dsh-plugin-coding-delegate 0.0.0-stage → 0.2.2

package/dist/retry-context.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * Recovery: a failed unit's failure locations become the next attempt's context.
+ *
+ * The ordinary cause of a unit that "failed for no visible reason" is that the worker was never shown the
+ * code it had to change. The architect declares `contextFiles` from its own reading; when that reading is
+ * too narrow the worker guesses, and the verdict comes back as a failure that already names the file.
+ *
+ * That location was being produced and thrown away. `RedactedFailure.location` carries `file:line` or
+ * `file:line:col`, `delegateWorker` returns it to the architect, and nothing used it.
+ *
+ * Recovering it is unusually cheap here, and that is the point: this plugin reads the file and puts it in
+ * the WORKER's prompt, while the architect receives metadata only. So the loop can widen the worker's
+ * view on a retry without widening the architect's window -- this plugin's own thesis, applied to its own
+ * failure path.
+ *
+ * Two properties the callers must keep, neither of which lives in this file:
+ *
+ * 1. **Best-effort.** Auto-injected context must never turn a delegation that would have run into a
+ *    refusal. An automatic convenience that can fail a unit is worse than no convenience, so the caller
+ *    keeps the declared injection unless the widened one resolves cleanly.
+ * 2. **Once.** The caller consumes the locations and clears them, so an old failure cannot silently
+ *    influence every later unit in the session.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RETRY_CONTEXT_WINDOW_LINES = void 0;
+exports.parseFailureLocations = parseFailureLocations;
+exports.retryContextRequests = retryContextRequests;
+/**
+ * The half-window, in lines, taken either side of a reported failure.
+ *
+ * A failure is a line, but the cause is usually a few lines up -- an import, a signature, a branch. Ten
+ * is enough to cover that and small enough that several files still fit the injection budget.
+ */
+exports.RETRY_CONTEXT_WINDOW_LINES = 10;
+// Greedy on the path so the LAST two numeric segments win. `C:\src\a.ts:12:5` has three colons in it, and
+// reading the first would make the drive letter look like a line number.
+const LOCATION_WITH_COLUMN = /^(.*):(\d+):(\d+)$/;
+const LOCATION_WITHOUT_COLUMN = /^(.*):(\d+)$/;
+/**
+ * The usable locations in a failure list. A failure without one is skipped rather than guessed at: a
+ * wrong path costs a wasted read, and a wrong line costs a misleading window.
+ */
+function parseFailureLocations(failures) {
+    if (!Array.isArray(failures))
+        return [];
+    const locations = [];
+    for (const failure of failures) {
+        const location = typeof failure?.location === 'string' ? failure.location.trim() : '';
+        if (!location)
+            continue;
+        const withColumn = LOCATION_WITH_COLUMN.exec(location);
+        const match = withColumn ?? LOCATION_WITHOUT_COLUMN.exec(location);
+        if (!match)
+            continue;
+        const path = match[1].trim();
+        const line = Number(match[2]);
+        if (!path || !Number.isInteger(line) || line < 1)
+            continue;
+        locations.push({ path, line });
+    }
+    return locations;
+}
+/**
+ * One window per file, covering every failure reported in it.
+ *
+ * Per file rather than per failure, because injecting the same file twice would spend the byte budget
+ * twice for the same bytes. The window spans the earliest and latest reported lines, so two failures far
+ * apart in one file produce one request that covers both.
