pi-feats 0.1.4 → 0.1.7

package/extensions/lib/cli-tui-mode.ts

@@ -0,0 +1,72 @@
+import { spawn } from "node:child_process";
+import { piCommand } from "./pi-command.ts";
+
+const profileManagementActions = new Set(["add", "create", "delete", "list", "open", "remove", "resume"]);
+const profileResourceCommands = new Set(["extensions", "packages", "sessions", "skills", "tools"]);
+const topLevelCliCommands = new Set(["api", "console", "guardrails", "pulse", "ssh", "tools", "skills", "extensions", "packages", "sessions"]);
+
+/** Remove the Pi TUI override before an extension dispatches positional CLI arguments. */
+export function withoutTuiModeArgs(raw: string[]): string[] {
+  const args: string[] = [];
+  for (let index = 0; index < raw.length; index += 1) {
+    const value = raw[index];
+    if (value === "--tui-mode") { index += 1; continue; }
+    if (value.startsWith("--tui-mode=")) continue;
+    args.push(value);
+  }
+  return args;
+}
+
+export function hasTuiModeArg(args: string[]): boolean {
+  return args.includes("--tui-mode");
+}
+
+/** Preserve an explicit user preference; otherwise make a finite CLI command render normally. */
+export function withRegularTuiMode(args: string[]): string[] {
+  return hasTuiModeArg(args) ? args : [...args, "--tui-mode", "regular"];
+}
+
+function profileCommandIsNonInteractive(args: string[]): boolean {
+  const action = args[1];
+  if (!action) return false;
+  if (profileManagementActions.has(action.toLowerCase())) return true;
+  return !profileManagementActions.has(action.toLowerCase()) && Boolean(args[2]) && (
+    profileResourceCommands.has(args[2]) || ["api", "console", "guardrails", "pulse", "ssh"].includes(args[2])
+  );
+}
+
+/**
+ * True only for pi-feats commands that produce a finite CLI result. Interactive
+ * Pi launches intentionally retain the selected profile's TUI preference.
+ */
+export function isPiFeatsNonInteractiveCli(raw: string[]): boolean {
+  const args = withoutTuiModeArgs(raw);
+  const command = args[0];
+  if (!command) return false;
+  if (topLevelCliCommands.has(command)) return true;
+  if (command === "profile") return profileCommandIsNonInteractive(args);
+  if (command === "remote") return ["add", "list", "delete"].includes(args[1] ?? "");
+
+  const remote = command.match(/^remote:[a-zA-Z][a-zA-Z0-9_-]{0,63}$/);
+  if (!remote) return false;
+  const nested = args.slice(1);
+  if (!nested.length || nested[0] === "bash") return false;
+  if (nested[0] === "profile") return profileCommandIsNonInteractive(nested);
+  return topLevelCliCommands.has(nested[0]);
+}
+
+/** Re-exec finite pi-feats CLI commands before Pi initializes its TUI. */
+export async function reexecCliWithRegularTui(): Promise<boolean> {
+  const args = process.argv.slice(2);
+  if (!isPiFeatsNonInteractiveCli(args) || hasTuiModeArg(args)) return false;
+  const pi = piCommand();
+  const child = spawn(pi.command, [...pi.args, ...withRegularTuiMode(args)], {
+    stdio: "inherit",
+    env: process.env,
+  });
+  const code = await new Promise<number>((resolveExit, reject) => {
+    child.once("error", reject);
+    child.once("exit", (exitCode) => resolveExit(exitCode ?? 1));
+  });
+  process.exit(code);
+}

