@agentguard-run/burn 0.1.0 → 0.2.0

package/dist/src/state/reservations.js

@@ -23,7 +23,7 @@
  * account do not share it, and that is stated rather than papered over.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ReservationStore = exports.RESERVATION_TTL_MS = void 0;
+exports.Transaction = exports.ReservationStore = exports.RESERVATION_TTL_MS = void 0;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const LOCK_STALE_MS = 10_000;
@@ -42,10 +42,24 @@ function pidAlive(pid) {
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+/**
+ * Lock instances are identified by nonce, not by path. This is what makes
+ * the lock survive contention from hundreds of processes:
+ *
+ * A waiter that reads the owner record, then gets descheduled, then judges
+ * "owner is dead" is telling the truth about an instance that has since
+ * been released and replaced. Under 240 concurrent hook processes that
+ * exact stall happened, the waiter tore down a live sibling's lock, two
+ * processes ran the transaction at once, and 43 spawns were admitted
+ * against a cap of 40. Every teardown below is therefore checked against
+ * the nonce it was judged on, and every write is fenced on the holder's own
+ * nonce still being on the path.
+ */
 class ReservationStore {
     home;
     lockDir;
     file;
+    held = null;
     constructor(home) {
         this.home = home;
         (0, node_fs_1.mkdirSync)(home, { recursive: true, mode: 0o700 });
@@ -58,7 +72,15 @@ class ReservationStore {
         for (;;) {
             try {
                 (0, node_fs_1.mkdirSync)(this.lockDir, { mode: 0o700 });
-                (0, node_fs_1.writeFileSync)((0, node_path_1.join)(this.lockDir, 'owner'), `${process.pid}\n${Date.now()}\n`, { mode: 0o600 });
+                // The owner record must appear whole or not at all. A sibling that
+                // read a half-written timestamp once parsed it as "held since 1970",
+                // reclaimed a live lock, and admitted a 41st spawn.
+                const owner = { pid: process.pid, since: Date.now(), nonce: `${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}` };
+                const tmp = (0, node_path_1.join)(this.lockDir, `owner.${process.pid}`);
+                (0, node_fs_1.writeFileSync)(tmp, JSON.stringify(owner), { mode: 0o600 });
+                (0, node_fs_1.renameSync)(tmp, (0, node_path_1.join)(this.lockDir, 'owner'));
+                this.held = owner;
+                this.trace('acquired');
                 return;
             }
             catch (error) {
@@ -72,34 +94,124 @@ class ReservationStore {
             }
         }
     }
+    readOwnerAt(dir) {
+        try {
+            const parsed = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, 'owner'), 'utf8'));
+            if (Number.isInteger(parsed.pid) && typeof parsed.since === 'number' && parsed.since > 1_000_000_000_000 && typeof parsed.nonce === 'string') {
+                return { pid: parsed.pid, since: parsed.since, nonce: parsed.nonce };
+            }
+        }
+        catch {
+            /* missing or unreadable */
+        }
+        return null;
+    }
+    /** The holder's own instance is still the one on the path. */
+    fence() {
+        const current = this.readOwnerAt(this.lockDir);
+        if (!this.held || !current || current.nonce !== this.held.nonce) {
+            throw new Error('AgentGuard lost the reservation lock mid-transaction; failing closed.');
+        }
+    }
+    /**
+     * Take the lock directory off its path atomically, then verify it is the
+     * instance we meant. rmSync on the live path is readdir + unlink + rmdir,
+     * and a sibling can mkdir the same path between those steps, so removal
+     * is always rename-then-delete. If the instance we grabbed is not the one
+     * we judged (`expect`), it is a live sibling's: put it back.
+     */
+    discard(reason, expect) {
+        const quarantine = `${this.lockDir}.${reason}.${process.pid}.${Date.now().toString(36)}`;
+        try {
+            (0, node_fs_1.renameSync)(this.lockDir, quarantine);
+        }
+        catch {
+            return false; // somebody else already took it off the path
+        }
+        const got = this.readOwnerAt(quarantine);
+        if ((got?.nonce ?? null) !== expect) {
+            // Not the instance we judged. Give it back; if a waiter slipped into
+            // the freed path in between, the displaced holder's fence throws and
+            // its transaction is discarded, so nothing double-commits.
+            try {
+                (0, node_fs_1.renameSync)(quarantine, this.lockDir);
+                this.trace(`discard ${reason}: wrong instance, returned`);
