omp-fabric 1.18.4 → 1.20.0

package/dist/fabric-runtime-state.js

@@ -11,8 +11,8 @@ import {
   MemoryProvider,
   actionArgNormalizer,
   uniqueDeclaredKeyForSpelling
-} from "./chunks/chunk-N5DHCLLX.js";
-import "./chunks/chunk-2KEWFW56.js";
+} from "./chunks/chunk-4J65SMNI.js";
+import "./chunks/chunk-SDZXNTBF.js";
 import "./chunks/chunk-U5FYOMG5.js";
 import {
   ApprovalController,
@@ -33,7 +33,7 @@ import {
   repairFabricGuestCode,
   resolveFabricIdentity,
   runFabricHandoffAtBoundary
-} from "./chunks/chunk-X3XY6SAU.js";
+} from "./chunks/chunk-LNP6JVCZ.js";
 import "./chunks/chunk-7VIQNUPS.js";
 import {
   AgentTranscriptReader,
@@ -50,7 +50,7 @@ import {
   repairActionName,
   setActiveCompiledSurface,
   setActiveRepairCompiler
-} from "./chunks/chunk-2LGLDM34.js";
+} from "./chunks/chunk-R4EFMCIY.js";
 import {
   formatFabricEffectConflict
 } from "./chunks/chunk-LMAVZN7J.js";
@@ -63,14 +63,14 @@ import {
   withExclusiveFileLockAsync
 } from "./chunks/chunk-YWEXP724.js";
 import "./chunks/chunk-4A4MVZQW.js";
-import "./chunks/chunk-FX3XLQYI.js";
-import "./chunks/chunk-6QBPSZJ5.js";
+import "./chunks/chunk-MQSRZC2O.js";
+import "./chunks/chunk-BPMSLBX4.js";
 import {
   FABRIC_COMPONENT_DISCOVER_EVENT,
   FABRIC_PROVIDER_DISCOVER_EVENT,
   FABRIC_TOOL_RESULT_PROXY_KIND,
   readFabricToolResultProxyDetailsV1
-} from "./chunks/chunk-RBA54WC7.js";
+} from "./chunks/chunk-X2SKPWJA.js";
 import {
   ActorDirectory,
   ActorRegistryOwnershipError,
@@ -94,7 +94,7 @@ import {
   resolveAgentCwd,
   resolveOmpBinary,
   validateAgentCwdRequest
-} from "./chunks/chunk-VYB7ROEH.js";
+} from "./chunks/chunk-NP5U3BJZ.js";
 import "./chunks/chunk-VPPIJRNZ.js";
 import {
   executeFile,
@@ -104,7 +104,7 @@ import {
 import "./chunks/chunk-CT2AJ2UI.js";
 import {
   checkedHandoffCompaction
-} from "./chunks/chunk-C5JMLDIM.js";
+} from "./chunks/chunk-RA2IB2QT.js";
 import {
   DEFAULT_FABRIC_CONFIG,
   FUZZY_RESOLUTION_MARKERS,
@@ -114,7 +114,7 @@ import {
   resolveAgentDir,
   resolveAvailableOmpModel,
   resolveFabricModel
-} from "./chunks/chunk-GIBZGL4G.js";
+} from "./chunks/chunk-5FYSQRJ4.js";
 import {
   FABRIC_ACTOR_HOST_EVENTS,
   isFabricActorHostEvent,
@@ -154,7 +154,7 @@ import {
 import {
   estimateTokens,
   fabricExecTitleHintCached
-} from "./chunks/chunk-WMB6QCWX.js";
+} from "./chunks/chunk-ZQ72MAHY.js";
 import "./chunks/chunk-3J7BKUNG.js";
 import {
   MAX_COMPACTION_INSTRUCTIONS_CHARS,
@@ -164,17 +164,19 @@ import {
   encodeCompactionRequest
 } from "./chunks/chunk-E4HNDTLM.js";
 import "./chunks/chunk-3XPR2AZL.js";
-import "./chunks/chunk-4HQDSTHN.js";
+import "./chunks/chunk-YBNCEX5E.js";
 import {
   FabricExecutionTraceRecorder,
   FabricTraceSafeError,
   executionOutcomeFromError
-} from "./chunks/chunk-T5ZA5YRU.js";
+} from "./chunks/chunk-52JBWP2C.js";
 import {
   OMP_CORE_TOOL_NAMES,
+  OMP_CORE_TOOL_NAME_SET,
   isOmpShellRef,
-  isOmpShellToolName
-} from "./chunks/chunk-6N4XGAZY.js";
+  isOmpShellToolName,
+  ompCoreToolDenied
+} from "./chunks/chunk-ZFMSJLQE.js";
 
 // src/fabric-runtime-state.ts
 import path19 from "node:path";
@@ -2976,7 +2978,7 @@ var FabricExecutionService = class {
       })) ?? []
     ) : void 0;
     const code = repairFabricGuestCode(options.code);
-    const checked2 = dependencies.typeCheckFabricCode(
+    const checked3 = dependencies.typeCheckFabricCode(
       code,
       dependencies.guestTypeDeclarations(effectiveFullCodeMode, {
         excludeGlobals: [...unavailable.keys()],
@@ -2984,8 +2986,8 @@ var FabricExecutionService = class {
         ...coreOverrideDeclarations ? { coreOverrides: coreOverrideDeclarations } : {}
       })
     );
-    if (checked2.errors.length > 0) {
-      for (const error of checked2.errors) {
+    if (checked3.errors.length > 0) {
+      for (const error of checked3.errors) {
         const missing = /^Cannot find name '([^']+)'/.exec(error.message);
         const reason = missing?.[1] ? unavailable.get(missing[1]) : void 0;
         if (missing && reason) {
@@ -3002,10 +3004,10 @@ var FabricExecutionService = class {
         trace: traceRecorder.seal(
           "failed",
           [],
-          `Type checking failed (${checked2.errors.length} ${checked2.errors.length === 1 ? "error" : "errors"})`
+          `Type checking failed (${checked3.errors.length} ${checked3.errors.length === 1 ? "error" : "errors"})`
         ),
         elapsedMs: performance.now() - startedAt,
-        typeErrors: checked2.errors
+        typeErrors: checked3.errors
       };
     }
     const classifierUsages = [];
@@ -3436,8 +3438,8 @@ var FabricExecutionService = class {
           memoryLimitBytes: this.config.executor.memoryLimitBytes,
           maxLogChars: this.config.executor.maxOutputChars,
           minimumTimeoutMsForHostCall,
-          ...checked2.javascript ? { transpiledCode: checked2.javascript } : {},
-          ...checked2.sourceMap ? { transpiledSourceMap: checked2.sourceMap } : {},
+          ...checked3.javascript ? { transpiledCode: checked3.javascript } : {},
+          ...checked3.sourceMap ? { transpiledSourceMap: checked3.sourceMap } : {},
           ...options.payloads ? { payloads: options.payloads } : {},
           ...Object.keys(proxyNames).length > 0 ? { proxyNames } : {},
