open-multi-agent-kit 0.98.5 → 0.99.0

package/dist/core/devin-harness-dispatch.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Apply the `devin-harness` domain loadout when the active provider is Devin.
+ * Does not require `OMK_DOMAIN_ROUTING=1`. Convenience wrapper over
+ * `tryProviderHarnessDispatch()` bound to the real loadout runtime.
+ */
+import type { LoadoutRuntimeSession, LoadoutRuntimeState } from "./loadout-runtime.ts";
+import { type ProviderHarnessDispatchInput, type ProviderHarnessDispatchResult } from "./provider-harness-dispatch.ts";
+import type { ResourceLoader } from "./resource-loader.ts";
+export type DevinHarnessDispatchInput = ProviderHarnessDispatchInput<LoadoutRuntimeSession, ResourceLoader>;
+export type DevinHarnessDispatchResult = ProviderHarnessDispatchResult<LoadoutRuntimeState>;
+export declare function tryDevinHarnessDispatch(input: DevinHarnessDispatchInput): DevinHarnessDispatchResult;
+//# sourceMappingURL=devin-harness-dispatch.d.ts.map

package/dist/core/devin-harness-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin-harness-dispatch.d.ts","sourceRoot":"","sources":["../../src/core/devin-harness-dispatch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EACN,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,yBAAyB,GAAG,4BAA4B,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;AAC5G,MAAM,MAAM,0BAA0B,GAAG,6BAA6B,CAAC,mBAAmB,CAAC,CAAC;AAE5F,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,yBAAyB,GAAG,0BAA0B,CAEpG","sourcesContent":["/**\n * Apply the `devin-harness` domain loadout when the active provider is Devin.\n * Does not require `OMK_DOMAIN_ROUTING=1`. Convenience wrapper over\n * `tryProviderHarnessDispatch()` bound to the real loadout runtime.\n */\n\nimport { DEVIN_HARNESS_SPEC } from \"./devin-harness.ts\";\nimport { LOADOUT_HARNESS_RUNTIME } from \"./domain-dispatch.ts\";\nimport type { LoadoutRuntimeSession, LoadoutRuntimeState } from \"./loadout-runtime.ts\";\nimport {\n\ttype ProviderHarnessDispatchInput,\n\ttype ProviderHarnessDispatchResult,\n\ttryProviderHarnessDispatch,\n} from \"./provider-harness-dispatch.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\n\nexport type DevinHarnessDispatchInput = ProviderHarnessDispatchInput<LoadoutRuntimeSession, ResourceLoader>;\nexport type DevinHarnessDispatchResult = ProviderHarnessDispatchResult<LoadoutRuntimeState>;\n\nexport function tryDevinHarnessDispatch(input: DevinHarnessDispatchInput): DevinHarnessDispatchResult {\n\treturn tryProviderHarnessDispatch(DEVIN_HARNESS_SPEC, LOADOUT_HARNESS_RUNTIME, input);\n}\n"]}

package/dist/core/devin-harness-dispatch.js

@@ -0,0 +1,12 @@
+/**
+ * Apply the `devin-harness` domain loadout when the active provider is Devin.
+ * Does not require `OMK_DOMAIN_ROUTING=1`. Convenience wrapper over
+ * `tryProviderHarnessDispatch()` bound to the real loadout runtime.
+ */
+import { DEVIN_HARNESS_SPEC } from "./devin-harness.js";
+import { LOADOUT_HARNESS_RUNTIME } from "./domain-dispatch.js";
+import { tryProviderHarnessDispatch, } from "./provider-harness-dispatch.js";
+export function tryDevinHarnessDispatch(input) {
+    return tryProviderHarnessDispatch(DEVIN_HARNESS_SPEC, LOADOUT_HARNESS_RUNTIME, input);
+}
+//# sourceMappingURL=devin-harness-dispatch.js.map

package/dist/core/devin-harness-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin-harness-dispatch.js","sourceRoot":"","sources":["../../src/core/devin-harness-dispatch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EAGN,0BAA0B,GAC1B,MAAM,gCAAgC,CAAC;AAMxC,MAAM,UAAU,uBAAuB,CAAC,KAAgC,EAA8B;IACrG,OAAO,0BAA0B,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;AAAA,CACtF","sourcesContent":["/**\n * Apply the `devin-harness` domain loadout when the active provider is Devin.\n * Does not require `OMK_DOMAIN_ROUTING=1`. Convenience wrapper over\n * `tryProviderHarnessDispatch()` bound to the real loadout runtime.\n */\n\nimport { DEVIN_HARNESS_SPEC } from \"./devin-harness.ts\";\nimport { LOADOUT_HARNESS_RUNTIME } from \"./domain-dispatch.ts\";\nimport type { LoadoutRuntimeSession, LoadoutRuntimeState } from \"./loadout-runtime.ts\";\nimport {\n\ttype ProviderHarnessDispatchInput,\n\ttype ProviderHarnessDispatchResult,\n\ttryProviderHarnessDispatch,\n} from \"./provider-harness-dispatch.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\n\nexport type DevinHarnessDispatchInput = ProviderHarnessDispatchInput<LoadoutRuntimeSession, ResourceLoader>;\nexport type DevinHarnessDispatchResult = ProviderHarnessDispatchResult<LoadoutRuntimeState>;\n\nexport function tryDevinHarnessDispatch(input: DevinHarnessDispatchInput): DevinHarnessDispatchResult {\n\treturn tryProviderHarnessDispatch(DEVIN_HARNESS_SPEC, LOADOUT_HARNESS_RUNTIME, input);\n}\n"]}

package/dist/core/devin-harness.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Devin SWE-2 harness: provider identity, auto-apply flag, per-turn skill
+ * grants, and the optional `~/.omk/agent/devin.md` operator overlay.
+ *
+ * The canonical operator contract is `docs/devin-harness.md`; the domain
+ * loadout is `devin-harness` in `domain-loadouts.ts`.
+ */
+import { type HarnessSkillCandidate, type HarnessSkillSelectionOptions } from "./harness-skills.ts";
+import type { ProviderHarnessSpec } from "./provider-harness-dispatch.ts";
+/** Built-in provider id for the Devin CLI subscription adapter. */
+export declare const DEVIN_PROVIDER = "devin";
+/** The only logical model the Devin adapter serves. */
+export declare const DEVIN_SWE2_MODEL_ID = "swe-2";
+/** Local context budget bundled with `devin/swe-2`; mirrors `DEVIN_LONG_CONTEXT_TOKENS` in omk-ai. */
+export declare const DEVIN_SWE2_CONTEXT_WINDOW = 1000000;
+/** Domain loadout id applied automatically when the Devin provider is active. */
+export declare const DEVIN_HARNESS_DOMAIN_ID = "devin-harness";
+/** Optional host-specific operator overlay appended to the system prompt on Devin sessions. */
+export declare const DEVIN_PLAYBOOK_FILENAME = "devin.md";
+/** Cap live system-prompt append size to reduce threshold autocompaction churn. */
+export declare const DEVIN_PLAYBOOK_MAX_APPEND_CHARS = 24000;
+/** SWE-2 efforts the adapter accepts; every other thinking level is rejected before credentials are sent. */
+export declare const DEVIN_SWE2_EFFORTS: readonly ["medium", "high", "max"];
+export type DevinSwe2Effort = (typeof DEVIN_SWE2_EFFORTS)[number];
+export type DevinHarnessIntent = "code" | "debug" | "test" | "repo";
+export type DevinHarnessSkillCandidate = HarnessSkillCandidate;
+export type DevinHarnessSkillSelectionOptions = HarnessSkillSelectionOptions;
+export declare function isDevinProvider(provider: string | undefined): boolean;
+export declare function isDevinSwe2Effort(level: string | undefined): level is DevinSwe2Effort;
+/**
+ * Recommended effort for a task class. SWE-2 medium acts sooner on simple and
+ * intermediate work; high and max plan and verify more on complex work.
+ */
+export declare function recommendedDevinEffortForIntent(intent: DevinHarnessIntent): DevinSwe2Effort;
+export declare function recommendedDevinSkillTierForIntent(intent: DevinHarnessIntent): readonly string[];
+/**
+ * Smallest devin-harness skill grant from the live inventory. The domain
+ * profile owns the allowlist; explicit-only skills are excluded. `headroom`
+ * requires lexical or measured pressure, and the result never exceeds
+ * `MAX_SELECTED_SKILLS` names.
+ */
+export declare function selectDevinHarnessSkills(task: string, inventory: readonly DevinHarnessSkillCandidate[], options?: DevinHarnessSkillSelectionOptions): readonly string[];
+/**
+ * When true (default), selecting the `devin` provider applies the `devin-harness`
+ * domain loadout (skills/MCP/hooks/tool gate). Set `OMK_DEVIN_HARNESS=0` to disable.
+ */
+export declare function devinHarnessAutoApplyEnabled(env?: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>): boolean;
+/** Provider-harness spec consumed by `tryProviderHarnessDispatch()`. */
+export declare const DEVIN_HARNESS_SPEC: ProviderHarnessSpec;
+/** Read ~/.omk/agent/devin.md for appending to the system prompt on Devin sessions. */
+export declare function loadDevinPlaybookAppend(): string | undefined;
+export declare function devinPlaybookAppendForProvider(provider: string | undefined): string | undefined;
+//# sourceMappingURL=devin-harness.d.ts.map

