dsh-plugin-coding-delegate 0.0.0-stage → 0.2.2

package/dist/declaration-egress-hook.js

@@ -0,0 +1,125 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleDeclarationPostExecute = handleDeclarationPostExecute;
+const path = __importStar(require("path"));
+const guard_1 = require("./guard");
+// CODE_EXTENSIONS is declared in ./paths and is deliberately not re-exported from ./guard, so it is
+// imported from its own module. Importing it from './guard' fails to compile.
+const paths_1 = require("./paths");
+const declaration_egress_1 = require("./declaration-egress");
+/**
+ * Decide whether this tool call may return its output under declarations mode.
+ *
+ * Returns a replacement decision when the call must be refused, or null when it may proceed. A null is
+ * the caller's signal to keep going, which is why every pass-through path returns null rather than a
+ * decision: the handler's contract is (exec, result, next) => decision, and a decision invented here
+ * would replace the tool's real output with nothing.
+ */
+function handleDeclarationPostExecute(exec, options) {
+    // The setting is the ceiling and is checked first, so this is a complete no-op for anyone who has not
+    // opted in. index.ts also gates registration on the same value; both checks are kept because a
+    // mis-ordered load must not be able to turn the control off.
+    if (options?.sourceReadEgress !== 'declarations')
+        return null;
+    const name = String(exec?.name || '');
+    if (!name)
+        return null;
+    let toolKind = 'other';
+    if (guard_1.READ_TOOLS.has(name))
+        toolKind = 'read';
+    else if (guard_1.SEARCH_TOOLS.has(name))
+        toolKind = 'search';
+    else if (guard_1.SHELL_TOOLS.has(name))
+        toolKind = 'shell';
+    // Not an egress route, and -- for a read -- handled by index.ts's own branch, which does more than
+    // this module can. See the note at the top.
+    if (toolKind !== 'search' && toolKind !== 'shell')
+        return null;
+    // Reads carry `path`, searches carry a scope, shell commands carry `command`. Reading the wrong field
+    // yields an empty target, which the evaluator treats as scope-free and refuses -- a fail-closed but
+    // wrong answer, so the extraction is per kind rather than guessed.
+    const args = exec?.arguments ?? {};
+    const target = toolKind === 'search'
+        ? String(args.path ?? args.directory ?? args.target ?? '')
+        : String(args.command ?? args.cmd ?? '');
+    // CODE_EXTENSIONS is a Set of EXTENSIONS, not of paths. Testing a whole path against it returns false
+    // for every source file and would silently disable the gate, so the extension is derived here.
+    const isCodeExtension = (p) => paths_1.CODE_EXTENSIONS.has(path.extname(String(p)).toLowerCase());
+    // longestCodeReference returns the longest code-looking token, or undefined. The evaluator wants a
+    // predicate, so presence becomes a boolean here rather than a second vocabulary of source extensions.
+    const commandNamesSource = (cmd) => (0, guard_1.longestCodeReference)(cmd) !== undefined;
+    const verdict = (0, declaration_egress_1.evaluateDeclarationEgress)({
+        toolKind,
+        target,
+        sourceReadEgress: options?.sourceReadEgress,
+        declarationRoot: options?.declarationRoot,
+        isCodeExtension,
+        declarationPathFor: guard_1.declarationPathFor,
+        commandReadsContent: guard_1.commandReadsContent,
+        commandNamesSource,
+    });
+    if (verdict.action === 'block') {
+        return {
+            kind: 'accept',
+            content: [
+                {
+                    type: 'text',
+                    text: String(verdict.reason || 'Egress blocked by declarations policy.'),
+                },
+            ],
+        };
+    }
+    // A search or a shell command has no single file to substitute a skeleton for: a search returns
+    // matched lines from wherever they matched. If the evaluator ever returns serve-declaration for one of
+    // these kinds, refusing is the safe reading -- serving a whole declaration in place of search output
+    // would answer a question the caller did not ask. Reads never reach this module.
