV prefix survives, and the official model-selection
+* notice is not emitted for an effort-only change) before paying for a model
+* switch. When both tiers share one model the ladder collapses to a single
+* effort-only rung.
+*
+* @param base - the configuration the loop proposed for the failing step.
+* @param cheap - the cheap tier landing.
+* @param strong - the strong tier landing.
+* @returns the ordered rungs; empty when escalation cannot change anything.
+*/
+function escalationLadder(base, cheap, strong) {
+	const rungs = [];
+	const baseEffort = base.reasoningEffort ?? cheap.effort ?? "low";
+	const onCheapModel = base.provider === cheap.provider && base.model === cheap.model;
+	if (strong.provider === cheap.provider && strong.model === cheap.model) {
+		if (strong.effort !== void 0 && strong.effort !== baseEffort) rungs.push({
+			route: {
+				provider: strong.provider,
+				model: strong.model,
+				effort: strong.effort
+			},
+			tier: "strong",
+			note: `effort-only escalation on the shared model (${baseEffort} -> ${strong.effort})`
+		});
+		return rungs;
+	}
+	if (onCheapModel) {
+		let step = nextEffortStep(baseEffort);
+		while (step !== null) {
+			rungs.push({
+				route: {
+					provider: cheap.provider,
+					model: cheap.model,
+					effort: step
+				},
+				tier: "cheap",
+				note: `cheap-tier effort rung ${step}`
+			});
+			step = nextEffortStep(step);
+		}
+	}
+	rungs.push({
+		route: strong.effort === void 0 ? {
+			provider: strong.provider,
+			model: strong.model
+		} : {
+			provider: strong.provider,
+			model: strong.model,
+			effort: strong.effort
+		},
+		tier: "strong",
+		note: "switch to the strong model"
+	});
+	return rungs;
+}
+/** Failure codes that mean the route itself is unusable: switch the chain now. */
+const FALLBACK_PERMANENT_CODES = [
+	"UNKNOWN_MODEL",
+	"MISSING_CREDENTIAL",
+	"INVALID_CREDENTIAL",
+	"QUOTA"
+];
+/** Failure codes owned by `dsh-llm-retry` first: switch the chain only after retries are exhausted. */
+const FALLBACK_TRANSIENT_CODES = [
+	"RATE_LIMIT",
+	"SERVER",
+	"TIMEOUT",
+	"TRANSPORT"
+];
+/** Failure codes that must never switch the model. */
+const FALLBACK_IGNORE_CODES = [
+	"CONTEXT_WINDOW_EXCEEDED",
+	"UNSUPPORTED_REASONING_EFFORT",
+	"ABORTED",
+	"EMPTY_RESPONSE"
+];
+/**
+* Classify one failed model request for the fallback machinery.
+* @param failure - the normalized failure facts (`code` and optional `status`).
+* @returns the chain verdict.
+*/
+function classifyFallback(failure) {
+	if (failure === void 0 || failure === null || typeof failure !== "object") return "unknown";
+	const code = typeof failure.code === "string" ? failure.code : void 0;
+	if (code !== void 0) {
+		if (FALLBACK_PERMANENT_CODES.includes(code)) return "permanent";
+		if (FALLBACK_TRANSIENT_CODES.includes(code)) return "transient";
+		if (FALLBACK_IGNORE_CODES.includes(code)) return "ignore";
+	}
+	if (typeof failure.status === "number" && failure.status >= 500) return "transient";
+	return "unknown";
+}
+/** Whether a fallback record is currently pinning the agent to a chain entry. */
+function fallbackActive(record, now) {
+	return record !== void 0 && record.index >= 0 && record.until > now;
+}
+/**
+* Advance a fallback record one step down one tier's chain.
+* @param record - the current record (absent or from another tier = start of this chain).
+* @param tier - the tier whose chain is being walked.
+* @param chainLength - the number of configured fallback entries.
+* @param now - current epoch millis.
+* @param ttlMs - how long the new entry stays in force.
+* @returns the next record, or null when the chain is exhausted.
+*/
+function advanceFallback(record, tier, chainLength, now, ttlMs) {
+	const next = (record !== void 0 && record.tier === tier ? record.index : -1) + 1;
+	if (next >= chainLength) return null;
+	return {
+		tier,
+		index: next,
+		until: now + (Number.isFinite(ttlMs) && ttlMs > 0 ? ttlMs : 3e5)
+	};
+}
+//#endregion
+//#region src/policy.ts
+/** A fresh per-agent state. */
+function createRouteState() {
+	return {
+		decision: void 0,
+		input: void 0,
+		override: void 0,
+		appliedTier: void 0,
+		appliedSource: void 0,
+		planActive: false,
+		escalation: void 0,
+		fallback: void 0,
+		judge: {
+			failures: 0,
+			lastCall: 0
+		},
+		verified: false,
+		reviewOwedFor: void 0,
+		probe: void 0,
+		denials: 0,
+		lastDenial: ""
+	};
+}
+/** Whether the current failure escalation is still in force. */
+function escalationActive(state, now) {
+	return state.escalation !== void 0 && state.escalation.until > now;
+}
+/**
+* Apply the double-threshold hysteresis to a classifier-driven change. The
+* anchor is only honoured when the applied tier itself came from the
+* classifier: an escalation, plan-mode, rule or manual decision is a deliberate
+* instruction, so returning from it must not be damped (otherwise a session
+* that escalated once never returns to the cheap tier).
+*/
+function withHysteresis(state, proposed, confidence, config) {
+	const applied = state.appliedTier;
+	if (applied === void 0 || applied === proposed) return proposed;
+	const anchorSource = state.appliedSource;
+	if (anchorSource !== "judge" && anchorSource !== "posterior" && anchorSource !== "default") return proposed;
+	const { toStrong, toCheap } = config.intent.hysteresis;
+	if (proposed === "strong" && confidence < toStrong) return applied;
+	if (proposed === "cheap" && confidence >= toCheap) return applied;
+	return proposed;
+}
+/**
+* Resolve the tier for the current step.
+*
+* Precedence (highest first): explicit override, active failure escalation,
+* plan mode, declarative rule, fingerprint posterior, classifier verdict.
+* Hysteresis applies only to the classifier verdict, so an explicit override
+* or an escalation takes effect immediately.
+*
+* @param input - the live state and the classification.
+* @returns the decision with its provenance.
+*/
+function decideTier(input) {
+	const { state, config, intent, rule, override, now } = input;
+	if (override === "strong" || override === "cheap") return {
+		tier: override,
+		source: "manual",
+		reason: `/tier ${override}`,
+		confidence: 1
+	};
+	if (escalationActive(state, now)) return {
+		tier: "strong",
+		source: "escalation",
+		reason: `escalated after ${String(state.escalation?.count ?? 0)} failure(s)`,
+		confidence: 1
+	};
+	if (state.planActive) return {
+		tier: "strong",
+		source: "plan-mode",
+		reason: "plan mode is active",
+		confidence: 1
+	};
+	if (fallbackActive(state.fallback, now)) return {
+		tier: intent.tier,
+		source: "fallback",
+		reason: `fallback chain entry ${String((state.fallback?.index ?? 0) + 1)}`,
+		confidence: intent.confidence
+	};
+	if (rule !== null) return {
+		tier: rule.tier,
+		source: "rule",
+		reason: `rule ${rule.id}`,
+		confidence: 1
+	};
+	const posterior = state.probe ?? null;
+	if (posterior !== null) return {
+		tier: posterior,
+		source: "posterior",
+		reason: `fingerprint ${intent.fingerprint} posterior`,
+		confidence: 1
+	};
+	const tier = withHysteresis(state, intent.tier, intent.confidence, config);
+	return {
+		tier,
+		source: intent.shortCircuit !== void 0 ? "rule" : "judge",
+		reason: tier === intent.tier ? intent.reasons.join("; ") : `hysteresis kept ${tier} (proposed ${intent.tier} at confidence ${intent.confidence.toFixed(2)})`,
+		confidence: intent.confidence
+	};
+}
+/** Whether the low-confidence judge should be consulted for this input. */
+function judgeNeeded(config, state, intent, rule, now) {
+	if (!config.intent.judge.enabled) return false;
+	if (rule !== null) return false;
+	if (intent.shortCircuit !== void 0) return false;
+	if (intent.confidence >= config.intent.ruleThreshold) return false;
+	if (state.judge.failures >= config.intent.judge.unavailableSkip) return false;
+	return now - state.judge.lastCall >= config.intent.judge.cooldownMs;
+}
+/** Whether the middle band should start cheap and verify on a signal. */
+function attemptBandApplies(config, intent) {
+	if (!config.intent.attemptBand.enabled) return false;
+	if (intent.shortCircuit !== void 0) return false;
+	return intent.confidence >= config.intent.attemptBand.tauLow && intent.confidence < config.intent.ruleThreshold;
+}
+/** Record one judge call attempt. */
+function noteJudgeCall(state, now, ok) {
+	state.judge.lastCall = now;
+	state.judge.failures = ok ? 0 : state.judge.failures + 1;
+}
+/**
+* Record one failure against the escalation counter.
+* @param state - the agent's state.
+* @param signature - the failure signature (`code|fingerprint`); only identical
+*   signatures accumulate when `escalation.signature` is enabled.
+* @param config - the resolved configuration.
+* @param now - current epoch millis.
+* @returns whether this failure escalated the tier.
+*/
+function noteFailure(state, signature, config, now) {
+	const current = state.escalation;
+	const sameSignature = config.escalation.signature ? current?.signature === signature : true;
+	const withinWindow = current !== void 0 && now - current.lastAt <= config.escalation.windowMs;
+	const count = sameSignature && current !== void 0 && withinWindow ? current.count + 1 : 1;
+	const escalated = count >= config.escalation.threshold;
+	state.escalation = {
+		count,
+		signature: config.escalation.signature ? signature : "",
+		until: escalated ? now + config.escalation.ttlMs : current?.until ?? 0,
+		rung: escalated ? (current?.rung ?? 0) + 1 : current?.rung ?? 0,
+		lastAt: now
+	};
+	return escalated;
+}
+/** Clear an expired escalation lazily. A record that never escalated keeps its window count. */
+function clearExpiredEscalation(state, now) {
+	if (state.escalation !== void 0 && state.escalation.until > 0 && state.escalation.until <= now) state.escalation = void 0;
+}
+/**
+* Advance the agent's fallback chain for one tier after an unusable route.
+* @returns whether a chain entry was taken (false = chain exhausted).
+*/
+function noteFallback(state, tier, chainLength, config, now) {
+	const next = advanceFallback(state.fallback, tier, chainLength, now, config.escalation.fallbackTtlMs);
+	if (next === null) {
+		if (state.fallback?.tier === tier) state.fallback = void 0;
+		return false;
+	}
+	state.fallback = next;
+	return true;
+}
+//#endregion
+//#region src/types.ts
+/**
+* Shared vocabulary for dsh-autotier: the tier ids, the adapter-owned reasoning
+* effort ids, the routing modes, and the public route/status shapes every
+* module and the `ctx.autotier` service speak.
+* @module dsh-autotier/types
+*/
+/**
+* Service Definition (contract layer): the two cost tiers this plugin routes
+* between. `strong` plans complex intent and reviews high-risk work; `cheap`
+* implements it. The ids are stable wire/settings vocabulary.
+*/
+const TIER_IDS = ["strong", "cheap"];
+/**
+* Reasoning-effort ids owned by the provider adapter. The DeepSeek adapter
+* accepts exactly these four (`packages/llm/llm-deepseek/src/index.ts:133`);
+* `medium` does not exist, and an unsupported value fails every request with
+* `UNSUPPORTED_REASONING_EFFORT` instead of degrading.
+*/
+const EFFORT_IDS = [
+	"off",
+	"low",
+	"high",
+	"max"
+];
+/**
+* Routing modes. `auto` is the fully automatic path; the rest are explicit
+* user overrides (`/tier strong|cheap|off`). `delegated` means the session
+* carries an explicit model selection that autotier must not fight.
+*/
+const ROUTING_MODES = [
+	"auto",
+	"strong",
+	"cheap",
+	"delegated",
+	"off"
+];
+/** Intent classes the rule layer and the judge distinguish. */
+const SCENARIOS = [
+	"coding",
+	"review",
+	"planning",
+	"retrieval",
+	"batch",
+	"daily",
+	"longText",
+	"multimodal"
+];
+/** Cost/quality arbitration direction when the signals are ambiguous. */
+const COST_MODES = [
+	"cost-first",
+	"quality-first",
+	"balanced"
+];
+//#endregion
+//#region src/command.ts
+/** Format the tier table for `/tier status`. */
+function statusText(service, state) {
+	const status = service.status();
+	const strong = status.tiers.strong;
+	const cheap = status.tiers.cheap;
+	const lines = [
+		`dsh-autotier — mode: ${state.override ?? status.mode}`,
+		`strong: ${strong.provider}/${strong.model}${strong.effort === void 0 ? " (follows session effort)" : ` @${strong.effort}`}`,
+		`cheap:  ${cheap.provider}/${cheap.model}${cheap.effort === void 0 ? " (follows session effort)" : ` @${cheap.effort}`}`,
+		`vision: ${status.tiers.vision.provider}/${status.tiers.vision.model}`,
+		`guard:  ${status.guard.enabled ? "on" : "off"} (${status.guard.tiers.join(", ")})`
+	];
+	const decision = state.decision;
+	if (decision !== void 0) {
+		lines.push(`last intent: ${decision.scenario} (confidence ${decision.confidence.toFixed(2)}, fingerprint ${decision.fingerprint})`);
+		if (decision.reasons.length > 0) lines.push(`  because: ${decision.reasons.join("; ")}`);
+	}
+	if (state.appliedTier !== void 0) lines.push(`applied tier: ${state.appliedTier}`);
+	if (escalationActive(state, Date.now())) lines.push(`escalation: active for ${String(Math.ceil(((state.escalation?.until ?? 0) - Date.now()) / 1e3))}s`);
+	if (state.fallback !== void 0) lines.push(`fallback: chain entry ${String(state.fallback.index + 1)}`);
+	if (state.planActive) lines.push("plan mode: active (strong tier)");
+	if (state.denials > 0) lines.push(`guard denials: ${String(state.denials)} (last rule ${state.lastDenial})`);
+	return lines.join("\n");
+}
+/**
+* Register the `/tier` command on the plugin fiber.