package/dist/core/devin-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin-harness.d.ts","sourceRoot":"","sources":["../../src/core/devin-harness.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EACN,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EAEjC,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,mEAAmE;AACnE,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C,sGAAsG;AACtG,eAAO,MAAM,yBAAyB,UAAY,CAAC;AAEnD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAIvD,+FAA+F;AAC/F,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAElD,mFAAmF;AACnF,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD,6GAA6G;AAC7G,eAAO,MAAM,kBAAkB,oCAAqC,CAAC;AACrE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AASpE,MAAM,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAC/D,MAAM,MAAM,iCAAiC,GAAG,4BAA4B,CAAC;AAM7E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAErE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,eAAe,CAErF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,CAU3F;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,MAAM,EAAE,CAEhG;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,0BAA0B,EAAE,EAChD,OAAO,GAAE,iCAAsC,GAC7C,SAAS,MAAM,EAAE,CAEnB;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC3C,GAAG,GAAE,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GACjF,OAAO,CAMT;AAED,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,EAAE,mBAIhC,CAAC;AAEF,uFAAuF;AACvF,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAiB5D;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK/F","sourcesContent":["/**\n * Devin SWE-2 harness: provider identity, auto-apply flag, per-turn skill\n * grants, and the optional `~/.omk/agent/devin.md` operator overlay.\n *\n * The canonical operator contract is `docs/devin-harness.md`; the domain\n * loadout is `devin-harness` in `domain-loadouts.ts`.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { getAgentDir } from \"../config.ts\";\nimport { getDomainProfile } from \"./domain-loadouts.ts\";\nimport {\n\ttype HarnessSkillCandidate,\n\ttype HarnessSkillSelectionOptions,\n\tselectHarnessSkills,\n} from \"./harness-skills.ts\";\nimport { capabilityGateNames } from \"./loadout-safety.ts\";\nimport type { ProviderHarnessSpec } from \"./provider-harness-dispatch.ts\";\n\n/** Built-in provider id for the Devin CLI subscription adapter. */\nexport const DEVIN_PROVIDER = \"devin\";\n\n/** The only logical model the Devin adapter serves. */\nexport const DEVIN_SWE2_MODEL_ID = \"swe-2\";\n\n/** Local context budget bundled with `devin/swe-2`; mirrors `DEVIN_LONG_CONTEXT_TOKENS` in omk-ai. */\nexport const DEVIN_SWE2_CONTEXT_WINDOW = 1_000_000;\n\n/** Domain loadout id applied automatically when the Devin provider is active. */\nexport const DEVIN_HARNESS_DOMAIN_ID = \"devin-harness\";\n\nconst DEVIN_HARNESS_AUTO_APPLY_ENV = \"OMK_DEVIN_HARNESS\";\n\n/** Optional host-specific operator overlay appended to the system prompt on Devin sessions. */\nexport const DEVIN_PLAYBOOK_FILENAME = \"devin.md\";\n\n/** Cap live system-prompt append size to reduce threshold autocompaction churn. */\nexport const DEVIN_PLAYBOOK_MAX_APPEND_CHARS = 24_000;\n\n/** SWE-2 efforts the adapter accepts; every other thinking level is rejected before credentials are sent. */\nexport const DEVIN_SWE2_EFFORTS = [\"medium\", \"high\", \"max\"] as const;\nexport type DevinSwe2Effort = (typeof DEVIN_SWE2_EFFORTS)[number];\n\nexport type DevinHarnessIntent = \"code\" | \"debug\" | \"test\" | \"repo\";\n\nconst SKILLS_BY_INTENT = {\n\tcode: [\"packages\", \"programming\"],\n\tdebug: [\"packages\", \"debugging\", \"programming\"],\n\ttest: [\"tdd-workflow\", \"programming\"],\n\trepo: [\"understand-anything\", \"packages\"],\n} as const satisfies Record<DevinHarnessIntent, readonly string[]>;\n\nexport type DevinHarnessSkillCandidate = HarnessSkillCandidate;\nexport type DevinHarnessSkillSelectionOptions = HarnessSkillSelectionOptions;\n\nconst DEVIN_HARNESS_ALLOWED_SKILLS: ReadonlySet<string> = new Set(\n\tcapabilityGateNames(getDomainProfile(DEVIN_HARNESS_DOMAIN_ID).skills),\n);\n\nexport function isDevinProvider(provider: string | undefined): boolean {\n\treturn provider === DEVIN_PROVIDER;\n}\n\nexport function isDevinSwe2Effort(level: string | undefined): level is DevinSwe2Effort {\n\treturn (DEVIN_SWE2_EFFORTS as readonly string[]).includes(level ?? \"\");\n}\n\n/**\n * Recommended effort for a task class. SWE-2 medium acts sooner on simple and\n * intermediate work; high and max plan and verify more on complex work.\n */\nexport function recommendedDevinEffortForIntent(intent: DevinHarnessIntent): DevinSwe2Effort {\n\tswitch (intent) {\n\t\tcase \"code\":\n\t\t\treturn \"medium\";\n\t\tcase \"test\":\n\t\t\treturn \"high\";\n\t\tcase \"debug\":\n\t\tcase \"repo\":\n\t\t\treturn \"max\";\n\t}\n}\n\nexport function recommendedDevinSkillTierForIntent(intent: DevinHarnessIntent): readonly string[] {\n\treturn SKILLS_BY_INTENT[intent];\n}\n\n/**\n * Smallest devin-harness skill grant from the live inventory. The domain\n * profile owns the allowlist; explicit-only skills are excluded. `headroom`\n * requires lexical or measured pressure, and the result never exceeds\n * `MAX_SELECTED_SKILLS` names.\n */\nexport function selectDevinHarnessSkills(\n\ttask: string,\n\tinventory: readonly DevinHarnessSkillCandidate[],\n\toptions: DevinHarnessSkillSelectionOptions = {},\n): readonly string[] {\n\treturn selectHarnessSkills(DEVIN_HARNESS_ALLOWED_SKILLS, task, inventory, options);\n}\n\n/**\n * When true (default), selecting the `devin` provider applies the `devin-harness`\n * domain loadout (skills/MCP/hooks/tool gate). Set `OMK_DEVIN_HARNESS=0` to disable.\n */\nexport function devinHarnessAutoApplyEnabled(\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n\tconst raw = env[DEVIN_HARNESS_AUTO_APPLY_ENV]?.trim().toLowerCase();\n\tif (raw === \"0\" || raw === \"false\" || raw === \"off\" || raw === \"no\") {\n\t\treturn false;\n\t}\n\treturn true;\n}\n\n/** Provider-harness spec consumed by `tryProviderHarnessDispatch()`. */\nexport const DEVIN_HARNESS_SPEC: ProviderHarnessSpec = {\n\tdomainId: DEVIN_HARNESS_DOMAIN_ID,\n\tapplies: (provider, env) => devinHarnessAutoApplyEnabled(env) && isDevinProvider(provider),\n\tselectSkills: (task, inventory, options) => selectDevinHarnessSkills(task, inventory, { paths: options.paths }),\n};\n\n/** Read ~/.omk/agent/devin.md for appending to the system prompt on Devin sessions. */\nexport function loadDevinPlaybookAppend(): string | undefined {\n\tconst path = join(getAgentDir(), DEVIN_PLAYBOOK_FILENAME);\n\tif (!existsSync(path)) {\n\t\treturn undefined;\n\t}\n\ttry {\n\t\tlet text = readFileSync(path, \"utf-8\").trim();\n\t\tif (text.length === 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\tif (text.length > DEVIN_PLAYBOOK_MAX_APPEND_CHARS) {\n\t\t\ttext = `${text.slice(0, DEVIN_PLAYBOOK_MAX_APPEND_CHARS)}\\n\\n[... devin.md truncated for system prompt; full file: ${path}]`;\n\t\t}\n\t\treturn text;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport function devinPlaybookAppendForProvider(provider: string | undefined): string | undefined {\n\tif (!isDevinProvider(provider)) {\n\t\treturn undefined;\n\t}\n\treturn loadDevinPlaybookAppend();\n}\n"]}

package/dist/core/devin-harness.js

@@ -0,0 +1,112 @@
+/**
+ * Devin SWE-2 harness: provider identity, auto-apply flag, per-turn skill
+ * grants, and the optional `~/.omk/agent/devin.md` operator overlay.
+ *
+ * The canonical operator contract is `docs/devin-harness.md`; the domain
+ * loadout is `devin-harness` in `domain-loadouts.ts`.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { getAgentDir } from "../config.js";
+import { getDomainProfile } from "./domain-loadouts.js";
+import { selectHarnessSkills, } from "./harness-skills.js";
+import { capabilityGateNames } from "./loadout-safety.js";
+/** Built-in provider id for the Devin CLI subscription adapter. */
+export const DEVIN_PROVIDER = "devin";
+/** The only logical model the Devin adapter serves. */
+export const DEVIN_SWE2_MODEL_ID = "swe-2";
+/** Local context budget bundled with `devin/swe-2`; mirrors `DEVIN_LONG_CONTEXT_TOKENS` in omk-ai. */
+export const DEVIN_SWE2_CONTEXT_WINDOW = 1_000_000;
+/** Domain loadout id applied automatically when the Devin provider is active. */
+export const DEVIN_HARNESS_DOMAIN_ID = "devin-harness";
+const DEVIN_HARNESS_AUTO_APPLY_ENV = "OMK_DEVIN_HARNESS";
+/** Optional host-specific operator overlay appended to the system prompt on Devin sessions. */
+export const DEVIN_PLAYBOOK_FILENAME = "devin.md";
+/** Cap live system-prompt append size to reduce threshold autocompaction churn. */
+export const DEVIN_PLAYBOOK_MAX_APPEND_CHARS = 24_000;
+/** SWE-2 efforts the adapter accepts; every other thinking level is rejected before credentials are sent. */
+export const DEVIN_SWE2_EFFORTS = ["medium", "high", "max"];
+const SKILLS_BY_INTENT = {
+    code: ["packages", "programming"],
+    debug: ["packages", "debugging", "programming"],
+    test: ["tdd-workflow", "programming"],
+    repo: ["understand-anything", "packages"],
+};
+const DEVIN_HARNESS_ALLOWED_SKILLS = new Set(capabilityGateNames(getDomainProfile(DEVIN_HARNESS_DOMAIN_ID).skills));
+export function isDevinProvider(provider) {
+    return provider === DEVIN_PROVIDER;
+}
+export function isDevinSwe2Effort(level) {
+    return DEVIN_SWE2_EFFORTS.includes(level ?? "");
+}
+/**
+ * Recommended effort for a task class. SWE-2 medium acts sooner on simple and
+ * intermediate work; high and max plan and verify more on complex work.
+ */
+export function recommendedDevinEffortForIntent(intent) {
+    switch (intent) {
+        case "code":
+            return "medium";
+        case "test":
+            return "high";
+        case "debug":
+        case "repo":
+            return "max";
+    }
+}
+export function recommendedDevinSkillTierForIntent(intent) {
+    return SKILLS_BY_INTENT[intent];
+}
+/**
+ * Smallest devin-harness skill grant from the live inventory. The domain
+ * profile owns the allowlist; explicit-only skills are excluded. `headroom`
+ * requires lexical or measured pressure, and the result never exceeds
+ * `MAX_SELECTED_SKILLS` names.
+ */
+export function selectDevinHarnessSkills(task, inventory, options = {}) {
+    return selectHarnessSkills(DEVIN_HARNESS_ALLOWED_SKILLS, task, inventory, options);
+}
+/**
+ * When true (default), selecting the `devin` provider applies the `devin-harness`
+ * domain loadout (skills/MCP/hooks/tool gate). Set `OMK_DEVIN_HARNESS=0` to disable.
+ */
+export function devinHarnessAutoApplyEnabled(env = process.env) {
+    const raw = env[DEVIN_HARNESS_AUTO_APPLY_ENV]?.trim().toLowerCase();
+    if (raw === "0" || raw === "false" || raw === "off" || raw === "no") {
+        return false;
+    }
+    return true;
+}
+/** Provider-harness spec consumed by `tryProviderHarnessDispatch()`. */
+export const DEVIN_HARNESS_SPEC = {
+    domainId: DEVIN_HARNESS_DOMAIN_ID,
+    applies: (provider, env) => devinHarnessAutoApplyEnabled(env) && isDevinProvider(provider),
+    selectSkills: (task, inventory, options) => selectDevinHarnessSkills(task, inventory, { paths: options.paths }),
+};
+/** Read ~/.omk/agent/devin.md for appending to the system prompt on Devin sessions. */
+export function loadDevinPlaybookAppend() {
+    const path = join(getAgentDir(), DEVIN_PLAYBOOK_FILENAME);
+    if (!existsSync(path)) {
+        return undefined;
+    }
+    try {
+        let text = readFileSync(path, "utf-8").trim();
+        if (text.length === 0) {
+            return undefined;
+        }
+        if (text.length > DEVIN_PLAYBOOK_MAX_APPEND_CHARS) {
+            text = `${text.slice(0, DEVIN_PLAYBOOK_MAX_APPEND_CHARS)}\n\n[... devin.md truncated for system prompt; full file: ${path}]`;
+        }
+        return text;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function devinPlaybookAppendForProvider(provider) {
+    if (!isDevinProvider(provider)) {
+        return undefined;
+    }
+    return loadDevinPlaybookAppend();
+}
+//# sourceMappingURL=devin-harness.js.map

