ruvnet-brain 4.5.5 → 4.5.6

package/plugin/scripts/project-progression-outbox.mjs

@@ -2,6 +2,66 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 const OUTBOX_NAME = 'project-progression-outbox.jsonl';
+const READ_CHUNK_BYTES = 64 * 1024;
+
+// Decode only complete records, so a multibyte character crossing reads stays intact.
+function* readJsonl(file) {
+  let fd;
+  try { fd = fs.openSync(file, 'r'); } catch (error) { if (error.code === 'ENOENT') return; throw error; }
+  const chunk = Buffer.alloc(READ_CHUNK_BYTES);
+  let parts = [];
+  let line = 0;
+  const parse = (bytes, terminated) => {
+    if (!bytes.length) return undefined;
+    const text = bytes.toString('utf8');
+    if (!text.trim()) return undefined;
+    try { return JSON.parse(text); } catch {
+      if (!terminated) return undefined;
+      throw new Error(`malformed outbox record at line ${line}`);
+    }
+  };
+  try {
+    let length;
+    while ((length = fs.readSync(fd, chunk, 0, chunk.length, null))) {
+      let start = 0;
+      for (let end = 0; end < length; end += 1) {
+        if (chunk[end] !== 10) continue;
+        parts.push(Buffer.from(chunk.subarray(start, end)));
+        line += 1;
+        const record = parse(Buffer.concat(parts), true);
+        if (record !== undefined) yield record;
+        parts = []; start = end + 1;
+      }
+      if (start < length) parts.push(Buffer.from(chunk.subarray(start, length)));
+    }
+    if (parts.length) {
+      line += 1;
+      const record = parse(Buffer.concat(parts), false);
+      if (record !== undefined) yield record;
+    }
+  } finally { fs.closeSync(fd); }
+}
+
+// Inspect only the final record; preceding history is never decoded or copied.
+function finalRecord(fd, size) {
+  const parts = [];
+  let position = size;
+  while (position > 0) {
+    const length = Math.min(READ_CHUNK_BYTES, position);
+    position -= length;
+    const chunk = Buffer.alloc(length);
+    let read = 0;
+    while (read < length) {
+      const count = fs.readSync(fd, chunk, read, length - read, position + read);
+      if (!count) throw new Error('outbox tail changed during inspection');
+      read += count;
+    }
+    const delimiter = chunk.lastIndexOf(10);
+    parts.unshift(delimiter < 0 ? chunk : chunk.subarray(delimiter + 1));
+    if (delimiter >= 0) break;
+  }
+  return Buffer.concat(parts).toString('utf8');
+}
 
 function requireIdentity(value, label) {
   if (typeof value !== 'string' || !value) throw new TypeError(`${label} must be a non-empty string`);
@@ -31,8 +91,7 @@ export class ProgressionOutbox {
         const last = Buffer.alloc(1);
         fs.readSync(fd, last, 0, 1, size - 1);
         if (last[0] !== 10) {
-          const content = fs.readFileSync(fd, 'utf8');
-          try { JSON.parse(content.slice(content.lastIndexOf('\n') + 1)); }
+          try { JSON.parse(finalRecord(fd, size)); }
           catch { throw new Error('incomplete outbox final record; preserve and recover the torn tail before appending'); }
           separator = '\n';
         }
@@ -66,18 +125,23 @@ export class ProgressionOutbox {
     return this.appendRecord({ type: 'commit', ...receipt });
   }
 
-  records() {
-    if (!fs.existsSync(this.path)) return [];
-    const content = fs.readFileSync(this.path, 'utf8');
-    const lines = content.split('\n');
-    if (lines.at(-1) === '') lines.pop();
-    else {
-      // A missing delimiter is not a missing record; only a crash-torn JSON suffix is incomplete.
-      try { JSON.parse(lines.at(-1)); } catch { lines.pop(); }
+  /** Disposition of one frozen payload, never a commit for its conflicting original key. */
+  markRecovered(snapshot, receipt) {
+    for (const [label, value] of Object.entries({ eventKey: snapshot?.eventKey,
+      payloadDigest: snapshot?.payloadDigest, recoveryEventKey: receipt?.eventKey,
+      recoveryPayloadDigest: receipt?.payloadDigest, readbackDigest: receipt?.readbackDigest,
+      committedAt: receipt?.committedAt })) requireIdentity(value, label);
+    if (receipt.eventKey === snapshot.eventKey || receipt.readbackDigest !== receipt.payloadDigest) {
+      throw new Error('unverified recovery disposition');
     }
-    return lines.filter(Boolean).map((line, index) => {
-      try { return JSON.parse(line); } catch { throw new Error(`malformed outbox record at line ${index + 1}`); }
-    });
+    return this.appendRecord({ type: 'recovery', eventKey: snapshot.eventKey,
+      payloadDigest: snapshot.payloadDigest, recoveryEventKey: receipt.eventKey,
+      recoveryPayloadDigest: receipt.payloadDigest, readbackDigest: receipt.readbackDigest,
+      committedAt: receipt.committedAt });
+  }
+
+  records() {
+    return [...readJsonl(this.path)];
   }
 
