muonroi-cli 1.8.4 → 1.9.0

package/dist/src/council/strip-think.js

@@ -0,0 +1,33 @@
+/**
+ * Strip inline chain-of-thought markup from council LLM output.
+ *
+ * Some providers (kimi-k2.7 via opencode-go, GLM thinking variants) emit
+ * reasoning inline as `<think>…</think>` in `result.text` instead of the AI
+ * SDK's separated `reasoningText`. Rendered verbatim, the user sees hundreds
+ * of words of internal drafting above every debate turn (live-verified
+ * 2026-07-06). Applied at the council LLM boundary (src/council/llm.ts) so
+ * every consumer — debate turns, leader evals, synthesis — is covered.
+ *
+ * Handles three shapes:
+ *   - complete `<think>…</think>` blocks anywhere (global, case-insensitive)
+ *   - an unclosed trailing `<think>…` block (output truncated mid-reasoning)
+ *   - a stray leading `…</think>` (model omitted the opener; everything up to
+ *     and including the close tag is reasoning)
+ */
+export function stripThinkBlocks(text) {
+    if (!text || !/<\/?think>/i.test(text))
+        return text;
+    let out = text.replace(/<think>[\s\S]*?<\/think>/gi, "");
+    // Stray close tag with no opener before it → everything before it is reasoning.
+    const closeIdx = out.search(/<\/think>/i);
+    if (closeIdx !== -1) {
+        out = out.slice(closeIdx).replace(/^<\/think>/i, "");
+    }
+    // Unclosed opener → everything after it is reasoning that got truncated.
+    const openIdx = out.search(/<think>/i);
+    if (openIdx !== -1) {
+        out = out.slice(0, openIdx);
+    }
+    return out.trim();
+}
+//# sourceMappingURL=strip-think.js.map

