tickmarkr 1.30.0

package/dist/config/config.d.ts

@@ -0,0 +1,184 @@
+import { z } from "zod";
+declare const TierEnum: z.ZodEnum<{
+    cheap: "cheap";
+    mid: "mid";
+    frontier: "frontier";
+}>;
+export type Tier = z.infer<typeof TierEnum>;
+export declare const TIER_RANK: Record<Tier, number>;
+export declare const MapEntrySchema: z.ZodObject<{
+    pin: z.ZodOptional<z.ZodObject<{
+        via: z.ZodString;
+        model: z.ZodString;
+    }, z.core.$strip>>;
+    tier: z.ZodOptional<z.ZodEnum<{
+        cheap: "cheap";
+        mid: "mid";
+        frontier: "frontier";
+    }>>;
+    prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    escalate: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type MapEntry = z.infer<typeof MapEntrySchema>;
+export declare const TierEntrySchema: z.ZodObject<{
+    vendor: z.ZodString;
+    channel: z.ZodEnum<{
+        sub: "sub";
+        api: "api";
+    }>;
+    models: z.ZodRecord<z.ZodString, z.ZodEnum<{
+        cheap: "cheap";
+        mid: "mid";
+        frontier: "frontier";
+    }>>;
+}, z.core.$strip>;
+export type TierEntry = z.infer<typeof TierEntrySchema>;
+export declare const ModelPricingSchema: z.ZodObject<{
+    inPerMtok: z.ZodNumber;
+    outPerMtok: z.ZodNumber;
+    cacheReadPerMtok: z.ZodOptional<z.ZodNumber>;
+    rateDate: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ModelPricing = z.infer<typeof ModelPricingSchema>;
+export declare const SubPricingSchema: z.ZodObject<{
+    planMonthly: z.ZodNumber;
+    windowsPerMonthLow: z.ZodNumber;
+    windowsPerMonthHigh: z.ZodNumber;
+}, z.core.$strip>;
+export type SubPricing = z.infer<typeof SubPricingSchema>;
+export declare const DrovrConfigSchema: z.ZodObject<{
+    concurrency: z.ZodNumber;
+    driver: z.ZodEnum<{
+        auto: "auto";
+        herdr: "herdr";
+        subprocess: "subprocess";
+    }>;
+    integrationBranchPrefix: z.ZodString;
+    taskTimeoutMinutes: z.ZodNumber;
+    contextWarnTokens: z.ZodNumber;
+    setup: z.ZodOptional<z.ZodString>;
+    routing: z.ZodObject<{
+        map: z.ZodRecord<z.ZodString, z.ZodObject<{
+            pin: z.ZodOptional<z.ZodObject<{
+                via: z.ZodString;
+                model: z.ZodString;
+            }, z.core.$strip>>;
+            tier: z.ZodOptional<z.ZodEnum<{
+                cheap: "cheap";
+                mid: "mid";
+                frontier: "frontier";
+            }>>;
+            prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            escalate: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        floors: z.ZodRecord<z.ZodString, z.ZodEnum<{
+            cheap: "cheap";
+            mid: "mid";
+            frontier: "frontier";
+        }>>;
+        learned: z.ZodEnum<{
+            on: "on";
+            off: "off";
+        }>;
+        learnedTuning: z.ZodOptional<z.ZodObject<{
+            halfLifeRuns: z.ZodOptional<z.ZodNumber>;
+            availWeight: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        allow: z.ZodOptional<z.ZodObject<{
+            adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        deny: z.ZodOptional<z.ZodObject<{
+            adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    tiers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        vendor: z.ZodString;
+        channel: z.ZodEnum<{
+            sub: "sub";
+            api: "api";
+        }>;
+        models: z.ZodRecord<z.ZodString, z.ZodEnum<{
+            cheap: "cheap";
+            mid: "mid";
+            frontier: "frontier";
+        }>>;
+    }, z.core.$strip>>;
+    pricing: z.ZodRecord<z.ZodString, z.ZodNumber>;
+    cost: z.ZodOptional<z.ZodObject<{
+        models: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            inPerMtok: z.ZodNumber;
+            outPerMtok: z.ZodNumber;
+            cacheReadPerMtok: z.ZodOptional<z.ZodNumber>;
+            rateDate: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        subs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            planMonthly: z.ZodNumber;