   /**
@@ -92,7 +156,8 @@ export class ProgressionOutbox {
     const snapshots = new Map();
     const committed = new Map();
     const quarantined = new Map();
-    for (const record of this.records()) {
+    const recoveries = [];
+    for (const record of readJsonl(this.path)) {
       requireIdentity(record?.eventKey, 'outbox eventKey');
       requireIdentity(record?.payloadDigest, 'outbox payloadDigest');
       if (record.type === 'snapshot') {
@@ -103,6 +168,13 @@ export class ProgressionOutbox {
         const prior = committed.get(record.eventKey);
         if (prior && prior !== record.payloadDigest) quarantined.set(record.eventKey, 'outbox commit collision');
         committed.set(record.eventKey, record.payloadDigest);
+      } else if (record.type === 'recovery') {
+        requireIdentity(record.recoveryEventKey, 'recovery event key');
+        requireIdentity(record.recoveryPayloadDigest, 'recovery payload digest');
+        if (record.eventKey === record.recoveryEventKey || record.readbackDigest !== record.recoveryPayloadDigest) {
+          throw new Error('unverified recovery disposition');
+        }
+        recoveries.push(record);
       } else {
         throw new Error('unsupported outbox record');
       }
@@ -113,9 +185,18 @@ export class ProgressionOutbox {
         quarantined.set(record.eventKey, 'outbox commit digest mismatch');
       }
     }
+    const recovered = new Set(recoveries.filter((record) => {
+      const target = snapshots.get(record.recoveryEventKey)?.snapshot;
+      return !quarantined.has(record.recoveryEventKey)
+        && committed.get(record.recoveryEventKey) === record.recoveryPayloadDigest
+        && target?.payloadDigest === record.recoveryPayloadDigest
+        && target.recoveryDiagnostics?.originalEventKey === record.eventKey
+        && target.recoveryDiagnostics?.frozenPayloadDigest === record.payloadDigest;
+    }).map((record) => `${record.eventKey}:${record.payloadDigest}`));
     this.quarantine = [...quarantined].map(([eventKey, reason]) => ({ eventKey, reason }));
     return [...snapshots.values()]
-      .filter((record) => !quarantined.has(record.eventKey) && !committed.has(record.eventKey))
+      .filter((record) => !quarantined.has(record.eventKey) && !committed.has(record.eventKey)
+        && !recovered.has(`${record.eventKey}:${record.payloadDigest}`))
       .sort((left, right) => left.eventKey.localeCompare(right.eventKey))
       .map((record) => record.snapshot);
   }

package/plugin/scripts/project-progression-producer.mjs

@@ -29,6 +29,7 @@
  * within those bounds.
  */
 import crypto from 'node:crypto';
+import { enrichStateWithObservation } from './project-progression-hook.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { digestCanonical, fieldAuthorityAllows, redactProgression, restoreProjectProgression } from './project-progression-contract.mjs';
@@ -250,6 +251,16 @@ export function buildProjectProgression({
     completeProjectState,
   });
   const projectProgression = redactedProgression;
+  // Compare the same redacted observation the native writer will append, without returning it
+  // twice. Tool input and terminal evidence must participate before the no-op decision.
+  const observedState = redactProgression(enrichStateWithObservation(
+    projectProgression.completeProjectState, { ...payload, hook_event_name: trigger },
+  )).value;
+  // A committed sequence is not an event identity: several boundaries may freeze before replay.
+  // Bind all immutable captured fields (including the native observation and occurrence time).
+  projectProgression.dedupId += `:${digestCanonical({
+    ...projectProgression, completeProjectState: observedState,
+  })}`;
 
   // RETENTION (ADR-073). Three capture boundaries per session times every session is unbounded
   // growth unless a capture that changes nothing writes nothing. Compare what a snapshot MEANS —
@@ -257,7 +268,7 @@ export function buildProjectProgression({
   // differ (sequence, timestamp, dedup id, the trigger that happens to be firing, and the evidence
   // block's own timestamps), because comparing those would make every capture look novel.
   const meaning = digestCanonical({
-    state: { ...projectProgression.completeProjectState, activeStep: null, evidence: null },
+    state: { ...observedState, activeStep: null, evidence: null },
     source: projectProgression.sourceIdentity,
   });
   const priorMeaning = heads.length === 1 ? digestCanonical({

package/plugin/scripts/project-progression-store.mjs

@@ -5,6 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { ProgressionOutbox } from './project-progression-outbox.mjs';
 import {
+  createProgressionSnapshot,
   digestCanonical,
   restoreProjectProgression,
   validateProgressionSnapshot,
@@ -87,10 +88,26 @@ export function projectResumePayloadToBound(payload, maxOutputBytes) {
     });
   }
 