package/extensions/lib/context-memory.ts

@@ -13,7 +13,7 @@ export type ContextMemoryConfig =
 export type ContextMemoryTarget = "operational" | "profile" | "user";
 export type ContextMemoryToolTarget = "operational" | "personal";
 export type ContextMemoryAction = "read" | "insert" | "update" | "remove" | "replace";
-export type MemoryExecutionContext = { application?: string; identityKey?: string; profile: string; sessionId?: string };
+export type MemoryExecutionContext = { application?: string; identityKey?: string; profile: string; sessionId?: string; directContextMemory?: string };
 export const CONTEXT_MEMORY_LIMITS = { operational: 2750, profile: 1375, user: 1375 } as const;
 const MAX_FILE_BYTES = 64 * 1024;
 const sensitive = /\b(password|passphrase|api[_ -]?key|secret|access[_ -]?token|refresh[_ -]?token|private[_ -]?key|cpf|credit[_ -]?card)\b/i;
@@ -116,6 +116,11 @@ async function handlerMemory(agentDir: string, profileDir: string, context: Memo
 export async function resolveContextMemory(agentDir: string, profileDir: string, context: MemoryExecutionContext): Promise<{ operational: string; personal: string; source?: string; handlerExecution?: ContextMemoryExecutionLog }> {
   const operational = await readMemory(memoryPath(agentDir, profileDir, "operational"));
   if (contextMemoryCharacters(operational) > CONTEXT_MEMORY_LIMITS.operational) throw new Error("OPERATIONAL.md exceeds 2750 characters.");
+  if (context.directContextMemory !== undefined) {
+    const personal = context.directContextMemory.trim();
+    if (contextMemoryCharacters(personal) > CONTEXT_MEMORY_LIMITS.user) throw new Error("Direct Context Memory exceeds 1375 characters.");
+    return { operational, personal, source: "direct" };
+  }
   const config = await profileMemoryConfig(profileDir);
   if (!config) return { operational, personal: "" };
   if (config.mode === "file" && config.target === "profile") { const personal = await readMemory(memoryPath(agentDir, profileDir, "profile")); if (contextMemoryCharacters(personal) > CONTEXT_MEMORY_LIMITS.profile) throw new Error("PROFILE.md exceeds 1375 characters."); return { operational, personal, source: "profile" }; }

package/extensions/lib/conversation-search.ts

@@ -0,0 +1,33 @@
+export type ConversationEntry = { role: "user" | "assistant"; text: string; timestamp?: number };
+export type ConversationCandidate = { id: string; name?: string | null; updatedAt: Date; entries: ConversationEntry[] };
+export type ConversationSearchResult = { id: string; name?: string | null; updatedAt: Date; score: number; excerpts: ConversationEntry[] };
+
+const normalized = (value: string) => value.normalize("NFD").replace(/\p{Diacritic}/gu, "").toLocaleLowerCase();
+const clip = (value: string, limit = 700) => value.length <= limit ? value : `${value.slice(0, limit - 1)}…`;
+
+export function textBlocks(content: unknown): string {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return "";
+  return content.filter((block: any) => block?.type === "text" && typeof block.text === "string").map((block: any) => block.text).join("\n");
+}
+
+export function searchConversationEntries(query: string, candidates: ConversationCandidate[], limit = 5): ConversationSearchResult[] {
+  const needle = normalized(query).trim();
+  const terms = [...new Set(needle.split(/\s+/).filter((term) => term.length > 1))];
+  if (!needle || !terms.length) return [];
+  return candidates.map((candidate) => {
+    const id = normalized(candidate.id), name = normalized(candidate.name ?? "");
+    const exactId = id === needle, idMatch = !exactId && id.includes(needle), nameMatch = name.includes(needle);
+    const matches = candidate.entries.map((entry) => {
+      const haystack = normalized(entry.text);
+      const termMatches = terms.filter((term) => haystack.includes(term)).length;
+      return { entry, termMatches, phrase: haystack.includes(needle) };
+    }).filter((match) => match.termMatches > 0);
+    if (!exactId && !idMatch && !nameMatch && !matches.length) return undefined;
+    const score = (exactId ? 10_000 : idMatch ? 5_000 : nameMatch ? 1_000 : 0) + matches.reduce((total, match) => total + match.termMatches + (match.phrase ? terms.length * 2 : 0), 0);
+    const excerpts = matches.length
+      ? matches.sort((left, right) => (right.phrase ? 1 : 0) - (left.phrase ? 1 : 0) || right.termMatches - left.termMatches).slice(0, 2).map(({ entry }) => ({ ...entry, text: clip(entry.text) }))
+      : candidate.entries.slice(-2).map((entry) => ({ ...entry, text: clip(entry.text) }));
+    return { id: candidate.id, name: candidate.name, updatedAt: candidate.updatedAt, score, excerpts };
+  }).filter((result): result is ConversationSearchResult => Boolean(result)).sort((left, right) => right.score - left.score || right.updatedAt.getTime() - left.updatedAt.getTime()).slice(0, Math.max(1, Math.min(10, limit)));
+}