+            windowsPerMonthLow: z.ZodNumber;
+            windowsPerMonthHigh: z.ZodNumber;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    gates: z.ZodObject<{
+        build: z.ZodOptional<z.ZodString>;
+        test: z.ZodOptional<z.ZodString>;
+        lint: z.ZodOptional<z.ZodString>;
+        byShape: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+            plan: "plan";
+            spec: "spec";
+            implement: "implement";
+            tests: "tests";
+            docs: "docs";
+            migration: "migration";
+            ui: "ui";
+            refactor: "refactor";
+            chore: "chore";
+        }> & z.core.$partial, z.ZodObject<{
+            acceptance: z.ZodOptional<z.ZodBoolean>;
+            review: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>>>>;
+    }, z.core.$strip>;
+    scope: z.ZodOptional<z.ZodObject<{
+        allowDeviations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    judge: z.ZodObject<{
+        adapter: z.ZodString;
+        model: z.ZodString;
+    }, z.core.$strip>;
+    review: z.ZodObject<{
+        complexityThreshold: z.ZodNumber;
+        required: z.ZodBoolean;
+    }, z.core.$strip>;
+    consult: z.ZodObject<{
+        adapter: z.ZodString;
+        model: z.ZodString;
+        stallMinutes: z.ZodNumber;
+    }, z.core.$strip>;
+    visibility: z.ZodObject<{
+        llm: z.ZodEnum<{
+            pane: "pane";
+            headless: "headless";
+        }>;
+        keepPanes: z.ZodEnum<{
+            run: "run";
+            attempt: "attempt";
+            forever: "forever";
+        }>;
+        worker: z.ZodEnum<{
+            interactive: "interactive";
+            print: "print";
+        }>;
+        workersPerTab: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type DrovrConfig = z.infer<typeof DrovrConfigSchema>;
+export declare class ConfigError extends Error {
+    constructor(message: string);
+}
+export declare const DEFAULT_CONFIG: DrovrConfig;
+export declare function globalConfigDir(): string;
+export declare function loadConfig(repoRoot: string, opts?: {
+    globalDir?: string;
+}): DrovrConfig;
+export declare function configTemplate(): string;
+export {};

package/dist/config/config.js

@@ -0,0 +1,329 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { z } from "zod";
+import { stateDirName } from "../graph/graph.js";
+import { SHAPES, TIERS } from "../graph/schema.js";
+const TierEnum = z.enum(TIERS, {
+    error: (iss) => `Invalid option: expected one of "cheap"|"mid"|"frontier" (got ${JSON.stringify(iss.input)})`,
+});
+export const TIER_RANK = { cheap: 0, mid: 1, frontier: 2 };
+export const MapEntrySchema = z.object({
+    pin: z.object({ via: z.string(), model: z.string() }).optional(),
+    tier: TierEnum.optional(),
+    prefer: z.array(z.string()).optional(),
+    escalate: z.boolean().optional(),
+});
+export const TierEntrySchema = z.object({
+    vendor: z.string(),
+    channel: z.enum(["sub", "api"]),
+    models: z.record(z.string(), TierEnum),
+});
+// v1.10 FLEET-06: optional routing.allow/deny fleet preference; absent blocks ⇒ byte-identical routing/discovery.
+// deny wins on conflict; presence of allow (even {} / empty arrays) activates allowlist (fail-closed).
+const PrefBlockSchema = z.object({
+    adapters: z.array(z.string()).optional(),
+    models: z.array(z.string()).optional(),
+});
+// v1.20 REC-02: operator-maintained price table for the usage/cost report (src/report/cost.ts). Two
+// channel economics, never conflated (spec cost model): API = tokens × per-Mtok rate; sub = flat plan
+// amortized over a windows/month RANGE (+ an API-equivalent counterfactual when the model has a rate).
+// ALL OPTIONAL: absent pricing ⇒ the estimator reports "not measurable" — never a crash or a fake $0.
+// Rate source to copy from: LiteLLM's model_prices_and_context_window.json (github.com/BerriAI/litellm),
+// the de-facto machine-readable price table ccusage/tokonomics both consume.
