sprag-cli 3.59.0 → 3.61.0

package/src/reply-language.cjs

@@ -0,0 +1,167 @@
+'use strict';
+
+/**
+ * reply-language — catches an English reply to a Korean prompt.
+ *
+ * The model sometimes answers a Korean prompt in English, typically right
+ * after a long stretch of English work (commit messages, release notes). The
+ * slip is decidable by counting letters, so it gets a Stop hook instead of
+ * another sentence in the guidance.
+ *
+ * The thresholds were measured on 2,204 Korean-prompt turns from 14 days of
+ * real transcripts: 8 flagged, all 8 true positives, no false positives.
+ * Loosening any of them reopens false positives on replies that are Korean
+ * prose around code and English identifiers, so change them only with a new
+ * measurement.
+ *
+ * CommonJS, no dependencies: this runs on every Stop, so it must stay cheap.
+ */
+
+const { openSync, readSync, fstatSync, closeSync } = require('node:fs');
+
+// Only the tail of the transcript matters, and transcripts grow to hundreds
+// of megabytes. If the last real prompt is further back than this, the turn is
+// a long agentic run and we skip it rather than pay for reading it all.
+const TAIL_BYTES = 2 * 1024 * 1024;
+
+const ENGLISH_REQUESTED = /영어로|영문으로|in English/i;
+
+// A user entry that is not something the person typed.
+const NOT_A_PROMPT_PREFIX = ['<command-name', '<local-command', '<command-message', '<task-notification', 'Caveat:'];
+
+/**
+ * Strip what is legitimately not prose in the reader's language: injected
+ * reminders, code, URLs and paths. Code and paths are Latin by nature, so
+ * counting them would flag every Korean reply that quotes a command.
+ */
+function cleanText(t) {
+  return String(t ?? '')
+    .replace(/<system-reminder>[\s\S]*?<\/system-reminder>/g, ' ')
+    .replace(/```[\s\S]*?```/g, ' ')
+    .replace(/`[^`]*`/g, ' ')
+    .replace(/https?:\/\/\S+/g, ' ')
+    .replace(/(?:~|\.{0,2})?\/[\w.\-/]+/g, ' ');
+}
+
+function letterCounts(text) {
+  const cleaned = cleanText(text);
+  const h = (cleaned.match(/[가-힣]/g) || []).length;
+  const l = (cleaned.match(/[A-Za-z]/g) || []).length;
+  return { h, l, ratio: h + l === 0 ? 0 : h / (h + l) };
+}
+
+function isKoreanPrompt(text) {
+  const { h, ratio } = letterCounts(text);
+  return h >= 4 && ratio >= 0.3;
+}
+
+function isEnglishReply(text) {
+  const { l, ratio } = letterCounts(text);
+  return l >= 80 && ratio < 0.15;
+}
+
+function textBlocks(content) {
+  if (typeof content === 'string') return content;
+  if (!Array.isArray(content)) return '';
+  return content
+    .filter((b) => b && b.type === 'text' && typeof b.text === 'string')
+    .map((b) => b.text)
+    .join('\n');
+}
+
+/**
+ * The text of a real user prompt, or null when the entry is a tool result, a
+ * meta entry, or machinery posing as a user message.
+ */
+function realPromptText(entry) {
+  if (entry.type !== 'user' || entry.isMeta) return null;
+  const content = entry.message?.content;
+  if (Array.isArray(content) && content.some((b) => b && b.type === 'tool_result')) return null;
+  if (typeof content !== 'string' && !Array.isArray(content)) return null;
+  const text = textBlocks(content);
+  const head = text.trimStart();
+  if (NOT_A_PROMPT_PREFIX.some((p) => head.startsWith(p))) return null;
+  if (text.includes('[Subagent hand-back]') || text.includes('<agent-message')) return null;
+  return text;
+}
+
+/**
+ * The last turn in a list of JSONL lines: the final real user prompt and the
+ * assistant text the user sees after it. A tool_result resets the reply,
+ * because text written before a tool call is narration, not the answer.
+ * Returns null when there is no prompt. Unparsable lines and sidechain
+ * (subagent) entries are skipped.
+ */
+function lastTurn(lines) {
+  let prompt = null;
+  let reply = [];
+  for (const line of lines) {
+    if (!line) continue;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!entry || typeof entry !== 'object' || entry.isSidechain) continue;
+    if (entry.type === 'user') {
+      const content = entry.message?.content;
+      if (Array.isArray(content) && content.some((b) => b && b.type === 'tool_result')) {
+        reply = [];
+        continue;
+      }
+      const text = realPromptText(entry);
+      if (text !== null) {
+        prompt = text;
+        reply = [];
+      }
+    } else if (entry.type === 'assistant') {
+      const text = textBlocks(entry.message?.content);
+      if (text) reply.push(text);
+    }
+  }
+  if (prompt === null) return null;
+  return { prompt, reply: reply.join('\n') };
+}
+
+function readTailLines(path) {
+  const fd = openSync(path, 'r');
+  try {
+    const size = fstatSync(fd).size;
+    const start = Math.max(0, size - TAIL_BYTES);
+    const buf = Buffer.alloc(size - start);
+    let got = 0;
+    while (got < buf.length) {
+      const n = readSync(fd, buf, got, buf.length - got, start + got);
+      if (n <= 0) break;
+      got += n;
+    }
+    const lines = buf.subarray(0, got).toString('utf8').split('\n');
+    // A window that starts mid-file begins inside a line, so drop that stub.
+    if (start > 0) lines.shift();
+    return lines;
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/**
+ * null when the reply is fine (or cannot be judged), otherwise the measured
+ * ratios so a caller can report them. Never throws.
+ */
+function checkReplyLanguage(transcriptPath) {
+  try {
+    if (!transcriptPath) return null;
+    const turn = lastTurn(readTailLines(transcriptPath));
+    if (!turn) return null;
+    if (ENGLISH_REQUESTED.test(turn.prompt)) return null;
+    if (!isKoreanPrompt(turn.prompt) || !isEnglishReply(turn.reply)) return null;
+    const u = letterCounts(turn.prompt);
+    const r = letterCounts(turn.reply);
+    return { userHangulRatio: u.ratio, replyHangulRatio: r.ratio, replyLatin: r.l };
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { checkReplyLanguage, cleanText, isKoreanPrompt, isEnglishReply, lastTurn };

