@aiwg/cli 2026.10.6 → 2026.10.7

package/dist/src/mcp/adapters/codex-runtime.js

@@ -14,11 +14,13 @@
  *
  * @implements #892
  */
+import { readPrivateValueFile } from '../../auth/sensitive-input.js';
 import { signalChild } from '../../process/signal-child.mjs';
-import { readFile, mkdir, symlink, access, readdir, chmod, lstat, open } from 'fs/promises';
+import { helperEnvironment, HELPER_ENV_ALLOWLIST, DESKTOP_HELPER_ENV_ALLOWLIST } from '../../process/cli-command.mjs';
+import { readFile, mkdir, symlink, access, readdir, chmod } from 'fs/promises';
 import { join } from 'path';
 import { homedir } from 'os';
-import { existsSync, constants } from 'fs';
+import { existsSync } from 'fs';
 import { spawn, spawnSync } from 'child_process';
 import { boundedSpawnSync, resolveSyncProcessTimeoutMs } from '../../process/bounded-child-process.mjs';
 import { isInteractive } from '../../cli/env.js';
@@ -228,73 +230,9 @@ function envWithoutSecretValue(base, envVarName, secretValue) {
     }
     return result;
 }
-/**
- * Read an API key from a private file (#3062 go/no-go review, blocker 1C):
- * `--api-key-file <path>` reads the key from disk instead of an
- * environment variable, so a file that does not meet the same bar the
- * decision ledger's own file writer enforces
- * (`src/decision/ledger.ts`'s `openLedgerFileForAppend`) is refused rather
- * than silently trusted. This mirrors that check for a read instead of a
- * write — there is no already-exported helper at this layer to reuse (the
- * ledger's checks are private to that module and tied to its own
- * create-if-missing write path), so this re-implements the same checks for
- * a read: never follow a symlink; the open file descriptor must resolve to
- * a regular file with exactly one hard link; and, on POSIX, must be owned
- * by the current user with no group/other permission bits. The file's
- * contents are returned trimmed; no error message here ever includes them.
- */
+/** Backward-compatible MCP export; the validation is shared by all input commands. */
 async function readApiKeyFromFile(filePath) {
-    try {
-        const pre = await lstat(filePath);
-        if (pre.isSymbolicLink()) {
-            throw new Error(`--api-key-file: "${filePath}" is a symlink; refusing to follow it.`);
-        }
-    }
-    catch (error) {
-        if (error.code === 'ENOENT') {
-            throw new Error(`--api-key-file: "${filePath}" does not exist.`);
-        }
-        if (error instanceof Error && error.message.startsWith('--api-key-file:'))
-            throw error;
-        throw new Error(`--api-key-file: cannot stat "${filePath}": ${error.message}`);
-    }
-    const hasNoFollow = typeof constants.O_NOFOLLOW === 'number';
-    const flags = constants.O_RDONLY | (hasNoFollow ? constants.O_NOFOLLOW : 0);
-    let handle;
-    try {
-        handle = await open(filePath, flags);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === 'ELOOP')
-            throw new Error(`--api-key-file: "${filePath}" is a symlink; refusing to follow it.`);
-        if (code === 'ENOENT')
-            throw new Error(`--api-key-file: "${filePath}" does not exist.`);
-        throw new Error(`--api-key-file: cannot open "${filePath}": ${error.message}`);
-    }
-    try {
-        const stat = await handle.stat();
-        if (!stat.isFile()) {
-            throw new Error(`--api-key-file: "${filePath}" is not a regular file.`);
-        }
-        if (stat.nlink !== 1) {
-            throw new Error(`--api-key-file: "${filePath}" has more than one hard link; refusing to read it.`);
-        }
-        if (process.platform !== 'win32') {
-            const uid = typeof process.getuid === 'function' ? process.getuid() : null;
-            if (uid !== null && stat.uid !== uid) {
-                throw new Error(`--api-key-file: "${filePath}" is not owned by the current user.`);
-            }
-            if ((stat.mode & 0o077) !== 0) {
-                throw new Error(`--api-key-file: "${filePath}" must not be readable or writable by group or other ` +
-                    '(chmod 600 it).');
-            }
-        }
-        return (await handle.readFile({ encoding: 'utf-8' })).trim();
-    }
-    finally {
-        await handle.close();
-    }
+    return readPrivateValueFile(filePath, '--api-key-file');
 }
 /**
  * Async, credential-safe launch of `codex login --with-api-key` (#3062
@@ -320,17 +258,37 @@ function spawnCodexLoginWithApiKey(apiKey, env) {
     return new Promise((resolve) => {
         const child = spawn('codex', ['login', '--with-api-key'], {
             env,
-            stdio: ['pipe', 'inherit', 'inherit'],
+            stdio: ['pipe', 'pipe', 'pipe'],
         });
         let settled = false;
         let timer;
+        const stdout = [];