           ...options.tokenBudget !== void 0 ? { tokenBudget: options.tokenBudget } : {},
@@ -6676,9 +6678,9 @@ var CapturedToolsProvider = class {
   #allowedTools = readChildToolAllowlist();
   async list(request, _context) {
     const query = request.query?.trim().toLowerCase();
-    const descriptors7 = this.catalog.list().filter((entry) => !this.#allowedTools || this.#allowedTools.has(entry.name)).map(descriptorFrom);
-    if (!query) return descriptors7;
-    return descriptors7.filter(
+    const descriptors8 = this.catalog.list().filter((entry) => !this.#allowedTools || this.#allowedTools.has(entry.name)).map(descriptorFrom);
+    if (!query) return descriptors8;
+    return descriptors8.filter(
       (descriptor) => `${descriptor.name} ${descriptor.description} ${descriptor.namespace ?? ""}`.toLowerCase().includes(query)
     );
   }
@@ -8114,32 +8116,420 @@ var CodemapProvider = class {
   }
 };
 
-// src/providers/compact-provider.ts
+// src/providers/judgment-provider.ts
 import { Type as Type2 } from "@oh-my-pi/pi-coding-agent/extensibility/legacy-typebox";
 import { validateJsonSchemaValue as validateJsonSchemaValue2 } from "@oh-my-pi/pi-ai/utils/schema";
-var requestSchema = Type2.Object({
-  reason: Type2.Optional(Type2.String({
+var askSchema = Type2.Object({
+  state: Type2.Any({
+    description: "Evidence every question is answered against: a string, or a JSON object/array of named parts."
+  }),
+  questions: Type2.Record(Type2.String(), Type2.Any(), {
+    description: 'Questions keyed by id. Each is { type: "choice", instructions, criteria: { label: rubric | null } }, { type: "bool", instructions, criteria?: { true?, false? } }, or { type: "score", instructions, criteria: [lowest, ..., highest] }.'
+  })
+}, { additionalProperties: false });
+var statsSchema = Type2.Object({}, { additionalProperties: false });
+var descriptors2 = [
+  {
+    name: "ask",
+    description: "Answer typed questions about one state with calibrated probabilities: choice (one label plus its distribution), bool (probability of yes), score (weighted position on ordered levels). Questions asked about the same state within the coalesce window travel as one backend request. Returns { ok: false, reason } instead of throwing when no backend is configured, the budget refuses, or the request fails.",
+    inputSchema: askSchema.toJsonSchema(),
+    risk: "network"
+  },
+  {
+    name: "stats",
+    description: "Counters for this session's judgment lane: requests, batched requests, merged callers, questions asked, refusals, failures, timeouts, and the backend and error seen last.",
+    inputSchema: statsSchema.toJsonSchema(),
+    risk: "read"
+  }
+];
+var normalizeJudgmentArgs = actionArgNormalizer(() => descriptors2);
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var instructionsOf = (id, value) => {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`judgment.ask question "${id}" needs non-empty string instructions`);
+  }
+  return value;
+};
+var parseChoice = (id, value) => {
+  const instructions = instructionsOf(id, value.instructions);
+  if (!isRecord3(value.criteria)) {
+    throw new Error(`judgment.ask choice question "${id}" needs criteria: { label: rubric | null }`);
+  }
+  const criteria = {};
+  for (const label in value.criteria) {
+    const rubric = value.criteria[label];
+    if (rubric !== null && typeof rubric !== "string") {
+      throw new Error(`judgment.ask choice question "${id}" criteria "${label}" must be a string or null`);
+    }
+    criteria[label] = rubric;
+  }
+  if (Object.keys(criteria).length < 2) {
+    throw new Error(`judgment.ask choice question "${id}" needs at least two options`);
+  }
+  return { type: "choice", instructions, criteria };
+};
+var parseBool = (id, value) => {
+  const instructions = instructionsOf(id, value.instructions);
+  if (value.criteria === void 0) return { type: "noul", instructions };
+  if (!isRecord3(value.criteria)) {
+    throw new Error(`judgment.ask bool question "${id}" criteria must be { true?: string, false?: string }`);
+  }
+  const criteria = {};
+  for (const side of ["true", "false"]) {
+    const description = value.criteria[side];
+    if (description === void 0) continue;
+    if (typeof description !== "string") {
+      throw new Error(`judgment.ask bool question "${id}" criteria.${side} must be a string`);
+    }
+    criteria[side] = description;
+  }
+  return { type: "noul", instructions, criteria };
+};
+var parseScore = (id, value) => {
+  const instructions = instructionsOf(id, value.instructions);
+  const levels = value.criteria;
+  if (!Array.isArray(levels) || !levels.every((level) => typeof level === "string")) {
+    throw new Error(`judgment.ask score question "${id}" needs criteria: [lowest, ..., highest]`);
+  }
+  const [lowest, second, ...rest] = levels;
+  if (lowest === void 0 || second === void 0) {
+    throw new Error(`judgment.ask score question "${id}" needs at least two levels`);
+  }
+  return { type: "score", instructions, criteria: [lowest, second, ...rest] };
+};
+var parseQuestion = (id, value) => {
+  if (!isRecord3(value)) throw new Error(`judgment.ask question "${id}" must be an object`);
+  switch (value.type) {
+    case "choice":
+      return parseChoice(id, value);