+                return false;
+            }
+            catch {
+                this.trace(`discard ${reason}: wrong instance, could not return`);
+            }
+        }
+        try {
+            (0, node_fs_1.rmSync)(quarantine, { recursive: true, force: true });
+        }
+        catch {
+            /* late write by the old holder; unique name, harmless */
+        }
+        this.trace(`discard ${reason} ok`);
+        return true;
+    }
+    trace(line) {
+        if (!process.env.AGENTGUARD_DEBUG_LOCK)
+            return;
+        try {
+            (0, node_fs_1.appendFileSync)((0, node_path_1.join)(this.home, 'lock.log'), `${Date.now()} ${process.pid} ${line}\n`);
+        }
+        catch {
+            /* debug only */
+        }
+    }
     recoverIfStale() {
+        const owner = this.readOwnerAt(this.lockDir);
+        if (owner) {
+            const stale = !pidAlive(owner.pid) || Date.now() - owner.since > LOCK_STALE_MS;
+            if (stale) {
+                this.trace(`reclaim: owner ${owner.pid} alive=${pidAlive(owner.pid)} age=${Date.now() - owner.since}ms`);
+                this.discard('stale', owner.nonce);
+            }
+            return;
+        }
+        // No trustworthy owner record: the holder is between mkdir and rename, or
+        // it died in that gap. Only the directory's age can tell those apart.
+        // Reclaiming immediately here was the race that let a 41st spawn through
+        // under 60 concurrent processes.
         try {
-            const raw = (0, node_fs_1.readFileSync)((0, node_path_1.join)(this.lockDir, 'owner'), 'utf8').split('\n');
-            const pid = Number(raw[0]);
-            const since = Number(raw[1]);
-            const stale = !Number.isFinite(pid) || !pidAlive(pid) || Date.now() - since > LOCK_STALE_MS;
-            if (stale)
-                (0, node_fs_1.rmSync)(this.lockDir, { recursive: true, force: true });
+            const age = Date.now() - (0, node_fs_1.statSync)(this.lockDir).mtimeMs;
+            if (age > LOCK_STALE_MS) {
+                this.trace(`reclaim ownerless dir age=${age}ms`);
+                this.discard('orphan', null);
+            }
         }
         catch {
-            // Owner file missing: the lock holder is mid-write or gone. If the
-            // directory is older than the stale window, reclaim it.
-            (0, node_fs_1.rmSync)(this.lockDir, { recursive: true, force: true });
+            /* directory vanished between checks: the next mkdir attempt decides */
         }
     }
     release() {
-        (0, node_fs_1.rmSync)(this.lockDir, { recursive: true, force: true });
+        // Only our own instance is released. If it was reclaimed and a sibling
+        // now holds the path, discard() sees the nonce mismatch and returns it.
+        // Release never throws: a crash here is how a lock goes ownerless.
+        const mine = this.held;
+        this.held = null;
+        if (!mine)
+            return;
+        try {
+            this.discard('released', mine.nonce);
+        }
+        catch (error) {
+            this.trace(`release threw ${error.message}`);
+        }
     }
     load() {
         try {
             const parsed = JSON.parse((0, node_fs_1.readFileSync)(this.file, 'utf8'));
-            if (parsed && parsed.version === 1 && Array.isArray(parsed.reservations))
-                return parsed;
+            if (parsed && (parsed.version === 1 || parsed.version === 2) && Array.isArray(parsed.reservations)) {
+                return { version: 2, reservations: parsed.reservations, calls: Array.isArray(parsed.calls) ? parsed.calls : [] };
+            }
         }
         catch {
             /* corrupt or missing: start clean, never trust partial state */
         }
-        return { version: 1, reservations: [] };
+        return { version: 2, reservations: [], calls: [] };
     }
     save(data) {
         const tmp = `${this.file}.${process.pid}.tmp`;
@@ -107,70 +219,192 @@ class ReservationStore {
         (0, node_fs_1.renameSync)(tmp, this.file);
     }
     /**
-     * Try to reserve one spawn slot. `observedSpawns` is what the transcript
-     * shows; the decision is made against observed + pending, under the lock.
+     * Run `fn` with the machine-wide lock held. Everything inside sees one
+     * consistent reservation file and writes it back once. The gateway uses
+     * this to make "fold state, evaluate, reserve, sign" a single transaction,
+     * so two hosts racing the same session cannot interleave halfway.
      *
-     * Returns the effective count that was evaluated, so the caller can report
-     * exactly why a spawn was denied.
