dsh-plugin-coding-delegate 0.0.0-stage → 0.2.2

package/dist/index.js

@@ -0,0 +1,1398 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInProcessFallback = exports.resolveVerificationTimeoutMs = exports.redactVerificationOutput = exports.parseTestOutput = exports.evaluateVerificationPolicy = exports.describeFailures = exports.commandProgram = exports.DEFAULT_VERIFICATION_TIMEOUT_MS = exports.DEFAULT_VERIFICATION_POLICY = exports.sha256File = exports.saveDelegatedRegistry = exports.resolveDelegatedRegistryPath = exports.resolveContractFiles = exports.recordOperatorAttestation = exports.rememberDelegated = exports.pruneDelegatedRecords = exports.parseDelegatedRegistry = exports.mergeDelegatedRecords = exports.loadDelegatedRegistry = exports.contractViolations = exports.contractFileHashes = exports.resolveContextFiles = exports.DEFAULT_CONTEXT_MAX_BYTES = exports.roleFromLineage = exports.roleForAgent = exports.resolveLeadProviders = exports.resolveAgentRole = exports.resetAgentRoles = exports.rememberAgentRole = exports.evaluateSourceEgress = exports.detectSourceEgress = exports.describeSourceRead = exports.applyArchitectConfig = exports.applyAgentRole = exports.agentLineageRole = exports.DEFAULT_SOURCE_EGRESS_MIN_LINES = exports.AGENT_ROLE_LIMIT = exports.hasCommandWriteSignal = exports.hasCommandDeleteSignal = exports.evaluateDelegatedReadPolicy = exports.evaluateCodeWriteGuard = exports.DELETE_PRIMITIVES = exports.extractAndEmitFiles = exports.evaluateUnitScope = exports.evaluateEmissionPath = exports.isPathWithin = exports.trace = exports.resolveDataDir = exports.SavingsTracker = exports.PROFILES = void 0;
+exports.LocalRouter = exports.name = exports.using = exports.inject = exports.retryContextRequests = exports.parseFailureLocations = exports.RETRY_CONTEXT_WINDOW_LINES = exports.resolveVerificationRepeats = exports.resolveDelegateStatus = exports.resolveChatCompletionsUrl = exports.parseSearchReplaceBlocks = exports.extractPromptText = exports.estimateTokenCount = exports.delegateWorker = exports.applySearchReplaceBlocks = exports.MIN_SEARCH_CHARS = exports.DEFAULT_LOCAL_ENDPOINT = exports.DELEGATE_WORKER_SCHEMA_COVERS_EVERY_PARAMETER = exports.DELEGATE_WORKER_SCHEMA = exports.DELEGATE_WORKER_OPENAI_SCHEMA = exports.foldContextQuality = exports.describeContextQuality = exports.EMPTY_CONTEXT_QUALITY = exports.runSandboxVerification = void 0;
+exports.scanDLP = scanDLP;
+exports.requestApprovalForWrite = requestApprovalForWrite;
+exports.resolveVerificationPolicy = resolveVerificationPolicy;
+exports.requestApprovalForVerification = requestApprovalForVerification;
+exports.requestApprovalForWorkspace = requestApprovalForWorkspace;
+exports.apply = apply;
+const fs = __importStar(require("fs"));
+const savings_tracker_1 = require("./savings-tracker");
+Object.defineProperty(exports, "SavingsTracker", { enumerable: true, get: function () { return savings_tracker_1.SavingsTracker; } });
+const profiles_1 = require("./profiles");
+Object.defineProperty(exports, "PROFILES", { enumerable: true, get: function () { return profiles_1.PROFILES; } });
+const local_classifier_1 = require("./local-classifier");
+const logging_1 = require("./logging");
+const paths_1 = require("./paths");
+const declaration_egress_hook_1 = require("./declaration-egress-hook");
+const containment_1 = require("./containment");
+const routing_1 = require("./routing");
+const attestation_1 = require("./attestation");
+const emission_1 = require("./emission");
+const verification_1 = require("./verification");
+const context_1 = require("./context");
+const guard_1 = require("./guard");
+const roles_1 = require("./roles");
+const delegation_1 = require("./delegation");
+const contracts_1 = require("./contracts");
+const context_quality_1 = require("./context-quality");
+const session_events_1 = require("./session-events");
+const host_events_1 = require("./host-events");
+var logging_2 = require("./logging");
+Object.defineProperty(exports, "resolveDataDir", { enumerable: true, get: function () { return logging_2.resolveDataDir; } });
+Object.defineProperty(exports, "trace", { enumerable: true, get: function () { return logging_2.trace; } });
+var paths_2 = require("./paths");
+Object.defineProperty(exports, "isPathWithin", { enumerable: true, get: function () { return paths_2.isPathWithin; } });
+var emission_2 = require("./emission");
+Object.defineProperty(exports, "evaluateEmissionPath", { enumerable: true, get: function () { return emission_2.evaluateEmissionPath; } });
+Object.defineProperty(exports, "evaluateUnitScope", { enumerable: true, get: function () { return emission_2.evaluateUnitScope; } });
+Object.defineProperty(exports, "extractAndEmitFiles", { enumerable: true, get: function () { return emission_2.extractAndEmitFiles; } });
+var guard_2 = require("./guard");
+Object.defineProperty(exports, "DELETE_PRIMITIVES", { enumerable: true, get: function () { return guard_2.DELETE_PRIMITIVES; } });
+Object.defineProperty(exports, "evaluateCodeWriteGuard", { enumerable: true, get: function () { return guard_2.evaluateCodeWriteGuard; } });
+Object.defineProperty(exports, "evaluateDelegatedReadPolicy", { enumerable: true, get: function () { return guard_2.evaluateDelegatedReadPolicy; } });
+Object.defineProperty(exports, "hasCommandDeleteSignal", { enumerable: true, get: function () { return guard_2.hasCommandDeleteSignal; } });
+Object.defineProperty(exports, "hasCommandWriteSignal", { enumerable: true, get: function () { return guard_2.hasCommandWriteSignal; } });
+var roles_2 = require("./roles");
+Object.defineProperty(exports, "AGENT_ROLE_LIMIT", { enumerable: true, get: function () { return roles_2.AGENT_ROLE_LIMIT; } });
+Object.defineProperty(exports, "DEFAULT_SOURCE_EGRESS_MIN_LINES", { enumerable: true, get: function () { return roles_2.DEFAULT_SOURCE_EGRESS_MIN_LINES; } });
+Object.defineProperty(exports, "agentLineageRole", { enumerable: true, get: function () { return roles_2.agentLineageRole; } });
+Object.defineProperty(exports, "applyAgentRole", { enumerable: true, get: function () { return roles_2.applyAgentRole; } });
+Object.defineProperty(exports, "applyArchitectConfig", { enumerable: true, get: function () { return roles_2.applyArchitectConfig; } });
+Object.defineProperty(exports, "describeSourceRead", { enumerable: true, get: function () { return roles_2.describeSourceRead; } });
+Object.defineProperty(exports, "detectSourceEgress", { enumerable: true, get: function () { return roles_2.detectSourceEgress; } });
+Object.defineProperty(exports, "evaluateSourceEgress", { enumerable: true, get: function () { return roles_2.evaluateSourceEgress; } });
+Object.defineProperty(exports, "rememberAgentRole", { enumerable: true, get: function () { return roles_2.rememberAgentRole; } });
+Object.defineProperty(exports, "resetAgentRoles", { enumerable: true, get: function () { return roles_2.resetAgentRoles; } });
+Object.defineProperty(exports, "resolveAgentRole", { enumerable: true, get: function () { return roles_2.resolveAgentRole; } });
+Object.defineProperty(exports, "resolveLeadProviders", { enumerable: true, get: function () { return roles_2.resolveLeadProviders; } });
+Object.defineProperty(exports, "roleForAgent", { enumerable: true, get: function () { return roles_2.roleForAgent; } });
+Object.defineProperty(exports, "roleFromLineage", { enumerable: true, get: function () { return roles_2.roleFromLineage; } });
+var context_2 = require("./context");
+Object.defineProperty(exports, "DEFAULT_CONTEXT_MAX_BYTES", { enumerable: true, get: function () { return context_2.DEFAULT_CONTEXT_MAX_BYTES; } });
+Object.defineProperty(exports, "resolveContextFiles", { enumerable: true, get: function () { return context_2.resolveContextFiles; } });
+var contracts_2 = require("./contracts");
+Object.defineProperty(exports, "contractFileHashes", { enumerable: true, get: function () { return contracts_2.contractFileHashes; } });
+Object.defineProperty(exports, "contractViolations", { enumerable: true, get: function () { return contracts_2.contractViolations; } });
+Object.defineProperty(exports, "loadDelegatedRegistry", { enumerable: true, get: function () { return contracts_2.loadDelegatedRegistry; } });
+Object.defineProperty(exports, "mergeDelegatedRecords", { enumerable: true, get: function () { return contracts_2.mergeDelegatedRecords; } });
+Object.defineProperty(exports, "parseDelegatedRegistry", { enumerable: true, get: function () { return contracts_2.parseDelegatedRegistry; } });
+Object.defineProperty(exports, "pruneDelegatedRecords", { enumerable: true, get: function () { return contracts_2.pruneDelegatedRecords; } });
+Object.defineProperty(exports, "rememberDelegated", { enumerable: true, get: function () { return contracts_2.rememberDelegated; } });
+Object.defineProperty(exports, "recordOperatorAttestation", { enumerable: true, get: function () { return contracts_2.recordOperatorAttestation; } });
+Object.defineProperty(exports, "resolveContractFiles", { enumerable: true, get: function () { return contracts_2.resolveContractFiles; } });
+Object.defineProperty(exports, "resolveDelegatedRegistryPath", { enumerable: true, get: function () { return contracts_2.resolveDelegatedRegistryPath; } });
+Object.defineProperty(exports, "saveDelegatedRegistry", { enumerable: true, get: function () { return contracts_2.saveDelegatedRegistry; } });
+Object.defineProperty(exports, "sha256File", { enumerable: true, get: function () { return contracts_2.sha256File; } });
+var verification_2 = require("./verification");
+Object.defineProperty(exports, "DEFAULT_VERIFICATION_POLICY", { enumerable: true, get: function () { return verification_2.DEFAULT_VERIFICATION_POLICY; } });
+Object.defineProperty(exports, "DEFAULT_VERIFICATION_TIMEOUT_MS", { enumerable: true, get: function () { return verification_2.DEFAULT_VERIFICATION_TIMEOUT_MS; } });
