dsh-plugin-coding-delegate 0.0.0-stage → 0.2.2

package/dist/local-classifier.d.ts

@@ -0,0 +1,52 @@
+export type ClassifierRoute = 'local' | 'cloud';
+export interface ClassifierScores {
+    is_private: number;
+    complexity: number;
+    target: 'LOCAL_5090' | 'CLOUD_DEEPSEEK';
+}
+export interface ClassifierDecision {
+    route: ClassifierRoute;
+    rationale: string;
+    gate: string;
+    scores: ClassifierScores;
+    latencyMs: number;
+}
+/**
+ * The single source of truth for credential detection, shared by this classifier and
+ * the enforced DLP gate in index.ts. One table, so the gate that decides whether a
+ * payload may leave the machine can never be weaker than the one that reports on it.
+ *
+ * Patterns are deliberately NOT global: a `/g` regex carries `lastIndex` between
+ * `.test()` calls and silently alternates between matching and not matching.
+ */
+export declare const SECRET_PATTERN_RULES: {
+    name: string;
+    pattern: RegExp;
+}[];
+/** Convenience view of {@link SECRET_PATTERN_RULES} for callers that want patterns only. */
+export declare const SECRET_PATTERNS: RegExp[];
+/** Shannon entropy in bits per character. */
+export declare function shannonEntropy(value: string): number;
+/** Bits per character above which a token is treated as suspiciously random. */
+export declare const ENTROPY_MIN_BITS_PER_CHAR = 4.5;
+/** Tokens shorter than this are too noisy to score. */
+export declare const ENTROPY_MIN_LENGTH = 20;
+/**
+ * The backstop for credentials no keyword or vendor pattern would reveal.
+ *
+ * Thresholds are measured, not guessed: on a corpus containing sha256 digests, base64
+ * payloads, UUIDs, git SHAs, long file paths, prose and minified CSS, 4.5 bits/char at
+ * length >= 20 caught every sampled secret with zero false positives. Random keys sit
+ * near 5.2 bits/char; the noise sat at 4.2-4.4. Re-tune against a real corpus before
+ * trusting the boundary in a new codebase.
+ */
+export declare function findHighEntropyTokens(text: string, options?: {
+    minBitsPerChar?: number;
+    minLength?: number;
+}): string[];
+export declare function containsSensitiveCredentials(text: string): boolean;
+export declare function evaluateHeuristics(promptSlice: string, secretScanText?: string): ClassifierScores;
+export declare function classifyLocally(promptText: string, options?: {
+    windowChars?: number;
+    scanFullTextForSecrets?: boolean;
+}): ClassifierDecision;

