titan-agent 6.5.3 → 7.1.0

package/dist/agent/autoModeClassifier.js

@@ -20,6 +20,22 @@ function getAutoModePolicy() {
   }
   return "standard";
 }
+const NAME_GATED_EXACT = /* @__PURE__ */ new Set([
+  "shell",
+  "run_shell",
+  "bash",
+  "run_command",
+  "execute_command",
+  "exec",
+  "delete_file",
+  "bulk_delete_labels",
+  "phone_call",
+  "make_call"
+]);
+const NAME_GATED_PATTERN = /(^|_)(delete|destroy|wipe|purge|deploy|publish|transfer|payment|purchase|wire|send_email|email_send)(_|$)/i;
+function nameLooksHighImpact(toolName) {
+  return NAME_GATED_EXACT.has(toolName) || NAME_GATED_PATTERN.test(toolName);
+}
 function classifyToolCall(toolName) {
   const policy = getAutoModePolicy();
   const contract = getToolContract(toolName);
@@ -42,9 +58,16 @@ function classifyToolCall(toolName) {
     };
   }
   if (!contract) {
+    if (nameLooksHighImpact(toolName)) {
+      return {
+        decision: "gate",
+        reason: `no contract + high-impact name "${toolName}" \u2014 gating`,
+        policy
+      };
+    }
     return {
-      decision: "gate",
-      reason: `no contract registered for "${toolName}" \u2014 gating by default`,
+      decision: "notify",
+      reason: `no contract for "${toolName}" \u2014 notify (benign long-tail)`,
       policy
     };
   }
@@ -90,6 +113,7 @@ export {
   classifyToolCall,
   formatBreadcrumb,
   getAutoModePolicy,
+  nameLooksHighImpact,
   shouldGate
 };
 //# sourceMappingURL=autoModeClassifier.js.map

package/dist/agent/autoModeClassifier.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/agent/autoModeClassifier.ts"],"sourcesContent":["/**\n * TITAN — Auto-Mode Classifier (v6.1.0-beta.16, Phase D.4)\n *\n * Reads the tool contract registry to decide whether an incoming\n * tool call can run autonomously, deserves a passive notification,\n * or requires explicit human approval. Pattern from Anthropic's\n * \"Claude Code auto-mode\" blog (in the Picrew/awesome-agent-harness\n * featured-reading list): classifier-backed approval delegation\n * gives the agent autonomy on safe paths while keeping a kill\n * switch on the risky ones.\n *\n * THREE DECISIONS:\n *\n *   - 'auto'    — run without prompting. Read-only ops + workspace\n *                 writes. Most missions run mostly 'auto' calls.\n *   - 'notify'  — run, but record a passive notification so a\n *                 watcher (Mission Canvas, log tail) can see it\n *                 happened. Default for network calls.\n *   - 'gate'    — require explicit human approval before running.\n *                 Default for destructive ops (shell, delete, etc.)\n *                 AND for any tool without a registered contract\n *                 (unknown → conservative).\n *\n * POLICY OVERRIDES (config.security.autoMode.policy):\n *\n *   - 'standard'  (default) — riskLevel drives the decision per\n *                             the table above.\n *   - 'paranoid'             — every tool call is 'gate'. For\n *                             demos, regulated environments, or\n *                             when Tony is debugging a misbehaving\n *                             agent.\n *   - 'permissive'           — riskLevel 'moderate' is auto-run\n *                             (still 'gate' on 'high'). For\n *                             trusted hot loops where ping-the-user\n *                             on every web_search is annoying.\n *   - 'yolo'                 — everything auto, including 'high'.\n *                             ONLY for sandboxed eval runs. Logs\n *                             a loud warning on init.\n *\n * WHY this module exists:\n *\n *   - Phase D.3 added riskLevel + sideEffects metadata to the 9\n *     canonical contracts. D.4 makes the metadata actually do\n *     something — gating decisions, not just labels.\n *\n *   - The existing approval-gate path in toolRunner uses a hardcoded\n *     \"is this tool name dangerous?\" list. That's a string-match\n *     allowlist that doesn't scale and doesn't account for HOW the\n *     tool is being used. The classifier is the structural answer:\n *     contracts declare risk; the classifier reads contracts.\n *\n *   - Decoupling the policy from the runner means changing the\n *     gating semantics (e.g. add a new 'risky-during-business-hours'\n *     decision) is a one-file change — never a wholesale runner\n *     refactor.\n *\n * TRADE-OFFS:\n *\n *   - First cut keys decisions on contract.riskLevel alone. A\n *     follow-up could consider call ARGS (e.g. shell with\n *     `command: 'ls'` could be 'auto' while shell with\n *     `command: 'rm -rf'` is still 'gate'). Skipped for now to\n *     keep the surface small + predictable.\n *\n *   - Tools without a registered contract default to 'gate'. This\n *     is conservative but means the long-tail 239 skills will hit\n *     the approval gate on every call until their contracts ship.\n *     If that becomes painful, lift the default to 'notify' via\n *     the `unknownToolDefault` config field.\n *\n * FOLLOW-UP:\n *\n *   - Phase D.5 reads sideEffects==='destructive' to route the\n *     call into a worktree-isolated executor.\n *   - Args-aware classification (shell `rm -rf` vs shell `ls`).\n *   - Per-session policy override so a \"draft a quick email\"\n *     mission can opt into 'permissive' while a \"review and merge\n *     this PR\" mission stays on 'paranoid'.\n */\n\nimport { getToolContract, type RiskLevel } from './toolContract.js';\nimport { loadConfig } from '../config/config.js';\nimport logger from '../utils/logger.js';\n\nconst COMPONENT = 'autoMode';\n\n/* ──────────────────────────  Types  ────────────────────────── */\n\nexport type AutoModeDecision = 'auto' | 'notify' | 'gate';\nexport type AutoModePolicy = 'standard' | 'paranoid' | 'permissive' | 'yolo';\n\nexport interface ClassificationResult {\n    /** What the runner should do with the call. */\n    decision: AutoModeDecision;\n    /** Plain-english reason — logged and surfaced in the trajectory. */\n    reason: string;\n    /** Policy that produced this decision (drives observability). */\n    policy: AutoModePolicy;\n    /** Risk level from the contract, if any. Undefined for unknown tools. */\n    riskLevel?: RiskLevel;\n}\n\n/* ──────────────────────────  Policy loader  ────────────────────────── */\n\n/**\n * Resolve the current auto-mode policy. Reads\n * `config.security.autoMode.policy` if present; defaults to 'standard'.\n * Pure synchronous lookup — no IO, safe to call per-tool-call.\n */\nexport function getAutoModePolicy(): AutoModePolicy {\n    // beta.21 — env override. Lets the test suite (and any embedder\n    // that wants a process-wide policy without touching config files)\n    // short-circuit the classifier without mutating loaded config.\n    // Production callers should configure via `config.security.autoMode.policy`\n    // — this env hook is opt-in and silent when unset.