+Object.defineProperty(exports, "commandProgram", { enumerable: true, get: function () { return verification_2.commandProgram; } });
+Object.defineProperty(exports, "describeFailures", { enumerable: true, get: function () { return verification_2.describeFailures; } });
+Object.defineProperty(exports, "evaluateVerificationPolicy", { enumerable: true, get: function () { return verification_2.evaluateVerificationPolicy; } });
+Object.defineProperty(exports, "parseTestOutput", { enumerable: true, get: function () { return verification_2.parseTestOutput; } });
+Object.defineProperty(exports, "redactVerificationOutput", { enumerable: true, get: function () { return verification_2.redactVerificationOutput; } });
+Object.defineProperty(exports, "resolveVerificationTimeoutMs", { enumerable: true, get: function () { return verification_2.resolveVerificationTimeoutMs; } });
+Object.defineProperty(exports, "runInProcessFallback", { enumerable: true, get: function () { return verification_2.runInProcessFallback; } });
+Object.defineProperty(exports, "runSandboxVerification", { enumerable: true, get: function () { return verification_2.runSandboxVerification; } });
+var context_quality_2 = require("./context-quality");
+Object.defineProperty(exports, "EMPTY_CONTEXT_QUALITY", { enumerable: true, get: function () { return context_quality_2.EMPTY_CONTEXT_QUALITY; } });
+Object.defineProperty(exports, "describeContextQuality", { enumerable: true, get: function () { return context_quality_2.describeContextQuality; } });
+Object.defineProperty(exports, "foldContextQuality", { enumerable: true, get: function () { return context_quality_2.foldContextQuality; } });
+var delegation_2 = require("./delegation");
+Object.defineProperty(exports, "DELEGATE_WORKER_OPENAI_SCHEMA", { enumerable: true, get: function () { return delegation_2.DELEGATE_WORKER_OPENAI_SCHEMA; } });
+Object.defineProperty(exports, "DELEGATE_WORKER_SCHEMA", { enumerable: true, get: function () { return delegation_2.DELEGATE_WORKER_SCHEMA; } });
+Object.defineProperty(exports, "DELEGATE_WORKER_SCHEMA_COVERS_EVERY_PARAMETER", { enumerable: true, get: function () { return delegation_2.DELEGATE_WORKER_SCHEMA_COVERS_EVERY_PARAMETER; } });
+Object.defineProperty(exports, "DEFAULT_LOCAL_ENDPOINT", { enumerable: true, get: function () { return delegation_2.DEFAULT_LOCAL_ENDPOINT; } });
+Object.defineProperty(exports, "MIN_SEARCH_CHARS", { enumerable: true, get: function () { return delegation_2.MIN_SEARCH_CHARS; } });
+Object.defineProperty(exports, "applySearchReplaceBlocks", { enumerable: true, get: function () { return delegation_2.applySearchReplaceBlocks; } });
+Object.defineProperty(exports, "delegateWorker", { enumerable: true, get: function () { return delegation_2.delegateWorker; } });
+Object.defineProperty(exports, "estimateTokenCount", { enumerable: true, get: function () { return delegation_2.estimateTokenCount; } });
+Object.defineProperty(exports, "extractPromptText", { enumerable: true, get: function () { return delegation_2.extractPromptText; } });
+Object.defineProperty(exports, "parseSearchReplaceBlocks", { enumerable: true, get: function () { return delegation_2.parseSearchReplaceBlocks; } });
+Object.defineProperty(exports, "resolveChatCompletionsUrl", { enumerable: true, get: function () { return delegation_2.resolveChatCompletionsUrl; } });
+Object.defineProperty(exports, "resolveDelegateStatus", { enumerable: true, get: function () { return delegation_2.resolveDelegateStatus; } });
+Object.defineProperty(exports, "resolveVerificationRepeats", { enumerable: true, get: function () { return delegation_2.resolveVerificationRepeats; } });
+var retry_context_1 = require("./retry-context");
+Object.defineProperty(exports, "RETRY_CONTEXT_WINDOW_LINES", { enumerable: true, get: function () { return retry_context_1.RETRY_CONTEXT_WINDOW_LINES; } });
+Object.defineProperty(exports, "parseFailureLocations", { enumerable: true, get: function () { return retry_context_1.parseFailureLocations; } });
+Object.defineProperty(exports, "retryContextRequests", { enumerable: true, get: function () { return retry_context_1.retryContextRequests; } });
+exports.inject = ['tools'];
+exports.using = ['tools'];
+/**
+ * Resolve the Session Workspace root WITHOUT declaring a hard inject dependency.
+ *
+ * ctx.workspace does not exist in Cordis (reading it throws), and dsh-workspace
+ * exposes a REGISTRY (ctx.workspaceRegistry), not a per-Session cwd. So probe the
+ * known shapes in order and report WHERE the answer came from: silently falling
+ * back to process.cwd() writes files into the server's own directory instead of
+ * the Session workspace, which is far worse than failing loudly.
+ */
+function resolveWorkspaceDir(ctx) {
+    for (const key of ['DSH_WORKSPACE_ROOT', 'DSH_WORKSPACE', 'WORKSPACE_ROOT']) {
+        const candidate = process.env[key];
+        if (typeof candidate === 'string' && candidate && fs.existsSync(candidate)) {
+            return { dir: candidate, source: `env:${key}` };
+        }
+    }
+    try {
+        for (const serviceName of ['workspace', 'workspaceRegistry', 'workspaceFiles', 'session']) {
+            const service = typeof ctx?.get === 'function' ? ctx.get(serviceName) : undefined;
+            if (!service)
+                continue;
+            for (const prop of ['dir', 'cwd', 'root', 'path', 'workspaceDir']) {
+                const value = service[prop];
+                if (typeof value === 'string' && value && fs.existsSync(value)) {
+                    return { dir: value, source: `ctx.get('${serviceName}').${prop}` };
+                }
+            }
+        }
+    }
+    catch {
+        // service unavailable in this context - fall through to the cwd fallback
+    }
+    return { dir: process.cwd(), source: 'process.cwd() FALLBACK (not a Session workspace)' };
+}
+exports.name = 'dsh-plugin-coding-delegate';
+// resolveDataDir and trace moved to ./logging.ts and are imported above. The re-export beside the other
+// module re-exports keeps `resolveDataDir` on the public surface, where callers already depend on it.
+// The delegate_worker schemas moved to ./delegation.ts and are re-exported below.
+function scanDLP(text, options = {}) {
+    if (!text)
+        return { hasSensitiveData: false, violations: [], highConfidence: false };
+    const violations = [];
+    // Shared with the classifier: an enforcing gate must not use a weaker rule set
+    // than the classifier that reports alongside it (it previously did, which let
+    // `password: "..."` through to the cloud).
+    for (const { name, pattern } of local_classifier_1.SECRET_PATTERN_RULES) {
+        if (pattern.test(text)) {
+            violations.push(name);
+        }
+    }
+    // A recognised shape or keyword-assigned value is high confidence.
+    const highConfidence = violations.length > 0;
+    // The entropy backstop. Deliberately medium confidence: a high-entropy token may
+    // equally be a digest or a base64 payload, so it must not hard-block a session.
+    if (options.entropyCheck !== false) {
+        const tokens = (0, local_classifier_1.findHighEntropyTokens)(text, {
+            minBitsPerChar: options.entropyMinBitsPerChar,
+            minLength: options.entropyMinLength,
+        });
+        if (tokens.length > 0)
+            violations.push('High-entropy string');
+    }
+    return { hasSensitiveData: violations.length > 0, violations, highConfidence };
+}
+class LocalRouter {
+    config;
+    constructor(config = {}) {
+        const contextThreshold = config.contextThreshold ??
+            config.contextTokenThreshold ??
+            parseInt(process.env.CONTEXT_TOKEN_THRESHOLD || '30000', 10);
+        this.config = {
+            localProvider: config.localProvider || profiles_1.PROFILES.WORKER.provider,
+            cloudProvider: config.cloudProvider || profiles_1.PROFILES.ARCHITECT.provider,
+            localModel: config.localModel || profiles_1.PROFILES.WORKER.model,
+            cloudModel: config.cloudModel || profiles_1.PROFILES.ARCHITECT.model,
+            contextThreshold,
+            timeoutMs: config.timeoutMs || 2000,
+            enforceDLP: config.enforceDLP ?? true,
+        };
+    }
+    getConfig() {
+        return this.config;
+    }
+    async predictRoute(promptText) {
+        const dlpResult = scanDLP(promptText);
+        if (dlpResult.hasSensitiveData) {
+            return {
+                provider: this.config.localProvider,
+                model: this.config.localModel,
+                route: 'WORKER_LOCAL',
+                gate: 'Gate 1 (Local Classifier - DLP Firewall)',
+                rationale: `Sensitive credentials detected by DLP firewall (${dlpResult.violations.join(', ')}). Routing payload locally to protect privacy.`,
+                scores: { is_private: 0.99, complexity: 1, target: 'LOCAL_5090' },
+                latencyMs: 0,
+                dlpViolations: dlpResult.violations,
+            };
+        }
+        const tokens = (0, delegation_1.estimateTokenCount)(promptText);
+        if (tokens > this.config.contextThreshold) {
+            return {
+                provider: this.config.cloudProvider,
+                model: this.config.cloudModel,
+                route: 'ARCHITECT_CLOUD',
+                gate: 'Gate 0 (Guard - Token Threshold)',
+                rationale: `Prompt token count (${tokens}) exceeds local context threshold (${this.config.contextThreshold}). Routing directly to Cloud.`,
+                scores: { is_private: 0, complexity: 5, target: 'CLOUD_DEEPSEEK' },
+                latencyMs: 0,
+            };
+        }
+        // Routing is decided in-process. There is no decision daemon, no HTTP hop and
+        // no timeout to pay on every routing call, and nothing to fail over to: the
+        // classifier always returns a decision.
