pi-openai-toolkit 0.14.7 → 0.14.9

package/README.md

@@ -13,7 +13,7 @@ Add Codex context windows, Responses compaction, hosted tools, and reviewed tool
 | --- | --- |
 | Codex Remote Context | Start a new context window and retrieve earlier windows with `history`. |
 | Remote Compaction v2 | Continue an eligible Responses session with an encrypted server checkpoint. |
-| Hosted Web Search | Give selected models OpenAI's hosted search tool. |
+| Web Search routes | Choose local `pi-web-access`, hosted Responses `web_search`, or CPA standalone `web.run` per exact model route. |
 | Image generation | Generate images or edit explicitly supplied local reference images. |
 | Tool-call review | Ask a reviewer model whether selected tool calls may run. |
 
@@ -31,7 +31,7 @@ pi install npm:pi-openai-toolkit
 
 Use `--local` to install it in the current project.
 
-Installing the package alone does not enable every feature. With no extension config, compaction is enabled but Remote Context is off, the Web Search model list is empty, image generation is disabled, and Auto Mode has no allowed models or reviewer.
+Installing the package alone does not enable every feature. With no extension config, compaction is enabled but Remote Context is off, Web Search has no toolkit-selected route, image generation is disabled, and Auto Mode has no allowed models or reviewer.
 
 The extension config file is:
 
@@ -130,19 +130,44 @@ Earlier windows remain available through `history`, but they are not all automat
 
 Leave Remote Context off when you want the Responses compaction path instead. Remote Compaction v2 stores and replays an encrypted checkpoint for eligible Responses models. Set `compaction.remoteCompactModel` only when the compaction request should use a separate model.
 
-### Enable hosted Web Search
+When `compaction.remoteV2ContextSource` is omitted, Remote V2 keeps the original `"legacy"` input chain: first compaction uses Pi's current session context (or the supplied preparation as a last resort), and recursive compaction uses the raw branch tail. This preserves existing behavior, but can diverge from provider-visible context when other extensions rewrite messages.
 
-List exact model specifications under `webSearch.models`:
+Set `compaction.remoteV2ContextSource` to `"pi-context-hook"` to opt into the Pi 0.85.1 runtime bridge. The toolkit then uses the same ordered `context` hook chain as the live provider request. If Pi cannot expose that public hook path, Remote V2 cancels instead of sending an unprojected history. Checkpoint replay is accepted only when its source marker matches the current setting. Switching between the two modes requires a new Remote V2 checkpoint; disable Remote V2 or use Pi's native compaction when custom-only state must survive inside the opaque checkpoint.
+
+### Choose a Web Search route
+
+Web Search has three mutually exclusive routes. Configure one global default and, when needed, exact `provider/model-id` overrides:
 
 ```json
 {
   "webSearch": {
-    "models": ["my-gateway/gpt-5.6-luna"]
+    "enabled": true,
+    "defaultRoute": "hosted",
+    "routes": {
+      "uwoacrimson/gpt-6-astra": "standalone-alpha",
+      "my-gateway/gpt-5.6-luna": "local"
+    }
   }
 }
 ```
 
-For those models, the extension replaces Pi's local `web_search` tool with OpenAI's hosted Responses search tool.
+Route selection is exact and deterministic: `routes[provider/model-id]` wins over `defaultRoute`; `defaultRoute` wins over the legacy `models` list. There is no wildcard, fuzzy model matching, capability guessing, fallback, or retry between routes. Invalid route values/keys are ignored with warnings rather than guessed, and overlapping new/legacy fields produce migration warnings. `enabled: false` releases toolkit ownership and disables all three toolkit-selected paths.
+
+- **`local`** keeps the already-installed `pi-web-access` `web_search` tool. The toolkit does not activate it when it was not active, and it does not add a hosted provider tool or `web.run`.
+- **`hosted`** removes the local function named `web_search` and injects the native Responses `{ "type": "web_search" }` tool plus source annotations. The legacy configuration remains valid:
+
+  ```json
+  {
+    "webSearch": {
+      "models": ["my-gateway/gpt-5.6-luna"]
+    }
+  }
+  ```
+
+  With no new route fields, only models in this exact list and the existing Responses-family APIs (`openai-responses` or `openai-codex-responses`) use hosted search.
+- **`standalone-alpha`** exposes one sequential `web.run` tool and sends one isolated `POST` request to the provider-relative `/alpha/search` endpoint. A base URL such as `https://gateway.example/v1` therefore receives `https://gateway.example/v1/alpha/search`, not a Responses endpoint. Supported command families are `search_query`, `image_query`, `open`, `click`, `find`, `screenshot`, `finance`, `weather`, `sports`, and `time`; `response_length` controls the requested result size.
+
+The standalone route is an experimental CPA/Codex gateway protocol, not a stable public OpenAI Responses endpoint. The gateway/provider must expose `/alpha/search`, enable its `alpha-search` capability, and support standalone web search (Codex providers commonly expose this as `supports_standalone_web_search = true`). The request reuses Pi's current model, authentication, provider headers, session identity, and Codex/gateway affinity; it does not change the active model. The MVP sends the bounded command envelope rather than the full conversation transcript, relies on provider session/reference handling for `ref_id` follow-ups, makes at most one request per tool call, and fails closed on invalid configuration, unavailable routes, cancellation, timeout, non-2xx, malformed, or oversized responses.
 
