@aiwg/cli 2026.10.1 → 2026.10.3

package/dist/src/decision/adapters/jev.js

@@ -2,7 +2,6 @@ import { DecisionValidationError, validateDecisionValue, validateDistribution }
 import { canonicalJson } from '../../security/artifact-trust.js';
 import { partitionProjectedState } from '../projection.js';
 import { isTraceparent } from '../telemetry/context.js';
-import { runInNewContext } from 'node:vm';
 import { lookup } from 'node:dns/promises';
 import { isIP } from 'node:net';
 import { request as httpsRequest } from 'node:https';
@@ -12,7 +11,7 @@ export const JEV_ENDPOINT = 'https://api.typesafe.ai/v1/systemone';
 const MAX_HEADER_BYTES = 32 * 1024;
 const MAX_BODY_BYTES = 1024 * 1024;
 const MAX_REQUEST_ID_LENGTH = 128;
-const MAX_PARSE_MS = 50;
+const MAX_PARSE_DEPTH = 64;
 /** Safe resolver taxonomy; messages are intentionally discarded at this boundary. */
 export class JevCredentialError extends Error {
     category;
@@ -45,6 +44,7 @@ export class JevDecisionAdapter {
         this.region = options.region?.trim() ? options.region : null;
         this.observeResponseBody = options.observeResponseBody;
     }
+    /** Used only for non-2xx error bodies, where there is no separate successful parse to stay consistent with. */
     observeResponse(body) {
         if (!this.observeResponseBody)
             return;
@@ -61,6 +61,30 @@ export class JevDecisionAdapter {
         this.observeResponseBody(body, { actualModel: typeof parsed.model === 'string' && parsed.model ? parsed.model : null,
             usage });
     }
+    /**
+     * Derives the observer's model/usage from a value `parseBoundedJson` has already produced (or `undefined`
+     * on a failed parse) -- never from a second, independent parse of the same bytes. `parseBoundedJson` runs
+     * inside a bounded-time VM context (`MAX_PARSE_MS`); calling it twice on identical bytes let one call
+     * succeed while the other spuriously hit that wall-clock bound under host contention, so the reported
+     * metadata could disagree with the actual parsed answer even though both described one response.
+     */
+    observationMetadataOf(parsed) {
+        let record = {};
+        try {
+            record = asRecord(parsed);
+        }
+        catch { /* A non-object (or absent) top-level value has no model; usage stays unknown. */ }
+        let usage = emptyUsage();
+        try {
+            usage = normalizeUsage(record.usage);
+        }
+        catch { /* Missing usage is unknown, including on auth errors. */ }
+        return { actualModel: typeof record.model === 'string' && record.model ? record.model : null, usage };
+    }
+    /** Observes exactly once, from the single parse attempt `parsed` already represents (successful or not). */
+    observeParsed(body, parsed) {
+        this.observeResponseBody?.(body, this.observationMetadataOf(parsed));
+    }
     async capabilities() {
         return {
             answerKinds: ['choice', 'ordinal-score', 'truth-probability'],
@@ -191,9 +215,7 @@ export class JevDecisionAdapter {
                     try {
                         parsedError = parseBoundedJson(errorBody);
                     }
-                    catch (error) {
-                        if (error && typeof error === 'object' && 'code' in error && error.code === 'ERR_SCRIPT_EXECUTION_TIMEOUT')
-                            throw error;
+                    catch {
                         parsedError = null;
                     }
                     if (parsedError && typeof parsedError === 'object' && !Array.isArray(parsedError)) {
@@ -217,8 +239,15 @@ export class JevDecisionAdapter {
         let parsed;
         try {
             const encoded = await readBoundedBody(response, signal);
-            this.observeResponse(encoded);
-            parsed = parseBoundedJson(encoded);
+            // One parse attempt; the observer reads its outcome (success or failure) before answer validation,
+            // so an invalid answer still gets model/usage checked, and a parse failure is reported as unknown
+            // to both the observer and the main path -- never divergently.
+            try {
+                parsed = parseBoundedJson(encoded);
+            }
+            finally {
+                this.observeParsed(encoded, parsed);