+     * Throws if the lock cannot be taken. Callers must fail closed on throw.
      */
-    reserve(args) {
-        const now = args.now ?? Date.now();
+    withLock(fn) {
         this.acquire();
         try {
             const data = this.load();
-            data.reservations = data.reservations.filter((r) => r.expiresAt > now);
-            // Idempotent: the same tool_use_id evaluated twice must not double-count.
-            const existing = data.reservations.find((r) => r.toolUseId === args.toolUseId);
-            const pendingForSession = data.reservations.filter((r) => r.sessionId === args.sessionId && r.toolUseId !== args.toolUseId).length;
-            const effective = args.observedSpawns + pendingForSession + 1;
-            if (existing) {
-                return { allowed: true, effectiveSpawns: effective, pending: pendingForSession };
-            }
-            if (effective > args.ceiling) {
-                return { allowed: false, effectiveSpawns: effective, pending: pendingForSession };
-            }
-            data.reservations.push({
-                sessionId: args.sessionId,
-                toolUseId: args.toolUseId,
-                at: now,
-                expiresAt: now + exports.RESERVATION_TTL_MS,
-            });
-            this.save(data);
-            return { allowed: true, effectiveSpawns: effective, pending: pendingForSession };
+            const tx = new Transaction(data);
+            const result = fn(tx);
+            // Fence before anything is written: if our instance was reclaimed
+            // while fn ran, the whole transaction is discarded, not half-applied.
+            this.fence();
+            if (tx.dirty)
+                this.save(data);
+            return result;
         }
         finally {
             this.release();
         }
     }
+    /**
+     * Callers that write their own files inside a transaction (the gateway's
+     * session file) call this right before writing, for the same reason.
+     */
+    assertHeld() {
+        this.fence();
+    }
+    /**
+     * Try to reserve one spawn slot. `observedSpawns` is what the transcript
+     * shows; the decision is made against observed + pending, under the lock.
+     *
+     * Returns the effective count that was evaluated, so the caller can report
+     * exactly why a spawn was denied.
+     */
+    reserve(args) {
+        return this.withLock((tx) => tx.reserve(args));
+    }
     /** Drop reservations the transcript has now accounted for. */
     reconcile(sessionId, observedSpawns, previouslyObserved) {
-        const settled = Math.max(0, observedSpawns - previouslyObserved);
-        if (settled === 0)
+        if (Math.max(0, observedSpawns - previouslyObserved) === 0)
             return;
-        this.acquire();
-        try {
-            const data = this.load();
-            let remaining = settled;
-            data.reservations = data.reservations.filter((r) => {
-                if (r.sessionId === sessionId && remaining > 0) {
-                    remaining -= 1;
-                    return false;
-                }
-                return true;
-            });
-            this.save(data);
-        }
-        finally {
-            this.release();
-        }
+        this.withLock((tx) => tx.reconcile(sessionId, observedSpawns, previouslyObserved));
     }
     pendingFor(sessionId, now = Date.now()) {
         return this.load().reservations.filter((r) => r.sessionId === sessionId && r.expiresAt > now).length;
     }
+    reserveCall(args) {
+        return this.withLock((tx) => tx.reserveCall(args));
+    }
+    finishCall(callId, windowMs, now = Date.now()) {
+        return this.withLock((tx) => tx.finishCall(callId, windowMs, now));
+    }
+    /** Lock-free read for status. May be a few milliseconds stale; never used to decide. */
+    computeSnapshot(sessionId, windowMs, now = Date.now()) {
+        return computeSnapshot(pruneCalls(this.load().calls ?? [], now, windowMs), sessionId, now, windowMs);
+    }
     clear() {
         if ((0, node_fs_1.existsSync)(this.file))
             (0, node_fs_1.rmSync)(this.file, { force: true });
-        (0, node_fs_1.rmSync)(this.lockDir, { recursive: true, force: true });
+        this.discard('cleared', this.readOwnerAt(this.lockDir)?.nonce ?? null);
     }
 }
 exports.ReservationStore = ReservationStore;
+/** Operations on the loaded reservation file while the lock is held. */
+class Transaction {
+    data;
+    dirty = false;
+    constructor(data) {
+        this.data = data;
+        if (!this.data.calls)
+            this.data.calls = [];
+    }
+    reserve(args) {
+        const now = args.now ?? Date.now();
+        const data = this.data;