package/dist/local-classifier.js

@@ -0,0 +1,159 @@
+"use strict";
+// The credential scan intentionally covers the WHOLE prompt while the complexity window stays bounded.
+// A credential near the start of a long file must not escape detection, so we scan the full text for secrets.
+// The complexity window remains bounded to keep heuristic scoring fast and predictable.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENTROPY_MIN_LENGTH = exports.ENTROPY_MIN_BITS_PER_CHAR = exports.SECRET_PATTERNS = exports.SECRET_PATTERN_RULES = void 0;
+exports.shannonEntropy = shannonEntropy;
+exports.findHighEntropyTokens = findHighEntropyTokens;
+exports.containsSensitiveCredentials = containsSensitiveCredentials;
+exports.evaluateHeuristics = evaluateHeuristics;
+exports.classifyLocally = classifyLocally;
+/**
+ * The single source of truth for credential detection, shared by this classifier and
+ * the enforced DLP gate in index.ts. One table, so the gate that decides whether a
+ * payload may leave the machine can never be weaker than the one that reports on it.
+ *
+ * Patterns are deliberately NOT global: a `/g` regex carries `lastIndex` between
+ * `.test()` calls and silently alternates between matching and not matching.
+ */
+exports.SECRET_PATTERN_RULES = [
+    { name: 'Private Key Block', pattern: /-----BEGIN (?:RSA |EC |OPENSSH |PGP |)PRIVATE KEY-----/i },
+    {
+        name: 'Generic Secret Keyword',
+        pattern: /(?:api_key|apikey|secret_key|private_key|auth_token|access_token|password)\s*[:=]\s*['"]?[A-Za-z0-9_\-\.]{8,}/i,
+    },
+    { name: 'GitHub PAT', pattern: /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36}/i },
+    { name: 'Fine-grained GitHub PAT', pattern: /github_pat_[A-Za-z0-9_]{20,}/i },
+    { name: 'OpenAI/DeepSeek API Key', pattern: /sk-[a-zA-Z0-9]{32,}/i },
+    { name: 'AWS Access Key', pattern: /AKIA[0-9A-Z]{16}/i },
+    { name: 'Slack Token', pattern: /xox[baprs]-[a-zA-Z0-9]{10,}/i },
+];
+/** Convenience view of {@link SECRET_PATTERN_RULES} for callers that want patterns only. */
+exports.SECRET_PATTERNS = exports.SECRET_PATTERN_RULES.map((rule) => rule.pattern);
+/** Shannon entropy in bits per character. */
+function shannonEntropy(value) {
+    if (!value)
+        return 0;
+    const counts = new Map();
+    for (const ch of value)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        entropy -= p * Math.log2(p);
+    }
+    return entropy;
+}
+/** Bits per character above which a token is treated as suspiciously random. */
+exports.ENTROPY_MIN_BITS_PER_CHAR = 4.5;
+/** Tokens shorter than this are too noisy to score. */
+exports.ENTROPY_MIN_LENGTH = 20;
+/** Runs worth scoring: base64-ish and hex-ish token shapes. */
+const ENTROPY_TOKEN = /[A-Za-z0-9+/_=-]{20,}/g;
+/**
+ * The backstop for credentials no keyword or vendor pattern would reveal.
+ *
+ * Thresholds are measured, not guessed: on a corpus containing sha256 digests, base64
+ * payloads, UUIDs, git SHAs, long file paths, prose and minified CSS, 4.5 bits/char at
+ * length >= 20 caught every sampled secret with zero false positives. Random keys sit
+ * near 5.2 bits/char; the noise sat at 4.2-4.4. Re-tune against a real corpus before
+ * trusting the boundary in a new codebase.
+ */
+function findHighEntropyTokens(text, options = {}) {
+    if (!text)
+        return [];
+    const minBits = options.minBitsPerChar ?? exports.ENTROPY_MIN_BITS_PER_CHAR;
+    const minLength = options.minLength ?? exports.ENTROPY_MIN_LENGTH;
+    const found = [];
+    for (const token of text.match(ENTROPY_TOKEN) ?? []) {
+        if (token.length < minLength)
+            continue;
+        if (shannonEntropy(token) >= minBits)
+            found.push(token);
+    }
+    return found;
+}
+function containsSensitiveCredentials(text) {
+    if (!text)
+        return false;
+    for (const pattern of exports.SECRET_PATTERNS) {
+        if (pattern.test(text))
+            return true;
+    }
+    return false;
+}
+const COMPLEX_WORDS = [
+    'refactor',
+    'architecture',
+    'async',
+    'thread',
+    'concurrency',
+    'distributed',
+    'kubernetes',
+    'algorithm',
+    'optimization',
+    'recursion',
+    'deadlock',
+];
+function evaluateHeuristics(promptSlice, secretScanText) {
+    const slice = String(promptSlice ?? '');
+    const lines = slice.split('\n').length;
+    const length = slice.length;
+    const lower = slice.toLowerCase();
+    let complexCount = 0;
+    for (const word of COMPLEX_WORDS) {
+        if (lower.includes(word))
+            complexCount++;
+    }
+    let complexity;
+    if (length > 3000 || lines > 100 || complexCount >= 3) {
+        complexity = 3;
+    }
+    else if (length > 1200 || lines > 40 || complexCount >= 1) {
+        complexity = 2;
+    }
+    else if (length > 400) {
+        complexity = 1;
+    }
+    else {
+        complexity = 0;
+    }
+    const target = complexity >= 2 ? 'CLOUD_DEEPSEEK' : 'LOCAL_5090';
+    const scanText = secretScanText ?? slice;
+    const is_private = containsSensitiveCredentials(scanText) ? 0.99 : 0.05;
+    return { is_private, complexity, target };
+}
+function classifyLocally(promptText, options) {
+    const start = performance.now();
+    const windowChars = options?.windowChars ?? 2000;
+    const scanFullTextForSecrets = options?.scanFullTextForSecrets ?? true;
+    const fullText = String(promptText ?? '');
+    const window = fullText.slice(-windowChars);
+    const scores = evaluateHeuristics(window, scanFullTextForSecrets ? fullText : window);
+    let route;
+    let gate;
+    let rationale;
+    if (scores.is_private > 0.8) {
+        route = 'local';
+        gate = 'Gate 1 (Local Classifier - Privacy Protection)';
+        rationale = `Privacy threshold exceeded (P(private) = ${scores.is_private.toFixed(2)} > 0.80). Routing to the local worker.`;
+    }
+    else if (scores.complexity >= 2) {
+        route = 'cloud';
+        gate = 'Gate 1 (Local Classifier - High Complexity)';
+        rationale = `High complexity score (complexity = ${scores.complexity} >= 2). Routing to DeepSeek Cloud.`;
+    }
+    else if (scores.target === 'CLOUD_DEEPSEEK') {
+        route = 'cloud';
+        gate = 'Gate 1 (Local Classifier - Model Target Choice)';
+        rationale = 'Target choice evaluated as CLOUD_DEEPSEEK. Routing to DeepSeek Cloud.';
+    }
+    else {
+        route = 'local';
+        gate = 'Gate 1 (Local Classifier - Local Default)';
+        rationale = "Request fits within the configured local model's capabilities. Routing to the local worker.";
+    }
+    const latencyMs = Math.round((performance.now() - start) * 100) / 100;
+    return { route, rationale, gate, scores, latencyMs };
+}

