pi-openai-toolkit 0.15.1 → 0.17.0

package/docs/internals.md

@@ -9,6 +9,7 @@ Developer-facing reference for [pi-openai-toolkit](../README.md). The README kee
 - [Configuration resolution](#configuration-resolution)
 - [Remote Context protocol](#remote-context-protocol)
 - [Rollover lifecycle](#rollover-lifecycle)
+- [Managed manual compact](#managed-manual-compact)
 - [Remote Compaction v2 wire contract](#remote-compaction-v2-wire-contract)
 - [Auto Mode TUI review renderer](#auto-mode-tui-review-renderer)
 - [Artifacts and debugging](#artifacts-and-debugging)
@@ -20,7 +21,7 @@ Developer-facing reference for [pi-openai-toolkit](../README.md). The README kee
 
 The single global document is loaded through [src/config.ts](../src/config.ts). [src/config/legacy.ts](../src/config/legacy.ts) owns unversioned compatibility; [src/config/v2.ts](../src/config/v2.ts) validates v2 scopes, resolves exact policy, and records leaf origins. [src/config/policy.ts](../src/config/policy.ts) defines effective values independently of persisted session data. See the [configuration reference](configuration.md) for supported fields and migration limits.
 
-Feature entrypoints resolve once per public operation and pass that immutable snapshot through awaited helpers. A separately named compaction producer is resolved from the same decoded document for its own identity. Subsequent callbacks reload; there is no cross-event provider transaction, project lookup, singleton cache, or config state writer. Internal legacy-shaped engine adapters preserve compaction/search algorithms without exposing v2 parsing to consumers. Cross-feature gateway policy belongs to the resolver, not the context enable switch.
+Feature entrypoints resolve once per public operation and pass that immutable snapshot through awaited helpers. A separately named compaction producer is resolved from the same decoded document for its own identity. Subsequent independent callbacks reload; a managed manual handoff retains its initiating context-policy snapshot until selection is restored. There is no general cross-event provider transaction, project lookup, singleton cache, or config state writer. Internal legacy-shaped engine adapters preserve compaction/search algorithms without exposing v2 parsing to consumers. Cross-feature gateway policy belongs to the resolver, not the context enable switch.
 
 Selected invalid policy blocks dependent operations; unrelated model errors remain reportable without replacing the selected model. An engaged auto gate stays blocking when its policy becomes invalid. Image choices are checked before auth, uploads, or paid requests. The human `/toolkit-config` command inspects effective values, validation, or a migration candidate without action APIs or network access. Migration is preview-only; source bytes and unknown/dormant content stay untouched.
 