+  if (size() > maxOutputBytes && Array.isArray(summary.state?.resumeConflicts)) {
+    const groups = new Map();
+    for (const conflict of payload.state.resumeConflicts) {
+      if (!groups.has(conflict.field)) groups.set(conflict.field, []);
+      groups.get(conflict.field).push(conflict);
+    }
+    if (groups.size < payload.state.resumeConflicts.length) {
+      summary.state.resumeConflicts = [...groups].map(([field, conflicts]) => ({
+        field, conflictCount: conflicts.length,
+        valueCount: conflicts.reduce((count, conflict) => count + (conflict.values ?? []).length, 0),
+        conflictsDigest: digestCanonical(conflicts),
+      }));
+      omissions.push({ path: 'state.resumeConflicts', ...omissionSummary(payload.state.resumeConflicts) });
+    }
+  }
+
   if (size() > maxOutputBytes) recordOmission(summary.state, 'journalHeads', 'state.journalHeads');
   // Least central detail first. currentGoal and nextAction are deliberately absent from this list.
   const stateFields = [
-    'commands', 'proofArtifacts', 'changedFiles', 'completed', 'untested', 'decisions',
+    'observations', 'commands', 'proofArtifacts', 'changedFiles', 'completed', 'untested', 'decisions',
     'plan', 'inProgress', 'blockers', 'failures', 'acceptanceContract', 'provenance',
     'evidence', 'activeStep', 'activeProcess', 'sourceIdentity',
   ];
@@ -450,6 +467,41 @@ export class ProjectProgressionStore {
     return receipt;
   }
 
+  /** Frozen queue recovery never rewrites the conflicting row or marks its key committed. */
+  captureFrozen(snapshot, { canCommit } = {}) {
+    if (typeof canCommit !== 'function') throw new Error('frozen recovery requires replay fencing');
+    const fenced = () => { if (!canCommit()) throw new Error('progression recovery lost replay fencing'); };
+    fenced();
+    try { return { snapshot, receipt: this.capture(snapshot, { onPhase: fenced }) }; } catch (error) {
+      if (error.message !== 'progression readback digest mismatch') throw error;
+    }
+    // An independently retrieved exact canonical value must be valid for this project. A failed,
+    // absent, malformed or foreign read is never evidence that the immutable key collided.
+    const exact = this.retrieveSnapshots([snapshot.eventKey]);
+    if (exact.rejected.length || exact.snapshots.length !== 1) throw new Error('immutable collision is not verified');
+    const existing = exact.snapshots[0];
+    this.validateSnapshot(existing);
+    if (existing.eventKey !== snapshot.eventKey || existing.payloadDigest === snapshot.payloadDigest) {
+      throw new Error('immutable collision is not verified');
+    }
+    const identity = { originalEventKey: snapshot.eventKey,
+      frozenPayloadDigest: snapshot.payloadDigest, existingPayloadDigest: existing.payloadDigest };
+    const created = createProgressionSnapshot({ ...snapshot,
+      dedupId: `immutable-recovery:${digestCanonical(identity)}` });
+    // Preserve the frozen state and source exactly; diagnostics carry no instruction authority.
+    const { payloadDigest: _digest, ...body } = created;
+    body.redactions = snapshot.redactions;
+    body.recoveryDiagnostics = { kind: 'immutable-event-key-collision', authoritative: false, ...identity };
+    const recovered = Object.freeze({ ...body, payloadDigest: digestCanonical(body) });
+    this.validateSnapshot(recovered);
+    this.requireCaptureConsent(recovered);
+    fenced();
+    const receipt = this.capture(recovered, { onPhase: fenced });
+    fenced();
+    this.outbox.markRecovered(snapshot, receipt);
+    return { snapshot: recovered, receipt };
+  }
+
   replay() {
     const receipts = [];
     for (const snapshot of this.outbox.pendingSnapshots()) {