+* @param ctx - the plugin context (must have `commands`).
+* @param service - the live service.
+* @param states - the per-agent state store.
+*/
+function registerTierCommand(ctx, service, states) {
+	ctx.commands.register({
+		name: "tier",
+		description: "Show or set this session's model tier (auto | strong | cheap | delegated | off | status).",
+		input: { hint: "auto | strong | cheap | delegated | off | status" },
+		handler: ({ agent, rawInput }) => {
+			const argument = rawInput.trim().toLowerCase();
+			const state = states.for(agent);
+			if (argument === "" || argument === "status") return {
+				kind: "success",
+				text: statusText(service, state)
+			};
+			const mode = ROUTING_MODES.find((candidate) => candidate === argument);
+			if (mode === void 0) return {
+				kind: "error",
+				text: `unknown tier mode ${JSON.stringify(argument)}; use auto | strong | cheap | off | status`
+			};
+			state.override = mode === "auto" ? void 0 : mode;
+			const status = service.status();
+			return {
+				kind: "success",
+				text: `dsh-autotier: session mode set to ${state.override ?? status.mode}\n${statusText(service, state)}`
+			};
+		}
+	});
+}
+//#endregion
+//#region src/schema.ts
+/**
+* The raw (possibly partial) configuration surface of dsh-autotier: the
+* Schemastery schema the Loader validates and the settings UI renders, plus the
+* interfaces it resolves to. The judgement that turns a raw config into a
+* resolved one lives in `config.ts`, so this module stays free of executable
+* logic (a schema module must not mix function values into its declarations).
+*
+* @module dsh-autotier/schema
+*/
+/** The default strong tier: the catalog's quality-critical model at high effort. */
+const DEFAULT_STRONG = {
+	provider: "deepseek-official",
+	model: "deepseek-v4-pro",
+	effort: "high",
+	followSession: false
+};
+/** The default cheap tier: the catalog's routine/parallel model at low effort. */
+const DEFAULT_CHEAP = {
+	provider: "deepseek-official",
+	model: "deepseek-v4-flash",
+	effort: "low",
+	followSession: true
+};
+/** The default vision landing: the catalog's only image-capable model. */
+const DEFAULT_VISION = {
+	provider: "deepseek-official",
+	model: "deepseek-v4-flash-vision-exp"
+};
+/**
+* One tier schema per tier, so a partially-specified tier gets the same
+* per-field defaults as the whole-object default (a shared schema would make
+* `Config({ tiers: { cheap: { model } } })` disagree with `resolveConfig` on
+* `followSession` and `effort`).
+*/
+const strongTier = z.object({
+	provider: z.string().default(DEFAULT_STRONG.provider),
+	model: z.string().default(DEFAULT_STRONG.model),
+	effort: z.union([...EFFORT_IDS]).default(DEFAULT_STRONG.effort),
+	followSession: z.boolean().default(DEFAULT_STRONG.followSession),
+	fallback: z.array(z.object({
+		provider: z.string().default("deepseek-official"),
+		model: z.string().default("")
+	})).default([])
+});
+const cheapTier = z.object({
+	provider: z.string().default(DEFAULT_CHEAP.provider),
+	model: z.string().default(DEFAULT_CHEAP.model),
+	effort: z.union([...EFFORT_IDS]).default(DEFAULT_CHEAP.effort),
+	followSession: z.boolean().default(DEFAULT_CHEAP.followSession),
+	fallback: z.array(z.object({
+		provider: z.string().default("deepseek-official"),
+		model: z.string().default("")
+	})).default([])
+});
+/** Schemastery schema: the loader validates and fills defaults before `apply`. */
+const Config = z.object({
+	tiers: z.object({
+		strong: strongTier.default({
+			...DEFAULT_STRONG,
+			fallback: []
+		}),
+		cheap: cheapTier.default({
+			...DEFAULT_CHEAP,
+			fallback: []
+		}),
+		vision: z.object({
+			provider: z.string().default("deepseek-official"),
+			model: z.string().default("deepseek-v4-flash-vision-exp")
+		}).default({ ...DEFAULT_VISION })
+	}).default({
+		strong: {
+			...DEFAULT_STRONG,
+			fallback: []
+		},
+		cheap: {
+			...DEFAULT_CHEAP,
+			fallback: []
+		},
+		vision: { ...DEFAULT_VISION }
+	}),
+	intent: z.object({
+		ruleThreshold: z.number().min(1e-6).max(1).default(.7),
+		attemptBand: z.object({
+			enabled: z.boolean().default(false),
+			tauLow: z.number().min(0).max(1).default(.45)
+		}).default({
+			enabled: false,
+			tauLow: .45
+		}),
+		hysteresis: z.object({
+			toStrong: z.number().min(0).max(1).default(.8),
+			toCheap: z.number().min(0).max(1).default(.6)
+		}).default({
+			toStrong: .8,
+			toCheap: .6
+		}),
+		rules: z.array(z.object({
+			id: z.string().default(""),
+			when: z.object({
+				patterns: z.array(z.string()).default([]),
+				tools: z.array(z.string()).default([]),
+				cwd: z.string().default("")
+			}).default({
+				patterns: [],
+				tools: [],
+				cwd: ""
+			}),
+			tier: z.union(["cheap", "strong"]).default("strong"),
+			priority: z.number().default(0)
+		})).default([]),
+		judge: z.object({
+			enabled: z.boolean().default(true),
+			model: z.string().default(""),
+			temperature: z.number().min(0).max(2).default(0),
+			maxTokens: z.number().step(1).min(1).max(4096).default(16),
+			cooldownMs: z.number().min(0).max(36e5).default(3e4),
+			timeoutMs: z.number().min(1).max(12e4).default(2e3),
+			unavailableSkip: z.number().step(1).min(0).max(100).default(2)
+		}).default({
+			enabled: true,
+			model: "",
+			temperature: 0,
+			maxTokens: 16,
+			cooldownMs: 3e4,
+			timeoutMs: 2e3,
+			unavailableSkip: 2
+		}),
+		scenarios: z.object({
+			coding: z.boolean().default(true),
+			review: z.boolean().default(true),
+			planning: z.boolean().default(true),
+			retrieval: z.boolean().default(true),
+			batch: z.boolean().default(true),
+			daily: z.boolean().default(true),
+			longText: z.boolean().default(true),
+			multimodal: z.boolean().default(true)
+		}).default({
+			coding: true,
+			review: true,
+			planning: true,
+			retrieval: true,
+			batch: true,
+			daily: true,
+			longText: true,
+			multimodal: true
+		}),
+		costMode: z.union([...COST_MODES]).default("balanced")
+	}).default({
+		ruleThreshold: .7,
+		attemptBand: {
+			enabled: false,
+			tauLow: .45
+		},
+		hysteresis: {
+			toStrong: .8,
+			toCheap: .6
+		},
+		rules: [],
+		judge: {
+			enabled: true,
+			model: "",
+			temperature: 0,
+			maxTokens: 16,
+			cooldownMs: 3e4,
+			timeoutMs: 2e3,
+			unavailableSkip: 2
+		},
+		scenarios: {
+			coding: true,
+			review: true,
+			planning: true,
+			retrieval: true,
+			batch: true,
+			daily: true,
+			longText: true,
+			multimodal: true
+		},
+		costMode: "balanced"
+	}),
+	guard: z.object({
+		enabled: z.boolean().default(true),
+		tiers: z.array(z.union(["cheap"])).default(["cheap"]),
+		whitelist: z.array(z.string()).default([]),
+		protectedPaths: z.array(z.string()).default([
+			".dsh",
+			"AGENTS.md",
+			"package.json",
+			".github/workflows"
+		]),
+		interopDefend: z.union(["auto", "none"]).default("auto")
+	}).default({
+		enabled: true,
+		tiers: ["cheap"],
+		whitelist: [],
+		protectedPaths: [
+			".dsh",
+			"AGENTS.md",
+			"package.json",
+			".github/workflows"
+		],
+		interopDefend: "auto"
+	}),
+	escalation: z.object({
+		threshold: z.number().step(1).min(1).max(100).default(2),
+		windowMs: z.number().min(1).max(864e5).default(6e4),
+		ttlMs: z.number().min(1).max(864e5).default(18e4),
+		fallbackTtlMs: z.number().min(1).max(864e5).default(3e5),
+		signature: z.boolean().default(true)
+	}).default({
+		threshold: 2,
+		windowMs: 6e4,
+		ttlMs: 18e4,
+		fallbackTtlMs: 3e5,
+		signature: true
+	}),
+	routingMode: z.union([...ROUTING_MODES]).default("auto")
+});
+//#endregion
+//#region src/config.ts
+/**
+* The explicit-resolve judge for dsh-autotier: it re-checks every default,
+* bound and cross-field requirement field by field, so programmatic
+* construction that bypasses Schemastery normalization still fails loud. The
+* schema itself lives in `schema.ts`.