\n    const envPolicy = process.env.TITAN_AUTOMODE_POLICY;\n    if (envPolicy === 'paranoid' || envPolicy === 'permissive' || envPolicy === 'yolo' || envPolicy === 'standard') {\n        return envPolicy;\n    }\n    try {\n        const cfg = loadConfig();\n        const sec = (cfg as Record<string, unknown>).security as Record<string, unknown> | undefined;\n        const am = sec?.autoMode as Record<string, unknown> | undefined;\n        const policy = am?.policy as string | undefined;\n        if (policy === 'paranoid' || policy === 'permissive' || policy === 'yolo' || policy === 'standard') {\n            return policy;\n        }\n    } catch { /* config unavailable — fall through */ }\n    return 'standard';\n}\n\n/* ──────────────────────────  Classifier  ────────────────────────── */\n\n/**\n * Decide whether a tool call should run automatically, with a\n * notification, or with explicit approval. The runner uses this to\n * decide whether to short-circuit the existing approval-gate path.\n *\n * Pure: no IO beyond reading the config + contract registry. Cheap\n * enough to call on every tool call without measuring.\n */\nexport function classifyToolCall(toolName: string): ClassificationResult {\n    const policy = getAutoModePolicy();\n    const contract = getToolContract(toolName);\n    const riskLevel = contract?.riskLevel;\n\n    // yolo short-circuit: regardless of risk, run. ONLY for sandboxed\n    // eval runs — logs a loud warning the first time per process.\n    if (policy === 'yolo') {\n        warnYoloOnce();\n        return {\n            decision: 'auto',\n            reason: 'yolo policy — gating disabled',\n            policy,\n            riskLevel,\n        };\n    }\n\n    // paranoid short-circuit: every call gated.\n    if (policy === 'paranoid') {\n        return {\n            decision: 'gate',\n            reason: 'paranoid policy — every tool call requires approval',\n            policy,\n            riskLevel,\n        };\n    }\n\n    // Unknown tool (no registered contract) → conservative 'gate'.\n    // The long-tail 239 skills without contracts hit this branch\n    // until their contracts ship. Override via config if the prompt\n    // pings become annoying.\n    if (!contract) {\n        return {\n            decision: 'gate',\n            reason: `no contract registered for \"${toolName}\" — gating by default`,\n            policy,\n        };\n    }\n\n    // Standard + permissive paths read riskLevel.\n    if (riskLevel === 'safe') {\n        return { decision: 'auto', reason: 'contract riskLevel=safe', policy, riskLevel };\n    }\n    if (riskLevel === 'moderate') {\n        if (policy === 'permissive') {\n            return { decision: 'auto', reason: 'permissive policy — moderate risk auto-runs', policy, riskLevel };\n        }\n        return { decision: 'notify', reason: 'contract riskLevel=moderate', policy, riskLevel };\n    }\n    if (riskLevel === 'high') {\n        return { decision: 'gate', reason: 'contract riskLevel=high', policy, riskLevel };\n    }\n\n    // Defensive fallback for an unknown future riskLevel value.\n    return {\n        decision: 'gate',\n        reason: `unrecognised riskLevel \"${riskLevel}\" — gating defensively`,\n        policy,\n        riskLevel,\n    };\n}\n\n/* ──────────────────────────  Helpers  ────────────────────────── */\n\nlet _yoloWarned = false;\nfunction warnYoloOnce(): void {\n    if (_yoloWarned) return;\n    _yoloWarned = true;\n    logger.warn(\n        COMPONENT,\n        'AUTO_MODE=yolo — every tool call will run without approval. This mode is ONLY intended for sandboxed eval runs. If you see this in production logs, something is misconfigured.',\n    );\n}\n\n/** For tests. */\nexport function _resetYoloWarning(): void {\n    _yoloWarned = false;\n}\n\n/**\n * Convenience: returns true iff the decision means the call should\n * NOT proceed without explicit human approval. Used by the runner\n * to short-circuit the existing approval-gate path on 'auto' /\n * 'notify' decisions.\n */\nexport function shouldGate(result: ClassificationResult): boolean {\n    return result.decision === 'gate';\n}\n\n/**\n * Format the classification as a one-line breadcrumb suitable for\n * the trajectory `note` event. Used by the runner on 'notify'\n * decisions so the trajectory captures what the agent did\n * autonomously vs what required a human prompt.\n */\nexport function formatBreadcrumb(toolName: string, result: ClassificationResult): string {\n    return `automode:${result.decision} tool=${toolName} risk=${result.riskLevel ?? 'unknown'} policy=${result.policy} (${result.reason})`;\n}\n"],"mappings":";AAgFA,SAAS,uBAAuC;AAChD,SAAS,kBAAkB;AAC3B,OAAO,YAAY;AAEnB,MAAM,YAAY;AAyBX,SAAS,oBAAoC;AAMhD,QAAM,YAAY,QAAQ,IAAI;AAC9B,MAAI,cAAc,cAAc,cAAc,gBAAgB,cAAc,UAAU,cAAc,YAAY;AAC5G,WAAO;AAAA,EACX;AACA,MAAI;AACA,UAAM,MAAM,WAAW;AACvB,UAAM,MAAO,IAAgC;AAC7C,UAAM,KAAK,KAAK;AAChB,UAAM,SAAS,IAAI;AACnB,QAAI,WAAW,cAAc,WAAW,gBAAgB,WAAW,UAAU,WAAW,YAAY;AAChG,aAAO;AAAA,IACX;AAAA,EACJ,QAAQ;AAAA,EAA0C;AAClD,SAAO;AACX;AAYO,SAAS,iBAAiB,UAAwC;AACrE,QAAM,SAAS,kBAAkB;AACjC,QAAM,WAAW,gBAAgB,QAAQ;AACzC,QAAM,YAAY,UAAU;AAI5B,MAAI,WAAW,QAAQ;AACnB,iBAAa;AACb,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAGA,MAAI,WAAW,YAAY;AACvB,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAMA,MAAI,CAAC,UAAU;AACX,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ,+BAA+B,QAAQ;AAAA,MAC/C;AAAA,IACJ;AAAA,EACJ;AAGA,MAAI,cAAc,QAAQ;AACtB,WAAO,EAAE,UAAU,QAAQ,QAAQ,2BAA2B,QAAQ,UAAU;AAAA,EACpF;AACA,MAAI,cAAc,YAAY;AAC1B,QAAI,WAAW,cAAc;AACzB,aAAO,EAAE,UAAU,QAAQ,QAAQ,oDAA+C,QAAQ,UAAU;AAAA,IACxG;AACA,WAAO,EAAE,UAAU,UAAU,QAAQ,+BAA+B,QAAQ,UAAU;AAAA,EAC1F;AACA,MAAI,cAAc,QAAQ;AACtB,WAAO,EAAE,UAAU,QAAQ,QAAQ,2BAA2B,QAAQ,UAAU;AAAA,EACpF;AAGA,SAAO;AAAA,IACH,UAAU;AAAA,IACV,QAAQ,2BAA2B,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACJ;AACJ;AAIA,IAAI,cAAc;AAClB,SAAS,eAAqB;AAC1B,MAAI,YAAa;AACjB,gBAAc;AACd,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;AAGO,SAAS,oBAA0B;AACtC,gBAAc;AAClB;AAQO,SAAS,WAAW,QAAuC;AAC9D,SAAO,OAAO,aAAa;AAC/B;AAQO,SAAS,iBAAiB,UAAkB,QAAsC;AACrF,SAAO,YAAY,OAAO,QAAQ,SAAS,QAAQ,SAAS,OAAO,aAAa,SAAS,WAAW,OAAO,MAAM,KAAK,OAAO,MAAM;AACvI;","names":[]}
+{"version":3,"sources":["../../src/agent/autoModeClassifier.ts"],"sourcesContent":["/**\n * TITAN — Auto-Mode Classifier (v6.1.0-beta.16, Phase D.4)\n *\n * Reads the tool contract registry to decide whether an incoming\n * tool call can run autonomously, deserves a passive notification,\n * or requires explicit human approval. Pattern from Anthropic's\n * \"Claude Code auto-mode\" blog (in the Picrew/awesome-agent-harness\n * featured-reading list): classifier-backed approval delegation\n * gives the agent autonomy on safe paths while keeping a kill\n * switch on the risky ones.\n *\n * THREE DECISIONS:\n *\n *   - 'auto'    — run without prompting. Read-only ops + workspace\n *                 writes. Most missions run mostly 'auto' calls.\n *   - 'notify'  — run, but record a passive notification so a\n *                 watcher (Mission Canvas, log tail) can see it\n *                 happened. Default for network calls.\n *   - 'gate'    — require explicit human approval before running.\n *                 Default for destructive ops (shell, delete, etc.)\n *                 AND for any tool without a registered contract\n *                 (unknown → conservative).\n *\n * POLICY OVERRIDES (config.security.autoMode.policy):\n *\n *   - 'standard'  (default) — riskLevel drives the decision per\n *                             the table above.\n *   - 'paranoid'             — every tool call is 'gate'. For\n *                             demos, regulated environments, or\n *                             when Tony is debugging a misbehaving\n *                             agent.