package/dist/src/council/types.d.ts

@@ -1,6 +1,15 @@
 import type { ModelMessage } from "ai";
 import type { ProcessMessageObserver } from "../orchestrator/agent-options.js";
+import type { TaskRequest, ToolResult } from "../types/index.js";
 import type { ModelRole } from "../utils/settings.js";
+/**
+ * Bridge to the orchestrator's isolated sub-agent runner (runTaskRequest). When
+ * wired into a council run, heavy phases (research; #3 grounding-verify) execute
+ * in a budget-capped, near-empty explore sub-agent instead of an in-process
+ * multi-step generateText that bloats the council thread/context. The bridge
+ * closure captures the council abort signal, so callers pass only the request.
+ */
+export type IsolatedTaskRunner = (request: TaskRequest) => Promise<ToolResult>;
 export interface CouncilQuestion {
     questionId: string;
     question: string;
@@ -37,6 +46,14 @@ export interface ClarifiedSpec {
     }>;
     /** Populated by P6 when the spec is converted to a Backlog. */
     backlogId?: string;
+    /**
+     * Ongoing-task / conversation context captured at council entry. Attached in
+     * council/index.ts on BOTH the explicit `/council` path and auto-council, so
+     * every debate stage (not just the opening statement) stays anchored to the
+     * parent task and the decisions already made earlier in the session. Optional
+     * for backward compat — empty when the council runs with no prior context.
+     */
+    parentContext?: string;
 }
 export interface CouncilPreflight {
     preflightId: string;
@@ -73,6 +90,12 @@ export interface LeaderEvaluation {
      * close to resolving the last unresolved point.
      */
     extendRounds?: number;
+    /**
+     * One-line focus/topic the leader sets for the NEXT round when the debate
+     * continues. Surfaced in the round-grouped transcript overview (P6). Optional
+     * — absent on convergence/stop.
+     */
+    nextRoundFocus?: string;
 }
 export interface DebateState {
     spec: ClarifiedSpec;
@@ -83,8 +106,34 @@ export interface DebateState {
     active: CouncilParticipant[];
     /** Evidence density from the final leader evaluation (0.0–1.0). Drives confidence badge. */
     finalEvidenceDensity?: number;
+    /**
+     * Total claims participants explicitly tagged ([CONFIRMED]/[REFUTED]/
+     * [UNVERIFIED]) across the debate. 0 = no evidence tags emitted, so density
+     * is unmeasurable rather than genuinely 0% — the badge distinguishes them.
+     */
+    finalTaggedClaims?: number;
     /** Role-indexed per-round positions for follow-up citations. */
     archive?: DebateArchiveEntry[];
+    /**
+     * F1 — the last successful round's per-criterion met flags, index-aligned to
+     * `spec.successCriteria`. Lets the post-debate card tell whether the debate
+     * actually satisfied the pinned success criteria (distinct from evidence
+     * density) so an unmet outcome is framed as provisional, not a settled
+     * decision. Undefined when the spec had no pinned criteria or no round eval
+     * ever produced a criteria status (treated as all-unmet by the card).
+     */
+    finalCriteriaMet?: boolean[];
+    /**
+     * B4 interactive escalation outcome. Set only when the user was prompted at a
+     * stop-with-unmet boundary and chose an action: `extend` granted extra rounds
+     * past the ceiling, `accept` proceeded with criteria open, `rescope` asked to
+     * narrow the scope. Undefined when no escalation fired (auto-resolved, headless,
+     * or all criteria met). Lets synthesis/caller react to a user-driven partial stop.
+     */
+    escalation?: {
+        action: "extend" | "accept" | "rescope";
+        grantedRounds?: number;
+    };
 }
 /**
  * Single position taken by a participant in one round. Used to answer
@@ -186,7 +235,37 @@ export interface EnhancedCouncilOutcome {
         answer: string;
     };
     plan?: ActionPlan;
+    /**
+     * Model-first post-debate options. The leader synthesis picks 2-4 actions
+     * from the wired handler vocabulary that FIT this debate's intent (a bug
+     * investigation vs an evaluation vs a plan warrant different follow-ups),
+     * ordered best-first. Rendered as the post-debate askcard instead of the
+     * old fixed "accept / research / apply" template. Empty/absent → index.ts
+     * falls back to the deterministic option set.
+     */
+    nextActions?: Array<{
+        action: PostDebateActionId;
+        label: string;
+        reason?: string;
+    }>;
 }
+/**
+ * Post-debate actions the leader may recommend. Bounded to handlers wired in
+ * index.ts's post-debate switch — the model selects/orders/labels FROM this
+ * vocabulary, it cannot invent new actions. Context-only actions
+ * (retry_synthesis on failure, refine on empty sections) are added by index.ts,
+ * not the model.
+ */
+export type PostDebateActionId = "ask_followup" | "generate_plan" | "implement" | "save_exit"
+/**
+ * Persist the outcome and hand control back to the session with the synthesis
+ * enriched into the message history (appendCompletedTurn), so the agent keeps
+ * working on the ORIGINAL task using the debate's trusted conclusion as
+ * context. The right default for a pure discussion / hard-problem debate whose
+ * deliverable is the conclusion itself. Behaves like save_exit at the handler
+ * level (falls through to persistence) — the distinction is intent + framing.
+ */
+ | "continue_session";
 export interface CouncilConfig {
     topic: string;
     conversationContext: string;
@@ -211,6 +290,13 @@ export interface CouncilConfig {
     internetFirst?: boolean;
     /** When true, leader sub-tasks downshift to cheaper tier models on the same provider. */
     costAware?: boolean;
+    /**
+     * Feature B — council debate language override. When set, runDebate uses this
+     * instead of reading `getCouncilLanguage()` from settings. Values: "auto"
+     * (follow the brief's language), "english" (historical English-only debate),
+     * or any locale label. Undefined → resolved from the user setting.
+     */
+    debateLanguage?: string;
     /**
      * Enclosing council run id (= sessionId). Used only as the correlationId on the
      * observe-only `council-turn-length` harness event so per-turn length samples can
@@ -218,6 +304,58 @@ export interface CouncilConfig {
      * stable literal); has no effect on debate behaviour.
      */
     runId?: string;
+    /**
+     * B4 interactive escalation channel. When wired, a debate about to STOP with
+     * pinned criteria still unmet (leader gave up or hit the ceiling) hands the
+     * decision to the user via a council_question askcard instead of silently
+     * synthesizing a partial outcome. Optional: headless/direct callers omit it and
+     * the debate falls through to the diagnostic closing verdict unchanged. Same
+     * responder the clarifier + post-debate askcards use.
+     */
+    respondToQuestion?: QuestionResponder;
+    /**
+     * convene_council path — when true, the mid-debate escalation askcard
+     * (runEscalationPrompt) is auto-accepted WITHOUT emitting a blocking
+     * council_question card. The convene tool runs the council autonomously
+     * mid-agent-turn: there is no interactive user answering the escalation, so a
+     * card would hang the tool call. Auto-accept = conclude with the best
+     * synthesis so far. No decision is hardcoded post-synthesis — the calling
+     * agent decides what to do with the returned conclusion.
+     */
+    convenePath?: boolean;
+    /**
+     * C (mid-debate checkpoint) — directory to persist the per-round debate
+     * checkpoint (`debate-checkpoint.json`), normally the run dir
+     * `.muonroi-flow/runs/<runId>`. When set, runDebate snapshots its state after
+     * each completed round and deletes it on normal completion. Unset → no
+     * checkpointing (direct callers/tests).
+     */
+    checkpointDir?: string;
+    /**
+     * C — a prior checkpoint to resume from. When present AND it matches this
+     * debate (same problem statement + panel), runDebate skips the research +
+     * opening phases and the already-completed rounds, restoring the accumulated
+     * transcript, and continues from the last completed round. Ignored on mismatch.
+     */
+    resumeCheckpoint?: import("./debate-checkpoint.js").DebateCheckpoint;
+    /**
+     * #2 — isolated research bridge. When wired (interactive /council + auto-
+     * council), the initial/mid-debate research phase runs in a budget-capped
+     * explore sub-agent (near-empty context, independent compaction) instead of
+     * an in-process 15-step generateText that accretes tool clutter into the
+     * council thread. Optional: headless/direct callers/tests omit it and research
+     * falls back to `llm.research`.
+     */
+    runIsolatedTask?: IsolatedTaskRunner;
+    /**
+     * Sprint-2 item 3 — per-stance recall at debate opening. When wired, runDebate
+     * calls this once before opening statements with the panel's stances/roles and
+     * a query; the returned per-role seed text is folded into each participant's
+     * opening context so every stance opens grounded in the prior experience its
+     * lens cares about (the EE server weights recall collections by stance).
+     * Optional: headless/direct callers/tests omit it and openings run unchanged.
+     */
+    stanceRecall?: (roles: string[], query: string) => Promise<Map<string, string>>;
 }
 /**
  * JSON shape persisted as `[Council Memory] {...}` in the session messages.