+*
+* @module dsh-autotier/config
+*/
+/** Throw the standard fail-loud config error for one invalid field. */
+function invalid(field, detail) {
+	throw new Error(`dsh-autotier: config.${field} ${detail}`);
+}
+/** Read a required non-empty string field, failing loud when absent or blank. */
+function text(field, value, fallback) {
+	const resolved = value ?? fallback;
+	if (typeof resolved !== "string" || resolved.trim().length === 0) invalid(field, "must be a non-empty string");
+	return resolved;
+}
+/** Read a bounded finite number. */
+function number(field, value, fallback, min, max) {
+	const resolved = value ?? fallback;
+	if (!Number.isFinite(resolved) || resolved < min || resolved > max) invalid(field, `must be a finite number in [${String(min)}, ${String(max)}]`);
+	return resolved;
+}
+/** Read an integer in a closed range. */
+function integer(field, value, fallback, min, max) {
+	const resolved = value ?? fallback;
+	if (!Number.isInteger(resolved) || resolved < min || resolved > max) invalid(field, `must be an integer in [${String(min)}, ${String(max)}]`);
+	return resolved;
+}
+/** Read a boolean switch. */
+function boolean(field, value, fallback) {
+	const resolved = value ?? fallback;
+	if (typeof resolved !== "boolean") invalid(field, "must be a boolean");
+	return resolved;
+}
+/** Read one member of a closed string set. */
+function member(field, value, fallback, allowed) {
+	const resolved = value ?? fallback;
+	if (!allowed.includes(resolved)) invalid(field, `must be one of ${allowed.join(", ")}`);
+	return resolved;
+}
+/** Resolve one tier, judging its landing, effort vocabulary and fallback chain. */
+function resolveTier(tier, raw, fallback) {
+	const provider = text(`tiers.${tier}.provider`, raw?.provider, fallback.provider);
+	const model = text(`tiers.${tier}.model`, raw?.model, fallback.model);
+	const effort = member(`tiers.${tier}.effort`, raw?.effort, fallback.effort, EFFORT_IDS);
+	const followSession = boolean(`tiers.${tier}.followSession`, raw?.followSession, fallback.followSession);
+	const chain = [];
+	const seen = /* @__PURE__ */ new Set([`${provider}/${model}`]);
+	for (const [index, entry] of (raw?.fallback ?? []).entries()) {
+		const entryProvider = text(`tiers.${tier}.fallback[${String(index)}].provider`, entry.provider, "");
+		const entryModel = text(`tiers.${tier}.fallback[${String(index)}].model`, entry.model, "");
+		const key = `${entryProvider}/${entryModel}`;
+		if (seen.has(key)) invalid(`tiers.${tier}.fallback[${String(index)}]`, `duplicates the tier landing or an earlier fallback (${key})`);
+		seen.add(key);
+		chain.push({
+			provider: entryProvider,
+			model: entryModel
+		});
+	}
+	return {
+		provider,
+		model,
+		effort,
+		followSession,
+		fallback: chain
+	};
+}
+/** Resolve the intent section. */
+function resolveIntent(raw) {
+	const intent = raw ?? {};
+	const ruleThreshold = number("intent.ruleThreshold", intent.ruleThreshold, .7, 1e-6, 1);
+	const tauLow = number("intent.attemptBand.tauLow", intent.attemptBand?.tauLow, .45, 0, 1);
+	if (tauLow >= ruleThreshold) invalid("intent.attemptBand.tauLow", `must stay below intent.ruleThreshold (${String(tauLow)} >= ${String(ruleThreshold)})`);
+	const toStrong = number("intent.hysteresis.toStrong", intent.hysteresis?.toStrong, .8, 0, 1);
+	const toCheap = number("intent.hysteresis.toCheap", intent.hysteresis?.toCheap, .6, 0, 1);
+	if (toCheap >= toStrong) invalid("intent.hysteresis", `toCheap (${String(toCheap)}) must stay below toStrong (${String(toStrong)})`);
+	const rules = [];
+	const ruleIds = /* @__PURE__ */ new Set();
+	for (const [index, rule] of (intent.rules ?? []).entries()) {
+		const id = text(`intent.rules[${String(index)}].id`, rule.id, "");
+		if (ruleIds.has(id)) invalid(`intent.rules[${String(index)}].id`, `duplicates rule id ${JSON.stringify(id)}`);
+		ruleIds.add(id);
+		const priority = rule.priority ?? 0;
+		if (!Number.isFinite(priority)) invalid(`intent.rules[${String(index)}].priority`, "must be a finite number");
+		const patterns = [...rule.when?.patterns ?? []];
+		const tools = [...rule.when?.tools ?? []];
+		if (patterns.length === 0 && tools.length === 0) invalid(`intent.rules[${String(index)}].when`, "must declare at least one pattern or tool");
+		for (const [patternIndex, pattern] of patterns.entries()) {
+			if (typeof pattern !== "string" || pattern.length === 0) invalid(`intent.rules[${String(index)}].when.patterns[${String(patternIndex)}]`, "must be a non-empty regular expression");
+			try {
+				new RegExp(pattern, "u");
+			} catch (error) {
+				invalid(`intent.rules[${String(index)}].when.patterns[${String(patternIndex)}]`, `is not a valid regular expression (${String(error)})`);
+			}
+		}
+		for (const [toolIndex, tool] of tools.entries()) if (typeof tool !== "string" || tool.trim().length === 0) invalid(`intent.rules[${String(index)}].when.tools[${String(toolIndex)}]`, "must be a non-empty tool name");
+		rules.push({
+			id,
+			when: {
+				patterns,
+				tools,
+				cwd: rule.when?.cwd ?? ""
+			},
+			tier: member(`intent.rules[${String(index)}].tier`, rule.tier, "strong", ["cheap", "strong"]),
+			priority
+		});
+	}
+	const judge = intent.judge ?? {};
+	const judgeModel = judge.model ?? "";
+	if (typeof judgeModel !== "string") invalid("intent.judge.model", "must be a string (empty = auto)");
+	const scenarios = Object.fromEntries(SCENARIOS.map((scenario) => [scenario, boolean(`intent.scenarios.${scenario}`, intent.scenarios?.[scenario], true)]));
+	return {
+		ruleThreshold,
+		attemptBand: {
+			enabled: boolean("intent.attemptBand.enabled", intent.attemptBand?.enabled, false),
+			tauLow
+		},
+		hysteresis: {
+			toStrong,
+			toCheap
+		},
+		rules,
+		judge: {
+			enabled: boolean("intent.judge.enabled", judge.enabled, true),
+			model: judgeModel,
+			temperature: number("intent.judge.temperature", judge.temperature, 0, 0, 2),
+			maxTokens: integer("intent.judge.maxTokens", judge.maxTokens, 16, 1, 4096),
+			cooldownMs: number("intent.judge.cooldownMs", judge.cooldownMs, 3e4, 0, 36e5),
+			timeoutMs: number("intent.judge.timeoutMs", judge.timeoutMs, 2e3, 1, 12e4),
+			unavailableSkip: integer("intent.judge.unavailableSkip", judge.unavailableSkip, 2, 0, 100)
+		},
+		scenarios,
+		costMode: member("intent.costMode", intent.costMode, "balanced", COST_MODES)
+	};
+}
+/** Resolve the guard section. */
+function resolveGuard(raw) {
+	const guard = raw ?? {};
+	const whitelist = [...guard.whitelist ?? []];
+	for (const [index, entry] of whitelist.entries()) if (typeof entry !== "string" || entry.trim().length === 0) invalid(`guard.whitelist[${String(index)}]`, "must be a non-empty string");
+	const protectedPaths = [...guard.protectedPaths ?? [
+		".dsh",
+		"AGENTS.md",
+		"package.json",
+		".github/workflows"
+	]];
+	for (const [index, entry] of protectedPaths.entries()) if (typeof entry !== "string" || entry.trim().length === 0) invalid(`guard.protectedPaths[${String(index)}]`, "must be a non-empty path or glob");
+	const tiers = guard.tiers === void 0 ? ["cheap"] : guard.tiers.map((tier, index) => {
+		if (tier !== "cheap") invalid(`guard.tiers[${String(index)}]`, "must be \"cheap\"");
+		return tier;
+	});
+	if (tiers.length === 0) invalid("guard.tiers", "must list at least one tier; use guard.enabled=false to disable the guard");
+	return {
+		enabled: boolean("guard.enabled", guard.enabled, true),
+		tiers,
+		whitelist,
+		protectedPaths,
+		interopDefend: member("guard.interopDefend", guard.interopDefend, "auto", ["auto", "none"])
+	};
+}
+/** Resolve the escalation section. */
+function resolveEscalation(raw) {
+	const escalation = raw ?? {};
+	return {
+		threshold: integer("escalation.threshold", escalation.threshold, 2, 1, 100),
+		windowMs: number("escalation.windowMs", escalation.windowMs, 6e4, 1, 864e5),
+		ttlMs: number("escalation.ttlMs", escalation.ttlMs, 18e4, 1, 864e5),
+		fallbackTtlMs: number("escalation.fallbackTtlMs", escalation.fallbackTtlMs, 3e5, 1, 864e5),
+		signature: boolean("escalation.signature", escalation.signature, true)
+	};
+}
+/** Deep-freeze a resolved configuration tree. */
+function deepFreeze(value) {
+	if (value !== null && typeof value === "object") {
+		for (const nested of Object.values(value)) deepFreeze(nested);
+		Object.freeze(value);
+	}
+	return value;
+}
+/**
+* The landing a tier actually resolves to. `followSession` tiers omit their
+* effort, so two tiers that differ only by a configured-but-ignored effort are
+* the same landing and must be rejected.
+*/
+function effectiveLanding(tier) {
+	return tier.followSession ? `${tier.provider}/${tier.model}@session` : `${tier.provider}/${tier.model}@${tier.effort}`;
+}
+/**
+* Resolve raw config to the frozen runtime policy, re-judging every default,
+* bound and cross-field requirement.
+*
+* @param raw - raw loader config; `undefined` for a bare row.
+* @returns the frozen resolved config.
+* @throws {Error} when a value is out of bounds or a cross-field requirement fails.
+*/
+function resolveConfig(raw) {
+	const tiers = raw?.tiers ?? {};
+	const strong = resolveTier("strong", tiers.strong, DEFAULT_STRONG);
+	const cheap = resolveTier("cheap", tiers.cheap, DEFAULT_CHEAP);
+	const strongTriple = effectiveLanding(strong);
+	if (strongTriple === effectiveLanding(cheap)) invalid("tiers", `strong and cheap resolve to the same landing (${strongTriple}); tiering would be a no-op`);
+	return deepFreeze({
+		tiers: {
+			strong,
+			cheap,
+			vision: {
+				provider: text("tiers.vision.provider", tiers.vision?.provider, DEFAULT_VISION.provider),
+				model: text("tiers.vision.model", tiers.vision?.model, DEFAULT_VISION.model)
+			}
+		},
+		intent: resolveIntent(raw?.intent),
+		guard: resolveGuard(raw?.guard),
+		escalation: resolveEscalation(raw?.escalation),
+		routingMode: member("routingMode", raw?.routingMode, "auto", ROUTING_MODES)
+	});
+}
+/**
+* Judge a configuration without keeping the resolved value. This is the
+* save-time hook the `autotier` settings namespace registers, so a user write
+* that violates a cross-field requirement is refused at the write instead of
+* silently disabling the plugin.
+*
+* @param value - the configuration to judge.
+* @throws {Error} when the configuration is invalid.
+*/
+function validateConfig(value) {
+	resolveConfig(value);
+}
+//#endregion
+//#region src/guard-rules.ts
+/**
+* High-impact command and path rules for the autotier guard.
+*
+* A TypeScript port of the dependency-free rule logic in `lib/pure.js` of
+* `dsh-tier-router` (v0.5.0, MIT — see `THIRD_PARTY_NOTICES.md`): the
+* `ARG_RUNNERS`/`DIRECT_RUNNERS` command-position detection, the 16
+* `HIGH_IMPACT_COMMAND` patterns, and the 5 `HIGH_IMPACT_PATH` patterns. The
+* upstream matching order, case-insensitivity, anchored command position, and
+* 80/120-character truncation are preserved exactly; the port only adds stable
+* rule ids and the `GuardMatch` shape the guard layer consumes.
+*
+* INTENTIONAL DELTA OVER UPSTREAM (the plugin's own Apache-2.0 addition, not
+* upstream code): upstream never looks inside a `sh -c "..."` payload, so
+* `sh -c "rm -rf /"` is a documented false negative. {@link SHELL_WRAPPERS} and
+* {@link SHELL_WRAPPER_MAX_DEPTH} add a second pass that runs only after the
+* upstream rules return no match: it strips a leading command runner, extracts
+* the `-c` payload (single-dash flag clusters such as `-lc`, case-insensitive
+* wrapper names, and the optional backslash escape included), unescapes it, and
+* re-runs the same matcher on it (bounded by depth) under a
+* `shell-wrapper:<inner rule>` id. No upstream verdict changes.
+*
+* Matching is deliberately conservative: it is a review/escalation signal, never
+* a substitute for `dsh-defend`, approvals, or the sandbox policy.
+* @module dsh-autotier/guard-rules
+*/
+/**
+* Command runners that may prefix `rm` and still execute it, split by whether
+* they legitimately carry their own arguments before the command.
+*
+* `ARG_RUNNERS` allow any arguments before `rm` (`env -i rm -rf`,
+* `timeout 5 rm -rf`, `xargs -0 rm -rf`); `DIRECT_RUNNERS` take the command
+* immediately (`nohup rm -rf`), because allowing arguments there would
+* false-positive on harmless forms like `nohup echo rm -rf`.
+*/
+const ARG_RUNNERS = "sudo|env|timeout|nice|xargs|doas|setarch|stdbuf|ionice";
+const DIRECT_RUNNERS = "command|exec|busybox|nohup|pkexec";
+/**
+* `rm` at command position: start of string, after a command separator
+* (`;`, `&`, `|`), or after one of the runners above. `\\?` makes the leading
+* backslash escape (`\rm -rf`) optional rather than required.
+*/
+const RECURSIVE_FORCE_RM = new RegExp("(^|[;&|]\\s*|\\b(" + ARG_RUNNERS + ")\\s+(?:\\S+\\s+)*" + "|\\b(" + DIRECT_RUNNERS + ")\\s+" + ")\\\\?rm(\\s+)", "i");
+/** Command matches are trimmed and truncated to this many characters. */
+const COMMAND_MATCH_LIMIT = 80;
+/** Path matches are truncated to this many characters (upstream: whole path). */
+const PATH_MATCH_LIMIT = 120;
+/**
+* Shell wrappers whose `-c` payload must be re-scanned (upstream misses these).
+* This table and {@link SHELL_WRAPPER_MAX_DEPTH} are the plugin's own extension,
+* not part of the upstream rule port.
+*/
+const SHELL_WRAPPERS = [
+	"sh",
+	"bash",
+	"zsh",
+	"dash",
+	"ksh"
+];
+/**
+* The wrapper-name alternation in every letter case (`SH`, `Bash`, `sh`, ...)
+* WITHOUT making the flag cluster case-insensitive: `-C` must not count as a
+* `-c` cluster.
+*/
+const WRAPPER_NAMES = SHELL_WRAPPERS.map((word) => word.split("").map((letter) => `[${letter}${letter.toUpperCase()}]`).join("")).join("|");
+/**
+* A wrapper invocation at command position: separator/start, an optional
+* backslash escape, wrapper name (any letter case), a single-dash flag cluster
+* containing `c` (`-c`, `-lc`, `-ec`, ... but never a long option such as
+* `--command`, which has no single-dash cluster before the payload), then a
+* double-quoted, single-quoted, or bare payload. The quoted forms accept
+* backslash escapes so nested quoting survives; the captured content is
+* unescaped before it is re-scanned.
+*/
+const SHELL_WRAPPER_C = new RegExp(`(^|[;&|]\\s*)\\\\?(${WRAPPER_NAMES})\\s+-(?=[a-z]*c[a-z]*\\b)[a-z]+\\s+("((?:[^"\\\\]|\\\\.)*)"|'((?:[^'\\\\]|\\\\.)*)'|(\\S+))`);
+/** A command runner at the very start, with optional backslash escape. */
+const RUNNER_AT_START = new RegExp(`^\\s*\\\\?(${ARG_RUNNERS}|${DIRECT_RUNNERS})\\s+`);
+/** An argument-carrying runner at the very start. */
+const ARG_RUNNER_AT_START = new RegExp(`^\\s*\\\\?(${ARG_RUNNERS})\\s+`);
+/** One leading whitespace-delimited token. */
+const LEADING_TOKEN = /^(\S+)\s+/;
+/**
+* The 16 upstream `HIGH_IMPACT_COMMAND` patterns, in upstream array order.
+* `matchCommand` returns the first hit, so order is part of the contract:
+* `sudo` precedes `wget-pipe-shell`, and the separate `rm` rule precedes all
+* of these.
