openhorse 0.2.19 → 0.2.22

package/dist/runtime/rich-text/sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../../src/runtime/rich-text/sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIxD"}

package/dist/runtime/rich-text/sanitizer.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * Rich text sanitizer.
+ *
+ * Delegates to the shared terminal sanitizer for control-character stripping,
+ * then applies additional rich-text-specific normalization for Markdown
+ * parsing safety.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeRichTextInput = sanitizeRichTextInput;
+exports.sanitizeCodeContent = sanitizeCodeContent;
+const style_1 = require("../../tui-core/style");
+/**
+ * Sanitize raw model text before Markdown parsing.
+ * Normalizes line endings first, then strips ANSI/escape sequences.
+ */
+function sanitizeRichTextInput(text) {
+    // Normalize line endings BEFORE stripping control chars (so \r is preserved).
+    const normalized = text.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+    // Strip escape sequences and control chars (except \n, \t).
+    return (0, style_1.sanitizeTerminalText)(normalized, 4);
+}
+/**
+ * Sanitize a code block's content for display.
+ * Preserves whitespace and indentation, strips escape sequences.
+ */
+function sanitizeCodeContent(code) {
+    // Code blocks keep their content mostly intact but strip ANSI escape sequences.
+    const normalized = code.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+    return (0, style_1.sanitizeTerminalText)(normalized, 4);
+}
+//# sourceMappingURL=sanitizer.js.map

package/dist/runtime/rich-text/sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../../src/runtime/rich-text/sanitizer.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAQH,sDAKC;AAMD,kDAIC;AArBD,gDAA4D;AAE5D;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,IAAY;IAChD,8EAA8E;IAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpE,4DAA4D;IAC5D,OAAO,IAAA,4BAAoB,EAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,gFAAgF;IAChF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpE,OAAO,IAAA,4BAAoB,EAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/runtime/rich-text/types.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Rich text block model: renderer-independent structured Markdown output.
+ *
+ * Parsed from model text via marked.lexer(), normalized into a fixed
+ * block/span union. Layout consumes this model to produce StyledRow[]
+ * without depending on React or JSX.
+ */
+import type { TuiStyle } from '../../tui-core/style';
+export interface RichTextSpan {
+    text: string;
+    bold?: boolean;
+    italic?: boolean;
+    code?: boolean;
+    linkUrl?: string;
+}
+export interface DiffLine {
+    kind: 'add' | 'remove' | 'context' | 'hunk' | 'meta';
+    content: string;
+}
+export type RichTextBlock = {
+    type: 'paragraph';
+    spans: RichTextSpan[];
+} | {
+    type: 'heading';
+    level: number;
+    spans: RichTextSpan[];
+} | {
+    type: 'list';
+    ordered: boolean;
+    items: RichTextBlock[][];
+} | {
+    type: 'quote';
+    blocks: RichTextBlock[];
+} | {
+    type: 'code';
+    language?: string;
+    lines: string[];
+} | {
+    type: 'diff';
+    lines: DiffLine[];
+} | {
+    type: 'table';
+    headers: RichTextSpan[][];
+    rows: RichTextSpan[][][];
+} | {
+    type: 'rule';
+};
+export interface RichTextDocument {
+    blocks: RichTextBlock[];
+}
+export declare const MAX_RICH_TEXT_INPUT_BYTES = 1000000;
+export declare const MAX_RICH_TEXT_BLOCKS = 2000;
+export declare const MAX_MARKDOWN_NESTING = 4;
+export declare const MAX_TABLE_COLUMNS = 20;
+export declare const MAX_TABLE_ROWS = 200;
+export type RichTextStyleToken = 'assistantText' | 'heading' | 'code' | 'inlineCode' | 'link' | 'diffAdded' | 'diffRemoved' | 'diffHunk' | 'warning' | 'error' | 'muted';
+/** Resolve a semantic token to a TuiStyle via theme. */
+export type RichTextThemeResolver = (token: RichTextStyleToken) => TuiStyle;
+//# sourceMappingURL=types.d.ts.map

package/dist/runtime/rich-text/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/runtime/rich-text/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,YAAY,EAAE,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,EAAE,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,EAAE,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC;IAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAGD,eAAO,MAAM,yBAAyB,UAAY,CAAC;AACnD,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAC1C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,cAAc,MAAM,CAAC;AAGlC,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,SAAS,GACT,MAAM,GACN,YAAY,GACZ,MAAM,GACN,WAAW,GACX,aAAa,GACb,UAAU,GACV,SAAS,GACT,OAAO,GACP,OAAO,CAAC;AAEZ,wDAAwD;AACxD,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,kBAAkB,KAAK,QAAQ,CAAC"}

