profclaw 2.3.0 → 2.4.0

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.4.0](https://github.com/profclaw/profclaw/compare/v2.3.0...v2.4.0) (2026-10-05)
+
+
+### Features
+
+* OS-level sandbox for the run bash tool ([#71](https://github.com/profclaw/profclaw/issues/71)) ([cc6ab33](https://github.com/profclaw/profclaw/commit/cc6ab33a7f683b20137b118e600300a200e88d72))
+* tamper-evident run receipts with verify and HTML viewer ([#74](https://github.com/profclaw/profclaw/issues/74)) ([322307f](https://github.com/profclaw/profclaw/commit/322307f35f843825d51f7f87ac2ee4ac2ee0af88))
+* token-efficient harness and verified autonomous run ([#68](https://github.com/profclaw/profclaw/issues/68)) ([68826ca](https://github.com/profclaw/profclaw/commit/68826ca9cd627aac6a6a9119b1c2178d6b7407be))
+
+
+### Bug Fixes
+
+* judge the first run attempt against a baseline, fix wrong unified diffs ([#70](https://github.com/profclaw/profclaw/issues/70)) ([19b47ad](https://github.com/profclaw/profclaw/commit/19b47ad6aa330e557f202c8a00d44d371153eb81))
+* time out the Docker ping so a wedged daemon cannot hang startup ([#72](https://github.com/profclaw/profclaw/issues/72)) ([72dd4f2](https://github.com/profclaw/profclaw/commit/72dd4f2ef42df0a0e5624518fb3b1b02ff0e374e))
+
 ## [2.3.0](https://github.com/profclaw/profclaw/compare/v2.2.0...v2.3.0) (2026-04-13)
 
 

package/README.md

@@ -17,12 +17,13 @@
   <img src="https://img.shields.io/badge/providers-35-f43f5e?style=for-the-badge" alt="35 providers">
   <img src="https://img.shields.io/badge/tools-72-fb7185?style=for-the-badge" alt="72 tools">
   <img src="https://img.shields.io/badge/channels-22-e11d48?style=for-the-badge" alt="22 channels">
+  <a href="https://discord.gg/Ar5pcaZB99"><img src="https://img.shields.io/discord/829168897080557579?style=for-the-badge&logo=discord&logoColor=white&label=discord&color=5865F2" alt="Discord"></a>
 </p>
 
 <p align="center">
   <a href="https://profclaw.ai/docs"><b>Docs</b></a> &middot;
   <a href="https://github.com/profclaw/profclaw/issues"><b>Report Bug</b></a> &middot;
-  <a href="https://discord.gg/profclaw"><b>Discord</b></a>
+  <a href="https://discord.gg/Ar5pcaZB99"><b>Discord</b></a>
 </p>
 
 ---
@@ -388,7 +389,9 @@ See [SECURITY.md](SECURITY.md) for our security policy and how to report vulnera
 - [Quickstart guide](https://docs.profclaw.ai/guides/quickstart)
 - [Full docs](https://docs.profclaw.ai)
 - [Report a bug](https://github.com/profclaw/profclaw/issues/new?template=bug_report.md)
-- [Discord](https://discord.gg/profclaw)
+- [Discord](https://discord.gg/Ar5pcaZB99): the #profclaw forum on the GLINR community server
+
+<a href="https://discord.gg/Ar5pcaZB99"><img src="https://discord.com/api/guilds/829168897080557579/widget.png?style=banner2" alt="Join the GLINR Discord" /></a>
 
 ## License
 

package/config/pricing.yml

@@ -3,6 +3,24 @@
 
 pricing:
   # Anthropic Models
+  # Verified: https://platform.claude.com/docs/en/about-claude/models/overview (2026-09-26)
+  claude-fable-5-1:
+    provider: anthropic
+    inputRate: 10.00
+    outputRate: 50.00
+  claude-opus-5-5:
+    provider: anthropic
+    inputRate: 4.00
+    outputRate: 20.00
+  claude-sonnet-5:
+    provider: anthropic
+    inputRate: 2.00
+    outputRate: 10.00
+  claude-haiku-4-5:
+    provider: anthropic
+    inputRate: 1.00
+    outputRate: 5.00
+  # Legacy (unverified this pass)
   claude-3-5-sonnet:
     provider: anthropic
     inputRate: 3.00
@@ -16,7 +34,7 @@ pricing:
     inputRate: 0.25
     outputRate: 1.25
 