+        const stderr = [];
+        let outputBytes = 0;
+        // Buffer through close so a credential split between chunks cannot escape
+        // redaction. The combined cap bounds both memory and forwarded diagnostics.
+        const collect = (target, chunk) => {
+            if (settled)
+                return;
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            outputBytes += buffer.length;
+            if (outputBytes > 1024 * 1024) {
+                settle({ status: null, signal: 'SIGKILL', error: new Error('codex login output exceeded the 1 MiB limit.') });
+                return;
+            }
+            target.push(buffer);
+        };
+        const onStdout = (chunk) => collect(stdout, chunk);
+        const onStderr = (chunk) => collect(stderr, chunk);
+        child.stdout?.on('data', onStdout);
+        child.stderr?.on('data', onStderr);
         // #3062 go/no-go review, blocker 2: stdin error, write completion,
-        // child 'error', child 'exit', and the deadline all funnel through this
+        // child 'error', child 'close', and the deadline all funnel through this
         // one function, which settles exactly once, always clears the timer and
         // removes every listener this call added, and kills the child if it is
         // still alive on a failing settlement (a running process on the
         // timeout path; a process that may still be running on an unexpected
-        // stdin-write error). The 'exit' path never reaches the kill — by the
+        // stdin-write error). The 'close' path never reaches the kill — by the
         // time that event fires the child has already exited.
         const settle = (result) => {
             if (settled)
@@ -340,13 +298,23 @@ function spawnCodexLoginWithApiKey(apiKey, env) {
                 clearTimeout(timer);
             child.stdin?.removeListener('error', onStdinError);
             child.removeListener('error', onChildError);
-            child.removeListener('exit', onExit);
+            child.removeListener('close', onClose);
+            child.stdout?.removeListener('data', onStdout);
+            child.stderr?.removeListener('data', onStderr);
+            child.stdout?.destroy();
+            child.stderr?.destroy();
             if (result.error && child.exitCode === null && child.signalCode === null) {
                 try {
                     signalChild(child, 'SIGKILL');
                 }
                 catch { /* already gone */ }
             }
+            // On a failed/oversized stream, suppress buffered fragments entirely:
+            // the missing remainder might contain the rest of a credential.
+            if (!result.error) {
+                process.stdout.write(Buffer.concat(stdout).toString('utf8').split(apiKey).join('[redacted]'));
+                process.stderr.write(Buffer.concat(stderr).toString('utf8').split(apiKey).join('[redacted]'));
+            }
             resolve(result);
         };
         timer = setTimeout(() => {
@@ -358,15 +326,15 @@ function spawnCodexLoginWithApiKey(apiKey, env) {
         }, boundMs);
         const onChildError = (err) => settle({ status: null, signal: null, error: err });
         child.on('error', onChildError);
-        const onExit = (code, signal) => settle({ status: code, signal });
-        child.on('exit', onExit);
+        const onClose = (code, signal) => settle({ status: code, signal });
+        child.on('close', onClose);
         // A child that exits (or closes its read end) before reading stdin
         // raises EPIPE/ECONNRESET on the *stdin stream*, not on the child
         // object — `child.on('error', ...)` above never sees it, so without
         // this listener it is an unhandled 'error' event, which Node turns into
         // an uncaught exception. Installed before the write/end below, per the
         // review. EPIPE/ECONNRESET specifically mean "the child already went
-        // away"; the already-firing (or about-to-fire) 'exit' event carries the
+        // away"; the already-firing (or about-to-fire) 'close' event carries the
         // real, non-secret result, so this swallows exactly those two codes and
         // lets settle() happen there instead. Anything else is a genuine,
         // unexpected stdin failure and is itself the settling error.
@@ -413,7 +381,9 @@ export async function loginInProfile(profile, options = {}) {
     await ensureRuntimeHome(profile);
     const rtHome = runtimeHomePath(profile);
     const env = {
-        ...process.env,
+        ...helperEnvironment(process.env, [
+            ...HELPER_ENV_ALLOWLIST, ...DESKTOP_HELPER_ENV_ALLOWLIST, 'NODE_EXTRA_CA_CERTS',
+        ]),
         HOME: rtHome,
         CODEX_HOME: rtHome,
         AIWG_CONFIG: resolveUserConfigDir(),

