mixdog 0.7.17 → 0.8.0

package/src/agent/orchestrator/smart-bridge/registry.mjs

@@ -1,348 +0,0 @@
-/**
- * Smart Bridge — Cache Registry (Phase D-2: provider × profile matrix)
- *
- * Each provider caches independently (Anthropic workspace+model shard,
- * OpenAI prompt_cache_key, Gemini implicit cache observations). Tracking a
- * single entry per profile-id — as v1 did — means a profile used across two
- * providers silently overwrites the warm state of the other. v2 indexes by
- * (profileId, provider), preserving per-shard hit/miss/TTL independently.
- *
- * Persistence: <plugin-data>/cache-registry.json. v1 files auto-migrate
- * on load.
- */
-
-import { existsSync, readFileSync, mkdirSync } from 'fs';
-import { createHash } from 'crypto';
-import { dirname, join } from 'path';
-import { getPluginData } from '../config.mjs';
-import { writeJsonAtomicSync } from '../../../shared/atomic-file.mjs';
-
-const REGISTRY_VERSION = 2;
-
-function registryPath() {
-    return join(getPluginData(), 'cache-registry.json');
-}
-
-function emptyRegistry() {
-    return {
-        version: REGISTRY_VERSION,
-        // profiles: profileId → provider → entry
-        //   entry = { prefixHash, createdAt, expiresAt, hitCount, missCount, observedOnly }
-        profiles: {},
-        openaiKeys: {}, // cacheKey → { retention, lastUsedAt }
-        updatedAt: new Date().toISOString(),
-    };
-}
-
-// shape: profiles[profileId][provider] = { prefixHash, createdAt, ... }
-function migrateV1ToV2(raw) {
-    const migrated = emptyRegistry();
-    migrated.openaiKeys = raw.openaiKeys || {};
-    for (const [profileId, entry] of Object.entries(raw.profiles || {})) {
-        if (!entry || typeof entry !== 'object') continue;
-        const provider = entry.provider || 'unknown';
-        const { provider: _p, ...rest } = entry;
-        migrated.profiles[profileId] = { [provider]: rest };
-    }
-    return migrated;
-}
-
-export class CacheRegistry {
-    constructor() {
-        this.data = emptyRegistry();
-        this.loaded = false;
-        this.dirty = false;
-    }
-
-    load() {
-        const path = registryPath();
-        if (!existsSync(path)) {
-            this.data = emptyRegistry();
-            this.loaded = true;
-            return;
-        }
-        try {
-            const raw = JSON.parse(readFileSync(path, 'utf8'));
-            if (raw.version === REGISTRY_VERSION) {
-                this.data = {
-                    version: REGISTRY_VERSION,
-                    profiles: raw.profiles || {},
-                    openaiKeys: raw.openaiKeys || {},
-                    updatedAt: raw.updatedAt || new Date().toISOString(),
-                };
-            } else if (raw.version === 1 || raw.version === undefined) {
-                process.stderr.write(`[cache-registry] migrating v${raw.version || '?'} → v${REGISTRY_VERSION}\n`);
-                this.data = migrateV1ToV2(raw);
-                this.dirty = true;
-            } else {
-                process.stderr.write(`[cache-registry] unknown version ${raw.version}, resetting\n`);
-                this.data = emptyRegistry();
-            }
-        } catch (err) {
-            process.stderr.write(`[cache-registry] load failed: ${err.message}\n`);
-            this.data = emptyRegistry();
-        }
-        this.cleanupExpired();
-        this.loaded = true;
-    }
-
-    save() {
-        if (!this.loaded) return;
-        const path = registryPath();
-        try {
-            mkdirSync(dirname(path), { recursive: true });
-            this.data.updatedAt = new Date().toISOString();
-            writeJsonAtomicSync(path, this.data, { lock: true });
-            this.dirty = false;
-        } catch (err) {
-            process.stderr.write(`[cache-registry] save failed: ${err.message}\n`);
-        }
-    }
-
-    _getEntry(profileId, provider) {
-        return this.data.profiles[profileId]?.[provider] || null;
-    }
-
-    _setEntry(profileId, provider, entry) {
-        if (!this.data.profiles[profileId]) this.data.profiles[profileId] = {};
-        this.data.profiles[profileId][provider] = entry;
-    }
-
-    // --- Profile × provider cache warm state ---
-
-    /**
-     * Record that a (profile, provider) shard was just written to provider
-     * cache. prefixContent should be deterministic (system + tools + context
-     * chunks) so re-hashing produces the same hash on next run. TTL seconds
-     * is provider-specific and decided by the caller.