-  # OpenAI Models
+  # OpenAI Models (unverified this pass, left unchanged)
   gpt-4o:
     provider: openai
     inputRate: 5.00
@@ -30,7 +48,7 @@ pricing:
     inputRate: 0.50
     outputRate: 1.50
 
-  # Google Models
+  # Google Models (unverified this pass, left unchanged)
   gemini-1.5-pro:
     provider: google
     inputRate: 3.50
@@ -40,6 +58,12 @@ pricing:
     inputRate: 0.35
     outputRate: 1.05
 
+  # Local open-weight models via Ollama: no per-token cost
+  gemma4:
+    provider: other
+    inputRate: 0
+    outputRate: 0
+
 defaultPricing:
   provider: other
   inputRate: 5.00

package/dist/agents/command-sandbox.d.ts

@@ -0,0 +1,93 @@
+/**
+ * OS-level confinement for shell commands run by `profclaw run`.
+ *
+ * Wraps a command so the kernel, not pattern matching, enforces the limits:
+ *  - writes only inside the worktree, a per-run temp dir, the git metadata the
+ *    worktree needs and a few device nodes (plus opt-in extras)
+ *  - reads are broad (node, pnpm, git and tsc need many system paths) but
+ *    credential directories such as ~/.ssh and ~/.aws are denied
+ *  - network is denied unless PROFCLAW_RUN_ALLOW_NETWORK is set
+ *
+ * Backends: macOS Seatbelt (`/usr/bin/sandbox-exec`) and Linux `bwrap`.
+ * Modes (PROFCLAW_RUN_SANDBOX): `auto` uses a sandbox when available and
+ * otherwise falls back to pattern screening with a one-time warning, `on`
+ * fails closed, `off` disables.
+ *
+ * Known limits: a writable git dir can be used to plant state outside the
+ * worktree (hooks and config are denied, other refs are not), and a sandboxed
+ * process can still read anything not in the deny list.
+ */
+export type SandboxMode = 'auto' | 'on' | 'off';
+export type SandboxBackend = 'seatbelt' | 'bwrap' | 'none';
+export interface SandboxAvailability {
+    backend: SandboxBackend;
+    /** Absolute path of the sandbox binary */
+    binary: string;
+}
+export interface SandboxOptions {
+    workdir: string;
+    /** Per-run scratch directory that is writable */
+    tempDir: string;
+    /** Home directory whose credential dirs are denied (default: os.homedir()) */
+    home?: string;
+    allowNetwork?: boolean;
+    /** Extra writable paths (e.g. the git dir of a linked worktree) */
+    extraWritable?: string[];
+    /** Paths inside an extraWritable tree that stay read-only (e.g. hooks) */
+    extraReadOnly?: string[];
+    /** Extra paths whose reads are denied */
+    extraDenyRead?: string[];
+}
+export interface SandboxPlan {
+    backend: SandboxBackend;
+    file: string;
+    args: string[];
+    /** Environment overrides the caller must merge in (TMPDIR) */
+    env: Record<string, string>;
+}
+export type DetectFn = () => SandboxAvailability;
+/** Home-relative locations holding credentials. Reads are denied. */
+export declare const SENSITIVE_HOME_PATHS: string[];
+/** Absolute credential locations outside of HOME. */
+export declare const SENSITIVE_ABSOLUTE_PATHS: string[];
+export declare function resolveSandboxMode(env?: NodeJS.ProcessEnv): SandboxMode;
+export declare function resolveAllowNetwork(env?: NodeJS.ProcessEnv): boolean;
+/** Extra writable paths from PROFCLAW_RUN_SANDBOX_WRITABLE (path-delimiter separated). */
+export declare function resolveExtraWritable(env?: NodeJS.ProcessEnv): string[];
+/** Resolve symlinks (Seatbelt matches real paths, e.g. /tmp is /private/tmp). */
+export declare function canonicalPath(path: string): string;
+/**
+ * Quote a path as an SBPL string literal. Backslash and double quote are
+ * escaped; control characters cannot be represented safely and are rejected,
+ * so a crafted path can never terminate the literal and inject rules.
+ */
+export declare function escapeSeatbeltString(value: string): string;
+/**
+ * Build the Seatbelt profile. SBPL applies the last matching rule, so the
+ * broad allow comes first and the specific denies and re-allows follow.
+ */
+export declare function buildSeatbeltProfile(options: SandboxOptions): string;
+export declare function buildBwrapArgs(options: SandboxOptions): string[];
+/**
+ * Detect a working sandbox. A probe run confirms it functions, since
+ * sandbox-exec fails when already inside a sandbox and bwrap can be blocked
+ * by unprivileged user namespace policy.
+ */
+export declare function detectSandbox(): SandboxAvailability;
+/** Test hook: allow the one-time warning to fire again. */
+export declare function resetSandboxWarning(): void;
+/** One-line description for CLI output. */
+export declare function describeSandbox(mode: SandboxMode, detect?: DetectFn, allowNetwork?: boolean): string;
+export interface PlanOptions {
+    mode?: SandboxMode;
+    detect?: DetectFn;
+    /** Receives the one-time fallback warning (default: stderr) */
+    warn?: (message: string) => void;
+    shell?: string;
+}
+/**
+ * Turn a shell command into the process to spawn. Throws in `on` mode when no
+ * sandbox is available. In `auto` mode falls back to the plain shell and warns once.
+ */
+export declare function planSandboxedCommand(command: string, options: SandboxOptions, plan?: PlanOptions): SandboxPlan;
+//# sourceMappingURL=command-sandbox.d.ts.map