+    case "bool":
+      return parseBool(id, value);
+    case "score":
+      return parseScore(id, value);
+    default:
+      throw new Error(`judgment.ask question "${id}" type must be "choice", "bool", or "score"`);
+  }
+};
+var parseState = (value) => {
+  if (typeof value === "string") {
+    if (value.length === 0) throw new Error("judgment.ask state must not be empty");
+    return value;
+  }
+  if (Array.isArray(value) || isRecord3(value)) return value;
+  throw new Error("judgment.ask state must be a string, a JSON object, or a JSON array");
+};
+var checked2 = (action, schema, args) => {
+  const validation = validateJsonSchemaValue2(schema.toJsonSchema(), args);
+  if (!validation.success) {
+    const message2 = validation.issues.slice(0, 5).map((issue) => issue.path.length > 0 ? `${issue.path.join(".")} ${issue.message}` : issue.message).join("; ");
+    throw new Error(`Invalid judgment.${action} arguments: ${message2}`);
+  }
+  return args;
+};
+var JudgmentProvider = class {
+  constructor(lane) {
+    this.lane = lane;
+  }
+  name = "judgment";
+  description = "Typed judgments over one state: calibrated choice, bool, and score answers batched into one backend request";
+  async list(request, _context) {
+    const query = request.query?.toLowerCase();
+    return query ? descriptors2.filter(
+      (descriptor) => `${descriptor.name} ${descriptor.description}`.toLowerCase().includes(query)
+    ) : descriptors2;
+  }
+  async describe(actionName, _context) {
+    return descriptors2.find((descriptor) => descriptor.name === actionName);
+  }
+  prepareArguments(actionName, args) {
+    return normalizeJudgmentArgs(actionName, args);
+  }
+  async invoke(actionName, args, context) {
+    switch (actionName) {
+      case "ask": {
+        const input = checked2("ask", askSchema, args);
+        const state = parseState(input.state);
+        const questions = {};
+        for (const id in input.questions) questions[id] = parseQuestion(id, input.questions[id]);
+        const outcome = await this.lane.ask(state, questions, {
+          ...context.signal !== void 0 ? { signal: context.signal } : {}
+        });
+        if (!outcome.ok) return outcome;
+        const answers = {};
+        for (const id in outcome.answers) {
+          const answer = outcome.answers[id];
+          answers[id] = answer.type === "noul" ? { type: "bool", bool: answer.noul } : answer;
+        }
+        return { ok: true, backend: outcome.backend, answers };
+      }
+      case "stats":
+        return { enabled: this.lane.enabled, ...this.lane.stats() };
+      default:
+        throw new Error(`Unknown judgment action: ${actionName}`);
+    }
+  }
+};
+
+// src/judgment/lane.ts
+var DeadlineError = class extends Error {
+};
+var measure = (state) => {
+  try {
+    const serialized = typeof state === "string" ? state : JSON.stringify(state);
+    if (typeof serialized !== "string") return void 0;
+    return { key: typeof state === "string" ? `s:${serialized}` : `j:${serialized}`, bytes: Buffer.byteLength(serialized, "utf-8") };
+  } catch {
+    return void 0;
+  }
+};
+var errorText2 = (error) => error instanceof Error ? error.message : String(error);
+var FabricJudgmentLane = class {
+  #config;
+  #resolve;
+  #pending = /* @__PURE__ */ new Map();
+  #waiting = [];
+  #stats = {
+    requests: 0,
+    batched: 0,
+    questions: 0,
+    merged: 0,
+    failures: 0,
+    refusals: 0,
+    timeouts: 0
+  };
+  #sequence = 0;
+  #inFlight = 0;
+  #judge;
+  #judgeResolved = false;
+  #judgePromise;
+  #resolveError;
+  constructor(config, resolve2) {
+    this.#config = config;
+    this.#resolve = resolve2;
+  }
+  get enabled() {
+    return this.#config.enabled;
+  }
+  stats() {
+    return { ...this.#stats };
+  }
+  async ask(state, questions, options) {
+    const ids = Object.keys(questions);
+    if (!this.#config.enabled) return { ok: false, reason: "disabled" };
+    if (ids.length === 0) return this.#refuse("no questions");
+    if (ids.length > this.#config.maxQuestionsPerRequest) {
+      return this.#refuse(
+        `${ids.length} questions exceeds maxQuestionsPerRequest=${this.#config.maxQuestionsPerRequest}`
+      );
+    }
+    const measured = measure(state);
+    if (!measured) return this.#refuse("state is not JSON-encodable");
+    if (measured.bytes > this.#config.maxStateBytes) {
+      return this.#refuse(
+        `state of ${measured.bytes} bytes exceeds maxStateBytes=${this.#config.maxStateBytes}`
+      );
+    }
+    if (options?.signal?.aborted === true) return { ok: false, reason: "aborted" };
+    const outcome = await new Promise((settle) => {
+      this.#enqueue(measured.key, state, questions, settle, options?.signal);
+    });
+    return outcome;
+  }
+  #refuse(detail) {
+    this.#stats.refusals++;
+    return { ok: false, reason: "refused", detail };
+  }
+  #enqueue(key, state, questions, settle, signal) {
+    const asked = Object.keys(questions).length;
+    const existing = this.#pending.get(key);
+    if (existing && existing.questionCount + asked > this.#config.maxQuestionsPerRequest) {
+      this.#flush(key);
+    }
+    const batch = this.#pending.get(key) ?? { state, entries: [], questionCount: 0 };
