jev-layer 0.1.0

package/scripts/clean-install-smoke.mjs

@@ -0,0 +1,162 @@
+import assert from "node:assert/strict";
+import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { execFile, spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { delimiter, dirname, join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { tmpdir } from "node:os";
+
+const execFileAsync = promisify(execFile);
+const sourceRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const stage = await mkdtemp(join(tmpdir(), "jev-clean-install-"));
+const packageRoot = join(stage, "package");
+const workspace = join(stage, "workspace");
+
+try {
+  await copyDistribution(packageRoot);
+  await execFileAsync("npm", ["install", "--ignore-scripts", "--no-audit", "--no-fund"], { cwd: packageRoot, env: process.env });
+  await mkdir(workspace, { recursive: true });
+  await writeFile(join(workspace, "package.json"), JSON.stringify({ name: "clean-install-workspace", private: true }, null, 2) + "\n", "utf8");
+  await execFileAsync("npm", ["install", "--ignore-scripts", "--no-audit", "--no-fund", "--no-save", packageRoot], { cwd: workspace, env: process.env });
+  await runNode(packageRoot, ["bin/jev.mjs", "install", "--project", workspace]);
+  await runNode(packageRoot, ["bin/jev.mjs", "add", "generic", "--project", workspace]);
+  const doctor = await runNode(packageRoot, ["bin/jev.mjs", "doctor", "--project", workspace]);
+  const doctorReport = JSON.parse(doctor.stdout);
+  assert.equal(doctorReport.ok, true);
+
+  const cli = await runJev(workspace, ["cli", "--provider", "demo", "--input", join(packageRoot, "examples", "route-request.json")]);
+  const cliDecision = JSON.parse(cli.stdout.trim().split(/\r?\n/).at(-1));
+  assert.equal(cliDecision.execution.enabled, false);
+  assert.ok(cliDecision.correlation_id);
+
+  const genericConfig = JSON.parse(await readFile(join(workspace, ".jev", "adapters", "generic.json"), "utf8"));
+  const genericServer = genericConfig.mcpServers.jev;
+  assert.deepEqual(genericServer.args, ["mcp"]);
+  const mcpEnv = localEnv(workspace);
+  const mcp = spawn(genericServer.command, genericServer.args, {
+    cwd: workspace,
+    env: { ...mcpEnv, JEV_LAYER_PROVIDER: "demo", JEV_REPLAY_CASES: join(workspace, ".jev", "replay", "cases.jsonl") },
+    stdio: ["pipe", "pipe", "pipe"],
+  });
+  const pending = new Map();
+  let nextId = 1;
+  const stderr = [];
+  let buffer = "";
+  mcp.stderr.on("data", (chunk) => stderr.push(String(chunk)));
+  mcp.stdout.on("data", (chunk) => {
+    buffer += String(chunk);
+    for (const line of buffer.split(/\r?\n/).slice(0, -1)) {
+      if (!line.trim()) continue;
+      const message = JSON.parse(line);
+      pending.get(message.id)?.(message);
+      pending.delete(message.id);
+    }
+    buffer = buffer.split(/\r?\n/).at(-1) ?? "";
+  });
+
+  const request = (method, params) => new Promise((resolveRequest, reject) => {
+    const id = nextId++;
+    pending.set(id, resolveRequest);
+    mcp.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
+    setTimeout(() => {
+      if (pending.delete(id)) reject(new Error(`timeout waiting for ${method}`));
+    }, 10_000).unref();
+  });
+  const notify = (method, params) => mcp.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`);
+
+  const initialized = await request("initialize", {});
+  assert.equal(initialized.result.serverInfo.name, "jev-layer");
+  notify("notifications/initialized", {});
+  const listed = await request("tools/list", {});
+  assert.ok(listed.result.tools.some((tool) => tool.name === "jev_route"));
+  assert.ok(listed.result.tools.some((tool) => tool.name === "jev_record_execution"));