+            }
             if (request.signal.aborted)
                 return externalInterruption(request, 'terminal-response', metadata);
             if (deadline.aborted)
@@ -334,8 +363,14 @@ export class JevDecisionAdapter {
         }
         try {
             const encoded = await readBoundedBody(response, signal);
-            this.observeResponse(encoded);
-            const parsed = parseBoundedJson(encoded);
+            // One parse attempt; see the single-request `evaluate()` for why observation never re-parses.
+            let parsed;
+            try {
+                parsed = parseBoundedJson(encoded);
+            }
+            finally {
+                this.observeParsed(encoded, parsed);
+            }
             const normalized = normalizeBatchResponse(requests, parsed).map(answer => ({
                 questionId: answer.questionId,
                 observation: { ...answer.observation, ...metadata },
@@ -574,19 +609,21 @@ function safeRequestId(value) {
     return typeof value === 'string' && value.length > 0 && value.length <= MAX_REQUEST_ID_LENGTH
         && /^[\x21-\x7e]+$/.test(value) && !value.includes(',') ? value : null;
 }
-function parseBoundedJson(text) {
-    rejectDuplicateAnswerKeys(text);
-    return structuredClone(runInNewContext('JSON.parse(input)', { input: text }, { timeout: MAX_PARSE_MS }));
-}
-/** Detect duplicate keys in the response's answer map before JSON.parse erases them. */
-function rejectDuplicateAnswerKeys(text) {
-    const marker = /"answers"\s*:\s*\{/g.exec(text);
-    if (!marker)
-        return;
-    let index = marker.index + marker[0].length;
-    let depth = 1;
-    const keys = new Set();
-    while (index < text.length && depth > 0) {
+/** @internal Exported from this module for direct admission and CPU-cost evidence, not the public barrel. */
+export function parseBoundedJson(text) {
+    // Bound work, not elapsed time: a VM timeout includes host scheduling delay.
+    // The stream reader also enforces this bound, before UTF-8 decoding.
+    if (text.length > MAX_BODY_BYTES || Buffer.byteLength(text, 'utf8') > MAX_BODY_BYTES) {
+        throw new DecisionValidationError('Jev response too large');
+    }
+    // Scan iteratively before allocation by JSON.parse. Total key text/count is
+    // bounded by body bytes; no recursive walk or suffix copying is needed.
+    // String/key spans are disjoint; skip the whitespace consumed by lookahead.
+    // Each code unit is visited once. Key slicing/decoding/hashing sum to
+    // O(body bytes), as does native parsing.
+    const containers = [];
+    let index = 0;
+    while (index < text.length) {
         const char = text[index];
         if (char === '"') {
             const start = index++;
@@ -600,20 +637,31 @@ function rejectDuplicateAnswerKeys(text) {
                 else if (next === '"')
                     break;
             }
-            if (depth === 1 && /^\s*:/.test(text.slice(index))) {
+            let next = index;
+            while (next < text.length && /[\x20\t\r\n]/.test(text[next]))
+                next += 1;
+            const keys = containers.at(-1);
+            if (keys && text[next] === ':') {
                 const key = JSON.parse(text.slice(start, index));
                 if (keys.has(key))
-                    throw new DecisionValidationError('duplicate Jev answer key');
+                    throw new DecisionValidationError('duplicate Jev response key');
                 keys.add(key);
             }
+            index = next;
             continue;
         }
-        if (char === '{' || char === '[')
-            depth += 1;
+        if (char === '{' || char === '[') {
+            if (containers.length >= MAX_PARSE_DEPTH)
+                throw new DecisionValidationError('Jev response nesting too deep');
+            containers.push(char === '{' ? new Set() : null);
+        }
         else if (char === '}' || char === ']')
-            depth -= 1;
+            containers.pop();
         index += 1;
     }
+    // Native parsing checks the complete JSON grammar, with no reviver or code
+    // execution. Input bytes and nesting bound its work and allocated graph.
+    return JSON.parse(text);
 }
 function headersWithinLimit(headers) {
     let bytes = 0;