@@ -75,13 +76,13 @@ State invariants the lifecycle code must keep honest:
 - The gate uses the live session/branch identity from `ctx.sessionManager`; cached manager identity must not hide a valid current-window pair, and old or foreign-session evidence must remain rejected.
 - Every rollover carries the most recent successful checkpoint path in its handoff message. The optional `thread_hint` is supplemental; a hint failure must not erase the local receipt.
 - A successful rollover closes the pre-rollover checkpoint phase. The first turn in the new window reads the receipt once and resumes the active user task; it must not immediately create another checkpoint or call `new_context` as part of that handoff. A later checkpoint is only for a later rollover, and `canRolloverFromCurrentWindow()` enforces it: a window entered by a rollover has to produce a tool result from a tool that is not one of `new_context`, `get_context_remaining`, `history`, or `notes` before it can roll over again.
-- Pi 0.86 sends the system prompt and the entire tool loadout as `system` messages inside the transcript: `Agent#createContextSnapshot()` passes messages only, and the Responses transport rebuilds `params.tools` from the leading system message. Trimming everything before a window boundary therefore deletes the model's only tool declaration, and Pi never re-declares it because the persisted transcript still looks unchanged. `preserveSystemHead()` re-anchors the merged pre-boundary state as the leading message of every trimmed window.
+- Pi 0.87 separates conversation-only `context` handlers from full-transcript `context_with_system` handlers. Toolkit uses the latter to trim windows and re-anchor the merged prompt/tool state with `preserveSystemHead()`. The output owns its leading system message; Pi does not repair it after this phase.
 - When even that rebuild would lose declared tools, the trim is refused and the full message list is sent: a window that still carries the previous turns is usable, a window with no tools silently degrades into a chat the model can only narrate. Each refusal is reported once per window and lost-tool set through `takeProjectionDiagnostics()`, which writes a `context.projection.tool_loadout_shrink` compaction artifact and warns in the UI.
 - The manager also remembers the head it last anchored. When a boundary compaction retires the transcript entry that declared the tools, the branch itself no longer contains a system message, and the remembered head is re-anchored instead of sending a tool-less window. The cache is request-time only, refreshed by every projection, and cleared by `reset()`.
 - `new_context` has no force escape hatch: a persisted successful notes checkpoint in the current window is always required before rollover. The model must wait for the notes result to be persisted before retrying.
 - After a marker is accepted for sending, the manager keeps a session/window-anchored pending guard until that exact target marker is persisted or the session changes. A duplicate `new_context` during this persistence gap returns `started: false` and sends no second marker; projected/in-memory messages do not retire the guard.
 - Budget checks are skipped until the current window has produced its own assistant usage. Acting on the previous window's usage anchor would burn the once-per-window reminder on a false alarm.
-- The scheduled trim is consumed exactly once, synchronously, by the first compaction attempt whose boundary window ID matches. Every other compaction path, including a threshold without a scheduled rollover, manual `/compact`, and overflow, is cancelled.
+- Preparing a boundary never consumes its scheduled trim. The manager reconciles the latest persisted compaction and branch state, so only a durable matching boundary consumes it. Missing/late callbacks, aborted preparation and navigation across branches sharing a marker remain retryable. Automatic threshold/overflow and toolkit-owned manual maintenance only trim a matching scheduled window; a user manual `/compact` follows the managed handoff below.
 - A window boundary is persisted as a `codex-context-window` custom message. `session_start` replays boundaries from the branch and rebuilds identity after forks.
 - Retiring windows is a projection-level act: the session branch keeps every retired window until a compaction consumes the scheduled trim. `evaluateWindowBulk()` measures that gap and compares it with the model about to receive it, `decideBulkCliffAction()` maps the report onto the `leaveManagedMode` policy (`warn` default, `compact`), and `decideBulkCloseOut()` only allows the automatic compaction where a compaction can actually finish: never in print mode (the process exits with the turn and would kill the summary), and at turn end only while a rollover trim is queued, because the window policy cancels every other compaction. Each window and model is surfaced once, and every decision writes a `window-bulk.<action>` compaction artifact with its trigger.
 - The close-out runs from `model_select` and `agent_settled`, never from `before_agent_start`: `ExtensionContext.compact()` aborts the running turn, and a hook inside turn processing is exactly the busy lane it must not fight.
@@ -89,17 +90,39 @@ State invariants the lifecycle code must keep honest:
 