package/extensions/lib/package-resources.ts

@@ -0,0 +1,58 @@
+import { basename, extname, join } from "node:path";
+
+export type PackageManifest = {
+  pi?: { extensions?: unknown; skills?: unknown };
+};
+
+export type InstalledPackage = {
+  base: string;
+  name: string;
+  manifest?: PackageManifest;
+};
+
+export type PackageExtension = {
+  name: string;
+  aliases: string[];
+  path: string;
+  packageName: string;
+};
+
+const extensionFileName = (entry: string) => basename(entry, extname(entry));
+
+/**
+ * Derive stable user-facing names for package extensions.
+ *
+ * A package whose only extension is an index entry uses the package name so
+ * users do not have to address a generic "index" extension. The technical
+ * entry name remains an alias for backwards compatibility.
+ */
+export function packageExtensions(packages: InstalledPackage[]): PackageExtension[] {
+  const candidates: Array<PackageExtension & { preferredName: string }> = [];
+  for (const pkg of packages) {
+    const entries = Array.isArray(pkg.manifest?.pi?.extensions)
+      ? pkg.manifest.pi.extensions.filter((entry): entry is string => typeof entry === "string")
+      : [];
+    const soleIndexEntry = entries.length === 1 && extensionFileName(entries[0]) === "index";
+    for (const entry of entries) {
+      const technicalName = extensionFileName(entry);
+      const preferredName = soleIndexEntry ? pkg.name : technicalName;
+      candidates.push({
+        name: preferredName,
+        preferredName,
+        aliases: [...new Set([preferredName, technicalName])],
+        path: join(pkg.base, entry),
+        packageName: pkg.name,
+      });
+    }
+  }
+
+  const preferredNameCounts = new Map<string, number>();
+  for (const candidate of candidates) {
+    preferredNameCounts.set(candidate.preferredName, (preferredNameCounts.get(candidate.preferredName) ?? 0) + 1);
+  }
+  return candidates.map(({ preferredName, ...candidate }) => {
+    const technicalName = extensionFileName(candidate.path);
+    const name = (preferredNameCounts.get(preferredName) ?? 0) === 1 ? preferredName : technicalName;
+    return { ...candidate, name, aliases: [...new Set([name, ...candidate.aliases])] };
+  });
+}

package/extensions/lib/pi-command.ts

@@ -0,0 +1,11 @@
+import { existsSync } from "node:fs";
+
+/**
+ * Return a fresh Pi CLI invocation. Managed Pi upgrades replace release files,
+ * so a long-running worker must not blindly reuse a now-deleted argv[1].
+ */
+export function piCommand(entry = process.argv[1]): { command: string; args: string[] } {
+  return entry && existsSync(entry)
+    ? { command: process.execPath, args: [entry] }
+    : { command: "pi", args: [] };
+}

package/extensions/lib/profile-sandbox.ts

@@ -2,19 +2,27 @@ import { existsSync, realpathSync } from "node:fs";
 import { access, mkdir, mkdtemp, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 
+const moduleDirectory = dirname(fileURLToPath(import.meta.url));
+
 export type ProfileSandboxSettings = { sandbox?: boolean; profile?: { skillSources?: { shared?: boolean; profile?: boolean } } };
 const managedDescription = "Pi profile runtime sandbox";
 export const nonoConfigPath = (profileDir: string) => join(profileDir, "nono.json");
 