+*/
+const HIGH_IMPACT_COMMAND_RULES = [
+	{
+		id: "mkfs",
+		description: "mkfs: filesystem creation on a device",
+		pattern: /\bmkfs\.?[a-z]*\b/
+	},
+	{
+		id: "dd-write",
+		description: "dd with if=/of=: raw device read/write",
+		pattern: /\bdd\s+(if|of)=/
+	},
+	{
+		id: "sudo",
+		description: "sudo: privilege escalation at command position",
+		pattern: /(^|[;&|]\s*)sudo\b/
+	},
+	{
+		id: "shutdown",
+		description: "shutdown/reboot/halt: system power control",
+		pattern: /(^|[;&|]\s*)(shutdown|reboot|halt)\b/
+	},
+	{
+		id: "git-push-force",
+		description: "git push --force/-f: remote history rewrite",
+		pattern: /git\s+push\s+[^\n]*(-f\b|--force)/
+	},
+	{
+		id: "git-clean-force",
+		description: "git clean -f: untracked file deletion",
+		pattern: /git\s+clean\s+(-[a-z]*f[a-z]*\b)/
+	},
+	{
+		id: "find-delete",
+		description: "find -delete: recursive file deletion",
+		pattern: /find\s+[^\n]*\s+-delete\b/
+	},
+	{
+		id: "find-exec-rm",
+		description: "find -exec rm: deletion through find",
+		pattern: /find\s+[^\n]*-exec\s+[^\n]*\brm\b/
+	},
+	{
+		id: "shutil-rmtree",
+		description: "shutil.rmtree(...): recursive Python deletion",
+		pattern: /\b(shutil\.rmtree|rmtree)\s*\(/
+	},
+	{
+		id: "os-remove",
+		description: "os.remove(...): Python file deletion",
+		pattern: /\bos\.remove\s*\(/
+	},
+	{
+		id: "python-inline-delete",
+		description: "python -c with inline deletion",
+		pattern: /python[0-9.]*\s+-c\s+[^|;&\n]*(rmtree|os\.remove|shutil\.rmtree|rm\s+-rf)/
+	},
+	{
+		id: "curl-pipe-shell",
+		description: "curl | sh: remote script execution",
+		pattern: /curl\s+[^\n]*\|\s*(sudo\s+)?(ba)?sh\b/
+	},
+	{
+		id: "wget-pipe-shell",
+		description: "wget | sh: remote script execution",
+		pattern: /wget\s+[^\n]*\|\s*(sudo\s+)?(ba)?sh\b/
+	},
+	{
+		id: "chmod-ssh",
+		description: "chmod on a .ssh/ path: SSH key permission change",
+		pattern: /\bchmod\s+[0-7]{3,4}\s+[^\n]*\.ssh\//
+	},
+	{
+		id: "chown",
+		description: "chown: ownership change",
+		pattern: /\bchown\s/
+	},
+	{
+		id: "diskutil-erase",
+		description: "diskutil erase/unmount: macOS disk destruction",
+		pattern: /\bdiskutil\s+(eraseDisk|eraseVolume|zeroDisk|secureErase|unmountDisk)\b/
+	}
+];
+/**
+* The 5 upstream `HIGH_IMPACT_PATH` patterns (credentials, keys, secrets), in
+* upstream array order. `.env` matches unless the suffix is an
+* example/sample/template name.
+*/
+const HIGH_IMPACT_PATH_RULES = [
+	{
+		id: "dotenv",
+		description: ".env secrets file (example/sample/template names excluded)",
+		pattern: /(^|\/)\.env(\.(?!example|sample|template)[^/]*)?$/i
+	},
+	{
+		id: "credentials",
+		description: "credentials/secrets file or directory",
+		pattern: /(^|\/)(credentials?|secrets?)(\.(json|ya?ml|toml|ini|env|key|pem|txt))?($|\/)/i
+	},
+	{
+		id: "ssh-dir",
+		description: ".ssh/ directory",
+		pattern: /(^|\/)\.ssh\//
+	},
+	{
+		id: "private-key",
+		description: "id_rsa/id_ed25519/id_ecdsa/id_dsa key or .netrc",
+		pattern: /(^|\/)(id_(rsa|ed25519|ecdsa|dsa)|\.netrc)(\b|\/)/i
+	},
+	{
+		id: "key-file",
+		description: ".pem/.key/.p12/.pfx/.jks key material",
+		pattern: /\.(pem|key|p12|pfx|jks)$/i
+	}
+];
+/** Description reported for the separate recursive-force `rm` rule. */
+const RM_RECURSIVE_FORCE_DESCRIPTION = "command pattern rm -r/-f matched (recursive force delete)";
+/**
+* Match `rm` at command position with BOTH recursive (`-r`/`-R`/`--recursive`)
+* and force (`-f`/`--force`) flags, including split flags (`rm -r -f`) that a
+* single-token check misses.
+* @param command - one shell command string.
+* @returns the matched command-position text (trimmed, truncated), or null.
+*/
+function matchRecursiveForceRm(command) {
+	const separator = command.match(RECURSIVE_FORCE_RM);
+	if (separator === null) return null;
+	const head = separator[0] ?? "";
+	const rest = command.slice((separator.index ?? 0) + head.length);
+	let flags = "";
+	for (const token of rest.split(/\s+/)) if (/^--?[a-zA-Z]/.test(token)) flags += token.replace(/^-+/, "");
+	else break;
+	const lowered = flags.toLowerCase();
+	if (!lowered.includes("r") || !lowered.includes("f")) return null;
+	return head.trim().slice(0, COMMAND_MATCH_LIMIT);
+}
+/**
+* Match the upstream command rules only: the recursive-force `rm` rule first
+* (upstream order), then {@link HIGH_IMPACT_COMMAND_RULES} in array order.
+*/
+function matchUpstreamCommand(command) {
+	const rm = matchRecursiveForceRm(command);
+	if (rm !== null) return {
+		rule: "rm-recursive-force",
+		description: RM_RECURSIVE_FORCE_DESCRIPTION,
+		matched: rm
+	};
+	for (const rule of HIGH_IMPACT_COMMAND_RULES) {
+		const match = command.match(rule.pattern);
+		if (match !== null) return {
+			rule: rule.id,
+			description: rule.description,
+			matched: (match[0] ?? "").trim().slice(0, COMMAND_MATCH_LIMIT)
+		};
+	}
+	return null;
+}
+/**
+* Strip leading command runners (and the arguments an argument-carrying runner
+* may carry) so a `sh -c ...` behind `env -i`, `timeout 5`, or `nohup` is still
+* seen at command position. Argument consumption stops at a shell wrapper,
+* matched case-insensitively and with the optional backslash escape removed.
+*/
+function stripRunnerPrefix(command) {
+	let rest = command;
+	for (;;) {
+		const carriesArgs = ARG_RUNNER_AT_START.test(rest);
+		const runner = RUNNER_AT_START.exec(rest);
+		if (runner === null) return rest;
+		rest = rest.slice((runner[0] ?? "").length);
+		if (!carriesArgs) continue;
+		for (;;) {
+			const token = LEADING_TOKEN.exec(rest);
+			const word = (token?.[1] ?? "").replace(/^\\/, "").toLowerCase();
+			if (token === null || SHELL_WRAPPERS.includes(word)) break;
+			rest = rest.slice((token[0] ?? "").length);
+		}
+	}
+}
+/** The `-c` payload of the first shell-wrapper invocation, or null. */
+function matchShellWrapperPayload(command) {
+	const wrapper = SHELL_WRAPPER_C.exec(stripRunnerPrefix(command));
+	if (wrapper === null) return null;
+	return (wrapper[4] ?? wrapper[5] ?? wrapper[6] ?? "").replace(/\\(["'\\])/g, "$1");
+}
+/**
+* The full matcher: upstream rules first, then the bounded shell-wrapper
+* extension. `depth` counts wrapper unwrappings, so a payload nested deeper
+* than {@link SHELL_WRAPPER_MAX_DEPTH} is left unmatched.
+*/
+function matchCommandAtDepth(command, depth) {
+	const upstream = matchUpstreamCommand(command);
+	if (upstream !== null) return upstream;
+	if (depth >= 3) return null;
+	const payload = matchShellWrapperPayload(command);
+	if (payload === null) return null;
+	const inner = matchCommandAtDepth(payload, depth + 1);
+	if (inner === null) return null;
+	return {
+		rule: `shell-wrapper:${inner.rule}`,
+		description: `shell wrapper -c payload: ${inner.description}`,
+		matched: inner.matched.slice(0, COMMAND_MATCH_LIMIT)
+	};
+}
+/**
+* Match one shell command string against the recursive-force `rm` rule first
+* (upstream order) and then the command rules in array order; only when those
+* find nothing, re-scan a `sh -c`-style payload (see the module header delta).
+* @param command - one shell command string.
+* @returns the first match, or null when the command is not high impact.
+*/
+function matchCommand(command) {
+	return matchCommandAtDepth(command, 0);
+}
+/**
+* Match one file path (a write/edit target) against the path rules in array
+* order.
+* @param filePath - one target path.
+* @returns the first match, or null when the path is not high impact.
+*/
+function matchPath(filePath) {
+	const rule = HIGH_IMPACT_PATH_RULES.find((candidate) => candidate.pattern.test(filePath));
+	if (rule === void 0) return null;
+	return {
+		rule: rule.id,
+		description: rule.description,
+		matched: filePath.slice(0, PATH_MATCH_LIMIT)
+	};
+}
+/**
+* Credential/secret path classification for protected-path review: true when
+* any of the {@link HIGH_IMPACT_PATH_RULES} matches, i.e. exactly the paths
+* {@link matchPath} reports.
+*/
+function isCredentialPath(filePath) {
+	return HIGH_IMPACT_PATH_RULES.some((rule) => rule.pattern.test(filePath));
+}
+//#endregion
+//#region src/guard.ts
+/** Tool argument keys that carry a shell command. */
+const COMMAND_KEYS = [
+	"command",
+	"cmd",
+	"script"
+];
+/**
+* Tool argument keys that carry a filesystem target. `file_path` is specific
+* enough to trust on any tool; the looser keys are only read from tools whose
+* name says they write, so a tool with an unrelated `target` argument (a window
+* handle, a selector) cannot trip the path rules.
+*/
+const STRICT_PATH_KEYS = ["file_path"];
+const LOOSE_PATH_KEYS = [
+	"path",
+	"target",
+	"file",
+	"filename"
+];
+/** Tool names whose `path`-like arguments are filesystem targets. */
+const WRITE_TOOL_PATTERN = /(?:write|edit|patch|create|delete|remove|move|copy|rename|save|apply|mkdir|touch)/iu;
+/**
+* Secret shapes that must never reach a model-visible denial reason or the
+* session log. The matched snippet is the one place user text could leak into
+* the guard's output, so it is redacted before it is composed.
+*/
+const SECRET_PATTERNS = [
+	/(bearer\s+)[A-Za-z0-9._~+/=-]{8,}/giu,
+	/\bsk-[A-Za-z0-9._-]{8,}/gu,
+	/\bgh[pousr]_[A-Za-z0-9]{8,}/gu,
+	/((?:password|passwd|token|secret|api[_-]?key)\s*[=:]\s*)\S+/giu
+];
+/** Redact credential-shaped spans from one snippet. */
+function redactSnippet(text) {
+	let redacted = text;
+	for (const pattern of SECRET_PATTERNS) redacted = redacted.replace(pattern, "$1<redacted>");
+	return redacted;
+}
+/** Extract the first string-valued key present in `args`. */
+function pick(args, keys) {
+	if (args === null || typeof args !== "object") return void 0;
+	const record = args;
+	for (const key of keys) {
+		const value = record[key];
+		if (typeof value === "string" && value.length > 0) return value;
+	}
+}
+/**
+* Whether a path sits inside a configured protected surface. Windows resolves
+* case-insensitively and strips trailing dots/spaces from each segment, so the
+* comparison normalizes both before matching; otherwise `PACKAGE.JSON` and
+* `package.json.` would slip past the guard.
+*/
+function isProtectedPath(path, protectedPaths) {
+	const normalize = (value) => {
+		const slashed = value.replace(/\\/gu, "/");
+		if (process.platform !== "win32") return slashed;
+		return slashed.split("/").map((segment) => segment.replace(/[. ]+$/u, "").toLowerCase()).join("/");
+	};
+	const normalized = normalize(path);
+	for (const entry of protectedPaths) {
+		const needle = normalize(entry).replace(/^\.\//u, "");
+		if (normalized === needle || normalized.endsWith(`/${needle}`) || normalized.includes(`/${needle}/`)) return entry;
+	}
+}
+/** Whether a command or path is whitelisted (exact, or a path/word boundary prefix). */
+function isWhitelisted(value, toolName, whitelist) {
+	if (whitelist.includes(toolName)) return true;
+	if (value === void 0) return false;
+	return whitelist.some((entry) => {
+		if (value === entry) return true;
+		const rest = value.slice(entry.length);
+		if (!value.startsWith(entry) || rest === "") return false;
+		return /^[\s/\\]/u.test(rest);
+	});
+}
+/**
+* Judge one tool call.
+*
+* Order: the guard must be enabled and the executing tier protected, then the
+* whitelist, then the credential/command rules, then the protected-path review
+* rule. A denial names the rule and tells the model to escalate instead of
+* retrying.
+*
+* @param input - the call, the executing tier and the live configuration.
+* @returns the verdict.