-     */
-    markWarm(profileId, provider, prefixContent, ttlSeconds) {
-        if (!this.loaded) this.load();
-        if (!profileId || !provider) return;
-        const now = Date.now();
-        const prefixHash = hashContent(prefixContent);
-        const existing = this._getEntry(profileId, provider);
-        const samePrefix = existing && existing.prefixHash === prefixHash;
-        this._setEntry(profileId, provider, {
-            prefixHash,
-            createdAt: samePrefix ? (existing.createdAt || now) : now,
-            expiresAt: now + ttlSeconds * 1000,
-            hitCount: samePrefix ? (existing.hitCount || 0) : 0,
-            missCount: existing?.missCount || 0,
-            observedOnly: false,
-        });
-        this.dirty = true;
-    }
-
-    /**
-     * Record that a provider returned cache metrics for this prefix without
-     * implying the next request can rely on a warm shard. Gemini implicit
-     * caching is the main case: hits are useful telemetry, but no explicit
-     * cache object or stable warm contract exists.
-     */
-    markObserved(profileId, provider, prefixContent, ttlSeconds) {
-        if (!this.loaded) this.load();
-        if (!profileId || !provider) return;
-        const now = Date.now();
-        const prefixHash = hashContent(prefixContent);
-        const existing = this._getEntry(profileId, provider);
-        const samePrefix = existing && existing.prefixHash === prefixHash;
-        this._setEntry(profileId, provider, {
-            prefixHash,
-            createdAt: samePrefix ? (existing.createdAt || now) : now,
-            expiresAt: now + ttlSeconds * 1000,
-            hitCount: samePrefix ? (existing.hitCount || 0) : 0,
-            missCount: samePrefix ? (existing.missCount || 0) : 0,
-            observedOnly: true,
-        });
-        this.dirty = true;
-    }
-
-    /**
-     * Check whether a (profile, provider) shard is still warm for the given
-     * prefix content. warm=true is only returned for providers we deliberately
-     * mark as reusable. Observation-only providers may have hit/miss stats,
-     * but still return warm=false because the provider has no explicit warm
-     * contract.
-     */
-    checkWarm(profileId, provider, prefixContent) {
-        if (!this.loaded) this.load();
-        const entry = this._getEntry(profileId, provider);
-        if (!entry) return { warm: false, expiresIn: 0, reason: 'no-entry' };
-        const now = Date.now();
-        if ((entry.expiresAt || 0) < now) return { warm: false, expiresIn: 0, reason: 'expired' };
-        if (entry.observedOnly) {
-            return { warm: false, expiresIn: entry.expiresAt - now, reason: 'observed-only' };
-        }
-        const currentHash = hashContent(prefixContent);
-        if (currentHash !== entry.prefixHash) {
-            return { warm: false, expiresIn: 0, reason: 'hash-mismatch' };
-        }
-        return { warm: true, expiresIn: entry.expiresAt - now, reason: 'warm' };
-    }
-
-    recordHit(profileId, provider) {
-        if (!this.loaded) this.load();
-        const entry = this._getEntry(profileId, provider);
-        if (entry) {
-            entry.hitCount = (entry.hitCount || 0) + 1;
-            this.dirty = true;
-        }
-    }
-
-    recordMiss(profileId, provider) {
-        if (!this.loaded) this.load();
-        const entry = this._getEntry(profileId, provider);
-        if (entry) {
-            entry.missCount = (entry.missCount || 0) + 1;
-            this.dirty = true;
-        }
-    }
-
-    /**
-     * Invalidate a single provider shard when `provider` is given, or every
-     * provider shard under that profile when omitted.