+        const before = data.reservations.length;
+        data.reservations = data.reservations.filter((r) => r.expiresAt > now);
+        if (data.reservations.length !== before)
+            this.dirty = true;
+        // Idempotent: the same tool_use_id evaluated twice must not double-count.
+        const existing = data.reservations.find((r) => r.toolUseId === args.toolUseId);
+        const pendingForSession = data.reservations.filter((r) => r.sessionId === args.sessionId && r.toolUseId !== args.toolUseId).length;
+        const effective = args.observedSpawns + pendingForSession + 1;
+        if (existing) {
+            return { allowed: true, effectiveSpawns: effective, pending: pendingForSession };
+        }
+        if (effective > args.ceiling) {
+            return { allowed: false, effectiveSpawns: effective, pending: pendingForSession };
+        }
+        data.reservations.push({
+            sessionId: args.sessionId,
+            toolUseId: args.toolUseId,
+            at: now,
+            expiresAt: now + exports.RESERVATION_TTL_MS,
+        });
+        this.dirty = true;
+        return { allowed: true, effectiveSpawns: effective, pending: pendingForSession };
+    }
+    reconcile(sessionId, observedSpawns, previouslyObserved) {
+        let remaining = Math.max(0, observedSpawns - previouslyObserved);
+        if (remaining === 0)
+            return;
+        const before = this.data.reservations.length;
+        this.data.reservations = this.data.reservations.filter((r) => {
+            if (r.sessionId === sessionId && remaining > 0) {
+                remaining -= 1;
+                return false;
+            }
+            return true;
+        });
+        if (this.data.reservations.length !== before)
+            this.dirty = true;
+    }
+    /**
+     * Open a model-call reservation and return the compute snapshot it was
+     * admitted against. Idempotent on callId: middleware and a proxy that both
+     * see the same call converge on one record. The caller decides the verdict;
+     * the store only guarantees the count is atomic across processes.
+     */
+    reserveCall(args) {
+        const now = args.now ?? Date.now();
+        const calls = pruneCalls(this.data.calls, now, args.windowMs);
+        if (calls.length !== this.data.calls.length)
+            this.dirty = true;
+        this.data.calls = calls;
+        if (!calls.some((c) => c.callId === args.callId)) {
+            calls.push({
+                sessionId: args.sessionId,
+                callId: args.callId,
+                host: args.host,
+                estimatedTokens: Math.max(0, args.estimatedTokens),
+                startedAt: now,
+                finishedAt: null,
+                expiresAt: now + args.ttlMs,
+            });
+            this.dirty = true;
+        }
+        return computeSnapshot(calls, args.sessionId, now, args.windowMs);
+    }
+    /** Mark a call finished. Returns its duration, or null if unknown to us. */
+    finishCall(callId, windowMs, now = Date.now()) {
+        const call = this.data.calls.find((c) => c.callId === callId);
+        if (!call)
+            return null;
+        if (call.finishedAt === null) {
+            call.finishedAt = now;
+            call.estimatedTokens = 0;
+            // Keep it exactly as long as the occupied-time window can see it.
+            call.expiresAt = now + windowMs;
+            this.dirty = true;
+        }
+        return call.finishedAt - call.startedAt;
+    }
+    computeSnapshot(sessionId, windowMs, now = Date.now()) {
+        return computeSnapshot(pruneCalls(this.data.calls, now, windowMs), sessionId, now, windowMs);
+    }
+}
+exports.Transaction = Transaction;
+function pruneCalls(calls, now, windowMs) {
+    const horizon = now - windowMs;
+    return calls.filter((c) => {
+        if (c.finishedAt === null)
+            return c.expiresAt > now;
+        return c.finishedAt > horizon;
+    });
+}
+function computeSnapshot(calls, sessionId, now, windowMs) {
+    const horizon = now - windowMs;
+    let inFlight = 0;
+    let inFlightForSession = 0;
+    let occupiedMs = 0;
+    let pendingEstimatedTokens = 0;
+    for (const c of calls) {
+        const end = c.finishedAt ?? now;
+        if (c.finishedAt === null) {
+            inFlight += 1;
+            if (c.sessionId === sessionId)
+                inFlightForSession += 1;
+            pendingEstimatedTokens += c.estimatedTokens;
+        }
+        // Only the part of the request inside the window counts.
+        occupiedMs += Math.max(0, end - Math.max(c.startedAt, horizon));
+    }
+    return { inFlight, inFlightForSession, occupiedMs, pendingEstimatedTokens, windowMs };
+}