+export const ModelPricingSchema = z.object({
+    inPerMtok: z.number().nonnegative(),
+    outPerMtok: z.number().nonnegative(),
+    cacheReadPerMtok: z.number().nonnegative().optional(),
+    rateDate: z.string().optional(), // ISO date the rate was verified; echoed in every estimate's basis
+});
+export const SubPricingSchema = z
+    .object({
+    planMonthly: z.number().positive(),
+    windowsPerMonthLow: z.number().int().positive(),
+    windowsPerMonthHigh: z.number().int().positive(),
+})
+    .refine((s) => s.windowsPerMonthLow <= s.windowsPerMonthHigh, "windowsPerMonthLow must be ≤ windowsPerMonthHigh");
+const ShapeGateParticipationSchema = z
+    .object({ acceptance: z.boolean().optional(), review: z.boolean().optional() })
+    .passthrough()
+    .superRefine((entry, ctx) => {
+    for (const gate of Object.keys(entry)) {
+        if (gate === "acceptance" || gate === "review")
+            continue;
+        const invariant = gate === "build" || gate === "test" || gate === "lint" ? "baseline" : gate;
+        const mandatory = invariant === "baseline" || invariant === "evidence" || invariant === "scope";
+        ctx.addIssue({
+            code: "custom",
+            path: [gate],
+            message: mandatory
+                ? `${invariant} is a mandatory fail-closed gate invariant and cannot be configured per shape`
+                : `gates.byShape may configure only acceptance and review (not ${gate})`,
+        });
+    }
+});
+export const DrovrConfigSchema = z.object({
+    concurrency: z.number().int().positive(),
+    driver: z.enum(["auto", "herdr", "subprocess"]),
+    integrationBranchPrefix: z
+        .string()
+        .regex(/^[A-Za-z0-9][A-Za-z0-9._/-]*$/, "must be branch-safe (letters/digits/._/-, no spaces or shell metacharacters)")
+        .refine((v) => !v.includes(".."), "may not contain '..'"),
+    taskTimeoutMinutes: z.number().positive(),
+    // v1.23 T2: warn the operator once per attempt when a live worker's context fill crosses this
+    // token count (sampled at existing poll seams). Telemetry only — never blocks or kills a worker.
+    // Default 170_000 matches the overseer's proven ctx-watch.sh threshold.
+    contextWarnTokens: z.number().int().positive(),
+    setup: z.string().optional(),
+    routing: z.object({
+        map: z.record(z.string(), MapEntrySchema),
+        floors: z.record(z.string(), TierEnum),
+        learned: z.enum(["on", "off"]), // v1.6 ROUTE-09 kill switch; a typo (offf) fails loud via safeParse
+        // v1.9 ROUTE-15 — optional overrides for profile.ts HALF_LIFE_RUNS/AVAIL_WEIGHT; absent ⇒ byte-identical defaults.
+        // SIBLING of learned (not nested): routing.learned is the on/off enum switch.
+        learnedTuning: z.object({
+            halfLifeRuns: z.number().positive().optional(),
+            availWeight: z.number().nonnegative().optional(),
+        }).optional(),
+        allow: PrefBlockSchema.optional(),
+        deny: PrefBlockSchema.optional(),
+    }),
+    tiers: z.record(z.string(), TierEntrySchema),
+    pricing: z.record(z.string(), z.number()),
+    // v1.20 REC-02: optional detailed price table for cost estimation. Distinct from `pricing` above
+    // (the coarse per-task tier estimate `drovr plan` shows) — this one drives the usage/cost report.
+    // Absent ⇒ every channel reports "not measurable" (never $0). models keyed by model id (LiteLLM
+    // convention); subs keyed by adapter id (subscription plans are per-account, not per-token).
+    cost: z
+        .object({
+        models: z.record(z.string(), ModelPricingSchema).optional(),
+        subs: z.record(z.string(), SubPricingSchema).optional(),
+    })
+        .optional(),
+    gates: z.object({
+        build: z.string(),
+        test: z.string(),
+        lint: z.string(),
+        byShape: z.partialRecord(z.enum(SHAPES), ShapeGateParticipationSchema).optional(),
+    }).partial(),
+    scope: z.object({
+        // HARD-08: the ONLY authority that can excuse an out-of-scope edit. Globs, matched with the
+        // same picomatch options as files[] ({ dot: true }). Default [] = no excuses (fail-closed).