-     */
-    invalidate(profileId, provider) {
-        if (!profileId || !this.data.profiles[profileId]) return;
-        if (provider) {
-            if (this.data.profiles[profileId][provider]) {
-                delete this.data.profiles[profileId][provider];
-                if (Object.keys(this.data.profiles[profileId]).length === 0) {
-                    delete this.data.profiles[profileId];
-                }
-                this.dirty = true;
-            }
-        } else {
-            delete this.data.profiles[profileId];
-            this.dirty = true;
-        }
-    }
-
-    // --- OpenAI cache_key tracking ---
-
-    trackOpenAIKey(cacheKey, retention) {
-        if (!this.loaded) this.load();
-        this.data.openaiKeys[cacheKey] = {
-            retention,
-            lastUsedAt: new Date().toISOString(),
-        };
-        this.dirty = true;
-    }
-
-    // --- Stats & maintenance ---
-
-    cleanupExpired() {
-        if (!this.loaded) return;
-        const now = Date.now();
-        let removed = 0;
-        for (const [profileId, providers] of Object.entries(this.data.profiles)) {
-            for (const [provider, entry] of Object.entries(providers)) {
-                if ((entry?.expiresAt || 0) < now) {
-                    delete providers[provider];
-                    removed += 1;
-                }
-            }
-            if (Object.keys(providers).length === 0) {
-                delete this.data.profiles[profileId];
-            }
-        }
-        if (removed > 0) this.dirty = true;
-    }
-
-    /**
-     * Matrix-shaped stats. profiles[profileId][provider] = { hitCount,
-     * missCount, hitRate, expiresIn, prefixHash }. shardCount totals every
-     * (profile, provider) pair; profileCount counts distinct profiles.
-     */
-    getStats() {
-        if (!this.loaded) this.load();
-        const now = Date.now();
-        const profiles = {};
-        let shardCount = 0;
-        for (const [profileId, providers] of Object.entries(this.data.profiles)) {
-            profiles[profileId] = {};
-            for (const [provider, entry] of Object.entries(providers)) {
-                const total = (entry.hitCount || 0) + (entry.missCount || 0);
-                profiles[profileId][provider] = {
-                    prefixHash: entry.prefixHash || null,
-                    hitCount: entry.hitCount || 0,
-                    missCount: entry.missCount || 0,
-                    hitRate: total > 0 ? (entry.hitCount || 0) / total : 0,
-                    expiresIn: Math.max(0, (entry.expiresAt || 0) - now),
-                    createdAt: entry.createdAt || null,
-                    observedOnly: entry.observedOnly === true,
-                };
-                shardCount += 1;
-            }
-        }
-        return {
-            profileCount: Object.keys(this.data.profiles).length,
-            shardCount,
-            profiles,
-            openaiKeyCount: Object.keys(this.data.openaiKeys).length,
-        };
-    }
-
-    // --- Singleton-style access (callers import a shared instance) ---
-
-    static _shared = null;
-    static shared() {
-        if (!this._shared) {
-            this._shared = new CacheRegistry();
-            this._shared.load();
-        }
-        return this._shared;
-    }
-}
-
-// --- Helpers ---
-
-/**
- * Deep stable stringifier — deterministic key order at every nesting level.
- * Arrays preserve positional order (tool order matters); objects sort keys
- * alphabetically. Primitives and null are serialized via JSON.stringify.
- *
- * Replaces the previous replacer-array form, which acted as a top-level
- * allowlist and silently emptied nested tool objects (name/description/
- * inputSchema were dropped → falsely stable hash across schema changes).
- */
-export function stableStringify(value) {
-    if (value === null || typeof value !== 'object') {
-        return JSON.stringify(value);
-    }
-    if (Array.isArray(value)) {
-        return '[' + value.map(v => stableStringify(v)).join(',') + ']';
-    }
-    const keys = Object.keys(value).sort();
-    const parts = [];
-    for (const k of keys) {
-        const v = value[k];
-        if (v === undefined) continue;
-        parts.push(JSON.stringify(k) + ':' + stableStringify(v));
-    }
-    return '{' + parts.join(',') + '}';
-}
-
-/**
- * Stable content hash — deterministic across runs as long as structure is identical.
- * Used to detect when a profile's prefix content has drifted.
- */
-export function hashContent(content) {
-    const canonical = typeof content === 'string'
-        ? content
-        : stableStringify(content);
-    return createHash('sha256').update(canonical).digest('hex').slice(0, 16);
-}
-
-/**
- * Default TTL (seconds) per cache layer. Providers pick their own; callers
- * that don't specify land on the shortest safe default.