package/dist/runtime/rich-text/types.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Rich text block model: renderer-independent structured Markdown output.
+ *
+ * Parsed from model text via marked.lexer(), normalized into a fixed
+ * block/span union. Layout consumes this model to produce StyledRow[]
+ * without depending on React or JSX.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_TABLE_ROWS = exports.MAX_TABLE_COLUMNS = exports.MAX_MARKDOWN_NESTING = exports.MAX_RICH_TEXT_BLOCKS = exports.MAX_RICH_TEXT_INPUT_BYTES = void 0;
+// Resource limits (deterministic degradation, never OOM)
+exports.MAX_RICH_TEXT_INPUT_BYTES = 1000000;
+exports.MAX_RICH_TEXT_BLOCKS = 2000;
+exports.MAX_MARKDOWN_NESTING = 4;
+exports.MAX_TABLE_COLUMNS = 20;
+exports.MAX_TABLE_ROWS = 200;
+//# sourceMappingURL=types.js.map

package/dist/runtime/rich-text/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/runtime/rich-text/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AA+BH,yDAAyD;AAC5C,QAAA,yBAAyB,GAAG,OAAS,CAAC;AACtC,QAAA,oBAAoB,GAAG,IAAK,CAAC;AAC7B,QAAA,oBAAoB,GAAG,CAAC,CAAC;AACzB,QAAA,iBAAiB,GAAG,EAAE,CAAC;AACvB,QAAA,cAAc,GAAG,GAAG,CAAC"}

package/dist/runtime/subagents/budget.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Subagent budget ledger: reserve before launch, reconcile after completion.
+ *
+ * The root turn owns an aggregate budget (model requests, tool calls,
+ * model-visible bytes, wall-clock time). Children draw against it. To avoid
+ * over-spending, the Supervisor reserves a per-task allowance up front and
+ * releases the difference once the real usage is known.
+ *
+ * This ledger is the single source of truth for child aggregate usage; the
+ * root loop reads it to fold child cost into `/cost` and loop stats.
+ */
+import type { SubtaskUsage } from './types';
+export interface SubagentBudgetLimits {
+    /** Total model requests allowed across all children in one root turn. */
+    maxModelRequestsPerTurn: number;
+    /** Per-child model request allowance. */
+    maxModelRequestsPerTask: number;
+    /** Per-child tool call allowance. */
+    maxToolCallsPerTask: number;
+    /** Per-child wall-clock timeout (ms). */
+    timeoutMs: number;
+}
+export interface ReservedBudget {
+    taskId: string;
+    modelRequests: number;
+}
+export interface BudgetSnapshot {
+    /** Requests reserved but not yet reconciled. */
+    reservedModelRequests: number;
+    /** Reconciled (actual observed) usage so far - never clamped to hide overage. */
+    used: SubtaskUsage;
+    /** Requests still available for new reservations. */
+    availableModelRequests: number;
+    /** Whether the aggregate limit has been exceeded by actual usage. */
+    exhausted: boolean;
+    /** Per-task overage events: observed usage exceeded an enforced allowance. */
+    violations: BudgetViolation[];
+}
+export interface BudgetViolation {
+    taskId: string;
+    /** The enforced limit that was exceeded. */
+    limit: 'maxModelRequestsPerTask' | 'maxToolCallsPerTask' | 'timeoutMs' | 'maxModelRequestsPerTurn';
+    /** The observed value. */
+    observed: number;
+    /** The enforced ceiling. */
+    enforced: number;
+}
+/**
+ * R6: turn-level mutable state shared across all `subtask` calls within one
+ * root turn. Lives on the SubagentTurnBundle so multiple `subtask` tool calls
+ * in the same turn see a consistent counter - the per-batch reset that
+ * previously let a turn exceed `maxTasksPerTurn` is gone.
+ */
+export declare class TurnTaskState {
+    private started;
+    /** Increment by `n` and return the new total. Called atomically by the
+     * supervisor after policy allows a batch. */
+    addStarted(n: number): number;
+    /** Total tasks started in this root turn (across all `subtask` calls). */
+    tasksStarted(): number;
+    reset(): void;
+}
+/**
+ * Aggregate budget ledger for one root turn. Not thread-safe by itself;
+ * the Supervisor serializes mutations.
+ *
+ * R6: observed usage is recorded faithfully (never clamped to hide overage).
+ * The enforced allowance and observed usage are modeled separately, so `/cost`
+ * and telemetry reflect the truth while the runtime still stops children that
+ * exceed their allowance.
+ */
+export declare class SubagentBudgetLedger {
+    private readonly limits;
+    private reserved;
+    private reconciled;
+    private violations;
+    constructor(limits: SubagentBudgetLimits);
+    /** Reserve model-request slots for a task. Returns false if unavailable. */
+    reserve(taskId: string, requestedRequests: number): ReservedBudget | null;
+    /** Release a reservation without consuming (e.g. task rejected after reserve). */
+    release(taskId: string): void;
+    /**
+     * Reconcile actual usage for a task. Releases its reservation and debits
+     * the REAL usage (never clamped). Records a violation if observed usage
+     * exceeded an enforced per-task or aggregate ceiling. Returns true if the
+     * aggregate turn limit is still respected.
+     *
+     * R6: observed usage is stored as-is so `/cost` and telemetry are truthful.
+     */
+    reconcile(taskId: string, actual: SubtaskUsage): boolean;
+    availableModelRequests(): number;
+    /**
+     * Whether `count` new tasks can each reserve at least one model request.
+     * NOTE: this checks the minimum (1 request per task), not the full
+     * per-task cap. The supervisor's reserve loop (supervisor.ts:158-179)
+     * handles per-task reserve amounts individually.
+     */
+    canReserveBatch(count: number): boolean;
+    snapshot(): BudgetSnapshot;
+    /** Reconciled aggregate usage across all completed children. */
+    aggregateUsage(): SubtaskUsage;
+    /** Number of tasks that have been reconciled (completed/failed/cancelled). */
+    reconciledTaskCount(): number;
+    /** Recorded overage violations (observed exceeded enforced ceiling). */
+    violationsList(): BudgetViolation[];
+    /** True if no reservations are outstanding and no usage has been recorded. */
+    isClean(): boolean;
+    private aggregateReservedOrUsed;
+    private aggregateUsedModelRequests;
+}
+/** Build limits from a SubagentConfig. */
+export declare function budgetLimitsFromConfig(config: {
+    maxModelRequestsPerTurn: number;
+    maxModelRequestsPerTask: number;
+    maxToolCallsPerTask: number;
+    timeoutMs: number;
+}): SubagentBudgetLimits;
+//# sourceMappingURL=budget.d.ts.map