 ### Generate an image
 
@@ -174,7 +199,7 @@ Allow a model and reviewer in `autoMode`:
 }
 ```
 
-Use `/auto on` in the session. The default `side-effect` gate reviews `bash`, `write`, `edit`, and configured extra tools. Set `gate` to `"all"` when every tool call needs review. A reviewer timeout does not approve a call.
+Use `/auto on` in the session, or start Pi with `--auto`. The TUI shows an activation notice and temporarily changes the working indicator to `Auto mode: reviewing <tool>` while a gated call is being reviewed; the footer keeps the active gate visible. On Pi versions that expose the compatible tool renderer, each tool block in Auto Mode also gets a bottom line: reviewed calls show states such as `allowed by reviewer · low risk · authorization medium` or `denied · <reason>`, while calls outside the configured gate show `not reviewed · outside the configured gate`. If that renderer seam is unavailable, the extension warns once and keeps the footer-only status. The default `side-effect` gate reviews `bash`, `write`, `edit`, and configured extra tools. Set `gate` to `"all"` when every tool call needs review. A reviewer timeout does not approve a call.
 
 ## Common configuration
 
@@ -186,8 +211,12 @@ The config file is `~/.pi/agent/extensions/pi-openai-toolkit/config.json`. Unkno
 | `compaction.contextManagement` | `"off"` | Enables Codex Remote Context when set to `"remote"`. |
 | `compaction.gatewayContextModels` | `[]` | Gateway models allowed to use Remote Context. |
 | `compaction.remoteCompactModel` | unset | Optional model used only for a v2 compaction request. |
+| `compaction.remoteV2ContextSource` | `"legacy"` | Preserve the original raw session/branch input path. Set `"pi-context-hook"` to opt into Pi's ordered context-hook projection. Checkpoints are mode-specific. |
 | `compaction.contextReminderThresholdPercent` | `5` | Remaining budget percentage for the once-per-window reminder. `0` disables the reminder and exhausted-window fallback. |
-| `webSearch.models` | `[]` | Models that receive hosted Web Search. |
+| `webSearch.enabled` | `true` | Total switch for the toolkit's Web Search route selection. `false` selects no toolkit route. |
+| `webSearch.defaultRoute` | unset | Default route: `local`, `hosted`, or `standalone-alpha`. Unset preserves legacy behavior. |
+| `webSearch.routes` | unset | Exact `provider/model-id` to route overrides. Exact entries take precedence over `defaultRoute`. |
+| `webSearch.models` | `[]` | Legacy exact allowlist; without the new route fields, listed Responses-family models receive hosted Web Search. |
 | `imageGeneration.enabled` | `false` | Enables `openai_generate_image`. |
 | `imageGeneration.models` | `["gpt-image-2.5"]` | Bare image-generation model IDs; the first entry is the default. |
 | `autoMode.models` | `[]` | Models allowed to use Auto Mode. |

package/README.zh.md

@@ -13,7 +13,7 @@
 | --- | --- |
 | Codex 远程上下文 | 切换到新上下文窗口，并通过 `history` 按需检索较早窗口。 |
 | 远程压缩 v2 | 使用服务端返回的加密检查点继续符合条件的 Responses 会话。 |
-| 托管联网搜索 | 为指定模型启用 OpenAI 托管的搜索工具。 |
+| 联网搜索路由 | 按精确模型路由选择本地 `pi-web-access`、Responses 托管 `web_search` 或 CPA standalone `web.run`。 |
 | 图像生成 | 生成图片，或根据明确传入的本地参考图片进行编辑。 |
 | 工具调用审查 | 在指定范围的工具调用执行前，由审查模型判断是否允许执行。 |
 
@@ -31,7 +31,7 @@ pi install npm:pi-openai-toolkit
 
 在当前项目中安装时，在命令后加上 `--local`。
 
-只安装扩展不会自动启用所有功能。没有扩展配置时，压缩模块处于开启状态，但远程上下文关闭，联网搜索没有目标模型，图像生成关闭，自动模式也没有允许的模型和审查模型。
+只安装扩展不会自动启用所有功能。没有扩展配置时，压缩模块处于开启状态，但远程上下文关闭，联网搜索没有工具包选择的路由，图像生成关闭，自动模式也没有允许的模型和审查模型。
 
 扩展配置文件位于：
 
@@ -130,19 +130,44 @@ pi --model my-gateway/gpt-5.6-luna
 
 如果希望使用 Responses 压缩路径，就保持远程上下文关闭。远程压缩 v2 会为符合条件的 Responses 模型保存并回放加密检查点。只有在压缩请求需要使用其他模型时，才设置 `compaction.remoteCompactModel`。
 
-### 启用托管联网搜索
+不配置 `compaction.remoteV2ContextSource` 时，Remote V2 保持原来的 `"legacy"` 输入链路：首次压缩使用 Pi 当前的 session context（最后才回退到事件提供的 preparation），递归压缩使用原始 branch tail。这会保留既有行为，但如果其他扩展改写消息，可能与 provider 实际看到的上下文不同。
 
-在 `webSearch.models` 中填写精确的模型标识：
+将 `compaction.remoteV2ContextSource` 设为 `"pi-context-hook"` 可主动启用 Pi 0.85.1 runtime bridge，让 Remote V2 压缩使用与实时 provider 请求相同的有序 `context` hook 链。如果 Pi 无法提供这条公开 hook 路径，Remote V2 会取消压缩，而不会发送未投影的历史。只有检查点来源标记与当前设置一致时，才会继续回放。在两种模式之间切换后，必须重新创建 Remote V2 检查点；如果自定义状态必须保留在不透明检查点中，请关闭 Remote V2，或使用 Pi 原生压缩。
+
+### 选择联网搜索路由
+
+联网搜索有三条互斥路由。可以设置一个全局默认路由，也可以按精确的 `provider/model-id` 覆盖：
 