 ---
 
+### Managed manual compact
+
+[src/context-management/manual-compact.ts](../src/context-management/manual-compact.ts) owns manual checkpoint duty. It uses public Pi lifecycle and selection APIs; it does not replace the built-in command or patch the scheduler. [src/context-management/window-manager.ts](../src/context-management/window-manager.ts) remains the sole owner of notes pairing, window identity, projection and trim.
+
+1. An active managed `session_before_compact` with reason `manual` validates the source/target policies from one snapshot, actual permitted tools, remaining capacity, backend/account scope and approval eligibility. It records the original model/thinking and cancels the native compact attempt. Internal window-bulk maintenance has a separate in-process owner even though Pi also labels it `manual`.
+2. The matching `session_compact_failed` callback launches duty only after Pi is idle. Public `setModel` changes the session selection, and a visible `sendUserMessage` rebuilds the target's normal prompt/tools. Delivery is observed through `message_start`; return from the fire-and-forget send API is not proof. A delivery timeout restores an abandoned idle selection.
+3. The existing `new_context` gate additionally requires a successful paired notes result after this operation and any later delivered user message. It records the exact target window before queueing a context-only marker, and returns a terminating result. Ordinary tools are blocked during checkpoint duty. Normal `new_context` outside this operation is unchanged.
+4. A terminating result alone does not stop mixed batches or queued messages. At `turn_end`, Toolkit requests abort without awaiting idle; context/request guards also refuse an unsafe continuation. The standard Responses and native Codex transports must not send an already-aborted continuation. Pi can deliver queued user content during that stop; it remains persisted and ordered for the original model.
+5. At `agent_settled`, after Pi has flushed custom messages, the controller verifies the exact durable marker and fresh checkpoint, restores original model/thinking, and sends one visible receipt-reading continuation. Pi 0.87 defers that continuation until every settled handler has returned, so later observers still see an idle session. Restoration finishes before the next provider request; marker `message_end` alone is not proof of persistence.
+
+Versioned `pi-openai-toolkit:manual-compact` custom entries record operation/session/branch/window identities, exact model keys, original thinking and phase. They contain no credentials, transcript copy or note contents. Reload/navigation reads the current branch and only recovers still-owned selection; it never retries notes, rollover or paid inference. A newer user model/thinking selection ends ownership. Failed restoration stays durable and blocks further provider requests until recovery or an explicit user selection.
+
+An engaged Auto Mode gate grants a session/operation-scoped selection lease through [src/auto-mode/model-selection-guard.ts](../src/auto-mode/model-selection-guard.ts). An ineligible target is refused. While switching, a later eligibility change cannot silently disengage the gate: calls remain blocked. The lease neither enables Auto Mode nor widens its allowlist.
+
+The underlying native compact promise still rejects its intentional cancellation. Empty/already-compacted sessions can fail before the extension hook. This is a separate handoff operation, not a fabricated successful native compaction. An observed user cancellation before the owned checkpoint stop restores selection without automatically resuming. Tests use the official Pi runtime, disk-backed sessions, isolated HOME/settings and synthetic Responses/native Codex traffic in [test/pi-managed-compact.test.ts](../test/pi-managed-compact.test.ts); they assert every request's model/thinking, marker/note order, retained tool head and queue preservation.
+
+---
+
 ### Remote Compaction v2 wire contract
 
 v2 is what an uncovered session gets. Any model that Remote Context declines, such as a gateway without an exact transport opt-in, can still compact through v2 when its API appears in `context.remoteCompaction.apis`. The two strategies never compete for one session.
 
 A `compaction_trigger` item appended to the live streaming request yields one output item of `type: "compaction"` with non-empty `encrypted_content`, stored in `CompactionEntry.details.compactedWindow`. On later requests the opaque checkpoint is replayed ahead of live turns, with no text summary. Replay fails closed: if the summary anchor cannot be located, the request is aborted with a notification and a content-free failure artifact. The sentinel-only payload is never sent.
 
+The incremental SSE consumer validates the first terminal event and reconciles its checkpoint with prior item evidence. A valid completed frame ends the operation even if the HTTP body stays open; reader cancellation is best-effort cleanup and is not awaited. Incomplete frames at EOF, conflicting checkpoint evidence and terminal errors cannot become successful checkpoints.
+
 A v2 response with a missing or empty checkpoint is never stored, and the `nativeFallback` tier is skipped. Pi's own threshold drives the next attempt, which may use `remoteCompactModel` when configured. `remoteCompactModel` must resolve to the same effective base URL as the active model.
 