package/dist/src/mcp/cli.mjs

@@ -1124,7 +1124,7 @@ Usage:
   aiwg mcp profile import <file>
   aiwg mcp profile export <name> [--out <file>]
   aiwg mcp profile init-presets
-  aiwg mcp profile login <name> [--api-key-stdin | --api-key-file <path> | --api-key-env <ENV_VAR_NAME>]
+  aiwg mcp profile login <name> [--api-key-interactive | --api-key-stdin | --api-key-file <path> | --api-key-store <name> | --api-key-env <ENV_VAR_NAME>]
 
 Profiles let you define named subsets of your registered MCP servers:
   aiwg mcp profile add dev --servers git-gitea,memory-fortemi --description "Dev work"
@@ -1162,10 +1162,10 @@ Logging in to a Codex profile's isolated runtime home (#3062):
                                                      $OPENAI_KEY; visible to every other
                                                      child process this shell starts
   In every case the key reaches codex over stdin only; it never appears on
-  argv, in logs, or in error messages. Exactly one of the three may be
-  given. Without a terminal and without any of the three, this errors
-  naming all three. See "Supplying credentials safely" in the docs:
-  docs/mcp/codex-profiles.md#supplying-credentials-safely
+  argv, in logs, or in error messages. Use --api-key-store <name> for a named
+  OS-store entry, or --api-key-interactive for hidden terminal entry. Give
+  sources in preference order; a missing source without a terminal errors naming the options.
+  See docs/cli/sensitive-values.md for exposure details and manager examples.
 `);
 }
 
@@ -1419,59 +1419,18 @@ async function handleProfileInitPresets() {
   }
 }
 
-/**
- * Read all of stdin and return it as one trimmed string (go/no-go review,
- * blocker 1C's `--api-key-stdin`). Mirrors `src/cli/handlers/decision.ts`'s
- * own private `readStdin()` + `.trim()` for `--token-stdin` — duplicated
- * rather than imported for the same source/dist reason documented on
- * `requireFlagValue` above (this file runs both compiled and directly from
- * source). Input is expected to be a single line; a value containing
- * additional lines is not specially rejected, matching that precedent.
- */
-async function readStdinAll() {
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
-  return Buffer.concat(chunks).toString('utf8');
-}
-
-/**
- * Handle `aiwg mcp profile login <name> [--api-key-env <ENV_VAR_NAME> |
- * --api-key-stdin | --api-key-file <path>]` (#3062, #3069, go/no-go review
- * blocker 1C).
- *
- * Wires `loginInProfile()` (src/mcp/adapters/codex-runtime.ts), which
- * already implements the full headless-safe behavior this command needs:
- * with a terminal attached and none of the three given, it runs the
- * interactive `codex login` OAuth flow. Exactly one credential source may
- * be given; more than one is a usage error naming the flags given. In
- * every case the key reaches `loginInProfile()` only as an in-memory value
- * (or, for `--api-key-env`, a variable *name*) — never on argv, in logs, or
- * in an error message — and travels to `codex` only on its stdin (see
- * `spawnCodexLoginWithApiKey()`'s own doc comment). Without a terminal and
- * without any of the three, `loginInProfile()` itself refuses, naming all
- * three flags.
- *
- * `--api-key-env` reads the key from that named environment variable, as
- * before. `--api-key-stdin` reads one line from this process's own stdin
- * (refusing if stdin is a terminal, or if it is empty) — the least
- * observable source, since the key then never exists in any environment or
- * on any command line. `--api-key-file <path>` reads the key from a file
- * that `readApiKeyFromFile()` requires to be a non-symlink, single-hard-
- * link, regular file owned by the current user with no group/other
- * permission bits on POSIX — refused otherwise, without ever printing the
- * path's contents. `--api-key-env` remains the least preferred of the
- * three (see "Supplying credentials safely" in the docs): the named
- * variable is visible to every other child process this shell starts.
- */
+/** Standard sensitive input; the Codex adapter still receives only an in-memory key. */
 async function handleProfileLogin(args) {
   let apiKeyEnv;
   let apiKeyFilePath;
+  let apiKeyStore;
   try {
     // rejectEmpty: an explicitly-given-but-empty variable name/path can
     // never name a real environment variable or file (#3062 second review,
     // finding 4; go/no-go review blocker 1C).
     apiKeyEnv = requireFlagValue(args, { rejectEmpty: true }, '--api-key-env');
     apiKeyFilePath = requireFlagValue(args, { rejectEmpty: true }, '--api-key-file');
+    apiKeyStore = requireFlagValue(args, { rejectEmpty: true }, '--api-key-store');
   } catch (err) {
     if (err instanceof MissingFlagValueError) {
       console.error(`${err.message}.`);
@@ -1481,16 +1440,6 @@ async function handleProfileLogin(args) {
   }
   const useStdin = args.includes('--api-key-stdin');
 