\n *   - 'permissive'           — riskLevel 'moderate' is auto-run\n *                             (still 'gate' on 'high'). For\n *                             trusted hot loops where ping-the-user\n *                             on every web_search is annoying.\n *   - 'yolo'                 — everything auto, including 'high'.\n *                             ONLY for sandboxed eval runs. Logs\n *                             a loud warning on init.\n *\n * WHY this module exists:\n *\n *   - Phase D.3 added riskLevel + sideEffects metadata to the 9\n *     canonical contracts. D.4 makes the metadata actually do\n *     something — gating decisions, not just labels.\n *\n *   - The existing approval-gate path in toolRunner uses a hardcoded\n *     \"is this tool name dangerous?\" list. That's a string-match\n *     allowlist that doesn't scale and doesn't account for HOW the\n *     tool is being used. The classifier is the structural answer:\n *     contracts declare risk; the classifier reads contracts.\n *\n *   - Decoupling the policy from the runner means changing the\n *     gating semantics (e.g. add a new 'risky-during-business-hours'\n *     decision) is a one-file change — never a wholesale runner\n *     refactor.\n *\n * TRADE-OFFS:\n *\n *   - First cut keys decisions on contract.riskLevel alone. A\n *     follow-up could consider call ARGS (e.g. shell with\n *     `command: 'ls'` could be 'auto' while shell with\n *     `command: 'rm -rf'` is still 'gate'). Skipped for now to\n *     keep the surface small + predictable.\n *\n *   - Tools without a registered contract default to 'gate'. This\n *     is conservative but means the long-tail 239 skills will hit\n *     the approval gate on every call until their contracts ship.\n *     If that becomes painful, lift the default to 'notify' via\n *     the `unknownToolDefault` config field.\n *\n * FOLLOW-UP:\n *\n *   - Phase D.5 reads sideEffects==='destructive' to route the\n *     call into a worktree-isolated executor.\n *   - Args-aware classification (shell `rm -rf` vs shell `ls`).\n *   - Per-session policy override so a \"draft a quick email\"\n *     mission can opt into 'permissive' while a \"review and merge\n *     this PR\" mission stays on 'paranoid'.\n */\n\nimport { getToolContract, type RiskLevel } from './toolContract.js';\nimport { loadConfig } from '../config/config.js';\nimport logger from '../utils/logger.js';\n\nconst COMPONENT = 'autoMode';\n\n/* ──────────────────────────  Types  ────────────────────────── */\n\nexport type AutoModeDecision = 'auto' | 'notify' | 'gate';\nexport type AutoModePolicy = 'standard' | 'paranoid' | 'permissive' | 'yolo';\n\nexport interface ClassificationResult {\n    /** What the runner should do with the call. */\n    decision: AutoModeDecision;\n    /** Plain-english reason — logged and surfaced in the trajectory. */\n    reason: string;\n    /** Policy that produced this decision (drives observability). */\n    policy: AutoModePolicy;\n    /** Risk level from the contract, if any. Undefined for unknown tools. */\n    riskLevel?: RiskLevel;\n}\n\n/* ──────────────────────────  Policy loader  ────────────────────────── */\n\n/**\n * Resolve the current auto-mode policy. Reads\n * `config.security.autoMode.policy` if present; defaults to 'standard'.\n * Pure synchronous lookup — no IO, safe to call per-tool-call.\n */\nexport function getAutoModePolicy(): AutoModePolicy {\n    // beta.21 — env override. Lets the test suite (and any embedder\n    // that wants a process-wide policy without touching config files)\n    // short-circuit the classifier without mutating loaded config.\n    // Production callers should configure via `config.security.autoMode.policy`\n    // — this env hook is opt-in and silent when unset.\n    const envPolicy = process.env.TITAN_AUTOMODE_POLICY;\n    if (envPolicy === 'paranoid' || envPolicy === 'permissive' || envPolicy === 'yolo' || envPolicy === 'standard') {\n        return envPolicy;\n    }\n    try {\n        const cfg = loadConfig();\n        const sec = (cfg as Record<string, unknown>).security as Record<string, unknown> | undefined;\n        const am = sec?.autoMode as Record<string, unknown> | undefined;\n        const policy = am?.policy as string | undefined;\n        if (policy === 'paranoid' || policy === 'permissive' || policy === 'yolo' || policy === 'standard') {\n            return policy;\n        }\n    } catch { /* config unavailable — fall through */ }\n    return 'standard';\n}\n\n/**\n * Inherently high-impact operations that stay gated even without a declared\n * contract — arbitrary command execution, destructive deletes, deploys, and\n * irreversible external sends/payments. Everything else uncontracted runs with\n * a notify (see classifyToolCall). Curated conservatively; a tool that should\n * gate but is missing here can still be added to the user approval list.\n */\nconst NAME_GATED_EXACT = new Set<string>([\n    'shell', 'run_shell', 'bash', 'run_command', 'execute_command', 'exec',\n    'delete_file', 'bulk_delete_labels', 'phone_call', 'make_call',\n]);\nconst NAME_GATED_PATTERN = /(^|_)(delete|destroy|wipe|purge|deploy|publish|transfer|payment|purchase|wire|send_email|email_send)(_|$)/i;\n\nexport function nameLooksHighImpact(toolName: string): boolean {\n    return NAME_GATED_EXACT.has(toolName) || NAME_GATED_PATTERN.test(toolName);\n}\n\n/* ──────────────────────────  Classifier  ────────────────────────── */\n\n/**\n * Decide whether a tool call should run automatically, with a\n * notification, or with explicit approval. The runner uses this to\n * decide whether to short-circuit the existing approval-gate path.\n *\n * Pure: no IO beyond reading the config + contract registry. Cheap\n * enough to call on every tool call without measuring.\n */\nexport function classifyToolCall(toolName: string): ClassificationResult {\n    const policy = getAutoModePolicy();\n    const contract = getToolContract(toolName);\n    const riskLevel = contract?.riskLevel;\n\n    // yolo short-circuit: regardless of risk, run. ONLY for sandboxed\n    // eval runs — logs a loud warning the first time per process.\n    if (policy === 'yolo') {\n        warnYoloOnce();\n        return {\n            decision: 'auto',\n            reason: 'yolo policy — gating disabled',\n            policy,\n            riskLevel,\n        };\n    }\n\n    // paranoid short-circuit: every call gated.\n    if (policy === 'paranoid') {\n        return {\n            decision: 'gate',\n            reason: 'paranoid policy — every tool call requires approval',\n            policy,\n            riskLevel,\n        };\n    }\n\n    // Unknown tool (no registered contract). The long-tail of ~239 skills has\n    // no contract, so gating ALL of them walled benign actions (search, read,\n    // widget-building, …) behind approval on every call — which broke the\n    // \"ask TITAN to build a weather widget\" flow and made the agent feel broken.\n    //\n    // v7.0 fix: uncontracted tools run with a 'notify' (visible, logged) by\n    // default, EXCEPT a curated set of inherently high-impact operations that\n    // stay gated by name. Dangerous shell commands + URLs are independently\n    // caught by preExecScan (toolRunner), and external-send tools (email/slack/\n    // x/publisher) self-gate via the approval_gates skill — so 'notify' here is\n    // safe for the benign majority. Strict users can still set policy='paranoid'.