+ */
+function retryContextRequests(locations, windowLines = exports.RETRY_CONTEXT_WINDOW_LINES) {
+    const window = Number.isInteger(windowLines) && windowLines >= 0 ? windowLines : exports.RETRY_CONTEXT_WINDOW_LINES;
+    const spans = new Map();
+    for (const location of locations ?? []) {
+        if (!location || typeof location.path !== 'string' || !location.path)
+            continue;
+        if (!Number.isInteger(location.line) || location.line < 1)
+            continue;
+        const prior = spans.get(location.path);
+        if (!prior)
+            spans.set(location.path, { min: location.line, max: location.line });
+        else
+            spans.set(location.path, {
+                min: Math.min(prior.min, location.line),
+                max: Math.max(prior.max, location.line),
+            });
+    }
+    const requests = [];
+    for (const [path, span] of spans) {
+        requests.push({
+            path,
+            startLine: Math.max(1, span.min - window),
+            endLine: span.max + window,
+        });
+    }
+    return requests;
+}

package/dist/roles.d.ts

@@ -0,0 +1,129 @@
+export type SourceEgressPolicy = 'deny' | 'ask' | 'allow';
+/** Blocks shorter than this are treated as quotations rather than as code being handed over. */
+export declare const DEFAULT_SOURCE_EGRESS_MIN_LINES = 3;
+export interface SourceEgressDetection {
+    found: boolean;
+    blocks: number;
+    languages: string[];
+}
+/**
+ * Find fenced source blocks in an outbound payload.
+ *
+ * The fence is built with `\x60` escapes rather than written literally: a literal triple backtick in
+ * this file makes the file unpatchable by a confined agent, because the emission scanner truncates a
+ * fenced body at the first backtick run inside it. The pattern is identical at runtime.
+ */
+export declare function detectSourceEgress(text: string, options?: {
+    minLines?: number;
+}): SourceEgressDetection;
+/**
+ * Rule 8: source may not reach the cloud. A request bound for the local worker is not egress at all,
+ * so the policy never applies to it — which is the entire reason the lead tier runs locally.
+ */
+export declare function evaluateSourceEgress(action: SourceEgressPolicy, detection: SourceEgressDetection, destination: 'cloud' | 'local'): {
+    kind: 'allow' | 'ask' | 'deny';
+    reason: string;
+};
+/** Bounded, newest-wins. Built from observed requests, because the host does not say which agent is which. */
+export declare const AGENT_ROLE_LIMIT = 200;
+/**
+ * Remember which role an agent last made a request as.
+ *
+ * This is a correlation, not lineage: the plugin sees an `agent` on `agent/request` and an `agent` on
+ * `tools/pre-execute`, and it assumes the same id means the same agent. That assumption is recorded
+ * rather than trusted — an unobserved id resolves to 'unknown' and the observation says so, so the
+ * record degrades honestly instead of inventing an attribution.
+ */
+export declare function rememberAgentRole(agentId: string | undefined, role: 'architect' | 'lead'): void;
+/**
+ * The role as the host's session lineage records it.
+ *
+ * `Session.header` carries `origin?: 'subagent'` and `delegationDepth?: number`, so the host says outright
+ * whether this is a root agent or one spawned beneath another. A root agent is the architect; anything the
+ * host has marked as spawned is not.
+ *
+ * A missing header returns 'unknown' rather than 'architect'. Absence of evidence is not evidence of
+ * rootness, and a plugin that guesses here is guessing about who may read source.
+ */
+export declare function roleFromLineage(header: unknown): 'architect' | 'lead' | 'unknown';
+/** The lineage role for a live agent, when the host hands one over. */
+export declare function agentLineageRole(agent: unknown): 'architect' | 'lead' | 'unknown';
+/**
+ * The role for an agent, preferring the host's lineage over the observed correlation.
+ *
+ * Lineage first, because it is what the host recorded. The correlation map below remains as the fallback
+ * for a host that says nothing -- which, before `Session.header` existed, was the only signal this plugin
+ * had, and the comment on `rememberAgentRole` said so honestly.
+ */
+export declare function roleForAgent(agentId: string | undefined, agent?: {
+    session?: {
+        header?: unknown;
+    };
+}): 'architect' | 'lead' | 'unknown';
+/** The map is module state, so tests need a way to clear it. */
+export declare function resetAgentRoles(): void;
+export interface SourceReadObservation {
+    track: boolean;
+    role: 'architect' | 'lead' | 'unknown';
+    target?: string;
+    extension?: string;
+    reason: string;
+}
+/**
+ * Should this tool call be recorded as a source read?