+    const entry = { prefix: `q${this.#sequence++}`, questions, settle, done: false };
+    if (signal) {
+      const onAbort = () => this.#settle(entry, { ok: false, reason: "aborted" });
+      entry.detach = () => signal.removeEventListener("abort", onAbort);
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+    batch.entries.push(entry);
+    batch.questionCount += asked;
+    this.#pending.set(key, batch);
+    if (batch.questionCount >= this.#config.maxQuestionsPerRequest) {
+      this.#flush(key);
+      return;
+    }
+    batch.timer ??= setTimeout(() => this.#flush(key), this.#config.coalesceMs);
+  }
+  #flush(key) {
+    const batch = this.#pending.get(key);
+    if (!batch) return;
+    this.#pending.delete(key);
+    if (batch.timer !== void 0) clearTimeout(batch.timer);
+    const live = batch.entries.filter((entry) => !entry.done);
+    if (live.length === 0) return;
+    void this.#schedule(batch.state, live);
+  }
+  /** Holds a slot for the whole run and hands it to the next waiter, so a flush cannot take one mid-release. */
+  async #schedule(state, entries) {
+    if (this.#inFlight >= this.#config.maxConcurrent) {
+      await new Promise((release) => this.#waiting.push(release));
+    } else {
+      this.#inFlight++;
+    }
+    try {
+      const live = entries.filter((entry) => !entry.done);
+      if (live.length > 0) await this.#run(state, live);
+    } finally {
+      const next = this.#waiting.shift();
+      if (next) next();
+      else this.#inFlight--;
+    }
+  }
+  async #run(state, entries) {
+    const merged = {};
+    for (const entry of entries) {
+      for (const id in entry.questions) {
+        merged[`${entry.prefix}_${id}`] = entry.questions[id];
+      }
+    }
+    const controller = new AbortController();
+    let timer;
+    let timedOut = false;
+    const deadline = new Promise((_settle, fail) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        fail(new DeadlineError(`no answer within ${this.#config.timeoutMs}ms`));
+        controller.abort();
+      }, this.#config.timeoutMs);
+    });
+    deadline.catch(() => {
+    });
+    try {
+      const judge = await Promise.race([this.#backend(), deadline]);
+      if (!judge) {
+        this.#settleAll(entries, {
+          ok: false,
+          reason: "unsupported",
+          ...this.#resolveError !== void 0 ? { detail: this.#resolveError } : {}
+        });
+        return;
+      }
+      this.#stats.requests++;
+      this.#stats.questions += Object.keys(merged).length;
+      if (entries.length > 1) {
+        this.#stats.batched++;
+        this.#stats.merged += entries.length;
+      }
+      const pending = judge.judge({ state, questions: merged }, { signal: controller.signal });
+      pending.catch(() => {
+      });
+      const result = await Promise.race([pending, deadline]);
+      const backend = `${result.provider}/${result.model}`;
+      this.#stats.lastBackend = backend;
+      for (const entry of entries) {
+        const answers = {};
+        let missing;
+        for (const id in entry.questions) {
+          const answer = result.answers[`${entry.prefix}_${id}`];
+          if (answer === void 0) {
+            missing = id;
+            break;
+          }
+          answers[id] = answer;
+        }
+        this.#settle(
+          entry,
+          missing === void 0 ? { ok: true, answers, backend } : { ok: false, reason: "failed", detail: `no answer for "${missing}"` }
+        );
+      }
+    } catch (error) {
+      const detail = timedOut ? `no answer within ${this.#config.timeoutMs}ms` : errorText2(error);
+      if (timedOut) this.#stats.timeouts++;
+      else this.#stats.failures++;
+      this.#stats.lastError = detail;
+      this.#settleAll(entries, { ok: false, reason: timedOut ? "timeout" : "failed", detail });
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+    }
+  }
+  #settle(entry, outcome) {
+    if (entry.done) return;
+    entry.done = true;
+    entry.detach?.();
+    entry.settle(outcome);
+  }
+  #settleAll(entries, outcome) {
+    for (const entry of entries) this.#settle(entry, outcome);
+  }
+  /** Resolves once per session, including a host that offers no judge; only a thrown resolver is retried. */
+  async #backend() {
+    if (this.#judgeResolved) return this.#judge;
+    this.#judgePromise ??= this.#resolve().then(
+      (judge) => {
+        this.#judge = judge;
+        this.#judgeResolved = true;
+        this.#resolveError = void 0;
+        this.#judgePromise = void 0;
+        return judge;
+      },
+      (error) => {
+        this.#resolveError = errorText2(error);
+        this.#stats.lastError = this.#resolveError;
+        this.#judgePromise = void 0;
+        return void 0;
+      }
+    );
+    return this.#judgePromise;
+  }
+};
+
+// src/judgment/host-judge.ts
+var ONLINE_JUDGMENT_BACKEND = "online";
+var resolveHostJudge = async (context) => {
+  if (context.modelRegistry === void 0) return void 0;
+  const [judgment, settingsModule] = await Promise.all([
+    import("@oh-my-pi/pi-coding-agent/judgment"),
+    import("@oh-my-pi/pi-coding-agent/config/settings")
+  ]);
+  const resolveJudge = judgment.resolveJudge;
+  const settings = settingsModule.settings;
+  if (typeof resolveJudge !== "function" || settings === void 0) return void 0;