-  const sourcesGiven = [
-    apiKeyEnv !== undefined ? '--api-key-env' : null,
-    useStdin ? '--api-key-stdin' : null,
-    apiKeyFilePath !== undefined ? '--api-key-file' : null,
-  ].filter(Boolean);
-  if (sourcesGiven.length > 1) {
-    console.error(`Only one credential source may be given; got ${sourcesGiven.join(', ')}.`);
-    process.exit(2);
-  }
-
   // Skip --api-key-env's/--api-key-file's own value when hunting for the
   // positional profile name, so e.g. `login --api-key-env FOO` (missing
   // name) never misreads FOO as the name (mirrors this file's own
@@ -1500,46 +1449,24 @@ async function handleProfileLogin(args) {
   for (let i = 0; i < args.length; i += 1) {
     const token = args[i];
     if (token === '--') break;
-    if (token === '--api-key-env' || token === '--api-key-file') { i += 1; continue; }
+    if (token === '--api-key-env' || token === '--api-key-file' || token === '--api-key-store') { i += 1; continue; }
     if (!token.startsWith('--')) positional.push(token);
   }
   const name = positional[0];
   if (!name) {
-    console.error('Usage: aiwg mcp profile login <name> [--api-key-env <ENV_VAR_NAME> | --api-key-stdin | --api-key-file <path>]');
+    console.error('Usage: aiwg mcp profile login <name> [--api-key-interactive | --api-key-stdin | --api-key-file <path> | --api-key-store <name> | --api-key-env <ENV_VAR_NAME>]');
     process.exit(1);
   }
 
-  let apiKey;
-  if (useStdin) {
-    if (process.stdin.isTTY) {
-      console.error(
-        '--api-key-stdin requires piped input, not a terminal; run ' +
-        `\`aiwg mcp profile login ${name}\` with no credential flag for the interactive login instead.`,
-      );
-      process.exit(2);
-    }
-    apiKey = (await readStdinAll()).trim();
-    if (!apiKey) {
-      console.error('--api-key-stdin received no key (stdin was empty).');
-      process.exit(2);
-    }
-  } else if (apiKeyFilePath !== undefined) {
-    const { readApiKeyFromFile } = await loadCodexRuntimeAdapter();
-    try {
-      apiKey = await readApiKeyFromFile(apiKeyFilePath);
-    } catch (err) {
-      console.error(err instanceof Error ? err.message : String(err));
-      process.exit(2);
-    }
-    if (!apiKey) {
-      console.error(`--api-key-file "${apiKeyFilePath}" is empty.`);
-      process.exit(2);
-    }
-  }
-
   try {
+    await loadCodexRuntimeAdapter();
+    const { resolveSensitiveInput } = await import(pathToFileURL(path.join(findOwnPackageRoot(), 'dist', 'src', 'auth', 'sensitive-input.js')).href);
+    const apiKey = await resolveSensitiveInput({
+      prefix: 'api-key', stdin: useStdin, file: apiKeyFilePath, store: apiKeyStore,
+      env: apiKeyEnv, interactive: args.includes('--api-key-interactive'),
+    });
     const { loginInProfile } = await loadCodexRuntimeAdapter();
-    const loginOptions = apiKey !== undefined ? { apiKey } : apiKeyEnv ? { apiKeyEnv } : {};
+    const loginOptions = { apiKey };
     await loginInProfile(name, loginOptions);
     console.log(`\nLogged in to profile "${name}".`);
   } catch (err) {

package/dist/src/mcp/grok-build-config.mjs

@@ -3,6 +3,7 @@ import { constants } from 'node:fs';
 import { access, lstat, readFile } from 'node:fs/promises';
 import { dirname, relative, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { tomlString as string } from './toml-string.mjs';
 