package/src/route-inject.js

@@ -22,11 +22,18 @@
  *   - the text trips EDIT_RE (implement, add, fix …): editing is not delegable
  *     however much the sentence also says "install" or "check"
  *   - no registered rule covers that category
+ *   - the request is an explanation question ("어떻게 동작해", "뭐야", "how does
+ *     …") whose only category evidence is one weight-1 keyword. "sprag 설치만으로
+ *     … 도구에서 어떻게 쓰이는거지?" scored run on the bare word 설치 and was told
+ *     to hand a question about how the tool behaves to a command-running haiku.
+ *     Answering it takes the main model's knowledge, not a command. The read
+ *     category is exempt: explaining is what it is for.
  * A hint that fires on the wrong request costs more than one that stays quiet.
  */
 
-import { categorize, ESCALATE_RE, EDIT_RE, worthDelegating } from './route-scan.js';
+import { categorizeScored, ESCALATE_RE, EDIT_RE, worthDelegating } from './route-scan.js';
 import { loadModelRules, budgetCapPhrase, ruleBudget } from './model-rules.js';
+import { sharedProjectRoots, realProjectRoot, scopeRank } from './shared-model-rules.js';
 import { agentPhrase, agentPhraseEn } from './agents.js';
 import { userLanguage } from './config.js';
 import { aliasForRole, resolveModelAlias } from './model-alias.js';
@@ -44,6 +51,34 @@ export function looksPasted(text) {
 /** Shortest text worth classifying; below this a prompt is an ack, not a task. */
 const MIN_LEN = 8;
 