+*/
+function evaluateToolCall(input) {
+	const { config, tier } = input;
+	if (!config.guard.enabled) return {
+		action: "allow",
+		reason: "",
+		rule: "",
+		axis: "none"
+	};
+	if (!config.guard.tiers.includes("cheap") || tier !== "cheap") return {
+		action: "allow",
+		reason: "",
+		rule: "",
+		axis: "none"
+	};
+	const command = pick(input.args, COMMAND_KEYS);
+	const path = WRITE_TOOL_PATTERN.test(input.toolName) ? pick(input.args, STRICT_PATH_KEYS) ?? pick(input.args, LOOSE_PATH_KEYS) : void 0;
+	if (isWhitelisted(command ?? path, input.toolName, config.guard.whitelist)) return {
+		action: "allow",
+		reason: "",
+		rule: "",
+		axis: "none"
+	};
+	if (path !== void 0) {
+		const protectedEntry = isProtectedPath(path, config.guard.protectedPaths);
+		if (protectedEntry !== void 0) return {
+			action: "deny",
+			rule: "protected-path",
+			axis: "protected-path",
+			reason: `dsh-autotier guard: "${redactSnippet(path)}" is a protected surface (${protectedEntry}). Modifying it requires the strong tier; report what you intend to change instead of retrying.`
+		};
+	}
+	if (command !== void 0) {
+		const hit = matchCommand(command);
+		if (hit !== null) return {
+			action: "deny",
+			rule: hit.rule,
+			axis: "command",
+			reason: `dsh-autotier guard: ${redactSnippet(hit.description)}. This command is denied while the cheap tier executes; the tier will escalate if the task needs it — do not retry the command.`
+		};
+	}
+	if (path !== void 0) {
+		const hit = matchPath(path);
+		if (hit !== null) return {
+			action: "deny",
+			rule: hit.rule,
+			axis: "path",
+			reason: `dsh-autotier guard: ${redactSnippet(hit.description)}. Credential and key material is denied while the cheap tier executes; the tier will escalate if the task needs it.`
+		};
+	}
+	return {
+		action: "allow",
+		reason: "",
+		rule: "",
+		axis: "none"
+	};
+}
+/** The tier the guard believes is executing one call. */
+function tierOf(states, agent) {
+	if (agent === void 0) return void 0;
+	const state = states.for(agent);
+	if (state.override === "strong") return "strong";
+	if (state.override === "off") return void 0;
+	if (state.override === "cheap") return "cheap";
+	if (state.escalation !== void 0 && state.escalation.until > Date.now()) return "strong";
+	return state.appliedTier ?? "cheap";
+}
+/**
+* Register the `tools/pre-execute` guard.
+*
+* The listener is registered with `{ prepend: true }` so a denial claims the
+* call before any pass-through listener; every allowed call awaits `next()`.
+*
+* @param options - the plugin context, service and state store.
+*/
+function registerGuardHook({ ctx, service, states }) {
+	ctx.on("tools/pre-execute", async (exec, next) => {
+		const agent = exec.agent;
+		try {
+			const tier = tierOf(states, agent);
+			if (tier === void 0) return next();
+			const sandbox = ctx.get("sandboxPolicy");
+			const sandboxMode = sandbox === void 0 || agent === void 0 ? void 0 : sandbox.resolve({ session: agent.session }).mode;
+			const verdict = evaluateToolCall({
+				toolName: exec.name,
+				args: exec.arguments,
+				tier,
+				config: service.config(),
+				...sandboxMode === void 0 ? {} : { sandboxMode }
+			});
+			if (verdict.action === "allow") return next();
+			ctx.logger.warn("dsh-autotier: guard denied %s on the %s tier (rule %s)%s", exec.name, tier, verdict.rule, sandboxMode === void 0 ? "" : ` [sandbox ${sandboxMode}]`);
+			if (agent !== void 0) {
+				const state = states.for(agent);
+				state.denials += 1;
+				state.lastDenial = verdict.rule;
+			}
+			return {
+				kind: "deny",
+				reason: verdict.reason
+			};
+		} catch (error) {
+			ctx.logger.error("dsh-autotier: guard malfunction (%o); forcing escalation and denying the call", error);
+			if (agent !== void 0) {
+				const state = states.for(agent);
+				const config = service.config();
+				const now = Date.now();
+				noteFailure(state, `guard|${String(error)}`, config, now);
+				state.escalation = {
+					count: config.escalation.threshold,
+					signature: `guard|${String(error)}`,
+					until: now + config.escalation.ttlMs,
+					rung: (state.escalation?.rung ?? 0) + 1,
+					lastAt: now
+				};
+			}
+			return {
+				kind: "deny",
+				reason: "dsh-autotier guard: the guard itself failed, so this call was denied. The session is escalated to the strong tier — re-run the call there."
+			};
+		}
+	}, { prepend: true });
+}
+//#endregion
+//#region src/intent.ts
+/** Compile the resolved rule table, ordered by descending priority. */
+function compileRules(rules) {
+	return rules.map((rule) => ({
+		id: rule.id,
+		patterns: rule.when.patterns.map((pattern) => new RegExp(pattern, "u")),
+		tools: rule.when.tools,
+		cwd: rule.when.cwd,
+		tier: rule.tier,
+		priority: rule.priority
+	})).sort((a, b) => b.priority - a.priority || a.id.localeCompare(b.id));
+}
+/**
+* Evaluate the declarative rule table. Rules are already sorted by descending
+* priority; the first match wins. A guard denial always outranks a rule (the
+* guard runs on `tools/pre-execute`, after the routing decision, and denies
+* regardless of tier).
+*
+* @param rules - compiled rules.
+* @param input - the live input facts.
+* @returns the winning hit, or null when no rule matches.
+*/
+function evaluateRules(rules, input) {
+	for (const rule of rules) {
+		if (rule.cwd !== "" && !input.cwd.startsWith(rule.cwd)) continue;
+		const toolHit = rule.tools.some((tool) => input.toolNames.includes(tool));
+		const patternHit = rule.patterns.some((pattern) => pattern.test(input.text));
+		if (rule.tools.length > 0 && rule.patterns.length > 0) {
+			if (!toolHit || !patternHit) continue;
+		} else if (rule.tools.length > 0) {
+			if (!toolHit) continue;
+		} else if (!patternHit) continue;
+		return {
+			id: rule.id,
+			tier: rule.tier
+		};
+	}
+	return null;
+}
+/** Which tier each scenario belongs to by default. */
+const SCENARIO_TIER = {
+	coding: "cheap",
+	review: "strong",
+	planning: "strong",
+	retrieval: "cheap",
+	batch: "cheap",
+	daily: "cheap",
+	longText: "strong",
+	multimodal: "strong"
+};
+/** Scenario evaluation order: specific/expensive first, `daily` last (tie-break order). */
+const SCENARIO_ORDER = [
+	"planning",
+	"review",
+	"coding",
+	"batch",
+	"retrieval",
+	"longText",
+	"multimodal",
+	"daily"
+];
+/**
+* Bilingual keyword tables. ASCII terms are matched with word boundaries
+* (case-insensitive); CJK terms are matched as substrings and a scenario needs
+* at least two distinct CJK hits before they count, so a single two-character
+* word cannot drag a turn into a scenario.
+*/
+const KEYWORDS = {
+	coding: [
+		"implement",
+		"refactor",
+		"fix",
+		"bug",
+		"test",
+		"function",
+		"class",
+		"endpoint",
+		"api",
+		"代码",
+		"实现",
+		"修复",
+		"重构",
+		"测试",
+		"函数",
+		"接口",
+		"编译",
+		"报错"
+	],
+	review: [
+		"review",
+		"audit",
+		"security",
+		"vulnerability",
+		"hardening",
+		"审查",
+		"审计",
+		"安全",
+		"漏洞",
+		"评审"
+	],
+	planning: [
+		"plan",
+		"design",
+		"architect",
+		"architecture",
+		"roadmap",
+		"migrate",
+		"migration",
+		"规划",
+		"设计",
+		"架构",
+		"方案",
+		"迁移"
+	],
+	retrieval: [
+		"where",
+		"find",
+		"search",
+		"locate",
+		"grep",
+		"查找",
+		"搜索",
+		"定位",
+		"在哪"
+	],
+	batch: [
+		"batch",
+		"bulk",
+		"every",
+		"rename",
+		"批量",
+		"全部",
+		"每个",
+		"遍历"
+	],
+	daily: [
+		"hello",
+		"hi",
+		"hey",
+		"thanks",
+		"thank",
+		"weather",
+		"你好",
+		"您好",
+		"谢谢",
+		"天气"
+	],
+	longText: [],
+	multimodal: []
+};
+/** Whole-string greetings classify as daily with high confidence. */
+const GREETING = /^(?:hi|hello|hey|thanks|thank you|你好|您好|谢谢|早上好|晚上好)[\s!.。,，!！]*$/iu;
+/** Explicit intent patterns that short-circuit keyword scoring. */
+const EXPLICIT = [
+	{
+		scenario: "planning",
+		confidence: .97,
+		pattern: /^(?:please\s+)?(?:plan|design|architect)\b/iu
+	},
+	{
+		scenario: "planning",
+		confidence: .95,
+		pattern: /(?:规划|架构设计|方案设计|技术方案|从零实现)/u
+	},
+	{
+		scenario: "review",
+		confidence: .96,
+		pattern: /\b(?:code review|review the|audit the|security review)\b/iu
+	},
+	{
+		scenario: "review",
+		confidence: .94,
+		pattern: /(?:代码审查|安全审计|评审一下)/u
+	},
+	{
+		scenario: "batch",
+		confidence: .95,
+		pattern: /\b(?:batch|bulk)\b/iu
+	},
+	{
+		scenario: "batch",
+		confidence: .94,
+		pattern: /(?:批量处理|批量修改|批量重命名)/u
+	}
+];
+/** Words that mark a multi-step or whole-system request. */
+const HARD_HINTS = [
+	"and then",
+	"step by step",
+	"multi-step",
+	"end to end",
+	"end-to-end",
+	"entire",
+	"all of",
+	"migrate",
+	"refactor",
+	"architecture",
+	"production",
+	"从零",
+	"完整",
+	"整个",
+	"多步",
+	"端到端",
+	"全流程"
+];
+/** Count non-overlapping occurrences of a fence marker. */
+function countFences(text) {
+	return (text.match(/```/gu) ?? []).length;
+}
+/** Count ASCII word-boundary hits, case-insensitive. */
+function asciiHits(text, term) {
+	const pattern = new RegExp(`\\b${term.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}\\b`, "giu");
+	return (text.match(pattern) ?? []).length;
+}
+/** Count CJK substring hits. */
+function cjkHits(text, term) {
+	let count = 0;
+	let index = text.indexOf(term);
+	while (index !== -1) {
+		count += 1;
+		index = text.indexOf(term, index + term.length);
+	}
+	return count;
+}
+/** Score one scenario against the text, applying the CJK co-occurrence rule. */
+function scoreScenario(text, scenario) {
+	let asciiScore = 0;
+	let cjkScore = 0;
+	let cjkTerms = 0;
+	for (const term of KEYWORDS[scenario]) {
+		const isAscii = /^[\x20-\x7E]+$/u.test(term);
+		const hits = isAscii ? asciiHits(text, term) : cjkHits(text, term);
+		if (hits === 0) continue;
+		const weight = term.length > 3 ? 2 : 1;
+		if (isAscii) asciiScore += hits * weight;
+		else {
+			cjkScore += hits * weight;
+			cjkTerms += 1;
+		}
+	}
+	return asciiScore + (cjkTerms >= 2 ? cjkScore : 0);
+}
+/** Compute the structural signal vector. */
+function computeSignals(input) {
+	const chars = input.text.length;
+	const estTokens = Math.ceil(chars / 4);
+	const tokenBands = [
+		4e3,
+		12e3,
+		3e4
+	].filter((band) => estTokens >= band).length;
+	const fences = countFences(input.text);
+	const toolCalls = input.toolNames.length;
+	const lower = input.text.toLowerCase();
+	const hardHints = HARD_HINTS.filter((hint) => lower.includes(hint)).length > 0 ? 1 : 0;
+	let score = tokenBands;
+	if (toolCalls >= 1) score += 1;
+	if (toolCalls >= 4) score += 1;
+	if (fences >= 1) score += 1;
+	if (fences >= 4) score += 1;
+	score += hardHints;
+	if (input.messageCount >= 12) score += 1;
+	if (input.messageCount >= 30) score += 1;
+	return {
+		chars,
+		estTokens,
+		tokenBands,
+		fences,
+		toolCalls,
+		messageCount: input.messageCount,
+		hardHints,
+		score
+	};
+}
+/** The token band index used in a fingerprint. */
+function tokenBand(estTokens) {
+	if (estTokens < 4e3) return 0;
+	if (estTokens < 12e3) return 1;
+	if (estTokens < 3e4) return 2;
+	return 3;
+}
+/** The fence band index used in a fingerprint. */
+function fenceBand(fences) {
+	if (fences === 0) return 0;
+	if (fences < 4) return 1;
+	return 2;
+}
+/** Build the fingerprint key for one classification. */
+function fingerprintOf(scenario, signals) {
+	return `${scenario}|${tokenBand(signals.estTokens)}|${fenceBand(signals.fences)}`;
+}
+/**
+* Classify one user input. Deterministic and token-free; the caller decides
+* whether the returned confidence warrants a judge call.
+*
+* @param input - the live input facts.
+* @param options - compiled rules and scenario switches.
+* @returns the verdict with its reasons.