package/dist/src/ee/artifact-cache.d.ts

@@ -40,6 +40,22 @@ export declare function getArtifact(toolCallId: string): ArtifactEntry | null;
 export declare function findArtifactByQuery(query: string): (ArtifactEntry & {
     toolCallId: string;
 }) | null;
+/**
+ * B (cheap-model anti-mù) — fuzzy in-memory fallback for a MALFORMED artifact id.
+ * Cheap models routinely botch the `tool-artifact id=<toolCallId>` contract by
+ * passing FILE PATHS instead of the opaque call id (observed live:
+ * `tool-artifact id=src/todo.js src/cli.js …`). extractArtifactId can't parse a
+ * path (its id charset excludes `/`), so the exact lookup silently misses and
+ * the model is stranded. When the exact id lookup has already failed, match by
+ * path against each cached artifact's content (a read_file result carries its
+ * `[<path>: lines …]` header) so the recall still succeeds. Returns the MOST
+ * recently-recorded artifact whose content references any path token in the
+ * hint, or null when the hint has no path-like token / nothing matches — so a
+ * genuinely-unknown id never fuzzy-matches unrelated content.
+ */
+export declare function findArtifactByHint(hint: string): (ArtifactEntry & {
+    toolCallId: string;
+}) | null;
 /**
  * Disk-tier lookup (survives restart). Scans the spill file newest-first so the
  * most recent record for an id wins. Fail-open: a missing/corrupt file yields