+  const routed = await request("tools/call", {
+    name: "jev_route",
+    arguments: {
+      harness: "clean-install",
+      intent: "read the installed package manifest",
+      actor_permissions: ["read"],
+      capabilities: [{
+        id: "read_manifest",
+        kind: "tool",
+        name: "Read package manifest",
+        description: "Read package.json without changing files",
+        permissions: ["read"],
+        risk: "low",
+      }],
+    },
+  });
+  const decision = routed.result.structuredContent;
+  assert.equal(decision.status, "selected");
+  const hostResult = await readFile(join(packageRoot, "package.json"), "utf8");
+  const recorded = await request("tools/call", {
+    name: "jev_record_execution",
+    arguments: {
+      correlation_id: decision.correlation_id,
+      harness: "clean-install",
+      capability_id: decision.selected,
+      status: "completed",
+      result: { bytes: Buffer.byteLength(hostResult) },
+      exit_status: 0,
+      duration_ms: 1,
+    },
+  });
+  const receipt = recorded.result.structuredContent;
+  assert.equal(receipt.correlation_id, decision.correlation_id);
+  assert.equal(receipt.host.exit_status, 0);
+  assert.equal(receipt.host.duration_ms, 1);
+  mcp.stdin.end();
+  await onceExit(mcp);
+  assert.equal(stderr.join(""), "");
+
+  const records = (await readFile(join(workspace, ".jev", "replay", "cases.jsonl"), "utf8"))
+    .trim().split(/\r?\n/).map((line) => JSON.parse(line));
+  assert.equal(records.length, 2);
+  assert.deepEqual(records.map((record) => record.record_type), ["routing_case", "execution_receipt"]);
+  assert.equal(records[0].correlation_id, records[1].correlation_id);
+  const replay = await runNode(packageRoot, ["scripts/replay-eval.mjs", "--provider", "demo", "--input", join(workspace, ".jev", "replay", "cases.jsonl"), "--limit", "1"]);
+  const replayReport = JSON.parse(replay.stdout);
+  assert.equal(replayReport.replayed_cases, 1);
+  assert.equal(replayReport.host_execution_calls, 0);
+  console.log(JSON.stringify({
+    ok: true,
+    stage,
+    package_root: packageRoot,
+    workspace,
+    install: "npm install",
+    cli: { status: cliDecision.status, correlation_id: cliDecision.correlation_id },
+    mcp: { tools: listed.result.tools.map((tool) => tool.name), selected: decision.selected, host_exit_status: receipt.host.exit_status },
+    receipts: records.length,
+    replay_cases: records.filter((record) => record.record_type === "routing_case").length,
+    replay: { replayed_cases: replayReport.replayed_cases, host_execution_calls: replayReport.host_execution_calls },
+  }, null, 2));
+} finally {
+  await rm(stage, { recursive: true, force: true });
+}
+
+async function copyDistribution(destination) {
+  const entries = ["bin", "config", "examples", "integrations", "scripts", "src", "test", "README.md", "package.json", "package-lock.json"];
+  for (const entry of entries) await cp(join(sourceRoot, entry), join(destination, entry), { recursive: true });
+}
+
+function runNode(cwd, args) {
+  return execFileAsync(process.execPath, args, { cwd, env: process.env, maxBuffer: 2 * 1024 * 1024 });
+}
+
+function runJev(cwd, args) {
+  return execFileAsync("jev", args, { cwd, env: localEnv(cwd), maxBuffer: 2 * 1024 * 1024 });
+}
+
+function localEnv(workspaceRoot) {
+  return {
+    ...process.env,
+    PATH: `${join(workspaceRoot, "node_modules", ".bin")}${delimiter}${process.env.PATH ?? ""}`,
+  };
+}
+
+function onceExit(child) {
+  return new Promise((resolveExit, reject) => {
+    child.once("error", reject);
+    child.once("close", (code) => code === 0 ? resolveExit() : reject(new Error(`MCP exited with ${code}`)));
+  });
+}