 ```json
 {
   "webSearch": {
-    "models": ["my-gateway/gpt-5.6-luna"]
+    "enabled": true,
+    "defaultRoute": "hosted",
+    "routes": {
+      "uwoacrimson/gpt-6-astra": "standalone-alpha",
+      "my-gateway/gpt-5.6-luna": "local"
+    }
   }
 }
 ```
 
-对于这些模型，扩展会用 OpenAI 托管的 Responses 搜索工具替代 Pi 本地的 `web_search` 工具。
+路由选择是精确且确定的：`routes[provider/model-id]` 优先于 `defaultRoute`，`defaultRoute` 优先于旧版 `models` 列表。不支持通配符、模糊模型匹配、按模型名称猜能力、路由间 fallback 或重试。无效的路由值或模型键会告警后忽略，不会猜测路由；新旧字段重叠时会给出迁移告警。`enabled: false` 会释放工具包的工具所有权，并关闭工具包选择的全部三条路径。
+
+- **`local`** 保留已经安装的 `pi-web-access` `web_search` 工具。如果它原本没有激活，工具包不会替你激活；同时不会添加托管 provider 工具或 `web.run`。
+- **`hosted`** 移除名为 `web_search` 的本地 function，并注入原生 Responses `{ "type": "web_search" }` 工具和来源标注。旧版配置仍然有效：
+
+  ```json
+  {
+    "webSearch": {
+      "models": ["my-gateway/gpt-5.6-luna"]
+    }
+  }
+  ```
+
+  没有配置新路由字段时，只有精确命中该列表、且 API 属于现有 Responses 系列（`openai-responses` 或 `openai-codex-responses`）的模型会使用托管搜索。
+- **`standalone-alpha`** 暴露一个 sequential 的 `web.run` 工具，并向 provider 相对的 `/alpha/search` 端点发送一次隔离的 `POST` 请求。例如基础地址是 `https://gateway.example/v1` 时，请求地址是 `https://gateway.example/v1/alpha/search`，不会变成 Responses 端点。支持的命令族包括 `search_query`、`image_query`、`open`、`click`、`find`、`screenshot`、`finance`、`weather`、`sports` 和 `time`；`response_length` 用于调整请求的结果长度。
+
+standalone 路由属于实验性的 CPA/Codex 网关协议，不是稳定的公开 OpenAI Responses 端点。网关/provider 必须提供 `/alpha/search`、启用 `alpha-search` 能力，并支持 standalone web search（Codex provider 通常以 `supports_standalone_web_search = true` 表示）。请求会复用 Pi 当前模型、认证、provider headers、会话标识及 Codex/gateway affinity，不会切换当前模型。MVP 发送受边界限制的命令 envelope，而不是完整会话 transcript；`ref_id` 后续操作依赖 provider 的会话/引用处理；每次工具调用最多发送一次请求；配置无效、路由不可用、取消、超时、非 2xx、响应畸形或超限时都会 fail closed。
 
 ### 生成图片
 
@@ -174,7 +199,7 @@ pi --model my-gateway/gpt-5.6-luna
 }
 ```
 