package/dist/src/decision/driver.js

@@ -3,8 +3,10 @@ import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { askDecision, setupJev, DecisionAskUsageError, readDecisionContextFile, validateDecisionAskInput, } from './ask.js';
+import { recordDecisionAsk, decisionLedgerHistory, decisionLedgerStats, resolveDecisionSessionId, parseDecisionLedgerSince, DecisionLedgerSinceError, DECISION_LEDGER_SCHEMA, ATTRIBUTION_FIELD_PATTERN, MAX_ATTRIBUTION_FIELD_LENGTH, MAX_RECORDED_CHOICE_IDS, MAX_RECORD_TEXT_BYTES, MAX_LEDGER_RECORD_BYTES, DECISION_LEDGER_RECORD_TIMEOUT_MS, DECISION_SAVINGS_REASONING_ALLOWANCE_TOKENS, DECISION_SAVINGS_ESTIMATION_METHOD, buildDecisionLedgerRecord, appendDecisionLedgerRecord, filterDecisionLedgerRecords, } from './ledger.js';
+import { resolveActiveProvider } from '../cli/provider-resolution.js';
 import { assertDecisionEvaluateDispatcherConfig, decisionPatternPacks, getDecisionPatternPack, governedPatternArtifacts, listDecisionPatterns, patternInputSchema, patternOutputSchema, planLiveDecisionPattern, runOfflineDecisionPattern, validateAgainstSchema, validateDecisionDocument, validateDefinition, validateRuleset, } from './index.js';
-export { askDecision, setupJev, readDecisionContextFile, validateDecisionAskInput, DecisionAskUsageError, };
+export { askDecision, setupJev, readDecisionContextFile, validateDecisionAskInput, DecisionAskUsageError, recordDecisionAsk, decisionLedgerHistory, decisionLedgerStats, resolveDecisionSessionId, parseDecisionLedgerSince, DecisionLedgerSinceError, DECISION_LEDGER_SCHEMA, ATTRIBUTION_FIELD_PATTERN, MAX_ATTRIBUTION_FIELD_LENGTH, MAX_RECORDED_CHOICE_IDS, MAX_RECORD_TEXT_BYTES, MAX_LEDGER_RECORD_BYTES, DECISION_LEDGER_RECORD_TIMEOUT_MS, DECISION_SAVINGS_REASONING_ALLOWANCE_TOKENS, DECISION_SAVINGS_ESTIMATION_METHOD, buildDecisionLedgerRecord, appendDecisionLedgerRecord, filterDecisionLedgerRecords, resolveActiveProvider, };
 const DECISION_ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const VALIDATION_TARGETS = ['request', 'definition', 'ruleset', 'binding'];
 const OFFLINE_ADAPTER = 'agentic/code/addons/decision-engine/examples/fixture-jev-adapter.mjs';