+ *
+ * Observation, not enforcement. The architect is allowed to read source today — the guard gates only
+ * files a worker wrote — and that is not a claim this project wants to keep making on faith. Recording
+ * every source read is what will say whether the architect's access is ever used, and therefore whether
+ * it can be closed.
+ *
+ * The tool check matters as much as the path check: without it, the architect's own refused writes to
+ * source would be counted as reads, and the evidence this exists to gather would be wrong.
+ */
+export declare function describeSourceRead(input: {
+    tool?: string;
+    target?: string;
+    role?: 'architect' | 'lead' | 'unknown';
+}): SourceReadObservation;
+/**
+ * Which providers are the lead tier? `leadTier` derives the list from the LEAD profile so the provider
+ * id is declared in one place; an explicit `leadProviders` list always wins.
+ *
+ * Takes a structural type rather than `PluginConfig`: importing that would be a cycle, because
+ * `index.ts` imports this module, and every field read here is optional anyway.
+ */
+export declare function resolveLeadProviders(options?: {
+    leadProviders?: string[];
+    leadTier?: boolean;
+}): string[];
+export declare function resolveAgentRole(input: {
+    hostProvider?: string;
+    leadProviders?: string[];
+}): {
+    role: 'architect' | 'lead';
+    reason: string;
+};
+/**
+ * The architect's request treatment: pin the provider, uncap the window, supply the tool and the role
+ * instruction. Extracted from the hook so the behaviour is testable without a host.
+ *
+ * Deliberately unchanged: the instruction is only injected into a `system` string or a `messages`
+ * array. A request carrying neither is left without it, because inventing a field the host may not
+ * read would be a silent no-op dressed up as a fix.
+ */
+export declare function applyArchitectConfig(requestConfig: Record<string, any>, options?: {
+    cloudProvider?: string;
+    cloudModel?: string;
+    localProvider?: string;
+    localModel?: string;
+    rerouteLocal?: boolean;
+    architectInstruction?: string;
+    workerTool?: any;
+}): Record<string, any>;
+/**
+ * Apply the role. A lead request is returned unchanged: the plugin's job is to enforce boundaries, not
+ * to reinvent a preset it did not write.
+ */
+export declare function applyAgentRole(requestConfig: Record<string, any>, role: {
+    role: 'architect' | 'lead';
+}, architectOptions?: Parameters<typeof applyArchitectConfig>[1]): Record<string, any>;

package/dist/roles.js

@@ -0,0 +1,363 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_ROLE_LIMIT = exports.DEFAULT_SOURCE_EGRESS_MIN_LINES = void 0;
+exports.detectSourceEgress = detectSourceEgress;
+exports.evaluateSourceEgress = evaluateSourceEgress;
+exports.rememberAgentRole = rememberAgentRole;
+exports.roleFromLineage = roleFromLineage;
+exports.agentLineageRole = agentLineageRole;
+exports.roleForAgent = roleForAgent;
+exports.resetAgentRoles = resetAgentRoles;
+exports.describeSourceRead = describeSourceRead;
+exports.resolveLeadProviders = resolveLeadProviders;
+exports.resolveAgentRole = resolveAgentRole;
+exports.applyArchitectConfig = applyArchitectConfig;
+exports.applyAgentRole = applyAgentRole;
+const path = __importStar(require("path"));
+const profiles_1 = require("./profiles");
+const guard_1 = require("./guard");
+const paths_1 = require("./paths");
+/**
+ * Fenced-block languages that count as source. Scripts are included: a deployment script is source,
+ * and it is exactly the sort of thing that should not be typed into a metered cloud conversation.
