@allocator-one/rcl 4.4.19

package/dist/ci.d.ts

@@ -0,0 +1,16 @@
+import type { ReviewResult } from './consensus/types.js';
+import { type ReviewerHealth } from './report/reviewer-health.js';
+export interface CiVerdict {
+    exitCode: number;
+    message?: string;
+}
+/**
+ * Decide the CI exit status for a completed review.
+ *
+ * A run where every reviewer errored produces zero findings — which without
+ * this check looks identical to "clean" and exits 0, greenlighting code that
+ * was never actually reviewed. That case fails first; blocking findings fail
+ * second. New proof-bearing reports pass a validated frozen-matrix health
+ * projection; legacy callers retain the original zero-success rule.
+ */
+export declare function evaluateCiGate(result: ReviewResult, health?: ReviewerHealth): CiVerdict;

package/dist/ci.js

@@ -0,0 +1,42 @@
+import { assertReviewerHealth } from './report/reviewer-health.js';
+/**
+ * Decide the CI exit status for a completed review.
+ *
+ * A run where every reviewer errored produces zero findings — which without
+ * this check looks identical to "clean" and exits 0, greenlighting code that
+ * was never actually reviewed. That case fails first; blocking findings fail
+ * second. New proof-bearing reports pass a validated frozen-matrix health
+ * projection; legacy callers retain the original zero-success rule.
+ */
+export function evaluateCiGate(result, health) {
+    if (health !== undefined) {
+        assertReviewerHealth(health);
+        if (!health.conclusive) {
+            return {
+                exitCode: 1,
+                message: `CI: ${health.successfulSeats.length}/${health.policy.seatCount} blocking reviewers completed every required chunk; ${health.policy.minimumSuccessful} required. Reviewer health is inconclusive. Exiting with code 1.`,
+            };
+        }
+    }
+    if (result.stats.successfulReviews === 0) {
+        return {
+            exitCode: 1,
+            message: `CI: 0/${result.stats.totalReviews} reviewers succeeded — nothing was reviewed. Exiting with code 1.`,
+        };
+    }
+    // Gating-annotated findings (RCL-23) block on their gating reason —
+    // consensus, critical, or verified — so a refuted single-model claim no
+    // longer fails CI. Legacy reports without annotations keep the pure
+    // severity gate.
+    const blocking = result.findings.filter((f) => f.gating
+        ? f.gating.reason !== 'none'
+        : f.severity === 'critical' || f.severity === 'important');
+    if (blocking.length > 0) {
+        return {
+            exitCode: 1,
+            message: `CI: ${blocking.length} blocking finding(s) found. Exiting with code 1.`,
+        };
+    }
+    return { exitCode: 0 };
+}
+//# sourceMappingURL=ci.js.map

package/dist/ci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.js","sourceRoot":"","sources":["../src/ci.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAuB,MAAM,6BAA6B,CAAC;AAOxF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,MAAuB;IAC1E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,uDAAuD,MAAM,CAAC,MAAM,CAAC,iBAAiB,kEAAkE;aACjO,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,SAAS,MAAM,CAAC,KAAK,CAAC,YAAY,mEAAmE;SAC/G,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,oEAAoE;IACpE,iBAAiB;IACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5C,CAAC,CAAC,MAAM;QACN,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;QAC5B,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAC5D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,QAAQ,CAAC,MAAM,kDAAkD;SAClF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC"}

package/dist/config/data-dir.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Where rcl keeps its per-machine state (model stats, the telemetry outbox,
+ * the consent notice): `RCL_DATA_DIR`, or `~/.rcl`. Shared here so no
+ * feature module depends on another for the location.
+ */
+export declare function resolveDataDir(env?: NodeJS.ProcessEnv): string;