+/**
+ * A question that asks for an explanation ("어떻게 쓰이는거지?", "뭐야", "how
+ * does it work"). "왜" is not here: ESCALATE_RE already routes it to the top
+ * tier. Kept to the shapes that ask HOW or WHAT something is — a bare "?" or a
+ * sentence-final "-지?" is too common in ordinary commands to count.
+ */
+const EXPLAIN_Q_RE = /어떻게\s*(?:쓰|사용|동작|작동|해야|하면|하는|하지|하죠|되는\s*(?:거|건|걸|것))|어떤\s*식으로|어떨\s*때|뭐야|뭐지|무엇|무슨\s*(?:의미|뜻)|\bhow\s+(?:does|do)\b|\bwhat\s+(?:is|does)\b/i;
+/**
+ * "어떻게 돼 / 됐 / 되고 있" asks for the current state of something, which is
+ * a check request however it is phrased. EXPLAIN_Q_RE does not list these, and
+ * this guard keeps it that way if "어떻게 되는 거" is ever matched next to one.
+ */
+const STATE_Q_RE = /어떻게\s*(?:돼|됐|됬|되어\s*있|되고\s*있)/;
+/** The category rests on exactly one weight-1 keyword. */
+const WEAK_SCORE = 1;
+/**
+ * The category whose job is to explain. Its weight-1 keywords (설명, 알려줘,
+ * 뭐야 …) share one pattern, so a question shape adds no evidence against it,
+ * and the registered rule names "4번 보정이 뭐야" as its own example.
+ */
+const EXPLAINING_CATEGORY = 'read';
+
+/** True for a question that asks how something works or what it is. */
+export function isExplainQuestion(text) {
+  const t = String(text || '');
+  return EXPLAIN_Q_RE.test(t) && !STATE_Q_RE.test(t);
+}
+
 /**
  * Price rank of whatever model is answering this session, or null when it
  * cannot be established.
@@ -87,7 +122,7 @@ export function sessionModelRank({ env = process.env, transcriptPath = null, sna
  *   model filters nothing.
  * @returns {{cat: object, t2: object|undefined, t1: object|undefined}|null}
  */
-export function routeMatch(text, { rules, sessionRank = null } = {}) {
+export function routeMatch(text, { rules, sessionRank = null, root } = {}) {
   const t = String(text || '').trim();
   if (t.length < MIN_LEN) return null;
   // Judgement and irreversible work stay on the top tier. This check comes
@@ -98,8 +133,14 @@ export function routeMatch(text, { rules, sessionRank = null } = {}) {
   // delegable, and with no tool calls yet only the wording can say so.
   if (EDIT_RE.test(t)) return null;
 
-  const cat = categorize(t, null);
-  if (!cat) return null;
+  const scored = categorizeScored(t, null);
+  if (!scored) return null;
+  const cat = scored.cat;
+  // A category carried by one weak keyword is a guess, and an explanation
+  // question is the case where the guess is most often wrong: "설치" inside a
+  // question about how a tool works is not a request to install anything.
+  // Two or more points (a command, or several keywords) keep the old verdict.
+  if (scored.score === WEAK_SCORE && cat.id !== EXPLAINING_CATEGORY && isExplainQuestion(t)) return null;
   // Length alone makes a paste offline, where the tool mix confirms it. At
   // prompt time a long text is as often a written spec as a pasted log, and a
   // spec is not haiku work — so it must also look pasted: many lines, or the
@@ -108,7 +149,13 @@ export function routeMatch(text, { rules, sessionRank = null } = {}) {
   if (cat.id === 'paste' && !looksPasted(t)) return null;
 
   const all = rules || loadModelRules().rules || [];
-  const matched = all.filter((r) => r && r.category === cat.id);
+  // The registry is shared with Codex, so a project rule approved in one
+  // project must not route another. A session whose directory is unknown gets
+  // global rules only.
+  const roots = root ? sharedProjectRoots(root) : [];
+  const inScope = (r) => r.scope !== 'project' ||
+    (typeof r.targetRoot === 'string' && roots.includes(realProjectRoot(r.targetRoot)));
+  const matched = all.filter((r) => r && r.category === cat.id && inScope(r));
   if (!matched.length) return null;
   // A rule only saves anything when its target tier is cheaper than the model
   // reading the hint. A T1 rule states "delegate to model: sonnet", which in a
@@ -121,8 +168,10 @@ export function routeMatch(text, { rules, sessionRank = null } = {}) {
     : matched.filter((r) => worthDelegating(r.tier, sessionRank));
   if (!usable.length) return null;
 