\n    if (!contract) {\n        if (nameLooksHighImpact(toolName)) {\n            return {\n                decision: 'gate',\n                reason: `no contract + high-impact name \"${toolName}\" — gating`,\n                policy,\n            };\n        }\n        return {\n            decision: 'notify',\n            reason: `no contract for \"${toolName}\" — notify (benign long-tail)`,\n            policy,\n        };\n    }\n\n    // Standard + permissive paths read riskLevel.\n    if (riskLevel === 'safe') {\n        return { decision: 'auto', reason: 'contract riskLevel=safe', policy, riskLevel };\n    }\n    if (riskLevel === 'moderate') {\n        if (policy === 'permissive') {\n            return { decision: 'auto', reason: 'permissive policy — moderate risk auto-runs', policy, riskLevel };\n        }\n        return { decision: 'notify', reason: 'contract riskLevel=moderate', policy, riskLevel };\n    }\n    if (riskLevel === 'high') {\n        return { decision: 'gate', reason: 'contract riskLevel=high', policy, riskLevel };\n    }\n\n    // Defensive fallback for an unknown future riskLevel value.\n    return {\n        decision: 'gate',\n        reason: `unrecognised riskLevel \"${riskLevel}\" — gating defensively`,\n        policy,\n        riskLevel,\n    };\n}\n\n/* ──────────────────────────  Helpers  ────────────────────────── */\n\nlet _yoloWarned = false;\nfunction warnYoloOnce(): void {\n    if (_yoloWarned) return;\n    _yoloWarned = true;\n    logger.warn(\n        COMPONENT,\n        'AUTO_MODE=yolo — every tool call will run without approval. This mode is ONLY intended for sandboxed eval runs. If you see this in production logs, something is misconfigured.',\n    );\n}\n\n/** For tests. */\nexport function _resetYoloWarning(): void {\n    _yoloWarned = false;\n}\n\n/**\n * Convenience: returns true iff the decision means the call should\n * NOT proceed without explicit human approval. Used by the runner\n * to short-circuit the existing approval-gate path on 'auto' /\n * 'notify' decisions.\n */\nexport function shouldGate(result: ClassificationResult): boolean {\n    return result.decision === 'gate';\n}\n\n/**\n * Format the classification as a one-line breadcrumb suitable for\n * the trajectory `note` event. Used by the runner on 'notify'\n * decisions so the trajectory captures what the agent did\n * autonomously vs what required a human prompt.\n */\nexport function formatBreadcrumb(toolName: string, result: ClassificationResult): string {\n    return `automode:${result.decision} tool=${toolName} risk=${result.riskLevel ?? 'unknown'} policy=${result.policy} (${result.reason})`;\n}\n"],"mappings":";AAgFA,SAAS,uBAAuC;AAChD,SAAS,kBAAkB;AAC3B,OAAO,YAAY;AAEnB,MAAM,YAAY;AAyBX,SAAS,oBAAoC;AAMhD,QAAM,YAAY,QAAQ,IAAI;AAC9B,MAAI,cAAc,cAAc,cAAc,gBAAgB,cAAc,UAAU,cAAc,YAAY;AAC5G,WAAO;AAAA,EACX;AACA,MAAI;AACA,UAAM,MAAM,WAAW;AACvB,UAAM,MAAO,IAAgC;AAC7C,UAAM,KAAK,KAAK;AAChB,UAAM,SAAS,IAAI;AACnB,QAAI,WAAW,cAAc,WAAW,gBAAgB,WAAW,UAAU,WAAW,YAAY;AAChG,aAAO;AAAA,IACX;AAAA,EACJ,QAAQ;AAAA,EAA0C;AAClD,SAAO;AACX;AASA,MAAM,mBAAmB,oBAAI,IAAY;AAAA,EACrC;AAAA,EAAS;AAAA,EAAa;AAAA,EAAQ;AAAA,EAAe;AAAA,EAAmB;AAAA,EAChE;AAAA,EAAe;AAAA,EAAsB;AAAA,EAAc;AACvD,CAAC;AACD,MAAM,qBAAqB;AAEpB,SAAS,oBAAoB,UAA2B;AAC3D,SAAO,iBAAiB,IAAI,QAAQ,KAAK,mBAAmB,KAAK,QAAQ;AAC7E;AAYO,SAAS,iBAAiB,UAAwC;AACrE,QAAM,SAAS,kBAAkB;AACjC,QAAM,WAAW,gBAAgB,QAAQ;AACzC,QAAM,YAAY,UAAU;AAI5B,MAAI,WAAW,QAAQ;AACnB,iBAAa;AACb,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAGA,MAAI,WAAW,YAAY;AACvB,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAaA,MAAI,CAAC,UAAU;AACX,QAAI,oBAAoB,QAAQ,GAAG;AAC/B,aAAO;AAAA,QACH,UAAU;AAAA,QACV,QAAQ,mCAAmC,QAAQ;AAAA,QACnD;AAAA,MACJ;AAAA,IACJ;AACA,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ,oBAAoB,QAAQ;AAAA,MACpC;AAAA,IACJ;AAAA,EACJ;AAGA,MAAI,cAAc,QAAQ;AACtB,WAAO,EAAE,UAAU,QAAQ,QAAQ,2BAA2B,QAAQ,UAAU;AAAA,EACpF;AACA,MAAI,cAAc,YAAY;AAC1B,QAAI,WAAW,cAAc;AACzB,aAAO,EAAE,UAAU,QAAQ,QAAQ,oDAA+C,QAAQ,UAAU;AAAA,IACxG;AACA,WAAO,EAAE,UAAU,UAAU,QAAQ,+BAA+B,QAAQ,UAAU;AAAA,EAC1F;AACA,MAAI,cAAc,QAAQ;AACtB,WAAO,EAAE,UAAU,QAAQ,QAAQ,2BAA2B,QAAQ,UAAU;AAAA,EACpF;AAGA,SAAO;AAAA,IACH,UAAU;AAAA,IACV,QAAQ,2BAA2B,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACJ;AACJ;AAIA,IAAI,cAAc;AAClB,SAAS,eAAqB;AAC1B,MAAI,YAAa;AACjB,gBAAc;AACd,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;AAGO,SAAS,oBAA0B;AACtC,gBAAc;AAClB;AAQO,SAAS,WAAW,QAAuC;AAC9D,SAAO,OAAO,aAAa;AAC/B;AAQO,SAAS,iBAAiB,UAAkB,QAAsC;AACrF,SAAO,YAAY,OAAO,QAAQ,SAAS,QAAQ,SAAS,OAAO,aAAa,SAAS,WAAW,OAAO,MAAM,KAAK,OAAO,MAAM;AACvI;","names":[]}

package/dist/agent/contextManager.js

@@ -9,7 +9,7 @@ import { compressContext } from "./contextCompressor.js";
 const COMPONENT = "Context";
 function calculateBudget(maxContextTokens, systemPrompt, toolDefinitionsCount) {
   const systemTokens = estimateTokens(systemPrompt);
-  const toolTokens = toolDefinitionsCount * 120;
+  const toolTokens = toolDefinitionsCount * 250;
   const reserveForResponse = 2e3;
   return {
     maxTokens: maxContextTokens,

package/dist/agent/contextManager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/agent/contextManager.ts"],"sourcesContent":["/**\n * TITAN — Smart Context Manager\n * Intelligent context window management that none of the competitors do well.\n *\n * Problems this solves:\n * - Auto-GPT wastes tokens on irrelevant history (high cost)\n * - CrewAI has prompt sprawl across agents (unpredictable cost)\n * - Open Interpreter has no context management at all\n *\n * TITAN's approach:\n * - Automatic summarization of old conversation history\n * - Priority-based context allocation (recent > relevant > old)\n * - Token budget tracking and enforcement\n * - Smart truncation that preserves tool call context\n */\nimport logger from '../utils/logger.js';\nimport type { ChatMessage } from '../providers/base.js';\nimport { estimateTokens } from '../utils/tokens.js';\nexport { estimateTokens };\nimport { flushMemoryBeforeCompaction } from '../memory/graph.js';\nimport { getRagContext } from '../memory/vectors.js';\nimport { getPlugins } from '../plugins/registry.js';\nimport { runAssemble, runCompact } from '../plugins/contextEngine.js';\nimport { compressContext, type StructuredSummary } from './contextCompressor.js';\n\nconst COMPONENT = 'Context';\n\ninterface ContextBudget {\n    maxTokens: number;\n    systemPromptTokens: number;\n    toolDefinitionTokens: number;\n    remainingForHistory: number;\n}\n\n\n\n/** Calculate the context budget */\nexport function calculateBudget(\n    maxContextTokens: number,\n    systemPrompt: string,\n    toolDefinitionsCount: number,\n): ContextBudget {\n    const systemTokens = estimateTokens(systemPrompt);\n    const toolTokens = toolDefinitionsCount * 120; // ~120 tokens per tool definition\n    const reserveForResponse = 2000; // Reserve for completion\n\n    return {\n        maxTokens: maxContextTokens,\n        systemPromptTokens: systemTokens,\n        toolDefinitionTokens: toolTokens,\n        remainingForHistory: Math.max(0, maxContextTokens - systemTokens - toolTokens - reserveForResponse),\n    };\n}\n\n/** Summarize a batch of messages into a single summary message */\nexport function summarizeMessages(messages: ChatMessage[]): ChatMessage {\n    const userMessages = messages.filter((m) => m.role === 'user').map((m) => m.content).filter(Boolean);\n    const assistantMessages = messages.filter((m) => m.role === 'assistant').map((m) => m.content).filter(Boolean);\n    const toolMessages = messages.filter((m) => m.role === 'tool').length;\n\n    const summary = [\n        `[Earlier conversation summary — ${messages.length} messages, ${toolMessages} tool calls]`,\n        userMessages.length > 0 ? `User discussed: ${userMessages.slice(-3).map((m) => m.slice(0, 80)).join('; ')}` : '',\n        assistantMessages.length > 0 ? `Assistant actions: ${assistantMessages.slice(-2).map((m) => m.slice(0, 80)).join('; ')}` : '',\n    ].filter(Boolean).join('\\n');\n\n    return { role: 'system', content: summary };\n}\n\n/**\n * Compress verbose tool results to save context window space.