package/dist/config/data-dir.js

@@ -0,0 +1,12 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Where rcl keeps its per-machine state (model stats, the telemetry outbox,
+ * the consent notice): `RCL_DATA_DIR`, or `~/.rcl`. Shared here so no
+ * feature module depends on another for the location.
+ */
+export function resolveDataDir(env = process.env) {
+    const override = env['RCL_DATA_DIR']?.trim();
+    return override && override.length > 0 ? override : join(homedir(), '.rcl');
+}
+//# sourceMappingURL=data-dir.js.map

package/dist/config/data-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-dir.js","sourceRoot":"","sources":["../../src/config/data-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC"}

package/dist/config/defaults.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Primary council — general reviewers; specialists also use secondary models.
+ * Direct-API models only: the RCL-21 audit (922 rounds, 15,268 calls) found
+ * the OpenRouter wing at p50 7–9.5 min per call with 19–39% dead calls,
+ * last-finisher in 97.6% of rounds; the audited direct trio answered in
+ * 45–70 s with ~0% dead calls. Replaying the corpus with that direct-provider
+ * topology drops the median round from 14.4 to 2.0 min while 91% of
+ * multi-model findings still surface.
+ */
+export declare const DEFAULT_MODELS: readonly ["anthropic/claude-opus-5-5", "openai/gpt-6-sol"];
+/**
+ * Async bonus reviewers — fired with the round but never awaited; whatever
+ * has arrived by the NEXT round's dedup is merged then, marked async in the
+ * report. kimi-k3 keeps a seat here because it has the council's best
+ * corroboration rate (62%) but is ~6× slower than the core trio.
+ */
+export declare const DEFAULT_ASYNC_MODELS: readonly ["openrouter/moonshotai/kimi-k3"];
+/** Gemini contributes specialist reviews without adding a general-review seat. */
+export declare const DEFAULT_SECONDARY_MODELS: readonly ["google/gemini-3.8-flash"];
+export declare const DEFAULT_THRESHOLDS: {
+    readonly minConsensusScore: 0.4;
+    readonly minConfidence: 0.2;
+    readonly dedupeLineWindow: 5;
+    /**
+     * Threshold for the weighted title+description similarity
+     * (0.6 * title + 0.4 * description). Calibrated against the fixture
+     * corpus: genuine cross-model duplicates score 0.29-0.55 (descriptions
+     * diverge heavily across models), so higher thresholds split real
+     * duplicates. The strictness gain over the old max(title, desc) check
+     * comes from the formula: a title-only match now needs 0.5+ title
+     * overlap to merge instead of 0.3.
+     */
+    readonly jaccardThreshold: 0.3;
+};
+/**
+ * Blocking-path per-call timeout. The RCL-21 corpus put every direct-API
+ * model's p90 under 260 s, but the 2.0.0 rollout (RCL-29) showed heavier
+ * reasoning defaults pushing real calls past 300 s; losing a reviewer costs
+ * more than waiting, so the blocking path now gets 540 s. Slow-by-design
+ * models still belong in the async lane, which has its own cap below.
+ */
+export declare const DEFAULT_TIMEOUT_MS = 540000;
+/**
+ * Quorum round closure (RCL-26): a round closes once this fraction of its
+ * planned calls has completed; outstanding non-core calls are canceled and
+ * recorded. ⅔ matches the converge reviewer-health threshold, so a round
+ * closed exactly at quorum can still be conclusive. Corpus replay: −51%
+ * total review wall even with the pre-RCL-25 roster. Set to 1 to disable.
+ */
+export declare const DEFAULT_QUORUM_FRACTION: number;
+/**
+ * Per-call timeout for the async (non-blocking) lane. Async reviewers are
+ * slow by definition — kimi-k3's p50 is 7–9.5 min — and nothing waits on
+ * them, so they get more headroom than the blocking council.
+ */
+export declare const DEFAULT_ASYNC_TIMEOUT_MS = 900000;
+export declare const DEFAULT_MAX_RETRIES = 3;
+/**
+ * Reasoning budget for OpenRouter-hosted models. Unbounded, they spend the
+ * whole completion budget (and many minutes) thinking before emitting any
+ * findings. Kimi K3, the default async model, supports low/high/max, not
+ * medium. Use the supported low level while retaining the output/time caps;
+ * explicit configuration can still select another effort for other models.
+ */
+export declare const DEFAULT_REASONING_EFFORT = "low";
+export declare const DEFAULT_CONCURRENCY = 9;
+/**
+ * Provider admission limits inside the blocking runner. The default prevents
+ * the observed five-seat high-effort Anthropic burst while preserving the
+ * existing per-call deadline. Providers absent from this map remain bounded
+ * only by the global concurrency limit.
+ */
+export declare const DEFAULT_PROVIDER_CONCURRENCY: {
+    readonly anthropic: 2;
+};
+export declare const DEFAULT_SEVERITY_ORDER: readonly ["critical", "important", "minor", "nitpick"];
+export declare const CONFIDENCE_THRESHOLDS: {
+    readonly veryHigh: 0.8;
+    readonly high: 0.6;
+    readonly medium: 0.4;
+    readonly low: 0.2;
+};