package/dist/src/ee/artifact-cache.js

@@ -99,6 +99,38 @@ export function findArtifactByQuery(query) {
     const hit = store.get(id);
     return hit ? { toolCallId: id, toolName: hit.toolName, content: hit.content } : null;
 }
+/** Path-like tokens (contain a slash or a trailing file extension) from a hint. */
+function pathTokens(hint) {
+    return (hint.match(/[^\s"']+/g) ?? [])
+        .map((t) => t.replace(/^id=/i, "")) // drop the contract's `id=` glued to the first path token
+        .filter((t) => t.includes("/") || /\.[A-Za-z0-9]{1,5}$/.test(t));
+}
+/**
+ * B (cheap-model anti-mù) — fuzzy in-memory fallback for a MALFORMED artifact id.
+ * Cheap models routinely botch the `tool-artifact id=<toolCallId>` contract by
+ * passing FILE PATHS instead of the opaque call id (observed live:
+ * `tool-artifact id=src/todo.js src/cli.js …`). extractArtifactId can't parse a
+ * path (its id charset excludes `/`), so the exact lookup silently misses and
+ * the model is stranded. When the exact id lookup has already failed, match by
+ * path against each cached artifact's content (a read_file result carries its
+ * `[<path>: lines …]` header) so the recall still succeeds. Returns the MOST
+ * recently-recorded artifact whose content references any path token in the
+ * hint, or null when the hint has no path-like token / nothing matches — so a
+ * genuinely-unknown id never fuzzy-matches unrelated content.
+ */
+export function findArtifactByHint(hint) {
+    const tokens = pathTokens(hint || "");
+    if (tokens.length === 0)
+        return null;
+    let match = null;
+    // Map insertion order is oldest→newest; keep the LAST (newest) match.
+    for (const [toolCallId, entry] of store) {
+        if (tokens.some((t) => entry.content.includes(t))) {
+            match = { toolCallId, toolName: entry.toolName, content: entry.content };
+        }
+    }
+    return match;
+}
 /**
  * Disk-tier lookup (survives restart). Scans the spill file newest-first so the
  * most recent record for an id wins. Fail-open: a missing/corrupt file yields

package/dist/src/ee/auth.d.ts

@@ -9,6 +9,7 @@ export interface ExperienceConfig {
         authToken?: string;
     };
 }
+export declare function relativizePath(p: string): string;
 export declare function loadEEAuthToken(opts?: {
     home?: string;
 }): Promise<string | null>;
@@ -24,6 +25,25 @@ export declare function refreshAuthToken(opts?: {
 export declare function writeExperienceConfig(patch: Partial<ExperienceConfig>, opts?: {
     home?: string;
 }): Promise<void>;
+/** Where the EE config lives, for display in setup/status output. */
+export declare function getExperienceConfigPath(opts?: {
+    home?: string;
+}): string;
+/**
+ * Best-effort reachability probe against an EE server's /health.
+ *
+ * Returns a reason on failure rather than a bare boolean: "saved but not
+ * reachable" and "saved, server says 401" are different problems for the user
+ * to act on, and collapsing them to `false` hides which one they have.
+ * Never throws — a probe is diagnostics, and must not fail a config write that
+ * already succeeded.
+ */
+export declare function probeEEHealth(baseUrl: string, token?: string, opts?: {
+    timeoutMs?: number;
+}): Promise<{
+    ok: boolean;
+    detail: string;
+}>;
 export declare function getCachedAuthToken(): string | null;
 export declare function getEmbeddingModelVersion(): string;
 export declare function getCachedServerBaseUrl(): string | null;