+ */
+const SOURCE_LANGUAGES = new Set([
+    'ts', 'typescript', 'tsx', 'js', 'javascript', 'jsx', 'mjs', 'cjs',
+    'py', 'python', 'rb', 'ruby', 'php', 'java', 'kt', 'kotlin', 'scala', 'swift', 'dart',
+    'cs', 'csharp', 'fs', 'fsharp', 'vb', 'go', 'rs', 'rust',
+    'c', 'h', 'cpp', 'c++', 'hpp', 'cc', 'mm',
+    'ps1', 'powershell', 'sh', 'bash', 'zsh', 'fish', 'bat', 'cmd',
+    'sql', 'html', 'css', 'scss', 'less', 'vue', 'svelte', 'lua', 'pl', 'perl', 'r',
+    'ex', 'exs', 'erl', 'hs', 'clj', 'asm', 'sol',
+]);
+/** Blocks shorter than this are treated as quotations rather than as code being handed over. */
+exports.DEFAULT_SOURCE_EGRESS_MIN_LINES = 3;
+/**
+ * Find fenced source blocks in an outbound payload.
+ *
+ * The fence is built with `\x60` escapes rather than written literally: a literal triple backtick in
+ * this file makes the file unpatchable by a confined agent, because the emission scanner truncates a
+ * fenced body at the first backtick run inside it. The pattern is identical at runtime.
+ */
+function detectSourceEgress(text, options = {}) {
+    if (typeof text !== 'string' || !text)
+        return { found: false, blocks: 0, languages: [] };
+    const minLines = Math.max(1, Number(options.minLines ?? exports.DEFAULT_SOURCE_EGRESS_MIN_LINES));
+    const languages = [];
+    let blocks = 0;
+    const FENCE = '\x60\x60\x60';
+    const fenced = new RegExp(FENCE + '([a-zA-Z0-9_+#-]+)[ \\t]*\\n([\\s\\S]*?)' + FENCE, 'g');
+    let match;
+    while ((match = fenced.exec(text)) !== null) {
+        const language = match[1].toLowerCase();
+        if (!SOURCE_LANGUAGES.has(language))
+            continue;
+        const body = match[2].replace(/\n$/, '');
+        if (body.split('\n').length < minLines)
+            continue;
+        blocks += 1;
+        languages.push(language);
+    }
+    return { found: blocks > 0, blocks, languages };
+}
+/**
+ * Rule 8: source may not reach the cloud. A request bound for the local worker is not egress at all,
+ * so the policy never applies to it — which is the entire reason the lead tier runs locally.
+ */
+function evaluateSourceEgress(action, detection, destination) {
+    if (destination === 'local') {
+        return {
+            kind: 'allow',
+            reason: 'the request is bound for the local worker, so nothing is leaving the machine',
+        };
+    }
+    if (!detection.found) {
+        return { kind: 'allow', reason: 'no fenced source block was found in the outbound payload' };
+    }
+    const summary = detection.blocks +
+        ' fenced source block(s) in the outbound payload (' +
+        detection.languages.join(', ') +
+        ')';
+    if (action === 'allow') {
+        return { kind: 'allow', reason: 'sourceEgress is allow, so ' + summary + ' will be transmitted' };
+    }
+    if (action === 'ask') {
+        return { kind: 'ask', reason: summary + ' needs an operator decision (sourceEgress is ask)' };
+    }
+    return {
+        kind: 'deny',
+        reason: 'rule 8 refuses this request: ' +
+            summary +
+            ". Set sourceEgress: 'ask' to approve case by case, or 'allow' to send source to the cloud " +
+            'deliberately.',
+    };
+}
+/** Bounded, newest-wins. Built from observed requests, because the host does not say which agent is which. */
+exports.AGENT_ROLE_LIMIT = 200;
+const agentRoles = new Map();
+/**
+ * Remember which role an agent last made a request as.
+ *
+ * This is a correlation, not lineage: the plugin sees an `agent` on `agent/request` and an `agent` on
+ * `tools/pre-execute`, and it assumes the same id means the same agent. That assumption is recorded
+ * rather than trusted — an unobserved id resolves to 'unknown' and the observation says so, so the
+ * record degrades honestly instead of inventing an attribution.