-  const t2 = usable.find((r) => r.tier === 'T2');
-  const t1 = usable.find((r) => r.tier === 'T1');
+  // The closest scope states the cap, whatever order the registry holds.
+  const nearest = [...usable].sort((a, b) => scopeRank(b) - scopeRank(a));
+  const t2 = nearest.find((r) => r.tier === 'T2');
+  const t1 = nearest.find((r) => r.tier === 'T1');
   return t2 || t1 ? { cat, t2, t1 } : null;
 }
 
@@ -146,7 +195,7 @@ export function matchCaps(match) {
  * @returns {string|null} the line to inject, or null to stay quiet
  */
 export function routeHint(text, { rules, lang = userLanguage(), root, sessionRank = null, match } = {}) {
-  const found = match === undefined ? routeMatch(text, { rules, sessionRank }) : match;
+  const found = match === undefined ? routeMatch(text, { rules, sessionRank, root }) : match;
   if (!found) return null;
   const { cat, t2, t1 } = found;
   const ko = lang === 'ko';

package/src/route-scan.js

@@ -29,6 +29,7 @@ import { modelRank, isRecognizedModelId, TIER_TARGET_RANK, tierForRank } from '.
 import { sessionCost } from './claude-price.js';
 import { learnProfileMapping, resetModelAliasCache } from './model-alias.js';
 import { modelRuleBaseText } from './model-rules.js';
+import { readResetMarks, isBeforeReset } from './saved-reset.cjs';
 
 // ── Tier bands (docs/TIER_CRITERIA.md §3) ────────────────────────────────
 // T2 (haiku): finished in few calls, tiny output, near-zero mutation, no
@@ -235,7 +236,21 @@ export function mungeProjectPath(p) {
  * id); no behavior AND no keyword hit → null (nothing delegable to name).
  */
 export function categorize(text, toolCounts) {
-  if (text.length >= PASTE_MIN_LEN) return CATEGORIES.find((c) => c.id === 'paste');
+  const scored = categorizeScored(text, toolCounts);
+  return scored ? scored.cat : null;
+}
+
+/**
+ * categorize() plus the winning category's keyword score, for a caller that
+ * must tell a request the keywords claim firmly from one that a single
+ * weight-1 word dragged into a category. `score` is 0 when the category came
+ * from the paste gate or from the tool-mix fallback, where no keyword won.
+ * categorize() delegates here, so the two can never disagree on the category.
+ *
+ * @returns {{cat: object, score: number}|null}
+ */
+export function categorizeScored(text, toolCounts) {
+  if (text.length >= PASTE_MIN_LEN) return { cat: CATEGORIES.find((c) => c.id === 'paste'), score: 0 };
   const pool = behaviorPool(toolCounts);
   const eligible = pool
     ? pool.ids.map((id) => CATEGORIES.find((c) => c.id === id))
@@ -246,8 +261,8 @@ export function categorize(text, toolCounts) {
     const s = keywordScore(c, text);
     if (s > bestScore) { best = c; bestScore = s; }
   }
-  if (best) return best;
-  if (pool?.fallback) return CATEGORIES.find((c) => c.id === pool.fallback);
+  if (best) return { cat: best, score: bestScore };
+  if (pool?.fallback) return { cat: CATEGORIES.find((c) => c.id === pool.fallback), score: 0 };
   return null;
 }
 