+        allowDeviations: z.array(z.string()),
+    }).partial().optional(),
+    judge: z.object({ adapter: z.string(), model: z.string() }),
+    review: z.object({ complexityThreshold: z.number(), required: z.boolean() }),
+    consult: z.object({ adapter: z.string(), model: z.string(), stallMinutes: z.number().positive() }),
+    visibility: z.object({
+        llm: z.enum(["pane", "headless"]),
+        keepPanes: z.enum(["run", "attempt", "forever"]),
+        worker: z.enum(["interactive", "print"]),
+        // VIS-09 item 2 (43-CONTEXT D-03): cap concurrent worker panes per WORKERS tab; the cap+1'th member
+        // overflows to a WORKERS-2 tab instead of further splitting tab 1 (bounded height, zero width risk).
+        // Positive int: zero/negative reddens the schema. Overlays omitting it parse (deepMerge over the
+        // default 3). Default 3: at a ~50-row terminal that's ~16 rows/pane (readable); the operator's
+        // 5-pane incident was ~10 rows each.
+        workersPerTab: z.number().int().positive(),
+    }),
+});
+export class ConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ConfigError";
+    }
+}
+export const DEFAULT_CONFIG = {
+    concurrency: 3,
+    driver: "auto",
+    integrationBranchPrefix: "drovr/",
+    taskTimeoutMinutes: 30,
+    contextWarnTokens: 170_000, // v1.23 T2: overseer ctx-watch.sh proven threshold
+    routing: {
+        map: {
+            plan: { pin: { via: "claude-code", model: "fable" } },
+            spec: { pin: { via: "claude-code", model: "fable" } },
+            implement: { tier: "mid", prefer: ["cursor-agent", "codex"] },
+            tests: { tier: "cheap", prefer: ["opencode"] },
+            docs: { tier: "cheap" },
+        },
+        floors: {
+            plan: "frontier", spec: "frontier", migration: "frontier",
+            implement: "mid", ui: "mid", refactor: "mid",
+            tests: "cheap", docs: "cheap", chore: "cheap",
+        },
+        // ROUTE-14 (2026-07-11, operator-adopted): learned reordering ON by default. Shipped OFF through v1.6/v1.7
+        // as a preview-then-adopt trust ramp (ROUTE-09); the operator adopts it here after v1.8 made learning
+        // auditable (VIS-05 `drovr report` learning section) and matured (decay ROUTE-11, scored utilization
+        // ROUTE-12, escalation tiebreak ROUTE-13). SAFE BY CONSTRUCTION: an empty/cold profile ⇒ every
+        // learnedScore returns exactly NEUTRAL ⇒ byte-identical v1.5 static routing, so ON only changes routing in
+        // a workspace that has accumulated ≥MIN_SAMPLES warm telemetry per cell. Preview any workspace's effect
+        // first with `drovr plan` / `drovr report`; flip to "off" to pin exact static routing (the kill switch stands).
+        learned: "on",
+    },
+    // Seed table (spec §13). New models = edit this (or your config.yaml), never code.
+    tiers: {
+        "claude-code": {
+            vendor: "anthropic", channel: "sub",
+            models: { fable: "frontier", opus: "frontier", sonnet: "mid", haiku: "cheap" },
+        },
+        // ids verified against installed CLI models_cache.json (codex 0.144.0, fetched 2026-07-09);
+        // gpt-5.4 / gpt-5.4-mini removed — OpenAI retirement 2026-07-23; sol=frontier / terra=mid / luna=cheap per OpenAI tier framing.
+        // MODEL-08 resolution (Phase 23, 23-LIVE-CHECK.md Finding 1): the v1.7 finding that codex refused
+        // gpt-5.6-sol was a codex 0.143.0 CLIENT-VERSION gate ("requires a newer version of Codex"), NOT a
+        // retired id. Installed codex 0.144.1 lists it (models_cache.json client_version 0.144.0, fetched
+        // 2026-07-10) AND a live runtime probe (`codex exec --model gpt-5.6-sol` → "OK", 2026-07-10) confirmed
+        // it runs. Reseeding away would be a regression — the CLI upgrade closed the gate. Seed stays.