-Pi 0.85.1's `session_before_compact` event supplies preparation and branch data, while the direct Remote V2 client can bypass the provider `context` hook chain. To preserve compatibility, an omitted `context.remoteCompaction.inputSource` keeps the original `"legacy"` behavior: first compaction uses `buildSessionContext()` and falls back to `SessionBeforeCompactEvent.preparation`, while recursion uses the opaque window plus the raw branch tail.
+Pi 0.87 makes `SessionManager` the source of model-visible context. An omitted `context.remoteCompaction.inputSource` keeps `"legacy"` behavior: first compaction reads `buildSessionProjection()` (falling back to Pi's preparation if unavailable), and recursion uses the opaque window plus the canonically projected branch tail. Both paths honor persisted context edits. Legacy mode still bypasses request-time extension transforms.
 
-Setting `context.remoteCompaction.inputSource: "pi-context-hook"` opts into a narrow runtime bridge around Pi's public `ExtensionRunner.createContext()`. It adds a non-enumerable `ctx.projectContextForCompaction(messages)` method backed by `ExtensionRunner.emitContext()`. In this opt-in mode, Remote V2 first reads `buildSessionContext()` and then runs the ordered projection. If the bridge, session context, or recursive summary anchor is unavailable, the extension cancels rather than sending an unprojected history. The legacy mode is an intentional compatibility trade-off and does not claim parity with provider-visible context hooks.
+Setting `context.remoteCompaction.inputSource: "pi-context-hook"` opts into a narrow runtime bridge around Pi's public `ExtensionRunner.createContext()`. It adds a non-enumerable `ctx.projectContextForCompaction(messages)` method backed by `ExtensionRunner.emitContext()`. This runs the ordered conversation-only and full-transcript phases on the canonical projection. If the bridge, session projection, or recursive summary anchor is unavailable, the extension cancels rather than sending unprojected history.
+
+Retained-message matching uses the SDK projection and source entry IDs, including omissions and replacements made before compaction. Older retained compaction entries contribute no second summary. A compaction whose kept boundary is its own ID retains no earlier messages. Edits to post-checkpoint input are applied to the live tail; an edit targeting history already sealed in an opaque checkpoint blocks replay and recursive compaction with `checkpoint-context-edited`. The encrypted checkpoint cannot be selectively rewritten. Start a new session or navigate before that checkpoint to rebuild from editable history; the raw log remains unchanged.
 
 New checkpoints record `inputProvenance: "pi-context-hook-v1"` or `"legacy-raw-context-v1"`, and replay/recursion reject missing or mode-mismatched markers without searching past the latest compaction. Retained `role: "custom"` messages are optional during replay because they may be changed or removed by context hooks; required user, assistant, and complete tool-call/result content remains ordered and fail-closed.
 
@@ -107,7 +130,9 @@ New checkpoints record `inputProvenance: "pi-context-hook-v1"` or `"legacy-raw-c
 
 ### Auto Mode TUI review renderer
 
-Auto Mode owns the review decision, but Pi owns the built-in tool-block component. Pi 0.85.1 exports `ToolExecutionComponent` without a public decorator interface, so `src/auto-mode/tool-review-tui.ts` installs a narrow, idempotent compatibility patch on its `render()` method. The patch only reads the component's existing tool-call ID and appends one bounded, single-line status after the normal block output; it never changes tool execution, event ordering, or provider payloads.
+Approval state is scoped to actual user-message delivery. Full structured user content is SHA-256 hashed independently of transcript truncation, and generation-owned classifier completions cannot overwrite newer samples. The bounded transcript selects recent user instructions first and reports omissions. The blocking reviewer and its read-only evidence loop share one deadline that also races uncooperative dependencies; timeout/cancellation is an unavailable review, never approval or a safety denial.
+
+Auto Mode owns the review decision, but Pi owns the built-in tool-block component. Pi 0.87 exports `ToolExecutionComponent` without a public decorator interface, so `src/auto-mode/tool-review-tui.ts` installs a narrow, idempotent compatibility patch on its `render()` method. The patch only reads the component's existing tool-call ID and appends one bounded, single-line status after the normal block output; it never changes tool execution, event ordering, or provider payloads.
 