+    if (verdict.action === 'serve-declaration') {
+        return {
+            kind: 'accept',
+            content: [
+                {
+                    type: 'text',
+                    text: "Reading '" +
+                        target +
+                        "' under sourceReadEgress 'declarations' is refused on this route: only a direct file read " +
+                        'can be redirected to a type skeleton, and a search or shell command cannot. Read the ' +
+                        'declaration path directly instead.',
+                },
+            ],
+        };
+    }
+    return null;
+}

package/dist/declaration-egress.d.ts

@@ -0,0 +1,37 @@
+/**
+ * What a declarations-mode egress check decided.
+ *
+ * `action` and `skeleton` are the field names the committed oracle asserts on
+ * (`plugin/tests/oracles/declaration-egress-scope.test.cjs`). They are not `decision`/`declarationPath`:
+ * the test file is the frozen contract for this unit, so the implementation follows it rather than the
+ * other way round.
+ */
+export interface DeclarationEgressVerdict {
+    action: 'allow' | 'serve-declaration' | 'block';
+    skeleton?: string;
+    reason?: string;
+}
+export interface DeclarationEgressInput {
+    toolKind: 'read' | 'search' | 'shell' | string;
+    /** The path argument for a read or a search scope; the command text for a shell command. */
+    target: string;
+    sourceReadEgress?: 'source' | 'declarations' | string;
+    declarationRoot?: string;
+    /** Injected so this module does not depend on guard.ts internals. See `mappableSourceFile` below. */
+    isCodeExtension?: (filePath: string) => boolean;
+    declarationPathFor?: (filePath: string, root?: string) => string | null;
+    commandReadsContent?: (cmd: string) => boolean;
+    commandNamesSource?: (cmd: string) => boolean;
+}
+/**
+ * Decide whether one tool call may proceed under declarations mode.
+ *
+ * Pure, with every environment-dependent question injected, so the whole policy is testable without a
+ * host -- the shape `containment.ts` and `attestation.ts` already use. Callers pass the real
+ * `declarationPathFor` and `commandReadsContent`; `SHELL_TOOLS` is not referenced here because it is
+ * module-private in `guard.ts` and the caller already knows which kind of tool it is holding.
+ *
+ * The setting is a ceiling checked first: when it is not the string 'declarations' this function is a
+ * complete no-op, so nobody who has not opted in is affected by anything below.
+ */
+export declare function evaluateDeclarationEgress(input: DeclarationEgressInput): DeclarationEgressVerdict;

package/dist/declaration-egress.js

@@ -0,0 +1,169 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateDeclarationEgress = evaluateDeclarationEgress;
+const path = __importStar(require("path"));
+/**
+ * The extensions `tsc --declaration --emitDeclarationOnly` can actually produce a skeleton for.
+ *
+ * WHY THIS SET EXISTS, and why it is narrower than `CODE_EXTENSIONS`. The obvious implementation is to
+ * ask `declarationPathFor` whether it can map the file and treat `null` as "cannot". That does not work,
+ * and the reason is a trap: `declarationPathFor` ends with
+ *
+ *     return path.join(declarationRoot, relative + '.d.ts')
+ *
+ * having fallen back to `path.basename` for any path that does not contain a `src/` segment
+ * (`guard.ts:583-587`). It therefore returns a NON-NULL path for every extension in its four-extension
+ * allowlist AND never consults the extension list of the thing being mapped. A `.py` file handed to it
+ * comes back as `<root>/deploy.d.ts` -- a path that no build will ever create.
+ *
+ * A check written that way would not refuse the Python read. It would redirect it to a skeleton that
+ * does not exist, which is the leak plus a misleading file reference. So the mappability decision is
+ * made here, explicitly, and `declarationPathFor` is only ever called for a file this set accepts.
+ *
+ * `.d.ts` is deliberately absent: a declaration is already a skeleton and is allowed earlier.
+ * `.mts` and `.cts` are absent because the build in this repository does not emit for them.
+ */
+const MAPPABLE_SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx']);
+/** True when this file's extension is one declarations mode can serve a skeleton for. */
+function mappableSourceFile(filePath) {
+    return MAPPABLE_SOURCE_EXTENSIONS.has(path.extname(String(filePath || '')).toLowerCase());
+}
+/**
+ * Decide whether one tool call may proceed under declarations mode.
+ *
+ * Pure, with every environment-dependent question injected, so the whole policy is testable without a
+ * host -- the shape `containment.ts` and `attestation.ts` already use. Callers pass the real
+ * `declarationPathFor` and `commandReadsContent`; `SHELL_TOOLS` is not referenced here because it is
+ * module-private in `guard.ts` and the caller already knows which kind of tool it is holding.