-在会话中使用 `/auto on`。默认的 `side-effect` 审查范围覆盖 `bash`、`write`、`edit` 和额外配置的工具。如果需要审查所有工具调用，将 `gate` 设置为 `"all"`。审查超时不会自动放行调用。
+在会话中使用 `/auto on`，也可以用 `--auto` 启动 Pi。TUI 会显示自动模式已开启的提示；每次审查受控工具时，工作指示器会临时显示 `Auto mode: reviewing <tool>`，底部状态栏会保留当前审查范围。在支持兼容 tool renderer 的 Pi 版本中，自动模式下每个工具块底部都会显示一行状态：已审查的调用会显示 `allowed by reviewer · low risk · authorization medium` 或 `denied · <reason>`，不在当前审查范围内的调用会显示 `not reviewed · outside the configured gate`。如果当前 Pi 没有这个 renderer seam，扩展会告警一次并继续使用底部状态栏提示。默认的 `side-effect` 审查范围覆盖 `bash`、`write`、`edit` 和额外配置的工具。如果需要审查所有工具调用，将 `gate` 设置为 `"all"`。审查超时不会自动放行调用。
 
 ## 常用配置
 
@@ -186,8 +211,12 @@ pi --model my-gateway/gpt-5.6-luna
 | `compaction.contextManagement` | `"off"` | 设置为 `"remote"` 后启用 Codex 远程上下文。 |
 | `compaction.gatewayContextModels` | `[]` | 允许使用远程上下文的网关模型。 |
 | `compaction.remoteCompactModel` | 未设置 | 仅用于 v2 压缩请求的可选模型。 |
+| `compaction.remoteV2ContextSource` | `"legacy"` | 保留原来的原始 session/branch 输入路径。设置为 `"pi-context-hook"` 后才启用 Pi 的有序 context hook projection。检查点与模式绑定。 |
 | `compaction.contextReminderThresholdPercent` | `5` | 每个窗口触发一次提醒的剩余预算百分比。设置为 `0` 会关闭提醒和窗口耗尽兜底。 |
-| `webSearch.models` | `[]` | 使用托管联网搜索的模型。 |
+| `webSearch.enabled` | `true` | 工具包联网搜索路由的总开关。设为 `false` 时不选择任何工具包路由。 |
+| `webSearch.defaultRoute` | 未设置 | 默认路由：`local`、`hosted` 或 `standalone-alpha`。未设置时保留旧版行为。 |
+| `webSearch.routes` | 未设置 | 精确的 `provider/model-id` 路由覆盖。精确条目优先于 `defaultRoute`。 |
+| `webSearch.models` | `[]` | 旧版精确白名单；没有新路由字段时，列表中的 Responses 系列模型使用托管联网搜索。 |
 | `imageGeneration.enabled` | `false` | 启用 `openai_generate_image`。 |
 | `imageGeneration.models` | `["gpt-image-2.5"]` | 裸生图模型 ID；列表第一项是默认模型。 |
 | `autoMode.models` | `[]` | 允许使用自动模式的模型。 |

package/docs/internals.md

@@ -9,6 +9,7 @@ Developer-facing reference for [pi-openai-toolkit](../README.md). The README kee
 - [Remote Context protocol](#remote-context-protocol)
 - [Rollover lifecycle](#rollover-lifecycle)
 - [Remote Compaction v2 wire contract](#remote-compaction-v2-wire-contract)
+- [Auto Mode TUI review renderer](#auto-mode-tui-review-renderer)
 - [Artifacts and debugging](#artifacts-and-debugging)
 - [Provenance](#provenance)
 
@@ -59,8 +60,10 @@ sequenceDiagram
 State invariants the lifecycle code must keep honest:
 
 - The checkpoint gate verifies a successful `notes` `append_to_file` or `write_file` against the persisted session branch after the latest window boundary, so it survives restarts and forks. A response with `ok: false` or `success: false` is not successful, even when HTTP returns 200.
+- The gate uses the live session/branch identity from `ctx.sessionManager`; cached manager identity must not hide a valid current-window pair, and old or foreign-session evidence must remain rejected.
 - Every rollover carries the most recent successful checkpoint path in its handoff message. The optional `thread_hint` is supplemental; a hint failure must not erase the local receipt.
-- `new_context` has no force escape hatch: a successful notes checkpoint is always required before rollover.
+- `new_context` has no force escape hatch: a persisted successful notes checkpoint in the current window is always required before rollover. The model must wait for the notes result to be persisted before retrying.
+- After a marker is accepted for sending, the manager keeps a session/window-anchored pending guard until that exact target marker is persisted or the session changes. A duplicate `new_context` during this persistence gap returns `started: false` and sends no second marker; projected/in-memory messages do not retire the guard.
 - Budget checks are skipped until the current window has produced its own assistant usage. Acting on the previous window's usage anchor would burn the once-per-window reminder on a false alarm.
 - The scheduled trim is consumed exactly once, synchronously, by the first compaction attempt whose boundary window ID matches. Every other compaction path, including a threshold without a scheduled rollover, manual `/compact`, and overflow, is cancelled.
 - A window boundary is persisted as a `codex-context-window` custom message. `session_start` replays boundaries from the branch and rebuilds identity after forks.
@@ -75,6 +78,29 @@ A `compaction_trigger` item appended to the live streaming request yields one ou
 
 A v2 response with a missing or empty checkpoint is never stored, and the `nativeFallback` tier is skipped. Pi's own threshold drives the next attempt, which may use `remoteCompactModel` when configured. `remoteCompactModel` must resolve to the same effective base URL as the active model.
 