+        codex: {
+            vendor: "openai", channel: "sub",
+            models: { "gpt-5.6-sol": "frontier", "gpt-5.5": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap" },
+        },
+        // grok-4.5 (xAI, released 2026-07-08) → mid: AA Intelligence 54 (#4), Terminal-Bench 2.1 83.3%
+        // (≈ GPT-5.5 83.4, Fable 5 84.3), SWE-bench Pro 64.7%, ~4.2× more token-efficient than Opus 4.8
+        // on SWE-b Pro (15,954 vs 67,020 output tokens). Near-frontier on terminal work at cheap price;
+        // conservative mid per policy — learned routing / overlays may raise. Researched 2026-07-10,
+        // promoted from overlay 2026-07-11 (MODEL-10).
+        // grok-4.5-fast → cheap: speed-optimized variant, no independent benchmark scores yet → floor tier.
+        // RETIRED 2026-07-13: cursor-agent seeds grok-4.5-xhigh / grok-4.5-fast-xhigh — CLI no longer reports
+        // either id (drovr plan lint, 2026-07-13). Tombstoned here; re-seed if cursor re-exposes them.
+        // (Benchmark provenance above still informs the native grok adapter seeds below.)
+        "cursor-agent": {
+            vendor: "cursor", channel: "sub",
+            models: {
+                "composer-2.5": "mid",
+            },
+        },
+        // GLM-5.2 → mid per benchmark policy (2026-07): SWE-bench Pro 62.1 (> GPT-5.5 58.6), FrontierSWE 74.4 ≈ Opus 4.8;
+        // no independent Terminal-Bench score → conservative mid, overlays may raise.
+        // MODEL-09 reseed (Phase 23, 23-LIVE-CHECK.md Finding 2): opencode 1.17.15 renamed the provider prefix
+        // opencode/ → zai-coding-plan/; the old id opencode/glm-5.2 is live-confirmed ABSENT and the new id
+        // zai-coding-plan/glm-5.2 present (`opencode models`, 2026-07-10). Tier stays mid — same model, benchmark
+        // unchanged (GLM-5.2 SWE-bench Pro 62.1).
+        opencode: {
+            vendor: "mixed", channel: "sub",
+            models: { "zai-coding-plan/glm-5.2": "mid" },
+        },
+        // GLM-5.2 via pi/ZAI Coding Plan (sub, flat-rate). mid per benchmark policy (2026-07):
+        // SWE-bench Pro 62.1, FrontierSWE 74.4 — same rationale as the opencode glm-5.2 seed above.
+        // id "zai/glm-5.2" verified via pi --list-models v0.80.3, 2026-07-10 (provider zai, model glm-5.2);
+        // provider-qualified so the channel never depends on ~/.pi/agent/settings.json defaults.
+        // Also exists as opencode:zai-coding-plan/glm-5.2 — two channels, one model, distinct channelKeys, intentional
+        // (opencode zen vs ZAI Coding Plan billing paths); review-diversity hole (zhipu vs mixed = same model
+        // cross-harness) is pre-existing, FLEET-05 owns it.
+        pi: {
+            vendor: "zhipu", channel: "sub",
+            models: { "zai/glm-5.2": "mid" },
+        },
+        // Native grok CLI (Phase 40). grok-4.5 → mid: same benchmark provenance as the retired cursor-agent
+        // grok-4.5-xhigh seed above (AA 54, TB2.1 83.3%, SWE-b Pro 64.7% — researched 2026-07-10).
+        // grok-composer-2.5-fast → cheap: fast variant, no independent benchmark scores yet → floor tier
+        // (same policy call as grok-4.5-fast, above). Ids live-verified `grok models` 2026-07-11, grok 0.2.93.
+        // Distinct channel from any former cursor-agent grok seed; channelKey() disambiguates (40-CONTEXT D-06).
+        grok: {
+            vendor: "xai", channel: "sub",
+            models: { "grok-4.5": "mid", "grok-composer-2.5-fast": "cheap" },
+        },
+    },
+    pricing: { cheap: 0.1, mid: 0.5, frontier: 2.5 },
+    gates: {},
+    judge: { adapter: "claude-code", model: "fable" },
+    review: { complexityThreshold: 7, required: true },
+    consult: { adapter: "claude-code", model: "fable", stallMinutes: 15 },
+    // v1.4: gate LLM calls (judge/review/consult) run headless by default; pane opts back into visible agents.