package/dist/src/ee/auth.js

@@ -8,7 +8,20 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { redactor } from "../utils/redactor.js";
 function configPath(homeOverride) {
-    return path.join(homeOverride ?? os.homedir(), ".experience", "config.json");
+    const base = homeOverride ?? os.homedir();
+    const normalizedBase = base.replace(/\\/g, "/");
+    return path.join(normalizedBase, ".experience", "config.json").replace(/\\/g, "/");
+}
+export function relativizePath(p) {
+    if (!p)
+        return p;
+    let normalized = p.replace(/\\/g, "/");
+    const home = os.homedir().replace(/\\/g, "/");
+    const normalizedHome = home.endsWith("/") ? home.slice(0, -1) : home;
+    if (normalized.startsWith(normalizedHome)) {
+        normalized = "~" + normalized.slice(normalizedHome.length);
+    }
+    return normalized;
 }
 let _token = null;
 let _embeddingModelVersion = null;
@@ -55,9 +68,48 @@ export async function writeExperienceConfig(patch, opts = {}) {
         // No existing config (or unreadable) — start fresh.
     }
     const merged = { ...existing, ...patch };
-    await fs.mkdir(path.dirname(p), { recursive: true });
+    await fs.mkdir(path.dirname(p), { recursive: true, mode: 0o700 });
     await fs.writeFile(p, `${JSON.stringify(merged, null, 2)}\n`, "utf8");
 }
+/** Where the EE config lives, for display in setup/status output. */
+export function getExperienceConfigPath(opts = {}) {
+    return configPath(opts.home);
+}
+/**
+ * Best-effort reachability probe against an EE server's /health.
+ *
+ * Returns a reason on failure rather than a bare boolean: "saved but not
+ * reachable" and "saved, server says 401" are different problems for the user
+ * to act on, and collapsing them to `false` hides which one they have.
+ * Never throws — a probe is diagnostics, and must not fail a config write that
+ * already succeeded.
+ */
+export async function probeEEHealth(baseUrl, token, opts = {}) {
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 4000);
+    try {
+        const res = await fetch(`${baseUrl}/health`, {
+            signal: ac.signal,
+            headers: token ? { authorization: `Bearer ${token}` } : undefined,
+        });
+        if (res.ok)
+            return { ok: true, detail: `HTTP ${res.status}` };
+        return {
+            ok: false,
+            detail: res.status === 401 || res.status === 403
+                ? `HTTP ${res.status} — the server rejected this auth token`
+                : `HTTP ${res.status}`,
+        };
+    }
+    catch (err) {
+        const message = err?.name === "AbortError" ? "timed out" : (err?.message ?? String(err));
+        console.error(`[ee/auth] /health probe failed for ${baseUrl}: ${message}`);
+        return { ok: false, detail: message };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 export function getCachedAuthToken() {
     return _token;
 }

package/dist/src/ee/bridge.d.ts

@@ -1,6 +1,16 @@
 import { type PilContextResponse } from "../pil/schema.js";
 export type { WhoAmIDim, WhoAmIDimName, WhoAmIProfile } from "./who-am-i.js";
 export { getWhoAmIProfile, outputStyleFromProfile, resetWhoAmICache } from "./who-am-i.js";
+import { type WhoAmIProfile } from "./who-am-i.js";
+/** Test-only: allow a fresh warm attempt after resetWhoAmICache(). */
+export declare function resetWhoAmIBrainWarm(): void;
+/**
+ * Fire-and-forget at session boot. Derives a brain-based Who-Am-I profile on a
+ * thin-client and primes the sync cache. Fail-open + bounded (deriveWhoAmIFromBrain
+ * wraps its own timeouts); never throws, never blocks a real device-local profile.
+ * Returns the primed profile (or null) for callers/tests that want to await it.
+ */
+export declare function warmWhoAmIFromBrain(): Promise<WhoAmIProfile | null>;
 interface EEPoint {
     id: string | number;
     score?: number;