+Pi 0.85.1's `session_before_compact` event supplies preparation and branch data, while the direct Remote V2 client can bypass the provider `context` hook chain. To preserve compatibility, an omitted `compaction.remoteV2ContextSource` keeps the original `"legacy"` behavior: first compaction uses `buildSessionContext()` and falls back to `SessionBeforeCompactEvent.preparation`, while recursion uses the opaque window plus the raw branch tail.
+
+Setting `compaction.remoteV2ContextSource: "pi-context-hook"` opts into a narrow runtime bridge around Pi's public `ExtensionRunner.createContext()`. It adds a non-enumerable `ctx.projectContextForCompaction(messages)` method backed by `ExtensionRunner.emitContext()`. In this opt-in mode, Remote V2 first reads `buildSessionContext()` and then runs the ordered projection. If the bridge, session context, or recursive summary anchor is unavailable, the extension cancels rather than sending an unprojected history. The legacy mode is an intentional compatibility trade-off and does not claim parity with provider-visible context hooks.
+
+New checkpoints record `inputProvenance: "pi-context-hook-v1"` or `"legacy-raw-context-v1"`, and replay/recursion reject missing or mode-mismatched markers without searching past the latest compaction. Retained `role: "custom"` messages are optional during replay because they may be changed or removed by context hooks; required user, assistant, and complete tool-call/result content remains ordered and fail-closed.
+
+---
+
+### Auto Mode TUI review renderer
+
+Auto Mode owns the review decision, but Pi owns the built-in tool-block component. Pi 0.85.1 exports `ToolExecutionComponent` without a public decorator interface, so `src/auto-mode/tool-review-tui.ts` installs a narrow, idempotent compatibility patch on its `render()` method. The patch only reads the component's existing tool-call ID and appends one bounded, single-line status after the normal block output; it never changes tool execution, event ordering, or provider payloads.
+
+The extension updates an ephemeral per-call state through the same `tool_call` lifecycle that performs the review:
+
+- `skipped` when the tool is outside the configured Auto Mode gate;
+- `reviewing` while the reviewer model is running;
+- `awaiting-user` when an unavailable review reaches interactive confirmation;
+- `allowed`, `denied`, or `blocked` after the final decision.
+
+The state is intentionally not persisted to the session. It is bounded to recent calls and cleared at `session_start`, so reloading a session does not invent historical approval claims. The renderer uses Pi's current theme when available, truncates untrusted rationale text, and preserves the original render output when no state exists.
+
+This is a version-coupled adapter, not a stable Pi extension contract. It is feature-detected at registration time and marked with a global symbol so extension reloads do not wrap the class repeatedly. If the exported component shape changes or becomes non-writable, the adapter becomes a no-op, emits one warning in TUI mode, and the existing footer/working-message review indicators remain the fallback.
+
 ---
 
 ### Artifacts and debugging

package/extensions/auto-mode.ts

@@ -1 +1 @@
-export { default } from "../src/auto-mode/extension.ts";
+export { default } from "../src/auto-mode/extension.ts";

package/extensions/codex-astra.ts

@@ -1 +1 @@
-export { default } from "../src/codex-astra/extension.ts";
+export { default } from "../src/codex-astra/extension.ts";

package/extensions/compaction.ts

@@ -1 +1 @@
-export { default } from "../src/extension-runtime.ts";
+export { default } from "../src/extension-runtime.ts";

package/extensions/image-generation.ts

@@ -1 +1 @@
-export { default } from "../src/image-generation/extension.ts";
+export { default } from "../src/image-generation/extension.ts";

package/extensions/web-search.ts

@@ -1 +1 @@
-export { default } from "../src/web-search/extension.ts";
+export { default } from "../src/web-search/extension.ts";