@@ -465,6 +480,35 @@ export function windowBytes(files) {
   return total;
 }
 
+/**
+ * Fold one measured delegation into its aggregate (`stats`: key → { runs,
+ * errRuns, outTokens, savedUsd }).
+ *
+ * The two kinds of figure answer different questions. runs / errRuns / outTokens
+ * feed rule-health, which judges whether a rule keeps failing, so they cover the
+ * whole scan window whatever `sprag saved reset` did. savedUsd is money the user
+ * zeroed on purpose: it counts only runs dated at or after `resetMark` (the
+ * routing mark), by the same isBeforeReset the ledger totals use. The date is
+ * the one the ledger stamps on its event (end, else start), so a run that was
+ * still going when the user reset lands on the same side in both totals. A run
+ * with no usable time cannot be shown to postdate the reset, so it is left out
+ * too. An unpriced run (non-finite `saved`) adds nothing either way.
+ *
+ * @param {Map<string, object>} stats
+ * @param {string} key "tier|category|project"
+ * @param {{startedAt: number|null, endedAt?: number|null, out?: number}} run
+ * @param {number|null} saved price difference for this run
+ * @param {number|null} [resetMark] ms timestamp of the routing reset, or null
+ */
+export function tallyDelegatedRun(stats, key, run, saved, resetMark = null) {
+  const d = stats.get(key) || { runs: 0, errRuns: 0, outTokens: 0, savedUsd: 0 };
+  d.runs += 1;
+  if (isFailedRun(run)) d.errRuns += 1;
+  d.outTokens += run.out || 0;
+  if (Number.isFinite(saved) && !isBeforeReset(run.endedAt ?? run.startedAt, resetMark)) d.savedUsd += saved;
+  stats.set(key, d);
+}
+
 export async function runRouteScan({ days = 14 } = {}) {
   const files = await discoverSessionFiles({ days });
 
@@ -599,14 +643,10 @@ export async function runRouteScan({ days = 14 } = {}) {
   const delegatedStats = new Map(); // "tier|category|project" → outcome aggregate
   let unresolvedRuns = 0;           // delegated runs dropped for an unpriceable model id
   const unresolvedModels = new Set();
-  const bumpDelegated = (key, run, saved) => {
-    const d = delegatedStats.get(key) || { runs: 0, errRuns: 0, outTokens: 0, savedUsd: 0 };
-    d.runs += 1;
-    if (isFailedRun(run)) d.errRuns += 1;
-    d.outTokens += run.out || 0;
-    if (Number.isFinite(saved)) d.savedUsd += saved; // unpriced runs add nothing
-    delegatedStats.set(key, d);
-  };
+  // `sprag saved reset routing` zeroes the money, not the rule-health sample:
+  // see tallyDelegatedRun. readResetMarks never throws (no file = no reset).
+  const routingMark = readResetMarks(userDataDir()).routing;
+  const bumpDelegated = (key, run, saved) => tallyDelegatedRun(delegatedStats, key, run, saved, routingMark);
   // Ledger events feed the statusline's weekly/monthly "Routing saved"
   // totals. Keyed by run transcript path so overlapping re-scans upsert the
   // same event instead of double-counting it.

package/src/savings-ledger.js

@@ -1,8 +1,9 @@
 /**
  * savings-ledger — per-run delegation saving events with timestamps.
  *
- * model-rules.json stores `savedUsd` as a scan-window snapshot per rule, which
- * is right for rule-health but cannot answer "how much did routing save this
+ * model-rules.json stores `savedUsd` as a scan-window snapshot per rule (only
+ * the runs dated after the last `sprag saved reset routing`), which is right
+ * for rule-health but cannot answer "how much did routing save this
  * week / this month / ever". This ledger keeps one event per subagent run,
  * keyed by the run's transcript path so re-scans over overlapping windows
  * upsert instead of double-counting.