+ *
+ * The setting is a ceiling checked first: when it is not the string 'declarations' this function is a
+ * complete no-op, so nobody who has not opted in is affected by anything below.
+ */
+function evaluateDeclarationEgress(input) {
+    // 1. Not opted in. A total pass-through, for the reason above.
+    if (input.sourceReadEgress !== 'declarations')
+        return { action: 'allow' };
+    const target = String(input.target || '');
+    // 2. A declaration file is already the artifact this mode exists to serve, so reading one is ordinary.
+    //    Checked before the tool kind because it is true for a read and for a search scope alike.
+    if (target.toLowerCase().endsWith('.d.ts'))
+        return { action: 'allow' };
+    // 3. READS.
+    if (input.toolKind === 'read') {
+        const isCode = input.isCodeExtension ? input.isCodeExtension(target) : false;
+        if (!isCode)
+            return { action: 'allow' };
+        // Only a mappable extension may be redirected. Anything else that is still code -- Python, Go, Rust,
+        // a shell script, SQL -- cannot be served as a skeleton by any build, so it is refused rather than
+        // leaked. See MAPPABLE_SOURCE_EXTENSIONS for why this is not delegated to `declarationPathFor`.
+        if (!mappableSourceFile(target)) {
+            return {
+                action: 'block',
+                reason: "Reading '" +
+                    target +
+                    "' was refused: sourceReadEgress is 'declarations' and no type skeleton can be produced for " +
+                    path.extname(target).toLowerCase() +
+                    '. Serving the body would be the implementation leak this setting exists to prevent. Read the ' +
+                    'declaration path directly, or turn sourceReadEgress off in the profile patch (which needs a ' +
+                    'DSH restart).',
+            };
+        }
+        const skeleton = input.declarationPathFor
+            ? input.declarationPathFor(target, input.declarationRoot)
+            : null;
+        if (!skeleton) {
+            // Fail closed, which is the rule index.ts already applies to a read whose declaration is missing.
+            return {
+                action: 'block',
+                reason: "Reading '" +
+                    target +
+                    "' was refused: sourceReadEgress is 'declarations' and no declaration path could be derived " +
+                    'for it. Implementation bodies are not served to this context.',
+            };
+        }
+        return { action: 'serve-declaration', skeleton };
+    }
+    // 4. SEARCHES. A search returns matching LINES, so there is no whole file to substitute: the matched
+    //    bytes are implementation bodies wherever they land. The scope decides, because a search confined
+    //    to prose cannot reach code. An UNSTATED scope cannot be shown to be harmless and is refused --
+    //    the opposite of the read branch, where an unstated target is simply not a read.
+    if (input.toolKind === 'search') {
+        const scope = target.trim();
+        if (scope && !(input.isCodeExtension ? input.isCodeExtension(scope) : false)) {
+            return { action: 'allow' };
+        }
+        return {
+            action: 'block',
+            reason: scope
+                ? "Searching '" +
+                    scope +
+                    "' was refused: sourceReadEgress is 'declarations' and a search returns matched source lines, " +
+                    'which are implementation bodies. Read the declaration path directly instead.'
+                : "A search with no stated scope was refused: sourceReadEgress is 'declarations' and the search's " +
+                    'reach cannot be shown to avoid source. Narrow it to a non-source path, or read a declaration ' +
+                    'path directly.',
+        };
+    }
+    // 5. SHELL. Same leak by another door, with one difference that matters: a command that merely lists
+    //    or tests reads no bytes, so there is nothing to leak and it is allowed through.
+    if (input.toolKind === 'shell') {
+        // An egress filter that cannot evaluate must not wave the read through. This is the rule
+        // index.ts:1496 already states for a failed evaluation.