package/plugin/scripts/project-transition-hook.mjs

@@ -75,20 +75,25 @@ export function normalizeTransition(payload, event, { now = () => new Date().toI
   const toolInput = input.tool_input ?? {};
   const response = input.tool_response && typeof input.tool_response === 'object' ? input.tool_response : {};
   const exitCode = [response.exit_code, response.exitCode, response.status].find(Number.isSafeInteger);
-  const failure = event === 'PostToolUseFailure' || response.isError === true || input.is_error === true || (Number.isSafeInteger(exitCode) && exitCode !== 0);
-  const interrupted = response.interrupted === true || response.signal === 'SIGINT';
+  const error = typeof response.error === 'string' && response.error ? redactText(response.error).slice(0, 4096) : undefined;
+  const signal = typeof response.signal === 'string' && response.signal ? redactText(response.signal).slice(0, 100) : undefined;
+  const failure = Boolean(error) || event === 'PostToolUseFailure' || response.isError === true || input.is_error === true || (Number.isSafeInteger(exitCode) && exitCode !== 0);
+  const interrupted = response.interrupted === true || Boolean(signal);
+  const declaredOutcome = ['success', 'failure', 'interrupted', 'unknown'].includes(response.outcome) ? response.outcome : null;
   // Measured native Claude Bash PostToolUse has no exit code. Its completion envelope
   // is host-reported success, never an inferred exit-code zero. Other hosts stay unknown.
   const claudeBashCompletion = host === 'claude' && input.tool_name === 'Bash' && event === 'PostToolUse'
     && typeof response.stdout === 'string' && typeof response.stderr === 'string'
     && response.interrupted === false && typeof response.isImage === 'boolean'
     && typeof response.noOutputExpected === 'boolean';
-  const outcome = event === 'PreToolUse' ? 'pending' : interrupted ? 'interrupted' : failure ? 'failure'
-    : Number.isSafeInteger(exitCode) || response.success === true || response.ok === true || claudeBashCompletion ? 'success' : 'unknown';
+  const outcome = event === 'PreToolUse' ? 'pending' : error ? 'failure' : interrupted ? 'interrupted' : failure ? 'failure'
+    : declaredOutcome || (Number.isSafeInteger(exitCode) || response.success === true || response.ok === true || claudeBashCompletion ? 'success' : 'unknown');
   return { ...common, kind: 'tool-observation', tool: String(input.tool_name).split('__').at(-1).slice(0, 100),
     intent: semanticIntent(toolInput.description ?? toolInput.command ?? toolInput.cmd ?? toolInput.file_path), outcome,
     ...(outcome === 'success' && claudeBashCompletion ? { outcomeEvidence: 'claude-bash-completion' } : {}),
-    ...(event !== 'PreToolUse' && Number.isSafeInteger(exitCode) ? { exitCode } : {}) };
+    ...(event !== 'PreToolUse' && Number.isSafeInteger(exitCode) ? { exitCode } : event !== 'PreToolUse' && (response.exit_code === null || response.exitCode === null) ? { exitCode: null } : {}),
+    ...(event !== 'PreToolUse' && error ? { error } : {}),
+    ...(event !== 'PreToolUse' && signal ? { signal } : {}) };
 }
 
 export function readTransitionHistory(resolution, { deadlineAt = Infinity } = {}) {
@@ -107,6 +112,11 @@ export function readTransitionHistory(resolution, { deadlineAt = Infinity } = {}
 export function buildTransitionProgression({ resolution, observation, snapshots = [], sessionIdentity, host, sourceIdentity: originalSourceIdentity }) {
   const restored = restoreProjectProgression(snapshots, { expectedProjectIdentity: resolution.projectIdentity });
   if (snapshots.length && !restored.ok) throw new Error('nonempty transition journal has no coherent ancestry');
+  return buildRestoredTransitionProgression({ resolution, observation, snapshots, sessionIdentity, host, sourceIdentity: originalSourceIdentity }, restored);
+}
+
+// Only the validated result computed in this module can reach this private builder.
+function buildRestoredTransitionProgression({ resolution, observation, snapshots, sessionIdentity, host, sourceIdentity: originalSourceIdentity }, restored) {
   const heads = snapshots.filter((snapshot) => restored.heads.includes(snapshot.eventKey));
   const prior = restored.state;
   const empty = Object.fromEntries(['plan', 'completed', 'inProgress', 'blockers', 'failures', 'decisions', 'changedFiles', 'commands', 'proofArtifacts', 'untested', 'resumeConflicts'].map((key) => [key, []]));
@@ -145,7 +155,8 @@ export function captureNormalizedTransition(job, { readHistory = readTransitionH
   if (!normalized || normalized.observation?.authoritative !== false || !normalized.observation?.id
     || normalized.sourceIdentity?.checkoutPath !== resolution.checkoutRoot) throw new Error('invalid normalized transition binding');
   const snapshots = readHistory(resolution, { deadlineAt });
-  if (snapshots.length && !restoreProjectProgression(snapshots, { expectedProjectIdentity: resolution.projectIdentity }).ok) {
+  const restored = restoreProjectProgression(snapshots, { expectedProjectIdentity: resolution.projectIdentity });
+  if (snapshots.length && !restored.ok) {
     throw new Error('nonempty transition journal has no coherent ancestry');
   }
   // A failed first store already fsynced a snapshot to the outbox. If startup/replay committed
@@ -159,9 +170,9 @@ export function captureNormalizedTransition(job, { readHistory = readTransitionH
   if (committed) return { progressionCaptured: true, eventId: normalized.observation.id,
     receipt: { eventKey: committed.eventKey, payloadDigest: committed.payloadDigest,
       readbackDigest: committed.payloadDigest, readPath: 'canonical progression reader' } };
-  const progression = buildTransitionProgression({ resolution, observation: normalized.observation,
+  const progression = buildRestoredTransitionProgression({ resolution, observation: normalized.observation,
     snapshots, sessionIdentity: job.payload.session_id, host: job.host,
-    sourceIdentity: normalized.sourceIdentity });
+    sourceIdentity: normalized.sourceIdentity }, restored);
   const result = capture(job.originProjectDir, job.event, { host: job.host, budgetMs: Math.max(0, deadlineAt - now()),
     ...(makeStoreFactory ? { makeStoreFactory } : {}), writeMetadata: false,
     rawInput: JSON.stringify({ session_id: job.payload.session_id, hook_event_name: job.event, projectProgression: progression }),