package/dist/logging.d.ts

@@ -0,0 +1,21 @@
+/**
+ * All plugin state (debug log, savings ledger) lives under one derived directory.
+ * It must never be a hard-coded absolute path: the previous build wrote its log
+ * into the plugin author's own project directory on every machine, which was
+ * correct on exactly one of them.
+ * Precedence: explicit env override, then DSH_HOME, then ~/.dsh.
+ */
+export declare function resolveDataDir(): string;
+/**
+ * Remove prompt text from a trace payload before it is written to disk.
+ *
+ * A debug log outlives the session, and call sites pass a prompt slice into it. No prompt content may
+ * be persisted, so the value is replaced with its length rather than scanned for secrets: pattern
+ * detection has false negatives, and a replacement is a guarantee where a pattern is a probability.
+ * Every other field is preserved, because redaction that succeeds by writing nothing removes the
+ * diagnostic value the log exists for.
+ *
+ * Pure and exported so it is testable directly. The caller's object is not mutated.
+ */
+export declare function redactTracePayload(data: any): any;
+export declare function trace(event: string, data: any): void;

package/dist/logging.js

@@ -0,0 +1,90 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveDataDir = resolveDataDir;
+exports.redactTracePayload = redactTracePayload;
+exports.trace = trace;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * All plugin state (debug log, savings ledger) lives under one derived directory.
+ * It must never be a hard-coded absolute path: the previous build wrote its log
+ * into the plugin author's own project directory on every machine, which was
+ * correct on exactly one of them.
+ * Precedence: explicit env override, then DSH_HOME, then ~/.dsh.
+ */
+function resolveDataDir() {
+    const explicit = process.env.DSH_LOCAL_ROUTER_DATA_DIR;
+    if (explicit && explicit.trim())
+        return explicit.trim();
+    const dshHome = process.env.DSH_HOME;
+    if (dshHome && dshHome.trim())
+        return path.join(dshHome.trim(), 'local-router');
+    return path.join(os.homedir(), '.dsh', 'local-router');
+}
+const LOG_FILE = path.join(resolveDataDir(), 'router-debug.log');
+/**
+ * Remove prompt text from a trace payload before it is written to disk.
+ *
+ * A debug log outlives the session, and call sites pass a prompt slice into it. No prompt content may
+ * be persisted, so the value is replaced with its length rather than scanned for secrets: pattern
+ * detection has false negatives, and a replacement is a guarantee where a pattern is a probability.
+ * Every other field is preserved, because redaction that succeeds by writing nothing removes the
+ * diagnostic value the log exists for.
+ *
+ * Pure and exported so it is testable directly. The caller's object is not mutated.
+ */
+function redactTracePayload(data) {
+    if (!data || typeof data !== 'object' || Array.isArray(data))
+        return data;
+    const copy = { ...data };
+    if (typeof copy.prompt === 'string') {
+        copy.prompt = 'prompt suppressed (' + copy.prompt.length + ' chars)';
+    }
+    return copy;
+}
+function trace(event, data) {
+    const timestamp = new Date().toISOString();
+    const payload = redactTracePayload(data);
+    const entry = '\n[' + timestamp + '] === ' + event + ' ===\n' +
+        (typeof payload === 'string' ? payload : JSON.stringify(payload, null, 2)) +
+        '\n';
+    try {
+        fs.mkdirSync(path.dirname(LOG_FILE), { recursive: true });
+        fs.appendFileSync(LOG_FILE, entry, 'utf8');
+    }
+    catch (err) { }
+}