+    // v1.2: workers are the real agent TUI in the pane; "print" restores the -p-rendered-in-pane path.
+    visibility: { llm: "headless", keepPanes: "run", worker: "interactive", workersPerTab: 3 },
+};
+function deepMerge(base, over) {
+    if (over === undefined || over === null)
+        return base;
+    if (Array.isArray(base) || Array.isArray(over) || typeof base !== "object" || typeof over !== "object" || base === null) {
+        return over;
+    }
+    const out = { ...base };
+    for (const [k, v] of Object.entries(over)) {
+        if (v === null) {
+            delete out[k]; // v1.1 tombstone: an explicit null in an overlay removes the key (e.g. stale tiers model ids)
+            continue;
+        }
+        out[k] = k in out ? deepMerge(out[k], v) : v;
+    }
+    return out;
+}
+function readYaml(path) {
+    if (!existsSync(path))
+        return undefined;
+    return parse(readFileSync(path, "utf8"));
+}
+export function globalConfigDir() {
+    return process.env.XDG_CONFIG_HOME
+        ? join(process.env.XDG_CONFIG_HOME, "drovr")
+        : join(homedir(), ".config", "drovr");
+}
+export function loadConfig(repoRoot, opts = {}) {
+    const globalCfg = readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml"));
+    const repoCfg = readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"));
+    const merged = deepMerge(deepMerge(structuredClone(DEFAULT_CONFIG), globalCfg), repoCfg);
+    const r = DrovrConfigSchema.safeParse(merged);
+    if (!r.success)
+        throw new ConfigError(z.prettifyError(r.error));
+    return r.data;
+}
+export function configTemplate() {
+    return `# drovr config overlay — merges over built-in defaults (repo beats global beats defaults)
+# concurrency: 3
+# driver: auto            # auto | herdr | subprocess
+# taskTimeoutMinutes: 30
+# contextWarnTokens: 170000   # v1.23: journal+notify once per attempt when live worker context crosses this (status shows the sample)
+# setup: npm ci --prefer-offline   # run in each fresh task worktree before dispatch
+# routing:
+#   map:                  # per-shape routing; pin an exact CLI+model, or tier+prefer
+#     implement: { tier: mid, prefer: [cursor-agent, codex] }
+#     migration: { pin: { via: claude-code, model: fable } }
+#   floors:               # advisory minimum tiers; 'drovr plan' lints violations
+#     migration: frontier
+#   learned: on            # default ON (ROUTE-14); cold profile = exact v1.5 static routing, warms per workspace. Set 'off' to pin static routing; preview with 'drovr plan'
+#   learnedTuning: { halfLifeRuns: 5, availWeight: 0.05 }  # optional; defaults byte-identical
+#   allow: { adapters: [claude-code, codex] }   # optional fleet allowlist; presence activates even if empty (fail-closed)
+#   deny: { models: [codex:gpt-5.5] }           # optional fleet denylist; deny beats allow on conflict
+#   # entry grammar: adapter id | model id | adapter:model (entries in either list accept all three forms)
+#   # a hint pinning a denied channel FAILS at plan time (RoutingError) — never silent reroute
+#   # tombstone: deny: null in a repo overlay removes a global deny (arrays replace wholesale, never merge)
+# tiers:                  # model → capability band; extend when new models ship
+#   claude-code: { vendor: anthropic, channel: sub, models: { fable: frontier } }
+#   codex: { models: { gpt-5.2-codex: null } }   # null = tombstone: removes a stale seed id
+# visibility:
+#   llm: headless         # headless (default): judge/review/consult run silently | pane: visible agents
+#   keepPanes: run        # run (default): ephemeral judge/review/consult panes close when read; a merged task's worker pane closes on done; other worker panes persist until run end | attempt | forever (keep everything for debugging)
+#   worker: interactive   # interactive (default): workers run the real agent TUI | print
+#   workersPerTab: 3      # cap concurrent worker panes per WORKERS tab; overflow opens WORKERS-2 (VIS-09). Default 3
+# scope:
+#   allowDeviations: []    # globs an operator permits out-of-scope edits into, e.g. ["package-lock.json"]
+# gates:                  # override auto-detected commands; per-shape participation may only skip LLM gates
+#   test: npm test
+#   byShape:
+#     docs: { acceptance: false, review: false }  # baseline, evidence, and scope are mandatory
+# review: { complexityThreshold: 7, required: true }
+# consult: { adapter: claude-code, model: fable, stallMinutes: 15 }
+# cost:                   # v1.20 REC-02 — OPTIONAL price table for the usage/cost report. Absent ⇒ every
+#                         # channel reports "not measurable" (never a crash or a fake $0). Two economics,
+#                         # never conflated: API = tokens × per-Mtok rate; sub = flat plan amortized over a
+#                         # windows/month range, plus an API-equivalent counterfactual when the model has a rate.