package/dist/runtime/subagents/budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../../src/runtime/subagents/budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG5C,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,uBAAuB,EAAE,MAAM,CAAC;IAChC,yCAAyC;IACzC,uBAAuB,EAAE,MAAM,CAAC;IAChC,qCAAqC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,IAAI,EAAE,YAAY,CAAC;IACnB,qDAAqD;IACrD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qEAAqE;IACrE,SAAS,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,KAAK,EAAE,yBAAyB,GAAG,qBAAqB,GAAG,WAAW,GAAG,yBAAyB,CAAC;IACnG,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAK;IAEpB;iDAC6C;IAC7C,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM;IAK7B,0EAA0E;IAC1E,YAAY,IAAI,MAAM;IAItB,KAAK,IAAI,IAAI;CAGd;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,UAAU,CAAsB;IACxC,OAAO,CAAC,UAAU,CAAyB;gBAE/B,MAAM,EAAE,oBAAoB;IAIxC,4EAA4E;IAC5E,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAQzE,kFAAkF;IAClF,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI7B;;;;;;;OAOG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO;IAkCxD,sBAAsB,IAAI,MAAM;IAIhC;;;;;OAKG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIvC,QAAQ,IAAI,cAAc;IAe1B,gEAAgE;IAChE,cAAc,IAAI,YAAY;IAI9B,8EAA8E;IAC9E,mBAAmB,IAAI,MAAM;IAI7B,wEAAwE;IACxE,cAAc,IAAI,eAAe,EAAE;IAInC,8EAA8E;IAC9E,OAAO,IAAI,OAAO;IAIlB,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,0BAA0B;CAGnC;AAED,0CAA0C;AAC1C,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,uBAAuB,EAAE,MAAM,CAAC;IAChC,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,oBAAoB,CAOvB"}