package/dist/paths.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Resolve `p` to a canonical path, following symlinks for the part of it that exists.
+ * A destination that does not exist yet has no realpath of its own, so the deepest
+ * existing ancestor is resolved and the remaining segments are re-appended.
+ */
+export declare function canonicalisePath(p: string): string;
+/** True when `candidate` is `root` itself or lives beneath it. Case-insensitive on Windows. */
+export declare function isPathWithin(root: string, candidate: string): boolean;
+/** Extensions treated as source code: writes must come from the local worker. */
+export declare const CODE_EXTENSIONS: Set<string>;

package/dist/paths.js

@@ -0,0 +1,83 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODE_EXTENSIONS = void 0;
+exports.canonicalisePath = canonicalisePath;
+exports.isPathWithin = isPathWithin;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Resolve `p` to a canonical path, following symlinks for the part of it that exists.
+ * A destination that does not exist yet has no realpath of its own, so the deepest
+ * existing ancestor is resolved and the remaining segments are re-appended.
+ */
+function canonicalisePath(p) {
+    let current = path.resolve(p);
+    const tail = [];
+    for (;;) {
+        if (fs.existsSync(current))
+            break;
+        const parent = path.dirname(current);
+        if (parent === current)
+            break;
+        tail.unshift(path.basename(current));
+        current = parent;
+    }
+    try {
+        current = fs.realpathSync(current);
+    }
+    catch {
+        // An unresolvable ancestor is not a reason to trust the path; keep it as written.
+    }
+    return tail.length > 0 ? path.join(current, ...tail) : current;
+}
+/** True when `candidate` is `root` itself or lives beneath it. Case-insensitive on Windows. */
+function isPathWithin(root, candidate) {
+    const flatten = (value) => (process.platform === 'win32' ? value.toLowerCase() : value);
+    const from = flatten(path.resolve(root));
+    const to = flatten(path.resolve(candidate));
+    if (from === to)
+        return true;
+    const rel = path.relative(from, to);
+    return rel !== '' && rel !== '..' && !rel.startsWith('..' + path.sep) && !path.isAbsolute(rel);
+}
+/** Extensions treated as source code: writes must come from the local worker. */
+exports.CODE_EXTENSIONS = new Set([
+    '.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs',
+    '.py', '.rb', '.go', '.rs', '.java', '.kt', '.kts', '.cs', '.fs', '.vb',
+    '.c', '.h', '.cc', '.cpp', '.hpp', '.swift', '.php', '.scala', '.lua', '.dart',
+    '.sh', '.bash', '.zsh', '.ps1', '.psm1', '.sql',
+    '.html', '.htm', '.css', '.scss', '.sass', '.less', '.vue', '.svelte',
+]);