package/dist/src/decision/entry.js

@@ -16,10 +16,42 @@ export class EntryAdmissionError extends Error {
         this.name = 'EntryAdmissionError';
     }
 }
+/**
+ * Starts an admission-budget clock, feature-detecting
+ * `process.threadCpuUsage()` once for this reading. `elapsedAdmissionMs`
+ * below reads the *type* of what this returns rather than re-detecting the
+ * feature, so one admission check always uses one clock end to end.
+ *
+ * Per-thread CPU time measures only the work the admitting call itself did
+ * on this thread, so it is immune both to host scheduling contention
+ * pausing this thread between reads (the root cause of #3047's false
+ * `time-budget` rejections of legitimate input under host load) and to
+ * other threads' or background GC's CPU time landing on this same process
+ * (which a process-wide `process.cpuUsage()` clock would still charge here
+ * -- not a safe substitute for the same reason `performance.now()` was not).
+ *
+ * `process.threadCpuUsage()` was added in Node v22.19.0 (per the installed
+ * `@types/node` `@since` annotation) and is absent on this project's
+ * `engines.node` floor (`>=20.0.0` in package.json) and on Node
+ * 22.0.0-22.18.x. On a runtime without it, this falls back to the
+ * pre-#3047 monotonic wall-clock guard as an explicitly documented
+ * compatibility fallback: it restores the original host-load sensitivity on
+ * those older runtimes, it does not resolve it there.
+ */
+export function admissionClockStart() {
+    return typeof process.threadCpuUsage === 'function' ? process.threadCpuUsage() : performance.now();
+}
+/** Elapsed time since `start` (from `admissionClockStart`), in milliseconds. */
+export function elapsedAdmissionMs(start) {
+    if (typeof start === 'number')
+        return performance.now() - start;
+    const diff = process.threadCpuUsage(start);
+    return (diff.user + diff.system) / 1000;
+}
 /** Check the object graph before JSON serialization, schema validation or digesting. */
 export function admitEntry(value, limits = DEFAULT_ENTRY_LIMITS) {
     const counts = { entries: 0, properties: 0, bytes: 0, estimatedMemoryBytes: 0 };
-    const started = performance.now();
+    const started = admissionClockStart();
     const encoder = new TextEncoder();
     const stack = new Set();
     const fail = (reason) => { throw new EntryAdmissionError(reason, counts); };
@@ -32,7 +64,7 @@ export function admitEntry(value, limits = DEFAULT_ENTRY_LIMITS) {
             fail('memory-budget');
     };
     const visit = (item, depth) => {
-        if (performance.now() - started > limits.timeMs)
+        if (elapsedAdmissionMs(started) > limits.timeMs)
             fail('time-budget');
         if (++counts.entries > limits.entries)
             fail('entry-count');
@@ -107,7 +139,7 @@ export function parseDecisionJson(source, limits = DEFAULT_ENTRY_LIMITS) {
         throw new EntryAdmissionError('serialized-bytes', { bytes });
     if (bytes * 4 > limits.memoryBytes)
         throw new EntryAdmissionError('memory-budget', { bytes });
-    const started = performance.now();
+    const started = admissionClockStart();
     let value;
     try {
         value = JSON.parse(source);
@@ -118,7 +150,7 @@ export function parseDecisionJson(source, limits = DEFAULT_ENTRY_LIMITS) {
     const document = parseDocument(source, { uniqueKeys: true });
     if (document.errors.length)
         throw new EntryAdmissionError('duplicate-or-invalid-key', { bytes });
-    if (performance.now() - started > limits.timeMs)
+    if (elapsedAdmissionMs(started) > limits.timeMs)
         throw new EntryAdmissionError('time-budget', { bytes });
     admitEntry(value, limits);
     return value;
@@ -130,7 +162,7 @@ export function parseDecisionYaml(source, limits = DEFAULT_ENTRY_LIMITS) {
         throw new EntryAdmissionError('serialized-bytes', { bytes });
     if (bytes * 4 > limits.memoryBytes)
         throw new EntryAdmissionError('memory-budget', { bytes });
-    const started = performance.now();
+    const started = admissionClockStart();
     const document = parseDocument(source, { uniqueKeys: true });
     if (document.errors.length)
         throw new EntryAdmissionError('duplicate-or-invalid-key', { bytes });
@@ -160,7 +192,7 @@ export function parseDecisionYaml(source, limits = DEFAULT_ENTRY_LIMITS) {
         }
     };
     inspect(document.contents, 0);
-    if (performance.now() - started > limits.timeMs)
+    if (elapsedAdmissionMs(started) > limits.timeMs)
         throw new EntryAdmissionError('time-budget', { bytes, entries });
     const value = document.toJS();
     admitEntry(value, limits);