+        const decision = (0, local_classifier_1.classifyLocally)(promptText);
+        const isCloud = decision.route === 'cloud';
+        return {
+            provider: isCloud ? this.config.cloudProvider : this.config.localProvider,
+            model: isCloud ? this.config.cloudModel : this.config.localModel,
+            route: isCloud ? 'ARCHITECT_CLOUD' : 'WORKER_LOCAL',
+            gate: decision.gate,
+            rationale: decision.rationale,
+            scores: decision.scores,
+            latencyMs: decision.latencyMs,
+        };
+    }
+    async handleBeforeRequest(session) {
+        if (!session)
+            return session;
+        const fullText = (0, delegation_1.extractPromptText)(session);
+        if (!fullText || fullText.trim().length === 0) {
+            return {
+                ...session,
+                provider: this.config.cloudProvider,
+                model: this.config.cloudModel,
+            };
+        }
+        const decision = await this.predictRoute(fullText);
+        const routerMeta = {
+            provider: decision.provider,
+            model: decision.model,
+            route: decision.route,
+            gate: decision.gate,
+            rationale: decision.rationale,
+            scores: decision.scores,
+            latencyMs: decision.latencyMs,
+            dlpViolations: decision.dlpViolations,
+            tier: decision.route === 'ARCHITECT_CLOUD' ? 'Cloud Tier (Cloud Architect)' : 'Local Tier (Local Worker)',
+            estimatedTokens: (0, delegation_1.estimateTokenCount)(fullText),
+        };
+        (0, logging_1.trace)('ROUTER_DECISION', {
+            prompt: fullText.slice(0, 100).replace(/\n/g, ' '),
+            tokens: (0, delegation_1.estimateTokenCount)(fullText),
+            gate: decision.gate,
+            selectedProvider: decision.provider,
+            selectedModel: decision.model,
+            rationale: decision.rationale,
+        });
+        const isLocal = decision.provider === this.config.localProvider;
+        if (Object.isExtensible(session)) {
+            try {
+                session.provider = decision.provider;
+                session.model = decision.model;
+                session.apiKey = isLocal ? 'KEY' : undefined;
+                if (isLocal) {
+                    delete session.reasoningEffort;
+                }
+                if (!session.options)
+                    session.options = {};
+                if (Object.isExtensible(session.options)) {
+                    session.options.provider = decision.provider;
+                    session.options.model = decision.model;
+                    if (isLocal) {
+                        session.options.apiKey = 'KEY';
+                        delete session.options.reasoningEffort;
+                    }
+                }
+                if (!session.metadata)
+                    session.metadata = {};
+                if (Object.isExtensible(session.metadata)) {
+                    session.metadata.router = routerMeta;
+                }
+            }
+            catch (err) { }
+        }
+        const updatedOptions = {
+            ...(session.options || {}),
+            provider: decision.provider,
+            model: decision.model,
+        };
+        if (isLocal) {
+            updatedOptions.apiKey = 'KEY';
+            delete updatedOptions.reasoningEffort;
+        }
+        const updated = {
+            ...session,
+            provider: decision.provider,
+            model: decision.model,
+            options: updatedOptions,
+            metadata: {
+                ...(session.metadata || {}),
+                router: routerMeta,
+            },
+        };
+        if (isLocal) {
+            updated.apiKey = 'KEY';
+            delete updated.reasoningEffort;
+        }
+        return updated;
+    }
+    async handleError(session, error) {
+        if (!session)
+            return session;
+        const currentProvider = session.provider || session.options?.provider || this.config.localProvider;
+        if (currentProvider === this.config.localProvider || session.metadata?.router?.route === 'WORKER_LOCAL' || session.metadata?.router?.route === 'local') {
+            const errorMessage = error?.message || String(error);
+            const prevMetadata = session.metadata?.router;
+            const routerMeta = {
+                ...prevMetadata,
+                failover: true,
+                previousProvider: currentProvider,
+                provider: this.config.cloudProvider,
+                model: this.config.cloudModel,
+                route: 'cloud-failover',
+                gate: 'Gate 2 (Guard - Automatic Cloud Failover)',
+                rationale: `Local LM Studio provider failure caught (${errorMessage}). Transparently re-dispatching turn to DeepSeek Cloud.`,
+                tier: 'Cloud Tier (DeepSeek Cloud Fallback)',
+                estimatedTokens: prevMetadata?.estimatedTokens || 0,
+            };
+            (0, logging_1.trace)('ROUTER_FAILOVER', {
+                errorMessage,
+                cloudProvider: this.config.cloudProvider,
+                cloudModel: this.config.cloudModel,
+            });
+            if (Object.isExtensible(session)) {
+                try {
+                    session.provider = this.config.cloudProvider;
+                    session.model = this.config.cloudModel;
+                    if (session.options && Object.isExtensible(session.options)) {
+                        session.options.provider = this.config.cloudProvider;
+                        session.options.model = this.config.cloudModel;
+                    }
+                    if (session.metadata && Object.isExtensible(session.metadata)) {
+                        session.metadata.router = routerMeta;
+                    }
+                }
+                catch (err) { }
+            }
+            const updated = {
+                ...session,
+                provider: this.config.cloudProvider,
+                model: this.config.cloudModel,
+                options: {
+                    ...(session.options || {}),
+                    provider: this.config.cloudProvider,
+                    model: this.config.cloudModel,
+                },
+                metadata: {
+                    ...(session.metadata || {}),
+                    router: routerMeta,
+                },
+            };
+            if (typeof session.redispatch === 'function') {
+                await session.redispatch();
+            }
+            else if (typeof session.retry === 'function') {
+                await session.retry();
+            }
+            return updated;
+        }
+        return session;
+    }
+}
+exports.LocalRouter = LocalRouter;
+/**
+ * The prompt stashed at `agent/pre-step` for the request hook, keyed by session AND turn.
+ *
+ * The key carries the session because turn numbers are per session: every delegated subagent starts
+ * at turn 1, so keying on the turn alone let two sessions sitting on the same turn hand each other
+ * their text. The gate scans `corpus.length > prompt.length ? corpus : prompt`, so a borrowed prompt
+ * longer than this session's own corpus replaced it and this session's text was never scanned at all
+ * -- a credential went out unscanned, measured in tests/oracles/dlp-session-scope.test.cjs.
+ */
+const pendingTurnPrompts = new Map();
+/** One stashed prompt per turn in flight; a turn whose request never runs would otherwise leak one. */
+const PENDING_TURN_PROMPTS_MAX = 256;
+/** Session ids and turn numbers cannot contain NUL, so the key is injective by construction. */
+const TURN_PROMPT_SEPARATOR = '\u0000';
+/**
+ * Every user-message text this plugin has seen, per session.
+ *
+ * The DLP gate can only scan what the host hands it: `agent/pre-step` receives the
+ * messages claimed for the current turn, and `agent/request` receives no message content
+ * at all because the outbound conversation is assembled from the session surface after
+ * that waterfall. Scanning only the newest message therefore let a credential introduced
+ * in an earlier turn be re-sent on every later request without tripping the gate.
+ * Accumulating makes the gate sticky instead.
+ */
+const sessionPromptCorpus = new Map();
+const SESSION_CORPUS_MAX_CHARS = 200_000;
+const GLOBAL_CORPUS_KEY = '__global__';
+function corpusKeyFor(payload) {
+    const id = payload?.agent?.id ?? payload?.agent?.session?.id ?? payload?.session?.id;
+    return typeof id === 'string' && id.length > 0 ? id : GLOBAL_CORPUS_KEY;
+}
+/** The stash key for one session's turn. */
+function turnPromptKey(payload, turn) {
+    return corpusKeyFor(payload) + TURN_PROMPT_SEPARATOR + String(turn);
+}
+/** Stash one turn's prompt, keeping insertion order as recency and bounding the map. */
+function rememberTurnPrompt(payload, turn, prompt) {
+    const key = turnPromptKey(payload, turn);
+    pendingTurnPrompts.delete(key);
+    pendingTurnPrompts.set(key, prompt);
+    while (pendingTurnPrompts.size > PENDING_TURN_PROMPTS_MAX) {
+        const oldest = pendingTurnPrompts.keys().next().value;
+        if (oldest === undefined)
+            break;
+        pendingTurnPrompts.delete(oldest);
+    }
+}
+function accumulateCorpus(key, text) {
+    if (!text)
+        return;
+    const target = key || GLOBAL_CORPUS_KEY;
+    const existing = sessionPromptCorpus.get(target) ?? '';
+    if (existing.includes(text))
+        return;
+    const combined = existing ? `${existing}\n${text}` : text;
+    sessionPromptCorpus.set(target, combined.length > SESSION_CORPUS_MAX_CHARS
+        ? combined.slice(combined.length - SESSION_CORPUS_MAX_CHARS)
+        : combined);
+}
+function extractTextFromClaimedMessages(messages) {
+    if (!Array.isArray(messages))
+        return '';
+    for (let i = messages.length - 1; i >= 0; i--) {
+        const m = messages[i];
+        if (!m)
+            continue;
+        if (typeof m.text === 'string' && m.text.trim())
+            return m.text.trim();
+        if (typeof m.prompt === 'string' && m.prompt.trim())
+            return m.prompt.trim();
+        if (typeof m.content === 'string' && m.content.trim())
+            return m.content.trim();
+        if (Array.isArray(m.content)) {
+            for (const block of m.content) {
+                if (block?.type === 'text' && typeof block?.text === 'string' && block.text.trim()) {
+                    if (!block.text.startsWith('Current runtime context.')) {
+                        return block.text.trim();
+                    }
+                }
+            }
+        }
+    }
+    return '';
+}
+let isPluginApplied = false;
+/**
+ * Print the measured reference throughput for the local worker models, so the
+ * server console carries a baseline next to the live per-call LEDGER_AUDIT rate.