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "pi-openai-toolkit",
-  "version": "0.14.7",
+  "version": "0.14.9",
   "private": false,
   "type": "module",
   "engines": {
     "node": ">=22.19.0"
   },
-  "description": "OpenAI toolkit for Pi: Codex Remote Context windows, remote compaction v2, hosted Web Search, image gen, auto mode.",
+  "description": "OpenAI toolkit for Pi: Codex Remote Context windows, remote compaction v2, routed Web Search, image gen, auto mode.",
   "author": "awoaCrim and contributors",
   "license": "MIT",
   "repository": {
@@ -47,6 +47,8 @@
     "extensions/image-generation.ts",
     "extensions/auto-mode.ts",
     "src/compact-client.ts",
+    "src/compaction-projection.ts",
+    "src/pi-context-hook.ts",
     "src/config.ts",
     "src/debug.ts",
     "src/details-store.ts",
@@ -72,6 +74,7 @@
     "src/image-generation/service.ts",
     "src/image-generation/types.ts",
     "src/auto-mode/extension.ts",
+    "src/auto-mode/tool-review-tui.ts",
     "src/auto-mode/policy.ts",
     "src/auto-mode/prompt.ts",
     "src/auto-mode/transcript.ts",
@@ -92,6 +95,7 @@
     "src/serializer.ts",
     "src/supported-environment.ts",
     "src/types.ts",
+    "src/web-search/alpha-client.ts",
     "src/web-search/extension.ts",
     "src/web-search/payload.ts",
     "src/web-search/prompt.ts",