+ */
+function rememberAgentRole(agentId, role) {
+    const id = String(agentId ?? '').trim();
+    if (!id)
+        return;
+    if (agentRoles.has(id))
+        agentRoles.delete(id);
+    agentRoles.set(id, role);
+    while (agentRoles.size > exports.AGENT_ROLE_LIMIT) {
+        const oldest = agentRoles.keys().next().value;
+        if (typeof oldest === 'string')
+            agentRoles.delete(oldest);
+    }
+}
+/**
+ * The role as the host's session lineage records it.
+ *
+ * `Session.header` carries `origin?: 'subagent'` and `delegationDepth?: number`, so the host says outright
+ * whether this is a root agent or one spawned beneath another. A root agent is the architect; anything the
+ * host has marked as spawned is not.
+ *
+ * A missing header returns 'unknown' rather than 'architect'. Absence of evidence is not evidence of
+ * rootness, and a plugin that guesses here is guessing about who may read source.
+ */
+function roleFromLineage(header) {
+    if (!header || typeof header !== 'object')
+        return 'unknown';
+    const h = header;
+    if (h.origin === 'subagent')
+        return 'lead';
+    if (typeof h.delegationDepth === 'number' && h.delegationDepth > 0)
+        return 'lead';
+    return 'architect';
+}
+/** The lineage role for a live agent, when the host hands one over. */
+function agentLineageRole(agent) {
+    const session = agent?.session;
+    return roleFromLineage(session?.header);
+}
+/**
+ * The role for an agent, preferring the host's lineage over the observed correlation.
+ *
+ * Lineage first, because it is what the host recorded. The correlation map below remains as the fallback
+ * for a host that says nothing -- which, before `Session.header` existed, was the only signal this plugin
+ * had, and the comment on `rememberAgentRole` said so honestly.
+ */
+function roleForAgent(agentId, agent) {
+    const byLineage = agentLineageRole(agent);
+    if (byLineage !== 'unknown')
+        return byLineage;
+    const id = String(agentId ?? '').trim();
+    if (!id)
+        return 'unknown';
+    return agentRoles.get(id) ?? 'unknown';
+}
+/** The map is module state, so tests need a way to clear it. */
+function resetAgentRoles() {
+    agentRoles.clear();
+}
+/**
+ * Should this tool call be recorded as a source read?
+ *
+ * Observation, not enforcement. The architect is allowed to read source today — the guard gates only
+ * files a worker wrote — and that is not a claim this project wants to keep making on faith. Recording
+ * every source read is what will say whether the architect's access is ever used, and therefore whether
+ * it can be closed.
+ *
+ * The tool check matters as much as the path check: without it, the architect's own refused writes to
+ * source would be counted as reads, and the evidence this exists to gather would be wrong.
+ */
+function describeSourceRead(input) {
+    const role = input?.role ?? 'unknown';
+    const tool = String(input?.tool ?? '').trim().toLowerCase();
+    if (!guard_1.READ_TOOLS.has(tool)) {
+        return { track: false, role, reason: `'${tool || 'unknown tool'}' is not a read tool` };
+    }
+    const target = String(input?.target ?? '').trim();
+    if (!target)
+        return { track: false, role, reason: 'no target to attribute' };
+    const extension = path.extname(target).toLowerCase();
+    if (!paths_1.CODE_EXTENSIONS.has(extension)) {
+        return { track: false, role, target, extension, reason: 'not a source file' };
+    }
+    return {
+        track: true,
+        role,
+        target,
+        extension,
+        reason: `source read attributed to ${role}`,
+    };
+}
+/**
+ * Which providers are the lead tier? `leadTier` derives the list from the LEAD profile so the provider
+ * id is declared in one place; an explicit `leadProviders` list always wins.
+ *
+ * Takes a structural type rather than `PluginConfig`: importing that would be a cycle, because
+ * `index.ts` imports this module, and every field read here is optional anyway.