 The extension updates an ephemeral per-call state through the same `tool_call` lifecycle that performs the review:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-openai-toolkit",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "private": false,
   "type": "module",
   "engines": {
@@ -63,6 +63,7 @@
     "src/context-management/window-request.ts",
     "src/context-management/window-bulk.ts",
     "src/context-management/window-manager.ts",
+    "src/context-management/manual-compact.ts",
     "src/context-management/codex-provider.ts",
     "src/context-management/history-notes.ts",
     "src/context-management/tools.ts",
@@ -80,6 +81,7 @@
     "src/auto-mode/extension.ts",
     "src/auto-mode/tool-review-tui.ts",
     "src/auto-mode/policy.ts",
+    "src/auto-mode/model-selection-guard.ts",
     "src/auto-mode/prompt.ts",
     "src/auto-mode/transcript.ts",
     "src/auto-mode/reviewer.ts",
@@ -118,16 +120,16 @@
     "typecheck": "tsc -p tsconfig.check.json"
   },
   "peerDependencies": {
-    "@earendil-works/pi-agent-core": ">=0.85.1",
-    "@earendil-works/pi-ai": ">=0.85.1",
-    "@earendil-works/pi-coding-agent": ">=0.85.1",
-    "@earendil-works/pi-tui": ">=0.85.1"
+    "@earendil-works/pi-agent-core": ">=0.87.0",
+    "@earendil-works/pi-ai": ">=0.87.0",
+    "@earendil-works/pi-coding-agent": ">=0.87.0",
+    "@earendil-works/pi-tui": ">=0.87.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-agent-core": "0.86.0",
-    "@earendil-works/pi-ai": "0.86.0",
-    "@earendil-works/pi-coding-agent": "0.86.0",
-    "@earendil-works/pi-tui": "0.86.0",
+    "@earendil-works/pi-agent-core": "0.87.0",
+    "@earendil-works/pi-ai": "0.87.0",
+    "@earendil-works/pi-coding-agent": "0.87.0",
+    "@earendil-works/pi-tui": "0.87.0",
     "@types/node": "24.12.4",
     "bun": "1.2.23",
     "typescript": "5.9.3"