-function runtimePaths(runtimeEntry: string) {
+export function runtimePaths(runtimeEntry: string) {
   // Pi may be installed by pi-node, a system package manager, or a managed
   // Node distribution (for example, Hermes). Grant only the active runtime
   // and its package root instead of assuming the pi-node installation path.
   const paths = new Set<string>(["$HOME/.local/share/pi-node/node-*", dirname(process.execPath)]);
   const entry = (() => { try { return realpathSync(runtimeEntry); } catch { return runtimeEntry; } })();
-  const nodeModules = entry.indexOf("/lib/node_modules/");
+  // Managed Pi releases place the CLI under
+  // <release>/node_modules/@earendil-works/pi-coding-agent/..., whereas
+  // global Node installations typically use <prefix>/lib/node_modules/....
+  // Allow the directory containing the active node_modules tree in both
+  // layouts, so Node can load the CLI and every runtime dependency.
+  const nodeModules = entry.lastIndexOf("/node_modules/");
   if (nodeModules > 0) paths.add(entry.slice(0, nodeModules));
   return [...paths];
 }
@@ -24,7 +32,7 @@ function nonoPolicy(profileDir: string, runtimeEntry: string, skillSources: { sh
   // This module is distributed inside <package>/extensions/lib. Allow the
   // package root, not only ~/.pi/agent/extensions, so Git and npm packages
   // remain readable inside a profile sandbox.
-  const packageRoot = dirname(dirname(__dirname));
+  const packageRoot = dirname(dirname(moduleDirectory));
   // Pulse scheduling is shared runtime state. A profile can create a schedule,
   // which starts the detached tick process and therefore must create its state
   // and log files as well as update the SQLite database.
@@ -55,6 +63,9 @@ function nonoPolicy(profileDir: string, runtimeEntry: string, skillSources: { sh
         // Resource commands need the default runtime's package and extension
         // configuration while operating on the named profile.
         join(agentDir, "settings.json"),
+        // Named profiles reference this shared catalog through models.json;
+        // Nono must permit resolving the symlink target in the root runtime.
+        join(agentDir, "models.json"),
         ...sharedRuntimeSources,
         ...(skillSources.shared ? [join(agentDir, "skills")] : []),
         // SSH resolves the current UID through these public account maps.

package/extensions/lib/remote-hosts.ts

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
+import { isPiFeatsNonInteractiveCli, withRegularTuiMode } from "./cli-tui-mode.ts";
 
 export const REMOTE_COMMAND_NAMES = ["remote", "add", "remove", "delete", "list"] as const;
 
@@ -367,11 +368,12 @@ async function connectRemote(root: string, name: string, args: string[]) {
     const exists = await runSsh(root, remote, password, profileExistsCommand(remote, profile));
     if (exists.code !== 0) fail(`profile '${profile}' does not exist on remote '${name}'.`);
   }
-  const command = args[0] === "bash"
-    ? runtimeBashCommand(remote, args.slice(1))
-    : profile && profileResourceCommands.has(args[2] ?? "")
-      ? profileRuntimeCommand(remote, profile, args.slice(2))
-      : runtimeCommand(remote, args);
+  const remoteArgs = isPiFeatsNonInteractiveCli(args) ? withRegularTuiMode(args) : args;
+  const command = remoteArgs[0] === "bash"
+    ? runtimeBashCommand(remote, remoteArgs.slice(1))
+    : profile && profileResourceCommands.has(remoteArgs[2] ?? "")
+      ? profileRuntimeCommand(remote, profile, remoteArgs.slice(2))
+      : runtimeCommand(remote, remoteArgs);
   const result = await runSsh(root, remote, password, command, { interactive: true });
   process.exit(result.code);
 }