+ */
+function logWorkerBenchmarks() {
+    console.log(`[WORKER_BENCH] Reference throughput (${profiles_1.WORKER_BENCHMARK_SOURCE})`);
+    console.log('[WORKER_BENCH] Local work is unmetered, so the metered plan is spent on thinking rather than on reading code.');
+    console.log('[WORKER_BENCH] LEDGER_AUDIT reports CloudEquiv: what the local tokens would have cost at the metered tier.');
+    console.log('[WORKER_BENCH] That is the plan exposure you avoided, not money saved -- the GPU is a fixed cost.');
+    console.log('[WORKER_BENCH] LEDGER_AUDIT carries running totals: Metered is what the plan paid, Local is what the GPU did.');
+    console.log('[WORKER_BENCH]   model                     decode        ttft       note');
+    for (const bench of profiles_1.WORKER_BENCHMARKS) {
+        const active = bench.model === profiles_1.PROFILES.WORKER.model ? '  <- active worker' : '';
+        console.log(`[WORKER_BENCH]   ${bench.model.padEnd(24)} ${`${bench.decodeTps.toFixed(1)} tok/s`.padEnd(13)} ${bench.ttft.padEnd(10)} ${bench.note}${active}`);
+    }
+    console.log(`[WORKER_BENCH] Active worker model: ${profiles_1.PROFILES.WORKER.model} (max_tokens: ${profiles_1.PROFILES.WORKER.max_tokens ?? 'unset'}, thinking: ${profiles_1.PROFILES.WORKER.enable_thinking === false ? 'off' : 'on'})`);
+}
+const APPROVAL_OUTCOMES = new Set(['allowed-once', 'rejected', 'cancelled', 'unavailable']);
+/**
+ * Route an `ask` guard decision through the real approval seam.
+ *
+ * Returning `{ kind: 'ask' }` from a tools/pre-execute listener prompts nobody: the
+ * pipeline understands only `deny`, so every other kind is an allow. The seam that
+ * actually asks is `dsh-user-approval` (ctx.approval), and it fails closed — a
+ * missing service, a missing agent, an idle turn or a throwing answerer all resolve
+ * to 'unavailable', which this treats as a refusal.
+ */
+async function requestApprovalForWrite(ctx, exec, verdict) {
+    try {
+        const service = typeof ctx?.get === 'function' ? ctx.get('approval') : undefined;
+        if (!service || typeof service.request !== 'function')
+            return 'unavailable';
+        if (!exec?.agent)
+            return 'unavailable';
+        const outcome = await service.request({
+            agent: exec.agent,
+            toolName: String(exec?.name || 'unknown'),
+            ...(exec?.callId ? { callId: exec.callId } : {}),
+            reason: verdict.reason,
+            ...(exec?.signal ? { signal: exec.signal } : {}),
+        });
+        // Validate against the vocabulary rather than trusting the answerer: the service
+        // normalises rogue values, but a bridge that assumes it would treat any unknown
+        // string as a decision. Anything unrecognised fails closed.
+        return typeof outcome === 'string' && APPROVAL_OUTCOMES.has(outcome)
+            ? outcome
+            : 'unavailable';
+    }
+    catch (err) {
+        // No open turn, suspended session, or a broken answerer: fail closed.
+        console.warn('[LOCAL_GUARD] approval request failed; failing closed:', err?.message || err);
+        return 'unavailable';
+    }
+}
+function resolveVerificationPolicy(options = {}) {
+    // A blank or non-string coherence command is absent, not an empty command: an empty string would run
+    // as a no-op subprocess and report success, which is a project check that checks nothing.
+    const coherence = typeof options.coherenceVerification === 'string' && options.coherenceVerification.trim()
+        ? options.coherenceVerification.trim()
+        : undefined;
+    return {
+        mode: options.verificationApproval ?? 'ask',
+        allowlist: Array.isArray(options.verificationAllowlist) ? options.verificationAllowlist : [],
+        allowInProcessFallback: options.allowInProcessFallback === true,
+        timeoutMs: (0, verification_1.resolveVerificationTimeoutMs)(options.verificationTimeoutMs),
+        ...(coherence ? { coherenceVerification: coherence } : {}),
+    };
+}
+/**
+ * Ask the operator to approve one model-selected verification command. Unlike the write
+ * guard this is not a `tools/pre-execute` decision, because the command runs after the
+ * worker responds; it is asked before dispatch so the operator sees it up front.
+ * Fails closed on every error path.
+ */
+async function requestApprovalForVerification(ctx, exec, command) {
+    try {
+        const service = typeof ctx?.get === 'function' ? ctx.get('approval') : undefined;
+        if (!service || typeof service.request !== 'function')
+            return false;
+        if (!exec?.agent)
+            return false;
+        const outcome = await service.request({
+            agent: exec.agent,
+            toolName: 'delegate_worker',
+            ...(exec?.callId ? { callId: exec.callId } : {}),
+            reason: `delegate_worker wants to run this verification command with the full authority of the DSH ` +
+                `process:\n  ${command}\n` +
+                `It is model-selected and is not confined to the workspace. Approve it only if you recognise it.`,
+            ...(exec?.signal ? { signal: exec.signal } : {}),
+        });
+        return outcome === 'allowed-once';
+    }
+    catch (err) {
+        console.warn('[LOCAL_GUARD] verification approval request failed; failing closed:', err?.message || err);
+        return false;
+    }
+}
+/**
+ * Ask the operator before a delegation writes into a directory that is neither the session workspace
+ * nor an allowlisted root. Same seam as the verification prompt above, and the same fail-closed rule:
+ * no approval service, no agent, or a thrown request all resolve to refusal rather than to consent.
+ */
+async function requestApprovalForWorkspace(ctx, exec, dir, reason) {
+    try {
+        const service = typeof ctx?.get === 'function' ? ctx.get('approval') : undefined;
+        if (!service || typeof service.request !== 'function')
+            return false;
+        if (!exec?.agent)
+            return false;
+        const outcome = await service.request({
+            agent: exec.agent,
+            toolName: 'delegate_worker',
+            ...(exec?.callId ? { callId: exec.callId } : {}),
+            reason: 'delegate_worker wants to write into a directory outside the session workspace:\n  ' +
+                dir +
+                '\n' +
+                reason +
+                '\nApprove only if you intend this delegation to write there.',
+            ...(exec?.signal ? { signal: exec.signal } : {}),
+        });
+        return outcome === 'allowed-once';
+    }
+    catch (err) {
+        console.warn('[LOCAL_GUARD] workspace approval request failed; failing closed:', err?.message || err);
+        return false;
+    }
+}
+// Role resolution, the architect config and the lead tier moved to ./roles.ts and are imported
+// above. They are re-exported beside the other module re-exports because callers depend on them.
+function apply(ctx, options = {}) {
+    // Restore what was delegated before this process started. Without this, a restart silently widened
+    // what the architect may read back — the gap a live run found, and the reason this is not merely
+    // in-memory state any more.
+    for (const record of (0, contracts_1.loadDelegatedRegistry)()) {
+        if (record.mode === 'created')
+            contracts_1.delegatedPaths.add((0, paths_1.canonicalisePath)(record.path));
+    }
+    const REGISTERED_KEY = Symbol.for('dsh-plugin-coding-delegate.registered');
+    const isTest = process.env.NODE_ENV === 'test';
+    if (!isTest) {
+        if (isPluginApplied || ctx[REGISTERED_KEY] || globalThis[REGISTERED_KEY]) {
+            console.warn('[LOCAL_ROUTER] Plugin already registered. Skipping duplicate mounting.');
+            return;
+        }
+        isPluginApplied = true;
+        ctx[REGISTERED_KEY] = true;
+        globalThis[REGISTERED_KEY] = true;
+    }
+    console.log('[LOCAL_ROUTER_DEBUG] ctx.tools available:', Boolean(ctx.tools));
+    const router = new LocalRouter(options);
+    const config = router.getConfig();
+    const tracker = new savings_tracker_1.SavingsTracker((0, logging_1.resolveDataDir)());
+    (0, logging_1.trace)('PLUGIN_INIT_ASYMMETRIC_ORCHESTRATOR', { config });
+    // Register `delegate_worker` strictly adhering to `@deepseek-ai/dsh-tools` and DeepSeek JSON Schema contract
+    if (ctx.tools && typeof ctx.tools.register === 'function') {
+        try {
+            const dshToolDef = {
+                name: 'delegate_worker',
+                description: 'Dispatches a discrete implementation, testing, or code-generation task to the configured local execution worker -- any OpenAI-compatible server (LM Studio, Ollama, vLLM, llama.cpp) -- with an isolated context window. The worker has no repository read: declare contextFiles for the code it must see, since it cannot discover anything itself.',
+                // SINGLE SOURCE OF TRUTH. These parameters were previously duplicated here and in
+                // DELEGATE_WORKER_OPENAI_SCHEMA in delegation.ts, and the duplication already cost a false test:
+                // adding attestTargets/attestEvidence to this copy alone left the tool listing unchanged and the
+                // delegated call was silently stripped of both -- the tool reported success while the parameters
+                // never arrived. delegation.ts owns the list; this file references it.
+                parameters: delegation_1.DELEGATE_WORKER_OPENAI_SCHEMA.function.parameters,
+                output: {
+                    schema: {
+                        type: 'object',
+                        additionalProperties: true,
+                    },
+                    render: (_args, value) => [
+                        {
+                            type: 'text',
+                            text: typeof value === 'string' ? value : JSON.stringify(value, null, 2),
+                        },
+                    ],
+                },
+                async execute(args, exec) {
+                    const resolved = resolveWorkspaceDir(ctx);
+                    const explicitDir = args?.workspaceDir;
+                    // `endpoint` is not a declared tool argument and is deliberately dropped:
+                    // delegateWorker would otherwise POST the task to whatever URL a caller named.