@@ -144,7 +145,7 @@ export async function unmanageGrokBuildMcp(configPath, names, options = {}) {
 }
 
 function runJson(binary, args, cwd, env) {
-  const run = spawnSync(binary, args, { cwd, env, encoding: 'utf8', timeout: 30_000, killSignal: 'SIGKILL' });
+  const run = spawnSync(binary, args, { cwd, env: helperEnvironment(env), encoding: 'utf8', timeout: 30_000, killSignal: 'SIGKILL' });
   if (run.error || run.status !== 0) return { ok: false, detail: run.error?.message || run.stderr || `exit ${run.status}` };
   try { return { ok: true, value: JSON.parse(run.stdout || '{}') }; }
   catch { return { ok: false, detail: 'Grok returned malformed JSON' }; }

package/dist/src/mcp/muse-native-config.mjs

@@ -4,6 +4,7 @@ import { spawnSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import os from 'node:os';
 import { resolveMuseXdgSkillsDir } from '../providers/muse-paths.js';
+import { helperEnvironment } from '../process/cli-command.mjs';
 
 // Mirrors tools/agents/providers/muse-hooks.mjs. src/ cannot import tools/:
 // tools/ is not part of the compiled dist/ tree.
@@ -47,7 +48,7 @@ function deepEqual(a, b) {
 
 function inspectMuseCli(env) {
   const result = spawnSync('muse', ['--version'], {
-    env,
+    env: helperEnvironment(env),
     encoding: 'utf8',
     timeout: MUSE_VERSION_TIMEOUT_MS,
     killSignal: 'SIGKILL',

package/dist/src/mcp/tools/worker-invoke.mjs

@@ -2707,6 +2707,9 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
   }
 
   async function status(input) {
+    const { projectRecoveryStatus, mergeRecoveryStatuses } = await importImpl('mission-protocol/worker-status.js');
+    const recoveryStatus = breaker => projectRecoveryStatus(typeof breaker?.recoveryStatus === 'function'
+      ? { ...breaker.recoveryStatus(), observedAt: now().toISOString() } : null, 'live');
     if (!input.invocation_id) {
       // #2915 round 8 (D4): ordinary status, read-only, no id — lists every
       // invocation this server currently tracks as a `dispatched` reservation
@@ -2725,11 +2728,19 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
         .filter(scope => scope.state === 'operator-intervention')
         .map(scope => ({ scopeId: scope.scopeKey, reason: scope.operatorReason,
           resetInstruction: { operation: 'reset_recovery_scope', scope_id: scope.scopeKey } })));
-      return { unresolvedReservations, interventionScopes };
+      const recovery = mergeRecoveryStatuses([...breakers].map((breaker, index) => {
+        const status = recoveryStatus(breaker);
+        if (breakers.size > 1) {
+          for (const scope of status.scopes) scope.owner = `owner-${index + 1}`;
+          for (const transition of status.transitions) transition.owner = `owner-${index + 1}`;
+        }
+        return status;
+      }));
+      return { unresolvedReservations, interventionScopes, recovery };
     }
     const entry = registry.get(input.invocation_id);
     if (!entry) throw new Error('Unknown invocation_id');
-    return publicStatus(entry, healthHook);
+    return { ...publicStatus(entry, healthHook), recovery: recoveryStatus(entry.recoveryBreaker ?? registry.recoveryOwner) };
   }
 