package/dist/src/state/session.d.ts

@@ -12,6 +12,12 @@ import type { BurnEvent, SessionState } from '../types';
 export declare function newSessionState(sessionId: string, firstEventAt: number): SessionState;
 /** Apply one event. Returns the active minutes that elapsed for debt accounting. */
 export declare function applyEvent(state: SessionState, event: BurnEvent): number;
+/**
+ * Correct a count already applied, in either direction, without touching
+ * active time. Used when a real usage figure replaces an estimate that was
+ * reserved under the same call ID. Buckets never go below zero.
+ */
+export declare function applyCorrection(state: SessionState, deltaTokens: number, deltaCacheRead: number): void;
 /** Sum of a rolling window over the last N active minutes. */
 export declare function windowSum(byMinute: Map<number, number>, activeMinutes: number, windowMinutes: number): number;
 /** Median of completed, nonzero active minutes. The current partial minute is excluded. */

package/dist/src/state/session.js

@@ -12,6 +12,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.newSessionState = newSessionState;
 exports.applyEvent = applyEvent;
+exports.applyCorrection = applyCorrection;
 exports.windowSum = windowSum;
 exports.medianCompletedMinute = medianCompletedMinute;
 exports.cacheReadRatio = cacheReadRatio;
@@ -62,6 +63,22 @@ function applyEvent(state, event) {
     }
     return activeGapMinutes;
 }
+/**
+ * Correct a count already applied, in either direction, without touching
+ * active time. Used when a real usage figure replaces an estimate that was
+ * reserved under the same call ID. Buckets never go below zero.
+ */
+function applyCorrection(state, deltaTokens, deltaCacheRead) {
+    state.totalTokens = Math.max(0, state.totalTokens + deltaTokens);
+    state.totalCacheRead = Math.max(0, state.totalCacheRead + deltaCacheRead);
+    const bucket = Math.floor(state.activeMinutes);
+    const current = state.tokensByActiveMinute.get(bucket) ?? 0;
+    const next = Math.max(0, current + deltaTokens);
+    if (next > 0)
+        state.tokensByActiveMinute.set(bucket, next);
+    else
+        state.tokensByActiveMinute.delete(bucket);
+}
 /** Sum of a rolling window over the last N active minutes. */
 function windowSum(byMinute, activeMinutes, windowMinutes) {
     const from = Math.max(0, Math.floor(activeMinutes) - windowMinutes);