+                    const { endpoint: _ignoredEndpoint, ...callerArgs } = args || {};
+                    // Attestation is a SEPARATE act from delegation and must not be smuggled into it. A caller may
+                    // name paths to attest here so the operator's own review can be recorded through a tool call
+                    // rather than a shell one-liner -- the manual route was the only one available, which is exactly
+                    // why the promotion socket sat patched-but-unattested for so long.
+                    const { attestTargets, attestEvidence, attestOperator, ...delegationArgs } = callerArgs;
+                    const policy = resolveVerificationPolicy(options);
+                    // The workspaceDir ARGUMENT chooses the base directory for every containment check, and it is
+                    // model-visible. Containment of the emitted files was always sound; what was missing is that
+                    // the base itself was supplied by the caller being contained, so naming a directory outside
+                    // the session workspace made every later boundary true by construction.
+                    const containment = (0, containment_1.resolveWorkspaceContainment)({
+                        requested: explicitDir,
+                        sessionRoot: resolved.dir,
+                        allowedRoots: options?.emitAllowlist,
+                        canPrompt: typeof ctx?.get === 'function' && Boolean(ctx.get('approval')),
+                    });
+                    if (!containment.trusted && !containment.needsApproval) {
+                        return {
+                            success: false,
+                            status: 'CONTEXT_REFUSED',
+                            taskName: String(args?.taskName || ''),
+                            message: String(containment.reason),
+                            error: 'workspaceDir refused',
+                            resolvedWorkspace: resolved.dir,
+                            filesWritten: [],
+                            testResults: { passed: 0, failed: 0, output: 'The worker was not called.' },
+                            tokens: { prompt: 0, completion: 0 },
+                        };
+                    }
+                    if (!containment.trusted && containment.needsApproval) {
+                        const approved = await requestApprovalForWorkspace(ctx, exec, String(containment.dir), String(containment.reason));
+                        if (!approved) {
+                            return {
+                                success: false,
+                                status: 'CONTEXT_REFUSED',
+                                taskName: String(args?.taskName || ''),
+                                message: String(containment.reason),
+                                error: 'workspaceDir refused: operator approval was not granted',
+                                resolvedWorkspace: resolved.dir,
+                                filesWritten: [],
+                                testResults: { passed: 0, failed: 0, output: 'The worker was not called.' },
+                                tokens: { prompt: 0, completion: 0 },
+                            };
+                        }
+                    }
+                    const verdict = await (0, delegation_1.delegateWorker)({
+                        ...delegationArgs,
+                        // Operator settings, not caller arguments. The local endpoint and model are
+                        // trusted configuration; a caller-supplied `endpoint` was dropped just above.
+                        ...(options?.localEndpoint ? { endpoint: options.localEndpoint } : {}),
+                        ...(options?.localModel ? { model: options.localModel } : {}),
+                        workspaceDir: explicitDir || resolved.dir,
+                        workspaceSource: explicitDir ? 'caller-supplied workspaceDir' : resolved.source,
+                        verificationPolicy: policy,
+                        emitAllowlist: options?.emitAllowlist,
+                        // Operator setting, placed after the caller args for the same reason as `unitScope` below:
+                        // a caller must not be able to switch this off, and an operator who has switched it off must
+                        // not have it switched back on by a caller.
+                        retryContext: options?.retryContext ?? 'auto',
+                        verificationApproval: (command) => requestApprovalForVerification(ctx, exec, command),
+                    }, tracker);
+                    if (Array.isArray(attestTargets) && attestTargets.length > 0) {
+                        // Only a PASSING unit may be attested from here. An attestation is a human claim about content;
+                        // attaching one to a unit that failed or was never verified would launder a machine outcome
+                        // into a human statement, which is the one thing this verdict must not become.
+                        //
+                        // The gate is `status === 'SUCCESS'`, NOT 'UNIT_PASSED'. The first version of this compared
+                        // against 'UNIT_PASSED' and refused every attestation, because `resolveDelegateStatus` returns
+                        // 'SUCCESS' / 'INCOHERENT' / 'VERIFICATION_FAILED' / 'UNVERIFIED' / 'FLAKY' and never emits the
+                        // registry's outcome vocabulary at all. The two vocabularies are genuinely different, and the
+                        // mistake was silent in the worst way: the tool reported success while quietly skipping the
+                        // attestation, and the skip message blamed the unit rather than the comparison.
+                        //
+                        // `SUCCESS` is also the stricter of the two candidate gates, and correctly so: it requires the
+                        // project coherence check to have passed as well, and attesting a unit whose tree is broken
+                        // would certify content in a state nothing verified.
+                        if (verdict && verdict.status === 'SUCCESS') {
+                            // OPERATOR IDENTITY, and the first version of this got it exactly wrong. It fell back to
+                            // `exec.agent.id`, which stamped an ephemeral session UUID into the audit ledger as though a
+                            // human had signed off -- inverting the separation of duties the verdict exists to record,
+                            // and producing a record LESS attributable than a typed name rather than more.
+                            //
+                            // There is deliberately NO fallback to the agent. An autonomous agent id cannot attest human
+                            // review, so the absence of an identity is a refusal, not a value to invent. Precedence is
+                            // the call's `attestOperator`, then the plugin's `operatorIdentity` -- explicit over ambient.
+                            const operator = String(attestOperator || options?.operatorIdentity || '').trim();
+                            // Scope before attesting: a path may be attested only if this unit actually wrote it.
+                            // Attesting anything else is how a caller forged a human review over a file the unit
+                            // never touched. Placed after `operator` because the helper needs it.
+                            const scope = (0, attestation_1.selectAttestableTargets)({
+                                requested: Array.isArray(attestTargets) ? attestTargets : [],
+                                filesWritten: Array.isArray(verdict?.filesWritten) ? verdict.filesWritten : [],
+                                operator,
+                            });
+                            if (scope.refused.length > 0) {
+                                verdict.attestationErrors = scope.refused.map((p) => 'attestTargets must be written and verified in the current unit: ' + p);
+                            }
+                            if (!operator) {
+                                // Refused, and the unit's own verdict is left INTACT. Throwing here would destroy a passing
+                                // unit's result over a bookkeeping failure, which is not what failing closed means at this
+                                // seam: the delegation succeeded, and only the attestation did not.
+                                verdict.attestationSkipped =
+                                    'attestTargets was provided but no operator identity is available, so nothing was attested. ' +
+                                        "Pass attestOperator on the call, or set 'operatorIdentity' in the plugin configuration. " +
+                                        'An autonomous agent id cannot attest human review, so it is never used as a fallback.';
+                                console.warn('[LOCAL_EGRESS] attestation refused: no operator identity (attestOperator or operatorIdentity)');
+                            }
+                            else {
+                                const evidence = String(attestEvidence || '').trim() ||
+                                    'operator reviewed the passing unit from delegation ' + String(verdict.taskName || '');
+                                const attested = [];
+                                // Only what this unit wrote, so an answer-only delegation attests nothing.
+                                for (const target of scope.attestable) {
+                                    try {
+                                        const record = (0, contracts_1.recordOperatorAttestation)(String(target), operator, evidence);
+                                        if (record)
+                                            attested.push(record.path);
+                                    }
+                                    catch (err) {
+                                        // The recorder throws when the registry cannot be written, deliberately: an unpersisted
+                                        // attestation must not be reported as one. Surfacing it here keeps that contract.
+                                        console.warn('[LOCAL_EGRESS] attestation failed for', target, err?.message || err);
+                                    }
+                                }
+                                verdict.attested = attested;
+                                if (attested.length > 0) {
+                                    verdict.summary = String(verdict.summary || '') + '\nAttested: ' + attested.join(', ') + '.';
+                                }
+                            }
+                        }
+                        else {
+                            verdict.attestationSkipped =
+                                'attestTargets was provided but the unit status was ' +
+                                    String(verdict && verdict.status) +
+                                    ', not SUCCESS, so nothing was attested';
+                        }
+                    }
+                    return verdict;
+                },
+            };
+            // DRIFT ASSERTION for the duplicated tool schema, and it exists because the duplication already cost
+            // a false test. The parameters are declared twice: once inline here (the dev contract this file
+            // registers) and once in `DELEGATE_WORKER_OPENAI_SCHEMA` in delegation.ts, which is what the host
+            // receives. Adding `attestTargets`/`attestEvidence` to the inline copy alone left the tool listing
+            // unchanged, and the delegated call was SILENTLY stripped of both -- the tool reported success while
+            // the parameters never arrived.
+            //
+            // `delegation.ts` owns the canonical list. This asserts the local copy still agrees with it, so the
+            // next parameter added to one and not the other fails loudly at registration instead of quietly
+            // dropping an argument. Sorted key comparison plus the `required` list, because a missing parameter
+            // and a reordered one are not the same defect and only the first is worth waking anyone for.