package/scripts/codex-mcp-smoke.mjs

@@ -0,0 +1,119 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const runner = resolve(root, "integrations/codex/run-mcp.mjs");
+const child = spawn(process.env.JEV_NODE ?? "node", [runner], {
+  cwd: root,
+  env: {
+    ...process.env,
+    JEV_LAYER_ROOT: root,
+    JEV_LAYER_PROVIDER: "openrouter",
+  },
+  stdio: ["pipe", "pipe", "pipe"],
+});
+const lines = createInterface({ input: child.stdout });
+const pending = new Map();
+const stderr = [];
+child.stderr.on("data", (chunk) => stderr.push(String(chunk)));
+lines.on("line", (line) => {
+  if (!line.trim()) return;
+  const message = JSON.parse(line);
+  const waiter = pending.get(message.id);
+  if (waiter) {
+    pending.delete(message.id);
+    waiter(message);
+  }
+});
+
+try {
+  const initialized = await request(1, "initialize", {});
+  assert.equal(initialized.result.serverInfo.name, "jev-layer");
+  await notification("notifications/initialized", {});
+  const listed = await request(2, "tools/list", {});
+  assert.ok(listed.result.tools.some((tool) => tool.name === "jev_route"));
+
+  const response = await request(3, "tools/call", {
+    name: "jev_route",
+    arguments: {
+      intent: "inspect the routing implementation",
+      harness: "codex",
+      context: { workspace: "jev-layer", operation: "read-only" },
+      actor_permissions: ["read"],
+      capabilities: [
+        {
+          id: "read_route",
+          name: "read",
+          kind: "tool",
+          description: "Read src/route.mjs without modifying it.",
+          execution: { mode: "host", target: "src/route.mjs" },
+          permissions: ["read"],
+          risk: "low",
+        },
+        {
+          id: "read_manifest",
+          name: "read",
+          kind: "tool",
+          description: "Read package.json without modifying it.",
+          execution: { mode: "host", target: "package.json" },
+          permissions: ["read"],
+          risk: "low",
+        },
+      ],
+    },
+  });
+  const decision = response.result.structuredContent;
+  assert.equal(decision.status, "selected");
+  assert.ok(decision.selected);
+
+  const target = decision.selected === "read_route" ? "src/route.mjs" : "package.json";
+  const content = await readFile(resolve(root, target), "utf8");
+  console.log(JSON.stringify({
+    ok: true,
+    transport: "codex-mcp-runner",
+    tool: "jev_route",
+    decision: {
+      selected: decision.selected,
+      probabilities: decision.probabilities,
+      confidence: decision.confidence,
+      status: decision.status,
+      latency_ms: decision.receipt?.latency_ms ?? null,
+      cost_usd: decision.raw_jev?.usage?.cost ?? null,
+      fallback: decision.fallback,
+      provider: decision.receipt?.provider ?? null,
+    },
+    host_execution: {
+      mode: "adapter-transport-fixture",
+      target,
+      bytes: Buffer.byteLength(content),
+      note: "Codex CLI model execution was not exercised by this fixture.",
+    },
+  }, null, 2));
+} finally {
+  child.kill();
+  await new Promise((resolveExit) => child.once("close", resolveExit));
+  if (stderr.length > 0) process.stderr.write(stderr.join(""));
+}
+
+function request(id, method, params) {
+  return new Promise((resolveResponse, reject) => {
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error(`MCP request timed out: ${method}`));
+    }, 15_000);
+    pending.set(id, (message) => {
+      clearTimeout(timer);
+      resolveResponse(message);
+    });
+    child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
+  });
+}
+
+function notification(method, params) {
+  child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`);
+  return new Promise((resolveNotification) => setImmediate(resolveNotification));
+}

package/scripts/context-filter-e2e.mjs

@@ -0,0 +1,45 @@
+import assert from "node:assert/strict";
+import { routeRequest } from "../src/route.mjs";
+
+const messages = [
+  ...Array.from({ length: 12 }, (_, index) => `stale unrelated worker note ${index}`),
+  "Requirement: preserve /workspace/project/config.json exactly",
+  "Error: command `npm test` failed with exit status 1",
+  "recent worker state",
+];
+const context = { messages };
+const before = JSON.stringify(context);
+let projected;
+const decision = await routeRequest({
+  harness: "context-filter-e2e",
+  intent: "inspect project state",
+  context,
+  policy: { context_filter_mode: "conservative" },
+  capabilities: [{ id: "inspect", kind: "tool", name: "Inspect", description: "Inspect context", risk: "low" }],
+}, {
+  provider: {
+    name: "context-filter-e2e-provider",
+    async decide({ state }) {
+      projected = state;
+      return { answers: { tool: { type: "choice", choice: "inspect", probabilities: { inspect: 1 }, confidence: 1 } } };
+    },
+  },
+});
+assert.equal(decision.status, "selected");
+assert.equal(projected.context_filter.mode, "conservative");
+assert.ok(projected.context_filter.dropped > 0);
+assert.ok(projected.context.messages.includes("Requirement: preserve /workspace/project/config.json exactly"));
+assert.ok(projected.context.messages.includes("Error: command `npm test` failed with exit status 1"));
+assert.equal(JSON.stringify(context), before);
+console.log(JSON.stringify({
+  ok: true,
+  status: decision.status,
+  mode: projected.context_filter.mode,
+  kept: projected.context_filter.kept,
+  dropped: projected.context_filter.dropped,
+  pinned: projected.context_filter.pinned,
+  preserved: [
+    projected.context.messages.includes("Requirement: preserve /workspace/project/config.json exactly"),
+    projected.context.messages.includes("Error: command `npm test` failed with exit status 1"),
+  ],
+}, null, 2));