\n * Keeps the last 5 tool results at full fidelity, summarizes older ones.\n */\nfunction compressToolResults(messages: ChatMessage[]): ChatMessage[] {\n    // Count tool messages from the end to find the cutoff\n    let toolCount = 0;\n    const toolIndices: number[] = [];\n    for (let i = messages.length - 1; i >= 0; i--) {\n        if (messages[i].role === 'tool') {\n            toolCount++;\n            toolIndices.push(i);\n        }\n    }\n\n    // If 5 or fewer tool results, nothing to compress\n    if (toolCount <= 5) return messages;\n\n    // Indices of tool messages to keep at full fidelity (last 5)\n    const keepFullSet = new Set(toolIndices.slice(0, 5));\n\n    return messages.map((msg, i) => {\n        if (msg.role !== 'tool' || keepFullSet.has(i)) return msg;\n        const content = msg.content || '';\n        if (content.length <= 500) return msg;\n\n        // Compress: keep first 150 chars + success/error status\n        const isError = content.toLowerCase().includes('error:');\n        const summary = `[${msg.name || 'tool'}: ${isError ? 'FAILED' : 'OK'}] ${content.slice(0, 150)}... [${content.length} chars compressed]`;\n        return { ...msg, content: summary };\n    });\n}\n\n/** Persistent structured summary for iterative context compression */\nlet currentSummary: StructuredSummary | null = null;\n\n/**\n * TITAN pattern: MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES\n * Disables compaction after 3 consecutive failures per session to prevent\n * wasted API calls (This class of bug can waste 250K+ API calls/day).\n */\nlet consecutiveCompactFailures = 0;\nconst MAX_CONSECUTIVE_COMPACT_FAILURES = 3;\n\n/** Reset compact failure counter (call on new session) */\nexport function resetCompactFailures(): void {\n    consecutiveCompactFailures = 0;\n}\n\n/** Get the current structured summary (for external access) */\nexport function getStructuredSummary(): StructuredSummary | null {\n    return currentSummary;\n}\n\n/** Set the structured summary (e.g., from agent loop state) */\nexport function setStructuredSummary(summary: StructuredSummary | null): void {\n    currentSummary = summary;\n}\n\n/**\n * Smart context builder — fits messages within token budget.\n * Uses the 5-phase compression pipeline (Hermes-inspired):\n * 1. Tool output pruning (no LLM call)\n * 2. Head protection (system + first 3 messages)\n * 3. Tail protection (last N messages, 5% of budget)\n * 4. Structured middle summary\n * 5. Iterative summary updates\n */\nexport function buildSmartContext(\n    messages: ChatMessage[],\n    tokenBudget: number,\n): ChatMessage[] {\n    if (messages.length === 0) return [];\n\n    // TITAN pattern: skip compaction after consecutive failures\n    if (consecutiveCompactFailures >= MAX_CONSECUTIVE_COMPACT_FAILURES) {\n        logger.warn(COMPONENT, `Compaction disabled after ${consecutiveCompactFailures} consecutive failures — returning raw messages`);\n        return messages;\n    }\n\n    let result;\n    try {\n        result = compressContext(messages, tokenBudget, currentSummary);\n        consecutiveCompactFailures = 0; // Reset on success\n    } catch (err) {\n        consecutiveCompactFailures++;\n        logger.warn(COMPONENT, `Compaction failed (${consecutiveCompactFailures}/${MAX_CONSECUTIVE_COMPACT_FAILURES}): ${(err as Error).message}`);\n        return messages; // Return uncompressed on failure\n    }\n\n    // Store summary for iterative updates on next compression\n    if (result.summary) {\n        currentSummary = result.summary;\n    }\n\n    if (result.savedTokens > 0) {\n        logger.debug(COMPONENT, `Smart context: ${messages.length} → ${result.messages.length} messages, saved ~${result.savedTokens} tokens`);\n    }\n\n    return result.messages;\n}\n\n/**\n * Force context compaction (used by /compact command).\n * Uses the 5-phase pipeline with an aggressive budget to maximize compression.\n */\nexport function forceCompactContext(\n    messages: ChatMessage[],\n): { messages: ChatMessage[]; savedTokens: number } {\n    if (messages.length <= 4) {\n        return { messages, savedTokens: 0 };\n    }\n\n    // Flush important context to graph memory before discarding (fire-and-forget)\n    const toFlush = messages.filter(m => m.role !== 'system');\n    flushMemoryBeforeCompaction(toFlush).catch((err) =>\n        logger.warn(COMPONENT, `Memory flush before compaction failed: ${(err as Error).message}`),\n    );\n\n    // Aggressive budget: 4000 tokens forces maximum compression\n    const result = compressContext(messages, 4000, currentSummary);\n\n    if (result.summary) {\n        currentSummary = result.summary;\n    }\n\n    logger.info(COMPONENT, `Force compacted: ${messages.length} → ${result.messages.length} messages, saved ~${result.savedTokens} tokens`);\n    return { messages: result.messages, savedTokens: result.savedTokens };\n}\n\n/** Get context window stats */\nexport function getContextStats(messages: ChatMessage[]): {\n    messageCount: number;\n    estimatedTokens: number;\n    userMessages: number;\n    assistantMessages: number;\n    toolCalls: number;\n} {\n    let tokens = 0;\n    let userMsgs = 0;\n    let assistantMsgs = 0;\n    let toolCalls = 0;\n\n    for (const m of messages) {\n        tokens += estimateTokens(m.content || '');\n        if (m.role === 'user') userMsgs++;\n        if (m.role === 'assistant') assistantMsgs++;\n        if (m.toolCalls) toolCalls += m.toolCalls.length;\n    }\n\n    return {\n        messageCount: messages.length,\n        estimatedTokens: tokens,\n        userMessages: userMsgs,\n        assistantMessages: assistantMsgs,\n        toolCalls,\n    };\n}\n\n/**\n * Inject RAG context into messages before the agent turn.\n * Queries the RAG vector store with the latest user message and prepends\n * relevant chunks as a system message.