package/dist/config/defaults.js

@@ -0,0 +1,89 @@
+/**
+ * Primary council — general reviewers; specialists also use secondary models.
+ * Direct-API models only: the RCL-21 audit (922 rounds, 15,268 calls) found
+ * the OpenRouter wing at p50 7–9.5 min per call with 19–39% dead calls,
+ * last-finisher in 97.6% of rounds; the audited direct trio answered in
+ * 45–70 s with ~0% dead calls. Replaying the corpus with that direct-provider
+ * topology drops the median round from 14.4 to 2.0 min while 91% of
+ * multi-model findings still surface.
+ */
+export const DEFAULT_MODELS = [
+    'anthropic/claude-opus-5-5',
+    'openai/gpt-6-sol',
+];
+/**
+ * Async bonus reviewers — fired with the round but never awaited; whatever
+ * has arrived by the NEXT round's dedup is merged then, marked async in the
+ * report. kimi-k3 keeps a seat here because it has the council's best
+ * corroboration rate (62%) but is ~6× slower than the core trio.
+ */
+export const DEFAULT_ASYNC_MODELS = ['openrouter/moonshotai/kimi-k3'];
+/** Gemini contributes specialist reviews without adding a general-review seat. */
+export const DEFAULT_SECONDARY_MODELS = ['google/gemini-3.8-flash'];
+export const DEFAULT_THRESHOLDS = {
+    minConsensusScore: 0.4,
+    minConfidence: 0.2,
+    dedupeLineWindow: 5,
+    /**
+     * Threshold for the weighted title+description similarity
+     * (0.6 * title + 0.4 * description). Calibrated against the fixture
+     * corpus: genuine cross-model duplicates score 0.29-0.55 (descriptions
+     * diverge heavily across models), so higher thresholds split real
+     * duplicates. The strictness gain over the old max(title, desc) check
+     * comes from the formula: a title-only match now needs 0.5+ title
+     * overlap to merge instead of 0.3.
+     */
+    jaccardThreshold: 0.3,
+};
+/**
+ * Blocking-path per-call timeout. The RCL-21 corpus put every direct-API
+ * model's p90 under 260 s, but the 2.0.0 rollout (RCL-29) showed heavier
+ * reasoning defaults pushing real calls past 300 s; losing a reviewer costs
+ * more than waiting, so the blocking path now gets 540 s. Slow-by-design
+ * models still belong in the async lane, which has its own cap below.
+ */
+export const DEFAULT_TIMEOUT_MS = 540_000;
+/**
+ * Quorum round closure (RCL-26): a round closes once this fraction of its
+ * planned calls has completed; outstanding non-core calls are canceled and
+ * recorded. ⅔ matches the converge reviewer-health threshold, so a round
+ * closed exactly at quorum can still be conclusive. Corpus replay: −51%
+ * total review wall even with the pre-RCL-25 roster. Set to 1 to disable.
+ */
+export const DEFAULT_QUORUM_FRACTION = 2 / 3;
+/**
+ * Per-call timeout for the async (non-blocking) lane. Async reviewers are
+ * slow by definition — kimi-k3's p50 is 7–9.5 min — and nothing waits on
+ * them, so they get more headroom than the blocking council.
+ */
+export const DEFAULT_ASYNC_TIMEOUT_MS = 900_000;
+export const DEFAULT_MAX_RETRIES = 3;
+/**
+ * Reasoning budget for OpenRouter-hosted models. Unbounded, they spend the
+ * whole completion budget (and many minutes) thinking before emitting any
+ * findings. Kimi K3, the default async model, supports low/high/max, not
+ * medium. Use the supported low level while retaining the output/time caps;
+ * explicit configuration can still select another effort for other models.
+ */
+export const DEFAULT_REASONING_EFFORT = 'low';
+export const DEFAULT_CONCURRENCY = 9;
+/**
+ * Provider admission limits inside the blocking runner. The default prevents
+ * the observed five-seat high-effort Anthropic burst while preserving the
+ * existing per-call deadline. Providers absent from this map remain bounded
+ * only by the global concurrency limit.
+ */
+export const DEFAULT_PROVIDER_CONCURRENCY = { anthropic: 2 };
+export const DEFAULT_SEVERITY_ORDER = [
+    'critical',
+    'important',
+    'minor',
+    'nitpick',
+];
+export const CONFIDENCE_THRESHOLDS = {
+    veryHigh: 0.8,
+    high: 0.6,
+    medium: 0.4,
+    low: 0.2,
+};
+//# sourceMappingURL=defaults.js.map