- */
-export const DEFAULT_TTL_SECONDS = {
-    '1h': 3600,
-    '5m': 300,
-    '24h': 86400,
-    in_memory: 600, // optimistic estimate
-    none: 0,
-};

package/src/agent/orchestrator/stall-policy.mjs

@@ -1,201 +0,0 @@
-import { getHiddenRole } from './internal-roles.mjs';
-
-const SECOND_MS = 1000;
-const MIN_PROVIDER_TIMEOUT_MS = 30_000;
-
-export const STALL_TICK_MS = 15_000;
-export const DEFAULT_STALL_WARN_S = 300;
-export const DEFAULT_STALL_ABORT_S = 600;
-// First-byte (no-stream-delta) abort for the bridge stall watchdog. A wedged
-// socket can sit at stage=requesting with zero server events. The 30s deadline
-// trialed here false-aborted slow high-reasoning first bytes (e.g. gpt-5.5
-// XHIGH, which can legitimately think >30s before the first delta) and, paired
-// with dispatch auto-retry, produced premature aborts + duplicate re-dispatches.
-// Auto-retry is now removed (bridge-retry.mjs MAX_ATTEMPTS = 1), so a single
-// attempt must get a generous first-byte window: 300s (5 min). Env-overridable.
-export const DEFAULT_STALL_FIRST_BYTE_ABORT_S = (() => {
-    const raw = process.env.MIXDOG_STALL_FIRST_BYTE_ABORT_S;
-    const n = Number.parseInt(raw, 10);
-    if (Number.isFinite(n) && n > 0) return Math.min(Math.max(n, 5), 600);
-    return 300;
-})();
-
-export function envThresholdSeconds(env = process.env) {
-    const raw = env.STALL_TIMEOUT_S;
-    if (!raw) return null;
-    const n = Number.parseInt(raw, 10);
-    if (!Number.isFinite(n) || n <= 0) return null;
-    return n;
-}
-
-export function resolveBaseStallThresholds(env = process.env) {
-    const abort = envThresholdSeconds(env) ?? DEFAULT_STALL_ABORT_S;
-    const warn = abort > DEFAULT_STALL_WARN_S ? DEFAULT_STALL_WARN_S : Math.floor(abort / 2);
-    return { warn, abort };
-}
-
-const _baseThresholds = resolveBaseStallThresholds();
-export const STALL_WARN_S = _baseThresholds.warn;
-export const STALL_ABORT_S = _baseThresholds.abort;
-export const STALL_WARN_MS = STALL_WARN_S * SECOND_MS;
-export const STALL_ABORT_MS = STALL_ABORT_S * SECOND_MS;
-
-export const PROVIDER_MAX_BEFORE_WARN_MS = Math.max(
-    SECOND_MS,
-    STALL_WARN_MS - STALL_TICK_MS,
-);
-
-export function resolveTimeoutMs(envNames, fallbackMs, { minMs = 1_000, maxMs = Number.POSITIVE_INFINITY, env = process.env } = {}) {
-    const names = Array.isArray(envNames) ? envNames : [envNames].filter(Boolean);
-    for (const name of names) {
-        const raw = env?.[name];
-        if (raw == null || raw === '') continue;
-        const n = Number(raw);
-        if (Number.isFinite(n) && n > 0) {
-            return Math.min(Math.max(n, minMs), maxMs);
-        }
-    }
-    return Math.min(Math.max(fallbackMs, minMs), maxMs);
-}
-
-export const PROVIDER_FIRST_BYTE_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_FIRST_BYTE_TIMEOUT_MS',
-    Math.min(120_000, PROVIDER_MAX_BEFORE_WARN_MS),
-    { minMs: MIN_PROVIDER_TIMEOUT_MS, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
-);
-
-export const PROVIDER_GENERATE_TOTAL_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_GENERATE_TOTAL_TIMEOUT_MS',
-    PROVIDER_MAX_BEFORE_WARN_MS,
-    { minMs: PROVIDER_FIRST_BYTE_TIMEOUT_MS, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
-);
-
-export const PROVIDER_NONSTREAM_TOTAL_TIMEOUT_MS = resolveTimeoutMs(
-    ['MIXDOG_NONSTREAM_TOTAL_TIMEOUT_MS', 'MIXDOG_COMPAT_NONSTREAM_TOTAL_TIMEOUT_MS'],
-    480_000,
-    { minMs: PROVIDER_GENERATE_TOTAL_TIMEOUT_MS, maxMs: STALL_ABORT_MS },
-);
-
-export const PROVIDER_CACHE_CREATE_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_CACHE_CREATE_TIMEOUT_MS',
-    Math.min(120_000, PROVIDER_GENERATE_TOTAL_TIMEOUT_MS),
-    { minMs: MIN_PROVIDER_TIMEOUT_MS, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
-);
-
-export const PROVIDER_CACHE_CREATE_TOTAL_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_CACHE_CREATE_TOTAL_TIMEOUT_MS',
-    Math.min(180_000, PROVIDER_GENERATE_TOTAL_TIMEOUT_MS),
-    { minMs: MIN_PROVIDER_TIMEOUT_MS, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
-);
-
-export const PROVIDER_HTTP_RESPONSE_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_HTTP_RESPONSE_TIMEOUT_MS',
-    60_000,
-    { minMs: 10_000, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
-);
-
-// Stream idle watchdog is OFF by default — matches Claude Code native
-// behaviour (its watchdog is gated behind CLAUDE_ENABLE_STREAM_WATCHDOG).