+ */
+function resolveLeadProviders(options = {}) {
+    if (Array.isArray(options.leadProviders) && options.leadProviders.length > 0) {
+        return options.leadProviders;
+    }
+    return options.leadTier ? [profiles_1.PROFILES.LEAD.provider] : [];
+}
+function resolveAgentRole(input) {
+    const host = String(input.hostProvider ?? '')
+        .trim()
+        .toLowerCase();
+    const declared = (input.leadProviders ?? [])
+        .map((p) => String(p ?? '').trim().toLowerCase())
+        .filter(Boolean);
+    if (!host) {
+        return {
+            role: 'architect',
+            reason: 'the host resolved no provider, so the architect default applies',
+        };
+    }
+    if (declared.includes(host)) {
+        return {
+            role: 'lead',
+            reason: `provider '${host}' is declared as a non-architect (lead) provider`,
+        };
+    }
+    return { role: 'architect', reason: `provider '${host}' is not declared as a lead provider` };
+}
+/**
+ * The architect's request treatment: pin the provider, uncap the window, supply the tool and the role
+ * instruction. Extracted from the hook so the behaviour is testable without a host.
+ *
+ * Deliberately unchanged: the instruction is only injected into a `system` string or a `messages`
+ * array. A request carrying neither is left without it, because inventing a field the host may not
+ * read would be a silent no-op dressed up as a fix.
+ */
+function applyArchitectConfig(requestConfig, options = {}) {
+    // A tripped DLP under dlpAction 'local' pins this request to the local provider instead of the cloud.
+    //
+    // The route is only rewritten when there is a route to rewrite it TO. Both options are operator config and
+    // both are optional, so the unconditional assignment that stood here wrote `provider: undefined` over
+    // whatever the host had selected -- and that is not a corner case, because the plugin's own entry in
+    // `config.json` carries no options at all. A plugin registered without a profile patch would have
+    // clobbered every request's provider. Leaving the host's route alone is what a session without this plugin
+    // does anyway, which is the honest fallback.
+    //
+    // One case deliberately still writes `undefined`: `rerouteLocal` means the operator asked for this request
+    // to go to the local worker, and with no local provider configured that cannot be satisfied locally.
+    // Falling back to the host's route could send source to the cloud on a request whose whole point was to
+    // keep it off the cloud, so the misconfiguration is left to fail loudly, and this says so.
+    const route = options.rerouteLocal
+        ? { provider: options.localProvider, model: options.localModel }
+        : { provider: options.cloudProvider, model: options.cloudModel };
+    const misrouted = typeof route.provider !== 'string' || route.provider.length === 0;
+    const mutatedConfig = { ...(requestConfig || {}) };
+    if (misrouted && options.rerouteLocal) {
+        console.warn('[LOCAL_GUARD] rerouteLocal is set but no localProvider is configured, so this request cannot be ' +
+            'routed locally. It is left unrouted rather than sent to whatever route the host selected.');
+        mutatedConfig.provider = undefined;
+        mutatedConfig.model = options.localModel;
+    }
+    else if (!misrouted) {
+        mutatedConfig.provider = route.provider;
+        mutatedConfig.model = route.model;
+    }
+    // A request pinned to the local worker must not carry a reasoning effort.
+    //
+    // A session's model selection is sticky: the last `model/selection` record keeps
+    // `reasoningEffort: 'high'` on every later request, and a local model commonly advertises no efforts
+    // at all -- `qwen/qwen3.8-27b` under `lm-studio` is configured without any. The pin therefore handed
+    // the host a request it refused before any network I/O:
+    //
+    //   provider "lm-studio" model "qwen/qwen3.8-27b" does not support reasoning effort "high"
+    //
+    // and because the effort is stored rather than per-message, it refused every later turn of that
+    // session too, which reads as a session that is permanently stuck. `index.ts` already clears this
+    // field when its own classifier selects the local worker; this is the other route into the local
+    // worker, so it clears the field as well. The cloud path keeps it: an effort is a capability of the
+    // model it was configured for, and stripping it there would silently downgrade the architect.