+*/
+function classifyIntent(input, options) {
+	const signals = computeSignals(input);
+	const reasons = [];
+	const enabled = (scenario) => options.scenarios[scenario];
+	const finish = (scenario, confidence, shortCircuit, keywordScore) => {
+		const tier = signals.score >= (options.signalThreshold ?? 3) ? "strong" : SCENARIO_TIER[scenario];
+		if (signals.score >= (options.signalThreshold ?? 3) && SCENARIO_TIER[scenario] === "cheap") reasons.push(`structural signals (score ${String(signals.score)}) force the strong tier`);
+		return {
+			scenario,
+			tier,
+			confidence,
+			keywordScore,
+			signals,
+			reasons,
+			shortCircuit,
+			fingerprint: fingerprintOf(scenario, signals)
+		};
+	};
+	if (input.hasImage && enabled("multimodal")) {
+		reasons.push("the message carries an image");
+		return finish("multimodal", .98, "image", 0);
+	}
+	if (signals.chars > 12e3 && enabled("longText")) {
+		reasons.push(`long input (${String(signals.chars)} chars)`);
+		return finish("longText", .96, "long-text", 0);
+	}
+	if (GREETING.test(input.text.trim()) && enabled("daily")) {
+		reasons.push("whole-message greeting");
+		return finish("daily", .92, "greeting", 0);
+	}
+	for (const entry of EXPLICIT) if (enabled(entry.scenario) && entry.pattern.test(input.text)) {
+		reasons.push(`explicit ${entry.scenario} intent`);
+		return finish(entry.scenario, entry.confidence, "explicit", 0);
+	}
+	let best = {
+		scenario: "daily",
+		score: 0
+	};
+	for (const scenario of SCENARIO_ORDER) {
+		if (!enabled(scenario)) continue;
+		const score = scoreScenario(input.text, scenario);
+		if (score > best.score) best = {
+			scenario,
+			score
+		};
+	}
+	const keywordScore = best.score;
+	const scenario = keywordScore === 0 ? "daily" : best.scenario;
+	const confidence = keywordScore === 0 ? .25 : Math.min(.96, .52 + keywordScore * .1);
+	if (keywordScore > 0) reasons.push(`keyword score ${String(keywordScore)} for ${scenario}`);
+	else reasons.push("no keyword matched; defaulting to the cheap tier");
+	return finish(scenario, confidence, void 0, keywordScore);
+}
+/** Wilson score interval lower bound for `ok` successes in `n` trials. */
+function wilsonLowerBound(ok, n, z = 1.96) {
+	if (n <= 0) return 0;
+	const phat = ok / n;
+	const denom = 1 + z * z / n;
+	const centre = phat + z * z / (2 * n);
+	const margin = z * Math.sqrt((phat * (1 - phat) + z * z / (4 * n)) / n);
+	return Math.max(0, (centre - margin) / denom);
+}
+/**
+* Per-fingerprint win-rate posteriors. Labels come from terminal task outcomes
+* only (never from the router's own judge call), and every write decays old
+* counts once per half-life so a shape's reputation can recover.
+*/
+var PosteriorTable = class {
+	entries = /* @__PURE__ */ new Map();
+	halfLife;
+	coldStart;
+	epsilon;
+	capacity;
+	random;
+	/** @param options - tuning knobs; defaults match the design table. */
+	constructor(options = {}) {
+		this.halfLife = options.halfLife ?? 10;
+		this.coldStart = options.coldStart ?? 8;
+		this.epsilon = options.epsilon ?? .05;
+		this.capacity = options.capacity ?? 2e3;
+		this.random = options.random ?? Math.random;
+	}
+	/** Number of tracked fingerprints. */
+	get size() {
+		return this.entries.size;
+	}
+	/** Read one posterior without decaying it. */
+	get(key) {
+		return this.entries.get(key);
+	}
+	/** Record one terminal outcome for a fingerprint and tier. */
+	record(key, tier, ok, now) {
+		const existing = this.entries.get(key);
+		const base = existing ?? {
+			cheapOK: 0,
+			cheapN: 0,
+			strongOK: 0,
+			strongN: 0,
+			lastSeen: now,
+			observations: 0,
+			probeN: 0
+		};
+		if (existing !== void 0 && existing.observations > 0 && existing.observations % this.halfLife === 0) {
+			base.cheapOK /= 2;
+			base.cheapN /= 2;
+			base.strongOK /= 2;
+			base.strongN /= 2;
+		}
+		if (tier === "cheap") {
+			base.cheapN += 1;
+			if (ok) base.cheapOK += 1;
+		} else {
+			base.strongN += 1;
+			if (ok) base.strongOK += 1;
+		}
+		base.lastSeen = now;
+		base.observations += 1;
+		this.entries.delete(key);
+		this.entries.set(key, base);
+		while (this.entries.size > this.capacity) {
+			const oldest = this.entries.keys().next().value;
+			if (oldest === void 0) break;
+			this.entries.delete(oldest);
+		}
+	}
+	/** Count one exploration probe on a key. */
+	probe(key) {
+		const entry = this.entries.get(key);
+		if (entry !== void 0) entry.probeN += 1;
+	}
+	/**
+	* The table's opinion about one fingerprint, without the exploration roll.
+	* @param key - the fingerprint.
+	* @returns the base verdict and whether an exploration probe is warranted.
+	*/
+	opinion(key) {
+		const entry = this.entries.get(key);
+		if (entry === void 0) return {
+			verdict: null,
+			explore: false
+		};
+		if (entry.cheapN + entry.strongN < this.coldStart) return {
+			verdict: null,
+			explore: false
+		};
+		if (entry.cheapN === 0) return {
+			verdict: entry.strongN > 0 ? "strong" : null,
+			explore: false
+		};
+		return wilsonLowerBound(entry.cheapOK, entry.cheapN) > .5 ? {
+			verdict: "cheap",
+			explore: true
+		} : {
+			verdict: "strong",
+			explore: false
+		};
+	}
+	/**
+	* The table's opinion about one fingerprint. The exploration roll is a
+	* decision point, so callers take it once per user input and reuse the
+	* result for every step of that input's turn.
+	* @param key - the fingerprint.
+	* @returns `'strong'`, `'cheap'`, or `null` when the table abstains.
+	*/
+	verdict(key) {
+		const { verdict, explore } = this.opinion(key);
+		if (verdict === "cheap" && explore && this.random() < this.epsilon) {
+			this.probe(key);
+			return "strong";
+		}
+		return verdict;
+	}
+	/** Snapshot every key, newest first, for `/tier status` and diagnostics. */
+	snapshot() {
+		return [...this.entries.entries()].reverse().map(([key, posterior]) => ({
+			key,
+			posterior: { ...posterior }
+		}));
+	}
+};
+//#endregion
+//#region src/judge.ts
+/** The label vocabulary the judge is asked to choose from. */
+const JUDGE_LABELS = [
+	{
+		label: "coding",
+		scenario: "coding"
+	},
+	{
+		label: "review",
+		scenario: "review"
+	},
+	{
+		label: "planning",
+		scenario: "planning"
+	},
+	{
+		label: "retrieval",
+		scenario: "retrieval"
+	},
+	{
+		label: "batch",
+		scenario: "batch"
+	},
+	{
+		label: "daily",
+		scenario: "daily"
+	},
+	{
+		label: "longText",
+		scenario: "longText"
+	},
+	{
+		label: "multimodal",
+		scenario: "multimodal"
+	}
+];
+/** Which tier a judged scenario lands on. */
+const LABEL_TIER = {
+	coding: "cheap",
+	review: "strong",
+	planning: "strong",
+	retrieval: "cheap",
+	batch: "cheap",
+	daily: "cheap",
+	longText: "strong",
+	multimodal: "strong"
+};
+/**
+* Resolve the judge route: the configured model, else the first catalog model
+* whose id contains `flash` on the cheap tier's provider.
+* @param ctx - the plugin context (reads `ctx.llm`).
+* @param config - the resolved configuration.
+* @returns the route, or undefined when no candidate exists.
+*/
+async function resolveJudgeRoute(ctx, config) {
+	const provider = config.tiers.cheap.provider;
+	if (config.intent.judge.model !== "") return {
+		provider,
+		model: config.intent.judge.model
+	};
+	try {
+		const models = await ctx.llm.listModels(provider);
+		const flash = models.find((model) => model.id.toLowerCase().includes("flash"));
+		if (flash !== void 0) return {
+			provider,
+			model: flash.id
+		};
+		const first = models[0];
+		return first === void 0 ? void 0 : {
+			provider,
+			model: first.id
+		};
+	} catch {
+		return;
+	}
+}
+/** Extract the first label that appears in the judge's answer. */
+function parseJudgeLabel(answer) {
+	const text = answer.trim().toLowerCase();
+	if (text === "") return void 0;
+	for (const entry of JUDGE_LABELS) {
+		const label = entry.label.toLowerCase();
+		if (new RegExp(`(^|[^a-z])${label}([^a-z]|$)`, "u").test(text)) return entry.scenario;
+	}
+}
+/**
+* Run one judge call.
+* @param ctx - the plugin context (reads `ctx.llm`).
+* @param config - the resolved configuration.
+* @param text - the newest user message text.
+* @param signal - the turn's abort signal; the judge adds its own timeout.
+* @returns the outcome; a failure is reported, never thrown.
+*/
+async function runJudge(ctx, config, text, signal) {
+	const route = await resolveJudgeRoute(ctx, config);
+	if (route === void 0) return {
+		ok: false,
+		scenario: void 0,
+		tier: void 0,
+		detail: "no judge model available"
+	};
+	const prompt = [
+		"Classify the user request into exactly one label.",
+		`Labels: ${JUDGE_LABELS.map((entry) => entry.label).join(", ")}`,
+		"Reply with the label only, no punctuation or explanation.",
+		"",
+		`Request: ${text.slice(0, 2e3)}`
+	].join("\n");
+	const timeout = AbortSignal.timeout(config.intent.judge.timeoutMs);
+	const fused = AbortSignal.any([signal, timeout]);
+	const options = {
+		provider: route.provider,
+		model: route.model,
+		messages: [createUserMessage({
+			content: [{
+				type: "text",
+				text: prompt
+			}],
+			source: {
+				kind: "plugin",
+				plugin: "dsh-autotier"
+			}
+		})],
+		temperature: config.intent.judge.temperature,
+		maxTokens: config.intent.judge.maxTokens,
+		signal: fused
+	};
+	const assembler = new BlockAssembler();
+	try {
+		for await (const chunk of ctx.llm.stream(options)) assembler.push(chunk);
+	} catch (error) {
+		return {
+			ok: false,
+			scenario: void 0,
+			tier: void 0,
+			detail: timeout.aborted ? "judge timed out" : `judge failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	const finish = assembler.finish;
+	if (finish.kind === "error" || finish.kind === "aborted") return {
+		ok: false,
+		scenario: void 0,
+		tier: void 0,
+		detail: `judge stream ended with ${finish.kind}`
+	};
+	const scenario = parseJudgeLabel(assembler.blocks().filter((block) => block.type === "text").map((block) => block.text).join(" "));
+	if (scenario === void 0) return {
+		ok: false,
+		scenario: void 0,
+		tier: void 0,
+		detail: "judge answer carried no known label"
+	};
+	return {
+		ok: true,
+		scenario,
+		tier: LABEL_TIER[scenario],
+		detail: `judge chose ${scenario}`
+	};
+}
+//#endregion
+//#region src/routing.ts
+/** How long third parties have to veto a proposed tier before the turn proceeds. */
+const VETO_TIMEOUT_MS = 250;
+/** Extract the plain text of one message's content blocks. */
+function textOf(content) {
+	return content.filter((block) => block.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n");
+}
+/** The error code of a thrown value, when it carries one. */
+function codeOf(error) {
+	if (error !== null && typeof error === "object" && "code" in error && typeof error.code === "string") return error.code;
+	return "UNKNOWN";
+}
+/** Whether a classified intent is complex enough to open plan mode. */
+function shouldPlan(intent) {
+	if (intent.tier !== "strong") return false;
+	if (intent.scenario === "review") return false;
+	return intent.scenario === "planning" || intent.signals.score >= 3;
+}
+/** The router owns every autotier listener. */
+var AutotierRouter = class {
+	ctx;
+	service;
+	states;
+	pendingJudges = /* @__PURE__ */ new Set();
+	/** Per-session classifier counters, keyed by session so no agent registry is needed. */
+	counters = /* @__PURE__ */ new WeakMap();
+	/** Router-owned lifetime signal: aborts in-flight judge calls on unload. */
+	lifetime = new AbortController();
+	disposed = false;
+	/**
+	* Register every listener on the plugin fiber.
+	* @param options - the plugin context, the service and the state store.