package/plugin/scripts/session-snapshot-hook.mjs

@@ -163,7 +163,8 @@ export function runSessionSnapshotHook(projectDir, event, {
     if (payload.hook_event_name !== event) {
       throw new Error(`progression boundary mismatch: expected ${event}, received ${payload.hook_event_name}`);
     }
-    const result = captureProgression({ host, payload, projectDir, storeFactory: (options) => makeStoreFactory(now() + budgetMs)({ ...options, env }) });
+    const result = captureProgression({ host, payload, projectDir, recoverFrozen: Boolean(ordered),
+      canCommit: () => Boolean(ordered) && refreshReplayLock(resolveProjectStore({ projectDir }).projectRoot, ordered), storeFactory: (options) => makeStoreFactory(now() + budgetMs)({ ...options, env }) });
     return { ...idle, progressionCaptured: true, receipt: result.receipt };
   }
 

package/scripts/claude-terminal-mod.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+// Materialize the sandboxed native mod and bridge it to the existing reviewed policy engine.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { classify } from '../config/model-router/policy.default.mjs';
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+export const MOD_SOURCE = path.join(ROOT, 'config/model-router/claude-terminal-mod');
+export function terminalModDigest(pluginRoot) {
+  const hash = crypto.createHash('sha256');
+  for (const relative of ['.claude-plugin/plugin.json', 'hooks/hooks.json', 'hooks/register.js', 'hooks/routing.js', 'hooks/policy.default.mjs', 'hooks/runtime.js']) {
+    hash.update(relative); hash.update('\0'); hash.update(fs.readFileSync(path.join(pluginRoot, relative))); hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+export function prepareClaudeTerminalMod({ destination, nodePath = process.execPath,
+  helperPath = fileURLToPath(import.meta.url), enginePath = path.join(ROOT, 'scripts/model-router-engine.mjs') } = {}) {
+  if (!destination || !path.isAbsolute(destination)) throw new Error('Absolute mod destination required');
+  for (const file of [nodePath, helperPath, enginePath]) if (!path.isAbsolute(file) || !fs.existsSync(file)) throw new Error('Native mod dependency unavailable');
+  fs.mkdirSync(destination, { recursive: true, mode: 0o700 });
+  for (const part of ['.claude-plugin/plugin.json', 'hooks/hooks.json', 'hooks/register.js', 'hooks/routing.js']) {
+    const dest = path.join(destination, part);
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.copyFileSync(path.join(MOD_SOURCE, part), dest);
+  }
+  const policyPath = path.join(destination, 'hooks/policy.default.mjs');
+  fs.copyFileSync(path.join(ROOT, 'config/model-router/policy.default.mjs'), policyPath);
+  fs.writeFileSync(path.join(destination, 'hooks/runtime.js'), `export default ${JSON.stringify({ nodePath, helperPath, enginePath, policyPath })};\n`, { mode: 0o600 });
+  return { pluginDir: destination, policyPath, modDigest: terminalModDigest(destination) };
+}
+export function validateDecision(decision, now = Date.now()) {
+  const age = now - Date.parse(decision?.selectionReviewedAt);
+  const maxAge = decision?.selectionMaxAgeMs;
+  if (decision?.harness !== 'claude-code' || decision.provider !== 'anthropic' || decision.subscriptionCovered !== true ||
+      !/^claude-[a-z0-9][a-z0-9.-]*$/.test(decision.model || '') || !['fast', 'medium', 'hard'].includes(decision.taskClass) ||
+      !['low', 'medium', 'high', 'xhigh', 'max'].includes(decision.effort) ||
+      !Number.isSafeInteger(maxAge) || maxAge <= 0 || maxAge > 604800000 || !Number.isFinite(age) || age < 0 ||
+      !/^[a-f0-9]{64}$/.test(decision.selectionRouteDigest || '')) throw new Error('Native terminal routing decision invalid; no fallback');
+  return decision;
+}
+export function routeNativePrompt({ prompt, turnId, minimumClass, enginePath = path.join(ROOT, 'scripts/model-router-engine.mjs'),
+  policyPath = path.join(ROOT, 'config/model-router/policy.default.mjs'), env = process.env } = {}) {
+  if (typeof prompt !== 'string' || !prompt.trim() || prompt.length > 200000) throw new Error('Native routing requires a bounded text prompt');
+  if (minimumClass !== undefined && !['fast', 'medium', 'hard'].includes(minimumClass)) throw new Error('Invalid class floor');
+  const codeFences = Math.floor((prompt.match(/```/g) || []).length / 2);
+  const hasCode = codeFences > 0 || /\b(function|const|let|def|class|import|=>|SELECT|async)\b/.test(prompt) || /[{};]\s*$/m.test(prompt);
+  const rank = { fast: 0, medium: 1, hard: 2 };
+  const canonicalFloor = classify({ taskHints: prompt, hasCode }, 'claude-code');
+  const floor = rank[minimumClass] > rank[canonicalFloor] ? minimumClass : canonicalFloor;
+  const classificationPrompt = floor === 'hard' ? 'final substantive review\n' + prompt : prompt;
+  // Let the engine honor the user's policy.mjs; the bundled copy is only the
+  // deterministic classification floor used by the sandboxed hook.
+  const result = spawnSync(process.execPath, [enginePath, '--harness', 'claude-code', '--request-json', '--policy-only', '--json'],
+    { input: JSON.stringify({ prompt: classificationPrompt }), encoding: 'utf8', env, timeout: 8000, maxBuffer: 262144 });
+  if (result.error || result.status !== 0) throw new Error('Reviewed native routing policy unavailable; no fallback');
+  const d = validateDecision(JSON.parse(result.stdout));
+  if (rank[d.taskClass] < rank[floor]) throw new Error('Reviewed native routing policy below canonical floor; no fallback');
+  // No prompt, reasoning, credentials, or arbitrary engine output crosses back to the sandbox.
+  return { schemaVersion: 1, turnId: typeof turnId === 'string' ? turnId : null, model: d.model, effort: d.effort,
+    taskClass: d.taskClass, expiresAt: Date.parse(d.selectionReviewedAt) + d.selectionMaxAgeMs,
+    subscriptionCovered: true, routeDigest: d.selectionRouteDigest };
+}
+export function writeReadinessReceipt({ nonce, receiptPath, pluginRoot, version, sessionId, status = 'ready' } = {}) {
+  if (!/^[a-f0-9]{64}$/.test(nonce || '') || !path.isAbsolute(receiptPath || '') ||
+      !path.isAbsolute(pluginRoot || '') || (!/^2\.1\.\d+$/.test(version || '') || Number(version.split('.')[2]) < 287) || typeof sessionId !== 'string' ||
+      !['ready', 'health'].includes(status)) throw new Error('Invalid native mod readiness request');
+  const receipt = { schemaVersion: 1, nonce, pluginRoot: fs.realpathSync(pluginRoot), nativeVersion: version,
+    sessionId, status, modDigest: terminalModDigest(pluginRoot), observedAt: new Date().toISOString(), pid: process.ppid,
+    scope: 'hook activation only; native load failure or worker crash can skip hooks' };
+  const parent = path.dirname(receiptPath);
+  if (!fs.existsSync(parent)) throw new Error('Readiness directory must be prepared by launcher');
+  const temporary = path.join(parent, `.rnb-ready-${crypto.randomBytes(16).toString('hex')}`);
+  fs.writeFileSync(temporary, JSON.stringify(receipt), { mode: 0o600, flag: 'wx' });
+  fs.renameSync(temporary, receiptPath);
+  return receipt;
+}
+async function main() {
+  const mode = process.argv[2];
+  const request = JSON.parse(fs.readFileSync(0, 'utf8'));
+  if (mode === '--decision') process.stdout.write(JSON.stringify(routeNativePrompt(request)) + '\n');
+  else if (mode === '--ready' || mode === '--health') process.stdout.write(JSON.stringify(writeReadinessReceipt({ ...request, status: mode === '--ready' ? 'ready' : 'health' })) + '\n');
+  else if (mode === '--prepare') process.stdout.write(JSON.stringify(prepareClaudeTerminalMod(request)) + '\n');
+  else throw new Error('Expected --prepare, --decision, --ready, or --health');
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) main().catch(() => {
+  process.stderr.write('claude-terminal-mod: routing or activation unavailable; no fallback\n'); process.exitCode = 1;
+});