+  return resolveJudge({
+    settings,
+    registry: context.modelRegistry,
+    backend: ONLINE_JUDGMENT_BACKEND,
+    ...context.model !== void 0 ? { sessionModel: context.model } : {},
+    ...context.sessionId !== void 0 ? { sessionId: context.sessionId } : {}
+  });
+};
+
+// src/providers/compact-provider.ts
+import { Type as Type3 } from "@oh-my-pi/pi-coding-agent/extensibility/legacy-typebox";
+import { validateJsonSchemaValue as validateJsonSchemaValue3 } from "@oh-my-pi/pi-ai/utils/schema";
+var requestSchema = Type3.Object({
+  reason: Type3.Optional(Type3.String({
     maxLength: 1024,
     description: "Short human-readable reason for the compaction"
   })),
-  instructions: Type2.Optional(Type2.String({
+  instructions: Type3.Optional(Type3.String({
     maxLength: MAX_COMPACTION_INSTRUCTIONS_CHARS,
     description: "Custom compaction instructions forwarded to OMP core"
   })),
-  preserve: Type2.Optional(Type2.Array(
-    Type2.String({ maxLength: MAX_PRESERVE_ITEM_CHARS }),
+  preserve: Type3.Optional(Type3.Array(
+    Type3.String({ maxLength: MAX_PRESERVE_ITEM_CHARS }),
     {
       maxItems: MAX_PRESERVE_ITEMS,
       description: "Explicit bounded facts to preserve, encoded as a typed Fabric compaction request"
     }
   )),
-  requestedBy: Type2.Optional(Type2.String({
+  requestedBy: Type3.Optional(Type3.String({
     maxLength: 256,
     description: "Who requested the compaction (default: model)"
   }))
 }, { additionalProperties: false });
 var checkedRequestArguments = (args) => {
-  const validation = validateJsonSchemaValue2(requestSchema.toJsonSchema(), args);
+  const validation = validateJsonSchemaValue3(requestSchema.toJsonSchema(), args);
   if (!validation.success) {
     const message2 = validation.issues.slice(0, 5).map((error) => error.message).join("; ");
     throw new Error(`Invalid compact.request arguments: ${message2}`);
@@ -8163,7 +8553,7 @@ var emptySchema = {
   properties: {},
   additionalProperties: false
 };
-var descriptors2 = [
+var descriptors3 = [
   {
     name: "request",
     description: "Request an advisory compaction of the host session's context at the next safe boundary (agent_end). The host commits it only between turns, never mid-turn. A new request replaces any pending one.",
@@ -8186,7 +8576,7 @@ var descriptors2 = [
     risk: "write"
   }
 ];
-var normalizeCompactArgs = actionArgNormalizer(() => descriptors2);
+var normalizeCompactArgs = actionArgNormalizer(() => descriptors3);
 var CompactProvider = class {
   constructor(controller) {
     this.controller = controller;
@@ -8195,12 +8585,12 @@ var CompactProvider = class {
   description = "Programmatic, advisory-then-committed context compaction for the host OMP session";
   async list(request, _context) {
     const query = request.query?.toLowerCase();
-    return query ? descriptors2.filter(
+    return query ? descriptors3.filter(
       (descriptor) => `${descriptor.name} ${descriptor.description}`.toLowerCase().includes(query)
-    ) : descriptors2;
+    ) : descriptors3;
   }
   async describe(actionName, _context) {
-    return descriptors2.find((descriptor) => descriptor.name === actionName);
+    return descriptors3.find((descriptor) => descriptor.name === actionName);
   }
   prepareArguments(actionName, args) {
     return normalizeCompactArgs(actionName, args);
@@ -8240,7 +8630,7 @@ var CompactProvider = class {
 };
 
 // src/providers/components-provider.ts
-var descriptors3 = [
+var descriptors4 = [
   {
     name: "list",
     description: "List registered component definitions and configured component instances.",
@@ -8287,13 +8677,13 @@ var ComponentsProvider = class {
   description = "Supervised component lifecycle, exact capability dependencies, effect cleanup, and reload diagnostics.";
   async list(request, _context) {
     const query = request.query?.normalize("NFKC").trim().toLowerCase();
-    const filtered = query ? descriptors3.filter(
+    const filtered = query ? descriptors4.filter(
       (descriptor) => `${descriptor.name} ${descriptor.description}`.toLowerCase().includes(query)
-    ) : descriptors3;
+    ) : descriptors4;
     return filtered.slice(0, Math.max(1, Math.min(request.limit ?? 100, 100)));
   }
   async describe(actionName, _context) {
-    return descriptors3.find((descriptor) => descriptor.name === actionName);
+    return descriptors4.find((descriptor) => descriptor.name === actionName);
   }
   async invoke(actionName, args, _context) {
     switch (actionName) {
@@ -8399,11 +8789,11 @@ var sameConfigLayers = (left, right) => left.length === right.length && left.eve
   return other !== void 0 && layer.path === other.path && layer.size === other.size && Math.abs(layer.mtimeMs - other.mtimeMs) <= 1;
 });
 var hashServerDefinition = (definition) => stableJsonHash(definition);
-var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var parseCachedServer = (value) => {
-  if (!isRecord3(value)) return void 0;
+  if (!isRecord4(value)) return void 0;
   const tools = Array.isArray(value.tools) ? value.tools.filter(
-    (tool) => isRecord3(tool) && typeof tool.name === "string"
+    (tool) => isRecord4(tool) && typeof tool.name === "string"
   ) : void 0;
