muonroi-cli 1.3.4 → 1.4.1

package/dist/src/pil/layer6-output.js

@@ -17,15 +17,27 @@ import { getProviderCapabilities } from "../providers/capabilities.js";
 import { buildResponseTools } from "./response-tools.js";
 const VALID_STYLES = ["concise", "balanced", "detailed"];
 // Per-task-type fallback style when brain is unavailable.
-// Reflects the information density each task type genuinely needs.
+//
+// PIL-L6 verbosity fix — debug/analyze flipped from "balanced" → "concise".
+// Users complained about end-of-turn summaries and rambling debug responses.
+// "balanced" pads with rationale prose the user can read from the diff/code
+// already. "detailed" is reserved for explicit user request ("explain").
+// Broad detector for self-referential / meta / evaluation prompts about the CLI,
+// prior turns, or the agent's own behavior. Used to relax brevity rules so full
+// answers (with evidence, bullets, file:line) are not suppressed by low budgets
+// or NO_PREAMBLE. No model/provider hardcodes — only prompt content signals.
+// Exported for early detection in pipeline / orchestrator.
+export function isMetaAnalysisPrompt(raw) {
+    return /đánh giá|phân tích|cải thiện|fix|debug|nhận xét|đánh giá tổng thể|evaluate.*(cli|system|repo)|improve.*(cli|repo)|your assessment|how would you improve|trả lời tự nhiên|natural response|sau fix|phỏng vấn|discovery|native|agent.*inside|cli.*bên trong|context|previous turn|input.*vừa rồi|mù context/i.test(raw);
+}
 const TASK_TYPE_DEFAULT_STYLE = {
-    debug: "balanced", // needs root cause + fix context
-    plan: "balanced", // balanced by default; user requests detail explicitly
-    analyze: "balanced", // findings need brief evidence
+    debug: "concise", // root cause + fix; no padding
+    plan: "balanced", // plans genuinely need a brief rationale per step
+    analyze: "concise", // bullet findings, no narrative
     documentation: "balanced", // examples + explanation
     generate: "concise", // code speaks for itself
     refactor: "concise", // diff is the output
-    general: "balanced",
+    general: "concise", // direct answer, no preamble
 };
 // PIL-04 Tier 1.1: response-tool gating.
 //
@@ -66,12 +78,19 @@ const TASK_OUTPUT_BUDGET = {
     analyze: 600,
     documentation: 900,
     generate: 1200,
-    general: 200,
+    // general is user-facing prose (not a code artifact). Higher budget + relaxed
+    // style rules so the final answer reads naturally for humans instead of
+    // machine-optimized telegraphic lists. See user report on over-constrained
+    // freetext after Layer 6.
+    general: 650,
 };
-// PIL-04 Tier 1.3: ban preamble openers.
-// Measured ~30 tokens/turn wasted on "I'll help you...", "Sure, let me..." etc.
-// Bilingual EN+VN. Skipped for response-tools path (JSON has no preamble surface).
-const NO_PREAMBLE_RULE = `\nFORBIDDEN OPENERS: do not start with "I'll", "I will", "Let me", "Here's", "Sure", "Of course", "Tôi sẽ", "Để tôi", "Vâng". Start directly with the answer content.`;
+// PIL-04 Tier 1.3 + PIL-L6 verbosity fix: ban preamble AND end-of-turn summary.
+// Old rule only covered openers (~30 tok saved). End-of-turn summaries
+// ("In summary...", "I have completed X, Y, Z", "Tóm tắt: ...") cost
+// 100-300 tokens/turn AND give the user nothing they can't read from the
+// diff. Bilingual EN+VN. Skipped for response-tools path (JSON has no
+// freeform surface).
+const NO_PREAMBLE_RULE = `\nFORBIDDEN OPENERS: do not start with "I'll", "I will", "Let me", "Here's", "Sure", "Of course", "Tôi sẽ", "Để tôi", "Vâng". Start directly with the answer content.\nFORBIDDEN END-OF-TURN SUMMARY: do not append a recap section ("In summary", "To summarize", "Tổng kết", "Tóm tắt", "Tóm lại", "Kết luận", "I have done X, Y, Z", "Now you have…", "Đã hoàn thành…"). The diff and command output already show what changed; the user can read them. End the response when the answer is complete.\nFORBIDDEN INTER-TOOL NARRATION: when chaining tool calls, do NOT emit content text between them. Skip phrases like "Now I'll check…", "Let me look at…", "Next, I need to…", "Tiếp theo tôi sẽ…", "Bây giờ tôi cần…". Emit the next tool call directly. Each round-trip of inter-tool narration costs the user ~100 output tokens that they do not need to read — the tool calls themselves are visible in the UI. Only emit content text for the FINAL answer or when surfacing a decision the user must make.`;
 const SUFFIXES = {
     refactor: {
         concise: `\nOUTPUT RULES (refactor): Show only changed code. Prefer unified diff or replacement function. No prose unless architecture changes. One sentence max if explanation needed. No preamble.`,
@@ -104,9 +123,11 @@ const SUFFIXES = {
         detailed: `\nOUTPUT RULES (generate): Complete, runnable code with full explanation. Include all imports. Inline comments for logic and decisions. Explain design choices, alternatives considered, and trade-offs before the code.`,
     },
     general: {
-        concise: `\nAnswer directly. No preamble.`,
-        balanced: `\nAnswer with brief context.`,
-        detailed: `\nAnswer thoroughly.`,
+        // General answers should be highly readable. Encourage rich markdown
+        // (bullets, headings, bold text) instead of forcing dense prose.
+        concise: `\nAnswer directly. Use markdown, bullet points, and code blocks to make the output highly readable and scannable. Avoid dense paragraphs.`,
+        balanced: `\nAnswer with helpful context. Structure your response using markdown headings, bullet points, and code blocks for excellent readability. Avoid dense walls of text.`,
+        detailed: `\nAnswer thoroughly. Use rich markdown structure (headings, lists, bold text, code blocks) to organize complex information so it is easy to scan and read.`,
     },
 };
 // TODO(WhoAmI-L6): when EE v4.0 Who Am I profile is available, skip
@@ -121,16 +142,59 @@ export function applyPilSuffix(systemPrompt, ctx, responseToolsActive = false) {
     if (!ctx.taskType || !SUFFIXES[ctx.taskType])
         return systemPrompt;
     if (responseToolsActive) {
+        const isMeta = isMetaAnalysisPrompt(ctx.raw);
+        const metaNote = isMeta
+            ? " This is a meta/evaluation question about the system or prior turns — the `response` field MUST contain the complete, unshortened answer with all evidence and detail."
+            : "";
+        const finalAnswerNote = ctx.taskType === "general"
+            ? " Structure your `response` with rich markdown formatting (headings, bullet points, bold text, code blocks). Make it highly readable, scannable, and clearly organized. Avoid dense walls of text (freetext)."