package/scripts/model-routing-gateway.mjs

@@ -15,6 +15,21 @@ import { subscriptionEnvironment, assertSubscriptionAuth, validateDispatchDecisi
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const REFUSED = 'Current reviewed native model/effort allocation unavailable; new turn was not forwarded.';
 const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+// Native inference surfaces without qualified execution-time routing are denied.
+const UNQUALIFIED = new Set(['review/start', 'thread/queue/add', 'thread/queue/update', 'thread/queue/start',
+  'thread/realtime/start', 'thread/realtime/appendAudio', 'thread/realtime/appendSpeech', 'thread/realtime/appendText',
+  'thread/goal/set', 'thread/goal/create', 'thread/goal/resume', 'thread/compact/start', 'turn/addUserMessage', 'thread/startAeon']);
+
+function canonicalCodexConfig(config) {
+  if (!config || (config.model_provider ?? 'openai') !== 'openai') return false;
+  // Native 0.160 gives serviceTierForTurn precedence over daemon/thread Fast defaults.
+  // routeCodexTurn supplies both standard overrides; provider/auth checks remain mandatory.
+  // A provider with the built-in name can still be replaced by a custom endpoint.
+  if (config.model_providers && Object.hasOwn(config.model_providers, 'openai') && config.model_providers.openai != null) return false;
+  if (config.chatgpt_base_url != null && config.chatgpt_base_url !== 'https://chatgpt.com/backend-api/') return false;
+  // Native Config serializes openai_base_url:null when the override is unset.
+  return !Object.entries(config).some(([key, value]) => value != null && /^(model_providers\.openai|base_url|baseUrl|openai_base_url)(\.|$)/.test(key));
+}
 