   if (typeof value.definitionHash !== "string" || tools === void 0) return void 0;
   return {
@@ -8416,10 +8806,10 @@ var parseCachedServer = (value) => {
   };
 };
 var parseCacheFile = (value) => {
-  if (!isRecord3(value) || value.version !== MCP_DESCRIPTOR_CACHE_VERSION) return void 0;
-  if (!Array.isArray(value.layers) || !isRecord3(value.servers)) return void 0;
+  if (!isRecord4(value) || value.version !== MCP_DESCRIPTOR_CACHE_VERSION) return void 0;
+  if (!Array.isArray(value.layers) || !isRecord4(value.servers)) return void 0;
   const layers = value.layers.filter(
-    (layer) => isRecord3(layer) && typeof layer.path === "string" && typeof layer.mtimeMs === "number" && typeof layer.size === "number"
+    (layer) => isRecord4(layer) && typeof layer.path === "string" && typeof layer.mtimeMs === "number" && typeof layer.size === "number"
   );
   return {
     version: MCP_DESCRIPTOR_CACHE_VERSION,
@@ -8624,9 +9014,9 @@ var McpProvider = class {
     this.#kickRevalidation();
     if (!request.namespace) await this.#awaitColdEnumeration(context.signal);
     const query = request.query?.toLowerCase();
-    const filterQuery = (descriptors7) => query ? descriptors7.filter(
+    const filterQuery = (descriptors8) => query ? descriptors8.filter(
       (descriptor) => `${descriptor.name} ${descriptor.description}`.toLowerCase().includes(query)
-    ) : descriptors7;
+    ) : descriptors8;
     if (request.namespace) {
       const server = await this.#resolveKnownServer(request.namespace);
       if (!server) return [];
@@ -8781,11 +9171,11 @@ var McpProvider = class {
   // Provider-fidelity descriptors for everything currently known, cached or
   // ephemeral.
   sliceDescriptors() {
-    const descriptors7 = [];
+    const descriptors8 = [];
     for (const [server, entry] of this.#servers) {
-      for (const tool of entry.tools) descriptors7.push(this.#toolDescriptor(server, tool));
+      for (const tool of entry.tools) descriptors8.push(this.#toolDescriptor(server, tool));
     }
-    return descriptors7;
+    return descriptors8;
   }
   // Test/ops hook: await hydration and any in-flight background revalidation,
   // then flush pending persistence and notifications.
@@ -9252,13 +9642,13 @@ var McpProvider = class {
         return tools.map((tool) => this.#toolDescriptor(server, tool));
       })
     );
-    const descriptors7 = settled.flatMap(
+    const descriptors8 = settled.flatMap(
       (entry) => entry.status === "fulfilled" ? entry.value : []
     );
     const query = request.query?.toLowerCase();
-    const filtered = query ? descriptors7.filter(
+    const filtered = query ? descriptors8.filter(
       (descriptor) => `${descriptor.name} ${descriptor.description}`.toLowerCase().includes(query)
-    ) : descriptors7;
+    ) : descriptors8;
     return request.namespace ? filtered : [...managementDescriptors, ...filtered];
   }
   async #describeLegacy(actionName, _context) {
@@ -9330,7 +9720,7 @@ var assertReadableStateKey = (key) => {
     throw new Error(`Fabric mesh key is private host state: ${key}`);
   }
 };
-var descriptors4 = [
+var descriptors5 = [
   {
     name: "self",
     description: "Return this Fabric participant's mesh identity",
@@ -9457,7 +9847,7 @@ var descriptors4 = [
     namespace: "coordination"
   }
 ];
-var normalizeMeshArgs = actionArgNormalizer(() => descriptors4);
+var normalizeMeshArgs = actionArgNormalizer(() => descriptors5);
 var MeshProvider = class {
   constructor(store, identity, participants) {
     this.store = store;
@@ -9468,12 +9858,12 @@ var MeshProvider = class {
   description = "Durable topics and compare-and-swap shared state for emergent agent coordination";
   async list(request, _context) {
     const query = request.query?.toLowerCase();
-    return query ? descriptors4.filter(
+    return query ? descriptors5.filter(
       (descriptor) => `${descriptor.name} ${descriptor.description}`.toLowerCase().includes(query)
-    ) : descriptors4;
+    ) : descriptors5;
   }
   async describe(actionName, _context) {
-    return descriptors4.find((descriptor) => descriptor.name === actionName);
+    return descriptors5.find((descriptor) => descriptor.name === actionName);
   }
   prepareArguments(actionName, args) {
     return normalizeMeshArgs(actionName, args);
@@ -9680,7 +10070,7 @@ var tryExecuteGitWorktreeAdd = async (args, sessionCwd) => {
 import { accessSync, constants, statSync as statSync3 } from "node:fs";
 import path13 from "node:path";
 import { createBashToolDefinition } from "@oh-my-pi/pi-coding-agent/extensibility/legacy-pi-coding-agent-shim";
-import { Type as Type3 } from "@oh-my-pi/pi-coding-agent/extensibility/legacy-typebox";
+import { Type as Type4 } from "@oh-my-pi/pi-coding-agent/extensibility/legacy-typebox";
 var OMP_BASH_CWD_KEY = "cwd";
 var resolveOmpShellCwd = (toolName, sessionCwd, requested) => {
   if (typeof requested !== "string" || requested.trim().length === 0) {
@@ -9708,27 +10098,27 @@ var resolveShellCwdArgument = (toolName, sessionCwd, args) => Object.hasOwn(args
     args[OMP_BASH_CWD_KEY]
   )
 } : args;
-var CWD_PROPERTY = Type3.Optional(
-  Type3.String({
+var CWD_PROPERTY = Type4.Optional(
+  Type4.String({
     description: "Execution directory for this command; relative paths resolve from the session cwd."