package/extensions/lib/workflow-evaluator.ts

@@ -0,0 +1,113 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export type WorkflowEvaluationConfig = { modelType: "llm" | "system_one"; systemOne?: { provider: string; model: string; endpoint?: { baseUrl: string; path: string }; onUncertain?: "block" } };
+const defaultOpenRouterEndpoint = { baseUrl: "https://openrouter.ai/api/", path: "alpha/decisions" };
+export type RequirementDecision = { status: "required" | "not_required" | "uncertain" | "unavailable" | "invalid_response" | "error"; reasoning: string; activation?: "definition" | "template"; templateId?: string; evaluator: "llm" | "system_one"; model?: string; confidence?: number; probabilities?: Record<string, number> };
+export type TaskDecision = { outcome: "accept" | "retry" | "fail" | "uncertain" | "unavailable" | "invalid_response" | "error"; reasoning: string; evaluator: "llm" | "system_one"; model?: string; confidence?: number; probabilities?: Record<string, number> };
+type WorkflowTemplate = { id: string; title: string; source: string };
+type ConversationMessage = { role: "user" | "assistant"; content: string };
+type UserInputRequirement = { origin: "user_input"; userLastMessage: string; conversationHistory: ConversationMessage[]; templates: WorkflowTemplate[] };
+type SkillRequirement = { origin: "skill"; evidence: string; userRequest: string; recentUserMessages: string[]; templates: WorkflowTemplate[] };
+export type RequirementInput = UserInputRequirement | SkillRequirement;
+export type TaskInput = { workflow: { title: string; source: string }; task: { type: "action" | "collect" | "workflow"; instruction: string; criteria: string }; result: string };
+const minimumAutomaticTaskConfidence = 0.85;
+
+const root = () => process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
+const object = (value: unknown): value is Record<string, unknown> => !!value && typeof value === "object" && !Array.isArray(value);
+const text = (value: unknown) => typeof value === "string" ? value : "";
+const metadata = (answer: Record<string, unknown>, evaluator: "llm" | "system_one", model?: string) => ({ evaluator, model, confidence: typeof answer.confidence === "number" ? answer.confidence : undefined, probabilities: object(answer.probabilities) ? Object.fromEntries(Object.entries(answer.probabilities).filter(([, value]) => typeof value === "number")) as Record<string, number> : undefined });
+
+export async function workflowEvaluationConfig(): Promise<WorkflowEvaluationConfig> {
+    let settings: unknown = {};
+    try { settings = JSON.parse(await readFile(join(root(), "settings.json"), "utf8")); } catch {}
+    const evaluation = object(settings) && object(settings.sequentialWorkflow) && object(settings.sequentialWorkflow.evaluation) ? settings.sequentialWorkflow.evaluation : undefined;
+    if (!evaluation || evaluation.modelType === undefined) return { modelType: "llm" };
+    if (evaluation.modelType === "llm") return { modelType: "llm" };
+    const systemOne = object(evaluation.systemOne) ? evaluation.systemOne : undefined;
+    const endpoint = object(systemOne?.endpoint) ? systemOne.endpoint : defaultOpenRouterEndpoint;
+    const baseUrl = text(endpoint.baseUrl).trim() || defaultOpenRouterEndpoint.baseUrl, path = text(endpoint.path).trim() || defaultOpenRouterEndpoint.path;
+    try { const url = new URL(baseUrl); if (!/^https?:$/.test(url.protocol) || /^(?:https?:)?\/\//i.test(path)) throw new Error(); }
+    catch { throw new Error("Invalid System One endpoint configuration."); }
+    if (evaluation.modelType !== "system_one" || !systemOne || !text(systemOne.provider).trim() || !text(systemOne.model).trim() || (systemOne.onUncertain !== undefined && systemOne.onUncertain !== "block")) throw new Error("Invalid sequentialWorkflow.evaluation configuration.");
+    return { modelType: "system_one", systemOne: { provider: text(systemOne.provider).trim(), model: text(systemOne.model).trim(), endpoint: { baseUrl, path: path.replace(/^\/+/, "") }, onUncertain: "block" } };
+}
+
+const endpointUrl = (endpoint: { baseUrl: string; path: string }) => new URL(endpoint.path.replace(/^\/+/, ""), endpoint.baseUrl.endsWith("/") ? endpoint.baseUrl : `${endpoint.baseUrl}/`).toString();
+
+async function openRouterApiKey(): Promise<string | undefined> {
+    const environmentKey = process.env.OPENROUTER_API_KEY?.trim();
+    if (environmentKey) return environmentKey;
+    try {
+        const auth: unknown = JSON.parse(await readFile(join(root(), "auth.json"), "utf8"));
+        const key = object(auth) && object(auth.openrouter) ? text(auth.openrouter.key).trim() : "";
+        return key || undefined;
+    } catch { return undefined; }
+}
+
+async function decisionEndpointChoice(ctx: ExtensionContext, model: string, endpoint: { baseUrl: string; path: string }, state: unknown, instructions: string, criteria: Record<string, string>): Promise<{ answer?: Record<string, unknown>; error?: string }> {
+    const apiKey = await openRouterApiKey();
+    if (!apiKey) return { error: "OpenRouter API credentials are unavailable." };
+    try {
+        const response = await fetch(endpointUrl(endpoint), { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` }, body: JSON.stringify({ model: model.replace(/^openrouter\//, ""), state, questions: { decision: { type: "choice", instructions, criteria } } }), signal: ctx.signal });