package/dist/src/decision/heldout/collector.js

@@ -250,6 +250,12 @@ export async function collectHeldoutStudy(options) {
                     // No raw provider exceptions, model IDs or request IDs cross this boundary when a secret matches.
                     const raw = observation;
                     const metadata = wireMetadata;
+                    // `metadata` is `jev.ts`'s observer, reading model/usage off the exact same single parse that
+                    // produced `raw` (never a second, independent parse of the same bytes -- see jev.ts `observeParsed`).
+                    // The two can therefore no longer disagree on a successful response; preferring `metadata` here
+                    // only matters when `raw` is a failure (e.g. an otherwise-parseable but invalid answer), so the
+                    // model/usage bound checks below still see the wire-observed values jev.ts's `failure()` does not
+                    // carry.
                     const observed = raw && metadata ? { ...raw, actualModel: metadata.actualModel, usage: metadata.usage } : raw;
                     const completed = receipt;
                     const captures = QUALIFICATION_PRIVACY_SURFACES.map(surface => ({ surface,
@@ -275,7 +281,10 @@ export async function collectHeldoutStudy(options) {
                     else if (observed?.usage.costUsd !== null && observed?.usage.costUsd !== undefined && observed.usage.costUsd * 1_000_000 > reserveMicros)
                         outcome = 'price-bound';
                     else if (observed?.status === 'success') {
-                        if (observed.actualModel !== a.servedModel)
+                        // A null model is unknown, not a mismatch: it must complete neither as 'ok' nor as 'served-model'.
+                        if (observed.actualModel === null)
+                            outcome = 'model-unknown';
+                        else if (observed.actualModel !== a.servedModel)
                             outcome = 'served-model';
                         else if (observed.usage.inputTokens === null || observed.usage.outputTokens === null)
                             outcome = 'usage-unknown';

package/dist/src/decision/index.js

@@ -54,6 +54,7 @@ export * from './issue-triage/index.js';
 export * from './routing/index.js';
 export * from './interop.js';
 export * from './ask.js';
+export * from './ledger.js';
 export * from './jev-credentials.js';
 export { collectHeldoutStudy, scoreHeldoutStudy } from './heldout/collector.js';
 export { heldoutDigest, heldoutExecutionDigest, planHeldoutCollection, validateHeldoutBundle, heldoutRowsInScope } from './heldout/contract.js';