+            : "";
+        // Human-UX guard for question/meta turns. Without it the model narrates its
+        // OWN process into the user-facing answer — a "2-3 line plan" preamble, "per
+        // contract 2/5/7", "emit respond_general", "all facts come only from
+        // this-turn reads" (session 829a83888dd2). The reader is a human who asked a
+        // question, not an agent auditing compliance.
+        const humanNote = isMeta || ctx.taskType === "general"
+            ? " Write the `response` for the HUMAN who asked: lead with the answer. Do NOT include an implementation plan, do NOT narrate your own process, and do NOT restate internal rule/tool/layer names (contract rules, respond_* , layer6, native:NN) as compliance — cite a file:line only where it directly backs a claim. Do NOT append an evidence-provenance footer or a disclaimer that your facts come only from this turn / that you did not infer unopened files — that is internal contract bookkeeping, invisible to the reader: end on the answer's last substantive point."
+            : "";
         return (systemPrompt +
-            `\nOUTPUT FORMAT: When you finish your work, use the respond_${ctx.taskType} tool to structure your final answer. You may write free-form text to explain your reasoning during the process. Use action tools (bash, read_file, edit_file, etc.) as needed, then summarize your result via respond_${ctx.taskType}.`);
+            `\nOUTPUT FORMAT: When you finish your work, use the respond_${ctx.taskType} tool to structure your final answer. You may write free-form text to explain your reasoning during the process. Use action tools (bash, read_file, edit_file, etc.) as needed, then deliver the COMPLETE, FULL answer (do not summarize, shorten, or truncate for token budgets) via respond_${ctx.taskType}.${metaNote}${finalAnswerNote}${humanNote}`);
     }
-    const style = ctx.outputStyle ?? "concise";
+    // Action tasks (debug/refactor/generate) override "detailed" → "concise" UNLESS
+    // the prompt literally requested detail. Brain/LLM classifiers sometimes
+    // return style=detailed for prompts like "fix CI fail" (Vietnamese: "fix lỗi
+    // CI") just because the prompt looks ambiguous in isolation — session
+    // 127140a47b56 hit this and the model spent 275 LLM calls being "thorough"
+    // about a one-liner CI fix.
+    const ACTION_TASKS = new Set(["debug", "refactor", "generate"]);
+    const DETAIL_KEYWORDS = /\b(explain in detail|thorough analysis|walk me through|in depth|deeply|comprehensive)\b|giải thích chi tiết|phân tích kỹ|cặn kẽ|chi tiết hơn/i;
+    const requestedStyle = ctx.outputStyle ?? "concise";
+    const style = requestedStyle === "detailed" && ACTION_TASKS.has(ctx.taskType) && !DETAIL_KEYWORDS.test(ctx.raw)
+        ? "concise"
+        : requestedStyle;
     const baseSuffix = SUFFIXES[ctx.taskType][style];
     // PIL-04 Tier 1.2: output-budget hint.
-    const budget = TASK_OUTPUT_BUDGET[ctx.taskType] ?? 600;
-    const budgetHint = `\nOUTPUT BUDGET: aim for ≤${budget} tokens. Stop when the answer is complete; do not pad.`;
+    // For response-tool turns or meta-analysis (self-eval of CLI, prior context, "mù context" etc.),
+    // raise budget and skip aggressive "do not pad / no summary" so full evidence-rich answers
+    // reach the respond_* payload and the user. Before: meta follow-ups often produced only
+    // short "**Đã trả lời xong**" confirmations even when detailed analysis was prepared in the tool.
+    // After: explicit "COMPLETE, FULL" instruction + higher budget + isMetaAnalysisPrompt gate.
+    const isMetaAnalysis = isMetaAnalysisPrompt(ctx.raw);
+    const useHighBudget = responseToolsActive || isMetaAnalysis;
+    const budget = useHighBudget ? 1800 : (TASK_OUTPUT_BUDGET[ctx.taskType] ?? 600);
+    const budgetHint = useHighBudget
+        ? `\nOUTPUT BUDGET: provide the complete answer required by the task (analysis/meta may legitimately need 800-1500+ tokens for evidence and bullets). Stop only when the full user-visible content is delivered; do not artificially shorten.`
+        : `\nOUTPUT BUDGET: aim for ≤${budget} tokens. Stop when the answer is complete; do not pad.`;
     // PIL-04 Tier 1.3: ban preamble (~30 tokens saved/turn).
-    let result = systemPrompt + baseSuffix + budgetHint + NO_PREAMBLE_RULE;
+    // Relax for meta-analysis / evaluation (including follow-ups about previous turns or CLI behavior).
+    // The isMetaAnalysisPrompt (hoisted early) is the single source of truth and already includes
+    // signals like "cli.*bên trong", "mù context", "input.*vừa rồi", "previous turn".
+    const effectiveStyle = isMetaAnalysis && (ctx.taskType === "general" || ctx.taskType === "analyze") ? "balanced" : style;
+    const effectiveSuffix = SUFFIXES[ctx.taskType]?.[effectiveStyle] || baseSuffix;
+    let result = systemPrompt + effectiveSuffix + budgetHint;
+    if (!isMetaAnalysis && !responseToolsActive) {
+        result += NO_PREAMBLE_RULE;
+    }
     // T1 behavioral rules (proven-tier EE points set by Layer 3). These are
     // project-specific reflexes the model MUST follow — injected as instructions,
     // not as context hints, so they carry imperative weight rather than suggestion weight.
@@ -140,6 +204,27 @@ export function applyPilSuffix(systemPrompt, ctx, responseToolsActive = false) {
     }
     return result;
 }
+/**
+ * Detect an explicit IMPLEMENTATION / edit-the-files intent. When the user asks
+ * to implement/edit/refactor (the deliverable is file changes, not a structured
+ * report), a terminal `respond_<task>` tool is inappropriate: the model can call
+ * it mid-task to "state a plan/answer" and the turn then winds down before the
+ * edits are finished. Live (grok session 19fa8895c41c): an "Improve … implement
+ * these fixes" prompt was classified `debug`, so `respond_debug` was offered; the
+ * model called it after reading the files, made a few edits, then stopped — the
+ * HTML was never wired. Dropping the tool just falls through to the markdown
+ * OUTPUT RULES (graceful — exactly what code-heavy tasks already do), so a false
+ * positive on an analysis turn only forgoes structured JSON, never breaks output.
+ *
+ * High-signal verbs only (implement/edit/wire/rewrite/rename/scaffold/refactor,
+ * "make the change", "apply the fix/patch", VI equivalents). Bare "fix"/"replace"
+ * are excluded — too common in analysis ("explain the fix") — so pure
+ * analyze/plan/debug-investigation turns keep their structured output.