   /**

package/dist/src/memory/project-registry.js

@@ -10,6 +10,7 @@ import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { boundedExecFileSync } from '../process/bounded-child-process.mjs';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { projectAiwgPath, resolveProjectAiwgDir } from '../config/project-artifacts.js';
 export function projectMemoryHome() {
     const override = process.env.AIWG_PROJECT_MEMORY_HOME;
@@ -248,7 +249,7 @@ function sanitizeProjectId(id) {
 }
 function discoverGitRemotes(cwd) {
     try {
-        const stdout = boundedExecFileSync('git', ['remote', '-v'], 'quick', { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const stdout = boundedExecFileSync('git', ['remote', '-v'], 'quick', { cwd, env: helperEnvironment(), encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
         const remotes = stdout
             .split('\n')
             .map((line) => line.trim().split(/\s+/)[1])

package/dist/src/mission-protocol/worker-status.js

@@ -1,2 +1,92 @@
-export {};
+const recoveryStates = new Set(['closed', 'open', 'half-open', 'canary-ready', 'canary', 'operator-intervention']);
+const recoveryScopes = new Set(['invocation', 'model', 'installation', 'quota', 'provider', 'host']);
+const recoveryReasons = new Set(['NOT_FOUND', 'SPAWN_REFUSED', 'AUTH', 'RATE_LIMIT', 'NETWORK',
+    'RESOURCE', 'SANDBOX', 'MODEL', 'UNKNOWN']);
+const objectRecord = (value) => value !== null
+    && typeof value === 'object' && !Array.isArray(value) ? value : null;
+const finiteClock = (value) => typeof value === 'number' && Number.isFinite(value)
+    && Math.abs(value) <= Number.MAX_SAFE_INTEGER ? value : null;
+/** Read-only projection of the existing breaker owner. Only fixed reason codes
+ * and scope identities survive; worker captures, actions and diagnostics do not.
+ * Clock values are converted with the owner's persisted wall-clock anchor,
+ * never with the reader's clock (which may belong to another process/boot). */
+export function projectRecoveryStatus(value, source = 'recorded') {
+    const record = objectRecord(value);
+    const observedAtMs = finiteClock(record?.observedAtMs);
+    const wall = typeof record?.observedAt === 'string' ? Date.parse(record.observedAt) : NaN;
+    const observedAt = Number.isFinite(wall) ? new Date(wall).toISOString() : null;
+    const at = (clock) => {
+        if (clock === null || observedAtMs === null || observedAt === null)
+            return null;
+        const mapped = wall + clock - observedAtMs;
+        return Number.isFinite(mapped) && Math.abs(mapped) <= 8.64e15 ? new Date(mapped).toISOString() : null;
+    };
+    const identity = (item) => {
+        if (!recoveryScopes.has(item.scope) || typeof item.scopeKey !== 'string'
+            || !/^[\p{L}\p{N}_.:/@+~%\-]{1,256}$/u.test(item.scopeKey)
+            || !item.scopeKey.startsWith(`${String(item.scope)}:`))
+            return null;
+        return { scopeKey: item.scopeKey, scope: item.scope };
+    };
+    const reasons = (value) => Array.isArray(value)
+        ? [...new Set(value.slice(0, 32).filter(reason => recoveryReasons.has(reason)))] : [];
+    const rawScopes = Array.isArray(record?.scopes) ? record.scopes : [];
+    const rawTransitions = Array.isArray(record?.transitions) ? record.transitions : [];
+    const scopes = [];
+    for (const raw of rawScopes.slice(0, 32)) {
+        const item = objectRecord(raw), id = item && identity(item);
+        if (!item || !id || !recoveryStates.has(item.state))
+            continue;
+        const nextEligibleAtMs = finiteClock(item.nextEligibleAtMs);
+        scopes.push({ ...id, state: item.state, reasons: reasons(item.reasons),
+            nextEligibleAtMs, nextEligibleAt: at(nextEligibleAtMs), canaryInFlight: item.canaryInFlight === true });
+    }
+    const transitions = [];
+    for (const raw of rawTransitions.slice(-32)) {
+        const item = objectRecord(raw), id = item && identity(item);
+        const clock = finiteClock(item?.atMs);
+        if (!item || !id || clock === null || !recoveryStates.has(item.from) || !recoveryStates.has(item.to))
+            continue;
+        const nextEligibleAtMs = finiteClock(item.nextEligibleAtMs);