+        if (!input.commandReadsContent || !input.commandNamesSource) {
+            return {
+                action: 'block',
+                reason: "Shell command '" +
+                    target +
+                    "' was refused: sourceReadEgress is 'declarations' and the command could not be inspected for " +
+                    'content reads, so it cannot be cleared. Fail closed.',
+            };
+        }
+        const reads = input.commandReadsContent(target) === true;
+        const names = input.commandNamesSource(target) === true;
+        if (reads && names) {
+            return {
+                action: 'block',
+                reason: "Shell command '" +
+                    target +
+                    "' was refused: sourceReadEgress is 'declarations' and this command reads source content, " +
+                    'which is an implementation egress by another route. Read the declaration path directly instead.',
+            };
+        }
+        return { action: 'allow' };
+    }
+    // 6. Anything that neither reads, searches nor shells is not an egress route.
+    return { action: 'allow' };
+}

package/dist/delegation.d.ts

@@ -0,0 +1,339 @@
+import { SavingsTracker } from './savings-tracker';
+import { ContextRequest } from './context';
+import { VerificationPolicy } from './verification';
+import type { DelegateWorkerParameter } from './contracts';
+import type { LLMSession } from './index';
+export declare const DELEGATE_WORKER_OPENAI_SCHEMA: {
+    type: string;
+    function: {
+        name: string;
+        description: string;
+        parameters: {
+            type: string;
+            properties: {
+                taskName: {
+                    type: string;
+                    description: string;
+                };
+                instruction: {
+                    type: string;
+                    description: string;
+                };
+                targetFiles: {
+                    type: string;
+                    items: {
+                        type: string;
+                    };
+                    description: string;
+                };
+                runVerification: {
+                    type: string;
+                    description: string;
+                };
+                verificationRepeats: {
+                    type: string;
+                    description: string;
+                };
+                attestTargets: {
+                    type: string;
+                    items: {
+                        type: string;
+                    };
+                    description: string;
+                };
+                attestEvidence: {
+                    type: string;
+                    description: string;
+                };
+                attestOperator: {
+                    type: string;
+                    description: string;
+                };
+                contractFiles: {
+                    type: string;
+                    items: {
+                        type: string;
+                    };
+                    description: string;
+                };
+                contextFiles: {
+                    type: string;
+                    description: string;
+                    items: {
+                        type: string;
+                        properties: {
+                            path: {
+                                type: string;
+                            };
+                            startLine: {
+                                type: string;
+                            };
+                            endLine: {
+                                type: string;
+                            };
+                        };
+                        required: string[];
+                    };
+                };
+                workspaceDir: {
+                    type: string;
+                    description: string;
+                };
+            };
+            required: string[];
+        };
+    };
+};
+export declare const DELEGATE_WORKER_SCHEMA: {
+    type: string;
+    function: {
+        name: string;
+        description: string;
+        parameters: {
+            type: string;
+            properties: {
+                taskName: {
+                    type: string;
+                    description: string;
+                };
+                instruction: {
+                    type: string;
+                    description: string;
+                };
+                targetFiles: {
+                    type: string;
+                    items: {
+                        type: string;
+                    };
+                    description: string;
+                };
+                runVerification: {
+                    type: string;
+                    description: string;
+                };
+                verificationRepeats: {
+                    type: string;
+                    description: string;
+                };
+                attestTargets: {
+                    type: string;
+                    items: {
+                        type: string;
+                    };
+                    description: string;
+                };
+                attestEvidence: {
+                    type: string;
+                    description: string;
+                };
+                attestOperator: {
+                    type: string;
+                    description: string;
+                };
+                contractFiles: {
+                    type: string;
+                    items: {
+                        type: string;
+                    };
+                    description: string;
+                };
+                contextFiles: {
+                    type: string;
+                    description: string;
+                    items: {
+                        type: string;
+                        properties: {
+                            path: {
+                                type: string;
+                            };
+                            startLine: {
+                                type: string;
+                            };
+                            endLine: {
+                                type: string;
+                            };
+                        };
+                        required: string[];
+                    };
+                };
+                workspaceDir: {
+                    type: string;
+                    description: string;
+                };
+            };
+            required: string[];
+        };
+    };
+};
+/**
+ * Compile-time assertion that the schema's parameters are EXACTLY `DelegateWorkerParameter`.
+ *
+ * TWO earlier versions of this did nothing, and both failures are worth recording because they are the same
+ * mistake in different clothes:
+ *
+ *   1. A type alias asserting the same thing. An exported type alias is never checked unless referenced, so
+ *      it was decoration. Verified by mutating the schema and watching tsc pass.