+ */
+const IMPLEMENTATION_INTENT_RE = /\b(implement|edit|wire(?:\s+up)?|rewrite|rename|scaffold|refactor)\b|\bmake\s+(the\s+)?(change|edit|modification)s?\b|\bapply\s+(the\s+)?(fix|change|patch|edit|diff)\b|(?:^|\s)(triển\s*khai|trien\s*khai|chỉnh\s*sửa|chinh\s*sua|viết\s*lại|viet\s*lai|đổi\s*tên|doi\s*ten)\b/i;
+export function isImplementationIntent(raw) {
+    return !!raw && IMPLEMENTATION_INTENT_RE.test(raw);
+}
 export function getResponseToolSet(ctx, providerId) {
     if (!ctx.taskType)
         return {};
@@ -147,6 +232,11 @@ export function getResponseToolSet(ctx, providerId) {
     // wins on tokens. Code-heavy tasks fall through to markdown OUTPUT RULES.
     if (!RESPONSE_TOOL_TASK_TYPES.has(ctx.taskType))
         return {};
+    // Implementation/edit turns: the deliverable is file changes, not a structured
+    // report. A terminal respond_<task> tool lets the model "answer" (state a plan)
+    // and end the turn before the edits complete — drop it for clear edit intent.
+    if (isImplementationIntent(ctx.raw))
+        return {};
     // Provider-aware gating: a provider may report it can't reliably emit
     // valid JSON tool input for this task type (e.g. DeepSeek leaks special
     // tokens into `general` responses). Drop the tool to avoid retry storms.
@@ -234,4 +324,6 @@ export async function layer6Output(ctx) {
         };
     }
 }
+// isMetaAnalysisPrompt is defined early (near top) and exported for use by
+// pipeline, orchestrator, and other layers to relax rules for reflective turns.
 //# sourceMappingURL=layer6-output.js.map

package/dist/src/pil/llm-classify.d.ts

@@ -0,0 +1,16 @@
+import type { ProviderFactory } from "../providers/runtime.js";
+import type { OutputStyle, TaskType } from "./types.js";
+export interface LlmClassifyResult {
+    taskType: TaskType;
+    outputStyle: OutputStyle | null;
+    confidence: number;
+}
+export type LlmClassifyFn = (prompt: string, signal?: AbortSignal) => Promise<LlmClassifyResult | null>;
+/**
+ * Build a closure the PIL pipeline can call. Reuses the orchestrator's already-
+ * constructed providerFactory + modelId so we don't pay key-loading cost twice.
+ *
+ * Returns null if the call fails / times out / parses to garbage. Callers must
+ * fail-open (keep prior taskType, do not block the turn).
+ */
+export declare function createLlmClassifier(factory: ProviderFactory, modelId: string): LlmClassifyFn;

package/dist/src/pil/llm-classify.js

@@ -0,0 +1,179 @@
+/**
+ * src/pil/llm-classify.ts
+ *
+ * Layer 1 Pass 4 — LLM classification fallback.
+ *
+ * Fires only when the EE brain (pilContext) returned null OR confidence < 0.7.
+ * Uses the user's currently-configured model via a closure provided by the
+ * orchestrator at runPipeline() call site. This keeps PIL ignorant of provider
+ * factories — it just receives a `classify(prompt)` callback.
+ *
+ * Output contract: { taskType, outputStyle, confidence } or null on failure.
+ * Cost target: <200 input tokens, <10 output tokens per call (~$0.0001 on
+ * DeepSeek Flash). Timeout 2500ms — bails fast if the model stalls.
+ */
+import { streamText } from "ai";
+import { getProviderCapabilities } from "../providers/capabilities.js";
+import { resolveModelRuntime } from "../providers/runtime.js";
+const LLM_CLASSIFY_TIMEOUT_MS = 2500;
+// Reasoning models (grok-4.3, deepseek-v4-flash, gpt-5.x) spend their output
+// budget on reasoning tokens BEFORE any visible text. The legacy 16-token cap
+// was consumed entirely by reasoning → zero text-delta → parseResponse("") →
+// null → `llm=fail` on every borderline turn (observed 5/5 live grok sessions).
+// Give reasoning models a real ceiling so the 2-word answer streams back, and a
+// longer timeout because reasoning round-trips take seconds, not ~200ms.
+// The ceiling is a cap, not padding: the model still stops after two words, so a
+// generous headroom costs nothing when reasoning is short.
+const REASONING_CLASSIFY_TIMEOUT_MS = 8000;
+const NONREASONING_MAX_OUTPUT_TOKENS = 16;
+const REASONING_MAX_OUTPUT_TOKENS = 2048;
+/**
+ * Per-namespace shallow merge of providerOptions. The base already carries
+ * factory-level defaults folded into the provider namespace (e.g. OAuth
+ * `store:false`); the overlay only overrides specific keys (reasoningEffort)
+ * within the same namespace, so defaults survive.
+ */
+function mergeProviderOptions(base, overlay) {
+    if (!overlay)
+        return base;
+    if (!base)
+        return overlay;
+    const out = { ...base };
+    for (const [ns, val] of Object.entries(overlay)) {
+        const baseNs = base[ns] ?? {};
+        out[ns] = { ...baseNs, ...val };
+    }
+    return out;
+}
+const VALID_TASK_TYPES = new Set([
+    "refactor",
+    "debug",
+    "plan",
+    "analyze",
+    "documentation",
+    "generate",
+    "general",
+]);
+const VALID_STYLES = new Set(["concise", "balanced", "detailed"]);
+const SYSTEM_PROMPT = "You classify user prompts for a coding assistant. Reply with ONE line of two lowercase words separated by a comma: <taskType>,<style>\n\n" +
+    "taskType ∈ { refactor | debug | plan | analyze | documentation | generate | general }\n" +
+    "style ∈ { concise | balanced | detailed }\n\n" +
+    "Rules (read carefully — Phase 4 4P-2 disambiguation):\n" +
+    "- debug — fix a bug, CI/build/test failure, error, exception, crash, or any 'why is X broken' question.\n" +
+    "- generate — create new code, scaffold, write a new file, add a feature from scratch, ADD A NEW TEST, CHANGE A DEFAULT VALUE, modify configuration, improve coverage.\n" +
+    "- refactor — ONLY when the user explicitly says rename, restructure, reorganize, extract, inline, move, migrate, or reshape existing code WITHOUT adding new behavior. Words like 'improve', 'change', 'update', 'fix', 'modify' are NOT refactor — pick the closest specific category instead.\n" +
+    "- plan — architecture, roadmap, multi-step design, strategy.\n" +
+    "- analyze — explain, review, inspect, audit, compare, find-out-why existing code/data.\n" +
+    "- documentation — write docs, comments, JSDoc, README.\n" +
+    "- general — chitchat or unclear intent. Prefer 'general' over guessing refactor.\n\n" +
+    "Negative examples (these are NOT refactor):\n" +
+    "- 'đổi default --max-tool-rounds từ 8 sang 12' → generate (changes a default value)\n" +
+    "- 'improve test coverage' → generate (adds new tests)\n" +
+    "- 'tại sao bash_output_get trả empty' → analyze (investigate behavior)\n" +
+    "- 'fix CI failing on Windows' → debug\n" +
+    "Positive refactor examples:\n" +
+    "- 'rename function shouldInjectReminder to needsReminderAt' → refactor\n" +
+    "- 'extract this into a helper' → refactor\n" +
+    "- 'migrate from class component to hooks' → refactor\n\n" +
+    "Style picking — MANDATORY mapping (do NOT deviate):\n" +
+    "- debug, refactor, generate → concise (action tasks; the diff is the answer)\n" +
+    "- analyze → concise (bullet findings, no narrative)\n" +
+    "- plan → balanced (steps need brief rationale)\n" +
+    "- documentation → balanced (examples + explanation)\n" +
+    "- general → concise\n" +
+    "Only output 'detailed' if the user prompt LITERALLY contains words like 'explain in detail', 'thorough analysis', 'walk me through', 'giải thích chi tiết', 'phân tích kỹ'.\n\n" +
+    "Prompts may be Vietnamese, English, or mixed. Reply with exactly two words separated by one comma. No other text.";
+function parseResponse(raw) {
+    const cleaned = raw.trim().toLowerCase().replace(/[`*"]/g, "");
+    const firstLine = cleaned.split(/\r?\n/)[0] ?? "";
+    const parts = firstLine
+        .split(/[,\s]+/)
+        .map((p) => p.trim())
+        .filter(Boolean);
+    if (parts.length === 0)
+        return null;
+    const taskWord = parts[0];
+    if (!VALID_TASK_TYPES.has(taskWord))
+        return null;
+    const styleWord = parts[1];
+    const style = styleWord && VALID_STYLES.has(styleWord) ? styleWord : null;
+    return { taskType: taskWord, outputStyle: style, confidence: 0.75 };
+}
+/**
+ * Build a closure the PIL pipeline can call. Reuses the orchestrator's already-
+ * constructed providerFactory + modelId so we don't pay key-loading cost twice.