package/src/auto-mode/classifier.ts

@@ -1,165 +1,161 @@
-import type { Api, Model } from "@earendil-works/pi-ai";
-import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
-import { parseModelSpec } from "../runtime";
-import { CLASSIFIER_SYSTEM_PROMPT } from "./prompt";
-import { boundReviewText, type ClassifierRisk, type FastDecisionReason } from "./types";
-
-/** One completed classification of the trajectory, tagged to a tool-call position. */
-export type ScoreRecord = {
-	risk: ClassifierRisk;
-	/** Tool-call counter value when the sample was taken. */
-	scoredAtCall: number;
-	/** Fingerprint of the user turns the score was based on. */
-	authorizationVersion: string;
-	sampledAt: number;
-};
-
-/**
- * Mutable per-session tracker for the non-blocking pre-scorer.
- *
- * The counters reproduce Codex's staleness rule: the agent keeps running while a
- * classification is in flight, so a score is only trustworthy if it is recent
- * enough and nothing the user said has changed underneath it.
- */
-export type ScoreTracker = {
-	latestCallIndex: number;
-	latestScoredIndex: number;
-	latestFailedIndex: number;
-	score?: ScoreRecord;
-};
-
-export function createScoreTracker(): ScoreTracker {
-	return { latestCallIndex: 0, latestScoredIndex: 0, latestFailedIndex: 0 };
-}
-
-/** Reset everything: a new turn or a disengaged mode invalidates prior scoring. */
-export function resetScoreTracker(tracker: ScoreTracker): void {
-	tracker.latestCallIndex = 0;
-	tracker.latestScoredIndex = 0;
-	tracker.latestFailedIndex = 0;
-	tracker.score = undefined;
-}
-
-/**
- * Fingerprint of the user-authored conversation. Any new or edited user turn makes
- * an existing score stale, because the score's authorization premise changed.
- */
-export function authorizationVersion(userText: string): string {
-	const bounded = boundReviewText(userText, 8_000);
-	let hash = 2166136261;
-	for (let index = 0; index < bounded.length; index += 1) {
-		hash ^= bounded.charCodeAt(index);
-		hash = Math.imul(hash, 16777619);
-	}
-	return `${bounded.length}:${(hash >>> 0).toString(36)}`;
-}
-
-export function recordScoredCall(tracker: ScoreTracker, score: ScoreRecord): void {
-	tracker.score = score;
-	tracker.latestScoredIndex = Math.max(tracker.latestScoredIndex, score.scoredAtCall);
-}
-
-export function recordFailedCall(tracker: ScoreTracker, scoredAtCall: number): void {
-	tracker.latestFailedIndex = Math.max(tracker.latestFailedIndex, scoredAtCall);
-}
-
-export type FastDecisionInput = {
-	tracker: ScoreTracker;
-	/** Tool-call counter value for the call being gated. */
-	currentCallIndex: number;
-	authorizationVersion: string;
-	maxLag: number;
-	/** Retries after a denial and widened gates must not take the fast path. */
-	requiresSynchronousReview?: boolean;
-};
-
-/**
- * Decide whether a cached classification can satisfy this gated call without
- * running the blocking reviewer. Anything other than `low_risk` defers to the
- * synchronous review; the classifier never denies an action on its own.
- */
-export function fastApprovalEligible(input: FastDecisionInput): {
-	eligible: boolean;
-	reason: FastDecisionReason;
-} {
-	const defer = (reason: FastDecisionReason) => ({ eligible: false, reason });
-
-	if (input.requiresSynchronousReview) return defer("requires_synchronous_review");
-	if (input.tracker.latestFailedIndex > input.tracker.latestScoredIndex) return defer("scoring_failure");
-
-	const score = input.tracker.score;
-	if (!score) return defer("missing_score");
-
-	const lag = input.currentCallIndex - score.scoredAtCall;
-	if (lag > input.maxLag) return defer("stale_score");
-	if (score.authorizationVersion !== input.authorizationVersion) return defer("authorization_changed");
-	if (score.risk === "low") return { eligible: true, reason: "low_risk" };
-	return defer("elevated_risk");
-}
-
-export type ClassificationResult =
-	| { kind: ClassifierRisk; model: string }
-	| { kind: "failed"; reason: string };
-
-/**
- * Run one non-blocking classification. Output is a single token; anything else is a
- * failed sample rather than a verdict, so a confused classifier costs a review and
- * never an approval or a denial.
- */