 /** Fresh policy-only subprocess: prompt stays on stdin, never argv, receipts or diagnostics. */
 export function decideNativeTurn(prompt, harness, { env = process.env, spawnEngine = spawn, timeoutMs = 4000, multimodal = false } = {}) {
@@ -107,9 +122,9 @@ function unsafeSettings(value, prefix = '', routing = false) {
   if (!value || typeof value !== 'object') return false;
   return Object.entries(value).some(([key, entry]) => {
     const name = prefix ? `${prefix}.${key}` : key;
-    if (/^(model_providers|apiKeyHelper|api_key|apiKey|base_url|baseUrl|auth_token|authToken|customHeaders|env|modelSettings|alwaysThinkingEnabled|maxEffortLevel)(\.|$)/.test(name)) return true;
+    if (/^(model_providers|apiKeyHelper|api_key|apiKey|base_url|baseUrl|openai_base_url|chatgpt_base_url|auth_token|authToken|customHeaders|env|modelSettings|alwaysThinkingEnabled|maxEffortLevel)(\.|$)/.test(name)) return true;
     if (/^(model_provider|modelProvider)$/.test(name) && entry !== 'openai') return true;
-    if (/^(service_tier|serviceTier)$/.test(name) && entry != null && entry !== 'default') return true;
+    if (/^(service_tier|serviceTier|service_tier_for_turn|serviceTierForTurn)$/.test(name) && entry != null && entry !== 'default') return true;
     if (/^(features\.fast_mode|fastMode)$/.test(name) && entry !== false) return true;
     if (routing && /^(model|effort|effortLevel|reasoning_effort|collaborationMode)(\.|$)/.test(name)) return true;
     return unsafeSettings(entry, name, routing);
@@ -123,7 +138,7 @@ export function verifyNativeVision(decision, models = loadNativeCodexModels()) {
 