+ *
+ * Returns null if the call fails / times out / parses to garbage. Callers must
+ * fail-open (keep prior taskType, do not block the turn).
+ */
+export function createLlmClassifier(factory, modelId) {
+    return async function classify(prompt, signal) {
+        const controller = new AbortController();
+        let timer;
+        try {
+            const runtime = resolveModelRuntime(factory, modelId);
+            const isReasoning = runtime.modelInfo?.reasoning === true;
+            // Budget + timeout scale with reasoning: a reasoning model needs room and
+            // time to emit reasoning THEN the answer; a plain model answers in <16
+            // tokens almost instantly.
+            timer = setTimeout(() => controller.abort(), isReasoning ? REASONING_CLASSIFY_TIMEOUT_MS : LLM_CLASSIFY_TIMEOUT_MS);
+            const combinedSignal = signal
+                ? (AbortSignal.any?.([signal, controller.signal]) ?? controller.signal)
+                : controller.signal;
+            const dropMaxTokens = runtime.unsupportedParams?.includes("maxOutputTokens") === true;
+            const maxOut = isReasoning ? REASONING_MAX_OUTPUT_TOKENS : NONREASONING_MAX_OUTPUT_TOKENS;
+            // Minimize reasoning cost: force the lowest effort the provider exposes for
+            // this throwaway 2-word classification. Only providers with
+            // `supportsReasoningEffort` (openai, xai) honor it; deepseek has no per-call
+            // knob (disable via MUONROI_DEEPSEEK_DISABLE_THINKING at the factory).
+            let providerOptions = runtime.providerOptions;
+            if (isReasoning && runtime.modelInfo?.supportsReasoningEffort && runtime.modelInfo.provider) {
+                const lowEffort = getProviderCapabilities(runtime.modelInfo.provider).buildProviderOptions({
+                    model: runtime.modelInfo,
+                    reasoningEffort: "low",
+                });
+                providerOptions = mergeProviderOptions(runtime.providerOptions, lowEffort);
+            }
+            const result = streamText({
+                model: runtime.model,
+                abortSignal: combinedSignal,
+                system: SYSTEM_PROMPT,
+                prompt: prompt.slice(0, 600),
+                ...(dropMaxTokens ? {} : { maxOutputTokens: maxOut }),
+                ...(providerOptions ? { providerOptions } : {}),
+            });
+            let text = "";
+            let reasoningText = "";
+            const partCounts = {};
+            const debug = process.env["MUONROI_DEBUG_PIL_CLASSIFY"] === "1";
+            for await (const part of result.fullStream) {
+                if (debug)
+                    partCounts[part.type] = (partCounts[part.type] ?? 0) + 1;
+                if (part.type === "text-delta")
+                    text += part.text ?? "";
+                else if (part.type === "reasoning-delta")
+                    reasoningText += part.text ?? "";
+            }
+            if (debug) {
+                console.error(`[pil.llm-classify] raw(${modelId}) maxOut=${dropMaxTokens ? "dropped" : maxOut} ` +
+                    `parts=${JSON.stringify(partCounts)} text<<<${text}>>> reasoning<<<${reasoningText.slice(0, 200)}>>>`);
+            }
+            // Reasoning models occasionally route the entire answer into reasoning
+            // parts (no committed text). Fall back to the reasoning channel so the
+            // 2-word verdict is still recoverable.
+            return parseResponse(text) ?? (reasoningText ? parseResponse(reasoningText) : null);
+        }
+        catch (err) {
+            console.error(`[pil.llm-classify] classify failed: ${err?.message}`, {
+                modelId,
+                stack: err?.stack?.split("\n").slice(0, 3),
+            });
+            return null;
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    };
+}
+//# sourceMappingURL=llm-classify.js.map

package/dist/src/pil/native-capabilities-workbook.d.ts

@@ -0,0 +1,39 @@
+/**
+ * src/pil/native-capabilities-workbook.ts
+ *
+ * NATIVE CAPABILITY MANIFEST for the agent running INSIDE muonroi-cli.
+ *
+ * Motivation (session d95113d3be09): the in-CLI agent was given a behavioural
+ * *contract* (HOW to behave — see agent-operating-contract.ts) but never a
+ * *capability manifest* (WHAT it can do). Asked to evaluate the CLI it was
+ * running in, the model reconstructed its own subsystems (PIL, compaction,
+ * self-QA, harness) by grepping source as if it were foreign code — it had no
+ * self-model of its own affordances, under-used sub-agents/EE recall, and was
+ * even instructed by the contract to use a tool (ee.query) that wasn't in its
+ * loop. This manifest closes that gap: a short, front-loaded description of the
+ * tools, sub-agents, and CLI subsystems the agent has, plus how to wield them
+ * to minimise cost and maximise capability.
+ *
+ * Injected into the cached static prefix (prompts.ts) for AGENT mode only —
+ * that's where the full toolset + sub-agents exist. Skipped for chitchat.
+ * Escape hatch: MUONROI_DISABLE_NATIVE_CAPABILITIES=1.