package/scripts/fail-open-smoke.mjs

@@ -0,0 +1,120 @@
+import assert from "node:assert/strict";
+import { routeRequest } from "../src/route.mjs";
+
+const candidates = [
+  {
+    id: "read_manifest",
+    name: "read",
+    kind: "tool",
+    description: "Read the repository package manifest without modifying it.",
+    execution: { mode: "native", target: "read" },
+    permissions: ["read"],
+    risk: "low",
+  },
+  {
+    id: "read_route",
+    name: "read",
+    kind: "tool",
+    description: "Read the routing implementation without modifying it.",
+    execution: { mode: "native", target: "read" },
+    permissions: ["read"],
+    risk: "low",
+  },
+];
+
+const request = {
+  intent: "inspect repository metadata",
+  harness: "fail-open-smoke",
+  context: { workspace: "jev-layer", operation: "read-only" },
+  actor_permissions: ["read"],
+  capabilities: candidates,
+};
+
+const originalEnabled = process.env.JEV_LAYER_ENABLED;
+const disabled = await withEnv("JEV_LAYER_ENABLED", "0", () => routeRequest(request, { provider: "openrouter" }));
+restoreEnv("JEV_LAYER_ENABLED", originalEnabled);
+assert.equal(disabled.status, "fallback");
+assert.equal(disabled.fallback.type, "disabled");
+assert.equal(disabled.execution.enabled, false);
+
+const unavailable = await routeRequest(request, {
+  provider: "openrouter",
+  openrouter: {
+    apiKey: "smoke-token",
+    endpoint: "http://127.0.0.1:1/unavailable",
+    timeoutMs: 100,
+  },
+});
+assert.equal(unavailable.status, "fallback");
+assert.equal(unavailable.fallback.type, "provider_error");
+assert.equal(unavailable.execution.enabled, false);
+
+const noDecision = await routeRequest({
+  ...request,
+  capabilities: candidates.map((candidate) => ({
+    ...candidate,
+    availability: { available: false, reason: "host capability intentionally unavailable" },
+  })),
+}, { provider: "demo" });
+assert.equal(noDecision.status, "no_decision");
+assert.equal(noDecision.execution.enabled, false);
+
+const lowConfidence = await routeRequest(request, {
+  provider: {
+    name: "low-confidence-smoke-provider",
+    async decide() {
+      return {
+        answers: {
+          tool: {
+            type: "choice",
+            choice: "read_manifest",
+            probabilities: { read_manifest: 0.51, read_route: 0.49 },
+            confidence: 0.51,
+          },
+        },
+      };
+    },
+  },
+  policy: { min_confidence: 0.8 },
+});
+assert.equal(lowConfidence.status, "fallback");
+assert.equal(lowConfidence.fallback.type, "low_confidence");
+assert.equal(lowConfidence.selected, "read_manifest");
+assert.equal(lowConfidence.execution.enabled, false);
+
+console.log(JSON.stringify({
+  ok: true,
+  scenarios: [
+    summarize("disabled", disabled),
+    summarize("provider_unavailable", unavailable),
+    summarize("no_decision", noDecision),
+    summarize("low_confidence", lowConfidence),
+  ],
+}, null, 2));
+
+async function withEnv(name, value, operation) {
+  const previous = process.env[name];
+  process.env[name] = value;
+  try {
+    return await operation();
+  } finally {
+    restoreEnv(name, previous);
+  }
+}
+
+function restoreEnv(name, value) {
+  if (value === undefined) delete process.env[name];
+  else process.env[name] = value;
+}
+
+function summarize(name, result) {
+  return {
+    name,
+    status: result.status,
+    selected: result.selected,
+    fallback: result.fallback?.type ?? null,
+    confidence: result.confidence ?? null,
+    latency_ms: result.latency_ms,
+    execution: result.execution,
+  };
+}