package/dist/src/ee/bridge.js

@@ -17,6 +17,59 @@ import { classifyEeError, logEeFailure, readTimeoutEnv, withEeTimeout } from "..
 // local-only (no network), cached, and fail-open — the same contract as the rest
 // of this bridge.
 export { getWhoAmIProfile, outputStyleFromProfile, resetWhoAmICache } from "./who-am-i.js";
+import { getWhoAmIProfile, primeWhoAmICache } from "./who-am-i.js";
+import { deriveWhoAmIFromBrain, isBrainWhoAmIEnabled } from "./who-am-i-brain.js";
+// Thin-client brain-derived Who-Am-I warm. The device-local profile.yaml pipeline is
+// full-brain-only (see who-am-i-brain.ts), so on a thin-client getWhoAmIProfile() is
+// always null and the PIL loses every style signal. warmWhoAmIFromBrain() derives the
+// same profile shape from the reachable `experience-behavioral` brain and primes the
+// per-process cache, so subsequent SYNC getWhoAmIProfile() reads (pipeline.ts:107,
+// layer4/5/6) pick it up. Idempotent + guarded: runs at most once per process, only
+// on a thin-client, only when no device-local profile exists, only when enabled.
+let _brainWhoAmIAttempted = false;
+/** Test-only: allow a fresh warm attempt after resetWhoAmICache(). */
+export function resetWhoAmIBrainWarm() {
+    _brainWhoAmIAttempted = false;
+}
+async function isThinClient() {
+    try {
+        const { getCachedEEClientMode } = await import("./client-mode.js");
+        const modeInfo = getCachedEEClientMode();
+        if (modeInfo)
+            return modeInfo.mode === "thin" || modeInfo.mode === "thin-degraded";
+        return !!(await import("./auth.js")).getCachedServerBaseUrl();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Fire-and-forget at session boot. Derives a brain-based Who-Am-I profile on a
+ * thin-client and primes the sync cache. Fail-open + bounded (deriveWhoAmIFromBrain
+ * wraps its own timeouts); never throws, never blocks a real device-local profile.
+ * Returns the primed profile (or null) for callers/tests that want to await it.
+ */
+export async function warmWhoAmIFromBrain() {
+    if (_brainWhoAmIAttempted)
+        return getWhoAmIProfile();
+    _brainWhoAmIAttempted = true;
+    try {
+        if (!isBrainWhoAmIEnabled())
+            return null;
+        if (getWhoAmIProfile())
+            return getWhoAmIProfile(); // real device-local profile wins
+        if (!(await isThinClient()))
+            return null;
+        const derived = await deriveWhoAmIFromBrain({ searchByText, classifyViaBrain });
+        if (derived)
+            primeWhoAmICache(derived);
+        return derived;
+    }
+    catch (err) {
+        logEeFailure("bridge.warmWhoAmIFromBrain", classifyEeError(err), err);
+        return null;
+    }
+}
 /**
  * Phase 21.5 — `routeModel` / `routeTask` budget. EE server unreachability used
  * to hang `/ideal` for the OS-level fetch connect timeout (~5 min on Windows).
@@ -33,6 +86,11 @@ let _loadAttempted = false;
  * Returns the absolute path if the file is accessible, null otherwise.
  */
 async function resolveCorePath() {
+    if (process.env.MUONROI_TEST_EE_CORE_PATH) {
+        if (process.env.MUONROI_TEST_EE_CORE_PATH === "null")
+            return null;
+        return process.env.MUONROI_TEST_EE_CORE_PATH;
+    }
     const installed = path.join(os.homedir(), ".experience", "experience-core.js");
     try {
         await fs.access(installed);