package/dist/src/status.d.ts

@@ -0,0 +1,11 @@
+/**
+ * One status for the whole machine.
+ *
+ * Every host's sessions in one table, with coverage stated per plane, so an
+ * OK never masquerades as full visibility. A Cursor session shows
+ * `usage:n/a`; a proxy session shows `spawns:n/a`; a session fed by both
+ * middleware and the proxy shows full coverage, because it has it.
+ */
+import type { GatewaySessionView } from './gateway';
+import type { ComputeSnapshot } from './state/reservations';
+export declare function renderMachineStatus(sessions: GatewaySessionView[], compute: ComputeSnapshot, now?: number): string;

package/dist/src/status.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * One status for the whole machine.
+ *
+ * Every host's sessions in one table, with coverage stated per plane, so an
+ * OK never masquerades as full visibility. A Cursor session shows
+ * `usage:n/a`; a proxy session shows `spawns:n/a`; a session fed by both
+ * middleware and the proxy shows full coverage, because it has it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderMachineStatus = renderMachineStatus;
+const evaluate_1 = require("./detectors/evaluate");
+const LIVE_WINDOW_MS = 30 * 60 * 1000;
+function renderMachineStatus(sessions, compute, now = Date.now()) {
+    const live = sessions.filter((s) => s.closedAt === null && now - s.state.lastEventAt <= LIVE_WINDOW_MS);
+    const totalTokens = live.reduce((n, s) => n + s.state.totalTokens, 0);
+    const lines = [];
+    lines.push(`cross-tool sessions: ${live.length} live · ${(0, evaluate_1.fmt)(totalTokens)} tokens · ${compute.inFlight} model call(s) in flight · ${Math.round(compute.occupiedMs / 1000)}s occupied in last ${Math.round(compute.windowMs / 60000)} min`);
+    if (live.length === 0) {
+        lines.push('  (none in the last 30 minutes; Claude Code sessions are tracked by the hook and listed by `replay`)');
+        return lines.join('\n');
+    }
+    lines.push('  ' + pad('HOST(S)', 22) + pad('SESSION', 20) + pad('TOKENS', 9) + pad('SPAWNS', 8) + pad('DEPTH', 7) + pad('LIVE', 6) + 'COVERAGE');
+    for (const s of live) {
+        lines.push('  ' +
+            pad(s.hosts.join('+'), 22) +
+            pad(shortId(s.sessionId), 20) +
+            pad((0, evaluate_1.fmt)(s.state.totalTokens), 9) +
+            pad(String(s.state.spawnCount), 8) +
+            pad(String(s.state.maxDepth), 7) +
+            pad(String(s.liveSpawns), 6) +
+            coverageLine(s));
+    }
+    return lines.join('\n');
+}
+function coverageLine(s) {
+    const usage = s.usage.missing > 0 ? `usage:partial(${s.usage.missing} missing)` : s.usage.authoritative > 0 ? 'usage:auth' : s.usage.estimated > 0 ? 'usage:est' : `usage:${short(s.capabilities.usage)}`;
+    return `spawns:${short(s.capabilities.spawns)} depth:${short(s.capabilities.depth)} ${usage}`;
+}
+function short(c) {
+    return c === 'authoritative' ? 'auth' : c === 'estimated' ? 'est' : 'n/a';
+}
+function pad(v, w) {
+    return v.length >= w ? `${v.slice(0, w - 1)} ` : v.padEnd(w, ' ');
+}
+function shortId(v) {
+    return v.length <= 18 ? v : `${v.slice(0, 8)}…${v.slice(-8)}`;
+}