package/dist/core/devin-harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devin-harness.js","sourceRoot":"","sources":["../../src/core/devin-harness.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAGN,mBAAmB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,sGAAsG;AACtG,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAEnD,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEvD,MAAM,4BAA4B,GAAG,mBAAmB,CAAC;AAEzD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAElD,mFAAmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAEtD,6GAA6G;AAC7G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAKrE,MAAM,gBAAgB,GAAG;IACxB,IAAI,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;IACjC,KAAK,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC;IAC/C,IAAI,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC;IACrC,IAAI,EAAE,CAAC,qBAAqB,EAAE,UAAU,CAAC;CACwB,CAAC;AAKnE,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAChE,mBAAmB,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,CACrE,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,QAA4B,EAAW;IACtE,OAAO,QAAQ,KAAK,cAAc,CAAC;AAAA,CACnC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAyB,EAA4B;IACtF,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAAA,CACvE;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAA0B,EAAmB;IAC5F,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,MAAM;YACV,OAAO,QAAQ,CAAC;QACjB,KAAK,MAAM;YACV,OAAO,MAAM,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACV,OAAO,KAAK,CAAC;IACf,CAAC;AAAA,CACD;AAED,MAAM,UAAU,kCAAkC,CAAC,MAA0B,EAAqB;IACjG,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAAA,CAChC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACvC,IAAY,EACZ,SAAgD,EAChD,OAAO,GAAsC,EAAE,EAC3B;IACpB,OAAO,mBAAmB,CAAC,4BAA4B,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAAA,CACnF;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC3C,GAAG,GAAqE,OAAO,CAAC,GAAG,EACzE;IACV,MAAM,GAAG,GAAG,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAwB;IACtD,QAAQ,EAAE,uBAAuB;IACjC,OAAO,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC;IAC1F,YAAY,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;CAC/G,CAAC;AAEF,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,GAAuB;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACJ,IAAI,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;YACnD,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,+BAA+B,CAAC,6DAA6D,IAAI,GAAG,CAAC;QAC9H,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AAAA,CACD;AAED,MAAM,UAAU,8BAA8B,CAAC,QAA4B,EAAsB;IAChG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,uBAAuB,EAAE,CAAC;AAAA,CACjC","sourcesContent":["/**\n * Devin SWE-2 harness: provider identity, auto-apply flag, per-turn skill\n * grants, and the optional `~/.omk/agent/devin.md` operator overlay.\n *\n * The canonical operator contract is `docs/devin-harness.md`; the domain\n * loadout is `devin-harness` in `domain-loadouts.ts`.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { getAgentDir } from \"../config.ts\";\nimport { getDomainProfile } from \"./domain-loadouts.ts\";\nimport {\n\ttype HarnessSkillCandidate,\n\ttype HarnessSkillSelectionOptions,\n\tselectHarnessSkills,\n} from \"./harness-skills.ts\";\nimport { capabilityGateNames } from \"./loadout-safety.ts\";\nimport type { ProviderHarnessSpec } from \"./provider-harness-dispatch.ts\";\n\n/** Built-in provider id for the Devin CLI subscription adapter. */\nexport const DEVIN_PROVIDER = \"devin\";\n\n/** The only logical model the Devin adapter serves. */\nexport const DEVIN_SWE2_MODEL_ID = \"swe-2\";\n\n/** Local context budget bundled with `devin/swe-2`; mirrors `DEVIN_LONG_CONTEXT_TOKENS` in omk-ai. */\nexport const DEVIN_SWE2_CONTEXT_WINDOW = 1_000_000;\n\n/** Domain loadout id applied automatically when the Devin provider is active. */\nexport const DEVIN_HARNESS_DOMAIN_ID = \"devin-harness\";\n\nconst DEVIN_HARNESS_AUTO_APPLY_ENV = \"OMK_DEVIN_HARNESS\";\n\n/** Optional host-specific operator overlay appended to the system prompt on Devin sessions. */\nexport const DEVIN_PLAYBOOK_FILENAME = \"devin.md\";\n\n/** Cap live system-prompt append size to reduce threshold autocompaction churn. */\nexport const DEVIN_PLAYBOOK_MAX_APPEND_CHARS = 24_000;\n\n/** SWE-2 efforts the adapter accepts; every other thinking level is rejected before credentials are sent. */\nexport const DEVIN_SWE2_EFFORTS = [\"medium\", \"high\", \"max\"] as const;\nexport type DevinSwe2Effort = (typeof DEVIN_SWE2_EFFORTS)[number];\n\nexport type DevinHarnessIntent = \"code\" | \"debug\" | \"test\" | \"repo\";\n\nconst SKILLS_BY_INTENT = {\n\tcode: [\"packages\", \"programming\"],\n\tdebug: [\"packages\", \"debugging\", \"programming\"],\n\ttest: [\"tdd-workflow\", \"programming\"],\n\trepo: [\"understand-anything\", \"packages\"],\n} as const satisfies Record<DevinHarnessIntent, readonly string[]>;\n\nexport type DevinHarnessSkillCandidate = HarnessSkillCandidate;\nexport type DevinHarnessSkillSelectionOptions = HarnessSkillSelectionOptions;\n\nconst DEVIN_HARNESS_ALLOWED_SKILLS: ReadonlySet<string> = new Set(\n\tcapabilityGateNames(getDomainProfile(DEVIN_HARNESS_DOMAIN_ID).skills),\n);\n\nexport function isDevinProvider(provider: string | undefined): boolean {\n\treturn provider === DEVIN_PROVIDER;\n}\n\nexport function isDevinSwe2Effort(level: string | undefined): level is DevinSwe2Effort {\n\treturn (DEVIN_SWE2_EFFORTS as readonly string[]).includes(level ?? \"\");\n}\n\n/**\n * Recommended effort for a task class. SWE-2 medium acts sooner on simple and\n * intermediate work; high and max plan and verify more on complex work.\n */\nexport function recommendedDevinEffortForIntent(intent: DevinHarnessIntent): DevinSwe2Effort {\n\tswitch (intent) {\n\t\tcase \"code\":\n\t\t\treturn \"medium\";\n\t\tcase \"test\":\n\t\t\treturn \"high\";\n\t\tcase \"debug\":\n\t\tcase \"repo\":\n\t\t\treturn \"max\";\n\t}\n}\n\nexport function recommendedDevinSkillTierForIntent(intent: DevinHarnessIntent): readonly string[] {\n\treturn SKILLS_BY_INTENT[intent];\n}\n\n/**\n * Smallest devin-harness skill grant from the live inventory. The domain\n * profile owns the allowlist; explicit-only skills are excluded. `headroom`\n * requires lexical or measured pressure, and the result never exceeds\n * `MAX_SELECTED_SKILLS` names.\n */\nexport function selectDevinHarnessSkills(\n\ttask: string,\n\tinventory: readonly DevinHarnessSkillCandidate[],\n\toptions: DevinHarnessSkillSelectionOptions = {},\n): readonly string[] {\n\treturn selectHarnessSkills(DEVIN_HARNESS_ALLOWED_SKILLS, task, inventory, options);\n}\n\n/**\n * When true (default), selecting the `devin` provider applies the `devin-harness`\n * domain loadout (skills/MCP/hooks/tool gate). Set `OMK_DEVIN_HARNESS=0` to disable.\n */\nexport function devinHarnessAutoApplyEnabled(\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n\tconst raw = env[DEVIN_HARNESS_AUTO_APPLY_ENV]?.trim().toLowerCase();\n\tif (raw === \"0\" || raw === \"false\" || raw === \"off\" || raw === \"no\") {\n\t\treturn false;\n\t}\n\treturn true;\n}\n\n/** Provider-harness spec consumed by `tryProviderHarnessDispatch()`. */\nexport const DEVIN_HARNESS_SPEC: ProviderHarnessSpec = {\n\tdomainId: DEVIN_HARNESS_DOMAIN_ID,\n\tapplies: (provider, env) => devinHarnessAutoApplyEnabled(env) && isDevinProvider(provider),\n\tselectSkills: (task, inventory, options) => selectDevinHarnessSkills(task, inventory, { paths: options.paths }),\n};\n\n/** Read ~/.omk/agent/devin.md for appending to the system prompt on Devin sessions. */\nexport function loadDevinPlaybookAppend(): string | undefined {\n\tconst path = join(getAgentDir(), DEVIN_PLAYBOOK_FILENAME);\n\tif (!existsSync(path)) {\n\t\treturn undefined;\n\t}\n\ttry {\n\t\tlet text = readFileSync(path, \"utf-8\").trim();\n\t\tif (text.length === 0) {\n\t\t\treturn undefined;\n\t\t}\n\t\tif (text.length > DEVIN_PLAYBOOK_MAX_APPEND_CHARS) {\n\t\t\ttext = `${text.slice(0, DEVIN_PLAYBOOK_MAX_APPEND_CHARS)}\\n\\n[... devin.md truncated for system prompt; full file: ${path}]`;\n\t\t}\n\t\treturn text;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport function devinPlaybookAppendForProvider(provider: string | undefined): string | undefined {\n\tif (!isDevinProvider(provider)) {\n\t\treturn undefined;\n\t}\n\treturn loadDevinPlaybookAppend();\n}\n"]}

package/dist/core/domain-dispatch.d.ts

@@ -8,9 +8,12 @@
 import type { ToolDefinition } from "./extensions/types.ts";
 import type { LoadoutAccessPolicy } from "./loadout-access-policy.ts";
 import { type CompositionTrace, type ScopeHints } from "./loadout-compose.ts";
-import { type LoadoutRuntimeSession } from "./loadout-runtime.ts";
+import { type LoadoutRuntimeSession, type LoadoutRuntimeState } from "./loadout-runtime.ts";
 import type { LoadoutAuthority, LoadoutProfile, LoadoutRole } from "./loadouts.ts";
+import type { ProviderHarnessRuntime } from "./provider-harness-dispatch.ts";
 import type { ResourceLoader } from "./resource-loader.ts";
+/** Real loadout runtime entry points for provider-harness dispatch (`tryProviderHarnessDispatch`). */
+export declare const LOADOUT_HARNESS_RUNTIME: ProviderHarnessRuntime<LoadoutRuntimeSession, ResourceLoader, LoadoutRuntimeState>;
 export interface DomainDispatchInput {
     readonly role: LoadoutRole;
     readonly initialPrompt: string;