-export async function classifyTrajectory(params: {
-	registry: Pick<ModelRegistry, "find" | "complete">;
-	modelSpec: string;
-	prompt: string;
-	timeoutMs: number;
-	signal?: AbortSignal;
-}): Promise<ClassificationResult> {
-	const parsed = parseModelSpec(params.modelSpec);
-	if (!parsed) {
-		return { kind: "failed", reason: `autoMode.classifier.model "${params.modelSpec}" is not provider/model-id.` };
-	}
-	const model = params.registry.find(parsed.provider, parsed.modelId) as Model<Api> | undefined;
-	if (!model) {
-		return { kind: "failed", reason: `Classifier model ${params.modelSpec} is not available.` };
-	}
-	const label = boundReviewText(`${model.provider}/${model.id}`, 256);
-
-	const controller = new AbortController();
-	const abortFromCaller = () => controller.abort();
-	if (params.signal?.aborted) controller.abort();
-	else params.signal?.addEventListener("abort", abortFromCaller);
-	const timer = setTimeout(() => controller.abort(), params.timeoutMs);
-
-	try {
-		const response = await params.registry.complete(
-			model,
-			{
-				systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
-				messages: [
-					{
-						role: "user",
-						content: [{ type: "text", text: params.prompt }],
-						timestamp: Date.now(),
-					},
-				],
-			},
-			{ signal: controller.signal, cacheRetention: "none" },
-		);
-		if (response.stopReason === "error" || response.stopReason === "aborted") {
-			return { kind: "failed", reason: response.errorMessage ?? `Classifier stopped: ${response.stopReason}` };
-		}
-		const text = response.content
-			.filter((block): block is { type: "text"; text: string } => block.type === "text")
-			.map((block) => block.text)
-			.join("")
-			.trim()
-			.toLowerCase();
-		if (/^high\b/.test(text)) return { kind: "high", model: label };
-		if (/^low\b/.test(text)) return { kind: "low", model: label };
-		return { kind: "failed", reason: `Classifier returned unreadable output: ${boundReviewText(text, 80)}` };
-	} catch (error) {
-		return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
-	} finally {
-		clearTimeout(timer);
-		params.signal?.removeEventListener("abort", abortFromCaller);
-	}
-}
+import { createHash } from "node:crypto";
+import type { Api, Model } from "@earendil-works/pi-ai";
+import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { parseModelSpec } from "../runtime";
+import { CLASSIFIER_SYSTEM_PROMPT } from "./prompt";
+import { boundReviewText, type ClassifierRisk, type FastDecisionReason } from "./types";
+
+/** One completed classification of the trajectory, tagged to a tool-call position. */
+export type ScoreRecord = {
+	risk: ClassifierRisk;
+	/** Tool-call counter value when the sample was taken. */
+	scoredAtCall: number;
+	/** Fingerprint of the user turns the score was based on. */
+	authorizationVersion: string;
+	sampledAt: number;
+};
+
+/**
+ * Mutable per-session tracker for the non-blocking pre-scorer.
+ *
+ * The counters reproduce Codex's staleness rule: the agent keeps running while a
+ * classification is in flight, so a score is only trustworthy if it is recent
+ * enough and nothing the user said has changed underneath it.
+ */
+export type ScoreTracker = {
+	latestCallIndex: number;
+	latestScoredIndex: number;
+	latestFailedIndex: number;
+	score?: ScoreRecord;
+};
+
+export function createScoreTracker(): ScoreTracker {
+	return { latestCallIndex: 0, latestScoredIndex: 0, latestFailedIndex: 0 };
+}
+
+/** Reset everything: a new turn or a disengaged mode invalidates prior scoring. */
+export function resetScoreTracker(tracker: ScoreTracker): void {
+	tracker.latestCallIndex = 0;
+	tracker.latestScoredIndex = 0;
+	tracker.latestFailedIndex = 0;
+	tracker.score = undefined;
+}
+
+/**
+ * Fingerprint of the user-authored conversation. Any new or edited user turn makes
+ * an existing score stale, because the score's authorization premise changed.
+ */
+export function authorizationVersion(userText: string): string {
+	return createHash("sha256").update(userText).digest("hex");
+}
+
+export function recordScoredCall(tracker: ScoreTracker, score: ScoreRecord): void {
+	tracker.score = score;
+	tracker.latestScoredIndex = Math.max(tracker.latestScoredIndex, score.scoredAtCall);