+        transitions.push({ ...id, from: item.from, to: item.to,
+            reasons: reasons(item.reasons), atMs: clock, at: at(clock), nextEligibleAtMs, nextEligibleAt: at(nextEligibleAtMs) });
+    }
+    const omittedScopeCount = typeof record?.omittedScopeCount === 'number'
+        && Number.isSafeInteger(record.omittedScopeCount) && record.omittedScopeCount >= 0 ? record.omittedScopeCount : 0;
+    return { source: record ? source : 'unavailable', observedAt, observedAtMs, scopes, transitions,
+        omittedScopeCount: omittedScopeCount + Math.max(0, rawScopes.length - 32),
+        truncated: record?.truncated === true || omittedScopeCount > 0 || rawScopes.length > 32 || rawTransitions.length > 32 };
+}
+/** Merge independently owned observations without letting one owner's close
+ * hide another owner's active scope. Callers first select the latest record
+ * for each owner; owner labels are supplied from validated launcher identity. */
+export function mergeRecoveryStatuses(statuses) {
+    const available = statuses.filter(status => status.source !== 'unavailable');
+    const latest = available.reduce((last, status) => !last
+        || Date.parse(status.observedAt ?? '') >= Date.parse(last.observedAt ?? '') ? status : last, null);
+    if (!latest)
+        return projectRecoveryStatus(null);
+    const allScopes = available.flatMap(status => status.scopes);
+    const scopes = allScopes.filter(scope => scope.state !== 'closed').concat(allScopes.filter(scope => scope.state === 'closed'));
+    const transitions = available.flatMap(status => status.transitions).sort((a, b) => (a.at ? Date.parse(a.at) : a.atMs) - (b.at ? Date.parse(b.at) : b.atMs));
+    const omittedScopeCount = available.reduce((count, status) => count + status.omittedScopeCount, 0) + Math.max(0, scopes.length - 32);
+    return { source: latest.source, observedAt: latest.observedAt, observedAtMs: latest.observedAtMs,
+        scopes: scopes.slice(0, 32), transitions: transitions.slice(-32), omittedScopeCount,
+        truncated: available.some(status => status.truncated) || omittedScopeCount > 0 || transitions.length > 32 };
+}
+/** Mechanical correction records carry fixed codes and invocation identities. */
+export function projectStartupCorrection(value) {
+    const record = objectRecord(value);
+    const safeId = (value) => typeof value === 'string'
+        && /^[\p{L}\p{N}_.:/@+~%\-]{1,256}$/u.test(value);
+    if (!record || record.action !== 'refresh-executable-binding' || record.reasonCode !== 'NOT_FOUND'
+        || !['applied', 'stopped'].includes(String(record.state)) || !safeId(record.previousInvocationId))
+        return null;
+    const stopCodes = new Set(['ATTEMPT_LIMIT', 'CANCELLED', 'DEADLINE', 'UNCHANGED_EXECUTABLE', 'QUALIFICATION_REFUSED',
+        'BINDING_CHANGED', 'RETRY_REFUSED', 'RETRY_FAILED']);
+    return { action: 'refresh-executable-binding', reasonCode: 'NOT_FOUND', state: record.state,
+        previousInvocationId: record.previousInvocationId,
+        ...(typeof record.stopCode === 'string' && stopCodes.has(record.stopCode) ? { stopCode: record.stopCode } : {}),
+        ...(safeId(record.retryInvocationId) ? { retryInvocationId: record.retryInvocationId } : {}) };
+}
 //# sourceMappingURL=worker-status.js.map

package/dist/src/models/worker-installation.d.mts

@@ -11,7 +11,7 @@ export function loadRecordedWorkerInstallations(input: {
   storeDigest?: string;
   /** Request validation after store presence, before recorded policy/adapter checks. */
   precheckPolicy?: () => void;
-}): Promise<{ registry: ProviderModelCapabilityRegistry; installations: Record<string, WorkerResolutionBinding>; drivers: Record<string, WorkerInvocationDriver>; observations: Record<string, import('./model-discovery.js').ProviderModelDiscovery> }>;
+}): Promise<{ registry: ProviderModelCapabilityRegistry; installations: Record<string, WorkerResolutionBinding>; drivers: Record<string, WorkerInvocationDriver>; observations: Record<string, import('./model-discovery.js').ProviderModelDiscovery>; qualificationFailures?: Record<string, string> }>;
 
 export function hasProvider(name: string): boolean;