\n */\nexport async function injectRagContext(\n    messages: ChatMessage[],\n    topK: number = 3,\n): Promise<ChatMessage[]> {\n    // Find the last user message\n    const lastUserMsg = [...messages].reverse().find(m => m.role === 'user');\n    if (!lastUserMsg?.content) return messages;\n\n    try {\n        const ragContext = await getRagContext(lastUserMsg.content, topK);\n        if (!ragContext) return messages;\n\n        logger.debug(COMPONENT, `Injecting RAG context (${ragContext.length} chars) for query: \"${lastUserMsg.content.slice(0, 80)}\"`);\n\n        const ragMessage: ChatMessage = {\n            role: 'system',\n            content: `[Relevant knowledge from ingested documents]\\n${ragContext}`,\n        };\n\n        // Insert RAG context before the last user message\n        const result = [...messages];\n        const lastUserIndex = result.lastIndexOf(lastUserMsg);\n        if (lastUserIndex >= 0) {\n            result.splice(lastUserIndex, 0, ragMessage);\n        } else {\n            result.push(ragMessage);\n        }\n        return result;\n    } catch (e) {\n        logger.debug(COMPONENT, `RAG context injection failed: ${(e as Error).message}`);\n        return messages;\n    }\n}\n\n/**\n * Assemble context with plugin hooks.\n * Runs RAG injection first (built-in), then all registered plugins.\n */\nexport async function assembleContextWithPlugins(\n    messages: ChatMessage[],\n    userMessage: string,\n    ragTopK: number = 3,\n): Promise<ChatMessage[]> {\n    // Built-in RAG injection as first step\n    let result = await injectRagContext(messages, ragTopK);\n\n    // Run registered plugin assemble hooks\n    const plugins = getPlugins();\n    if (plugins.length > 0) {\n        result = await runAssemble(plugins, result, userMessage);\n    }\n\n    return result;\n}\n\n/**\n * Compact context with plugin hooks.\n * Runs built-in smart context first, then all registered plugins.\n */\nexport async function compactContextWithPlugins(\n    messages: ChatMessage[],\n    maxTokens: number,\n): Promise<ChatMessage[]> {\n    // Built-in smart context compaction\n    let result = buildSmartContext(messages, maxTokens);\n\n    // Run registered plugin compact hooks\n    const plugins = getPlugins();\n    if (plugins.length > 0) {\n        result = await runCompact(plugins, result, maxTokens);\n    }\n\n    return result;\n}\n"],"mappings":";AAeA,OAAO,YAAY;AAEnB,SAAS,sBAAsB;AAE/B,SAAS,mCAAmC;AAC5C,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAC3B,SAAS,aAAa,kBAAkB;AACxC,SAAS,uBAA+C;AAExD,MAAM,YAAY;AAYX,SAAS,gBACZ,kBACA,cACA,sBACa;AACb,QAAM,eAAe,eAAe,YAAY;AAChD,QAAM,aAAa,uBAAuB;AAC1C,QAAM,qBAAqB;AAE3B,SAAO;AAAA,IACH,WAAW;AAAA,IACX,oBAAoB;AAAA,IACpB,sBAAsB;AAAA,IACtB,qBAAqB,KAAK,IAAI,GAAG,mBAAmB,eAAe,aAAa,kBAAkB;AAAA,EACtG;AACJ;AAGO,SAAS,kBAAkB,UAAsC;AACpE,QAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,OAAO;AACnG,QAAM,oBAAoB,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,OAAO;AAC7G,QAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;AAE/D,QAAM,UAAU;AAAA,IACZ,wCAAmC,SAAS,MAAM,cAAc,YAAY;AAAA,IAC5E,aAAa,SAAS,IAAI,mBAAmB,aAAa,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK;AAAA,IAC9G,kBAAkB,SAAS,IAAI,sBAAsB,kBAAkB,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK;AAAA,EAC/H,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAE3B,SAAO,EAAE,MAAM,UAAU,SAAS,QAAQ;AAC9C;AAMA,SAAS,oBAAoB,UAAwC;AAEjE,MAAI,YAAY;AAChB,QAAM,cAAwB,CAAC;AAC/B,WAAS,IAAI,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;AAC3C,QAAI,SAAS,CAAC,EAAE,SAAS,QAAQ;AAC7B;AACA,kBAAY,KAAK,CAAC;AAAA,IACtB;AAAA,EACJ;AAGA,MAAI,aAAa,EAAG,QAAO;AAG3B,QAAM,cAAc,IAAI,IAAI,YAAY,MAAM,GAAG,CAAC,CAAC;AAEnD,SAAO,SAAS,IAAI,CAAC,KAAK,MAAM;AAC5B,QAAI,IAAI,SAAS,UAAU,YAAY,IAAI,CAAC,EAAG,QAAO;AACtD,UAAM,UAAU,IAAI,WAAW;AAC/B,QAAI,QAAQ,UAAU,IAAK,QAAO;AAGlC,UAAM,UAAU,QAAQ,YAAY,EAAE,SAAS,QAAQ;AACvD,UAAM,UAAU,IAAI,IAAI,QAAQ,MAAM,KAAK,UAAU,WAAW,IAAI,KAAK,QAAQ,MAAM,GAAG,GAAG,CAAC,QAAQ,QAAQ,MAAM;AACpH,WAAO,EAAE,GAAG,KAAK,SAAS,QAAQ;AAAA,EACtC,CAAC;AACL;AAGA,IAAI,iBAA2C;AAO/C,IAAI,6BAA6B;AACjC,MAAM,mCAAmC;AAGlC,SAAS,uBAA6B;AACzC,+BAA6B;AACjC;AAGO,SAAS,uBAAiD;AAC7D,SAAO;AACX;AAGO,SAAS,qBAAqB,SAAyC;AAC1E,mBAAiB;AACrB;AAWO,SAAS,kBACZ,UACA,aACa;AACb,MAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAGnC,MAAI,8BAA8B,kCAAkC;AAChE,WAAO,KAAK,WAAW,6BAA6B,0BAA0B,qDAAgD;AAC9H,WAAO;AAAA,EACX;AAEA,MAAI;AACJ,MAAI;AACA,aAAS,gBAAgB,UAAU,aAAa,cAAc;AAC9D,iCAA6B;AAAA,EACjC,SAAS,KAAK;AACV;AACA,WAAO,KAAK,WAAW,sBAAsB,0BAA0B,IAAI,gCAAgC,MAAO,IAAc,OAAO,EAAE;AACzI,WAAO;AAAA,EACX;AAGA,MAAI,OAAO,SAAS;AAChB,qBAAiB,OAAO;AAAA,EAC5B;AAEA,MAAI,OAAO,cAAc,GAAG;AACxB,WAAO,MAAM,WAAW,kBAAkB,SAAS,MAAM,WAAM,OAAO,SAAS,MAAM,qBAAqB,OAAO,WAAW,SAAS;AAAA,EACzI;AAEA,SAAO,OAAO;AAClB;AAMO,SAAS,oBACZ,UACgD;AAChD,MAAI,SAAS,UAAU,GAAG;AACtB,WAAO,EAAE,UAAU,aAAa,EAAE;AAAA,EACtC;AAGA,QAAM,UAAU,SAAS,OAAO,OAAK,EAAE,SAAS,QAAQ;AACxD,8BAA4B,OAAO,EAAE;AAAA,IAAM,CAAC,QACxC,OAAO,KAAK,WAAW,0CAA2C,IAAc,OAAO,EAAE;AAAA,EAC7F;AAGA,QAAM,SAAS,gBAAgB,UAAU,KAAM,cAAc;AAE7D,MAAI,OAAO,SAAS;AAChB,qBAAiB,OAAO;AAAA,EAC5B;AAEA,SAAO,KAAK,WAAW,oBAAoB,SAAS,MAAM,WAAM,OAAO,SAAS,MAAM,qBAAqB,OAAO,WAAW,SAAS;AACtI,SAAO,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,YAAY;AACxE;AAGO,SAAS,gBAAgB,UAM9B;AACE,MAAI,SAAS;AACb,MAAI,WAAW;AACf,MAAI,gBAAgB;AACpB,MAAI,YAAY;AAEhB,aAAW,KAAK,UAAU;AACtB,cAAU,eAAe,EAAE,WAAW,EAAE;AACxC,QAAI,EAAE,SAAS,OAAQ;AACvB,QAAI,EAAE,SAAS,YAAa;AAC5B,QAAI,EAAE,UAAW,cAAa,EAAE,UAAU;AAAA,EAC9C;AAEA,SAAO;AAAA,IACH,cAAc,SAAS;AAAA,IACvB,iBAAiB;AAAA,IACjB,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB;AAAA,EACJ;AACJ;AAOA,eAAsB,iBAClB,UACA,OAAe,GACO;AAEtB,QAAM,cAAc,CAAC,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,OAAK,EAAE,SAAS,MAAM;AACvE,MAAI,CAAC,aAAa,QAAS,QAAO;AAElC,MAAI;AACA,UAAM,aAAa,MAAM,cAAc,YAAY,SAAS,IAAI;AAChE,QAAI,CAAC,WAAY,QAAO;AAExB,WAAO,MAAM,WAAW,0BAA0B,WAAW,MAAM,uBAAuB,YAAY,QAAQ,MAAM,GAAG,EAAE,CAAC,GAAG;AAE7H,UAAM,aAA0B;AAAA,MAC5B,MAAM;AAAA,MACN,SAAS;AAAA,EAAiD,UAAU;AAAA,IACxE;AAGA,UAAM,SAAS,CAAC,GAAG,QAAQ;AAC3B,UAAM,gBAAgB,OAAO,YAAY,WAAW;AACpD,QAAI,iBAAiB,GAAG;AACpB,aAAO,OAAO,eAAe,GAAG,UAAU;AAAA,IAC9C,OAAO;AACH,aAAO,KAAK,UAAU;AAAA,IAC1B;AACA,WAAO;AAAA,EACX,SAAS,GAAG;AACR,WAAO,MAAM,WAAW,iCAAkC,EAAY,OAAO,EAAE;AAC/E,WAAO;AAAA,EACX;AACJ;AAMA,eAAsB,2BAClB,UACA,aACA,UAAkB,GACI;AAEtB,MAAI,SAAS,MAAM,iBAAiB,UAAU,OAAO;AAGrD,QAAM,UAAU,WAAW;AAC3B,MAAI,QAAQ,SAAS,GAAG;AACpB,aAAS,MAAM,YAAY,SAAS,QAAQ,WAAW;AAAA,EAC3D;AAEA,SAAO;AACX;AAMA,eAAsB,0BAClB,UACA,WACsB;AAEtB,MAAI,SAAS,kBAAkB,UAAU,SAAS;AAGlD,QAAM,UAAU,WAAW;AAC3B,MAAI,QAAQ,SAAS,GAAG;AACpB,aAAS,MAAM,WAAW,SAAS,QAAQ,SAAS;AAAA,EACxD;AAEA,SAAO;AACX;","names":[]}
+{"version":3,"sources":["../../src/agent/contextManager.ts"],"sourcesContent":["/**\n * TITAN — Smart Context Manager\n * Intelligent context window management that none of the competitors do well.\n *\n * Problems this solves:\n * - Auto-GPT wastes tokens on irrelevant history (high cost)\n * - CrewAI has prompt sprawl across agents (unpredictable cost)\n * - Open Interpreter has no context management at all\n *\n * TITAN's approach:\n * - Automatic summarization of old conversation history\n * - Priority-based context allocation (recent > relevant > old)\n * - Token budget tracking and enforcement\n * - Smart truncation that preserves tool call context\n */\nimport logger from '../utils/logger.js';\nimport type { ChatMessage } from '../providers/base.js';\nimport { estimateTokens } from '../utils/tokens.js';\nexport { estimateTokens };\nimport { flushMemoryBeforeCompaction } from '../memory/graph.js';\nimport { getRagContext } from '../memory/vectors.js';\nimport { getPlugins } from '../plugins/registry.js';\nimport { runAssemble, runCompact } from '../plugins/contextEngine.js';\nimport { compressContext, type StructuredSummary } from './contextCompressor.js';\n\nconst COMPONENT = 'Context';\n\ninterface ContextBudget {\n    maxTokens: number;\n    systemPromptTokens: number;\n    toolDefinitionTokens: number;\n    remainingForHistory: number;\n}\n\n\n\n/** Calculate the