package/dist/core/domain-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain-dispatch.d.ts","sourceRoot":"","sources":["../../src/core/domain-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAkB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,UAAU,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAyB,KAAK,qBAAqB,EAA4B,MAAM,sBAAsB,CAAC;AACnH,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAChF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACjD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,wBAAgB,kCAAkC,CACjD,OAAO,EAAE,mCAAmC,GAC1C,qBAAqB,CA0BvB;AAED,wBAAgB,sBAAsB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GACjF,OAAO,CAET;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CAyClF","sourcesContent":["/**\n * Opt-in domain dispatch orchestration.\n *\n * Callers can invoke it to route an initial prompt, compose a role/domain\n * loadout, apply it to the current runtime inventory, and receive an access\n * policy suitable for existing AgentSession enforcement.\n */\n\nimport { routeDomain } from \"./domain-router.ts\";\nimport type { RegisteredTool, ToolDefinition } from \"./extensions/types.ts\";\nimport type { LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport {\n\ttype ComposeLoadoutOptions,\n\ttype CompositionTrace,\n\tcomposeLoadout,\n\ttype ScopeHints,\n} from \"./loadout-compose.ts\";\nimport { createLoadoutPolicyFromRuntimeState, validatePolicyIntegrity } from \"./loadout-policy-bridge.ts\";\nimport { applyLoadoutToRuntime, type LoadoutRuntimeSession, type LoadoutRuntimeState } from \"./loadout-runtime.ts\";\nimport type { LoadoutAuthority, LoadoutProfile, LoadoutRole } from \"./loadouts.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\n\nexport interface DomainDispatchInput {\n\treadonly role: LoadoutRole;\n\treadonly initialPrompt: string;\n\treadonly session: LoadoutRuntimeSession;\n\treadonly resourceLoader: ResourceLoader;\n\treadonly cwd: string;\n\treadonly agentDir: string;\n\treadonly grantAuthority?: LoadoutAuthority;\n\treadonly scopeHints?: ScopeHints;\n\treadonly env?: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>;\n\treadonly roleProfileOverride?: LoadoutProfile;\n\treadonly blockedPaths?: readonly string[];\n}\n\nexport interface DomainDispatchResult {\n\treadonly loadoutAccessPolicy: LoadoutAccessPolicy | undefined;\n\treadonly domainUsed: string | undefined;\n\treadonly fallback: boolean;\n\treadonly warnings: readonly string[];\n\treadonly trace: CompositionTrace | undefined;\n}\n\nexport interface DomainDispatchRuntimeSessionOptions {\n\treadonly baseToolNames: readonly string[];\n\treadonly resourceLoader: ResourceLoader;\n\treadonly customTools?: readonly ToolDefinition[];\n\treadonly allowedToolNames?: readonly string[];\n\treadonly excludedToolNames?: readonly string[];\n}\n\nexport function createDomainDispatchRuntimeSession(\n\toptions: DomainDispatchRuntimeSessionOptions,\n): LoadoutRuntimeSession {\n\tconst allowedToolNameSet = options.allowedToolNames ? new Set(options.allowedToolNames) : undefined;\n\tconst excludedToolNameSet = options.excludedToolNames ? new Set(options.excludedToolNames) : undefined;\n\tconst isAllowedTool = (name: string): boolean =>\n\t\t(!allowedToolNameSet || allowedToolNameSet.has(name)) && !excludedToolNameSet?.has(name);\n\n\tconst base = new Map<string, ToolDefinition>();\n\tfor (const name of uniqueSorted(options.baseToolNames).filter(isAllowedTool)) {\n\t\tbase.set(name, { name } as unknown as ToolDefinition);\n\t}\n\n\tconst extensionToolsByName = new Map<string, RegisteredTool>();\n\tfor (const extension of options.resourceLoader.getExtensions().extensions) {\n\t\tfor (const tool of extension.tools.values()) {\n\t\t\tconst name = tool.definition.name;\n\t\t\tif (isAllowedTool(name) && !extensionToolsByName.has(name)) {\n\t\t\t\textensionToolsByName.set(name, tool);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\t_baseToolDefinitions: base,\n\t\t_extensionRunner: { getAllRegisteredTools: () => [...extensionToolsByName.values()] },\n\t\t_customTools: [...(options.customTools ?? [])].filter((tool) => isAllowedTool(tool.name)),\n\t};\n}\n\nexport function isDomainRoutingEnabled(\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n\treturn env.OMK_DOMAIN_ROUTING === \"1\";\n}\n\nexport function tryDomainDispatch(input: DomainDispatchInput): DomainDispatchResult {\n\tif (!isDomainRoutingEnabled(input.env)) {\n\t\treturn noPolicy(false, [], undefined, undefined);\n\t}\n\n\tlet domainUsed: string | undefined;\n\tlet trace: CompositionTrace | undefined;\n\ttry {\n\t\tconst route = routeDomain({ task: input.initialPrompt });\n\t\tdomainUsed = route.primary.id;\n\t\tconst composeOptions: ComposeLoadoutOptions = {\n\t\t\tgrantAuthority: input.grantAuthority,\n\t\t\tscopeHints: input.scopeHints,\n\t\t\troleProfileOverride: input.roleProfileOverride,\n\t\t};\n\t\tconst profile = composeLoadout(input.role, route.primary, composeOptions);\n\t\ttrace = profile.composition;\n\t\tconst state = applyLoadoutToRuntime(input.session, input.resourceLoader, input.cwd, input.agentDir, {\n\t\t\tprofile,\n\t\t\trole: input.role,\n\t\t\tgrantAuthority: input.grantAuthority,\n\t\t\tassignedReadPaths: input.scopeHints?.readScope,\n\t\t\tassignedWritePaths: input.scopeHints?.writeScope,\n\t\t});\n\t\tconst policy = createPolicyOrThrow(state, profile.commands, input.cwd, input.blockedPaths);\n\t\tconst integrity = validatePolicyIntegrity(policy, state);\n\t\treturn {\n\t\t\tloadoutAccessPolicy: policy,\n\t\t\tdomainUsed,\n\t\t\tfallback: route.confidence === \"fallback\",\n\t\t\twarnings: uniqueSorted([\n\t\t\t\t...routeWarnings(route),\n\t\t\t\t...profile.composition.warnings,\n\t\t\t\t...state.warnings,\n\t\t\t\t...integrity.warnings,\n\t\t\t]),\n\t\t\ttrace,\n\t\t};\n\t} catch (error) {\n\t\treturn noPolicy(true, [errorMessage(error)], domainUsed, trace);\n\t}\n}\n\nfunction createPolicyOrThrow(\n\tstate: LoadoutRuntimeState,\n\tcommands: LoadoutProfile[\"commands\"],\n\tcwd: string,\n\tblockedPaths: readonly string[] | undefined,\n): LoadoutAccessPolicy {\n\treturn createLoadoutPolicyFromRuntimeState(state, {\n\t\tcwd,\n\t\tblockedPaths,\n\t\tcommands,\n\t});\n}\n\nfunction noPolicy(\n\tfallback: boolean,\n\twarnings: readonly string[],\n\tdomainUsed: string | undefined,\n\ttrace: CompositionTrace | undefined,\n): DomainDispatchResult {\n\treturn {\n\t\tloadoutAccessPolicy: undefined,\n\t\tdomainUsed,\n\t\tfallback,\n\t\twarnings: uniqueSorted(warnings),\n\t\ttrace,\n\t};\n}\n\nfunction routeWarnings(route: ReturnType<typeof routeDomain>): string[] {\n\tconst warnings: string[] = [];\n\tif (route.ambiguous) warnings.push(route.reason);\n\tif (route.confidence === \"fallback\") warnings.push(route.reason);\n\treturn warnings;\n}\n\nfunction errorMessage(error: unknown): string {\n\tif (error instanceof Error) return error.message;\n\treturn String(error);\n}\n\nfunction uniqueSorted(values: readonly string[]): string[] {\n\treturn [...new Set(values.map((value) => value.trim()).filter((value) => value !== \"\"))].sort((a, b) => {\n\t\tif (a < b) return -1;\n\t\tif (a > b) return 1;\n\t\treturn 0;\n\t});\n}\n"]}
+{"version":3,"file":"domain-dispatch.d.ts","sourceRoot":"","sources":["../../src/core/domain-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAkB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,UAAU,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAyB,KAAK,qBAAqB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACnH,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,sGAAsG;AACtG,eAAO,MAAM,uBAAuB,EAAE,sBAAsB,CAC3D,qBAAqB,EACrB,cAAc,EACd,mBAAmB,CAInB,CAAC;AAEF,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAChF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,cAAc,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACjD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,wBAAgB,kCAAkC,CACjD,OAAO,EAAE,mCAAmC,GAC1C,qBAAqB,CA0BvB;AAED,wBAAgB,sBAAsB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GACjF,OAAO,CAET;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,GAAG,oBAAoB,CAyClF","sourcesContent":["/**\n * Opt-in domain dispatch orchestration.\n *\n * Callers can invoke it to route an initial prompt, compose a role/domain\n * loadout, apply it to the current runtime inventory, and receive an access\n * policy suitable for existing AgentSession enforcement.\n */\n\nimport { routeDomain } from \"./domain-router.ts\";\nimport type { RegisteredTool, ToolDefinition } from \"./extensions/types.ts\";\nimport type { LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport {\n\ttype ComposeLoadoutOptions,\n\ttype CompositionTrace,\n\tcomposeLoadout,\n\ttype ScopeHints,\n} from \"./loadout-compose.ts\";\nimport { createLoadoutPolicyFromRuntimeState, validatePolicyIntegrity } from \"./loadout-policy-bridge.ts\";\nimport { applyLoadoutToRuntime, type LoadoutRuntimeSession, type LoadoutRuntimeState } from \"./loadout-runtime.ts\";\nimport type { LoadoutAuthority, LoadoutProfile, LoadoutRole } from \"./loadouts.ts\";\nimport type { ProviderHarnessRuntime } from \"./provider-harness-dispatch.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\n\n/** Real loadout runtime entry points for provider-harness dispatch (`tryProviderHarnessDispatch`). */\nexport const LOADOUT_HARNESS_RUNTIME: ProviderHarnessRuntime<\n\tLoadoutRuntimeSession,\n\tResourceLoader,\n\tLoadoutRuntimeState\n> = {\n\tapplyLoadoutToRuntime,\n\tcreateLoadoutPolicyFromRuntimeState,\n};\n\nexport interface DomainDispatchInput {\n\treadonly role: LoadoutRole;\n\treadonly initialPrompt: string;\n\treadonly session: LoadoutRuntimeSession;\n\treadonly resourceLoader: ResourceLoader;\n\treadonly cwd: string;\n\treadonly agentDir: string;\n\treadonly grantAuthority?: LoadoutAuthority;\n\treadonly scopeHints?: ScopeHints;\n\treadonly env?: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>;\n\treadonly roleProfileOverride?: LoadoutProfile;\n\treadonly blockedPaths?: readonly string[];\n}\n\nexport interface DomainDispatchResult {\n\treadonly loadoutAccessPolicy: LoadoutAccessPolicy | undefined;\n\treadonly domainUsed: string | undefined;\n\treadonly fallback: boolean;\n\treadonly warnings: readonly string[];\n\treadonly trace: CompositionTrace | undefined;\n}\n\nexport interface DomainDispatchRuntimeSessionOptions {\n\treadonly baseToolNames: readonly string[];\n\treadonly resourceLoader: ResourceLoader;\n\treadonly customTools?: readonly ToolDefinition[];\n\treadonly allowedToolNames?: readonly string[];\n\treadonly excludedToolNames?: readonly string[];\n}\n\nexport function createDomainDispatchRuntimeSession(\n\toptions: DomainDispatchRuntimeSessionOptions,\n): LoadoutRuntimeSession {\n\tconst allowedToolNameSet = options.allowedToolNames ? new Set(options.allowedToolNames) : undefined;\n\tconst excludedToolNameSet = options.excludedToolNames ? new Set(options.excludedToolNames) : undefined;\n\tconst isAllowedTool = (name: string): boolean =>\n\t\t(!allowedToolNameSet || allowedToolNameSet.has(name)) && !excludedToolNameSet?.has(name);\n\n\tconst base = new Map<string, ToolDefinition>();\n\tfor (const name of uniqueSorted(options.baseToolNames).filter(isAllowedTool)) {\n\t\tbase.set(name, { name } as unknown as ToolDefinition);\n\t}\n\n\tconst extensionToolsByName = new Map<string, RegisteredTool>();\n\tfor (const extension of options.resourceLoader.getExtensions().extensions) {\n\t\tfor (const tool of extension.tools.values()) {\n\t\t\tconst name = tool.definition.name;\n\t\t\tif (isAllowedTool(name) && !extensionToolsByName.has(name)) {\n\t\t\t\textensionToolsByName.set(name, tool);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\t_baseToolDefinitions: base,\n\t\t_extensionRunner: { getAllRegisteredTools: () => [...extensionToolsByName.values()] },\n\t\t_customTools: [...(options.customTools ?? [])].filter((tool) => isAllowedTool(tool.name)),\n\t};\n}\n\nexport function isDomainRoutingEnabled(\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n\treturn env.OMK_DOMAIN_ROUTING === \"1\";\n}\n\nexport function tryDomainDispatch(input: DomainDispatchInput): DomainDispatchResult {\n\tif (!isDomainRoutingEnabled(input.env)) {\n\t\treturn noPolicy(false, [], undefined, undefined);\n\t}\n\n\tlet domainUsed: string | undefined;\n\tlet trace: CompositionTrace | undefined;\n\ttry {\n\t\tconst route = routeDomain({ task: input.initialPrompt });\n\t\tdomainUsed = route.primary.id;\n\t\tconst composeOptions: ComposeLoadoutOptions = {\n\t\t\tgrantAuthority: input.grantAuthority,\n\t\t\tscopeHints: input.scopeHints,\n\t\t\troleProfileOverride: input.roleProfileOverride,\n\t\t};\n\t\tconst profile = composeLoadout(input.role, route.primary, composeOptions);\n\t\ttrace = profile.composition;\n\t\tconst state = applyLoadoutToRuntime(input.session, input.resourceLoader, input.cwd, input.agentDir, {\n\t\t\tprofile,\n\t\t\trole: input.role,\n\t\t\tgrantAuthority: input.grantAuthority,\n\t\t\tassignedReadPaths: input.scopeHints?.readScope,\n\t\t\tassignedWritePaths: input.scopeHints?.writeScope,\n\t\t});\n\t\tconst policy = createPolicyOrThrow(state, profile.commands, input.cwd, input.blockedPaths);\n\t\tconst integrity = validatePolicyIntegrity(policy, state);\n\t\treturn {\n\t\t\tloadoutAccessPolicy: policy,\n\t\t\tdomainUsed,\n\t\t\tfallback: route.confidence === \"fallback\",\n\t\t\twarnings: uniqueSorted([\n\t\t\t\t...routeWarnings(route),\n\t\t\t\t...profile.composition.warnings,\n\t\t\t\t...state.warnings,\n\t\t\t\t...integrity.warnings,\n\t\t\t]),\n\t\t\ttrace,\n\t\t};\n\t} catch (error) {\n\t\treturn noPolicy(true, [errorMessage(error)], domainUsed, trace);\n\t}\n}\n\nfunction createPolicyOrThrow(\n\tstate: LoadoutRuntimeState,\n\tcommands: LoadoutProfile[\"commands\"],\n\tcwd: string,\n\tblockedPaths: readonly string[] | undefined,\n): LoadoutAccessPolicy {\n\treturn createLoadoutPolicyFromRuntimeState(state, {\n\t\tcwd,\n\t\tblockedPaths,\n\t\tcommands,\n\t});\n}\n\nfunction noPolicy(\n\tfallback: boolean,\n\twarnings: readonly string[],\n\tdomainUsed: string | undefined,\n\ttrace: CompositionTrace | undefined,\n): DomainDispatchResult {\n\treturn {\n\t\tloadoutAccessPolicy: undefined,\n\t\tdomainUsed,\n\t\tfallback,\n\t\twarnings: uniqueSorted(warnings),\n\t\ttrace,\n\t};\n}\n\nfunction routeWarnings(route: ReturnType<typeof routeDomain>): string[] {\n\tconst warnings: string[] = [];\n\tif (route.ambiguous) warnings.push(route.reason);\n\tif (route.confidence === \"fallback\") warnings.push(route.reason);\n\treturn warnings;\n}\n\nfunction errorMessage(error: unknown): string {\n\tif (error instanceof Error) return error.message;\n\treturn String(error);\n}\n\nfunction uniqueSorted(values: readonly string[]): string[] {\n\treturn [...new Set(values.map((value) => value.trim()).filter((value) => value !== \"\"))].sort((a, b) => {\n\t\tif (a < b) return -1;\n\t\tif (a > b) return 1;\n\t\treturn 0;\n\t});\n}\n"]}

package/dist/core/domain-dispatch.js

@@ -9,6 +9,11 @@ import { routeDomain } from "./domain-router.js";
 import { composeLoadout, } from "./loadout-compose.js";
 import { createLoadoutPolicyFromRuntimeState, validatePolicyIntegrity } from "./loadout-policy-bridge.js";
 import { applyLoadoutToRuntime } from "./loadout-runtime.js";
+/** Real loadout runtime entry points for provider-harness dispatch (`tryProviderHarnessDispatch`). */
+export const LOADOUT_HARNESS_RUNTIME = {
+    applyLoadoutToRuntime,
+    createLoadoutPolicyFromRuntimeState,
+};
 export function createDomainDispatchRuntimeSession(options) {
     const allowedToolNameSet = options.allowedToolNames ? new Set(options.allowedToolNames) : undefined;
     const excludedToolNameSet = options.excludedToolNames ? new Set(options.excludedToolNames) : undefined;