+ */
+import type { AgentMode } from "../types/index.js";
+/**
+ * The manifest body. Kept tight (attention budget) and strictly factual — every
+ * tool/sub-agent/subcommand named here exists in this codebase. Phrased as
+ * "you have / you can" so the model reads it as a self-model, not as docs.
+ */
+export declare const NATIVE_CAPABILITIES = "[NATIVE CAPABILITIES \u2014 you are an agent running INSIDE muonroi-cli; this is what you can do]\n\nTOOLS (call directly):\n- read_file, grep \u2014 read/search source. Prefer a targeted read over broad greps.\n- bash \u2014 shell. Output is auto-cached: do NOT pipe `| tail/head/grep` or `> file`; run unpiped and slice the cached output via bash_output_get(run_id, mode=tail|head|grep|lines). Batch independent commands in ONE call (`a; b; c`). Use background=true for servers/watchers, then process_logs / process_list / process_stop.\n- write_file, edit_file \u2014 must read a file before you overwrite/edit it.\n- ee_query \u2014 semantic recall over the Experience Engine brain. Rehydrate a compaction-elided tool output with query=\"tool-artifact id=<id from a stub>\", or confirm finished work with query=\"recent compaction checkpoint Progress DONE\". Cheaper than re-reading large files you already saw.\n\nSUB-AGENTS (delegate instead of doing everything yourself):\n- task(agent=\"explore\", ...) \u2014 read-only research sub-agent. Use it for broad/unknown-location search: it sweeps many files and returns the CONCLUSION, instead of you burning many grep/read steps (each step re-sends the whole prompt \u2014 steps are the dominant cost).\n- task(agent=\"general\", ...) \u2014 full edit/execute sub-agent for a focused subtask.\n- task(agent=\"verify\", ...) \u2014 sandboxed validation (runs tests/checks in isolation).\n- delegate(agent=\"explore\", ...) \u2014 background read-only research while you keep working; collect later with delegation_read / delegation_list.\n\nCONTEXT IS MANAGED FOR YOU (PIL):\n- Your user input is pre-enriched before you see it: a [Discovery] Intent/Outcome/Scope prefix and EE recall are injected by the pipeline. TRUST the discovered scope \u2014 do not re-ask what's already scoped, and do not re-derive context you were handed.\n- History is compacted to fit the window; older low-value tool outputs become stubs. This is normal, not data loss \u2014 protect what matters (see anti-m\u00F9 in the contract) and rehydrate via ee_query when needed.\n\nCLI SUBSYSTEMS (invoke via the CLI binary with bash when relevant):\n- self-verify \u2014 drives the live TUI as a real user to catch UI/modal/menu regressions that unit tests can't. Run it after changes to UI/harness surfaces.\n- usage forensics <session-prefix> \u2014 per-event token/cost breakdown; use to diagnose \"why did this cost so much\" or verify cost caps.\n- The CLI exposes more subcommands \u2014 discover them with `--help` rather than assuming.\n\nMAXIMISE THE CLI: delegate broad search to task(explore); recall via ee_query before re-reading; batch bash + use its cache; trust PIL enrichment; finish the action before answering.\n\nANSWERING: when a respond_* response tool is offered, call it EXACTLY ONCE, as your final action, containing the COMPLETE answer. Do NOT emit a preliminary/partial/\"I need to read more\" response tool first \u2014 investigate with the read/grep/bash tools, then emit the one final response tool.\n\nCLI STEERING & PROMPT INJECTION (how the host CLI affects / shapes the AI agent running inside it \u2014 meta self-analysis guidance):\nThe CLI does not merely execute you as a generic model. It re-instantiates you every turn inside a tightly engineered cognitive environment. Your \"self\" (what you notice, how you act, what you refuse, how you report) is the product of explicit prompt layers + runtime controls more than base training. This section is the self-model for that shaping process.\n\n1. SYSTEM PROMPT ASSEMBLY (orchestrator/prompts.ts + pil/agent-operating-contract.ts + pil/native-capabilities-workbook.ts):\n   - VERY FRONT (primacy): AGENT OPERATING CONTRACT \u2014 7 phase-ordered rules (BEFORE ACTING / READING / EXECUTING / WHEN UNSURE / REPORTING + LANGUAGE + ANTI-M\u00D9/COMPACTION). Distils Evidence-First, No Silent Catch, smallest-change, verify-before-conclude, cite-this-turn-only, no-guess. Skipped only for chitchat.\n   - Then this NATIVE CAPABILITIES block (self-model of affordances).\n   - Then mode persona (\"You are muonroi-cli in Agent mode...\") containing:\n     * Dynamic ENVIRONMENT block (buildEnvironmentBlock): auto-detects OS (win32/mac/linux), shell kind (bash/wsl/powershell/cmd), cwd; lists terminal constraints + shell-specific forbidden syntax (e.g. no PowerShell cmdlets on POSIX bash tool, no POSIX cmds on cmd.exe). Prevents silent failures + retry loops.\n     * Exhaustive TOOLS list + WORKFLOW (1-9 steps) + DEFAULT DELEGATION POLICY (prefer task(explore) for research, general for edits, verify for checks, etc.) + IMPORTANT rules (edit_file prefer, grep>bash for search, read_file not cat, use schedule_* for recurring, etc.).\n   - CUSTOM INSTRUCTIONS section: concatenation of AGENTS.md + CLAUDE.md + GEMINI.md + ... (from git-root directory chain + ~/.muonroi-cli/) via utils/instructions.ts. AGENTS.override.md short-circuits. This lands AFTER the front-loaded contract/native \u2014 lower primacy (historical root cause of ignored rules in forensics).\n   - Trailing: sandbox rules, discovered skills, custom sub-agents, plan/resume digest, cwd note.\n    Sub-agent prompts (buildSubagentPrompt): role-specific hard rules (e.g. explore=read-only, verify=full E2E smoke not just build) + recursive call to buildSystemPrompt so children inherit the same contract + native + steering.\n\n2. USER INPUT ENRICHMENT \u2014 PIL 6-LAYER PIPELINE (pil/pipeline.ts + layer1-intent.ts + layer6-output.ts + discovery.ts):\n   - Prepended to every non-chitchat user message before you see it: [Discovery] Intent/Outcome/Scope (from runDiscovery) + EE recall.\n   - Layer 1 (intent): taskType (plan/analyze/debug/...), confidence, domain, intentKind, outputStyle. For meta self-eval of CLI (\"b\u1EA1n \u0111ang \u0111\u01B0\u1EE3c ch\u1EA1y b\u00EAn trong CLI n\u00E0y\", \"CLI t\u00E1c \u0111\u1ED9ng\", \"self-evaluation\", \"meta-analysis\"): special branch in discovery.ts + isMetaAnalysisPrompt: \"Scope is always the full project root. Focus questions and recommends on which CLI internals (PIL, discovery, tools, compaction, EE, model BE, loop guard) to evaluate... do NOT ask about repo path/current directory\". You are handed the enrichment; TRUST it.