package/src/seed-rules.js

@@ -25,16 +25,16 @@
 
 import { readFileSync } from 'node:fs';
 import { CLI_NAME } from './cli-name.js';
-import { join, dirname } from 'node:path';
+import { join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createHash } from 'node:crypto';
+import { sharedModelRulesForProject, loadSharedModelRules, sharedProjectRoots, realProjectRoot } from './shared-model-rules.js';
 import { userDataDir } from './paths.js';
 import { userLanguage } from './config.js';
 import { writeStateFile } from './state-file.js';
 import {
   addModelRule,
   composeRuleText,
-  loadModelRules,
   modelRuleBaseText,
   syncAllFiles,
 } from './model-rules.js';
@@ -102,22 +102,12 @@ const stripDate = (t) => t.replace(/^\d{4}-\d{2}-\d{2}(\s*\([^)]*\))?:\s*/, '').
  * Everything still worth asking about: presets the user has not answered and
  * that are not already covered by a rule they have.
  *
- * "Already covered" is deliberately loose for model presets — any registered
- * rule for the same tier and category wins, whatever its scope or agent. A user
- * whose own route-scan already promoted that shape does not need ours, and
- * offering it anyway would read as the tool failing to notice its own state.
+ * A shared policy covers its tier and category only within its approved scope.
+ * A decision in another project must not suppress this project's offer.
  */
 export function pendingSeeds({ lang = userLanguage(), root = findProjectRoot(), agent = 'claude' } = {}) {
   const { decided } = loadSeedState({ agent });
-  // Codex model routing comes from its own measured route-scan candidates;
-  // Claude tier presets name models Codex does not run.
-  const registered = agent === 'codex' ? [] : (() => {
-    try {
-      return loadModelRules().rules;
-    } catch {
-      return [];
-    }
-  })();
+  const registered = sharedModelRulesForProject(loadSharedModelRules({ includeInactive: true }), root);
   const haveModel = new Set(registered.map((r) => `${r.tier}|${r.category}`));
 
   const haveText = new Set();
@@ -128,16 +118,23 @@ export function pendingSeeds({ lang = userLanguage(), root = findProjectRoot(),
   }
 
   const out = [];
-  for (const p of agent === 'codex' ? [] : modelPresets()) {
-    if (decided[p.id]) continue;
+  const roots = sharedProjectRoots(root);
+  for (const p of modelPresets()) {
+    const decision = decided[p.id];
+    if (decision?.action === 'skipped') continue;
+    // An answer recorded before decisions kept targetRoot cannot name its
+    // project, so it stays decided everywhere, as it was when it was given.
+    if (decision?.action === 'accepted' && (decision.scope !== 'project' || !decision.targetRoot ||
+        roots.includes(realProjectRoot(decision.targetRoot)))) continue;
     if (haveModel.has(`${p.tier}|${p.category}`)) continue;
     out.push({
       kind: 'model',
       id: p.id,
       tier: p.tier,
       label: lang === 'ko' ? p.label : p.labelEn,
-      agent: p.agent,
-      ruleText: composeRuleText(modelRuleBaseText(p, lang), { budget: p.budget }, lang),
+      agent: agent === 'codex' ? `Codex ${p.tier} mapping` : p.agent,
+      ruleText: agent === 'codex' ? codexSeedText(p, lang)
+        : composeRuleText(modelRuleBaseText(p, lang), { budget: p.budget }, lang),
       preset: p,
     });
   }
@@ -151,6 +148,13 @@ export function pendingSeeds({ lang = userLanguage(), root = findProjectRoot(),
   return out;
 }
 