+            {
+                const canonical = delegation_1.DELEGATE_WORKER_OPENAI_SCHEMA?.function?.parameters;
+                const inlineParams = dshToolDef?.parameters;
+                if (canonical && canonical.properties && inlineParams && inlineParams.properties) {
+                    const a = Object.keys(canonical.properties).sort().join(',');
+                    const b = Object.keys(inlineParams.properties).sort().join(',');
+                    const reqA = JSON.stringify(canonical.required || []);
+                    const reqB = JSON.stringify(inlineParams.required || []);
+                    if (a !== b || reqA !== reqB) {
+                        throw new Error('delegate_worker schema drift: the inline parameters in index.ts disagree with ' +
+                            'DELEGATE_WORKER_OPENAI_SCHEMA in delegation.ts. ' +
+                            'Canonical: [' +
+                            a +
+                            '] required ' +
+                            reqA +
+                            '. Inline: [' +
+                            b +
+                            '] required ' +
+                            reqB +
+                            '. Add the parameter to BOTH or neither -- a parameter present in only one is silently ' +
+                            'dropped from the tool call, which is how attestTargets was lost the first time.');
+                    }
+                }
+            }
+            try {
+                ;
+                ctx.tools.register(dshToolDef);
+            }
+            catch (e) {
+                ;
+                ctx.tools.register('delegate_worker', dshToolDef, dshToolDef.execute);
+            }
+            console.log("[LOCAL_ROUTER_INIT] Tool 'delegate_worker' registered successfully on ctx.tools.");
+            logWorkerBenchmarks();
+        }
+        catch (e) {
+            console.warn("[LOCAL_ROUTER_INIT] Failed to register tool via ctx.tools.register:", e?.message || String(e));
+        }
+    }
+    else {
+        // There is NO fallback. The listener that used to sit here subscribed to `ctx.on('tool/call')`, which
+        // is not a Cordis hook at all: `tool/call` is a SESSION EVENT type, delivered through `session/event`,
+        // and an observer of the session log cannot answer a tool invocation in any case. So the fallback
+        // could never have run, and if `ctx.tools.register` ever fails this plugin simply has no tool.
+        console.warn('[LOCAL_ROUTER_INIT] ctx.tools is unavailable. There is no fallback path: this plugin can only ' +
+            'serve delegate_worker through ctx.tools.register.');
+    }
+    // Local-only code guard: refuse cloud-authored source writes so that all code
+    // work routes through delegate_worker to the local worker.
+    if (options?.localCodeGuard !== false) {
+        // Parameters inferred from the host's `tools/pre-execute` signature: `(exec: ToolExecution, next)`.
+        (0, host_events_1.onHost)(ctx, 'tools/pre-execute', async (exec, next) => {
+            // `as const` keeps `kind` the literal the host's `PreToolDecision` requires. Without it the object
+            // widens to `{ kind: string }` and the whole handler stops satisfying the host's signature -- which
+            // is what made this one line worth checking rather than assuming.
+            const decision = typeof next === 'function' ? await next() : { kind: 'allow' };
+            if (!decision || decision.kind !== 'allow')
+                return decision;
+            try {
+                const verdict = (0, guard_1.evaluateCodeWriteGuard)(exec, {
+                    askPaths: options?.guardAskPaths,
+                    delegatedPaths: contracts_1.delegatedPaths,
+                    delegateReadPolicy: options?.delegateReadPolicy,
+                    contractPaths: options?.contractPaths,
+                    contractWriteMode: options?.contractWriteMode,
+                });
+                if (verdict) {
+                    // guardMode 'deny' wins outright: an operator who said "never prompt" must
+                    // not be prompted just because this path would otherwise be ask-eligible.
+                    const wantsAsk = options?.guardMode !== 'deny' && (options?.guardMode === 'ask' || verdict.kind === 'ask');
+                    if (!wantsAsk) {
+                        console.log(`[LOCAL_GUARD] DENY ${exec?.name} -> ${verdict.target}`);
+                        return { kind: 'deny', reason: verdict.reason };
+                    }
+                    // Ask for real, through the approval seam. Only 'allowed-once' grants.
+                    const outcome = await requestApprovalForWrite(ctx, exec, verdict);
+                    if (outcome === 'allowed-once') {
+                        console.log(`[LOCAL_GUARD] ALLOWED-ONCE ${exec?.name} -> ${verdict.target}`);
+                        return decision;
+                    }
+                    console.log(`[LOCAL_GUARD] DENY (${outcome}) ${exec?.name} -> ${verdict.target}`);
+                    return {
+                        kind: 'deny',
+                        reason: `${verdict.reason} (approval outcome: ${outcome})`,
+                    };
+                }
+                // Observation, not enforcement: the architect is allowed to read source, and this records it.
+                // The guard above answers "may this happen"; this answers "did it, and who by" — which is what
+                // will later say whether that access is used at all, and so whether it can be taken away.
+                const observed = (0, roles_1.describeSourceRead)({
+                    tool: exec?.name,
+                    target: (0, guard_1.extractWriteTarget)(exec?.arguments),
+                    // The live agent is passed as well as its id, so the guard can read the host's session lineage
+                    // instead of relying only on the observed correlation. That is the whole of item 1: before
+                    // `Session.header` existed there was nothing to read, and the plugin said so.
+                    role: (0, roles_1.roleForAgent)(exec?.agent?.id, exec?.agent),
+                });
+                if (observed.track) {
+                    (0, logging_1.trace)('SOURCE_READ', {
+                        role: observed.role,
+                        agent: String(exec?.agent?.id ?? '').slice(0, 8) || 'unknown',
+                        tool: String(exec?.name ?? ''),
+                        target: observed.target,
+                        extension: observed.extension,
+                    });
+                }
+            }
+            catch (err) {
+                // Fail closed: a guard that cannot evaluate must not wave the call through.
+                console.warn('[LOCAL_GUARD] evaluation failed; failing closed:', err);
+                return {
+                    kind: 'deny',
+                    reason: `Local-code guard could not evaluate this call: ${err?.message || err}`,
+                };
+            }
+            return decision;
+        });
+        console.log('[LOCAL_ROUTER_INIT] Local-code guard registered on tools/pre-execute.');
+    }
+    // Egress control for READS: serve the type skeleton instead of the implementation.
+    //
+    // The write guard answers "may source be authored". This answers "may implementation BODIES leave the
+    // machine", which is a different question and was previously unanswered -- the architect could read any
+    // file it liked and nothing constrained it. It cannot be done at `tools/pre-execute`, because that
+    // decision type is only allow/deny/ask and rewriting arguments is excluded by the host's own comment on
+    // `PreToolDecision`. `tools/post-execute` can replace the model-facing content, which is exactly "serve
+    // the declaration instead", so that is where it lives.
+    if (options?.sourceReadEgress === 'declarations') {
+        const declarationRoot = options?.declarationRoot;
+        if (!declarationRoot || !String(declarationRoot).trim()) {
+            console.warn('[LOCAL_EGRESS] sourceReadEgress is "declarations" but no declarationRoot was configured, so reads are ' +
+                'being SERVED AS SOURCE. Set declarationRoot, or this setting does nothing.');
+        }
+        else {
+            (0, host_events_1.onHost)(ctx, 'tools/post-execute', async (exec, result, next) => {
+                const decision = typeof next === 'function' ? await next() : { kind: 'accept' };
+                if (!decision || decision.kind !== 'accept')
+                    return decision;
+                try {
+                    const name = String(exec?.name || '');
+                    const egressDecision = (0, declaration_egress_hook_1.handleDeclarationPostExecute)(exec, options);
+                    if (egressDecision)
+                        return egressDecision;
+                    if (!guard_1.READ_TOOLS.has(name))
+                        return decision;
+                    if (result?.isError)
+                        return decision;
+                    const target = (0, guard_1.extractWriteTarget)(exec?.arguments);
+                    if (!target)
+                        return decision;
+                    const skeleton = (0, guard_1.declarationPathFor)(target, String(declarationRoot));
+                    // Not a source file: nothing to strip, so the read stands.
+                    if (!skeleton)
+                        return decision;
+                    // STALENESS. Until this check existed, the egress control trusted the build: it verified that a
+                    // declaration EXISTED at the derived path, never that the declaration described the source being
+                    // read. Edit an interface, skip the rebuild, and the architect would be served yesterday's
+                    // signature while believing it was current -- green for the same reason every false green here has
+                    // been green, because nothing checked the thing that mattered.
+                    //
+                    // Read the predicate rather than the summary: mtime is evidence of a rebuild, not proof of a
+                    // match, and `staleDeclarationReason` says so at length.
+                    const stale = (0, guard_1.staleDeclarationReason)(target, skeleton);
+                    if (stale) {
+                        return {
+                            kind: 'block',
+                            feedback: [
+                                {
+                                    type: 'text',
+                                    text: "Reading '" +
+                                        target +
+                                        "' was refused: " +
+                                        stale +
+                                        '. Rebuild the declarations (tsc --declaration --emitDeclarationOnly) and read again. ' +
+                                        'Serving a stale declaration would let this context plan against a contract the code no ' +
+                                        'longer implements.',
+                                },
+                            ],
+                        };
+                    }
+                    let content;
+                    try {
+                        content = fs.readFileSync(skeleton, 'utf8');
+                    }
+                    catch {
+                        // Fail closed. A file with no emitted declaration is refused rather than served as source,
+                        // because serving it would be the exact leak this control exists to prevent.
+                        return {
+                            kind: 'block',
+                            feedback: [
+                                {
+                                    type: 'text',
+                                    text: "Reading '" +
+                                        target +
+                                        "' was refused: sourceReadEgress is 'declarations' and no type skeleton exists at '" +
+                                        skeleton +
+                                        ". " +
+                                        // A TEST FILE HAS NO DECLARATION BY CONSTRUCTION. tsconfig.json sets rootDir ./src and
+                                        // include [src/**/*], so a file under tests/ is outside the emit root and NO build will ever
+                                        // produce its .d.ts. The original message told the reader to rebuild and retry, which is
+                                        // unachievable for exactly the files most likely to be refused -- a remediation loop with no
+                                        // exit. Separators are doubled below because this is a regex literal.
+                                        (/(?:^|[\\/])tests?(?:[\\/]|$)/i.test(target)
+                                            ? 'Test files live outside the declaration root and emit no skeleton, so no build will produce one. Inspect it in a local editor, or turn sourceReadEgress off in the profile patch (which needs a DSH restart).'