+}
+
+export function recordFailedCall(tracker: ScoreTracker, scoredAtCall: number): void {
+	tracker.latestFailedIndex = Math.max(tracker.latestFailedIndex, scoredAtCall);
+}
+
+export type FastDecisionInput = {
+	tracker: ScoreTracker;
+	/** Tool-call counter value for the call being gated. */
+	currentCallIndex: number;
+	authorizationVersion: string;
+	maxLag: number;
+	/** Retries after a denial and widened gates must not take the fast path. */
+	requiresSynchronousReview?: boolean;
+};
+
+/**
+ * Decide whether a cached classification can satisfy this gated call without
+ * running the blocking reviewer. Anything other than `low_risk` defers to the
+ * synchronous review; the classifier never denies an action on its own.
+ */
+export function fastApprovalEligible(input: FastDecisionInput): {
+	eligible: boolean;
+	reason: FastDecisionReason;
+} {
+	const defer = (reason: FastDecisionReason) => ({ eligible: false, reason });
+
+	if (input.requiresSynchronousReview) return defer("requires_synchronous_review");
+	if (input.tracker.latestFailedIndex > input.tracker.latestScoredIndex) return defer("scoring_failure");
+
+	const score = input.tracker.score;
+	if (!score) return defer("missing_score");
+
+	const lag = input.currentCallIndex - score.scoredAtCall;
+	if (lag < 0 || lag > input.maxLag) return defer("stale_score");
+	if (score.authorizationVersion !== input.authorizationVersion) return defer("authorization_changed");
+	if (score.risk === "low") return { eligible: true, reason: "low_risk" };
+	return defer("elevated_risk");
+}
+
+export type ClassificationResult =
+	| { kind: ClassifierRisk; model: string }
+	| { kind: "failed"; reason: string };
+
+/**
+ * Run one non-blocking classification. Output is a single token; anything else is a
+ * failed sample rather than a verdict, so a confused classifier costs a review and
+ * never an approval or a denial.
+ */
+export async function classifyTrajectory(params: {
+	registry: Pick<ModelRegistry, "find" | "complete">;
+	modelSpec: string;
+	prompt: string;
+	timeoutMs: number;
+	signal?: AbortSignal;
+}): Promise<ClassificationResult> {
+	const parsed = parseModelSpec(params.modelSpec);
+	if (!parsed) {
+		return { kind: "failed", reason: `autoMode.classifier.model "${params.modelSpec}" is not provider/model-id.` };
+	}
+	const model = params.registry.find(parsed.provider, parsed.modelId) as Model<Api> | undefined;
+	if (!model) {
+		return { kind: "failed", reason: `Classifier model ${params.modelSpec} is not available.` };
+	}
+	const label = boundReviewText(`${model.provider}/${model.id}`, 256);
+
+	const controller = new AbortController();
+	const abortFromCaller = () => controller.abort();
+	if (params.signal?.aborted) controller.abort();
+	else params.signal?.addEventListener("abort", abortFromCaller);
+	const timer = setTimeout(() => controller.abort(), params.timeoutMs);
+
+	try {
+		const response = await params.registry.complete(
+			model,
+			{
+				systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
+				messages: [
+					{
+						role: "user",
+						content: [{ type: "text", text: params.prompt }],
+						timestamp: Date.now(),
+					},
+				],
+			},
+			{ signal: controller.signal, cacheRetention: "none" },
+		);
+		if (controller.signal.aborted) return { kind: "failed", reason: "Classifier was cancelled or timed out." };
+		if (response.stopReason === "error" || response.stopReason === "aborted") {
+			return { kind: "failed", reason: response.errorMessage ?? `Classifier stopped: ${response.stopReason}` };
+		}
+		const text = response.content
+			.filter((block): block is { type: "text"; text: string } => block.type === "text")
+			.map((block) => block.text)
+			.join("")
+			.trim()
+			.toLowerCase();
+		if (/^high\b/.test(text)) return { kind: "high", model: label };
+		if (/^low\b/.test(text)) return { kind: "low", model: label };
+		return { kind: "failed", reason: `Classifier returned unreadable output: ${boundReviewText(text, 80)}` };
+	} catch (error) {
+		return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
+	} finally {
+		clearTimeout(timer);
+		params.signal?.removeEventListener("abort", abortFromCaller);
+	}
+}