+function codexSeedText(p, lang) {
+  const text = lang === 'ko'
+    ? `"${p.label}" 유형의 ${p.tier === 'T2' ? '단순' : '중간 난도'} 작업은 ${p.tier}에 위임합니다. 실행 모델은 Codex 매핑에서 정합니다.`
+    : `${p.tier === 'T2' ? 'Simple' : 'Moderate'} "${p.labelEn}" tasks use ${p.tier}. The execution model comes from the Codex mapping.`;
+  return composeRuleText(text, p, lang);
+}
+
 /** One pending seed by id, or null. Ids are matched exactly. */
 export function findSeed(id, opts = {}) {
   return pendingSeeds(opts).find((s) => s.id === id) || null;
@@ -222,12 +226,16 @@ export async function acceptSeed(id, { scope, root = findProjectRoot(), lang = u
     // Marks the rule as seeded rather than measured, so the rendered file does
     // not report someone else's recurrence count as this user's evidence.
     origin: 'preset',
+    approvedBy: agent,
     promotedAt: today,
     lastSeen: today,
   });
-  const written = syncAllFiles();
-  recordDecision(id, 'accepted', { scope }, { agent });
-  return { id, kind: 'model', scope, paths: written, rule: composeRuleText(entry.rule, entry, lang) };
+  // Codex-first installs need only the registry. Claude renders its view when
+  // it is installed or starts a session, without creating .claude here.
+  const written = agent === 'codex' ? [] : syncAllFiles();
+  recordDecision(id, 'accepted', { scope, targetRoot: scope === 'project' ? resolve(root) : null }, { agent });
+  return { id, kind: 'model', scope, paths: written,
+    rule: agent === 'codex' ? codexSeedText(p, lang) : composeRuleText(entry.rule, entry, lang) };
 }
 
 /**
@@ -277,13 +285,14 @@ export function seedOfferBlock({ lang = userLanguage(), root = findProjectRoot()
     // Codex hook text stays English; the rule text itself follows the user's language.
     const cmd = (s) => `${CLI_NAME} seed ${s} --agent codex`;
     return [
-      `[Sprag seed] ${pending.length} recommended Codex ratchet rule(s) from the bundled presets are not registered yet.`,
+      `[Sprag seed] ${pending.length} recommended shared delegation and Codex ratchet rule(s) from the bundled presets are not registered yet.`,
       'Ask in your first reply, after answering any request the user opened with. Offer these choices in this order:',
       `  1. Register all, globally: ${cmd('accept all --global')}`,
       `  2. Register all, this project only: ${cmd('accept all --project')}`,
       '  3. Decide one at a time: ask about each rule below and run its command as soon as they answer',
       `  4. Register none: ${cmd('skip all')} (never offered again)`,
       'Always confirm the scope with the user before running an accept command.',
+      'Delegation policies are shared across Claude and Codex; approval retains the chosen scope. Codex execution also requires delegate on and explicit tier mappings: sprag delegate shared status --agent codex. Never assume Claude model names are Codex models.',
       ...pending.map((s) => `  [${s.id}] ${s.ruleText}`),
     ].join('\n');
   }

package/src/session-cache.js

@@ -18,9 +18,10 @@
  * and misses return identically shaped objects).
  */
 
-import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync } from 'node:fs';
+import { readFileSync, existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { userDataDir } from './paths.js';
+import { writeViaTmp, runHousekeeping, sweepStaleTmp } from './state-file.js';
 import { debug } from './debug.js';
 
 const CACHE_PATH = join(userDataDir(), 'session-cache.json');
@@ -185,12 +186,19 @@ export function saveCache(cache) {
     for (const [path, e] of Object.entries(cache.entries)) {
       if (e && typeof e.mtimeMs === 'number' && e.mtimeMs >= cutoff) entries[path] = e;
     }
-    const tmp = `${CACHE_PATH}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify({ version: CACHE_VERSION, entries }) + '\n');
-    renameSync(tmp, CACHE_PATH);
+    writeViaTmp(`${CACHE_PATH}.${process.pid}.tmp`, CACHE_PATH, JSON.stringify({ version: CACHE_VERSION, entries }) + '\n');
   } catch (e) {
     debug('session-cache:save', e); // best-effort — never block a report
   }
+  // This runs on nearly every statusline render, so it is the natural place to
+  // notice temp files that killed processes left in the data directory. The
+  // sweep itself runs at most once a day (see runHousekeeping).
+  try {
+    const dir = userDataDir();
+    runHousekeeping(dir, { 'stale-tmp': () => sweepStaleTmp(dir) });
+  } catch (e) {
+    debug('session-cache:housekeeping', e);
+  }
 }
 