-// The bridge stall watchdog (STALL_ABORT_S, 600s) is the backstop for
-// genuinely dead streams; this short inter-chunk idle watchdog only adds
-// value when explicitly enabled, and otherwise prematurely kills slow
-// high-reasoning streams. Enable with MIXDOG_ENABLE_STREAM_WATCHDOG=1.
-const _sseWatchdogRaw = process.env.MIXDOG_ENABLE_STREAM_WATCHDOG;
-export const PROVIDER_SSE_IDLE_WATCHDOG_ENABLED =
-    _sseWatchdogRaw === '1' || _sseWatchdogRaw === 'true' || _sseWatchdogRaw === 'yes';
-
-export const PROVIDER_SSE_IDLE_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_SSE_IDLE_TIMEOUT_MS',
-    90_000,
-    { minMs: 10_000, maxMs: STALL_WARN_MS },
-);
-
-export const PROVIDER_WS_HANDSHAKE_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_WS_HANDSHAKE_TIMEOUT_MS',
-    30_000,
-    { minMs: 5_000, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
-);
-
-export const PROVIDER_WS_ACQUIRE_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_WS_ACQUIRE_TIMEOUT_MS',
-    15_000,
-    { minMs: 5_000, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
-);
-
-export const PROVIDER_WS_FIRST_MEANINGFUL_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_WS_FIRST_MEANINGFUL_TIMEOUT_MS',
-    PROVIDER_GENERATE_TOTAL_TIMEOUT_MS,
-    { minMs: MIN_PROVIDER_TIMEOUT_MS, maxMs: PROVIDER_MAX_BEFORE_WARN_MS },
-);
-
-export const PROVIDER_WS_INTER_CHUNK_TIMEOUT_MS = resolveTimeoutMs(
-    'MIXDOG_PROVIDER_WS_INTER_CHUNK_TIMEOUT_MS',
-    STALL_ABORT_MS,
-    { minMs: STALL_WARN_MS, maxMs: STALL_ABORT_MS },
-);
-
-export const PROVIDER_RETRY_BACKOFF_MS = Object.freeze([0, 1000, 2000, 4000, 8000]);
-export const PROVIDER_RETRY_MAX_ATTEMPTS = PROVIDER_RETRY_BACKOFF_MS.length;
-export const PROVIDER_RETRY_JITTER_RATIO = (() => {
-    const raw = process.env.MIXDOG_PROVIDER_RETRY_JITTER_RATIO;
-    const n = Number(raw);
-    if (Number.isFinite(n) && n >= 0) return Math.min(n, 1);
-    return 0.2;
-})();
-
-export function resolveBridgeStallThresholds(role, env = process.env) {
-    const cfg = role ? getHiddenRole(role) : null;
-    const cfgAbort = cfg?.stallCap?.idleSeconds > 0 ? cfg.stallCap.idleSeconds : STALL_ABORT_S;
-    const envOverride = envThresholdSeconds(env);
-    const abort = envOverride != null ? envOverride : cfgAbort;
-    // Mid-stream "slow" warning disabled — a bridge stall now notifies ONLY at
-    // the abort deadline (10 min default). warn === abort means the watchdog's
-    // warn branch (verdict 'ok' && stale >= warn) can never fire before 'stall',
-    // so the only notification a stalled bridge worker emits is at the deadline.