package/scripts/feature-flags-smoke.mjs

@@ -0,0 +1,46 @@
+import assert from "node:assert/strict";
+import { loadConfig } from "../src/config.mjs";
+import { decideBrowserStep } from "../src/browser.mjs";
+import { routeRequest } from "../src/route.mjs";
+import { superviseWork } from "../src/supervision.mjs";
+
+const { config } = await loadConfig({ cwd: "/tmp/jev-no-config" });
+assert.equal(config.features.browser_fast_path, false);
+assert.equal(config.features.supervision, false);
+assert.equal(config.features.context_filter, null);
+
+const browser = await decideBrowserStep({ goal: "scroll down", observation: { scroll: { down: true } } }, {
+  provider: { name: "must-not-run", async decide() { throw new Error("disabled browser must not call Jev"); } },
+});
+assert.equal(browser.decision.fallback.type, "browser_fast_path_disabled");
+
+const previousSupervision = process.env.JEV_SUPERVISION;
+delete process.env.JEV_SUPERVISION;
+try {
+  const supervision = await superviseWork({ provider: { async evaluate() { throw new Error("disabled supervision must not call Jev"); } } });
+  assert.equal(supervision.fallback.type, "disabled");
+} finally {
+  if (previousSupervision === undefined) delete process.env.JEV_SUPERVISION;
+  else process.env.JEV_SUPERVISION = previousSupervision;
+}
+
+let calls = 0;
+const route = await routeRequest({
+  intent: "inspect",
+  context: { messages: ["plain context"] },
+  capabilities: [{ id: "inspect", kind: "tool", name: "Inspect", description: "Inspect context", risk: "low" }],
+}, {
+  provider: { name: "default-route-provider", async decide() {
+    calls += 1;
+    return { answers: { tool: { type: "choice", choice: "inspect", probabilities: { inspect: 1 }, confidence: 1 } } };
+  } },
+});
+assert.equal(route.status, "selected");
+assert.equal(calls, 1);
+console.log(JSON.stringify({
+  ok: true,
+  browser: browser.decision.fallback.type,
+  supervision: "disabled",
+  context_filter: "disabled",
+  default_route_provider_calls: calls,
+}, null, 2));