+	*/
+	constructor(options) {
+		this.ctx = options.ctx;
+		this.service = options.service;
+		this.states = options.states;
+		this.ctx.on("agent/inbox/inserted", (payload) => this.onInboxInserted(payload.agent, payload.message), { prepend: true });
+		this.ctx.on("agent/request", (payload, next) => this.onRequest(payload.agent, payload.turn, payload.step, next), { prepend: true });
+		this.ctx.on("agent/error", (payload) => this.onAgentError(payload.agent, payload.error));
+		this.ctx.on("agent/request-error", (payload, next) => this.onRequestError(payload.agent, payload.provider, payload.failure, next));
+		this.ctx.on("session/event", (session, event) => this.onSessionEvent(session, event));
+		this.ctx.effect(() => () => {
+			this.disposed = true;
+			this.lifetime.abort();
+		});
+	}
+	/** Pending judge calls (diagnostics and tests). */
+	get judgeCallsInFlight() {
+		return this.pendingJudges.size;
+	}
+	/** The classifier input for one agent. */
+	inputFor(agent, text, hasImage) {
+		const counters = this.counterFor(agent.session);
+		return {
+			text,
+			toolNames: counters.toolNames,
+			hasImage,
+			messageCount: counters.messageCount,
+			cwd: agent.session.header.cwd ?? ""
+		};
+	}
+	/** The per-session classifier counters, created on first use. */
+	counterFor(session) {
+		let counters = this.counters.get(session);
+		if (counters === void 0) {
+			counters = {
+				toolNames: [],
+				messageCount: 0
+			};
+			this.counters.set(session, counters);
+		}
+		return counters;
+	}
+	/** The routing mode in force for one agent. */
+	modeFor(agent) {
+		return this.states.for(agent).override ?? this.service.config().routingMode;
+	}
+	/** Capture the newest user input, classify it, and start the judge when needed. */
+	onInboxInserted(agent, message) {
+		if (message.source?.kind !== "user") return;
+		const text = textOf(message.content ?? []);
+		const hasImage = (message.content ?? []).some((block) => block.type === "image");
+		const state = this.states.for(agent);
+		const config = this.service.config();
+		const input = this.inputFor(agent, text, hasImage);
+		state.input = input;
+		state.decision = classifyIntent(input, {
+			rules: this.service.rules(),
+			scenarios: config.intent.scenarios
+		});
+		state.verified = false;
+		state.probe = this.service.posteriors().verdict(state.decision.fingerprint) ?? void 0;
+		if (this.modeFor(agent) !== "auto") return;
+		const rule = evaluateRules(this.service.rules(), input);
+		if (shouldPlan(state.decision) && !state.planActive) this.enterPlanMode(agent);
+		if (judgeNeeded(config, state, state.decision, rule, Date.now())) this.startJudge(agent, config, text, state.decision);
+	}
+	/** Fire the judge without blocking the emit dispatch. */
+	startJudge(agent, config, text, local) {
+		const state = this.states.for(agent);
+		state.judge.lastCall = Date.now();
+		const signal = this.lifetime.signal;
+		const generation = local;
+		const task = runJudge(this.ctx, config, text, signal).then((outcome) => {
+			if (this.disposed) return;
+			noteJudgeCall(state, Date.now(), outcome.ok);
+			if (state.decision !== generation) return;
+			if (!outcome.ok || outcome.tier === void 0 || outcome.scenario === void 0) {
+				this.ctx.logger.debug("dsh-autotier: judge abstained (%s); keeping the local verdict", outcome.detail);
+				return;
+			}
+			state.decision = {
+				...local,
+				scenario: outcome.scenario,
+				tier: outcome.tier,
+				confidence: .75,
+				reasons: [...local.reasons, outcome.detail]
+			};
+		}).catch((error) => {
+			if (this.disposed) return;
+			noteJudgeCall(state, Date.now(), false);
+			this.ctx.logger.warn("dsh-autotier: judge call failed: %o", error);
+		}).finally(() => {
+			this.pendingJudges.delete(task);
+		});
+		this.pendingJudges.add(task);
+	}
+	/** Open plan mode through the service, or through the log when it is absent. */
+	enterPlanMode(agent) {
+		const planMode = this.ctx.get("planMode");
+		const state = this.states.for(agent);
+		if (planMode !== void 0) try {
+			const outcome = planMode.set(agent, true);
+			if (outcome !== "noop") {
+				state.planActive = true;
+				this.ctx.logger.info("dsh-autotier: plan mode %s for a complex instruction", outcome);
+			}
+			return;
+		} catch (error) {
+			this.ctx.logger.warn("dsh-autotier: planMode.set failed (%o); falling back to the session log", error);
+		}
+		try {
+			agent.session.append("plan/mode", { active: true });
+			state.planActive = true;
+		} catch (error) {
+			this.ctx.logger.warn("dsh-autotier: could not open plan mode (%o)", error);
+		}
+	}
+	/**
+	* Offer the proposal to third parties on the `autotier/route` serial event.
+	* A listener failure is contained, and a listener that never settles cannot
+	* stall the turn: the race resolves with our own decision after the timeout.
+	* The timer is owned by `ctx.effect`, so unloading clears it (no HMR leak).
+	*/
+	async serialVeto(proposal) {
+		const deadline = new Promise((resolve) => {
+			this.ctx.effect(() => {
+				const timer = setTimeout(() => {
+					resolve(void 0);
+				}, VETO_TIMEOUT_MS);
+				return () => {
+					clearTimeout(timer);
+				};
+			});
+		});
+		const offered = this.ctx.serial("autotier/route", proposal).catch((error) => {
+			this.ctx.logger.warn("dsh-autotier: autotier/route listener failed: %o", error);
+		});
+		return Promise.race([offered, deadline]);
+	}
+	/** The tier landing for one tier, resolving the vision override, an active
+	* fallback record, and the effort-first escalation ladder.
+	*
+	* The ladder is the point of escalation: raise the current model's effort one
+	* step at a time (the KV prefix survives and the official notice stays quiet
+	* for an effort-only change) before paying for a model switch. `rung` counts
+	* how many times escalation has triggered for this agent, so repeated failures
+	* walk the ladder instead of jumping to the strongest landing.
+	*/
+	routeFor(tier, config, intent, state, now, base) {
+		if (intent?.signals !== void 0 && intent.shortCircuit === "image") {
+			const vision = config.tiers.vision;
+			return {
+				provider: vision.provider,
+				model: vision.model
+			};
+		}
+		const entry = tier === "strong" ? config.tiers.strong : config.tiers.cheap;
+		if (state.fallback !== void 0 && state.fallback.tier === tier && state.fallback.until > now) {
+			const chainEntry = entry.fallback[state.fallback.index];
+			if (chainEntry !== void 0) {
+				const floor = entry.followSession && base?.reasoningEffort !== void 0 ? void 0 : entry.effort;
+				return floor === void 0 ? {
+					provider: chainEntry.provider,
+					model: chainEntry.model
+				} : {
+					provider: chainEntry.provider,
+					model: chainEntry.model,
+					effort: floor
+				};
+			}
+		}
+		if (tier === "strong" && state.escalation !== void 0 && state.escalation.until > now) {
+			const cheapLanding = this.tierRoute("cheap", config);
+			const ladder = escalationLadder(cheapLanding, cheapLanding, this.tierRoute("strong", config));
+			let index = Math.min(Math.max(state.escalation.rung - 1, 0), Math.max(ladder.length - 1, 0));
+			const currentRank = effortRank(base?.reasoningEffort ?? cheapLanding.effort ?? "low");
+			while (index < ladder.length - 1) {
+				const candidate = ladder[index];
+				if ((candidate?.route.effort === void 0 ? EFFORT_LADDER.length : effortRank(candidate.route.effort)) >= currentRank) break;
+				index += 1;
+			}
+			const rung = ladder[index];
+			if (rung !== void 0) return rung.route;
+		}
+		return this.tierRoute(tier, config, base);
+	}
+	/**
+	* The configured landing of one tier. `followSession` means the session's own
+	* effort wins when it has one; when it has none, the tier's configured effort
+	* is the floor (an omitted effort would fall through to the adapter default,
+	* which is the strongest level).
+	*/
+	tierRoute(tier, config, base) {
+		const entry = tier === "strong" ? config.tiers.strong : config.tiers.cheap;
+		if (!entry.followSession) return {
+			provider: entry.provider,
+			model: entry.model,
+			effort: entry.effort
+		};
+		if (base?.reasoningEffort === void 0 && entry.effort !== void 0) return {
+			provider: entry.provider,
+			model: entry.model,
+			effort: entry.effort
+		};
+		return {
+			provider: entry.provider,
+			model: entry.model
+		};
+	}
+	/** Resolve the tier for this step and apply it to the proposed configuration. */
+	async onRequest(agent, turn, step, next) {
+		const base = await next();
+		try {
+			return await this.routeRequest(agent, turn, step, base);
+		} catch (error) {
+			this.ctx.logger.error("dsh-autotier: routing failed, using the session configuration: %o", error);
+			return base;
+		}
+	}
+	/** The routing body, separated so one try/catch guards the whole seam. */
+	async routeRequest(agent, turn, step, base) {
+		const mode = this.modeFor(agent);
+		if (mode === "off" || mode === "delegated") return base;
+		const state = this.states.for(agent);
+		const config = this.service.config();
+		const now = Date.now();
+		clearExpiredEscalation(state, now);
+		const intent = state.decision;
+		if (intent === void 0) return base;
+		let decision = decideTier({
+			config,
+			state,
+			intent,
+			rule: state.input === void 0 ? null : evaluateRules(this.service.rules(), state.input),
+			override: state.override,
+			now
+		});
+		if ((decision.source === "judge" || decision.source === "default") && attemptBandApplies(config, intent) && !state.verified && !escalationActive(state, now)) decision = {
+			tier: "cheap",
+			source: "default",
+			reason: `${intent.reasons.join("; ")}; attempt-first band`,
+			confidence: intent.confidence
+		};
+		if (state.reviewOwedFor !== void 0 && state.reviewOwedFor === intent.fingerprint && !state.verified) {
+			state.verified = true;
+			state.reviewOwedFor = void 0;
+			decision = {
+				tier: "strong",
+				source: "escalation",
+				reason: "attempt-first strong review",
+				confidence: 1
+			};
+		}
+		const proposal = {
+			agent,
+			turn,
+			step,
+			tier: decision.tier,
+			source: decision.source,
+			reason: decision.reason,
+			confidence: decision.confidence
+		};
+		const veto = await this.serialVeto(proposal);
+		const tier = veto?.tier ?? decision.tier;
+		const source = veto === void 0 || veto === null ? decision.source : "manual";
+		const reason = veto === void 0 || veto === null ? decision.reason : `veto: ${veto.reason}`;
+		const route = this.routeFor(tier, config, intent, state, now, base);
+		const applied = resolveRoute(base, route);
+		if (state.appliedTier !== tier) {
+			const from = state.appliedTier;
+			state.appliedTier = tier;
+			state.appliedSource = source;
+			this.ctx.emit("autotier/tier-changed", {
+				agent,
+				from,
+				to: tier,
+				source,
+				reason,
+				route
+			});
+		} else state.appliedSource = source;
+		this.ctx.logger.debug("dsh-autotier: turn=%d step=%d tier=%s source=%s (%s)", turn, step, tier, source, reason);
+		return applied;
+	}
+	/** Count failures and escalate on the configured signature recurrence. */
+	onAgentError(agent, error) {
+		const mode = this.modeFor(agent);
+		if (mode === "off" || mode === "delegated") return;
+		const state = this.states.for(agent);
+		const config = this.service.config();
+		const signature = `${codeOf(error)}|${state.decision?.fingerprint ?? ""}`;
+		const now = Date.now();
+		if (state.decision !== void 0 && attemptBandApplies(config, state.decision) && !state.verified) state.reviewOwedFor = state.decision.fingerprint;
+		const alreadyEscalated = escalationActive(state, now);
+		if ((state.appliedTier ?? "cheap") !== "cheap" && !alreadyEscalated) return;
+		if (noteFailure(state, signature, config, now) && !alreadyEscalated) {
+			const tier = this.routeFor("strong", config, state.decision, state, now);
+			this.ctx.logger.warn("dsh-autotier: escalating after %d recurring failure(s) (%s) -> %s/%s", state.escalation?.count ?? 0, signature, tier.provider, tier.model);
+			this.ctx.emit("autotier/tier-changed", {
+				agent,
+				from: state.appliedTier,
+				to: "strong",
+				source: "escalation",
+				reason: signature,
+				route: tier
+			});
+		}
+		if (state.decision !== void 0) this.service.posteriors().record(state.decision.fingerprint, state.appliedTier ?? "cheap", false, now);
+	}
+	/**
+	* Walk the tier's fallback chain. Permanent codes switch immediately;
+	* transient codes wait for `dsh-llm-retry` to exhaust its own retries first
+	* (this listener is registered after it on purpose).
+	*/
+	async onRequestError(agent, provider, failure, next) {
+		const mode = this.modeFor(agent);
+		if (mode === "off" || mode === "delegated") return next();
+		const config = this.service.config();
+		const verdict = classifyFallback(failure);
+		if (verdict === "ignore" || verdict === "unknown") return next();
+		const state = this.states.for(agent);
+		const tier = escalationActive(state, Date.now()) ? "strong" : state.appliedTier ?? "cheap";
+		const chain = tier === "strong" ? config.tiers.strong.fallback : config.tiers.cheap.fallback;
+		if (chain.length === 0) return next();
+		if (verdict === "transient") {
+			const downstream = await next();
+			if (downstream !== void 0) return downstream;
+		}
+		const now = Date.now();
+		if (noteFallback(state, tier, chain.length, config, now)) {
+			this.ctx.logger.warn("dsh-autotier: provider \"%s\" failed with %s; switching to fallback entry %d of the %s tier", provider, String(typeof failure.code === "string" ? failure.code : `status ${String(failure.status ?? "?")}`), (state.fallback?.index ?? 0) + 1, tier);
+			return { kind: "retry" };
+		}
+		return next();
+	}
+	/** Maintain the classifier counters and the plan-mode fallback fold. */
+	onSessionEvent(session, event) {
+		const counters = this.counterFor(session);
+		if (event.type === "user/message") {
+			counters.messageCount += 1;
+			return;
+		}
+		if (event.type === "tool/call") {
+			const name = event.data.name;
+			if (typeof name === "string" && !counters.toolNames.includes(name)) counters.toolNames.push(name);
+			return;
+		}
+		if (event.type === "plan/mode") {
+			const agent = this.agentOf(session);
+			if (agent !== void 0) this.states.for(agent).planActive = event.data.active === true;
+			return;
+		}
+		if (event.type === "turn/end") {
+			const reason = event.data.reason?.kind;
+			const agent = this.agentOf(session);
+			if (agent === void 0) return;
+			const state = this.states.for(agent);
+			if (reason === "completed" && state.decision !== void 0) this.service.posteriors().record(state.decision.fingerprint, state.appliedTier ?? "cheap", true, Date.now());
+		}
+	}
+	/** Resolve the agent that owns one session, when the registry is reachable. */
+	agentOf(session) {
+		const agents = this.ctx.get("agents");
+		if (agents === void 0) return void 0;
+		try {
+			return agents.get(session.id);
+		} catch {
+			return;
+		}
+	}
+};
+//#endregion
+//#region src/service.ts
+/**
+* `ctx.autotier`: the Service Provider for autotier's public read surface. The
+* service owns the live resolved configuration, the compiled rule table and the
+* fingerprint posteriors, and serves the status snapshot that `/tier status`,
+* the `tier_status` tool and any third-party consumer read. Routing decisions
+* themselves live in `policy.ts`/`routing.ts`; this class is the stable contract
+* other plugins may depend on.