package/dist/src/decision/interop.js

@@ -38,7 +38,8 @@ const FORBIDDEN_CONTROL_FIELDS = new Set([
     'calibration', 'executor', 'backend', 'acceptance', 'artifactPin', 'actionAuthorization',
 ]);
 const SENSITIVE_LOG_KEY = /(?:raw|body|secret|token|credential|private|locator|state|authorization|password|key)/iu;
-const SENSITIVE_LOG_VALUE = /(?:bearer\s+\S+|secret|token|file:\/\/|\/home\/|private|[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,})/iu;
+const SENSITIVE_LOG_VALUE = /(?:bearer\s+\S+|secret|token|file:\/\/|\/home\/|private)/iu;
+const MAX_LOG_VALUE_LENGTH = 65_536;
 const SUPPORTED_DMN_ELEMENTS = new Set(['definitions', 'decision', 'informationRequirement', 'requiredDecision', 'decisionTable', 'input', 'inputExpression', 'output', 'rule', 'inputEntry', 'outputEntry', 'text']);
 export function decisionInteropDefaultBounds(overrides = {}) {
     return { ...DEFAULT_BOUNDS, ...overrides };
@@ -580,7 +581,11 @@ function sanitizeJson(value, path, redaction) {
                 redaction.removed.push(`${path}.${key}`);
                 continue;
             }
-            result[key] = sanitizeJson(child, `${path}.${key}`, redaction);
+            // Keep ordinary objects while preserving __proto__ as an own JSON data key.
+            Object.defineProperty(result, key, {
+                value: sanitizeJson(child, `${path}.${key}`, redaction),
+                enumerable: true, writable: true, configurable: true,
+            });
         }
         return result;
     }
@@ -595,10 +600,16 @@ function projectOpaInput(input, allowlist, redaction) {
     for (const pointer of allowlist) {
         if (!pointer.startsWith('/'))
             throw new DecisionInteropError('opa-input-projection', 'OPA input projection allowlist entries must be JSON Pointers');
+        const path = pointer.slice(1).split('/').map(part => part.replace(/~1/gu, '/').replace(/~0/gu, '~'));
+        // Only __proto__ is forbidden in pointers; constructor/prototype are valid data keys.
+        // Own-property traversal and data-property writes keep ordinary projection objects safe.
+        if (path.some(segment => segment === '__proto__')) {
+            throw new DecisionInteropError('opa-input-projection', 'OPA input projection cannot contain __proto__ segments');
+        }
         const resolved = resolveJsonPointer(input, pointer);
         if (!resolved.found)
             continue;
-        setProjectedValue(output, pointer.slice(1).split('/').map(part => part.replace(/~1/gu, '/').replace(/~0/gu, '~')), sanitizeJson(resolved.value, `$.input${pointer}`, redaction));
+        setProjectedValue(output, path, sanitizeJson(resolved.value, `$.input${pointer}`, redaction));
     }
     return output;
 }
@@ -606,17 +617,58 @@ function setProjectedValue(target, path, value) {
     let cursor = target;
     path.forEach((segment, index) => {
         if (index === path.length - 1) {
-            cursor[segment] = value;
+            Object.defineProperty(cursor, segment, {
+                value, enumerable: true, writable: true, configurable: true,
+            });
             return;
         }
-        const existing = cursor[segment];
-        if (!existing || typeof existing !== 'object' || Array.isArray(existing))
-            cursor[segment] = {};
+        const existing = Object.hasOwn(cursor, segment) ? cursor[segment] : undefined;
+        if (!existing || typeof existing !== 'object' || Array.isArray(existing)) {
+            Object.defineProperty(cursor, segment, {
+                value: {}, enumerable: true, writable: true, configurable: true,
+            });
+        }
         cursor = cursor[segment];
     });
 }
 function isSensitiveValue(value) {
-    return typeof value === 'string' && SENSITIVE_LOG_VALUE.test(value);
+    if (typeof value !== 'string')
+        return false;
+    // Redact oversized values in full so a sensitive suffix cannot escape inspection.
+    if (value.length > MAX_LOG_VALUE_LENGTH)
+        return true;
+    if (SENSITIVE_LOG_VALUE.test(value))
+        return true;
+    let localLength = 0;
+    let domainLength = -1;
+    let suffixLength = -1;
+    for (const character of value) {
+        const letter = /[A-Z]/iu.test(character);
+        if (character === '@') {
+            domainLength = localLength > 0 ? 0 : -1;
+            suffixLength = -1;
+        }
+        else if (domainLength >= 0) {
+            if (/[A-Z0-9.-]/iu.test(character)) {
+                if (character === '.')
+                    suffixLength = domainLength > 0 ? 0 : -1;
+                else if (letter && suffixLength >= 0) {
+                    suffixLength++;
+                    if (suffixLength >= 2)
+                        return true;
+                }
+                else
+                    suffixLength = -1;
+                domainLength++;
+            }
+            else {
+                domainLength = -1;
+                suffixLength = -1;
+            }
+        }
+        localLength = /[A-Z0-9._%+-]/iu.test(character) ? localLength + 1 : 0;
+    }
+    return false;
 }
 function assertUnique(values, label) {
     const seen = new Set();