package/dist/runtime/subagents/budget.js

@@ -0,0 +1,173 @@
+"use strict";
+/**
+ * Subagent budget ledger: reserve before launch, reconcile after completion.
+ *
+ * The root turn owns an aggregate budget (model requests, tool calls,
+ * model-visible bytes, wall-clock time). Children draw against it. To avoid
+ * over-spending, the Supervisor reserves a per-task allowance up front and
+ * releases the difference once the real usage is known.
+ *
+ * This ledger is the single source of truth for child aggregate usage; the
+ * root loop reads it to fold child cost into `/cost` and loop stats.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubagentBudgetLedger = exports.TurnTaskState = void 0;
+exports.budgetLimitsFromConfig = budgetLimitsFromConfig;
+const types_1 = require("./types");
+/**
+ * R6: turn-level mutable state shared across all `subtask` calls within one
+ * root turn. Lives on the SubagentTurnBundle so multiple `subtask` tool calls
+ * in the same turn see a consistent counter - the per-batch reset that
+ * previously let a turn exceed `maxTasksPerTurn` is gone.
+ */
+class TurnTaskState {
+    constructor() {
+        this.started = 0;
+    }
+    /** Increment by `n` and return the new total. Called atomically by the
+     * supervisor after policy allows a batch. */
+    addStarted(n) {
+        this.started += n;
+        return this.started;
+    }
+    /** Total tasks started in this root turn (across all `subtask` calls). */
+    tasksStarted() {
+        return this.started;
+    }
+    reset() {
+        this.started = 0;
+    }
+}
+exports.TurnTaskState = TurnTaskState;
+/**
+ * Aggregate budget ledger for one root turn. Not thread-safe by itself;
+ * the Supervisor serializes mutations.
+ *
+ * R6: observed usage is recorded faithfully (never clamped to hide overage).
+ * The enforced allowance and observed usage are modeled separately, so `/cost`
+ * and telemetry reflect the truth while the runtime still stops children that
+ * exceed their allowance.
+ */
+class SubagentBudgetLedger {
+    constructor(limits) {
+        this.reserved = new Map();
+        this.reconciled = [];
+        this.violations = [];
+        this.limits = limits;
+    }
+    /** Reserve model-request slots for a task. Returns false if unavailable. */
+    reserve(taskId, requestedRequests) {
+        if (this.reserved.has(taskId))
+            return null;
+        const want = Math.max(1, Math.min(requestedRequests, this.limits.maxModelRequestsPerTask));
+        if (want > this.availableModelRequests())
+            return null;
+        this.reserved.set(taskId, want);
+        return { taskId, modelRequests: want };
+    }
+    /** Release a reservation without consuming (e.g. task rejected after reserve). */
+    release(taskId) {
+        this.reserved.delete(taskId);
+    }
+    /**
+     * Reconcile actual usage for a task. Releases its reservation and debits
+     * the REAL usage (never clamped). Records a violation if observed usage
+     * exceeded an enforced per-task or aggregate ceiling. Returns true if the
+     * aggregate turn limit is still respected.
+     *
+     * R6: observed usage is stored as-is so `/cost` and telemetry are truthful.
+     */
+    reconcile(taskId, actual) {
+        this.reserved.delete(taskId);
+        // Record observed usage faithfully - do NOT clamp to hide overage.
+        this.reconciled.push({ ...actual });
+        // Record violations: observed exceeded an enforced ceiling.
+        if (actual.modelRequests > this.limits.maxModelRequestsPerTask) {
+            this.violations.push({
+                taskId,
+                limit: 'maxModelRequestsPerTask',
+                observed: actual.modelRequests,
+                enforced: this.limits.maxModelRequestsPerTask,
+            });
+        }
+        if (actual.toolCalls > this.limits.maxToolCallsPerTask) {
+            this.violations.push({
+                taskId,
+                limit: 'maxToolCallsPerTask',
+                observed: actual.toolCalls,
+                enforced: this.limits.maxToolCallsPerTask,
+            });
+        }
+        if (actual.durationMs > this.limits.timeoutMs) {
+            this.violations.push({
+                taskId,
+                limit: 'timeoutMs',
+                observed: actual.durationMs,
+                enforced: this.limits.timeoutMs,
+            });
+        }
+        return this.aggregateUsedModelRequests() <= this.limits.maxModelRequestsPerTurn;
+    }
+    availableModelRequests() {
+        return Math.max(0, this.limits.maxModelRequestsPerTurn - this.aggregateReservedOrUsed());
+    }
+    /**
+     * Whether `count` new tasks can each reserve at least one model request.
+     * NOTE: this checks the minimum (1 request per task), not the full
+     * per-task cap. The supervisor's reserve loop (supervisor.ts:158-179)
+     * handles per-task reserve amounts individually.
+     */
+    canReserveBatch(count) {
+        return this.availableModelRequests() >= count;
+    }
+    snapshot() {
+        const used = (0, types_1.sumSubtaskUsage)(this.reconciled);
+        const reservedModelRequests = (0, types_1.sumSubtaskUsage)(Array.from(this.reserved.entries()).map(([, n]) => ({ ...types_1.EMPTY_SUBTASK_USAGE, modelRequests: n }))).modelRequests;
+        const availableModelRequests = this.availableModelRequests();
+        return {
+            reservedModelRequests,
+            used,
+            availableModelRequests,
+            exhausted: this.aggregateUsedModelRequests() > this.limits.maxModelRequestsPerTurn,
+            violations: [...this.violations],
+        };
+    }
+    /** Reconciled aggregate usage across all completed children. */
+    aggregateUsage() {
+        return (0, types_1.sumSubtaskUsage)(this.reconciled);
+    }
+    /** Number of tasks that have been reconciled (completed/failed/cancelled). */
+    reconciledTaskCount() {
+        return this.reconciled.length;
+    }
+    /** Recorded overage violations (observed exceeded enforced ceiling). */
+    violationsList() {
+        return [...this.violations];
+    }
+    /** True if no reservations are outstanding and no usage has been recorded. */
+    isClean() {
+        return this.reserved.size === 0 && this.reconciled.length === 0;
+    }
+    aggregateReservedOrUsed() {
+        let total = 0;
+        for (const n of this.reserved.values())
+            total += n;
+        for (const u of this.reconciled)
+            total += u.modelRequests;
+        return total;
+    }
+    aggregateUsedModelRequests() {
+        return this.reconciled.reduce((acc, u) => acc + u.modelRequests, 0);
+    }
+}
+exports.SubagentBudgetLedger = SubagentBudgetLedger;
+/** Build limits from a SubagentConfig. */
+function budgetLimitsFromConfig(config) {
+    return {
+        maxModelRequestsPerTurn: config.maxModelRequestsPerTurn,
+        maxModelRequestsPerTask: config.maxModelRequestsPerTask,
+        maxToolCallsPerTask: config.maxToolCallsPerTask,
+        timeoutMs: config.timeoutMs,
+    };
+}
+//# sourceMappingURL=budget.js.map