package/dist/agents/command-sandbox.js

@@ -0,0 +1,235 @@
+/**
+ * OS-level confinement for shell commands run by `profclaw run`.
+ *
+ * Wraps a command so the kernel, not pattern matching, enforces the limits:
+ *  - writes only inside the worktree, a per-run temp dir, the git metadata the
+ *    worktree needs and a few device nodes (plus opt-in extras)
+ *  - reads are broad (node, pnpm, git and tsc need many system paths) but
+ *    credential directories such as ~/.ssh and ~/.aws are denied
+ *  - network is denied unless PROFCLAW_RUN_ALLOW_NETWORK is set
+ *
+ * Backends: macOS Seatbelt (`/usr/bin/sandbox-exec`) and Linux `bwrap`.
+ * Modes (PROFCLAW_RUN_SANDBOX): `auto` uses a sandbox when available and
+ * otherwise falls back to pattern screening with a one-time warning, `on`
+ * fails closed, `off` disables.
+ *
+ * Known limits: a writable git dir can be used to plant state outside the
+ * worktree (hooks and config are denied, other refs are not), and a sandboxed
+ * process can still read anything not in the deny list.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, realpathSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { delimiter, join, resolve } from 'node:path';
+/** Home-relative locations holding credentials. Reads are denied. */
+export const SENSITIVE_HOME_PATHS = [
+    '.ssh',
+    '.aws',
+    '.config/gh',
+    '.gnupg',
+    '.netrc',
+    '.git-credentials',
+    '.kube',
+    '.azure',
+    '.config/gcloud',
+    '.docker/config.json',
+    'Library/Keychains',
+];
+/** Absolute credential locations outside of HOME. */
+export const SENSITIVE_ABSOLUTE_PATHS = ['/Library/Keychains', '/private/var/db/dslocal'];
+// Environment parsing
+export function resolveSandboxMode(env = process.env) {
+    const raw = (env.PROFCLAW_RUN_SANDBOX ?? 'auto').trim().toLowerCase();
+    if (raw === 'on' || raw === 'off' || raw === 'auto')
+        return raw;
+    if (raw === '1' || raw === 'true')
+        return 'on';
+    if (raw === '0' || raw === 'false')
+        return 'off';
+    throw new Error(`Invalid PROFCLAW_RUN_SANDBOX "${raw}" (expected auto, on or off)`);
+}
+export function resolveAllowNetwork(env = process.env) {
+    const raw = (env.PROFCLAW_RUN_ALLOW_NETWORK ?? '').trim().toLowerCase();
+    return raw === '1' || raw === 'true' || raw === 'yes';
+}
+/** Extra writable paths from PROFCLAW_RUN_SANDBOX_WRITABLE (path-delimiter separated). */
+export function resolveExtraWritable(env = process.env) {
+    return (env.PROFCLAW_RUN_SANDBOX_WRITABLE ?? '')
+        .split(delimiter)
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0);
+}
+// Path handling
+/** Resolve symlinks (Seatbelt matches real paths, e.g. /tmp is /private/tmp). */
+export function canonicalPath(path) {
+    const absolute = resolve(path);
+    try {
+        return realpathSync(absolute);
+    }
+    catch {
+        return absolute;
+    }
+}
+/**
+ * Quote a path as an SBPL string literal. Backslash and double quote are
+ * escaped; control characters cannot be represented safely and are rejected,
+ * so a crafted path can never terminate the literal and inject rules.
+ */
+export function escapeSeatbeltString(value) {
+    if (/[\u0000-\u001f\u007f]/.test(value))
+        throw new Error('Path contains control characters and cannot be sandboxed');
+    return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+function subpath(path) {
+    return `(subpath ${escapeSeatbeltString(path)})`;
+}
+function deniedReadPaths(options) {
+    const home = canonicalPath(options.home ?? homedir());
+    return [
+        ...SENSITIVE_HOME_PATHS.map((p) => join(home, p)),
+        ...SENSITIVE_ABSOLUTE_PATHS,
+        ...(options.extraDenyRead ?? []).map(canonicalPath),
+    ];
+}
+// Seatbelt
+/**
+ * Build the Seatbelt profile. SBPL applies the last matching rule, so the
+ * broad allow comes first and the specific denies and re-allows follow.
+ */
+export function buildSeatbeltProfile(options) {
+    const writable = [options.workdir, options.tempDir, ...(options.extraWritable ?? [])].map(canonicalPath);
+    const readOnly = (options.extraReadOnly ?? []).map(canonicalPath);
+    const lines = [
+        '(version 1)',
+        '(allow default)',
+        '(deny file-write*)',
+        `(allow file-write* ${writable.map(subpath).join(' ')})`,
+        '(allow file-write* (literal "/dev/null") (literal "/dev/zero") (literal "/dev/tty") (literal "/dev/dtracehelper"))',
+    ];
+    if (readOnly.length > 0)
+        lines.push(`(deny file-write* ${readOnly.map(subpath).join(' ')})`);
+    lines.push(`(deny file-read* ${deniedReadPaths(options).map(subpath).join(' ')})`);
+    if (options.allowNetwork !== true)
+        lines.push('(deny network*)');
+    return `${lines.join('\n')}\n`;