package/dist/profiles.d.ts

@@ -0,0 +1,35 @@
+export interface ProfileConfig {
+    name: string;
+    provider: string;
+    model: string;
+    endpoint?: string;
+    contextWindow?: number;
+    uncappedContextWindow?: boolean;
+    systemInstruction?: string;
+    temperature?: number;
+    max_tokens?: number;
+    stop?: string[];
+    enable_thinking?: boolean;
+    reasoning_effort?: string;
+}
+export interface Profiles {
+    ARCHITECT: ProfileConfig;
+    LEAD: ProfileConfig;
+    WORKER: ProfileConfig;
+}
+export declare const PROFILES: Profiles;
+/**
+ * Measured reference throughput for the local worker models (author's reference rig /
+ * LM Studio, temperature 0, single stream, no concurrent load). Printed once at startup
+ * for operator reference; live per-call rates ride the LEDGER_AUDIT line instead.
+ * These are one machine's numbers: throughput is a property of the hardware and the
+ * model, not of the plugin, and a different card will produce different figures.
+ */
+export interface WorkerBenchmark {
+    model: string;
+    decodeTps: number;
+    ttft: string;
+    note: string;
+}
+export declare const WORKER_BENCHMARK_SOURCE: string;
+export declare const WORKER_BENCHMARKS: WorkerBenchmark[];

package/dist/profiles.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORKER_BENCHMARKS = exports.WORKER_BENCHMARK_SOURCE = exports.PROFILES = void 0;
+exports.PROFILES = {
+    ARCHITECT: {
+        name: 'ARCHITECT_CLOUD',
+        provider: 'deepseek-official',
+        model: 'deepseek-chat',
+        uncappedContextWindow: true,
+        systemInstruction: 'You are the Lead Architect. You have access to the `delegate_worker` tool. For implementation, ' +
+            'component code, file generation, test writing, or heavy algorithmic coding tasks, you MUST call ' +
+            'the `delegate_worker` tool to delegate execution to the local worker rather than outputting code ' +
+            'in chat markdown. You may read source to engineer a change, but read narrowly and read late: ' +
+            'prefer the verdict you already have over opening the file, read only the lines the unit changes, ' +
+            'and remember that anything you read is re-sent on every later turn. Do not read back what you ' +
+            'delegated. The local worker has no repository read either: it can never find the code it needs, so ' +
+            'declare contextFiles for the files it must see, and state the interfaces, types and behaviour it ' +
+            'needs. Use contractFiles for the tests that decide the unit. Never assume the worker can ' +
+            'discover anything from the codebase, and never assume it can return a large file in one piece.',
+    },
+    /**
+     * The lead tier: a thinking model with repository access that authors each unit's contract. It is
+     * deliberately local, because a cloud lead would mean source reaching the cloud and would spend the
+     * metered allowance this plugin exists to protect. It is deliberately not given `delegate_worker`:
+     * the lead authors contracts, the architect dispatches them.
+     *
+     * RETIRED, and almost entirely REFERENCE ONLY. The tier was built, measured, and retired; the
+     * measurements are in `docs/ROADMAP.md`. What matters for reading this object is that **only
+     * `provider` is ever read** — `resolveLeadProviders` derives the `leadTier` allowlist from it, and
+     * that is the whole of the plugin's use.
+     *
+     * Every other field here (`model`, `endpoint`, `contextWindow`, `temperature`, `max_tokens`,
+     * `enable_thinking`, `reasoning_effort`, `systemInstruction`) is NEVER APPLIED, and deliberately so:
+     * a request the host resolved to a lead provider is left exactly as the host configured it, because
+     * the plugin enforces boundaries rather than reinventing a preset it did not write. The agent preset
+     * is what actually runs (see `docs/lead-tier.md`).
+     *
+     * They are kept as the record of what the tier was configured to be, and `lead-tier.test.cjs` asserts
+     * that record has not drifted. Read them as documentation, not as configuration: changing one has no
+     * effect on any request.
+     */
+    LEAD: {
+        name: 'LEAD_LOCAL',
+        provider: 'lm-studio',
+        model: 'qwen/qwen3.8-27b',
+        endpoint: 'http://127.0.0.1:1234/v1',
+        contextWindow: 32768,
+        temperature: 0.2,
+        max_tokens: 8192,
+        enable_thinking: true,
+        reasoning_effort: 'high',
+        systemInstruction: 'You are the Lead. You read the repository and author the contract for each unit of work. You do ' +
+            'not write implementation code, and you do not dispatch the worker -- the architect does that ' +
+            'with your contract. For each unit, state: the files it touches, the exact change expected, the ' +
+            'code the worker must see, and the command that decides whether the unit passed. Quote any code ' +
+            'you are changing exactly as it appears, because a patch that does not match byte-for-byte is ' +
+            'refused rather than approximated.',
+    },
+    /**
+     * The worker. `enable_thinking` and `reasoning_effort` below are ADVISORY ONLY, and are documented
+     * as such rather than removed: the plugin does transmit both on every delegation, but LM Studio's
+     * per-model setting is authoritative and ignores them — four variants of one request, including
+     * `enable_thinking: false` and `reasoning_effort: 'high'`, returned byte-identical output. See
+     * `docs/findings.md`. Do not read either as a control that works, and do not expect the worker to be
+     * as unthinking as `false` suggests.
+     */
+    WORKER: {
+        name: 'WORKER_LOCAL',
+        provider: 'lm-studio',
+        model: 'qwen/qwen3.8-27b',
+        endpoint: 'http://127.0.0.1:1234/v1',
+        contextWindow: 32768,
+        temperature: 0.2,
+        max_tokens: 8192,
+        stop: ['<|im_end|>', '<|endoftext|>'],
+        enable_thinking: false,
+        reasoning_effort: 'none',
+    },
+};
+exports.WORKER_BENCHMARK_SOURCE = "measured 2026-10-06 on the author's reference rig / LM Studio, temperature 0, single stream; " +
+    'your throughput will differ with your hardware and your model';
+exports.WORKER_BENCHMARKS = [
+    {
+        model: 'qwen/qwen3.8-27b',
+        decodeTps: 130.6,
+        ttft: '~240 ms',
+        note: 'prefill ~2400 tok/s cold, ~100 ms with a cached prompt',
+    },
+    {
+        model: 'muse-glimmer-30b',
+        decodeTps: 114.4,
+        ttft: '~19.7 s',
+        note: 'TTFT dominated by JIT model load, not prefill',
+    },
+];