context budget */\nexport function calculateBudget(\n    maxContextTokens: number,\n    systemPrompt: string,\n    toolDefinitionsCount: number,\n): ContextBudget {\n    const systemTokens = estimateTokens(systemPrompt);\n    const toolTokens = toolDefinitionsCount * 250; // measured avg 887 chars (~250 tok) per definition — 120 undercounted 4x and blew small contexts\n    const reserveForResponse = 2000; // Reserve for completion\n\n    return {\n        maxTokens: maxContextTokens,\n        systemPromptTokens: systemTokens,\n        toolDefinitionTokens: toolTokens,\n        remainingForHistory: Math.max(0, maxContextTokens - systemTokens - toolTokens - reserveForResponse),\n    };\n}\n\n/** Summarize a batch of messages into a single summary message */\nexport function summarizeMessages(messages: ChatMessage[]): ChatMessage {\n    const userMessages = messages.filter((m) => m.role === 'user').map((m) => m.content).filter(Boolean);\n    const assistantMessages = messages.filter((m) => m.role === 'assistant').map((m) => m.content).filter(Boolean);\n    const toolMessages = messages.filter((m) => m.role === 'tool').length;\n\n    const summary = [\n        `[Earlier conversation summary — ${messages.length} messages, ${toolMessages} tool calls]`,\n        userMessages.length > 0 ? `User discussed: ${userMessages.slice(-3).map((m) => m.slice(0, 80)).join('; ')}` : '',\n        assistantMessages.length > 0 ? `Assistant actions: ${assistantMessages.slice(-2).map((m) => m.slice(0, 80)).join('; ')}` : '',\n    ].filter(Boolean).join('\\n');\n\n    return { role: 'system', content: summary };\n}\n\n/**\n * Compress verbose tool results to save context window space.\n * Keeps the last 5 tool results at full fidelity, summarizes older ones.\n */\nfunction compressToolResults(messages: ChatMessage[]): ChatMessage[] {\n    // Count tool messages from the end to find the cutoff\n    let toolCount = 0;\n    const toolIndices: number[] = [];\n    for (let i = messages.length - 1; i >= 0; i--) {\n        if (messages[i].role === 'tool') {\n            toolCount++;\n            toolIndices.push(i);\n        }\n    }\n\n    // If 5 or fewer tool results, nothing to compress\n    if (toolCount <= 5) return messages;\n\n    // Indices of tool messages to keep at full fidelity (last 5)\n    const keepFullSet = new Set(toolIndices.slice(0, 5));\n\n    return messages.map((msg, i) => {\n        if (msg.role !== 'tool' || keepFullSet.has(i)) return msg;\n        const content = msg.content || '';\n        if (content.length <= 500) return msg;\n\n        // Compress: keep first 150 chars + success/error status\n        const isError = content.toLowerCase().includes('error:');\n        const summary = `[${msg.name || 'tool'}: ${isError ? 'FAILED' : 'OK'}] ${content.slice(0, 150)}... [${content.length} chars compressed]`;\n        return { ...msg, content: summary };\n    });\n}\n\n/** Persistent structured summary for iterative context compression */\nlet currentSummary: StructuredSummary | null = null;\n\n/**\n * TITAN pattern: MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES\n * Disables compaction after 3 consecutive failures per session to prevent\n * wasted API calls (This class of bug can waste 250K+ API calls/day).\n */\nlet consecutiveCompactFailures = 0;\nconst MAX_CONSECUTIVE_COMPACT_FAILURES = 3;\n\n/** Reset compact failure counter (call on new session) */\nexport function resetCompactFailures(): void {\n    consecutiveCompactFailures = 0;\n}\n\n/** Get the current structured summary (for external access) */\nexport function getStructuredSummary(): StructuredSummary | null {\n    return currentSummary;\n}\n\n/** Set the structured summary (e.g., from agent loop state) */\nexport function setStructuredSummary(summary: StructuredSummary | null): void {\n    currentSummary = summary;\n}\n\n/**\n * Smart context builder — fits messages within token budget.\n * Uses the 5-phase compression pipeline (Hermes-inspired):\n * 1. Tool output pruning (no LLM call)\n * 2. Head protection (system + first 3 messages)\n * 3. Tail protection (last N messages, 5% of budget)\n * 4. Structured middle summary\n * 5. Iterative summary updates\n */\nexport function buildSmartContext(\n    messages: ChatMessage[],\n    tokenBudget: number,\n): ChatMessage[] {\n    if (messages.length === 0) return [];\n\n    // TITAN pattern: skip compaction after consecutive failures\n    if (consecutiveCompactFailures >= MAX_CONSECUTIVE_COMPACT_FAILURES) {\n        logger.warn(COMPONENT, `Compaction disabled after ${consecutiveCompactFailures} consecutive failures — returning raw messages`);\n        return messages;\n    }\n\n    let result;\n    try {\n        result = compressContext(messages, tokenBudget, currentSummary);\n        consecutiveCompactFailures = 0; // Reset on success\n    } catch (err) {\n        consecutiveCompactFailures++;\n        logger.warn(COMPONENT, `Compaction failed (${consecutiveCompactFailures}/${MAX_CONSECUTIVE_COMPACT_FAILURES}): ${(err as Error).message}`);\n        return messages; // Return uncompressed on failure\n    }\n\n    // Store summary for iterative updates on next compression\n    if (result.summary) {\n        currentSummary = result.summary;\n    }\n\n    if (result.savedTokens > 0) {\n        logger.debug(COMPONENT, `Smart context: ${messages.length} → ${result.messages.length} messages, saved ~${result.savedTokens} tokens`);\n    }\n\n    return result.messages;\n}\n\n/**\n * Force context compaction (used by /compact command).\n * Uses the 5-phase pipeline with an aggressive budget to maximize compression.\n */\nexport function forceCompactContext(\n    messages: ChatMessage[],\n): { messages: ChatMessage[]; savedTokens: number } {\n    if (messages.length <= 4) {\n        return { messages, savedTokens: 0 };\n    }\n\n    // Flush important context to graph memory before discarding (fire-and-forget)\n    const toFlush = messages.filter(m => m.role !== 'system');\n    flushMemoryBeforeCompaction(toFlush).catch((err) =>\n        logger.warn(COMPONENT, `Memory flush before compaction failed: ${(err as Error).message}`),\n    );\n\n    // Aggressive budget: 4000 tokens forces maximum compression\n    const result = compressContext(messages, 4000, currentSummary);\n\n    if (result.summary) {\n        currentSummary = result.summary;\n    }\n\n    logger.info(COMPONENT, `Force compacted: ${messages.length} → ${result.messages.length} messages, saved ~${result.savedTokens} tokens`);\n    return { messages: result.messages, savedTokens: result.savedTokens };\n}\n\n/** Get context window stats */\nexport function getContextStats(messages: ChatMessage[]): {\n    messageCount: number;\n    estimatedTokens: number;\n    userMessages: number;\n    assistantMessages: number;\n    toolCalls: number;\n} {\n    let tokens = 0;\n    let userMsgs = 0;\n    let assistantMsgs = 0;\n    let toolCalls = 0;\n\n    for (const m of messages) {\n        tokens += estimateTokens(m.content || '');\n        if (m.role === 'user') userMsgs++;\n        if (m.role === 'assistant') assistantMsgs++;\n        if (m.toolCalls) toolCalls += m.toolCalls.length;\n    }\n\n    return {\n        messageCount: messages.length,\n        estimatedTokens: tokens,\n        userMessages: userMsgs,\n        assistantMessages: assistantMsgs,\n        toolCalls,\n    };\n}\n\n/**\n * Inject RAG context into messages before the agent turn.