+}
+// bubblewrap
+function isDirectory(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+export function buildBwrapArgs(options) {
+    const workdir = canonicalPath(options.workdir);
+    const tempDir = canonicalPath(options.tempDir);
+    const args = ['--ro-bind', '/', '/', '--dev', '/dev', '--proc', '/proc', '--die-with-parent', '--new-session'];
+    for (const path of [workdir, tempDir, ...(options.extraWritable ?? []).map(canonicalPath)]) {
+        args.push('--bind', path, path);
+    }
+    for (const path of (options.extraReadOnly ?? []).map(canonicalPath)) {
+        if (existsSync(path))
+            args.push('--ro-bind', path, path);
+    }
+    for (const path of deniedReadPaths(options)) {
+        if (!existsSync(path))
+            continue;
+        // Directories are hidden behind an empty tmpfs, files behind /dev/null.
+        args.push(...(isDirectory(path) ? ['--tmpfs', path] : ['--ro-bind', '/dev/null', path]));
+    }
+    if (options.allowNetwork !== true)
+        args.push('--unshare-net');
+    args.push('--chdir', workdir);
+    return args;
+}
+// Detection
+let cachedAvailability;
+function findOnPath(name) {
+    for (const dir of (process.env.PATH ?? '').split(delimiter)) {
+        if (dir.length > 0 && existsSync(join(dir, name)))
+            return join(dir, name);
+    }
+    return undefined;
+}
+/**
+ * Detect a working sandbox. A probe run confirms it functions, since
+ * sandbox-exec fails when already inside a sandbox and bwrap can be blocked
+ * by unprivileged user namespace policy.
+ */
+export function detectSandbox() {
+    if (cachedAvailability)
+        return cachedAvailability;
+    let found = { backend: 'none', binary: '' };
+    if (process.platform === 'darwin' && existsSync('/usr/bin/sandbox-exec')) {
+        const probe = spawnSync('/usr/bin/sandbox-exec', ['-p', '(version 1)(allow default)', '/usr/bin/true']);
+        if (probe.status === 0)
+            found = { backend: 'seatbelt', binary: '/usr/bin/sandbox-exec' };
+    }
+    else if (process.platform === 'linux') {
+        const bwrap = findOnPath('bwrap');
+        if (bwrap) {
+            const probe = spawnSync(bwrap, ['--ro-bind', '/', '/', '--unshare-net', 'true']);
+            if (probe.status === 0)
+                found = { backend: 'bwrap', binary: bwrap };
+        }
+    }
+    cachedAvailability = found;
+    return found;
+}
+// Planning
+let warned = false;
+/** Test hook: allow the one-time warning to fire again. */
+export function resetSandboxWarning() {
+    warned = false;
+}
+/** One-line description for CLI output. */
+export function describeSandbox(mode, detect = detectSandbox, allowNetwork = resolveAllowNetwork()) {
+    if (mode === 'off')
+        return 'Sandbox: off (pattern screening only)';
+    const { backend } = detect();
+    if (backend === 'none') {
+        return mode === 'on'
+            ? 'Sandbox: required but unavailable, bash commands will fail'
+            : 'Sandbox: unavailable, bash commands are pattern screened only';
+    }
+    return `Sandbox: ${mode} (${backend}, network ${allowNetwork ? 'allowed' : 'denied'})`;
+}
+/**
+ * Turn a shell command into the process to spawn. Throws in `on` mode when no
+ * sandbox is available. In `auto` mode falls back to the plain shell and warns once.
+ */
+export function planSandboxedCommand(command, options, plan = {}) {
+    const mode = plan.mode ?? resolveSandboxMode();
+    const shell = plan.shell ?? '/bin/sh';
+    const plain = { backend: 'none', file: shell, args: ['-c', command], env: {} };
+    if (mode === 'off')
+        return plain;
+    const available = (plan.detect ?? detectSandbox)();
+    if (available.backend === 'none') {
+        if (mode === 'on') {
+            throw new Error('PROFCLAW_RUN_SANDBOX=on but no sandbox is available (need sandbox-exec on macOS or bwrap on Linux)');
+        }
+        if (!warned) {
+            warned = true;
+            const message = '[profclaw] No OS sandbox available, shell commands are only pattern screened (set PROFCLAW_RUN_SANDBOX=on to require one).\n';
+            if (plan.warn)
+                plan.warn(message);
+            else
+                process.stderr.write(message);
+        }
+        return plain;
+    }
+    const env = { TMPDIR: canonicalPath(options.tempDir) };
+    if (available.backend === 'seatbelt') {
+        return {
+            backend: 'seatbelt',
+            file: available.binary,
+            args: ['-p', buildSeatbeltProfile(options), shell, '-c', command],
+            env,
+        };
+    }
+    return { backend: 'bwrap', file: available.binary, args: [...buildBwrapArgs(options), shell, '-c', command], env };
+}
+//# sourceMappingURL=command-sandbox.js.map