package/dist/retry-context.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Recovery: a failed unit's failure locations become the next attempt's context.
+ *
+ * The ordinary cause of a unit that "failed for no visible reason" is that the worker was never shown the
+ * code it had to change. The architect declares `contextFiles` from its own reading; when that reading is
+ * too narrow the worker guesses, and the verdict comes back as a failure that already names the file.
+ *
+ * That location was being produced and thrown away. `RedactedFailure.location` carries `file:line` or
+ * `file:line:col`, `delegateWorker` returns it to the architect, and nothing used it.
+ *
+ * Recovering it is unusually cheap here, and that is the point: this plugin reads the file and puts it in
+ * the WORKER's prompt, while the architect receives metadata only. So the loop can widen the worker's
+ * view on a retry without widening the architect's window -- this plugin's own thesis, applied to its own
+ * failure path.
+ *
+ * Two properties the callers must keep, neither of which lives in this file:
+ *
+ * 1. **Best-effort.** Auto-injected context must never turn a delegation that would have run into a
+ *    refusal. An automatic convenience that can fail a unit is worse than no convenience, so the caller
+ *    keeps the declared injection unless the widened one resolves cleanly.
+ * 2. **Once.** The caller consumes the locations and clears them, so an old failure cannot silently
+ *    influence every later unit in the session.
+ */
+/** Where a failure happened, as the redactor reported it. */
+export interface FailureLocation {
+    path: string;
+    line: number;
+}
+/**
+ * The half-window, in lines, taken either side of a reported failure.
+ *
+ * A failure is a line, but the cause is usually a few lines up -- an import, a signature, a branch. Ten
+ * is enough to cover that and small enough that several files still fit the injection budget.
+ */
+export declare const RETRY_CONTEXT_WINDOW_LINES = 10;
+/**
+ * The usable locations in a failure list. A failure without one is skipped rather than guessed at: a
+ * wrong path costs a wasted read, and a wrong line costs a misleading window.
+ */
+export declare function parseFailureLocations(failures: any): FailureLocation[];
+/**
+ * One window per file, covering every failure reported in it.
+ *
+ * Per file rather than per failure, because injecting the same file twice would spend the byte budget
+ * twice for the same bytes. The window spans the earliest and latest reported lines, so two failures far
+ * apart in one file produce one request that covers both.
+ */
+export declare function retryContextRequests(locations: FailureLocation[], windowLines?: number): Array<{
+    path: string;
+    startLine: number;
+    endLine: number;
+}>;