+* @module dsh-autotier/service
+*/
+/** Project one resolved tier config onto the public route shape. */
+function routeOf(tier) {
+	if (tier.followSession) return {
+		provider: tier.provider,
+		model: tier.model
+	};
+	return {
+		provider: tier.provider,
+		model: tier.model,
+		effort: tier.effort
+	};
+}
+/**
+* Service Provider for `ctx.autotier`. Registration rides the owning fiber: the
+* plugin unloading removes the service with every listener it owns.
+*/
+var AutotierService = class extends Service {
+	scope;
+	posteriorTable = new PosteriorTable();
+	resolved;
+	compiled;
+	/**
+	* Register the service as `ctx.autotier` and start following the settings
+	* namespace.
+	* @param ctx - the owning plugin context.
+	* @param options - the live settings scope and the mount-time configuration.
+	*/
+	constructor(ctx, options) {
+		super(ctx, "autotier");
+		this.scope = options.scope;
+		this.resolved = options.config;
+		this.compiled = compileRules(options.config.intent.rules);
+		ctx.effect(() => this.scope.watch((next) => {
+			this.resolved = resolveConfig(next);
+			this.compiled = compileRules(this.resolved.intent.rules);
+		}));
+	}
+	/** The live resolved configuration. */
+	config() {
+		return this.resolved;
+	}
+	/** The compiled declarative rule table, ordered by descending priority. */
+	rules() {
+		return this.compiled;
+	}
+	/** The per-fingerprint win-rate posteriors. */
+	posteriors() {
+		return this.posteriorTable;
+	}
+	/**
+	* The registered provider/model catalog, as the minimal serializable subset a
+	* configuration UI needs. Never hardcoded: it reads the live `ctx.llm`
+	* registry, so a model the adapter does not advertise cannot be selected.
+	* @returns one entry per registered provider with its models.
+	*/
+	async catalog() {
+		const entries = [];
+		for (const provider of this.ctx.llm.listProviders()) {
+			let models = [];
+			try {
+				models = await this.ctx.llm.listModels(provider.id);
+			} catch {
+				models = [];
+			}
+			entries.push({
+				provider: provider.id,
+				models: models.map((model) => ({
+					id: model.id,
+					name: model.name,
+					inputModalities: model.inputModalities ?? ["text"]
+				}))
+			});
+		}
+		return entries;
+	}
+	/** Read-only status snapshot. */
+	status() {
+		const config = this.resolved;
+		return {
+			mode: config.routingMode,
+			tiers: {
+				strong: routeOf(config.tiers.strong),
+				cheap: routeOf(config.tiers.cheap),
+				vision: {
+					provider: config.tiers.vision.provider,
+					model: config.tiers.vision.model
+				}
+			},
+			guard: {
+				enabled: config.guard.enabled,
+				tiers: config.guard.tiers
+			},
+			escalation: {
+				threshold: config.escalation.threshold,
+				windowMs: config.escalation.windowMs,
+				ttlMs: config.escalation.ttlMs,
+				fallbackTtlMs: config.escalation.fallbackTtlMs,
+				signature: config.escalation.signature
+			}
+		};
+	}
+};
+//#endregion
+//#region src/state.ts
+/** The projection key autotier owns. */
+const TIER_PROJECTION_KEY = "autotier";
+/** Minimal zod-compatible schemas for the projection state and wire view. */
+const projectionSchema = { parse(value) {
+	const record = value ?? {};
+	return {
+		provider: typeof record.provider === "string" ? record.provider : "",
+		model: typeof record.model === "string" ? record.model : "",
+		effort: typeof record.effort === "string" ? record.effort : "",
+		plan: record.plan === true
+	};
+} };
+/**
+* Register the tier projection when the registry is composed.
+* @param ctx - the plugin context; the registration rides its fiber.
+* @returns the registration disposer, or undefined when the registry is absent.
+*/
+function registerTierProjection(ctx) {
+	const registry = ctx.get("sessionProjections");
+	if (registry === void 0) {
+		ctx.logger.warn("dsh-autotier: sessionProjections is absent; the replayable tier projection is disabled");
+		return;
+	}
+	return registry.register({
+		key: TIER_PROJECTION_KEY,
+		stateVersion: 1,
+		stateSchema: projectionSchema,
+		init: () => ({
+			provider: "",
+			model: "",
+			effort: "",
+			plan: false
+		}),
+		apply: (state, event) => {
+			if (event.type === "plan/mode") {
+				const plan = event.data.active === true;
+				return plan === state.plan ? state : {
+					...state,
+					plan
+				};
+			}
+			if (event.type !== "request/header") return state;
+			const config = event.data.header?.config;
+			if (config === void 0) return state;
+			const next = {
+				provider: typeof config.provider === "string" ? config.provider : "",
+				model: typeof config.model === "string" ? config.model : "",
+				effort: typeof config.reasoningEffort === "string" ? config.reasoningEffort : "",
+				plan: state.plan
+			};
+			return next.provider === state.provider && next.model === state.model && next.effort === state.effort && next.plan === state.plan ? state : next;
+		},
+		wire: {
+			viewSchema: projectionSchema,
+			view: (state) => state
+		}
+	});
+}
+/** The per-agent runtime state store. */
+var AgentStateStore = class {
+	states = /* @__PURE__ */ new WeakMap();
+	/** The state for one agent, created on first use. */
+	for(agent) {
+		let state = this.states.get(agent);
+		if (state === void 0) {
+			state = createRouteState();
+			this.states.set(agent, state);
+		}
+		return state;
+	}
+	/** Whether one agent already has state (diagnostics). */
+	has(agent) {
+		return this.states.has(agent);
+	}
+};
+//#endregion
+//#region src/tools.ts
+/** Render one canonical value as a single text block. */
+function textBlock(value) {
+	return [{
+		type: "text",
+		text: typeof value === "string" ? value : JSON.stringify(value, null, 2)
+	}];
+}
+/** Build the `tier_status` tool. */
+function tierStatusTool({ service, states }) {
+	return defineTool({
+		name: "tier_status",
+		description: "Report the live dsh-autotier routing state: the configured tier landings, the effective mode for this session, the last intent classification, and whether a failure escalation or fallback is in force. Read-only.",
+		parameters: {},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					mode: { type: "string" },
+					strong: { type: "string" },
+					cheap: { type: "string" },
+					vision: { type: "string" },
+					guardEnabled: { type: "boolean" },
+					appliedTier: { type: "string" },
+					lastScenario: { type: "string" },
+					lastConfidence: { type: "number" },
+					escalated: { type: "boolean" },
+					planActive: { type: "boolean" },
+					guardDenials: { type: "integer" },
+					lastDenialRule: { type: "string" }
+				}
+			},
+			render: (_args, value) => textBlock(value)
+		},
+		execute: async (_args, exec) => {
+			const agent = exec.agent;
+			const state = agent === void 0 ? void 0 : states.for(agent);
+			const status = service.status();
+			return {
+				mode: state?.override ?? status.mode,
+				strong: `${status.tiers.strong.provider}/${status.tiers.strong.model}${status.tiers.strong.effort === void 0 ? "" : `@${status.tiers.strong.effort}`}`,
+				cheap: `${status.tiers.cheap.provider}/${status.tiers.cheap.model}${status.tiers.cheap.effort === void 0 ? "" : `@${status.tiers.cheap.effort}`}`,
+				vision: `${status.tiers.vision.provider}/${status.tiers.vision.model}`,
+				guardEnabled: status.guard.enabled,
+				appliedTier: state?.appliedTier ?? "",
+				lastScenario: state?.decision?.scenario ?? "",
+				lastConfidence: state?.decision?.confidence ?? 0,
+				escalated: state === void 0 ? false : escalationActive(state, Date.now()),
+				planActive: state?.planActive ?? false,
+				guardDenials: state?.denials ?? 0,
+				lastDenialRule: state?.lastDenial ?? ""
+			};
+		}
+	});
+}
+/** Build the `tier_route` tool. */
+function tierRouteTool({ service }) {
+	return defineTool({
+		name: "tier_route",
+		description: "Dry-run the intent classifier on one instruction and report which tier it would use, without sending a model request. Read-only.",
+		parameters: { text: {
+			type: "string",
+			description: "The instruction to classify.",
+			required: true
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					tier: { type: "string" },
+					scenario: { type: "string" },
+					confidence: { type: "number" },
+					fingerprint: { type: "string" },
+					reason: { type: "string" }
+				}
+			},
+			render: (_args, value) => textBlock(value)
+		},
+		execute: async (args) => {
+			const config = service.config();
+			const result = classifyIntent({
+				text: args.text,
+				toolNames: [],
+				hasImage: false,
+				messageCount: 0,
+				cwd: ""
+			}, {
+				rules: service.rules(),
+				scenarios: config.intent.scenarios
+			});
+			return {
+				tier: result.tier,
+				scenario: result.scenario,
+				confidence: result.confidence,
+				fingerprint: result.fingerprint,
+				reason: result.reasons.join("; ")
+			};
+		}
+	});
+}
+/**
+* Register both tools on the plugin fiber.
+* @param ctx - the plugin context (must have `tools`).
+* @param services - the service and the state store.
+*/
+function registerTierTools(ctx, services) {
+	ctx.tools.register(tierStatusTool(services));
+	ctx.tools.register(tierRouteTool(services));
+}
+//#endregion
+//#region src/index.ts
+/** The cordis.yml row id and the plugin name must match. */
+const name = "dsh-autotier";
+/**
+* Hard service dependencies. `sessions` is plural — the service name really is
+* `sessions` (`packages/core/session/src/index.ts` registers `super(ctx,
+* 'sessions')`); declaring a non-existent name would leave this plugin PENDING
+* forever. Every other capability (`agents`, `subagents`, `systemPrompt`,
+* `planMode`, `sessionProjections`, `sandboxPolicy`) is read with `ctx.get()`
+* and degrades when absent.
+*/
+const inject = [
+	"settings",
+	"llm",
+	"tools",
+	"commands",
+	"sessions"
+];
+/**
+* Mount the plugin: judge the configuration, register the `autotier` settings
+* namespace, publish the `ctx.autotier` service, and wire the routing listeners,
+* the `/tier` command and the two read-only tools.
+*
+* @param ctx - the plugin context.
+* @param config - the raw row configuration; every field is optional.
+* @throws {Error} when the configuration fails the cross-field judgement.
+*/
+function apply(ctx, config = {}) {
+	const resolved = resolveConfig(config);
+	const service = new AutotierService(ctx, {
+		scope: ctx.settings.register("autotier", Config, {
+			base: config,
+			applies: "live",
+			validate: (value) => {
+				validateConfig(value);
+			}
+		}),
+		config: resolved
+	});
+	registerTierProjection(ctx);
+	const states = new AgentStateStore();
+	new AutotierRouter({
+		ctx,
+		service,
+		states
+	});
+	registerGuardHook({
+		ctx,
+		service,
+		states
+	});
+	registerTierCommand(ctx, service, states);
+	registerTierTools(ctx, {
+		service,
+		states
+	});
+	if (resolved.guard.interopDefend === "auto") ctx.logger.info("dsh-autotier: guard runs alongside dsh-defend when installed (guard.interopDefend=auto)");
+	const status = service.status();
+	ctx.logger.info("dsh-autotier: mode=%s strong=%s/%s cheap=%s/%s guard=%s", status.mode, status.tiers.strong.provider, status.tiers.strong.model, status.tiers.cheap.provider, status.tiers.cheap.model, status.guard.enabled ? "on" : "off");
+}
+//#endregion
+export { AgentStateStore, AutotierRouter, AutotierService, Config, EFFORT_IDS, HIGH_IMPACT_COMMAND_RULES, HIGH_IMPACT_PATH_RULES, JUDGE_LABELS, PosteriorTable, ROUTING_MODES, SCENARIOS, TIER_IDS, TIER_PROJECTION_KEY, advanceFallback, apply, attemptBandApplies, classifyFallback, classifyIntent, compileRules, computeSignals, createRouteState, decideTier, effortRank, escalationActive, escalationLadder, evaluateRules, evaluateToolCall, fallbackActive, fingerprintOf, inject, isCredentialPath, judgeNeeded, matchCommand, matchPath, name, nextEffortStep, noteFailure, noteFallback, noteJudgeCall, parseJudgeLabel, redactSnippet, registerGuardHook, registerTierProjection, resolveConfig, resolveJudgeRoute, resolveRoute, routeEquals, runJudge, validateConfig, wilsonLowerBound };