+        if (!response.ok) return { error: `Configured Decisions API returned HTTP ${response.status}.` };
+        const body: unknown = await response.json();
+        const answer = object(body) && object(body.answers) && object(body.answers.decision) ? body.answers.decision : undefined;
+        return answer ? { answer } : { error: "Configured Decisions API returned an invalid Choice response." };
+    } catch (error) { return { error: error instanceof Error ? error.message : String(error) }; }
+}
+
+async function configuredSystemOneChoice(ctx: ExtensionContext, config: WorkflowEvaluationConfig, state: unknown, instructions: string, criteria: Record<string, string>): Promise<{ answer?: Record<string, unknown>; error?: string }> {
+    const systemOne = config.systemOne!;
+    return decisionEndpointChoice(ctx, systemOne.model, systemOne.endpoint ?? defaultOpenRouterEndpoint, state, instructions, criteria);
+}
+
+const workflowRequirementPolicy = `Decide whether the supplied state requests an actual, new persisted Sequential Workflow execution. The keyword “Sequential Workflow” (including spelling variants) is only a trigger to evaluate; it is never evidence by itself that a workflow is required. For user_input origin, userLastMessage is the primary and decisive evidence: evaluate its current operative intent first. conversationHistory is background context only; it may explain references but must never cause a workflow to be created merely because an earlier message mentioned, requested, created, or completed one. Select a workflow route only when the current user message asks the agent to actually use, create, run, continue, inspect, or cancel a Sequential Workflow to perform current work. Select no_workflow when the current user message is a question, hypothetical, conditional, explanation request, discussion, correction, implementation request, test, configuration request, documentation request, plan, analysis, report, or meta-level question about Sequential Workflow, its Skills, templates, Harness, or System One. A quoted, illustrative, or referenced workflow command is not a command to execute. For example, “If I say ‘Use Sequential Workflow to do X’, would you create one?” requires no_workflow. Do not confuse a request to modify or discuss the feature with a request to execute the feature. For Skill origin, decide from both the active user request and the complete supplied Skill: a keyword in documentation, an example, a comment, frontmatter, a Skill name, or a template mention alone is not enough. Select a template route only when the supplied Skill explicitly requires creating the workflow from a named JSON template. Return uncertain only when the current evidence is genuinely ambiguous.`;
+
+const llmDecision = async (ctx: ExtensionContext, input: RequirementInput): Promise<RequirementDecision> => {
+    if (!ctx.model) return { status: "unavailable", reasoning: "No classifier model is available.", evaluator: "llm" };
+    const messages: any[] = [{ role: "system", content: `${workflowRequirementPolicy} Return only JSON with status (required, not_required, uncertain), non-empty reasoning, activation (definition or template only when required), and templateId only when activation is template. Select template only when one supplied template ID is appropriate, except a Skill may explicitly name a colocated JSON template without a catalog ID.` }, { role: "user", content: JSON.stringify(input) }];
+    try {
+        const response: any = await (ctx.modelRegistry as any).streamSimple(ctx.model, { messages } as any, { signal: ctx.signal }).result();
+        const content = typeof response?.content === "string" ? response.content : (response?.content ?? []).map((part: any) => part.text ?? "").join("");
+        const parsed: unknown = JSON.parse(content);
+        if (!object(parsed) || !["required", "not_required", "uncertain"].includes(text(parsed.status)) || !text(parsed.reasoning).trim()) throw new Error("Invalid classifier response.");
+        if (parsed.status !== "required") return { status: parsed.status as "not_required" | "uncertain", reasoning: text(parsed.reasoning), evaluator: "llm" };
+        const activation = parsed.activation === "template" ? "template" : "definition", templateId = text(parsed.templateId).trim() || undefined;
+        if (activation === "template" && input.origin !== "skill" && (!templateId || !input.templates.some(template => template.id === templateId))) return { status: "invalid_response", reasoning: "Template activation selected an unavailable template.", evaluator: "llm" };
+        return { status: "required", reasoning: text(parsed.reasoning), activation, templateId, evaluator: "llm" };
+    } catch (error) { const reasoning = error instanceof Error ? error.message : String(error); return { status: reasoning === "Invalid classifier response." ? "invalid_response" : "error", reasoning, evaluator: "llm" }; }
+};
+
+const systemOneRequirement = async (ctx: ExtensionContext, config: WorkflowEvaluationConfig, input: RequirementInput): Promise<RequirementDecision> => {