package/dist/runtime/subagents/budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../../../src/runtime/subagents/budget.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA+MH,wDAYC;AAxND,mCAA+D;AAyC/D;;;;;GAKG;AACH,MAAa,aAAa;IAA1B;QACU,YAAO,GAAG,CAAC,CAAC;IAiBtB,CAAC;IAfC;iDAC6C;IAC7C,UAAU,CAAC,CAAS;QAClB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,0EAA0E;IAC1E,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACnB,CAAC;CACF;AAlBD,sCAkBC;AAED;;;;;;;;GAQG;AACH,MAAa,oBAAoB;IAM/B,YAAY,MAA4B;QAJhC,aAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QACrC,eAAU,GAAmB,EAAE,CAAC;QAChC,eAAU,GAAsB,EAAE,CAAC;QAGzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,4EAA4E;IAC5E,OAAO,CAAC,MAAc,EAAE,iBAAyB;QAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC3F,IAAI,IAAI,GAAG,IAAI,CAAC,sBAAsB,EAAE;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,kFAAkF;IAClF,OAAO,CAAC,MAAc;QACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,MAAc,EAAE,MAAoB;QAC5C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,mEAAmE;QACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAEpC,4DAA4D;QAC5D,IAAI,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,CAAC;YAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBACnB,MAAM;gBACN,KAAK,EAAE,yBAAyB;gBAChC,QAAQ,EAAE,MAAM,CAAC,aAAa;gBAC9B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBACnB,MAAM;gBACN,KAAK,EAAE,qBAAqB;gBAC5B,QAAQ,EAAE,MAAM,CAAC,SAAS;gBAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;aAC1C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBACnB,MAAM;gBACN,KAAK,EAAE,WAAW;gBAClB,QAAQ,EAAE,MAAM,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aAChC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,0BAA0B,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;IAClF,CAAC;IAED,sBAAsB;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,sBAAsB,EAAE,IAAI,KAAK,CAAC;IAChD,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,qBAAqB,GAAG,IAAA,uBAAe,EAC3C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,2BAAmB,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CACnG,CAAC,aAAa,CAAC;QAChB,MAAM,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC7D,OAAO;YACL,qBAAqB;YACrB,IAAI;YACJ,sBAAsB;YACtB,SAAS,EAAE,IAAI,CAAC,0BAA0B,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB;YAClF,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;SACjC,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,cAAc;QACZ,OAAO,IAAA,uBAAe,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;QACjB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,cAAc;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,8EAA8E;IAC9E,OAAO;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IAClE,CAAC;IAEO,uBAAuB;QAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,KAAK,IAAI,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU;YAAE,KAAK,IAAI,CAAC,CAAC,aAAa,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,0BAA0B;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;CACF;AA7HD,oDA6HC;AAED,0CAA0C;AAC1C,SAAgB,sBAAsB,CAAC,MAKtC;IACC,OAAO;QACL,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/runtime/subagents/child-executor-guard.d.ts