package/dist/core/domain-dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-dispatch.js","sourceRoot":"","sources":["../../src/core/domain-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EAGN,cAAc,GAEd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mCAAmC,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAwD,MAAM,sBAAsB,CAAC;AAkCnH,MAAM,UAAU,kCAAkC,CACjD,OAA4C,EACpB;IACxB,MAAM,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,MAAM,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAC/C,CAAC,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1F,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAA+B,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/D,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAClC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,oBAAoB,EAAE,IAAI;QAC1B,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,EAAE;QACrF,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACzF,CAAC;AAAA,CACF;AAED,MAAM,UAAU,sBAAsB,CACrC,GAAG,GAAqE,OAAO,CAAC,GAAG,EACzE;IACV,OAAO,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC;AAAA,CACtC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAA0B,EAAwB;IACnF,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,UAA8B,CAAC;IACnC,IAAI,KAAmC,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QACzD,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,cAAc,GAA0B;YAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC9C,CAAC;QACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC1E,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;QAC5B,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE;YACnG,OAAO;YACP,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS;YAC9C,kBAAkB,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU;SAChD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO;YACN,mBAAmB,EAAE,MAAM;YAC3B,UAAU;YACV,QAAQ,EAAE,KAAK,CAAC,UAAU,KAAK,UAAU;YACzC,QAAQ,EAAE,YAAY,CAAC;gBACtB,GAAG,aAAa,CAAC,KAAK,CAAC;gBACvB,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ;gBAC/B,GAAG,KAAK,CAAC,QAAQ;gBACjB,GAAG,SAAS,CAAC,QAAQ;aACrB,CAAC;YACF,KAAK;SACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;AAAA,CACD;AAED,SAAS,mBAAmB,CAC3B,KAA0B,EAC1B,QAAoC,EACpC,GAAW,EACX,YAA2C,EACrB;IACtB,OAAO,mCAAmC,CAAC,KAAK,EAAE;QACjD,GAAG;QACH,YAAY;QACZ,QAAQ;KACR,CAAC,CAAC;AAAA,CACH;AAED,SAAS,QAAQ,CAChB,QAAiB,EACjB,QAA2B,EAC3B,UAA8B,EAC9B,KAAmC,EACZ;IACvB,OAAO;QACN,mBAAmB,EAAE,SAAS;QAC9B,UAAU;QACV,QAAQ;QACR,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;QAChC,KAAK;KACL,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,KAAqC,EAAY;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,YAAY,CAAC,KAAc,EAAU;IAC7C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CACrB;AAED,SAAS,YAAY,CAAC,MAAyB,EAAY;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvG,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACpB,OAAO,CAAC,CAAC;IAAA,CACT,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Opt-in domain dispatch orchestration.\n *\n * Callers can invoke it to route an initial prompt, compose a role/domain\n * loadout, apply it to the current runtime inventory, and receive an access\n * policy suitable for existing AgentSession enforcement.\n */\n\nimport { routeDomain } from \"./domain-router.ts\";\nimport type { RegisteredTool, ToolDefinition } from \"./extensions/types.ts\";\nimport type { LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport {\n\ttype ComposeLoadoutOptions,\n\ttype CompositionTrace,\n\tcomposeLoadout,\n\ttype ScopeHints,\n} from \"./loadout-compose.ts\";\nimport { createLoadoutPolicyFromRuntimeState, validatePolicyIntegrity } from \"./loadout-policy-bridge.ts\";\nimport { applyLoadoutToRuntime, type LoadoutRuntimeSession, type LoadoutRuntimeState } from \"./loadout-runtime.ts\";\nimport type { LoadoutAuthority, LoadoutProfile, LoadoutRole } from \"./loadouts.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\n\nexport interface DomainDispatchInput {\n\treadonly role: LoadoutRole;\n\treadonly initialPrompt: string;\n\treadonly session: LoadoutRuntimeSession;\n\treadonly resourceLoader: ResourceLoader;\n\treadonly cwd: string;\n\treadonly agentDir: string;\n\treadonly grantAuthority?: LoadoutAuthority;\n\treadonly scopeHints?: ScopeHints;\n\treadonly env?: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>;\n\treadonly roleProfileOverride?: LoadoutProfile;\n\treadonly blockedPaths?: readonly string[];\n}\n\nexport interface DomainDispatchResult {\n\treadonly loadoutAccessPolicy: LoadoutAccessPolicy | undefined;\n\treadonly domainUsed: string | undefined;\n\treadonly fallback: boolean;\n\treadonly warnings: readonly string[];\n\treadonly trace: CompositionTrace | undefined;\n}\n\nexport interface DomainDispatchRuntimeSessionOptions {\n\treadonly baseToolNames: readonly string[];\n\treadonly resourceLoader: ResourceLoader;\n\treadonly customTools?: readonly ToolDefinition[];\n\treadonly allowedToolNames?: readonly string[];\n\treadonly excludedToolNames?: readonly string[];\n}\n\nexport function createDomainDispatchRuntimeSession(\n\toptions: DomainDispatchRuntimeSessionOptions,\n): LoadoutRuntimeSession {\n\tconst allowedToolNameSet = options.allowedToolNames ? new Set(options.allowedToolNames) : undefined;\n\tconst excludedToolNameSet = options.excludedToolNames ? new Set(options.excludedToolNames) : undefined;\n\tconst isAllowedTool = (name: string): boolean =>\n\t\t(!allowedToolNameSet || allowedToolNameSet.has(name)) && !excludedToolNameSet?.has(name);\n\n\tconst base = new Map<string, ToolDefinition>();\n\tfor (const name of uniqueSorted(options.baseToolNames).filter(isAllowedTool)) {\n\t\tbase.set(name, { name } as unknown as ToolDefinition);\n\t}\n\n\tconst extensionToolsByName = new Map<string, RegisteredTool>();\n\tfor (const extension of options.resourceLoader.getExtensions().extensions) {\n\t\tfor (const tool of extension.tools.values()) {\n\t\t\tconst name = tool.definition.name;\n\t\t\tif (isAllowedTool(name) && !extensionToolsByName.has(name)) {\n\t\t\t\textensionToolsByName.set(name, tool);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\t_baseToolDefinitions: base,\n\t\t_extensionRunner: { getAllRegisteredTools: () => [...extensionToolsByName.values()] },\n\t\t_customTools: [...(options.customTools ?? [])].filter((tool) => isAllowedTool(tool.name)),\n\t};\n}\n\nexport function isDomainRoutingEnabled(\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n\treturn env.OMK_DOMAIN_ROUTING === \"1\";\n}\n\nexport function tryDomainDispatch(input: DomainDispatchInput): DomainDispatchResult {\n\tif (!isDomainRoutingEnabled(input.env)) {\n\t\treturn noPolicy(false, [], undefined, undefined);\n\t}\n\n\tlet domainUsed: string | undefined;\n\tlet trace: CompositionTrace | undefined;\n\ttry {\n\t\tconst route = routeDomain({ task: input.initialPrompt });\n\t\tdomainUsed = route.primary.id;\n\t\tconst composeOptions: ComposeLoadoutOptions = {\n\t\t\tgrantAuthority: input.grantAuthority,\n\t\t\tscopeHints: input.scopeHints,\n\t\t\troleProfileOverride: input.roleProfileOverride,\n\t\t};\n\t\tconst profile = composeLoadout(input.role, route.primary, composeOptions);\n\t\ttrace = profile.composition;\n\t\tconst state = applyLoadoutToRuntime(input.session, input.resourceLoader, input.cwd, input.agentDir, {\n\t\t\tprofile,\n\t\t\trole: input.role,\n\t\t\tgrantAuthority: input.grantAuthority,\n\t\t\tassignedReadPaths: input.scopeHints?.readScope,\n\t\t\tassignedWritePaths: input.scopeHints?.writeScope,\n\t\t});\n\t\tconst policy = createPolicyOrThrow(state, profile.commands, input.cwd, input.blockedPaths);\n\t\tconst integrity = validatePolicyIntegrity(policy, state);\n\t\treturn {\n\t\t\tloadoutAccessPolicy: policy,\n\t\t\tdomainUsed,\n\t\t\tfallback: route.confidence === \"fallback\",\n\t\t\twarnings: uniqueSorted([\n\t\t\t\t...routeWarnings(route),\n\t\t\t\t...profile.composition.warnings,\n\t\t\t\t...state.warnings,\n\t\t\t\t...integrity.warnings,\n\t\t\t]),\n\t\t\ttrace,\n\t\t};\n\t} catch (error) {\n\t\treturn noPolicy(true, [errorMessage(error)], domainUsed, trace);\n\t}\n}\n\nfunction createPolicyOrThrow(\n\tstate: LoadoutRuntimeState,\n\tcommands: LoadoutProfile[\"commands\"],\n\tcwd: string,\n\tblockedPaths: readonly string[] | undefined,\n): LoadoutAccessPolicy {\n\treturn createLoadoutPolicyFromRuntimeState(state, {\n\t\tcwd,\n\t\tblockedPaths,\n\t\tcommands,\n\t});\n}\n\nfunction noPolicy(\n\tfallback: boolean,\n\twarnings: readonly string[],\n\tdomainUsed: string | undefined,\n\ttrace: CompositionTrace | undefined,\n): DomainDispatchResult {\n\treturn {\n\t\tloadoutAccessPolicy: undefined,\n\t\tdomainUsed,\n\t\tfallback,\n\t\twarnings: uniqueSorted(warnings),\n\t\ttrace,\n\t};\n}\n\nfunction routeWarnings(route: ReturnType<typeof routeDomain>): string[] {\n\tconst warnings: string[] = [];\n\tif (route.ambiguous) warnings.push(route.reason);\n\tif (route.confidence === \"fallback\") warnings.push(route.reason);\n\treturn warnings;\n}\n\nfunction errorMessage(error: unknown): string {\n\tif (error instanceof Error) return error.message;\n\treturn String(error);\n}\n\nfunction uniqueSorted(values: readonly string[]): string[] {\n\treturn [...new Set(values.map((value) => value.trim()).filter((value) => value !== \"\"))].sort((a, b) => {\n\t\tif (a < b) return -1;\n\t\tif (a > b) return 1;\n\t\treturn 0;\n\t});\n}\n"]}
+{"version":3,"file":"domain-dispatch.js","sourceRoot":"","sources":["../../src/core/domain-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,OAAO,EAGN,cAAc,GAEd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mCAAmC,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAwD,MAAM,sBAAsB,CAAC;AAKnH,sGAAsG;AACtG,MAAM,CAAC,MAAM,uBAAuB,GAIhC;IACH,qBAAqB;IACrB,mCAAmC;CACnC,CAAC;AAgCF,MAAM,UAAU,kCAAkC,CACjD,OAA4C,EACpB;IACxB,MAAM,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,MAAM,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAC/C,CAAC,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAE1F,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAA+B,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/D,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAClC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,oBAAoB,EAAE,IAAI;QAC1B,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,EAAE;QACrF,YAAY,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACzF,CAAC;AAAA,CACF;AAED,MAAM,UAAU,sBAAsB,CACrC,GAAG,GAAqE,OAAO,CAAC,GAAG,EACzE;IACV,OAAO,GAAG,CAAC,kBAAkB,KAAK,GAAG,CAAC;AAAA,CACtC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAA0B,EAAwB;IACnF,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,UAA8B,CAAC;IACnC,IAAI,KAAmC,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QACzD,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,cAAc,GAA0B;YAC7C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC9C,CAAC;QACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC1E,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;QAC5B,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE;YACnG,OAAO;YACP,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS;YAC9C,kBAAkB,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU;SAChD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3F,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO;YACN,mBAAmB,EAAE,MAAM;YAC3B,UAAU;YACV,QAAQ,EAAE,KAAK,CAAC,UAAU,KAAK,UAAU;YACzC,QAAQ,EAAE,YAAY,CAAC;gBACtB,GAAG,aAAa,CAAC,KAAK,CAAC;gBACvB,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ;gBAC/B,GAAG,KAAK,CAAC,QAAQ;gBACjB,GAAG,SAAS,CAAC,QAAQ;aACrB,CAAC;YACF,KAAK;SACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;AAAA,CACD;AAED,SAAS,mBAAmB,CAC3B,KAA0B,EAC1B,QAAoC,EACpC,GAAW,EACX,YAA2C,EACrB;IACtB,OAAO,mCAAmC,CAAC,KAAK,EAAE;QACjD,GAAG;QACH,YAAY;QACZ,QAAQ;KACR,CAAC,CAAC;AAAA,CACH;AAED,SAAS,QAAQ,CAChB,QAAiB,EACjB,QAA2B,EAC3B,UAA8B,EAC9B,KAAmC,EACZ;IACvB,OAAO;QACN,mBAAmB,EAAE,SAAS;QAC9B,UAAU;QACV,QAAQ;QACR,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;QAChC,KAAK;KACL,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,KAAqC,EAAY;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,SAAS,YAAY,CAAC,KAAc,EAAU;IAC7C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CACrB;AAED,SAAS,YAAY,CAAC,MAAyB,EAAY;IAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvG,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC;QACpB,OAAO,CAAC,CAAC;IAAA,CACT,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Opt-in domain dispatch orchestration.\n *\n * Callers can invoke it to route an initial prompt, compose a role/domain\n * loadout, apply it to the current runtime inventory, and receive an access\n * policy suitable for existing AgentSession enforcement.\n */\n\nimport { routeDomain } from \"./domain-router.ts\";\nimport type { RegisteredTool, ToolDefinition } from \"./extensions/types.ts\";\nimport type { LoadoutAccessPolicy } from \"./loadout-access-policy.ts\";\nimport {\n\ttype ComposeLoadoutOptions,\n\ttype CompositionTrace,\n\tcomposeLoadout,\n\ttype ScopeHints,\n} from \"./loadout-compose.ts\";\nimport { createLoadoutPolicyFromRuntimeState, validatePolicyIntegrity } from \"./loadout-policy-bridge.ts\";\nimport { applyLoadoutToRuntime, type LoadoutRuntimeSession, type LoadoutRuntimeState } from \"./loadout-runtime.ts\";\nimport type { LoadoutAuthority, LoadoutProfile, LoadoutRole } from \"./loadouts.ts\";\nimport type { ProviderHarnessRuntime } from \"./provider-harness-dispatch.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\n\n/** Real loadout runtime entry points for provider-harness dispatch (`tryProviderHarnessDispatch`). */\nexport const LOADOUT_HARNESS_RUNTIME: ProviderHarnessRuntime<\n\tLoadoutRuntimeSession,\n\tResourceLoader,\n\tLoadoutRuntimeState\n> = {\n\tapplyLoadoutToRuntime,\n\tcreateLoadoutPolicyFromRuntimeState,\n};\n\nexport interface DomainDispatchInput {\n\treadonly role: LoadoutRole;\n\treadonly initialPrompt: string;\n\treadonly session: LoadoutRuntimeSession;\n\treadonly resourceLoader: ResourceLoader;\n\treadonly cwd: string;\n\treadonly agentDir: string;\n\treadonly grantAuthority?: LoadoutAuthority;\n\treadonly scopeHints?: ScopeHints;\n\treadonly env?: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>;\n\treadonly roleProfileOverride?: LoadoutProfile;\n\treadonly blockedPaths?: readonly string[];\n}\n\nexport interface DomainDispatchResult {\n\treadonly loadoutAccessPolicy: LoadoutAccessPolicy | undefined;\n\treadonly domainUsed: string | undefined;\n\treadonly fallback: boolean;\n\treadonly warnings: readonly string[];\n\treadonly trace: CompositionTrace | undefined;\n}\n\nexport interface DomainDispatchRuntimeSessionOptions {\n\treadonly baseToolNames: readonly string[];\n\treadonly resourceLoader: ResourceLoader;\n\treadonly customTools?: readonly ToolDefinition[];\n\treadonly allowedToolNames?: readonly string[];\n\treadonly excludedToolNames?: readonly string[];\n}\n\nexport function createDomainDispatchRuntimeSession(\n\toptions: DomainDispatchRuntimeSessionOptions,\n): LoadoutRuntimeSession {\n\tconst allowedToolNameSet = options.allowedToolNames ? new Set(options.allowedToolNames) : undefined;\n\tconst excludedToolNameSet = options.excludedToolNames ? new Set(options.excludedToolNames) : undefined;\n\tconst isAllowedTool = (name: string): boolean =>\n\t\t(!allowedToolNameSet || allowedToolNameSet.has(name)) && !excludedToolNameSet?.has(name);\n\n\tconst base = new Map<string, ToolDefinition>();\n\tfor (const name of uniqueSorted(options.baseToolNames).filter(isAllowedTool)) {\n\t\tbase.set(name, { name } as unknown as ToolDefinition);\n\t}\n\n\tconst extensionToolsByName = new Map<string, RegisteredTool>();\n\tfor (const extension of options.resourceLoader.getExtensions().extensions) {\n\t\tfor (const tool of extension.tools.values()) {\n\t\t\tconst name = tool.definition.name;\n\t\t\tif (isAllowedTool(name) && !extensionToolsByName.has(name)) {\n\t\t\t\textensionToolsByName.set(name, tool);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\t_baseToolDefinitions: base,\n\t\t_extensionRunner: { getAllRegisteredTools: () => [...extensionToolsByName.values()] },\n\t\t_customTools: [...(options.customTools ?? [])].filter((tool) => isAllowedTool(tool.name)),\n\t};\n}\n\nexport function isDomainRoutingEnabled(\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n\treturn env.OMK_DOMAIN_ROUTING === \"1\";\n}\n\nexport function tryDomainDispatch(input: DomainDispatchInput): DomainDispatchResult {\n\tif (!isDomainRoutingEnabled(input.env)) {\n\t\treturn noPolicy(false, [], undefined, undefined);\n\t}\n\n\tlet domainUsed: string | undefined;\n\tlet trace: CompositionTrace | undefined;\n\ttry {\n\t\tconst route = routeDomain({ task: input.initialPrompt });\n\t\tdomainUsed = route.primary.id;\n\t\tconst composeOptions: ComposeLoadoutOptions = {\n\t\t\tgrantAuthority: input.grantAuthority,\n\t\t\tscopeHints: input.scopeHints,\n\t\t\troleProfileOverride: input.roleProfileOverride,\n\t\t};\n\t\tconst profile = composeLoadout(input.role, route.primary, composeOptions);\n\t\ttrace = profile.composition;\n\t\tconst state = applyLoadoutToRuntime(input.session, input.resourceLoader, input.cwd, input.agentDir, {\n\t\t\tprofile,\n\t\t\trole: input.role,\n\t\t\tgrantAuthority: input.grantAuthority,\n\t\t\tassignedReadPaths: input.scopeHints?.readScope,\n\t\t\tassignedWritePaths: input.scopeHints?.writeScope,\n\t\t});\n\t\tconst policy = createPolicyOrThrow(state, profile.commands, input.cwd, input.blockedPaths);\n\t\tconst integrity = validatePolicyIntegrity(policy, state);\n\t\treturn {\n\t\t\tloadoutAccessPolicy: policy,\n\t\t\tdomainUsed,\n\t\t\tfallback: route.confidence === \"fallback\",\n\t\t\twarnings: uniqueSorted([\n\t\t\t\t...routeWarnings(route),\n\t\t\t\t...profile.composition.warnings,\n\t\t\t\t...state.warnings,\n\t\t\t\t...integrity.warnings,\n\t\t\t]),\n\t\t\ttrace,\n\t\t};\n\t} catch (error) {\n\t\treturn noPolicy(true, [errorMessage(error)], domainUsed, trace);\n\t}\n}\n\nfunction createPolicyOrThrow(\n\tstate: LoadoutRuntimeState,\n\tcommands: LoadoutProfile[\"commands\"],\n\tcwd: string,\n\tblockedPaths: readonly string[] | undefined,\n): LoadoutAccessPolicy {\n\treturn createLoadoutPolicyFromRuntimeState(state, {\n\t\tcwd,\n\t\tblockedPaths,\n\t\tcommands,\n\t});\n}\n\nfunction noPolicy(\n\tfallback: boolean,\n\twarnings: readonly string[],\n\tdomainUsed: string | undefined,\n\ttrace: CompositionTrace | undefined,\n): DomainDispatchResult {\n\treturn {\n\t\tloadoutAccessPolicy: undefined,\n\t\tdomainUsed,\n\t\tfallback,\n\t\twarnings: uniqueSorted(warnings),\n\t\ttrace,\n\t};\n}\n\nfunction routeWarnings(route: ReturnType<typeof routeDomain>): string[] {\n\tconst warnings: string[] = [];\n\tif (route.ambiguous) warnings.push(route.reason);\n\tif (route.confidence === \"fallback\") warnings.push(route.reason);\n\treturn warnings;\n}\n\nfunction errorMessage(error: unknown): string {\n\tif (error instanceof Error) return error.message;\n\treturn String(error);\n}\n\nfunction uniqueSorted(values: readonly string[]): string[] {\n\treturn [...new Set(values.map((value) => value.trim()).filter((value) => value !== \"\"))].sort((a, b) => {\n\t\tif (a < b) return -1;\n\t\tif (a > b) return 1;\n\t\treturn 0;\n\t});\n}\n"]}