 export function sessionCachePath() {

package/src/shared-model-rules.js

@@ -0,0 +1,73 @@
+import { realpathSync } from 'node:fs';
+import { isAbsolute, resolve } from 'node:path';
+import { loadModelRules, ruleBudget } from './model-rules.js';
+import { findProjectRoot } from './harness.js';
+
+export const SHARED_RULE_TIERS = ['T2', 'T1'];
+const CATEGORIES = new Set(['paste', 'translate', 'explore', 'read', 'check', 'run']);
+
+/** A root as a real path, so a symlinked checkout or macOS /var names one directory once. */
+export function realProjectRoot(path) {
+  try { return realpathSync(path); } catch { return resolve(path); }
+}
+
+/**
+ * Every root either agent assigns to a working directory. Claude stops at
+ * CLAUDE.md and Codex at AGENTS.md, so a subdirectory holding only one of them
+ * gets a different root from each agent for the same project.
+ */
+export function sharedProjectRoots(start) {
+  const from = start || process.cwd();
+  return [...new Set(['claude', 'codex'].map((agent) => realProjectRoot(findProjectRoot(from, { agent }))))];
+}
+
+/** Read a policy view of the existing registry, never its model roles or statistics. */
+export function loadSharedModelRules({ includeInactive = false, ...opts } = {}) {
+  return loadModelRules(opts).rules.flatMap((r) => {
+    if (!r || !(r.status === 'active' || (includeInactive && ['off', 'review'].includes(r.status))) ||
+        !SHARED_RULE_TIERS.includes(r.tier) || !CATEGORIES.has(r.category) ||
+        !['global', 'project'].includes(r.scope)) return [];
+    if (r.scope === 'project' && (typeof r.targetRoot !== 'string' || !isAbsolute(r.targetRoot))) return [];
+    const targetRoot = r.scope === 'project' ? realProjectRoot(r.targetRoot) : null;
+    const budget = ruleBudget(r);
+    return [{ category: r.category, tier: r.tier, scope: r.scope, targetRoot,
+      sharedSignature: typeof r.signature === 'string' && r.signature.length <= 512 ? r.signature
+        : `${r.tier}|${r.category}|${targetRoot || '*'}`,
+      budget: {
+        calls: Number.isSafeInteger(budget?.calls) && budget.calls > 0 ? budget.calls : null,
+        out: Number.isSafeInteger(budget?.out) && budget.out > 0 ? budget.out : null,
+      } }];
+  });
+}
+
+/**
+ * How close a rule's scope is to the working directory: a project rule ranks
+ * by the depth of its root, so in a nested project the inner root wins, and
+ * any project rule outranks a global one. Registry order never decides.
+ */
+export function scopeRank(rule) {
+  return rule.scope === 'project' && typeof rule.targetRoot === 'string' ? realProjectRoot(rule.targetRoot).length : -1;
+}
+
+/**
+ * One policy per category and tier, the closest scope first (see scopeRank).
+ * `start` is the working directory when known; a project policy applies when
+ * its root is the root either agent assigns to that directory.
+ */
+export function sharedModelRulesForProject(rules, start) {
+  const roots = new Set(sharedProjectRoots(start));
+  const chosen = new Map();
+  for (const rule of rules) {
+    if (rule.scope !== 'global' && !roots.has(rule.targetRoot)) continue;
+    const key = `${rule.category}|${rule.tier}`;
+    if (!chosen.has(key) || scopeRank(rule) > scopeRank(chosen.get(key))) chosen.set(key, rule);
+  }
+  return [...chosen.values()];
+}
+
+export function sharedRuleBounds(rule) {
+  const caps = [];
+  if (rule.budget?.calls) caps.push(`${rule.budget.calls} tool calls`);
+  if (rule.budget?.out) caps.push(`${rule.budget.out} output tokens`);
+  return caps.length ? `Caller-approved cap: ${caps.join(' / ')}. Stop and report partial work before exceeding it.` : '';
+}