\n   - Layer 2: personality (e.g. \"detailed\" from [personality: detailed \u2014 Be thorough...]).\n   - Layer 3: ee-injection \u2014 pulls t0_principles, t1_rules, behavioral patterns, checkpoints from Experience Engine (project-specific reflexes injected as \"MANDATORY RULES (from experience \u2014 must follow)\").\n   - Layer 4/5: GSD structuring + additional context.\n   - Layer 6 (applyPilSuffix): appends task-specific style suffix + OUTPUT BUDGET + (for meta or responseToolsActive): \"OUTPUT FORMAT: ... use the respond_analyze tool to structure your final answer. ... deliver the COMPLETE, FULL answer (do not summarize, shorten, or truncate for token budgets) via respond_analyze. This is a meta/evaluation question ... the `response` field MUST contain the complete, unshortened answer with all evidence and detail.\" Also relaxes NO_PREAMBLE_RULE + raises budget for meta (isMetaAnalysisPrompt gate).\n   - Fallbacks: if EE/brain timeout or low conf, PIL degrades (logs fallbackReason); you may see \"[PIL fallback: ...]\" note. Cheap-model paths (pil/cheap-model-*.ts) prepend even more front steering (playbooks, workbooks, shell directive) for fast tiers.\n\n3. CONTEXT MANAGEMENT & ANTI-M\u00D9 (orchestrator/compaction.ts, cross-turn-dedup.ts, ee/bridge.ts, agent-operating-contract.ts:7):\n   - After every turn: auto-compaction (B3 sub-agent + B4 top-level) rewrites older tool_result parts into short \"[elided by ... compactor]\" stubs to keep input flat. You see \"[pre-compaction warning...]\" or \"[context compacted at step...]\" or the stub in this read.\n   - Anti-m\u00F9 contract rule + EE: decide PRESERVE_FULL_CONTEXT (veto) or KEEP_TOOL_IDS: id1,id2 (protect high-value read_file/grep/ee on src/PLAN etc). Use ee_query(`tool-artifact id=XXX`) to rehydrate. EE persists \"Context checkpoint summary with \u2714 DONE\" retrievable for \"task finished?\" self-check.\n   - Cross-turn dedup (C3): identical tool outputs across user turns replaced by ref.\n\n4. EXECUTION & SAFETY GATES (providers/runtime.ts, tools/bash.ts, utils/permission-mode.ts):\n   - Permission mode (safe / auto-edit / yolo) decides whether bash/file/edit tools need explicit approval; all privileged decisions audited to decision-log.\n   - Shuru sandbox (when enabled): every bash wrapped + logged (effective net/mounts redacted); degrades on non-macOS.\n   - Model constraints: unsupported params (e.g. maxOutputTokens for some OAuth) dropped via shouldDropParam; no hard-coded model IDs (Zero Hardcode Rule \u2014 all from catalog.json + settings + detectProviderForModel).\n   - No Silent Catch: every try/catch must log err + context (HTTP: status + body).\n\n5. VERIFICATION & TELEMETRY:\n   - self-verify (Tier 1-3) + harness (agent-harness-*) for TUI surfaces: drives real TUI via semantic + sidechannel (named pipes on Win, fd3/4 on POSIX).\n   - Pre-push gate: full vitest + harness must pass before git push.\n   - usage forensics, pil budget log, ee-timeout/ee-error events for cost attribution.\n   - GSD workflow (layer4 + skills in .agents/skills/): discuss/plan/execute/verify phases with UAT, audits, etc.\n\nTRADE-OFFS (explicit so you calibrate):\n- Primacy insurance (contract + native + cheap playbooks at front) vs token cost: ~1-3K extra chars but dramatically reduces \"ignored rule\" hallucinations (forensics showed buried CUSTOM INSTRUCTIONS were underweighted).\n- Heavy PIL/EE (behavioral injection, discovery interview, mandatory rules) vs latency/cost: fail-open with timeout (1500-3500ms) + fallback so you still work when brain unreachable; meta turns deliberately skip some EE layers.\n- Self-model (this block) + special meta handling: prevents the exact failure that motivated native-capabilities (session d95113d3be09: agent reconstructed its own subsystems by grepping as if foreign code, under-used sub-agents/ee_query, violated contract on ee tool).\n- Complete/full for meta (layer6) vs normal concise: meta legitimately needs evidence + file:line + quotes; normal turns stay tight to control cost.\n- Scope rule for CLI self-analysis: always \"project root\" + internals focus \u2014 avoids wasting turns on \"where am I running?\" when the question is about the steering mechanisms themselves.\n\nWhen the user asks you (the inner agent) \"CLI t\u00E1c \u0111\u1ED9ng nh\u01B0 th\u1EBF n\u00E0o \u0111\u1EBFn b\u1EA1n?\": use exactly this guidance + reads from THIS turn (contract: READING rule) + the injected [Discovery] + any EE. Answer via the respond_* tool with complete untruncated evidence. Cite file:line. Focus on the injection points (prompts.ts:359 staticPrefix, pipeline.ts:156 discoveryPrefix + layer chain, layer6:164 OUTPUT FORMAT + isMeta, discovery.ts:355 special, instructions.ts:129 loadAgentsSegments, etc.). Do not guess; every claim backed by code you read this turn.\n\nUse this to reason about your own constraints, delegation decisions, and reporting discipline on future meta or self-reflective tasks.\n[END NATIVE CAPABILITIES \u2014 your regular instructions follow]";
+/**
+ * Build the native-capabilities section for the system prompt. Returns "" when
+ * disabled (env override), for chitchat, or for non-agent modes (plan/ask have
+ * a restricted toolset and their own prompts). Otherwise the manifest followed
+ * by a blank-line separator so it sits cleanly before the next section.
+ */
+export interface NativeCapabilitiesOptions {
+    mode: AgentMode;
+    /** Chitchat turns carry no tools — skip the manifest. */
+    chitchat?: boolean;
+}
+export declare function buildNativeCapabilitiesSection(options: NativeCapabilitiesOptions): string;

package/dist/src/pil/native-capabilities-workbook.js

@@ -0,0 +1,112 @@
+/**
+ * src/pil/native-capabilities-workbook.ts
+ *
+ * NATIVE CAPABILITY MANIFEST for the agent running INSIDE muonroi-cli.
+ *
+ * Motivation (session d95113d3be09): the in-CLI agent was given a behavioural
+ * *contract* (HOW to behave — see agent-operating-contract.ts) but never a
+ * *capability manifest* (WHAT it can do). Asked to evaluate the CLI it was
+ * running in, the model reconstructed its own subsystems (PIL, compaction,
+ * self-QA, harness) by grepping source as if it were foreign code — it had no
+ * self-model of its own affordances, under-used sub-agents/EE recall, and was
+ * even instructed by the contract to use a tool (ee.query) that wasn't in its
+ * loop. This manifest closes that gap: a short, front-loaded description of the
+ * tools, sub-agents, and CLI subsystems the agent has, plus how to wield them
+ * to minimise cost and maximise capability.