package/scripts/mcp-receipt-smoke.mjs

@@ -0,0 +1,98 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+
+const root = resolve(new URL("..", import.meta.url).pathname);
+const casesPath = join(await mkdtemp(join(tmpdir(), "jev-mcp-receipt-")), "cases.jsonl");
+const child = spawn(process.env.JEV_NODE ?? "node", [resolve(root, "src/mcp-server.mjs")], {
+  cwd: root,
+  env: { ...process.env, JEV_REPLAY_CASES: casesPath },
+  stdio: ["pipe", "pipe", "pipe"],
+});
+const lines = createInterface({ input: child.stdout });
+const pending = new Map();
+lines.on("line", (line) => {
+  if (!line.trim()) return;
+  const message = JSON.parse(line);
+  const waiter = pending.get(message.id);
+  if (waiter) {
+    pending.delete(message.id);
+    waiter(message);
+  }
+});
+
+try {
+  const initialized = await request(1, "initialize", {});
+  assert.equal(initialized.result.serverInfo.name, "jev-layer");
+  await notification("notifications/initialized", {});
+  const listed = await request(2, "tools/list", {});
+  assert.ok(listed.result.tools.some((tool) => tool.name === "jev_route"));
+  assert.ok(listed.result.tools.some((tool) => tool.name === "jev_record_execution"));
+
+  const routed = await request(3, "tools/call", {
+    name: "jev_route",
+    arguments: {
+      provider: "demo",
+      harness: "mcp-receipt-smoke",
+      intent: "read repository metadata",
+      actor_permissions: ["read"],
+      capabilities: [{
+        id: "read_metadata",
+        kind: "tool",
+        name: "Read metadata",
+        description: "Read repository metadata without modifying files",
+        permissions: ["read"],
+        risk: "low",
+      }],
+    },
+  });
+  const decision = routed.result.structuredContent;
+  assert.equal(decision.status, "selected");
+  assert.equal(decision.receipt.replay_persisted, true);
+
+  const recorded = await request(4, "tools/call", {
+    name: "jev_record_execution",
+    arguments: {
+      correlation_id: decision.correlation_id,
+      harness: "mcp-receipt-smoke",
+      capability_id: decision.selected,
+      status: "completed",
+      result: { observed: "metadata" },
+      exit_status: 0,
+      duration_ms: 3.2,
+    },
+  });
+  const receipt = recorded.result.structuredContent;
+  assert.equal(receipt.correlation_id, decision.correlation_id);
+  assert.equal(receipt.host.exit_status, 0);
+  assert.equal(receipt.host.duration_ms, 3.2);
+
+  const records = (await readFile(casesPath, "utf8")).trim().split(/\r?\n/).map(JSON.parse);
+  assert.deepEqual(records.map((record) => record.record_type), ["routing_case", "execution_receipt"]);
+  console.log(JSON.stringify({ ok: true, cases_path: casesPath, receipt }, null, 2));
+} finally {
+  child.kill();
+  await new Promise((resolveExit) => child.once("close", resolveExit));
+}
+
+function request(id, method, params) {
+  return new Promise((resolveResponse, reject) => {
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error(`MCP request timed out: ${method}`));
+    }, 15_000);
+    pending.set(id, (message) => {
+      clearTimeout(timer);
+      resolveResponse(message);
+    });
+    child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id, method, params })}\n`);
+  });
+}
+
+function notification(method, params) {
+  child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", method, params })}\n`);
+  return new Promise((resolveNotification) => setImmediate(resolveNotification));
+}

package/scripts/openrouter-choice.mjs

@@ -0,0 +1,59 @@
+import { routeRequest } from "../src/route.mjs";
+
+const endpoint = process.env.OPENROUTER_DECISIONS_ENDPOINT ?? "https://openrouter.ai/api/alpha/decisions";
+const model = process.env.OPENROUTER_DECISIONS_MODEL ?? "typesafe/jev-1.13";
+const decision = await routeRequest({
+  schema_version: 1,
+  harness: "jev-layer-openrouter-smoke",
+  intent: "Find where the OpenRouter Decisions provider is implemented without modifying files",
+  context: {
+    purpose: "one real bounded Choice call",
+    secret_note: "must be redacted before provider transmission",
+  },
+  actor_permissions: ["read", "browser", "terminal:read"],
+  capabilities: [
+    {
+      id: "repo_search",
+      kind: "mcp",
+      name: "Repository search",
+      description: "Search repository files and symbols without changing files",
+      permissions: ["read"],
+      risk: "low",
+    },
+    {
+      id: "browser_inspect",
+      kind: "mcp",
+      name: "Browser inspection",
+      description: "Open a webpage and inspect visible browser state",
+      permissions: ["browser"],
+      risk: "medium",
+    },
+    {
+      id: "terminal_read",
+      kind: "cli",
+      name: "Read-only terminal",
+      description: "Run a read-only shell command and return its output",
+      permissions: ["terminal:read"],
+      risk: "low",
+    },
+  ],
+}, {
+  provider: "openrouter",
+  openrouter: { endpoint, model, timeoutMs: 15_000 },
+});
+
+const raw = decision.raw_jev ?? {};
+const usage = raw.usage && typeof raw.usage === "object" ? raw.usage : {};
+console.log(JSON.stringify({
+  request: { endpoint, model, method: "POST" },
+  response: { id: raw.id ?? null, model: raw.model ?? null, provider: raw.provider ?? null },
+  status: decision.status,
+  selected: decision.selected,
+  probabilities: decision.probabilities,
+  confidence: decision.confidence,
+  latency_ms: decision.receipt.latency_ms,
+  cost_usd: typeof usage.cost === "number" ? usage.cost : null,
+  usage,
+  fallback: decision.fallback,
+  execution: decision.execution,
+}, null, 2));