package/dist/core/domain-loadouts-provider-harness.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Provider-harness domain profiles: `grok-harness` (native `xai`) and
+ * `devin-harness` (Devin SWE-2). They are registered in `DOMAIN_PROFILES`
+ * by `domain-loadouts.ts` and auto-applied by the provider harness dispatch
+ * without requiring `OMK_DOMAIN_ROUTING=1`.
+ *
+ * I/O-free and side-effect-free; erasable TypeScript only.
+ */
+import type { DomainProfile } from "./domain-profile.ts";
+export declare const GROK_HARNESS_PROFILE: DomainProfile;
+export declare const DEVIN_HARNESS_PROFILE: DomainProfile;
+//# sourceMappingURL=domain-loadouts-provider-harness.d.ts.map

package/dist/core/domain-loadouts-provider-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-loadouts-provider-harness.d.ts","sourceRoot":"","sources":["../../src/core/domain-loadouts-provider-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAazD,eAAO,MAAM,oBAAoB,EAAE,aAuDlC,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,aAiDnC,CAAC","sourcesContent":["/**\n * Provider-harness domain profiles: `grok-harness` (native `xai`) and\n * `devin-harness` (Devin SWE-2). They are registered in `DOMAIN_PROFILES`\n * by `domain-loadouts.ts` and auto-applied by the provider harness dispatch\n * without requiring `OMK_DOMAIN_ROUTING=1`.\n *\n * I/O-free and side-effect-free; erasable TypeScript only.\n */\n\nimport type { DomainProfile } from \"./domain-profile.ts\";\nimport type { CapabilityGate, LoadoutCommands, ToolGate } from \"./loadouts.ts\";\n\nconst WRITE_TOOLS: ToolGate = { allow: [\"read\", \"grep\", \"find\", \"ls\", \"edit\", \"write\", \"bash\"] };\n\nfunction gate(kind: \"skill\" | \"mcp\" | \"hook\", names: readonly string[]): CapabilityGate {\n\treturn { allow: [{ kind, names }] };\n}\n\nfunction commands(mode: LoadoutCommands[\"mode\"]): LoadoutCommands {\n\treturn { mode };\n}\n\nexport const GROK_HARNESS_PROFILE: DomainProfile = {\n\tschemaVersion: \"omk.loadout.v1\",\n\tid: \"grok-harness\",\n\tname: \"grok-harness\",\n\tlabel: \"Grok xAI Harness\",\n\tauthority: \"write-scoped\",\n\ttools: WRITE_TOOLS,\n\tskills: gate(\"skill\", [\n\t\t\"packages\",\n\t\t\"headroom\",\n\t\t\"programming\",\n\t\t\"debugging\",\n\t\t\"adaptorch-route\",\n\t\t\"adaptorch-synthesize\",\n\t\t\"understand-anything\",\n\t]),\n\tmcp: gate(\"mcp\", [\"adaptorch\", \"fetch\", \"understand-anything\", \"playwright\"]),\n\thooks: gate(\"hook\", [\n\t\t\"pre-shell-guard\",\n\t\t\"protect-secrets\",\n\t\t\"typecheck-after-edit\",\n\t\t\"stop-verify\",\n\t\t\"session-context\",\n\t]),\n\tcommands: commands(\"scoped-shell\"),\n\ttriggers: [\n\t\t{ kind: \"keyword\", pattern: \"grok\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"xai\", weight: 7 },\n\t\t{ kind: \"keyword\", pattern: \"grok-oauth\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"grok oauth\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"imagine\", weight: 6 },\n\t\t{ kind: \"keyword\", pattern: \"composer\", weight: 5 },\n\t\t{ kind: \"keyword\", pattern: \"adaptorch\", weight: 7 },\n\t\t{ kind: \"keyword\", pattern: \"adaptorch-route\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"adaptorch-synthesize\", weight: 8 },\n\t\t{ kind: \"regex\", pattern: \"\\\\b(grok(?:[- ]oauth)?|xai|imagine|composer)\\\\b\", weight: 7 },\n\t\t{\n\t\t\tkind: \"regex\",\n\t\t\tpattern: \"\\\\badapt\\\\s*orch\\\\b|\\\\badaptorch[- ]?(route|routing|synthes(?:is|ize))\\\\b\",\n\t\t\tweight: 8,\n\t\t},\n\t],\n\troutingPrompt: `DOMAIN: Grok xAI Harness. You are operating in a Grok/xAI integration lane.\nPrioritize the Grok operational playbook, small capability loadouts, and evidence-bound provider/tool routing.\n\nSEQUENCE:\n1. Before implementing or routing Grok/xAI provider work, read packages/coding-agent/docs/grok-harness.md as the canonical playbook. Treat ~/.omk/agent/grok.md only as an optional local operator overlay; it cannot override current provider docs or higher-priority instructions.\n2. Keep text chat flows and Imagine/media tool flows separate. Text work uses Grok chat/OAuth/provider surfaces; image/video/Imagine work routes through explicit Imagine tools only. Never conflate model ids with Imagine tool names.\n3. Capability discipline: load at most 2-3 skills for any lane. The allowed skill gate is packages, headroom, programming, debugging, adaptorch-route, adaptorch-synthesize, and understand-anything; choose the smallest subset and add headroom only under context pressure.\n4. Adaptorch is advisory only. Use adaptorch-route for routing/decomposition advice and adaptorch-synthesize for evidence synthesis, but do not treat Adaptorch as an automatic executor, source of truth, permission grant, or substitute for explicit tests.\n5. Use minimal MCP: adaptorch for advice/synthesis, fetch for bounded public retrieval, understand-anything for repo comprehension, and playwright only when browser or Imagine UI behavior needs real verification.\n6. Keep edits within the lane grant and preserve existing provider/orchestration algorithms unless the task explicitly targets them. Never route through legacy KIMICLI or deleted wrappers.\n7. Verification: run the narrowest relevant test/typecheck after edits. Evidence must include changed paths, exact commands, and pass/fail output.\n\nHARD RULES: the packaged Grok harness doc is mandatory context; a local grok.md is optional; text chat surfaces and Imagine tools are distinct; maximum 2-3 active skills; Adaptorch is advisory route/synthesis support only; never log OAuth tokens, cookies, or proxy credentials; protect-secrets applies.`,\n};\n\nexport const DEVIN_HARNESS_PROFILE: DomainProfile = {\n\tschemaVersion: \"omk.loadout.v1\",\n\tid: \"devin-harness\",\n\tname: \"devin-harness\",\n\tlabel: \"Devin SWE-2 Harness\",\n\tauthority: \"write-scoped\",\n\ttools: WRITE_TOOLS,\n\tskills: gate(\"skill\", [\n\t\t\"packages\",\n\t\t\"headroom\",\n\t\t\"programming\",\n\t\t\"debugging\",\n\t\t\"tdd-workflow\",\n\t\t\"lsp\",\n\t\t\"ast-grep\",\n\t\t\"understand-anything\",\n\t]),\n\tmcp: gate(\"mcp\", [\"fetch\", \"context7\", \"understand-anything\", \"playwright\"]),\n\thooks: gate(\"hook\", [\n\t\t\"pre-shell-guard\",\n\t\t\"protect-secrets\",\n\t\t\"typecheck-after-edit\",\n\t\t\"stop-verify\",\n\t\t\"session-context\",\n\t\t\"precompact-checkpoint\",\n\t]),\n\tcommands: commands(\"scoped-shell\"),\n\ttriggers: [\n\t\t{ kind: \"keyword\", pattern: \"devin\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"swe-2\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"swe2\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"cognition\", weight: 6 },\n\t\t{ kind: \"keyword\", pattern: \"devin cli\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"1m context\", weight: 5 },\n\t\t{ kind: \"regex\", pattern: \"\\\\b(devin|swe[- ]?2|cognition)\\\\b\", weight: 7 },\n\t],\n\troutingPrompt: `DOMAIN: Devin SWE-2 Harness. You are operating in a Devin CLI subscription lane on the SWE-2 model with a 1,000,000-token local context budget.\nPrioritize the SWE-2 operational playbook, focused exploration, small capability loadouts, and evidence-bound verification.\n\nSEQUENCE:\n1. Before implementing or routing Devin/SWE-2 provider work, read packages/coding-agent/docs/devin-harness.md as the canonical playbook. Treat ~/.omk/agent/devin.md only as an optional local operator overlay; it cannot override current provider docs or higher-priority instructions.\n2. Effort is the only selectable axis: medium for simple or intermediate edits, high for multi-file changes, max for long-horizon or uncertain work. Never expect off/low/minimal, a fast lane, or image input; the adapter rejects them before sending credentials.\n3. Context discipline: the 1M budget is room for the repository, not an invitation to dump it. Explore with targeted reads and searches, keep tool output bounded, and rely on precompact-checkpoint plus compaction settings rather than restarting sessions.\n4. Capability discipline: load at most 2-3 skills for any lane. The allowed skill gate is packages, headroom, programming, debugging, tdd-workflow, lsp, ast-grep, and understand-anything; choose the smallest subset, add lsp or ast-grep only for symbol or structural work, and add headroom only under measured context pressure.\n5. Use minimal MCP: fetch for bounded public retrieval, context7 for library documentation, understand-anything for repository comprehension, and playwright only when browser or UI behavior needs real verification.\n6. Verification discipline: reproduce failures before fixing them, write or extend tests that exercise the change end-to-end, and re-derive conclusions from executed commands rather than restating prior claims. Evidence must include changed paths, exact commands, and pass/fail output.\n7. Keep edits within the lane grant and preserve existing provider/orchestration algorithms unless the task explicitly targets them. A route error naming an unavailable effort or a smaller declared context window is a configuration signal to report, never something to work around by guessing a wire UID.\n\nHARD RULES: the packaged Devin harness doc is mandatory context; a local devin.md is optional; medium/high/max are the only efforts; the 1M budget never justifies unbounded dumps; maximum 2-3 active skills; never log the Devin session token, user JWT, or auth.json contents; protect-secrets applies.`,\n};\n"]}