package/src/auto-mode/classifier.ts

@@ -1,165 +1,165 @@
-import type { Api, Model } from "@earendil-works/pi-ai";
-import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
-import { parseModelSpec } from "../runtime";
-import { CLASSIFIER_SYSTEM_PROMPT } from "./prompt";
-import { boundReviewText, type ClassifierRisk, type FastDecisionReason } from "./types";
-
-/** One completed classification of the trajectory, tagged to a tool-call position. */
-export type ScoreRecord = {
-	risk: ClassifierRisk;
-	/** Tool-call counter value when the sample was taken. */
-	scoredAtCall: number;
-	/** Fingerprint of the user turns the score was based on. */
-	authorizationVersion: string;
-	sampledAt: number;
-};
-
-/**
- * Mutable per-session tracker for the non-blocking pre-scorer.
- *
- * The counters reproduce Codex's staleness rule: the agent keeps running while a
- * classification is in flight, so a score is only trustworthy if it is recent
- * enough and nothing the user said has changed underneath it.
- */
-export type ScoreTracker = {
-	latestCallIndex: number;
-	latestScoredIndex: number;
-	latestFailedIndex: number;
-	score?: ScoreRecord;
-};
-
-export function createScoreTracker(): ScoreTracker {
-	return { latestCallIndex: 0, latestScoredIndex: 0, latestFailedIndex: 0 };
-}
-
-/** Reset everything: a new turn or a disengaged mode invalidates prior scoring. */
-export function resetScoreTracker(tracker: ScoreTracker): void {
-	tracker.latestCallIndex = 0;
-	tracker.latestScoredIndex = 0;
-	tracker.latestFailedIndex = 0;
-	tracker.score = undefined;
-}
-
-/**
- * Fingerprint of the user-authored conversation. Any new or edited user turn makes
- * an existing score stale, because the score's authorization premise changed.
- */
-export function authorizationVersion(userText: string): string {
-	const bounded = boundReviewText(userText, 8_000);
-	let hash = 2166136261;
-	for (let index = 0; index < bounded.length; index += 1) {
-		hash ^= bounded.charCodeAt(index);
-		hash = Math.imul(hash, 16777619);
-	}
-	return `${bounded.length}:${(hash >>> 0).toString(36)}`;
-}
-
-export function recordScoredCall(tracker: ScoreTracker, score: ScoreRecord): void {
-	tracker.score = score;
-	tracker.latestScoredIndex = Math.max(tracker.latestScoredIndex, score.scoredAtCall);
-}
-
-export function recordFailedCall(tracker: ScoreTracker, scoredAtCall: number): void {
-	tracker.latestFailedIndex = Math.max(tracker.latestFailedIndex, scoredAtCall);
-}
-
-export type FastDecisionInput = {
-	tracker: ScoreTracker;
-	/** Tool-call counter value for the call being gated. */
-	currentCallIndex: number;
-	authorizationVersion: string;
-	maxLag: number;
-	/** Retries after a denial and widened gates must not take the fast path. */
-	requiresSynchronousReview?: boolean;
-};
-
-/**
- * Decide whether a cached classification can satisfy this gated call without
- * running the blocking reviewer. Anything other than `low_risk` defers to the
- * synchronous review; the classifier never denies an action on its own.
- */
-export function fastApprovalEligible(input: FastDecisionInput): {
-	eligible: boolean;
-	reason: FastDecisionReason;
-} {
-	const defer = (reason: FastDecisionReason) => ({ eligible: false, reason });
-
-	if (input.requiresSynchronousReview) return defer("requires_synchronous_review");
-	if (input.tracker.latestFailedIndex > input.tracker.latestScoredIndex) return defer("scoring_failure");
-
-	const score = input.tracker.score;
-	if (!score) return defer("missing_score");
-
-	const lag = input.currentCallIndex - score.scoredAtCall;
-	if (lag > input.maxLag) return defer("stale_score");
-	if (score.authorizationVersion !== input.authorizationVersion) return defer("authorization_changed");
-	if (score.risk === "low") return { eligible: true, reason: "low_risk" };
-	return defer("elevated_risk");
-}
-
-export type ClassificationResult =
-	| { kind: ClassifierRisk; model: string }
-	| { kind: "failed"; reason: string };
-
-/**
- * Run one non-blocking classification. Output is a single token; anything else is a
- * failed sample rather than a verdict, so a confused classifier costs a review and
- * never an approval or a denial.
- */
-export async function classifyTrajectory(params: {
-	registry: Pick<ModelRegistry, "find" | "complete">;
-	modelSpec: string;
-	prompt: string;
-	timeoutMs: number;
-	signal?: AbortSignal;
-}): Promise<ClassificationResult> {
-	const parsed = parseModelSpec(params.modelSpec);
-	if (!parsed) {
-		return { kind: "failed", reason: `autoMode.classifier.model "${params.modelSpec}" is not provider/model-id.` };
-	}
-	const model = params.registry.find(parsed.provider, parsed.modelId) as Model<Api> | undefined;
-	if (!model) {
-		return { kind: "failed", reason: `Classifier model ${params.modelSpec} is not available.` };
-	}
-	const label = boundReviewText(`${model.provider}/${model.id}`, 256);
-
-	const controller = new AbortController();
-	const abortFromCaller = () => controller.abort();
-	if (params.signal?.aborted) controller.abort();
-	else params.signal?.addEventListener("abort", abortFromCaller);
-	const timer = setTimeout(() => controller.abort(), params.timeoutMs);
-
-	try {
-		const response = await params.registry.complete(
-			model,
-			{
-				systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
-				messages: [
-					{
-						role: "user",
-						content: [{ type: "text", text: params.prompt }],
-						timestamp: Date.now(),
-					},
-				],
-			},
-			{ signal: controller.signal, cacheRetention: "none" },
-		);
-		if (response.stopReason === "error" || response.stopReason === "aborted") {
-			return { kind: "failed", reason: response.errorMessage ?? `Classifier stopped: ${response.stopReason}` };
-		}
-		const text = response.content
-			.filter((block): block is { type: "text"; text: string } => block.type === "text")
-			.map((block) => block.text)
-			.join("")
-			.trim()
-			.toLowerCase();
-		if (/^high\b/.test(text)) return { kind: "high", model: label };
-		if (/^low\b/.test(text)) return { kind: "low", model: label };
-		return { kind: "failed", reason: `Classifier returned unreadable output: ${boundReviewText(text, 80)}` };
-	} catch (error) {
-		return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
-	} finally {
-		clearTimeout(timer);
-		params.signal?.removeEventListener("abort", abortFromCaller);