+                                            : 'Build the declarations with npm run build, or read the declaration path directly.') +
+                                        ' Implementation bodies are not served to this context.',
+                                },
+                            ],
+                        };
+                    }
+                    (0, logging_1.trace)('SOURCE_DECLARATION_SERVED', {
+                        tool: name,
+                        requested: String(exec?.arguments?.file_path || exec?.arguments?.path || target),
+                        served: skeleton,
+                        bytes: Buffer.byteLength(content, 'utf8'),
+                    });
+                    return {
+                        kind: 'accept',
+                        content: [
+                            {
+                                type: 'text',
+                                text: '// SERVED AS TYPE DECLARATIONS, NOT SOURCE. Implementation bodies are withheld by policy ' +
+                                    '(sourceEgress: declarations).\n// Declaration file: ' +
+                                    skeleton +
+                                    '\n\n' +
+                                    content,
+                            },
+                        ],
+                    };
+                }
+                catch (err) {
+                    // Fail closed for the same reason the write guard does: an egress filter that cannot evaluate
+                    // must not wave the read through.
+                    console.warn('[LOCAL_EGRESS] evaluation failed; refusing the read:', err);
+                    return {
+                        kind: 'block',
+                        feedback: [
+                            { type: 'text', text: 'Read refused: the source-egress filter could not evaluate this call.' },
+                        ],
+                    };
+                }
+            });
+            console.log('[LOCAL_ROUTER_INIT] Source egress control registered on tools/post-execute.');
+        }
+    }
+    // 1. Lightweight agent/pre-step prompt capture & DLP scanner ONLY
+    (0, host_events_1.onHost)(ctx, 'agent/pre-step', async (payload, next) => {
+        const turn = payload?.turn;
+        const prompt = extractTextFromClaimedMessages(payload?.messages);
+        if (turn !== undefined && prompt) {
+            rememberTurnPrompt(payload, turn, prompt);
+            accumulateCorpus(corpusKeyFor(payload), prompt);
+            (0, logging_1.trace)('HOOK_CAPTURE: PROMPT_CAPTURED (agent/pre-step)', {
+                turn,
+                prompt: prompt.slice(0, 100),
+            });
+        }
+        // The host types `next` as always a function, so the `payload` branch is a runtime guard the types
+        // cannot see through -- and `payload` is not a `PreStepDecision`, so it never was a valid answer.
+        // Asserted rather than deleted: if the guard ever fires, passing the payload through is still the
+        // least surprising thing to do, and this line now says out loud that it is unverified.
+        return typeof next === 'function' ? await next() : payload;
+    }, { prepend: true });
+    // Context-quality counters: the measurement that turns "your GPU does the typing" into an observation
+    // rather than an argument.
+    //
+    // DSH publishes every session event on a `session/event` firehose, and its own session service
+    // documents observation as "a plugin concern (subscribe to `session/event`)". So this needs no injected
+    // service, which is what keeps the plugin's `inject` list -- and the oracle that asserts it -- unchanged.
+    //
+    // Counted per session, traced on the events that move the figures. The reclaimed-token number comes
+    // from the host (`shadowedTokenCount` on `compaction/summary` and `compaction/prune`), so it is
+    // reported rather than estimated.
+    //
+    // One limit worth knowing while reading the trace: events that entered through construction (replay,
+    // fork, resume) are not published on this firehose, so a resumed session is counted from the resume
+    // rather than from its true beginning. Recorded in `docs/findings.md`.
+    const contextQuality = new Map();
+    const qualityKeyFor = (session) => {
+        const id = session?.id ?? session?.header?.id;
+        return typeof id === 'string' && id.length > 0 ? id : '__global__';
+    };
+    // Parameters inferred from the host's `session/event` signature: `(session: Session, event: SessionEvent)`.
+    (0, host_events_1.onHost)(ctx, 'session/event', (session, event) => {
+        const key = qualityKeyFor(session);
+        const current = contextQuality.get(key) ?? context_quality_1.EMPTY_CONTEXT_QUALITY;
+        const next = (0, context_quality_1.foldContextQuality)(current, event);
+        if (next === current)
+            return;
+        contextQuality.set(key, next);
+        const type = String(event?.type ?? '');
+        // The traced subset lives in `session-events.ts` beside the folded vocabulary, where both lists are
+        // checked against the host's own `SessionEventMap`. Two hand-written copies of these names used to sit
+        // in this plugin, and only one of them was ever going to get updated.
+        if (session_events_1.TRACED_EVENTS.has(type)) {
+            (0, logging_1.trace)('CONTEXT_QUALITY', {
+                // DSH ids are `session-<uuid>`, so the first eight characters are the constant prefix and
+                // identify nothing -- every session logged as "session-". Take the eight AFTER the prefix.
+                session: key.startsWith('session-') ? key.slice(8, 16) : key.slice(0, 8),
+                event: type,
+                summary: (0, context_quality_1.describeContextQuality)(next),
+            });
+            // Once per turn, the compounding figure: content the worker produced and the architect never carried,
+            // multiplied by the model calls it would have ridden on. The currency is context, not money -- see
+            // `docs/experiment.md` for why the ledger stopped quoting dollars. `turn/start` is used because it is
+            // already folded and traced, so this costs one branch rather than a second event subscription.
+            if (type === 'turn/start') {
+                (0, logging_1.trace)('CONTEXT_HYGIENE', {
+                    session: key.startsWith('session-') ? key.slice(8, 16) : key.slice(0, 8),
+                    line: tracker.contextHygiene(next.steps).line,
+                });
+            }
+        }
+    });
+    // 2. Primary Thread (Architect) Request Hook: Pin primary thread to DeepSeek Cloud with native uncapped context and tool schema injection
+    (0, host_events_1.onHost)(ctx, 'agent/request', 
+    // Parameters deliberately NOT annotated: both are inferred from the host's own signature for
+    // `agent/request`, so reading a field the host does not send is now a compile error here.
+    async (payload, next) => {
+        // `next` is typed by the host as always a function, so the `{}` fallback is a runtime guard the
+        // types cannot see through. Widening this local keeps the guard without pretending the branch is
+        // reachable; everything else in this handler stays typed.
+        const resolvedConfig = typeof next === 'function' ? await next() : {};
+        const turn = payload?.turn;
+        const agent = payload?.agent;
+        let prompt = (turn !== undefined ? pendingTurnPrompts.get(turnPromptKey(payload, turn)) : '') || '';
+        if (turn !== undefined) {
+            pendingTurnPrompts.delete(turnPromptKey(payload, turn));
+        }
+        if (!prompt) {
+            try {
+                if (agent?.inbox?.nextTurn && Array.isArray(agent.inbox.nextTurn) && agent.inbox.nextTurn.length > 0) {
+                    const item = agent.inbox.nextTurn[agent.inbox.nextTurn.length - 1];
+                    prompt = item?.prompt || item?.text || item?.content || '';
+                }
+            }
+            catch { }
+        }
+        if (!prompt && agent?.session)
+            prompt = (0, delegation_1.extractPromptText)(agent.session);
+        // `payload?.session` used to be tried here. The host's `agent/request` payload is
+        // `{ agent, turn, step, signal }` -- there is no `session` on it, so that fallback never matched a
+        // single request. Found by typing the handler against the host's own signature rather than by review.
+        if (!prompt && payload)
+            prompt = (0, delegation_1.extractPromptText)(payload);
+        // Pre-flight DLP Firewall. This is a GATE, not a log line: a payload carrying
+        // credentials is either refused outright or pinned to the local worker, but it
+        // is never transmitted to the cloud. (Earlier versions logged "Blocking WAN
+        // transmission" and then sent the payload anyway.)
+        // Scan everything this session has said, not just the newest message: the host
+        // re-sends the conversation on every request, so a clean latest message is not
+        // evidence that the outbound payload is clean.
+        const corpus = sessionPromptCorpus.get(corpusKeyFor(payload)) || '';
+        const dlpSubject = corpus.length > prompt.length ? corpus : prompt;
+        const dlpResult = scanDLP(dlpSubject, {
+            entropyCheck: options?.entropyCheck,
+            entropyMinBitsPerChar: options?.entropyMinBitsPerChar,
+            entropyMinLength: options?.entropyMinLength,
+        });
+        const dlpTripped = config.enforceDLP && dlpResult.hasSensitiveData;
+        // Entropy-only hits are medium confidence: always rerouted local (so they are
+        // never transmitted) but never hard-blocked, because digests and base64 payloads
+        // are legitimate content that merely looks random.
+        const entropyOnly = dlpTripped && !dlpResult.highConfidence;
+        // WHERE THIS WILL ACTUALLY LAND, decided before the role is applied and before anything is
+        // transmitted. The reroute used to be committed here on entropy alone, which in the documented
+        // cloud-only setup pinned the payload to the provider it was meant to be kept away from.
+        // `classifyDestination` refuses instead when a reroute was requested but there is no distinct
+        // local provider, or when the policy says block.
+        const classification = (0, routing_1.classifyDestination)({
+            provider: resolvedConfig?.provider || '',
+            localProvider: config.localProvider,
+            cloudProvider: config.cloudProvider,
+            dlpTripped,
+            entropyOnly,
+            dlpAction: options?.dlpAction,
+        });
+        if (classification.decision === 'block') {
+            // Name the pattern, not just the policy. An earlier throw said "credentials detected (API Key)",
+            // and dropping that to a bare classification reason cost a test that asserts the message names
+            // the offending pattern -- which is also what tells an operator what to remove.
+            const violations = dlpResult.violations.join(', ');
+            const why = violations
+                ? 'credentials detected (' + violations + '). ' + (classification.reason || '')
+                : classification.reason || 'policy says block';
+            console.error('[DLP_FIREWALL_BLOCK] Refusing to transmit: ' + why + '. Nothing was sent to the cloud.');
+            throw new Error('DLP firewall blocked this request: ' + why +
+                '. Nothing was transmitted. This gate scans every user message it has seen in this session, ' +
+                "so a credential that appeared in an earlier turn keeps blocking until the session is restarted.");
+        }
+        const rerouteLocal = classification.rerouteLocal;
+        if (dlpTripped) {
+            const violations = dlpResult.violations.join(', ');
+            (0, logging_1.trace)('DLP_FIREWALL_TRIPPED', {
+                violations,
+                action: rerouteLocal ? 'reroute-local' : 'block',
+                confidence: dlpResult.highConfidence ? 'high' : 'entropy-only',
+                prompt: prompt.slice(0, 100),
+            });
+            // The old shouldBlock branch stood here. It is dead: the classification above already threw for
+            // the same two cases -- a reroute requested with no distinct local provider, and an explicit
+            // block policy -- and it throws with a reason that names the actual cause.