package/dist/agents/executor-runner.d.ts

@@ -0,0 +1,135 @@
+/**
+ * ExecutorRunner: the built-in model-backed AgentRunner for verified runs.
+ *
+ * Adapts AgentExecutor to the AgentRunner seam used by runVerifiedGoal:
+ * - runs the executor with the run's worktree as the only place it can touch
+ *   (worktree-confined tools plus the PermissionManager, never push or PR);
+ * - feeds it the goal plus the previous attempt's trimmed verifier output;
+ * - reports tokens, dollars and cache hit rate so the loop's budget guard works,
+ *   and cancels an attempt mid-flight when the remaining budget is spent;
+ * - cascades models: starts on the smart router's cheap pick and moves one
+ *   tier up after N consecutive verifier failures (N is configurable).
+ *
+ * AgentExecutor is used as-is. Cache usage is read from its public
+ * `step:complete` event, so the executor internals are not touched.
+ */
+import type { LanguageModel, ModelMessage, ToolSet } from 'ai';
+import type { ToolExecuteHandler } from './executor.js';
+import type { AgentConfig, AgentState } from './types.js';
+import type { AgentAttemptInput, AgentAttemptResult, AgentRunner } from './verified-run.js';
+import type { PermissionManager } from './permissions.js';
+import type { ComplexityTier } from '../providers/smart-router.js';
+import type { ProviderType } from '../providers/core/types.js';
+import type { PromptCacheConfig } from '../providers/prompt-cache.js';
+export interface ModelChoice {
+    provider: ProviderType;
+    model: string;
+    costPer1MInput: number;
+    costPer1MOutput: number;
+    /** Router tier the pick came from, or 'pinned' for an explicit --model */
+    tier: ComplexityTier | 'pinned';
+}
+/**
+ * Build the ordered list of models an attempt series may use.
+ *
+ * `modelSpec` (comma separated) pins an explicit ladder, cheapest first.
+ * Without it the smart router classifies the goal, picks the cheap model for
+ * that tier, and appends the picks for each higher tier (deduplicated).
+ */
+export declare function buildModelLadder(goal: string, availableProviders: Set<ProviderType>, modelSpec?: string): ModelChoice[];
+export interface UsageTotals {
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadTokens: number;
+    cacheWriteTokens: number;
+}
+/** Dollar cost with cache reads and writes priced by their multipliers. */
+export declare function computeCostUsd(choice: ModelChoice, usage: UsageTotals, cache: PromptCacheConfig): number;
+export interface ExecutorRunnerConfig {
+    /** Consecutive verifier failures on a model before moving up a tier. 0 disables cascading. */
+    escalateAfter: number;
+    maxStepsPerAttempt: number;
+    /** Token cap per attempt (also bounded by the run's remaining budget) */
+    attemptTokenBudget: number;
+    commandTimeoutMs: number;
+    maxToolOutputChars: number;
+}
+export declare const DEFAULT_RUNNER_CONFIG: ExecutorRunnerConfig;
+/** Precedence: explicit flag > PROFCLAW_RUN_* env var > default. */
+export declare function resolveRunnerConfig(flags: Partial<ExecutorRunnerConfig>, env?: NodeJS.ProcessEnv): ExecutorRunnerConfig;