-	}
-}
+import type { Api, Model } from "@earendil-works/pi-ai";
+import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { parseModelSpec } from "../runtime";
+import { CLASSIFIER_SYSTEM_PROMPT } from "./prompt";
+import { boundReviewText, type ClassifierRisk, type FastDecisionReason } from "./types";
+
+/** One completed classification of the trajectory, tagged to a tool-call position. */
+export type ScoreRecord = {
+	risk: ClassifierRisk;
+	/** Tool-call counter value when the sample was taken. */
+	scoredAtCall: number;
+	/** Fingerprint of the user turns the score was based on. */
+	authorizationVersion: string;
+	sampledAt: number;
+};
+
+/**
+ * Mutable per-session tracker for the non-blocking pre-scorer.
+ *
+ * The counters reproduce Codex's staleness rule: the agent keeps running while a
+ * classification is in flight, so a score is only trustworthy if it is recent
+ * enough and nothing the user said has changed underneath it.
+ */
+export type ScoreTracker = {
+	latestCallIndex: number;
+	latestScoredIndex: number;
+	latestFailedIndex: number;
+	score?: ScoreRecord;
+};
+
+export function createScoreTracker(): ScoreTracker {
+	return { latestCallIndex: 0, latestScoredIndex: 0, latestFailedIndex: 0 };
+}
+
+/** Reset everything: a new turn or a disengaged mode invalidates prior scoring. */
+export function resetScoreTracker(tracker: ScoreTracker): void {
+	tracker.latestCallIndex = 0;
+	tracker.latestScoredIndex = 0;
+	tracker.latestFailedIndex = 0;
+	tracker.score = undefined;
+}
+
+/**
+ * Fingerprint of the user-authored conversation. Any new or edited user turn makes
+ * an existing score stale, because the score's authorization premise changed.
+ */
+export function authorizationVersion(userText: string): string {
+	const bounded = boundReviewText(userText, 8_000);
+	let hash = 2166136261;
+	for (let index = 0; index < bounded.length; index += 1) {
+		hash ^= bounded.charCodeAt(index);
+		hash = Math.imul(hash, 16777619);
+	}
+	return `${bounded.length}:${(hash >>> 0).toString(36)}`;
+}
+
+export function recordScoredCall(tracker: ScoreTracker, score: ScoreRecord): void {
+	tracker.score = score;
+	tracker.latestScoredIndex = Math.max(tracker.latestScoredIndex, score.scoredAtCall);
+}
+
+export function recordFailedCall(tracker: ScoreTracker, scoredAtCall: number): void {
+	tracker.latestFailedIndex = Math.max(tracker.latestFailedIndex, scoredAtCall);
+}
+
+export type FastDecisionInput = {
+	tracker: ScoreTracker;
+	/** Tool-call counter value for the call being gated. */
+	currentCallIndex: number;
+	authorizationVersion: string;
+	maxLag: number;
+	/** Retries after a denial and widened gates must not take the fast path. */
+	requiresSynchronousReview?: boolean;
+};
+
+/**
+ * Decide whether a cached classification can satisfy this gated call without
+ * running the blocking reviewer. Anything other than `low_risk` defers to the
+ * synchronous review; the classifier never denies an action on its own.
+ */
+export function fastApprovalEligible(input: FastDecisionInput): {
+	eligible: boolean;
+	reason: FastDecisionReason;
+} {
+	const defer = (reason: FastDecisionReason) => ({ eligible: false, reason });
+
+	if (input.requiresSynchronousReview) return defer("requires_synchronous_review");
+	if (input.tracker.latestFailedIndex > input.tracker.latestScoredIndex) return defer("scoring_failure");
+
+	const score = input.tracker.score;
+	if (!score) return defer("missing_score");
+
+	const lag = input.currentCallIndex - score.scoredAtCall;
+	if (lag > input.maxLag) return defer("stale_score");
+	if (score.authorizationVersion !== input.authorizationVersion) return defer("authorization_changed");
+	if (score.risk === "low") return { eligible: true, reason: "low_risk" };
+	return defer("elevated_risk");
+}
+
+export type ClassificationResult =
+	| { kind: ClassifierRisk; model: string }
+	| { kind: "failed"; reason: string };
+
+/**
+ * Run one non-blocking classification. Output is a single token; anything else is a
+ * failed sample rather than a verdict, so a confused classifier costs a review and
+ * never an approval or a denial.
+ */
+export async function classifyTrajectory(params: {
+	registry: Pick<ModelRegistry, "find" | "complete">;
+	modelSpec: string;
+	prompt: string;
+	timeoutMs: number;
+	signal?: AbortSignal;
+}): Promise<ClassificationResult> {
+	const parsed = parseModelSpec(params.modelSpec);
+	if (!parsed) {
+		return { kind: "failed", reason: `autoMode.classifier.model "${params.modelSpec}" is not provider/model-id.` };
+	}
+	const model = params.registry.find(parsed.provider, parsed.modelId) as Model<Api> | undefined;
+	if (!model) {
+		return { kind: "failed", reason: `Classifier model ${params.modelSpec} is not available.` };
+	}
+	const label = boundReviewText(`${model.provider}/${model.id}`, 256);
+
+	const controller = new AbortController();
+	const abortFromCaller = () => controller.abort();
+	if (params.signal?.aborted) controller.abort();
+	else params.signal?.addEventListener("abort", abortFromCaller);
+	const timer = setTimeout(() => controller.abort(), params.timeoutMs);
+
+	try {
+		const response = await params.registry.complete(
+			model,
+			{
+				systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
+				messages: [
+					{
+						role: "user",
+						content: [{ type: "text", text: params.prompt }],
+						timestamp: Date.now(),
+					},
+				],
+			},
+			{ signal: controller.signal, cacheRetention: "none" },
+		);
+		if (response.stopReason === "error" || response.stopReason === "aborted") {
+			return { kind: "failed", reason: response.errorMessage ?? `Classifier stopped: ${response.stopReason}` };
+		}
+		const text = response.content
+			.filter((block): block is { type: "text"; text: string } => block.type === "text")
+			.map((block) => block.text)
+			.join("")
+			.trim()
+			.toLowerCase();
+		if (/^high\b/.test(text)) return { kind: "high", model: label };
+		if (/^low\b/.test(text)) return { kind: "low", model: label };
+		return { kind: "failed", reason: `Classifier returned unreadable output: ${boundReviewText(text, 80)}` };
+	} catch (error) {
+		return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
+	} finally {
+		clearTimeout(timer);
+		params.signal?.removeEventListener("abort", abortFromCaller);
+	}
+}