 /** Pure native override: preserve every context, tool, approval and collaboration instruction. */
 export function routeCodexTurn(message, decision) {
-  const params = { ...message.params, model: decision.model, effort: decision.effort, serviceTier: 'default' };
+  const params = { ...message.params, model: decision.model, effort: decision.effort, serviceTier: 'default', serviceTierForTurn: 'default' };
   if (params.collaborationMode) params.collaborationMode = { ...params.collaborationMode,
     settings: { ...params.collaborationMode.settings, model: decision.model, reasoning_effort: decision.effort } };
   return { ...message, params };
@@ -135,7 +150,7 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
   receipt = appendGatewayReceipt, timeoutMs = 5000, maxDeferredBytes = 64 * 1024 * 1024, tempRoot = os.tmpdir(), now = () => new Date().toISOString() } = {}) {
   const nonce = crypto.randomUUID();
   const pending = new Map(), initIds = new Set(), ownIds = new Set(), held = new Set();
-  const accepted = new Map(), starts = new Map(), inactiveWaiters = new Set();
+  const accepted = new Map(), starts = new Map(), inactiveWaiters = new Set(), boundedWaiters = new Set();
   let serial = Promise.resolve(), ready = harness === 'codex', active = false, closed = false, serialNumber = 0;
   let readiness = null, resolveReady;
   let queuedBytes = 0, spoolDirectory = null, spoolSequence = 0, declineUsers = false;
@@ -218,9 +233,10 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
   };
   function bounded(work) {
     return new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error(REFUSED)), timeoutMs);
-      Promise.resolve(work).then((value) => { clearTimeout(timer); resolve(value); },
-        (error) => { clearTimeout(timer); reject(error); });
+      const finish = (error, value) => { clearTimeout(timer); boundedWaiters.delete(cancel); error ? reject(error) : resolve(value); };
+      const cancel = () => finish(new Error(REFUSED));
+      const timer = setTimeout(cancel, timeoutMs); boundedWaiters.add(cancel);
+      Promise.resolve(work).then((value) => finish(null, value), (error) => finish(error));
     });
   }
   const control = (request) => new Promise((resolve, reject) => {
@@ -262,7 +278,7 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
       if (harness === 'codex') {
         if (message.method !== 'turn/start') {
           const pair = accepted.get(message.params?.threadId);
-          if (!pair || pair.model !== decision.model || pair.effort !== decision.effort) {
+          if (!pair || pair.turnId !== message.params?.expectedTurnId || pair.model !== decision.model || pair.effort !== decision.effort) {
             fail(message, 'Input not submitted: requires a new turn with reviewed allocation; current work continues.'); return;
           }
           record('active-input-approved', decision, false, { evidence: 'native-turn-start.accepted-configured-pair' });
@@ -271,6 +287,14 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
         const account = await control({ method: 'account/read', params: { refreshToken: false } });
         assertLive();
         if (account?.account?.type !== 'chatgpt') throw new Error(REFUSED);
+        const thread = await control({ method: 'thread/read', params: { threadId: message.params?.threadId, includeTurns: false } });
+        assertLive();
+        if (thread?.thread?.id !== message.params?.threadId || thread.thread.modelProvider !== 'openai') throw new Error(REFUSED);
+        const cwd = message.params?.cwd ?? thread.thread.cwd;
+        if (typeof cwd !== 'string' || !path.isAbsolute(cwd)) throw new Error(REFUSED);
+        const effective = await control({ method: 'config/read', params: { includeLayers: false, cwd } });
+        assertLive();
+        if (!canonicalCodexConfig(effective?.config)) throw new Error(REFUSED);
         const allowance = await control({ method: 'account/rateLimits/read', params: { excludeResetCreditDetails: true, supportsLunaReserve: false } });
         assertLive();
         if (allowance?.ordinaryUsageAllowed !== true) throw new Error(REFUSED);
@@ -310,10 +334,14 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
     stream.on('end', () => { buffer += decoder.end(); if (buffer) handler(buffer); });
   };
   listenLines(input, (line) => {
+    if (closed) return;
     let message;
     try { message = JSON.parse(line); } catch { if (!closed) writeHost(line); return; }
     if (harness === 'claude-code' && message.type === 'control_request' && message.request?.subtype === 'initialize') initIds.add(message.request_id);
-    const routable = harness === 'codex' ? ['turn/start', 'turn/steer', 'thread/queue/add'].includes(message.method) : message.type === 'user';
+    if (harness === 'codex' && UNQUALIFIED.has(message.method)) {
+      fail(message, 'Native inference method is not qualified for gateway routing; request not forwarded.'); return;
+    }
+    const routable = harness === 'codex' ? ['turn/start', 'turn/steer'].includes(message.method) : message.type === 'user';
     if (routable && harness === 'claude-code' && (declineUsers || queuedBytes + Buffer.byteLength(line) > maxDeferredBytes)) {
       declineUsers = true;
       const reason = 'Deferred input capacity (64 MiB) exceeded; new user packet not submitted; current work continues.';
@@ -334,9 +362,11 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
     let unsafe = false;
     if (harness === 'codex') {
       const params = message.params || {};
-      unsafe = unsafeSettings(params.config) || unsafeSettings({ modelProvider: params.modelProvider ?? 'openai', serviceTier: params.serviceTier ?? 'default' });
+      unsafe = unsafeSettings(params.config) || unsafeSettings({ modelProvider: params.modelProvider ?? 'openai',
+        serviceTier: params.serviceTier, service_tier: params.service_tier,
+        serviceTierForTurn: params.serviceTierForTurn, service_tier_for_turn: params.service_tier_for_turn });
       if (message.method === 'account/login/start' && !['chatgpt', 'chatgptDeviceCode', 'chatgptAuthTokens'].includes(params.type)) unsafe = true;
-      if (message.method === 'thread/settings/update') unsafe ||= unsafeSettings(params, '', true);
+      if (['thread/settings/update', 'turn/settings/update'].includes(message.method)) unsafe ||= unsafeSettings(params, '', true);
       const edits = message.method === 'config/value/write' ? [params] : message.method === 'config/batchWrite' ? params.edits || [] : [];
       if (message.method === 'config/batchWrite' && params.reloadUserConfig === true) unsafe = true;
       unsafe ||= edits.some((edit) => unsafeSettings({ [edit.keyPath]: edit.value }, '', true));
@@ -366,9 +396,9 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
     }
     if (starts.has(id)) {
       const pair = starts.get(id); starts.delete(id);
-      if (!message.error && message.result?.turn) accepted.set(pair.threadId, pair);
+      if (!message.error && typeof message.result?.turn?.id === 'string' && message.result.turn.id) accepted.set(pair.threadId, { ...pair, turnId: message.result.turn.id });
     }
-    if (message.method === 'turn/completed') accepted.delete(message.params?.threadId);
+    if (message.method === 'turn/completed' && accepted.get(message.params?.threadId)?.turnId === message.params?.turn?.id) accepted.delete(message.params.threadId);
     if (ownIds.has(id)) return; // late own-control replies never escape into the host client
     if (initIds.has(id) && message.response?.subtype === 'success') {
       ready = true; active = message.response.response?.session_state && message.response.response.session_state !== 'idle'; resolveReady?.();
@@ -379,7 +409,9 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
   });
   child.stderr?.on('data', (chunk) => diagnostics.write(chunk));
   const close = () => {
+    if (closed) return;
     closed = true; hostWriter.close(); inactiveWaiters.forEach((resolve) => resolve()); inactiveWaiters.clear();
+    boundedWaiters.forEach((cancel) => cancel()); boundedWaiters.clear(); accepted.clear(); starts.clear();
     for (const token of [...held]) { token.cancelled = true; retire(token); }
     if (spoolDirectory) fs.rmSync(spoolDirectory, { recursive: true, force: true });
     spoolKey.fill(0);
@@ -387,7 +419,8 @@ export function connectNativeGateway({ harness, child, input, output, diagnostic
     pending.clear();
   };
   child.once('error', close); child.once('exit', close); child.stdin.on('error', close); child.stdout.on('error', close);
-  input.on('end', () => { serial.finally(async () => { await hostWriter.idle(); if (!closed) child.stdin.end(); }); });
+  const disconnect = () => { close(); if (!child.stdin.destroyed) child.stdin.end(); };
+  input.on('end', disconnect); input.on('error', disconnect); input.on('close', disconnect);
   return { idle: () => serial, close, spoolState: () => ({ directory: spoolDirectory, queuedBytes }) };
 }