-    const warn = abort;
-    // First-byte deadline: a request still in 'requesting' that never produced a
-    // single SSE delta is hung, not slow-reasoning. Abort on this shorter deadline
-    // so the lead is notified in minutes, not at the full mid-stream window.
-    const firstByteAbort = Math.min(abort, DEFAULT_STALL_FIRST_BYTE_ABORT_S);
-    return { warn, abort, firstByteAbort };
-}
-
-export function resolveBridgeToolThresholdSeconds(role, thresholdSeconds) {
-    const cfg = role ? getHiddenRole(role) : null;
-    if (cfg?.stallCap?.toolRunningSeconds > 0) return cfg.stallCap.toolRunningSeconds;
-    return thresholdSeconds;
-}
-
-export function providerTimeoutError(label, timeoutMs) {
-    const err = new Error(`${label} timed out after ${timeoutMs}ms`);
-    err.name = 'ProviderTimeoutError';
-    err.code = 'EPROVIDERTIMEOUT';
-    return err;
-}
-
-export function createTimeoutSignal(parentSignal, timeoutMs, label) {
-    const ac = new AbortController();
-    let timer = null;
-    let parentListener = null;
-    const cleanup = () => {
-        if (timer) { clearTimeout(timer); timer = null; }
-        if (parentListener && parentSignal) {
-            try { parentSignal.removeEventListener('abort', parentListener); } catch {}
-            parentListener = null;
-        }
-    };
-    const abort = (reason) => {
-        try { ac.abort(reason); } catch {}
-    };
-    if (parentSignal) {
-        parentListener = () => abort(parentSignal.reason);
-        if (parentSignal.aborted) {
-            parentListener();
-        } else {
-            parentSignal.addEventListener('abort', parentListener, { once: true });
-        }
-    }
-    timer = setTimeout(() => abort(providerTimeoutError(label, timeoutMs)), timeoutMs);
-    if (typeof timer.unref === 'function') timer.unref();
-    return { signal: ac.signal, cleanup };
-}

package/src/agent/orchestrator/tool-loop-guard.mjs

@@ -1,75 +0,0 @@
-/**
- * Shell file-lookup classifier + soft-warn marker stripper.
- *
- * The tool-loop guard subsystem (repeated/fanned-out tool-use detection and its
- * soft-warn sidecars) was removed once every warn path had been disabled. Two
- * standalone utilities remain:
- *   • classifyBashFileLookupCommand — detects a `bash` call whose first token is
- *     a file-lookup that has a dedicated in-process tool (read/grep/glob/list).
- *     Used by the bridge-worker permission gate to block the shell route.
- *   • stripSoftWarns — strips legacy soft-warn marker blocks from outbound
- *     bodies so older transcripts that still carry them stay clean.
- */
-
-// File-lookup-via-shell detector. Matches a `bash` command whose first token
-// is a unix find/grep/cat/ls/head/tail OR a powershell file-discovery cmdlet
-// (Get-ChildItem / Select-String / Get-Content). These have dedicated tools
-// (glob / grep / read / list) per rules/shared/01-tool.md; using bash routes
-// around the in-process tool cache and the path-permission check, and the
-// outputs were observed in PG telemetry running 100x slower than the dedicated
-// path. Get-CimInstance / Win32_Process etc. are NOT matched — process
-// enumeration genuinely needs the shell. One advisory per session per matched
-// command class; subsequent matches stay silent so the model isn't drowned.
-const SHELL_FILE_LOOKUP_COMMANDS = [
-    'find', 'ls', 'grep', 'rg', 'fd', 'cat', 'head', 'tail',
-    'sed', 'awk', 'less', 'more', 'wc', 'tree',
-    // File-metadata mirror paths called out in rules/shared/01-tool.md
-    // Tool Routing section. Added after probe HS-A3 surfaced that the
-    // rule explicitly lists `stat`, `du`, `file`, and `ls -l` as
-    // forbidden mirror paths but the policy under-enforced them.