   })
 );
-var isRecord4 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var schemaDocument2 = (schema) => {
-  if (isRecord4(schema)) return schema;
+  if (isRecord5(schema)) return schema;
   if (typeof schema !== "function" || !("toJsonSchema" in schema)) return void 0;
   const toJsonSchema = schema.toJsonSchema;
   if (typeof toJsonSchema !== "function") return void 0;
   const document = toJsonSchema.call(schema);
-  return isRecord4(document) ? document : void 0;
+  return isRecord5(document) ? document : void 0;
 };
 var withShellCwdSchema = (schema) => {
   const document = schemaDocument2(schema);
-  if (!document || !isRecord4(document.properties)) return schema;
+  if (!document || !isRecord5(document.properties)) return schema;
   if (Object.hasOwn(document.properties, OMP_BASH_CWD_KEY)) return schema;
   const cwdSchema = schemaDocument2(CWD_PROPERTY);
   if (!cwdSchema) return schema;
-  return Type3.Unsafe({
+  return Type4.Unsafe({
     ...document,
     properties: { ...document.properties, [OMP_BASH_CWD_KEY]: cwdSchema }
   });
@@ -9765,7 +10155,7 @@ var BashCwdDefinitions = class extends ShellCwdDefinitions {
 import { homedir } from "node:os";
 import { dirname, isAbsolute, resolve, win32 } from "node:path";
 import { mkdir, readFile as readFile2, stat, writeFile } from "node:fs/promises";
-import { Type as Type4 } from "@oh-my-pi/pi-coding-agent/extensibility/legacy-typebox";
+import { Type as Type5 } from "@oh-my-pi/pi-coding-agent/extensibility/legacy-typebox";
 import { WriteTool } from "@oh-my-pi/pi-coding-agent/tools/write";
 var mutationQueues = /* @__PURE__ */ new Map();
 var withFileMutationQueue = async (path20, operation) => {
@@ -9837,7 +10227,7 @@ var createPreviewWriteToolDefinition = (cwd, session) => {
     name: "write",
     label: "Write",
     description: "Write a file",
-    parameters: Type4.Object({ path: Type4.String(), content: Type4.String() }),
+    parameters: Type5.Object({ path: Type5.String(), content: Type5.String() }),
     execute: async () => ({ content: [{ type: "text", text: "" }] })
   };
   return {
@@ -10442,19 +10832,21 @@ var normalizeResult = (name, result, artifactPaths, appendReadNewline = true, ex
   return { ok: true, output, details: details ?? null };
 };
 var OmpToolsProvider = class _OmpToolsProvider {
-  static async create(cwd, catalog, capturedTools) {
-    return new _OmpToolsProvider(cwd, catalog, capturedTools);
+  static async create(cwd, catalog, capturedTools, hostActiveTools) {
+    return new _OmpToolsProvider(cwd, catalog, capturedTools, hostActiveTools);
   }
   name = "omp";
   description = "OMP's built-in coding tools";
   #allowedTools = readChildToolAllowlist();
+  #hostActiveTools;
   #tools;
   #catalog;
   #capturedTools;
   #cwd;
   #artifactPaths = /* @__PURE__ */ new Map();
   #bashDefinitions = new BashCwdDefinitions();
-  constructor(cwd, catalog, capturedTools) {
+  constructor(cwd, catalog, capturedTools, hostActiveTools) {
+    this.#hostActiveTools = hostActiveTools;
     this.#cwd = cwd;
     this.#tools = {
       read: createNativeReadToolDefinition(cwd),
@@ -10470,16 +10862,16 @@ var OmpToolsProvider = class _OmpToolsProvider {
   }
   async list(request, _context) {
     const query = request.query?.toLowerCase();
-    const descriptors7 = await Promise.all(
+    const descriptors8 = await Promise.all(
       OMP_CORE_TOOL_NAMES.map((name) => this.describe(name, _context))
     );
-    return descriptors7.filter((descriptor) => descriptor !== void 0).filter(
+    return descriptors8.filter((descriptor) => descriptor !== void 0).filter(
       (descriptor) => query ? `${descriptor.name} ${descriptor.description}`.toLowerCase().includes(query) : true
     );
   }
   async describe(actionName, _context) {
     const name = actionName;
-    if (this.#allowedTools && !this.#allowedTools.has(name)) return void 0;
+    if (this.denialMessage(name)) return void 0;
     const tool = this.#tools[name];
     if (!tool) return void 0;
     const override = await this.#capturedTools?.describe(name, _context);
@@ -10506,9 +10898,17 @@ var OmpToolsProvider = class _OmpToolsProvider {
     return actionName === "edit" ? normalizeEditArguments(record2, args.all === true, this.#cwd) : record2;
   }
   #assertAllowed(name) {
-    if (this.#allowedTools && !this.#allowedTools.has(name)) {
-      throw new Error(`OMP tool ${name} is not permitted by this child's tool allowlist`);
-    }
+    const message2 = this.denialMessage(name);
+    if (message2) throw new Error(message2);
+  }
+  denialMessage(actionName) {
+    const source = this.#denialSource(actionName);
+    return source ? `OMP tool ${actionName} is not permitted by ${source}` : void 0;
+  }
+  #denialSource(name) {
+    if (!OMP_CORE_TOOL_NAME_SET.has(name)) return void 0;
+    if (this.#allowedTools && !this.#allowedTools.has(name)) return "this child's tool allowlist";
+    return ompCoreToolDenied(name, this.#hostActiveTools?.()) ? "OMP's active tool selection" : void 0;
   }
   // Keep a cwd-bound definition for hosts without argument preparation, while newer hosts receive the
   // same directory through ExtensionContext.cwd. `cwd` also stays in the