@@ -0,0 +1,60 @@
+/**
+ * ChildToolExecutorGuard: enforces project-root and packet-scope isolation.
+ *
+ * R3 (v0.2.20): the policy only canonicalizes scope.paths into the child
+ * prompt, but the actual tool arguments (read_file path, glob base, grep
+ * path, batch_read nested args) were not validated. A child could read
+ * absolute paths, `../` escapes, outside-scope files, or symlink targets
+ * pointing outside the project.
+ *
+ * This guard wraps the child tool executor and performs a realpath-based
+ * containment check on every path-bearing argument before delegating to
+ * the real executor.
+ *
+ * Two containment boundaries:
+ *   1. Canonical project root (always enforced).
+ *   2. Packet scope paths (enforced when the packet specifies a non-empty
+ *      scope). The path must be inside the root AND inside at least one
+ *      scope realpath.
+ */
+export interface GuardOptions {
+    /** Canonical project root (first containment boundary). */
+    rootCwd: string;
+    /** Canonical scope paths (second, stricter boundary). Empty = root only. */
+    scopePaths?: readonly string[];
+}
+export interface GuardRejection {
+    ok: false;
+    tool: string;
+    reason: string;
+    path?: string;
+}
+export interface GuardApproval {
+    ok: true;
+}
+export type GuardVerdict = GuardApproval | GuardRejection;
+/**
+ * Evaluate whether a tool call is allowed under the guard's boundaries.
+ * Pure (modulo realpath reads) so it can be tested in isolation.
+ */
+export declare function evaluateToolCall(tool: string, args: Record<string, unknown>, options: GuardOptions): GuardVerdict;
+/**
+ * A mutable scope holder: the supervisor sets the current packet's scope
+ * before running it, so the turn-level guard can enforce per-packet scope
+ * containment without rebuilding the executor per packet.
+ */
+export declare class ScopeHolder {
+    private current;
+    setScope(paths: readonly string[]): void;
+    clear(): void;
+    getScope(): readonly string[];
+}
+/**
+ * Wrap a child tool executor with containment enforcement. The returned
+ * executor delegates to `inner` only when all path-bearing args are inside
+ * the project root (and inside the packet scope, if the scope holder is set).
+ */
+export declare function createChildToolExecutorGuard(inner: (name: string, args: Record<string, unknown>, abortSignal?: AbortSignal) => Promise<string>, options: GuardOptions & {
+    scopeHolder?: ScopeHolder;
+}): (name: string, args: Record<string, unknown>, abortSignal?: AbortSignal) => Promise<string>;
+//# sourceMappingURL=child-executor-guard.d.ts.map

package/dist/runtime/subagents/child-executor-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-executor-guard.d.ts","sourceRoot":"","sources":["../../../src/runtime/subagents/child-executor-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAiBH,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,IAAI,CAAC;CACV;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,cAAc,CAAC;AA+I1D;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,YAAY,GACpB,YAAY,CAkBd;AAED;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAyB;IAExC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAIxC,KAAK,IAAI,IAAI;IAIb,QAAQ,IAAI,SAAS,MAAM,EAAE;CAG9B;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,CACL,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,MAAM,CAAC,EACpB,OAAO,EAAE,YAAY,GAAG;IAAE,WAAW,CAAC,EAAE,WAAW,CAAA;CAAE,GACpD,CACD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,CAAC,EAAE,WAAW,KACtB,OAAO,CAAC,MAAM,CAAC,CAgBnB"}