+#   models:               # per-Mtok API rates by model id. Copy from LiteLLM's
+#                         # model_prices_and_context_window.json (github.com/BerriAI/litellm) — the de-facto
+#                         # price table ccusage/tokonomics consume. Stamp rateDate; refresh on vendor changes.
+#     opus:   { inPerMtok: 5.0,  outPerMtok: 25.0, cacheReadPerMtok: 0.5, rateDate: 2026-07-13 }
+#     sonnet: { inPerMtok: 3.0,  outPerMtok: 15.0, rateDate: 2026-07-13 }
+#   subs:                 # subscription plans by adapter id (plans are per-account, not per-token).
+#                         # windowsPerMonthLow/High is a RANGE (time-varying quotas, e.g. GLM peak 3×).
+#     claude-code: { planMonthly: 200, windowsPerMonthLow: 400, windowsPerMonthHigh: 1200 }
+# NOTE: claude workers/judges run with --strict-mcp-config --mcp-config '{"mcpServers":{}}' — project
+# .mcp.json servers (e.g. supabase) are UNAVAILABLE in worktrees. Deliberate: prevents the MCP-enable
+# dialog stalling unattended HEADLESS runs (live-verified on claude 2.1.205). Interactive TUIs still
+# show a first-entry dialog — but it is the workspace TRUST dialog, not MCP config loading (live-drilled
+# claude 2.1.206, 2026-07-10). There is NO CLI flag to pre-accept trust; the only store is claude's global
+# ~/.claude.json keyed on the EXACT worktree path. drovr does NOT write it (HYG-03 won't-fix, decision B:
+# claude's own last-writer-wins persistence races any seed). Cost is ~one dismissal per worktree path,
+# ever — drovr reuses stable worktree paths so the accept persists across runs; blocked-pane paging
+# surfaces each first-time dialog.
+`;
+}

package/dist/drivers/herdr.d.ts

@@ -0,0 +1,44 @@
+import { type ExecutorDriver, type NotifyOpts, type Slot, type SlotOpts } from "./types.js";
+export declare const TRAILER_SAFE_FLOOR_COLS = 108;
+export declare const TRAILER_WIDTH_MARGIN = 2;
+/** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
+export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
+export declare class HerdrDriver implements ExecutorDriver {
+    private bin;
+    private workersPerTab;
+    id: string;
+    interactive: boolean;
+    private groups;
+    private groupSerial;
+    private ws;
+    constructor(bin?: string, workersPerTab?: number);
+    private serial;
+    static available(): boolean;
+    private herdr;
+    private paneId;
+    private paneWidth;
+    slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    private tabSlot;
+    private groupSlot;
+    private newGeneration;
+    private renameGroupTab;
+    private glyphFor;
+    private joinGroup;
+    run(slot: Slot, cmd: string): Promise<void>;
+    waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {
+        regex?: boolean;
+    }): Promise<boolean>;
+    waitAgentStatus(slot: Slot, status: string, timeoutMs: number): Promise<boolean>;
+    status(slot: Slot): Promise<string>;
+    private statusByName;
+    read(slot: Slot, lines: number): Promise<string>;
+    sendKey(slot: Slot, key: string): Promise<void>;
+    notify(msg: string, opts?: NotifyOpts): Promise<void>;
+    close(slot: Slot): Promise<void>;
+    private closeGrouped;
+    narrator(cwd: string, command: string, runId?: string): Promise<Slot>;
+    reconcile(desired: Set<string>, runId: string, opts?: {
+        spareLiveLlm?: boolean;
+    }): Promise<void>;
+    worktree(repo: string, branch: string, baseRef: string): Promise<string>;
+}