+ *   2. A one-directional conditional. `Record<SchemaKeys, true> extends Record<Canonical, true>` only asks
+ *      whether the canonical keys are all present; structural assignability permits EXTRA properties, so a
+ *      schema key that is not canonical was still accepted. Verified by mutation again.
+ *
+ * This version requires set EQUALITY: both directions, expressed as one condition so there is no ordering to
+ * get wrong. It is a value, so it is always checked, and both mutations now fail the build.
+ */
+type SchemaKeys = Extract<keyof (typeof DELEGATE_WORKER_OPENAI_SCHEMA)['function']['parameters']['properties'], string>;
+type SchemaMatchesCanonicalParameters = [SchemaKeys] extends [DelegateWorkerParameter] ? [DelegateWorkerParameter] extends [SchemaKeys] ? true : never : never;
+export declare const DELEGATE_WORKER_SCHEMA_COVERS_EVERY_PARAMETER: SchemaMatchesCanonicalParameters;
+/**
+ * How many times a contract should run, from a caller-supplied value that cannot be trusted.
+ *
+ * **The default is 3, and that is a deliberate break with the previous behaviour.** It used to be 1,
+ * chosen to guarantee no caller saw a change. That was backwards for an integrity boundary: it left a
+ * non-deterministic oracle unprotected unless the caller happened to KNOW the contract was flaky -- and
+ * the caller who does not know is exactly the one whose race condition gets promoted by a lucky pass.
+ * A guardrail that has to be opted into is not a guardrail.
+ *
+ * The cost is real and worth naming: every delegated verification now runs three subprocesses instead of
+ * one. A deterministic suite pays that to prove its own stability, which is not wasted -- three agreeing
+ * runs are strictly more evidence than one. A caller who has measured their suite and wants the speed
+ * back passes `verificationRepeats: 1` explicitly, which is the honest way round: the fast path is the
+ * one that requires a decision.
+ *
+ * The ceiling is not cosmetic. Each repeat is a real subprocess with the host process's authority, so an
+ * unbounded value would be a denial-of-service lever through a tool argument.
+ */
+export declare const DEFAULT_VERIFICATION_REPEATS = 3;
+export declare const MAX_VERIFICATION_REPEATS = 20;
+export declare function resolveVerificationRepeats(value: unknown): number;
+export interface DelegateWorkerParams {
+    instruction?: string;
+    taskPrompt?: string;
+    prompt?: string;
+    taskName?: string;
+    targetFiles?: string[] | string;
+    fileContext?: string;
+    systemPrompt?: string;
+    runVerification?: string;
+    endpoint?: string;
+    model?: string;
+    turnId?: number;
+    timeoutMs?: number;
+    workspaceDir?: string;
+    workspaceSource?: string;
+    /**
+     * Paths to the tests that constitute this unit's contract. They are hashed before the worker
+     * runs, refused as worker emission targets, and re-hashed afterwards: any change voids the
+     * verdict. The architect owns these files and the executor never may, which is what stops a
+     * unit from certifying itself.
+     */
+    contractFiles?: string[];
+    /**
+     * Existing files the worker needs to see, named by path with optional 1-based line ranges. The
+     * plugin reads them and puts them in the worker's prompt; the architect never receives contents,
+     * only a record of what was injected. This is the transport that lets a unit close on existing
+     * code without the code entering the architect's context.
+     */
+    contextFiles?: ContextRequest[];
+    /** Set false to return raw verification output. Raw output can carry source. */
+    redactVerification?: boolean;
+    /**
+     * How many times to run `runVerification`. Defaults to 3: a contract that runs three times and agrees
+     * with itself has proved its own stability, and one that disagrees produces `UNIT_FLAKY` instead of a
+     * pass. Raise it for a genuinely rare race; pass 1 only for a suite you have measured as deterministic
+     * and whose three-fold cost you are deliberately declining.
+     */
+    verificationRepeats?: number;
+    /** Policy for the model-supplied `runVerification` command. */
+    verificationPolicy?: VerificationPolicy;
+    /**
+     * Approval callback used when the policy resolves to `ask`. Absent means no approver is
+     * reachable, which refuses the command rather than running it unattended.