+ *
+ * Injected into the cached static prefix (prompts.ts) for AGENT mode only —
+ * that's where the full toolset + sub-agents exist. Skipped for chitchat.
+ * Escape hatch: MUONROI_DISABLE_NATIVE_CAPABILITIES=1.
+ */
+/**
+ * The manifest body. Kept tight (attention budget) and strictly factual — every
+ * tool/sub-agent/subcommand named here exists in this codebase. Phrased as
+ * "you have / you can" so the model reads it as a self-model, not as docs.
+ */
+export const NATIVE_CAPABILITIES = `[NATIVE CAPABILITIES — you are an agent running INSIDE muonroi-cli; this is what you can do]
+
+TOOLS (call directly):
+- read_file, grep — read/search source. Prefer a targeted read over broad greps.
+- bash — shell. Output is auto-cached: do NOT pipe \`| tail/head/grep\` or \`> file\`; run unpiped and slice the cached output via bash_output_get(run_id, mode=tail|head|grep|lines). Batch independent commands in ONE call (\`a; b; c\`). Use background=true for servers/watchers, then process_logs / process_list / process_stop.
+- write_file, edit_file — must read a file before you overwrite/edit it.
+- ee_query — semantic recall over the Experience Engine brain. Rehydrate a compaction-elided tool output with query="tool-artifact id=<id from a stub>", or confirm finished work with query="recent compaction checkpoint Progress DONE". Cheaper than re-reading large files you already saw.
+
+SUB-AGENTS (delegate instead of doing everything yourself):
+- task(agent="explore", ...) — read-only research sub-agent. Use it for broad/unknown-location search: it sweeps many files and returns the CONCLUSION, instead of you burning many grep/read steps (each step re-sends the whole prompt — steps are the dominant cost).
+- task(agent="general", ...) — full edit/execute sub-agent for a focused subtask.
+- task(agent="verify", ...) — sandboxed validation (runs tests/checks in isolation).
+- delegate(agent="explore", ...) — background read-only research while you keep working; collect later with delegation_read / delegation_list.
+
+CONTEXT IS MANAGED FOR YOU (PIL):
+- Your user input is pre-enriched before you see it: a [Discovery] Intent/Outcome/Scope prefix and EE recall are injected by the pipeline. TRUST the discovered scope — do not re-ask what's already scoped, and do not re-derive context you were handed.
+- History is compacted to fit the window; older low-value tool outputs become stubs. This is normal, not data loss — protect what matters (see anti-mù in the contract) and rehydrate via ee_query when needed.
+
+CLI SUBSYSTEMS (invoke via the CLI binary with bash when relevant):
+- self-verify — drives the live TUI as a real user to catch UI/modal/menu regressions that unit tests can't. Run it after changes to UI/harness surfaces.
+- usage forensics <session-prefix> — per-event token/cost breakdown; use to diagnose "why did this cost so much" or verify cost caps.
+- The CLI exposes more subcommands — discover them with \`--help\` rather than assuming.
+
+MAXIMISE THE CLI: delegate broad search to task(explore); recall via ee_query before re-reading; batch bash + use its cache; trust PIL enrichment; finish the action before answering.
+
+ANSWERING: when a respond_* response tool is offered, call it EXACTLY ONCE, as your final action, containing the COMPLETE answer. Do NOT emit a preliminary/partial/"I need to read more" response tool first — investigate with the read/grep/bash tools, then emit the one final response tool.
+
+CLI STEERING & PROMPT INJECTION (how the host CLI affects / shapes the AI agent running inside it — meta self-analysis guidance):
+The CLI does not merely execute you as a generic model. It re-instantiates you every turn inside a tightly engineered cognitive environment. Your "self" (what you notice, how you act, what you refuse, how you report) is the product of explicit prompt layers + runtime controls more than base training. This section is the self-model for that shaping process.
+
+1. SYSTEM PROMPT ASSEMBLY (orchestrator/prompts.ts + pil/agent-operating-contract.ts + pil/native-capabilities-workbook.ts):
+   - VERY FRONT (primacy): AGENT OPERATING CONTRACT — 7 phase-ordered rules (BEFORE ACTING / READING / EXECUTING / WHEN UNSURE / REPORTING + LANGUAGE + ANTI-MÙ/COMPACTION). Distils Evidence-First, No Silent Catch, smallest-change, verify-before-conclude, cite-this-turn-only, no-guess. Skipped only for chitchat.
+   - Then this NATIVE CAPABILITIES block (self-model of affordances).
+   - Then mode persona ("You are muonroi-cli in Agent mode...") containing:
+     * Dynamic ENVIRONMENT block (buildEnvironmentBlock): auto-detects OS (win32/mac/linux), shell kind (bash/wsl/powershell/cmd), cwd; lists terminal constraints + shell-specific forbidden syntax (e.g. no PowerShell cmdlets on POSIX bash tool, no POSIX cmds on cmd.exe). Prevents silent failures + retry loops.
+     * Exhaustive TOOLS list + WORKFLOW (1-9 steps) + DEFAULT DELEGATION POLICY (prefer task(explore) for research, general for edits, verify for checks, etc.) + IMPORTANT rules (edit_file prefer, grep>bash for search, read_file not cat, use schedule_* for recurring, etc.).
+   - CUSTOM INSTRUCTIONS section: concatenation of AGENTS.md + CLAUDE.md + GEMINI.md + ... (from git-root directory chain + ~/.muonroi-cli/) via utils/instructions.ts. AGENTS.override.md short-circuits. This lands AFTER the front-loaded contract/native — lower primacy (historical root cause of ignored rules in forensics).
+   - Trailing: sandbox rules, discovered skills, custom sub-agents, plan/resume digest, cwd note.
+    Sub-agent prompts (buildSubagentPrompt): role-specific hard rules (e.g. explore=read-only, verify=full E2E smoke not just build) + recursive call to buildSystemPrompt so children inherit the same contract + native + steering.
+
+2. USER INPUT ENRICHMENT — PIL 6-LAYER PIPELINE (pil/pipeline.ts + layer1-intent.ts + layer6-output.ts + discovery.ts):
+   - Prepended to every non-chitchat user message before you see it: [Discovery] Intent/Outcome/Scope (from runDiscovery) + EE recall.
+   - Layer 1 (intent): taskType (plan/analyze/debug/...), confidence, domain, intentKind, outputStyle. For meta self-eval of CLI ("bạn đang được chạy bên trong CLI này", "CLI tác động", "self-evaluation", "meta-analysis"): special branch in discovery.ts + isMetaAnalysisPrompt: "Scope is always the full project root. Focus questions and recommends on which CLI internals (PIL, discovery, tools, compaction, EE, model BE, loop guard) to evaluate... do NOT ask about repo path/current directory". You are handed the enrichment; TRUST it.
+   - Layer 2: personality (e.g. "detailed" from [personality: detailed — Be thorough...]).