+/** The slice of AgentExecutor the runner uses; lets tests inject a fake. */
+export interface AgentLoop {
+    run(model: LanguageModel, messages: ModelMessage[], tools: ToolSet, onToolExecute?: ToolExecuteHandler, providerHint?: string): Promise<AgentState>;
+    cancel(): void;
+    getState(): AgentState;
+    on(event: 'step:complete', listener: (state: AgentState, result: unknown) => void): unknown;
+}
+export interface CreateLoopArgs {
+    sessionId: string;
+    goal: string;
+    config: Partial<AgentConfig>;
+}
+export type RunnerEvent = {
+    type: 'model_selected';
+    attempt: number;
+    choice: ModelChoice;
+    escalated: boolean;
+};
+/** One tool invocation by the agent, reported after it finishes. */
+export interface ToolCallEvent {
+    attempt: number;
+    name: string;
+    args: Record<string, unknown>;
+    durationMs: number;
+    ok: boolean;
+}
+export interface ExecutorRunnerOptions {
+    ladder: ModelChoice[];
+    createModel: (choice: ModelChoice) => Promise<LanguageModel>;
+    config?: Partial<ExecutorRunnerConfig>;
+    env?: NodeJS.ProcessEnv;
+    /** Run-level budgets (0 disables); attempts are capped to what is left */
+    maxTokens?: number;
+    maxCostUsd?: number;
+    permissions?: PermissionManager;
+    createLoop?: (args: CreateLoopArgs) => AgentLoop;
+    onEvent?: (event: RunnerEvent) => void;
+    /** Called after every tool call (used for run receipts) */
+    onToolCall?: (event: ToolCallEvent) => void;
+}
+export declare function buildAgentMessages(input: AgentAttemptInput): ModelMessage[];
+export declare class ExecutorRunner implements AgentRunner {
+    private readonly options;
+    private readonly config;
+    private readonly env;
+    private readonly permissions;
+    private tierIndex;
+    private failuresOnTier;
+    private spentTokens;
+    private spentUsd;
+    constructor(options: ExecutorRunnerOptions);
+    /** Model the next attempt would use (for tests and diagnostics). */
+    get currentChoice(): ModelChoice;
+    /**
+     * A call that arrives with feedback means the previous attempt failed
+     * verification (or crashed). After `escalateAfter` such failures in a row on
+     * the same model, move to the next tier up, if there is one.
+     */
+    private selectChoice;
+    runAttempt(input: AgentAttemptInput): Promise<AgentAttemptResult>;
+    private summarize;
+}
+export interface DefaultRunnerArgs {
+    goal: string;
+    /** Comma separated ladder, cheapest first; a single value pins the model */
+    model?: string;
+    config?: Partial<ExecutorRunnerConfig>;
+    maxTokens?: number;
+    maxCostUsd?: number;
+    env?: NodeJS.ProcessEnv;
+    onEvent?: (event: RunnerEvent) => void;
+    onToolCall?: (event: ToolCallEvent) => void;
+}
+/** Build a runner on the configured providers via the smart router. */
+export declare function createDefaultExecutorRunner(args: DefaultRunnerArgs): Promise<ExecutorRunner>;
+//# sourceMappingURL=executor-runner.d.ts.map