+     */
+    verificationApproval?: (command: string) => Promise<boolean>;
+    /** Extra roots the worker may write into beyond `workspaceDir`. */
+    emitAllowlist?: string[];
+    /**
+     * What to do when the worker writes a file the unit did not declare in `targetFiles`. `'enforce'`
+     * (the default) refuses it and reports why; `'off'` restores the permissive behaviour that predates
+     * the boundary.
+     *
+     * Enforced by default because declaring targets is what makes a later project-level failure
+     * attributable: without it, a unit can sprawl and no record says which unit broke the tree.
+     */
+    unitScope?: 'enforce' | 'off';
+    /**
+     * Whether the previous failure's locations are offered to this attempt as context. `'auto'` (the
+     * default) adds a window around each file the last failure named, once; `'off'` disables it.
+     *
+     * Bounded three ways: it is consumed by a single attempt, it never overrides a file the caller already
+     * declared, and it is dropped entirely if adding it would push the injection over its byte budget.
+     */
+    retryContext?: 'auto' | 'off';
+}
+/** Where the local worker is assumed to live when nothing else is configured. */
+export declare const DEFAULT_LOCAL_ENDPOINT = "http://127.0.0.1:1234/v1";
+/**
+ * Accept either a base URL or a full chat-completions URL and return the full one, so
+ * `localEndpoint: 'http://127.0.0.1:11434/v1'` (Ollama, vLLM, llama.cpp, …) works exactly as
+ * written without the operator having to know this plugin appends the path.
+ */
+export declare function resolveChatCompletionsUrl(base: string): string;
+/** A delta block: the bytes to find, and what to put there instead. */
+export interface SearchReplaceBlock {
+    search: string;
+    replace: string;
+}
+export interface PatchResult {
+    ok: boolean;
+    content?: string;
+    reason?: string;
+}
+/**
+ * A one- or two-character search is unique by accident rather than by intent, so it is refused even
+ * when the exactly-once rule would allow it. The property that matters is exactness, not cleverness.
+ */
+export declare const MIN_SEARCH_CHARS = 8;
+/**
+ * Recognise a search/replace body. The fenced header is shared with whole-file emission, so the body
+ * decides the mode and the worker does not have to know which of the two it is producing.
+ *
+ * Returns null when there is no delta here, which tells the caller to treat the body as a whole file.
+ * A body that *starts* a search/replace block but never finishes it returns an empty list instead --
+ * never null -- so a malformed patch cannot fall through and be written over a real file.
+ */
+export declare function parseSearchReplaceBlocks(body: string): SearchReplaceBlock[] | null;
+/**
+ * Apply every block, or none. A partially applied change is worse than no change: it leaves the tree
+ * in a state that no contract was written against.
+ *
+ * Everything is normalised to LF for matching and the file's own ending is restored at the end.
+ * Nothing else is normalised -- indentation is bytes -- because a near miss must fail loudly rather
+ * than be massaged into a match. Fuzzy patching is not a tuning choice here; it is the mechanism by
+ * which a wrong edit lands silently.
+ */
+export declare function applySearchReplaceBlocks(content: string, blocks: SearchReplaceBlock[]): PatchResult;
+/**
+ * Status precedence, as a pure function so the ordering is testable without a server. Tampering
+ * outranks everything: a modified contract voids the run even when verification passed, because
+ * what passed was no longer the contract.
+ */
+export declare function resolveDelegateStatus(input: {
+    verificationGate?: string | null;
+    unverified: boolean;
+    contractViolations: string[];
+    isSuccess: boolean;
+    /**
+     * The project's own check ran and failed, whatever the unit's own contract said. Absent means no
+     * coherence check was configured, or it was skipped -- never "it passed".
+     */
+    coherenceFailed?: boolean;
+    /**
+     * The contract disagreed with itself across repeated runs. A statement about the ORACLE, not the
+     * code, and it is checked before the coherence result for the same reason `verificationGate` is:
+     * there is no trustworthy unit verdict to compare the project against.
+     */
+    flaky?: boolean;
+}): string;
+export declare function delegateWorker(params?: DelegateWorkerParams, tracker?: SavingsTracker): Promise<any>;
+export declare function extractPromptText(session: LLMSession | any): string;
+export declare function estimateTokenCount(text: string): number;
+export {};