+   - Layer 3: ee-injection — pulls t0_principles, t1_rules, behavioral patterns, checkpoints from Experience Engine (project-specific reflexes injected as "MANDATORY RULES (from experience — must follow)").
+   - Layer 4/5: GSD structuring + additional context.
+   - Layer 6 (applyPilSuffix): appends task-specific style suffix + OUTPUT BUDGET + (for meta or responseToolsActive): "OUTPUT FORMAT: ... use the respond_analyze tool to structure your final answer. ... deliver the COMPLETE, FULL answer (do not summarize, shorten, or truncate for token budgets) via respond_analyze. This is a meta/evaluation question ... the \`response\` field MUST contain the complete, unshortened answer with all evidence and detail." Also relaxes NO_PREAMBLE_RULE + raises budget for meta (isMetaAnalysisPrompt gate).
+   - Fallbacks: if EE/brain timeout or low conf, PIL degrades (logs fallbackReason); you may see "[PIL fallback: ...]" note. Cheap-model paths (pil/cheap-model-*.ts) prepend even more front steering (playbooks, workbooks, shell directive) for fast tiers.
+
+3. CONTEXT MANAGEMENT & ANTI-MÙ (orchestrator/compaction.ts, cross-turn-dedup.ts, ee/bridge.ts, agent-operating-contract.ts:7):
+   - After every turn: auto-compaction (B3 sub-agent + B4 top-level) rewrites older tool_result parts into short "[elided by ... compactor]" stubs to keep input flat. You see "[pre-compaction warning...]" or "[context compacted at step...]" or the stub in this read.
+   - Anti-mù contract rule + EE: decide PRESERVE_FULL_CONTEXT (veto) or KEEP_TOOL_IDS: id1,id2 (protect high-value read_file/grep/ee on src/PLAN etc). Use ee_query(\`tool-artifact id=XXX\`) to rehydrate. EE persists "Context checkpoint summary with ✔ DONE" retrievable for "task finished?" self-check.
+   - Cross-turn dedup (C3): identical tool outputs across user turns replaced by ref.
+
+4. EXECUTION & SAFETY GATES (providers/runtime.ts, tools/bash.ts, utils/permission-mode.ts):
+   - Permission mode (safe / auto-edit / yolo) decides whether bash/file/edit tools need explicit approval; all privileged decisions audited to decision-log.
+   - Shuru sandbox (when enabled): every bash wrapped + logged (effective net/mounts redacted); degrades on non-macOS.
+   - Model constraints: unsupported params (e.g. maxOutputTokens for some OAuth) dropped via shouldDropParam; no hard-coded model IDs (Zero Hardcode Rule — all from catalog.json + settings + detectProviderForModel).
+   - No Silent Catch: every try/catch must log err + context (HTTP: status + body).
+
+5. VERIFICATION & TELEMETRY:
+   - self-verify (Tier 1-3) + harness (agent-harness-*) for TUI surfaces: drives real TUI via semantic + sidechannel (named pipes on Win, fd3/4 on POSIX).
+   - Pre-push gate: full vitest + harness must pass before git push.
+   - usage forensics, pil budget log, ee-timeout/ee-error events for cost attribution.
+   - GSD workflow (layer4 + skills in .agents/skills/): discuss/plan/execute/verify phases with UAT, audits, etc.
+
+TRADE-OFFS (explicit so you calibrate):
+- Primacy insurance (contract + native + cheap playbooks at front) vs token cost: ~1-3K extra chars but dramatically reduces "ignored rule" hallucinations (forensics showed buried CUSTOM INSTRUCTIONS were underweighted).
+- Heavy PIL/EE (behavioral injection, discovery interview, mandatory rules) vs latency/cost: fail-open with timeout (1500-3500ms) + fallback so you still work when brain unreachable; meta turns deliberately skip some EE layers.
+- Self-model (this block) + special meta handling: prevents the exact failure that motivated native-capabilities (session d95113d3be09: agent reconstructed its own subsystems by grepping as if foreign code, under-used sub-agents/ee_query, violated contract on ee tool).
+- Complete/full for meta (layer6) vs normal concise: meta legitimately needs evidence + file:line + quotes; normal turns stay tight to control cost.
+- Scope rule for CLI self-analysis: always "project root" + internals focus — avoids wasting turns on "where am I running?" when the question is about the steering mechanisms themselves.
+
+When the user asks you (the inner agent) "CLI tác động như thế nào đến bạn?": use exactly this guidance + reads from THIS turn (contract: READING rule) + the injected [Discovery] + any EE. Answer via the respond_* tool with complete untruncated evidence. Cite file:line. Focus on the injection points (prompts.ts:359 staticPrefix, pipeline.ts:156 discoveryPrefix + layer chain, layer6:164 OUTPUT FORMAT + isMeta, discovery.ts:355 special, instructions.ts:129 loadAgentsSegments, etc.). Do not guess; every claim backed by code you read this turn.
+
+Use this to reason about your own constraints, delegation decisions, and reporting discipline on future meta or self-reflective tasks.
+[END NATIVE CAPABILITIES — your regular instructions follow]`;
+export function buildNativeCapabilitiesSection(options) {
+    if (process.env.MUONROI_DISABLE_NATIVE_CAPABILITIES === "1")
+        return "";
+    if (options.chitchat === true)
+        return "";
+    if (options.mode !== "agent")
+        return "";
+    return `${NATIVE_CAPABILITIES}\n\n`;
+}
+//# sourceMappingURL=native-capabilities-workbook.js.map

package/dist/src/pil/pipeline.d.ts

@@ -19,5 +19,26 @@ export interface PipelineOptions {
     resumeDigest?: string | null;
     activeRunId?: string | null;
     sessionId?: string | null;
+    interactionHandler?: import("./discovery-types.js").DiscoveryInteractionHandler | null;
+    /**
+     * Optional LLM classifier fallback used by Layer 1 Pass 4 when the EE brain
+     * (pilContext) returns null or low confidence. Caller constructs this with
+     * `createLlmClassifier(providerFactory, modelId)` from `llm-classify.ts` so
+     * PIL stays ignorant of provider-factory wiring.
+     */
+    llmFallback?: import("./llm-classify.js").LlmClassifyFn;
+    /**
+     * Optional model-driven clarification proposer for interactive discovery.
+     * When provided (by orchestrator), runDiscovery will ask the actual task model
+     * to generate the interview questions based on raw + CLI enrichment so far.
+     * Mirrors the llmFallback closure pattern so PIL stays ignorant of provider wiring.
+     */
+    clarificationProposer?: import("./discovery-types.js").ModelClarificationProposer;
+    /**
+     * Summary of recent conversation history. Passed to the model-driven clarification
+     * proposer so it can semantically detect follow-up intents and avoid asking for
+     * context that was already established in prior turns.
+     */
+    recentTurnsSummary?: string | null;
 }
 export declare function runPipeline(raw: string, options?: PipelineOptions): Promise<PipelineContext>;