+    const model = config.systemOne!.model, options: Record<string, string> = { no_workflow: "A persisted Sequential Workflow is not needed.", workflow_definition: "A persisted Sequential Workflow is needed and should be defined from the supplied state.", workflow_from_template: "A persisted Sequential Workflow is needed and the supplied Skill explicitly requires creating it from a named JSON template.", uncertain: "The state does not provide enough evidence for a safe decision." };
+    const response = await configuredSystemOneChoice(ctx, config, input, `${workflowRequirementPolicy} Choose exactly one route: no_workflow, workflow_definition, workflow_from_template, or uncertain.`, options);
+    if (!response.answer) return { status: response.error?.endsWith("API credentials are unavailable.") ? "unavailable" : "error", reasoning: response.error!, evaluator: "system_one", model };
+    const choice = text(response.answer.choice), common = metadata(response.answer, "system_one", model);
+    if (choice === "workflow_definition") return { status: "required", reasoning: "TypeSafe System One selected workflow definition.", activation: "definition", ...common };
+    if (choice === "workflow_from_template") return { status: "required", reasoning: "TypeSafe System One selected workflow creation from the Skill's named template.", activation: "template", ...common };
+    if (choice === "no_workflow") return { status: "not_required", reasoning: "TypeSafe System One selected no workflow.", ...common };
+    if (choice === "uncertain") return { status: "uncertain", reasoning: "TypeSafe System One selected an uncertain workflow decision.", ...common };
+    return { status: "invalid_response", reasoning: "TypeSafe API returned an unsupported workflow route.", ...common };
+};
+
+export async function evaluateWorkflowRequirement(ctx: ExtensionContext, input: RequirementInput): Promise<RequirementDecision> { try { const config = await workflowEvaluationConfig(); return config.modelType === "system_one" ? systemOneRequirement(ctx, config, input) : llmDecision(ctx, input); } catch (error) { return { status: "error", reasoning: error instanceof Error ? error.message : String(error), evaluator: "llm" }; } }
+
+export async function evaluateWorkflowTask(ctx: ExtensionContext, input: TaskInput): Promise<TaskDecision | undefined> {
+    let config: WorkflowEvaluationConfig;
+    try { config = await workflowEvaluationConfig(); } catch (error) { return { outcome: "error", reasoning: error instanceof Error ? error.message : String(error), evaluator: "llm" }; }
+    if (config.modelType === "llm") return undefined;
+    const model = config.systemOne!.model;
+    const instruction = input.task.type === "collect"
+        ? "Evaluate the recorded result against the complete collection contract: workflow source, task instruction, and acceptance criterion. The criterion is a minimum condition, never permission to weaken a more specific requirement in the instruction or workflow source. Accept only when every material requirement is demonstrably satisfied. For a request for a full name, require at least a given name and surname; a single token is incomplete. Select retry for an incomplete or incorrect response whenever another user response may satisfy the contract."
+        : "Evaluate whether the recorded result demonstrates completion of this action's stated acceptance criterion. Action criteria intentionally validate the completed outcome and recorded evidence, not an independent reconstruction of every underlying calculation. Select retry only for a concrete discrepancy, omission, or contradiction in the result; do not select retry solely because independent verification confidence is limited.";
+    const response = await configuredSystemOneChoice(ctx, config, input, `${instruction} Select fail only when the task cannot safely progress. Select uncertain only when the evidence cannot establish whether retry could resolve the task.`, { accept: "The result meets the task contract.", retry: "The result has a concrete, remediable discrepancy, omission, or contradiction.", fail: "The result cannot safely satisfy the task contract and the workflow must fail.", uncertain: "The evidence is insufficient to determine whether retry can resolve the task." });
+    if (!response.answer) return { outcome: response.error?.endsWith("API credentials are unavailable.") ? "unavailable" : "error", reasoning: response.error!, evaluator: "system_one", model };
+    const choice = text(response.answer.choice), common = metadata(response.answer, "system_one", model);
+    if (choice === "uncertain") return { outcome: "retry", reasoning: "TypeSafe System One could not determine a safe acceptance; retry the task with corrected or stronger evidence.", ...common };
+    if (input.task.type === "collect" && (typeof common.confidence !== "number" || common.confidence < minimumAutomaticTaskConfidence)) return { outcome: "retry", reasoning: `TypeSafe System One confidence (${common.confidence ?? "missing"}) is below the automatic-acceptance threshold (${minimumAutomaticTaskConfidence}); retry the task with corrected or stronger evidence.`, ...common };
+    if (["accept", "retry", "fail"].includes(choice)) return { outcome: choice as "accept" | "retry" | "fail", reasoning: `TypeSafe System One selected ${choice}.`, ...common };
+    return { outcome: "invalid_response", reasoning: "TypeSafe API returned an unsupported task decision.", ...common };
+}