package/dist/src/types.d.ts

@@ -8,7 +8,7 @@
  * competitors, so the policy layer has to sit above all of them.
  */
 export type Verdict = 'OK' | 'WARN' | 'STOP';
-export type Detector = 'fanout' | 'sustained_burn' | 'burn_debt' | 'spawn_rate' | 'account' | 'duplicate_work';
+export type Detector = 'fanout' | 'sustained_burn' | 'burn_debt' | 'spawn_rate' | 'account' | 'duplicate_work' | 'local_compute';
 /** One normalised observation from a host transcript. */
 export interface BurnEvent {
     /** Unix milliseconds. */
@@ -114,6 +114,19 @@ export interface Thresholds {
         windowActiveMinutes: number;
         warnConcurrentSessions: number;
     };
+    /**
+     * Local inference plane (Ollama, vLLM, LM Studio). Token dollars are close
+     * to meaningless when the GPU is yours; what runs away is concurrency and
+     * occupied time. WARN-only by default: no universal STOP is honest for
+     * hardware we cannot see. Optional so pre-0.2 policy files stay valid.
+     */
+    localCompute?: {
+        windowMs: number;
+        warnConcurrent: number;
+        stopConcurrent: number | null;
+        warnOccupiedMs: number | null;
+        stopOccupiedMs: number | null;
+    };
 }
 export type Mode = 'shadow' | 'enforce';
 export interface Policy {

package/package.json

@@ -1,17 +1,41 @@
 {
   "name": "@agentguard-run/burn",
-  "version": "0.1.0",
-  "description": "Local runaway-agent circuit breaker for AI coding agents. Detects fan-out storms and sustained token burn, blocks the next spawn, and proves what happened. Nothing leaves the machine.",
+  "version": "0.2.0",
+  "description": "Local runaway-agent circuit breaker for AI coding agents and local model runtimes. One policy across Claude Code, Cursor, Codex, Ollama, vLLM, LM Studio and raw orchestrators: detects fan-out storms and sustained token burn, blocks the next spawn, and proves what happened with content-free signed receipts. Nothing leaves the machine.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    },
+    "./middleware": {
+      "types": "./dist/src/adapters/raw-api.d.ts",
+      "default": "./dist/src/adapters/raw-api.js"
+    },
+    "./proxy": {
+      "types": "./dist/src/proxy/server.d.ts",
+      "default": "./dist/src/proxy/server.js"
+    },
+    "./cursor": {
+      "types": "./dist/src/adapters/cursor.d.ts",
+      "default": "./dist/src/adapters/cursor.js"
+    },
+    "./codex": {
+      "types": "./dist/src/adapters/codex.d.ts",
+      "default": "./dist/src/adapters/codex.js"
+    },
+    "./package.json": "./package.json"
+  },
   "bin": {
     "agentguard-burn": "dist/src/cli.js"
   },
   "files": [
     "dist/src",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "engines": {
@@ -21,11 +45,10 @@
     "build": "tsc -p tsconfig.json",
     "test": "tsc -p tsconfig.json && node --test \"dist/tests/**/*.test.js\"",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "replay": "node dist/cli.js replay"
-  },
-  "dependencies": {
-    "@noble/ed25519": "^3.0.0"
+    "conformance": "tsc -p tsconfig.json && node dist/src/cli.js conformance",
+    "replay": "node dist/src/cli.js replay"
   },
+  "dependencies": {},
   "devDependencies": {
     "@types/node": "^22",
     "typescript": "^5.0.0"
@@ -33,10 +56,14 @@
   "keywords": [
     "agentguard",
     "claude-code",
+    "cursor",
+    "codex",
+    "ollama",
+    "vllm",
     "agents",
     "token-budget",
     "circuit-breaker",
     "runaway",
     "fan-out"
   ]
-}
+}