-    'stat', 'du', 'file',
-    'dir', 'type', 'findstr',
-    'Get-ChildItem', 'gci', 'Select-String', 'sls', 'Get-Content', 'gc',
-].join('|');
-const BASH_FILE_LOOKUP_RE = new RegExp(
-    `^\\s*(?:git\\s+(?:grep|ls-files)\\b|(?:${SHELL_FILE_LOOKUP_COMMANDS})\\b)`,
-    'i',
-);
-// Wrapper / eval forms that route the same file-lookup intent through a host
-// shell (`bash -c "grep ..."`, `pwsh -Command Get-Content ...`) or an
-// inline interpreter eval (`node -e fs.readFileSync(...)`,
-// `python -c "open(...)"`). Without these the advisory was bypassable just
-// by quoting the call inside another command.
-const BASH_WRAPPER_FILE_LOOKUP_RE = new RegExp(
-    `^\\s*(?:bash|sh|zsh|fish|dash)\\b[^\\n]*\\s-\\w*c\\w*\\s+["']?\\s*(?:${SHELL_FILE_LOOKUP_COMMANDS})\\b`,
-    'i',
-);
-const CMD_WRAPPER_FILE_LOOKUP_RE = /^\s*cmd(?:\.exe)?\s+\/[cs]\s+["']?\s*(?:dir|type|findstr)\b/i;
-const PWSH_WRAPPER_FILE_LOOKUP_RE = /^\s*(?:pwsh|powershell)(?:\.exe)?\b[\s\S]*?(?:-|\/)(?:Command|c)\s+["']?\s*(?:Get-ChildItem|gci|dir|ls|Select-String|sls|Get-Content|gc|cat|type)\b/i;
-const NODE_FS_EVAL_RE = /^\s*node(?:\.exe)?\b[\s\S]*?\s-e\s+["'](?![\s\S]*\bJSON\.parse\s*\()[\s\S]*?\b(?:fs\.|readFileSync|readFile|readdirSync|readdir|statSync|stat)\b/i;
-const PYTHON_OPEN_EVAL_RE = /^\s*python3?(?:\.exe)?\b[\s\S]*?\s-c\s+["'][\s\S]*?\b(?:open\s*\(|Path\s*\(|read_text\s*\(|read_bytes\s*\(|iterdir\s*\()/i;
-function _classifyBashFileLookup(command) {
-    if (typeof command !== 'string' || !command) return null;
-    const direct = command.match(BASH_FILE_LOOKUP_RE);
-    if (direct) return direct[0].trim().toLowerCase();
-    if (BASH_WRAPPER_FILE_LOOKUP_RE.test(command)) return 'bash-wrapped';
-    if (CMD_WRAPPER_FILE_LOOKUP_RE.test(command)) return 'cmd-wrapped';
-    if (PWSH_WRAPPER_FILE_LOOKUP_RE.test(command)) return 'pwsh-wrapped';
-    if (NODE_FS_EVAL_RE.test(command)) return 'node-fs-eval';
-    if (PYTHON_OPEN_EVAL_RE.test(command)) return 'python-open-eval';
-    return null;
-}
-
-export function classifyBashFileLookupCommand(command) {
-    return _classifyBashFileLookup(command);
-}
-
-// Strip soft-warn marker blocks (header ⚠ <label> through next blank line / EOF)
-// from outbound bodies. Never call on tool-result bodies fed back to the model.
-// New compact format: each warn is a single line starting with `⚠ <Label>(` and ending at newline.
-// Legacy multi-line markers retained for older transcripts: `⚠ ... soft-warn ...` block until blank line.
-const SOFT_WARN_RE = /⚠\s+(?:Tool-loop|Repeated-tool|Repeated-input|Tool-budget|Same-file\s+multi-chunk|Same-file\s+reads|Same-slice\s+reads|Edit-miss|Mixed-tool|Bash\s+file-lookup|Iteration|0-match)\([^\n]*\n?|⚠\s+(?:(?:Tool-loop|Repeated-tool|Repeated-input|Tool-budget|Same-file\s+multi-chunk|Same-file\s+reads|Same-slice\s+reads|Edit-miss|Mixed-tool|Bash\s+file-lookup|Iteration)\s+soft-warn|0-match\s+(?:family-switch\s+advisory|ESCALATED))[^]*?(?:\n\s*\n|$)/g;
-export function stripSoftWarns(text) {
-    if (typeof text !== 'string' || text.length === 0) return text;
-    return text.replace(SOFT_WARN_RE, '');
-}