+    const pinnedLocal = options.rerouteLocal === true && !misrouted;
+    if (pinnedLocal)
+        delete mutatedConfig.reasoningEffort;
+    // Uncap the context window for the cloud architect.
+    delete mutatedConfig.contextWindow;
+    delete mutatedConfig.maxTokens;
+    delete mutatedConfig.max_tokens;
+    delete mutatedConfig.max_completion_tokens;
+    delete mutatedConfig.apiKey;
+    // Inject the `delegate_worker` tool definition for the architect thread.
+    if (Array.isArray(mutatedConfig.tools)) {
+        const hasWorker = mutatedConfig.tools.some((t) => (t?.function?.name || t?.name) === 'delegate_worker');
+        if (!hasWorker && options.workerTool)
+            mutatedConfig.tools.push(options.workerTool);
+    }
+    else if (options.workerTool) {
+        mutatedConfig.tools = [options.workerTool];
+    }
+    if (options.architectInstruction) {
+        if (typeof mutatedConfig.system === 'string') {
+            if (!mutatedConfig.system.includes('delegate_worker')) {
+                mutatedConfig.system += '\n\n' + options.architectInstruction;
+            }
+        }
+        else if (Array.isArray(mutatedConfig.messages)) {
+            const sysMsg = mutatedConfig.messages.find((m) => m.role === 'system');
+            if (sysMsg) {
+                if (typeof sysMsg.content === 'string' && !sysMsg.content.includes('delegate_worker')) {
+                    sysMsg.content += '\n\n' + options.architectInstruction;
+                }
+            }
+            else {
+                mutatedConfig.messages.unshift({
+                    role: 'system',
+                    content: options.architectInstruction,
+                });
+            }
+        }
+    }
+    return mutatedConfig;
+}
+/**
+ * Apply the role. A lead request is returned unchanged: the plugin's job is to enforce boundaries, not
+ * to reinvent a preset it did not write.
+ */
+function applyAgentRole(requestConfig, role, architectOptions = {}) {
+    if (role.role === 'lead')
+        return { ...(requestConfig || {}) };
+    return applyArchitectConfig(requestConfig, architectOptions);
+}

package/dist/routing.d.ts

@@ -0,0 +1,35 @@
+export interface DestinationClassificationInput {
+    provider: string;
+    localProvider: string;
+    cloudProvider: string;
+    dlpTripped: boolean;
+    entropyOnly: boolean;
+    dlpAction?: 'block' | 'local' | 'warn' | string;
+}
+export interface DestinationClassificationResult {
+    destination: 'cloud' | 'local';
+    decision: 'proceed' | 'block';
+    rerouteLocal: boolean;
+    reason?: string;
+}
+/**
+ * Where an outbound request will actually land, and whether that is allowed.
+ *
+ * Both halves of this decision used to be made by comparing provider IDs, and both fail in the
+ * documented cloud-only setup where `localProvider` and `cloudProvider` are the same id:
+ *
+ *   1. An entropy-only DLP hit forced a local reroute even when `dlpAction` was 'block', so the
+ *      payload was pinned to the cloud it was meant to be kept away from -- and the log said it was
+ *      pinned to the LOCAL worker.
+ *   2. `destination` was then inferred from `provider === localProvider`, which is true in that
+ *      setup, so source egress classified the route as local and ALLOWED source to the cloud.
+ *
+ * The plugin cannot see the architect's endpoint, so where it cannot tell it refuses rather than
+ * guessing. `dlpAction` is an explicit input for the same reason: a caller that pre-computes
+ * "should I reroute" cannot express that 'block' was overridden, which is how half 1 stayed hidden.
+ *
+ * `dlpAction` undefined preserves the previous behaviour deliberately: entropy-only hits reroute,
+ * high-confidence hits do not. Only an explicit 'block' changes that, and only 'local' authorises a
+ * reroute for a high-confidence hit.
+ */
+export declare function classifyDestination(input: DestinationClassificationInput): DestinationClassificationResult;