+            console.warn(`[DLP_FIREWALL_REROUTE] Sensitive data (${violations}) pinned to the LOCAL worker; it will not reach the WAN.`);
+        }
+        // Which role is this request? The plugin used to treat every agent as the architect, which is
+        // right for the architect and wrong for everything else: a lead configured to run locally would
+        // be repinned to the cloud and told it was the architect. The DLP gate above runs either way, so
+        // opting a provider out of the architect role does not opt it out of the firewall.
+        const role = (0, roles_1.resolveAgentRole)({
+            hostProvider: resolvedConfig?.provider,
+            leadProviders: (0, roles_1.resolveLeadProviders)(options),
+        });
+        // Correlate the role with the agent, so a later tool call can be attributed. Best effort by
+        // construction: the host does not expose lineage, so this is the plugin's own inference.
+        (0, roles_1.rememberAgentRole)(agent?.id, role.role);
+        const mutatedConfig = (0, roles_1.applyAgentRole)(resolvedConfig || {}, role, {
+            cloudProvider: config.cloudProvider,
+            cloudModel: config.cloudModel,
+            localProvider: config.localProvider,
+            localModel: config.localModel,
+            rerouteLocal,
+            architectInstruction: profiles_1.PROFILES.ARCHITECT.systemInstruction,
+            workerTool: delegation_1.DELEGATE_WORKER_OPENAI_SCHEMA,
+        });
+        // Rule 8: source may not reach the cloud. The read guard covers pulling delegated code back, and
+        // contextFiles injects into the worker; this covers the blunt route — source sitting in the
+        // outbound payload because it was typed into a cloud-bound conversation.
+        const destination = rerouteLocal ||
+            String(mutatedConfig.provider || '').toLowerCase() ===
+                String(config.localProvider || '').toLowerCase()
+            ? 'local'
+            : 'cloud';
+        const egressDetection = (0, roles_1.detectSourceEgress)(dlpSubject, {
+            minLines: options?.sourceEgressMinLines,
+        });
+        const egress = (0, roles_1.evaluateSourceEgress)(options?.sourceEgress ?? 'deny', egressDetection, destination);
+        if (egress.kind !== 'allow') {
+            let permitted = false;
+            if (egress.kind === 'ask') {
+                try {
+                    const approvalService = typeof ctx?.get === 'function' ? ctx.get('approval') : undefined;
+                    if (approvalService && typeof approvalService.request === 'function' && agent) {
+                        const outcome = await approvalService.request({
+                            agent,
+                            toolName: 'agent/request',
+                            reason: `This cloud-bound request carries source: ${egress.reason} Source is not supposed ` +
+                                `to reach the cloud (rule 8). Approve only if you mean to transmit it.`,
+                            ...(payload?.signal ? { signal: payload.signal } : {}),
+                        });
+                        permitted = outcome === 'allowed-once';
+                    }
+                }
+                catch (err) {
+                    console.warn('[SOURCE_EGRESS] approval request failed; failing closed:', err?.message || err);
+                    permitted = false;
+                }
+            }
+            if (!permitted) {
+                (0, logging_1.trace)('SOURCE_EGRESS_BLOCKED', {
+                    blocks: egressDetection.blocks,
+                    languages: egressDetection.languages,
+                    destination,
+                    action: options?.sourceEgress ?? 'deny',
+                });
+                throw new Error(`Source may not reach the cloud (rule 8): ${egress.reason} Nothing was transmitted. ` +
+                    `This gate reads every user message the session has sent, so a block from an earlier ` +
+                    `turn keeps it closed until the session is restarted.`);
+            }
+        }
+        (0, logging_1.trace)(role.role === 'lead'
+            ? 'HOOK_EXIT: LEAD_LEFT_AS_CONFIGURED (agent/request)'
+            : rerouteLocal
+                ? 'HOOK_EXIT: DLP_PINNED_LOCAL (agent/request)'
+                : 'HOOK_EXIT: ARCHITECT_CLOUD_PINNED (agent/request)', {
+            role: role.role,
+            roleReason: role.reason,
+            provider: mutatedConfig.provider,
+            model: mutatedConfig.model,
+            uncappedContextWindow: role.role === 'architect',
+            toolsCount: mutatedConfig.tools?.length || 0,
+        });
+        // The host expects `LlmCallConfig` here. `applyAgentRole` returns a looser record, so this is an
+        // ASSERTION rather than a check: the plugin cannot prove it returns a valid config, and DSH does not
+        // verify it either. Named rather than hidden -- the payload on the way in IS checked, which is where
+        // the dead `payload.session` read was found.
+        return mutatedConfig;
+    }, { prepend: true });
+    // Architect usage is deliberately NOT recorded in this ledger. Three subscriptions that tried to are
+    // gone, because none of them could ever have fired -- checked against the installed host, not assumed:
+    //
+    //   `agent/post-step` and `agent/step-finish` do not exist. Neither name appears anywhere in the
+    //   installed `@deepseek-ai/*` packages; this plugin invented them.
+    //
+    //   `agent/assistant-stream` does exist, but its frames are `start` / `chunk` / `end`
+    //   (`AssistantStreamFrame` in `dsh-agent`) and none carries `usage`. That stream is "presentation data
+    //   rather than the replay source"; the durable settlement is `assistant/message`, which does carry
+    //   `usage?: TokenUsage`.
+    //
+    // So `cloudTurns`, `architectTurns`, `totalCloudTokens` and `totalSpendUSD` are permanently zero, and
+    // the ledger's `scope` field now says so rather than leaving them to read as measured data.
+    //
+    // Reviving them was considered and rejected, not overlooked. It would mean a ledger write on every
+    // architect model call -- 980 in one observed session -- to produce a dollar figure this plugin no
+    // longer claims anything about. The architect side *is* measured, by the context-quality fold off the
+    // same `session/event` subscription used above; it is measured as context, and it is not money.
+    //
+    // The general fix for this whole class -- a subscription to an event the host does not emit -- is to
+    // type `ctx.on` against the host's `Events` interface so that such a name cannot compile. That is the
+    // open half of the host contract: ROADMAP item 21 covers session event TYPES, not hook names.
+}
+// The patch engine is configured inside ./delegation.ts, where both halves now live.
+const pluginExport = {
+    name: exports.name,
+    inject: exports.inject,
+    using: exports.using,
+    apply,
+    LocalRouter,
+    SavingsTracker: savings_tracker_1.SavingsTracker,
+    scanDLP,
+    delegateWorker: delegation_1.delegateWorker,
+    extractAndEmitFiles: emission_1.extractAndEmitFiles,
+    runSandboxVerification: verification_1.runSandboxVerification,
+    parseTestOutput: verification_1.parseTestOutput,
+    sha256File: contracts_1.sha256File,
+    resolveContextFiles: context_1.resolveContextFiles,
+    parseSearchReplaceBlocks: delegation_1.parseSearchReplaceBlocks,
+    applySearchReplaceBlocks: delegation_1.applySearchReplaceBlocks,
+    MIN_SEARCH_CHARS: delegation_1.MIN_SEARCH_CHARS,
+    DEFAULT_CONTEXT_MAX_BYTES: context_1.DEFAULT_CONTEXT_MAX_BYTES,
+    resolveContractFiles: contracts_1.resolveContractFiles,
+    contractFileHashes: contracts_1.contractFileHashes,
+    contractViolations: contracts_1.contractViolations,
+    resolveDelegateStatus: delegation_1.resolveDelegateStatus,
+    resolveVerificationRepeats: delegation_1.resolveVerificationRepeats,
+    MAX_VERIFICATION_REPEATS: delegation_1.MAX_VERIFICATION_REPEATS,
+    resolveLeadProviders: roles_1.resolveLeadProviders,
+    evaluateDelegatedReadPolicy: guard_1.evaluateDelegatedReadPolicy,
+    rememberAgentRole: roles_1.rememberAgentRole,
+    roleForAgent: roles_1.roleForAgent,
+    resetAgentRoles: roles_1.resetAgentRoles,
+    describeSourceRead: roles_1.describeSourceRead,
+    AGENT_ROLE_LIMIT: roles_1.AGENT_ROLE_LIMIT,
+    detectSourceEgress: roles_1.detectSourceEgress,
+    evaluateSourceEgress: roles_1.evaluateSourceEgress,
+    DEFAULT_SOURCE_EGRESS_MIN_LINES: roles_1.DEFAULT_SOURCE_EGRESS_MIN_LINES,
+    resolveDelegatedRegistryPath: contracts_1.resolveDelegatedRegistryPath,
+    parseDelegatedRegistry: contracts_1.parseDelegatedRegistry,
+    mergeDelegatedRecords: contracts_1.mergeDelegatedRecords,
+    pruneDelegatedRecords: contracts_1.pruneDelegatedRecords,
+    saveDelegatedRegistry: contracts_1.saveDelegatedRegistry,
+    loadDelegatedRegistry: contracts_1.loadDelegatedRegistry,
+    rememberDelegated: contracts_1.rememberDelegated,
+    resolveAgentRole: roles_1.resolveAgentRole,
+    applyArchitectConfig: roles_1.applyArchitectConfig,
+    applyAgentRole: roles_1.applyAgentRole,
+    DELEGATE_WORKER_SCHEMA: delegation_1.DELEGATE_WORKER_SCHEMA,
+    DELEGATE_WORKER_OPENAI_SCHEMA: delegation_1.DELEGATE_WORKER_OPENAI_SCHEMA,
+    PROFILES: profiles_1.PROFILES,
+    default: apply,
+};
+exports.default = pluginExport;