@@ -11897,7 +12297,7 @@ var operationSchema = {
     }
   ]
 };
-var descriptors5 = [
+var descriptors6 = [
   {
     name: "status",
     description: "Read the fixed session Schema mode, transaction bounds, generation, and invocation hypotheses",
@@ -11967,7 +12367,7 @@ var descriptors5 = [
     namespace: "schema"
   }
 ];
-var normalizeSchemaArgs = actionArgNormalizer(() => descriptors5);
+var normalizeSchemaArgs = actionArgNormalizer(() => descriptors6);
 var SchemaProvider = class {
   constructor(controller) {
     this.controller = controller;
@@ -11976,12 +12376,12 @@ var SchemaProvider = class {
   description = "Host-owned, opt-in Schema verification and bounded local-file transaction control plane";
   async list(request, _context) {
     const query = request.query?.toLowerCase();
-    return query ? descriptors5.filter(
+    return query ? descriptors6.filter(
       (descriptor) => `${descriptor.name} ${descriptor.description}`.toLowerCase().includes(query)
-    ) : descriptors5;
+    ) : descriptors6;
   }
   async describe(actionName, _context) {
-    return descriptors5.find((descriptor) => descriptor.name === actionName);
+    return descriptors6.find((descriptor) => descriptor.name === actionName);
   }
   prepareArguments(actionName, args) {
     return normalizeSchemaArgs(actionName, args);
@@ -13681,7 +14081,7 @@ var checkGoalSchema = {
   additionalProperties: false
 };
 var emptySchema3 = { type: "object", properties: {}, additionalProperties: false };
-var descriptors6 = [
+var descriptors7 = [
   {
     name: "transition",
     description: "Append a labeled, validated state transition and compare-and-swap advance the head",
@@ -13732,7 +14132,7 @@ var descriptors6 = [
     namespace: "state"
   }
 ];
-var normalizeStateArgs = actionArgNormalizer(() => descriptors6);
+var normalizeStateArgs = actionArgNormalizer(() => descriptors7);
 var StateProvider = class {
   name = "state";
   description = "Schema-style labeled transition layer: an append-only timeline of validated transitions with a compare-and-swap head and evidence-based certification over mesh storage";
@@ -13747,12 +14147,12 @@ var StateProvider = class {
   }
   async list(request, _context) {
     const query = request.query?.toLowerCase();
-    return query ? descriptors6.filter(
+    return query ? descriptors7.filter(
       (descriptor) => `${descriptor.name} ${descriptor.description}`.toLowerCase().includes(query)
-    ) : descriptors6;
+    ) : descriptors7;
   }
   async describe(actionName, _context) {
-    return descriptors6.find((descriptor) => descriptor.name === actionName);
+    return descriptors7.find((descriptor) => descriptor.name === actionName);
   }
   prepareArguments(actionName, args) {
     return normalizeStateArgs(actionName, args);
@@ -13900,6 +14300,7 @@ var FabricRuntimeState = class {
     this.sessionApprovals = options.sessionApprovals ?? new FabricSessionApprovals();
     this.#lcmContext = options.lcmContext;
     this.#lcmRuntime = options.lcmRuntime;
+    this.#hostActiveTools = options.hostActiveTools;
     this.#paths = options.paths;
   }
   #registry;
@@ -13938,6 +14339,7 @@ var FabricRuntimeState = class {
   sessionApprovals;
   #lcmContext;
   #lcmRuntime;
+  #hostActiveTools;
   #paths;
   #widgetDismissedAt = 0;
   #suppressResidentGuidanceSync = false;
@@ -14196,7 +14598,8 @@ var FabricRuntimeState = class {
         create: () => OmpToolsProvider.create(
           context.cwd,
           this.capturedTools,
-          capturedToolsProvider
+          capturedToolsProvider,
+          this.#hostActiveTools
         )
       }));
     }
@@ -14323,6 +14726,23 @@ var FabricRuntimeState = class {
         'disabled by configuration (codemap.enabled=false); set "codemap": { "enabled": true } in .omp/fabric.json or the agent fabric.json to enable codemap.* actions'
       );
     }
+    if (this.#config.judgment.enabled) {
+      const judgmentConfig = this.#config.judgment;
+      await installBuiltin(createProviderComponent({
+        provider: "judgment",
+        description: "Typed judgments with calibrated probabilities",
+        create: () => new JudgmentProvider(new FabricJudgmentLane(judgmentConfig, () => resolveHostJudge({
+          modelRegistry: context.modelRegistry,
+          ...context.model !== void 0 ? { model: context.model } : {},
+          sessionId: context.sessionManager.getSessionId()
+        })))
+      }));
+    } else {
+      this.#registry.markUnavailable(
+        "judgment",
+        'disabled by configuration (judgment.enabled=false); set "judgment": { "enabled": true } in .omp/fabric.json or the agent fabric.json to enable judgment.* actions'
+      );
+    }
     const agentConfig = enforceSchema ? { ...this.#config.agents, enabled: false } : this.#config.agents;
     const modelsConfig = this.#config.models;
     const visibleOmpModels = () => {
@@ -14623,6 +15043,7 @@ ${escapeXmlText(text)}
       "schema",
       "compact",
       ...this.#config.codemap.enabled ? ["codemap"] : [],
+      ...this.#config.judgment.enabled ? ["judgment"] : [],
       "agents",
       ...this.#config.memory.enabled ? ["memory"] : []
     ]);