package/dist/core/domain-loadouts-provider-harness.js

@@ -0,0 +1,122 @@
+/**
+ * Provider-harness domain profiles: `grok-harness` (native `xai`) and
+ * `devin-harness` (Devin SWE-2). They are registered in `DOMAIN_PROFILES`
+ * by `domain-loadouts.ts` and auto-applied by the provider harness dispatch
+ * without requiring `OMK_DOMAIN_ROUTING=1`.
+ *
+ * I/O-free and side-effect-free; erasable TypeScript only.
+ */
+const WRITE_TOOLS = { allow: ["read", "grep", "find", "ls", "edit", "write", "bash"] };
+function gate(kind, names) {
+    return { allow: [{ kind, names }] };
+}
+function commands(mode) {
+    return { mode };
+}
+export const GROK_HARNESS_PROFILE = {
+    schemaVersion: "omk.loadout.v1",
+    id: "grok-harness",
+    name: "grok-harness",
+    label: "Grok xAI Harness",
+    authority: "write-scoped",
+    tools: WRITE_TOOLS,
+    skills: gate("skill", [
+        "packages",
+        "headroom",
+        "programming",
+        "debugging",
+        "adaptorch-route",
+        "adaptorch-synthesize",
+        "understand-anything",
+    ]),
+    mcp: gate("mcp", ["adaptorch", "fetch", "understand-anything", "playwright"]),
+    hooks: gate("hook", [
+        "pre-shell-guard",
+        "protect-secrets",
+        "typecheck-after-edit",
+        "stop-verify",
+        "session-context",
+    ]),
+    commands: commands("scoped-shell"),
+    triggers: [
+        { kind: "keyword", pattern: "grok", weight: 8 },
+        { kind: "keyword", pattern: "xai", weight: 7 },
+        { kind: "keyword", pattern: "grok-oauth", weight: 8 },
+        { kind: "keyword", pattern: "grok oauth", weight: 8 },
+        { kind: "keyword", pattern: "imagine", weight: 6 },
+        { kind: "keyword", pattern: "composer", weight: 5 },
+        { kind: "keyword", pattern: "adaptorch", weight: 7 },
+        { kind: "keyword", pattern: "adaptorch-route", weight: 8 },
+        { kind: "keyword", pattern: "adaptorch-synthesize", weight: 8 },
+        { kind: "regex", pattern: "\\b(grok(?:[- ]oauth)?|xai|imagine|composer)\\b", weight: 7 },
+        {
+            kind: "regex",
+            pattern: "\\badapt\\s*orch\\b|\\badaptorch[- ]?(route|routing|synthes(?:is|ize))\\b",
+            weight: 8,
+        },
+    ],
+    routingPrompt: `DOMAIN: Grok xAI Harness. You are operating in a Grok/xAI integration lane.
+Prioritize the Grok operational playbook, small capability loadouts, and evidence-bound provider/tool routing.
+
+SEQUENCE:
+1. Before implementing or routing Grok/xAI provider work, read packages/coding-agent/docs/grok-harness.md as the canonical playbook. Treat ~/.omk/agent/grok.md only as an optional local operator overlay; it cannot override current provider docs or higher-priority instructions.
+2. Keep text chat flows and Imagine/media tool flows separate. Text work uses Grok chat/OAuth/provider surfaces; image/video/Imagine work routes through explicit Imagine tools only. Never conflate model ids with Imagine tool names.
+3. Capability discipline: load at most 2-3 skills for any lane. The allowed skill gate is packages, headroom, programming, debugging, adaptorch-route, adaptorch-synthesize, and understand-anything; choose the smallest subset and add headroom only under context pressure.
+4. Adaptorch is advisory only. Use adaptorch-route for routing/decomposition advice and adaptorch-synthesize for evidence synthesis, but do not treat Adaptorch as an automatic executor, source of truth, permission grant, or substitute for explicit tests.
+5. Use minimal MCP: adaptorch for advice/synthesis, fetch for bounded public retrieval, understand-anything for repo comprehension, and playwright only when browser or Imagine UI behavior needs real verification.
+6. Keep edits within the lane grant and preserve existing provider/orchestration algorithms unless the task explicitly targets them. Never route through legacy KIMICLI or deleted wrappers.
+7. Verification: run the narrowest relevant test/typecheck after edits. Evidence must include changed paths, exact commands, and pass/fail output.
+
+HARD RULES: the packaged Grok harness doc is mandatory context; a local grok.md is optional; text chat surfaces and Imagine tools are distinct; maximum 2-3 active skills; Adaptorch is advisory route/synthesis support only; never log OAuth tokens, cookies, or proxy credentials; protect-secrets applies.`,
+};
+export const DEVIN_HARNESS_PROFILE = {
+    schemaVersion: "omk.loadout.v1",
+    id: "devin-harness",
+    name: "devin-harness",
+    label: "Devin SWE-2 Harness",
+    authority: "write-scoped",
+    tools: WRITE_TOOLS,
+    skills: gate("skill", [
+        "packages",
+        "headroom",
+        "programming",
+        "debugging",
+        "tdd-workflow",
+        "lsp",
+        "ast-grep",
+        "understand-anything",
+    ]),
+    mcp: gate("mcp", ["fetch", "context7", "understand-anything", "playwright"]),
+    hooks: gate("hook", [
+        "pre-shell-guard",
+        "protect-secrets",
+        "typecheck-after-edit",
+        "stop-verify",
+        "session-context",
+        "precompact-checkpoint",
+    ]),
+    commands: commands("scoped-shell"),
+    triggers: [
+        { kind: "keyword", pattern: "devin", weight: 8 },
+        { kind: "keyword", pattern: "swe-2", weight: 8 },
+        { kind: "keyword", pattern: "swe2", weight: 8 },
+        { kind: "keyword", pattern: "cognition", weight: 6 },
+        { kind: "keyword", pattern: "devin cli", weight: 8 },
+        { kind: "keyword", pattern: "1m context", weight: 5 },
+        { kind: "regex", pattern: "\\b(devin|swe[- ]?2|cognition)\\b", weight: 7 },
+    ],
+    routingPrompt: `DOMAIN: Devin SWE-2 Harness. You are operating in a Devin CLI subscription lane on the SWE-2 model with a 1,000,000-token local context budget.
+Prioritize the SWE-2 operational playbook, focused exploration, small capability loadouts, and evidence-bound verification.
+
+SEQUENCE:
+1. Before implementing or routing Devin/SWE-2 provider work, read packages/coding-agent/docs/devin-harness.md as the canonical playbook. Treat ~/.omk/agent/devin.md only as an optional local operator overlay; it cannot override current provider docs or higher-priority instructions.
+2. Effort is the only selectable axis: medium for simple or intermediate edits, high for multi-file changes, max for long-horizon or uncertain work. Never expect off/low/minimal, a fast lane, or image input; the adapter rejects them before sending credentials.
+3. Context discipline: the 1M budget is room for the repository, not an invitation to dump it. Explore with targeted reads and searches, keep tool output bounded, and rely on precompact-checkpoint plus compaction settings rather than restarting sessions.
+4. Capability discipline: load at most 2-3 skills for any lane. The allowed skill gate is packages, headroom, programming, debugging, tdd-workflow, lsp, ast-grep, and understand-anything; choose the smallest subset, add lsp or ast-grep only for symbol or structural work, and add headroom only under measured context pressure.
+5. Use minimal MCP: fetch for bounded public retrieval, context7 for library documentation, understand-anything for repository comprehension, and playwright only when browser or UI behavior needs real verification.
+6. Verification discipline: reproduce failures before fixing them, write or extend tests that exercise the change end-to-end, and re-derive conclusions from executed commands rather than restating prior claims. Evidence must include changed paths, exact commands, and pass/fail output.
+7. Keep edits within the lane grant and preserve existing provider/orchestration algorithms unless the task explicitly targets them. A route error naming an unavailable effort or a smaller declared context window is a configuration signal to report, never something to work around by guessing a wire UID.
+
+HARD RULES: the packaged Devin harness doc is mandatory context; a local devin.md is optional; medium/high/max are the only efforts; the 1M budget never justifies unbounded dumps; maximum 2-3 active skills; never log the Devin session token, user JWT, or auth.json contents; protect-secrets applies.`,
+};
+//# sourceMappingURL=domain-loadouts-provider-harness.js.map