\n * Queries the RAG vector store with the latest user message and prepends\n * relevant chunks as a system message.\n */\nexport async function injectRagContext(\n    messages: ChatMessage[],\n    topK: number = 3,\n): Promise<ChatMessage[]> {\n    // Find the last user message\n    const lastUserMsg = [...messages].reverse().find(m => m.role === 'user');\n    if (!lastUserMsg?.content) return messages;\n\n    try {\n        const ragContext = await getRagContext(lastUserMsg.content, topK);\n        if (!ragContext) return messages;\n\n        logger.debug(COMPONENT, `Injecting RAG context (${ragContext.length} chars) for query: \"${lastUserMsg.content.slice(0, 80)}\"`);\n\n        const ragMessage: ChatMessage = {\n            role: 'system',\n            content: `[Relevant knowledge from ingested documents]\\n${ragContext}`,\n        };\n\n        // Insert RAG context before the last user message\n        const result = [...messages];\n        const lastUserIndex = result.lastIndexOf(lastUserMsg);\n        if (lastUserIndex >= 0) {\n            result.splice(lastUserIndex, 0, ragMessage);\n        } else {\n            result.push(ragMessage);\n        }\n        return result;\n    } catch (e) {\n        logger.debug(COMPONENT, `RAG context injection failed: ${(e as Error).message}`);\n        return messages;\n    }\n}\n\n/**\n * Assemble context with plugin hooks.\n * Runs RAG injection first (built-in), then all registered plugins.\n */\nexport async function assembleContextWithPlugins(\n    messages: ChatMessage[],\n    userMessage: string,\n    ragTopK: number = 3,\n): Promise<ChatMessage[]> {\n    // Built-in RAG injection as first step\n    let result = await injectRagContext(messages, ragTopK);\n\n    // Run registered plugin assemble hooks\n    const plugins = getPlugins();\n    if (plugins.length > 0) {\n        result = await runAssemble(plugins, result, userMessage);\n    }\n\n    return result;\n}\n\n/**\n * Compact context with plugin hooks.\n * Runs built-in smart context first, then all registered plugins.\n */\nexport async function compactContextWithPlugins(\n    messages: ChatMessage[],\n    maxTokens: number,\n): Promise<ChatMessage[]> {\n    // Built-in smart context compaction\n    let result = buildSmartContext(messages, maxTokens);\n\n    // Run registered plugin compact hooks\n    const plugins = getPlugins();\n    if (plugins.length > 0) {\n        result = await runCompact(plugins, result, maxTokens);\n    }\n\n    return result;\n}\n"],"mappings":";AAeA,OAAO,YAAY;AAEnB,SAAS,sBAAsB;AAE/B,SAAS,mCAAmC;AAC5C,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAC3B,SAAS,aAAa,kBAAkB;AACxC,SAAS,uBAA+C;AAExD,MAAM,YAAY;AAYX,SAAS,gBACZ,kBACA,cACA,sBACa;AACb,QAAM,eAAe,eAAe,YAAY;AAChD,QAAM,aAAa,uBAAuB;AAC1C,QAAM,qBAAqB;AAE3B,SAAO;AAAA,IACH,WAAW;AAAA,IACX,oBAAoB;AAAA,IACpB,sBAAsB;AAAA,IACtB,qBAAqB,KAAK,IAAI,GAAG,mBAAmB,eAAe,aAAa,kBAAkB;AAAA,EACtG;AACJ;AAGO,SAAS,kBAAkB,UAAsC;AACpE,QAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,OAAO;AACnG,QAAM,oBAAoB,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,OAAO;AAC7G,QAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;AAE/D,QAAM,UAAU;AAAA,IACZ,wCAAmC,SAAS,MAAM,cAAc,YAAY;AAAA,IAC5E,aAAa,SAAS,IAAI,mBAAmB,aAAa,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK;AAAA,IAC9G,kBAAkB,SAAS,IAAI,sBAAsB,kBAAkB,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,KAAK;AAAA,EAC/H,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AAE3B,SAAO,EAAE,MAAM,UAAU,SAAS,QAAQ;AAC9C;AAMA,SAAS,oBAAoB,UAAwC;AAEjE,MAAI,YAAY;AAChB,QAAM,cAAwB,CAAC;AAC/B,WAAS,IAAI,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;AAC3C,QAAI,SAAS,CAAC,EAAE,SAAS,QAAQ;AAC7B;AACA,kBAAY,KAAK,CAAC;AAAA,IACtB;AAAA,EACJ;AAGA,MAAI,aAAa,EAAG,QAAO;AAG3B,QAAM,cAAc,IAAI,IAAI,YAAY,MAAM,GAAG,CAAC,CAAC;AAEnD,SAAO,SAAS,IAAI,CAAC,KAAK,MAAM;AAC5B,QAAI,IAAI,SAAS,UAAU,YAAY,IAAI,CAAC,EAAG,QAAO;AACtD,UAAM,UAAU,IAAI,WAAW;AAC/B,QAAI,QAAQ,UAAU,IAAK,QAAO;AAGlC,UAAM,UAAU,QAAQ,YAAY,EAAE,SAAS,QAAQ;AACvD,UAAM,UAAU,IAAI,IAAI,QAAQ,MAAM,KAAK,UAAU,WAAW,IAAI,KAAK,QAAQ,MAAM,GAAG,GAAG,CAAC,QAAQ,QAAQ,MAAM;AACpH,WAAO,EAAE,GAAG,KAAK,SAAS,QAAQ;AAAA,EACtC,CAAC;AACL;AAGA,IAAI,iBAA2C;AAO/C,IAAI,6BAA6B;AACjC,MAAM,mCAAmC;AAGlC,SAAS,uBAA6B;AACzC,+BAA6B;AACjC;AAGO,SAAS,uBAAiD;AAC7D,SAAO;AACX;AAGO,SAAS,qBAAqB,SAAyC;AAC1E,mBAAiB;AACrB;AAWO,SAAS,kBACZ,UACA,aACa;AACb,MAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAGnC,MAAI,8BAA8B,kCAAkC;AAChE,WAAO,KAAK,WAAW,6BAA6B,0BAA0B,qDAAgD;AAC9H,WAAO;AAAA,EACX;AAEA,MAAI;AACJ,MAAI;AACA,aAAS,gBAAgB,UAAU,aAAa,cAAc;AAC9D,iCAA6B;AAAA,EACjC,SAAS,KAAK;AACV;AACA,WAAO,KAAK,WAAW,sBAAsB,0BAA0B,IAAI,gCAAgC,MAAO,IAAc,OAAO,EAAE;AACzI,WAAO;AAAA,EACX;AAGA,MAAI,OAAO,SAAS;AAChB,qBAAiB,OAAO;AAAA,EAC5B;AAEA,MAAI,OAAO,cAAc,GAAG;AACxB,WAAO,MAAM,WAAW,kBAAkB,SAAS,MAAM,WAAM,OAAO,SAAS,MAAM,qBAAqB,OAAO,WAAW,SAAS;AAAA,EACzI;AAEA,SAAO,OAAO;AAClB;AAMO,SAAS,oBACZ,UACgD;AAChD,MAAI,SAAS,UAAU,GAAG;AACtB,WAAO,EAAE,UAAU,aAAa,EAAE;AAAA,EACtC;AAGA,QAAM,UAAU,SAAS,OAAO,OAAK,EAAE,SAAS,QAAQ;AACxD,8BAA4B,OAAO,EAAE;AAAA,IAAM,CAAC,QACxC,OAAO,KAAK,WAAW,0CAA2C,IAAc,OAAO,EAAE;AAAA,EAC7F;AAGA,QAAM,SAAS,gBAAgB,UAAU,KAAM,cAAc;AAE7D,MAAI,OAAO,SAAS;AAChB,qBAAiB,OAAO;AAAA,EAC5B;AAEA,SAAO,KAAK,WAAW,oBAAoB,SAAS,MAAM,WAAM,OAAO,SAAS,MAAM,qBAAqB,OAAO,WAAW,SAAS;AACtI,SAAO,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,YAAY;AACxE;AAGO,SAAS,gBAAgB,UAM9B;AACE,MAAI,SAAS;AACb,MAAI,WAAW;AACf,MAAI,gBAAgB;AACpB,MAAI,YAAY;AAEhB,aAAW,KAAK,UAAU;AACtB,cAAU,eAAe,EAAE,WAAW,EAAE;AACxC,QAAI,EAAE,SAAS,OAAQ;AACvB,QAAI,EAAE,SAAS,YAAa;AAC5B,QAAI,EAAE,UAAW,cAAa,EAAE,UAAU;AAAA,EAC9C;AAEA,SAAO;AAAA,IACH,cAAc,SAAS;AAAA,IACvB,iBAAiB;AAAA,IACjB,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB;AAAA,EACJ;AACJ;AAOA,eAAsB,iBAClB,UACA,OAAe,GACO;AAEtB,QAAM,cAAc,CAAC,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,OAAK,EAAE,SAAS,MAAM;AACvE,MAAI,CAAC,aAAa,QAAS,QAAO;AAElC,MAAI;AACA,UAAM,aAAa,MAAM,cAAc,YAAY,SAAS,IAAI;AAChE,QAAI,CAAC,WAAY,QAAO;AAExB,WAAO,MAAM,WAAW,0BAA0B,WAAW,MAAM,uBAAuB,YAAY,QAAQ,MAAM,GAAG,EAAE,CAAC,GAAG;AAE7H,UAAM,aAA0B;AAAA,MAC5B,MAAM;AAAA,MACN,SAAS;AAAA,EAAiD,UAAU;AAAA,IACxE;AAGA,UAAM,SAAS,CAAC,GAAG,QAAQ;AAC3B,UAAM,gBAAgB,OAAO,YAAY,WAAW;AACpD,QAAI,iBAAiB,GAAG;AACpB,aAAO,OAAO,eAAe,GAAG,UAAU;AAAA,IAC9C,OAAO;AACH,aAAO,KAAK,UAAU;AAAA,IAC1B;AACA,WAAO;AAAA,EACX,SAAS,GAAG;AACR,WAAO,MAAM,WAAW,iCAAkC,EAAY,OAAO,EAAE;AAC/E,WAAO;AAAA,EACX;AACJ;AAMA,eAAsB,2BAClB,UACA,aACA,UAAkB,GACI;AAEtB,MAAI,SAAS,MAAM,iBAAiB,UAAU,OAAO;AAGrD,QAAM,UAAU,WAAW;AAC3B,MAAI,QAAQ,SAAS,GAAG;AACpB,aAAS,MAAM,YAAY,SAAS,QAAQ,WAAW;AAAA,EAC3D;AAEA,SAAO;AACX;AAMA,eAAsB,0BAClB,UACA,WACsB;AAEtB,MAAI,SAAS,kBAAkB,UAAU,SAAS;AAGlD,QAAM,UAAU,WAAW;AAC3B,MAAI,QAAQ,SAAS,GAAG;AACpB,aAAS,MAAM,WAAW,SAAS,QAAQ,SAAS;AAAA,EACxD;AAEA,SAAO;AACX;","names":[]}

package/dist/agent/goalDriver.js

@@ -817,6 +817,7 @@ ${spawn.artifacts.map((a) => `  - [${a.type}] ${a.ref}${a.description ? ` \u2014
     state.phase = "iterating";
   }
 }
+const __internal_tickVerifying = tickVerifying;
 async function tickReporting(goal, state) {
   const durationMs = Date.now() - new Date(state.startedAt).getTime();
   const specialistsUsed = [...new Set(
@@ -1366,6 +1367,7 @@ function _resetDriverStateForTests(goalId) {
 }
 export {
   SAME_BLOCK_TWICE_WINDOW_MS,
+  __internal_tickVerifying,
   _resetDriverStateForTests,
   cancelDriver,
   composeApprovalGuidance,