package/dist/core/domain-loadouts-provider-harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-loadouts-provider-harness.js","sourceRoot":"","sources":["../../src/core/domain-loadouts-provider-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,GAAa,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;AAEjG,SAAS,IAAI,CAAC,IAA8B,EAAE,KAAwB,EAAkB;IACvF,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAAA,CACpC;AAED,SAAS,QAAQ,CAAC,IAA6B,EAAmB;IACjE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA,CAChB;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAkB;IAClD,aAAa,EAAE,gBAAgB;IAC/B,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,cAAc;IACzB,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;QACrB,UAAU;QACV,UAAU;QACV,aAAa;QACb,WAAW;QACX,iBAAiB;QACjB,sBAAsB;QACtB,qBAAqB;KACrB,CAAC;IACF,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAAC;IAC7E,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;QACnB,iBAAiB;QACjB,iBAAiB;QACjB,sBAAsB;QACtB,aAAa;QACb,iBAAiB;KACjB,CAAC;IACF,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE;QACT,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE;QAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE;QAC9C,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE;QACrD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE;QACrD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE;QAClD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE;QACnD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE;QACpD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,EAAE;QAC1D,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,EAAE;QAC/D,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iDAAiD,EAAE,MAAM,EAAE,CAAC,EAAE;QACxF;YACC,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,2EAA2E;YACpF,MAAM,EAAE,CAAC;SACT;KACD;IACD,aAAa,EAAE;;;;;;;;;;;;+SAY+R;CAC9S,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAkB;IACnD,aAAa,EAAE,gBAAgB;IAC/B,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,qBAAqB;IAC5B,SAAS,EAAE,cAAc;IACzB,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE;QACrB,UAAU;QACV,UAAU;QACV,aAAa;QACb,WAAW;QACX,cAAc;QACd,KAAK;QACL,UAAU;QACV,qBAAqB;KACrB,CAAC;IACF,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAAC;IAC5E,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;QACnB,iBAAiB;QACjB,iBAAiB;QACjB,sBAAsB;QACtB,aAAa;QACb,iBAAiB;QACjB,uBAAuB;KACvB,CAAC;IACF,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE;QACT,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;QAChD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;QAChD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE;QAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE;QACpD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE;QACpD,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,EAAE;QACrD,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,CAAC,EAAE;KAC1E;IACD,aAAa,EAAE;;;;;;;;;;;;4SAY4R;CAC3S,CAAC","sourcesContent":["/**\n * Provider-harness domain profiles: `grok-harness` (native `xai`) and\n * `devin-harness` (Devin SWE-2). They are registered in `DOMAIN_PROFILES`\n * by `domain-loadouts.ts` and auto-applied by the provider harness dispatch\n * without requiring `OMK_DOMAIN_ROUTING=1`.\n *\n * I/O-free and side-effect-free; erasable TypeScript only.\n */\n\nimport type { DomainProfile } from \"./domain-profile.ts\";\nimport type { CapabilityGate, LoadoutCommands, ToolGate } from \"./loadouts.ts\";\n\nconst WRITE_TOOLS: ToolGate = { allow: [\"read\", \"grep\", \"find\", \"ls\", \"edit\", \"write\", \"bash\"] };\n\nfunction gate(kind: \"skill\" | \"mcp\" | \"hook\", names: readonly string[]): CapabilityGate {\n\treturn { allow: [{ kind, names }] };\n}\n\nfunction commands(mode: LoadoutCommands[\"mode\"]): LoadoutCommands {\n\treturn { mode };\n}\n\nexport const GROK_HARNESS_PROFILE: DomainProfile = {\n\tschemaVersion: \"omk.loadout.v1\",\n\tid: \"grok-harness\",\n\tname: \"grok-harness\",\n\tlabel: \"Grok xAI Harness\",\n\tauthority: \"write-scoped\",\n\ttools: WRITE_TOOLS,\n\tskills: gate(\"skill\", [\n\t\t\"packages\",\n\t\t\"headroom\",\n\t\t\"programming\",\n\t\t\"debugging\",\n\t\t\"adaptorch-route\",\n\t\t\"adaptorch-synthesize\",\n\t\t\"understand-anything\",\n\t]),\n\tmcp: gate(\"mcp\", [\"adaptorch\", \"fetch\", \"understand-anything\", \"playwright\"]),\n\thooks: gate(\"hook\", [\n\t\t\"pre-shell-guard\",\n\t\t\"protect-secrets\",\n\t\t\"typecheck-after-edit\",\n\t\t\"stop-verify\",\n\t\t\"session-context\",\n\t]),\n\tcommands: commands(\"scoped-shell\"),\n\ttriggers: [\n\t\t{ kind: \"keyword\", pattern: \"grok\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"xai\", weight: 7 },\n\t\t{ kind: \"keyword\", pattern: \"grok-oauth\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"grok oauth\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"imagine\", weight: 6 },\n\t\t{ kind: \"keyword\", pattern: \"composer\", weight: 5 },\n\t\t{ kind: \"keyword\", pattern: \"adaptorch\", weight: 7 },\n\t\t{ kind: \"keyword\", pattern: \"adaptorch-route\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"adaptorch-synthesize\", weight: 8 },\n\t\t{ kind: \"regex\", pattern: \"\\\\b(grok(?:[- ]oauth)?|xai|imagine|composer)\\\\b\", weight: 7 },\n\t\t{\n\t\t\tkind: \"regex\",\n\t\t\tpattern: \"\\\\badapt\\\\s*orch\\\\b|\\\\badaptorch[- ]?(route|routing|synthes(?:is|ize))\\\\b\",\n\t\t\tweight: 8,\n\t\t},\n\t],\n\troutingPrompt: `DOMAIN: Grok xAI Harness. You are operating in a Grok/xAI integration lane.\nPrioritize the Grok operational playbook, small capability loadouts, and evidence-bound provider/tool routing.\n\nSEQUENCE:\n1. Before implementing or routing Grok/xAI provider work, read packages/coding-agent/docs/grok-harness.md as the canonical playbook. Treat ~/.omk/agent/grok.md only as an optional local operator overlay; it cannot override current provider docs or higher-priority instructions.\n2. Keep text chat flows and Imagine/media tool flows separate. Text work uses Grok chat/OAuth/provider surfaces; image/video/Imagine work routes through explicit Imagine tools only. Never conflate model ids with Imagine tool names.\n3. Capability discipline: load at most 2-3 skills for any lane. The allowed skill gate is packages, headroom, programming, debugging, adaptorch-route, adaptorch-synthesize, and understand-anything; choose the smallest subset and add headroom only under context pressure.\n4. Adaptorch is advisory only. Use adaptorch-route for routing/decomposition advice and adaptorch-synthesize for evidence synthesis, but do not treat Adaptorch as an automatic executor, source of truth, permission grant, or substitute for explicit tests.\n5. Use minimal MCP: adaptorch for advice/synthesis, fetch for bounded public retrieval, understand-anything for repo comprehension, and playwright only when browser or Imagine UI behavior needs real verification.\n6. Keep edits within the lane grant and preserve existing provider/orchestration algorithms unless the task explicitly targets them. Never route through legacy KIMICLI or deleted wrappers.\n7. Verification: run the narrowest relevant test/typecheck after edits. Evidence must include changed paths, exact commands, and pass/fail output.\n\nHARD RULES: the packaged Grok harness doc is mandatory context; a local grok.md is optional; text chat surfaces and Imagine tools are distinct; maximum 2-3 active skills; Adaptorch is advisory route/synthesis support only; never log OAuth tokens, cookies, or proxy credentials; protect-secrets applies.`,\n};\n\nexport const DEVIN_HARNESS_PROFILE: DomainProfile = {\n\tschemaVersion: \"omk.loadout.v1\",\n\tid: \"devin-harness\",\n\tname: \"devin-harness\",\n\tlabel: \"Devin SWE-2 Harness\",\n\tauthority: \"write-scoped\",\n\ttools: WRITE_TOOLS,\n\tskills: gate(\"skill\", [\n\t\t\"packages\",\n\t\t\"headroom\",\n\t\t\"programming\",\n\t\t\"debugging\",\n\t\t\"tdd-workflow\",\n\t\t\"lsp\",\n\t\t\"ast-grep\",\n\t\t\"understand-anything\",\n\t]),\n\tmcp: gate(\"mcp\", [\"fetch\", \"context7\", \"understand-anything\", \"playwright\"]),\n\thooks: gate(\"hook\", [\n\t\t\"pre-shell-guard\",\n\t\t\"protect-secrets\",\n\t\t\"typecheck-after-edit\",\n\t\t\"stop-verify\",\n\t\t\"session-context\",\n\t\t\"precompact-checkpoint\",\n\t]),\n\tcommands: commands(\"scoped-shell\"),\n\ttriggers: [\n\t\t{ kind: \"keyword\", pattern: \"devin\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"swe-2\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"swe2\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"cognition\", weight: 6 },\n\t\t{ kind: \"keyword\", pattern: \"devin cli\", weight: 8 },\n\t\t{ kind: \"keyword\", pattern: \"1m context\", weight: 5 },\n\t\t{ kind: \"regex\", pattern: \"\\\\b(devin|swe[- ]?2|cognition)\\\\b\", weight: 7 },\n\t],\n\troutingPrompt: `DOMAIN: Devin SWE-2 Harness. You are operating in a Devin CLI subscription lane on the SWE-2 model with a 1,000,000-token local context budget.\nPrioritize the SWE-2 operational playbook, focused exploration, small capability loadouts, and evidence-bound verification.\n\nSEQUENCE:\n1. Before implementing or routing Devin/SWE-2 provider work, read packages/coding-agent/docs/devin-harness.md as the canonical playbook. Treat ~/.omk/agent/devin.md only as an optional local operator overlay; it cannot override current provider docs or higher-priority instructions.\n2. Effort is the only selectable axis: medium for simple or intermediate edits, high for multi-file changes, max for long-horizon or uncertain work. Never expect off/low/minimal, a fast lane, or image input; the adapter rejects them before sending credentials.\n3. Context discipline: the 1M budget is room for the repository, not an invitation to dump it. Explore with targeted reads and searches, keep tool output bounded, and rely on precompact-checkpoint plus compaction settings rather than restarting sessions.\n4. Capability discipline: load at most 2-3 skills for any lane. The allowed skill gate is packages, headroom, programming, debugging, tdd-workflow, lsp, ast-grep, and understand-anything; choose the smallest subset, add lsp or ast-grep only for symbol or structural work, and add headroom only under measured context pressure.\n5. Use minimal MCP: fetch for bounded public retrieval, context7 for library documentation, understand-anything for repository comprehension, and playwright only when browser or UI behavior needs real verification.\n6. Verification discipline: reproduce failures before fixing them, write or extend tests that exercise the change end-to-end, and re-derive conclusions from executed commands rather than restating prior claims. Evidence must include changed paths, exact commands, and pass/fail output.\n7. Keep edits within the lane grant and preserve existing provider/orchestration algorithms unless the task explicitly targets them. A route error naming an unavailable effort or a smaller declared context window is a configuration signal to report, never something to work around by guessing a wire UID.\n\nHARD RULES: the packaged Devin harness doc is mandatory context; a local devin.md is optional; medium/high/max are the only efforts; the 1M budget never justifies unbounded dumps; maximum 2-3 active skills; never log the Devin session token, user JWT, or auth.json contents; protect-secrets applies.`,\n};\n"]}

package/dist/core/domain-loadouts.d.ts

@@ -21,40 +21,9 @@
  *
  * Erasable TypeScript only (no enum/namespace/parameter properties).
  */
+import type { DomainProfile } from "./domain-profile.ts";
 import type { LoadoutProfile } from "./loadouts.ts";
-/** Signal kinds the router evaluates. */
-export type TriggerKind = "keyword" | "regex" | "extension" | "path";
-/**
- * One routing signal for a domain.
- *
- * - `keyword`: case-insensitive, word-boundary substring of the task text.
- *   Multi-word phrases are matched literally. Matched occurrences are counted
- *   (capped) so repeated mentions raise confidence.
- * - `regex`: matched against the lowercased task text via RegExp. Use for
- *   intent clusters that keywords cannot express compactly (e.g. `cve-\d`).
- * - `extension`: matched against the suffix of any provided path hint.
- * - `path`: glob fragment matched against any provided path hint.
- */
-export interface TriggerSpec {
-    readonly kind: TriggerKind;
-    readonly pattern: string;
-    readonly weight: number;
-}
-/** Domain routing + identity metadata layered on top of a LoadoutProfile. */
-export interface DomainProfile extends LoadoutProfile {
-    /** Stable domain id, e.g. "frontend-ui". Used as the registry key. */
-    readonly id: string;
-    /** Human label, e.g. "Frontend & UI". */
-    readonly label: string;
-    /** Deterministic routing signals consumed by `domain-router.ts`. */
-    readonly triggers: readonly TriggerSpec[];
-    /**
-     * Detailed English routing prompt. When the router selects this domain, the
-     * orchestrator prepends this to the lane's task prompt so the model knows
-     * exactly which capabilities to lean on and how to sequence the work.
-     */
-    readonly routingPrompt: string;
-}
+export type { DomainProfile, TriggerKind, TriggerSpec } from "./domain-profile.ts";
 /**
  * All domain profiles, keyed by id. Order is intentional only for human reading;
  * the router scores every entry independently.