package/dist/config/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,2BAA2B;IAC3B,kBAAkB;CACV,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,+BAA+B,CAAU,CAAC;AAE/E,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,yBAAyB,CAAU,CAAC;AAE7E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB,EAAE,GAAG;IACtB,aAAa,EAAE,GAAG;IAClB,gBAAgB,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,GAAG;CACb,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,SAAS,EAAE,CAAC,EAAW,CAAC;AAEtE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,WAAW;IACX,OAAO;IACP,SAAS;CACD,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;CACA,CAAC"}

package/dist/config/harness.d.ts

@@ -0,0 +1,40 @@
+export interface HarnessKeyResult {
+    /** Providers whose keys were injected into the env. */
+    injected: string[];
+    /** One human-readable line worth showing, when there is something to say. */
+    note?: string;
+}
+export interface HarnessKeyOptions {
+    cwd?: string;
+    /** Injectable for tests; defaults to process.env and is MUTATED on inject. */
+    env?: Record<string, string | undefined>;
+    credentialsPath?: string;
+    fetchImpl?: typeof fetch;
+    /**
+     * A credential already in hand — the run-bound one `rcl review --attest`
+     * minted (RCL-40). Used instead of the stored login, and the attestation
+     * stands in for the repository's `.harness-cli/config.json`.
+     */
+    credential?: {
+        url: string;
+        token: string;
+    };
+}
+/** Walk up from `startDir` looking for `.harness-cli/config.json`. */
+export declare function findHarnessRepoConfig(startDir: string): string | null;
+/**
+ * The credential `harness login` stores. The format is frozen on the
+ * harness-cli side (exactly {url, token}) — see its core/credentials.ts.
+ */
+export declare function defaultCredentialsPath(env: Record<string, string | undefined>): string;
+export declare function readStoredCredentials(path: string): Promise<{
+    url: string;
+    token: string;
+} | null>;
+export declare function missingProviders(env: Record<string, string | undefined>): string[];
+/**
+ * The one entry point: called before config loading (default-model
+ * degradation for a missing OPENROUTER_API_KEY happens there, so the key
+ * must exist earlier). No-op unless keys are missing AND the repo opted in.
+ */
+export declare function applyHarnessModelKeys(options?: HarnessKeyOptions): Promise<HarnessKeyResult>;

package/dist/config/harness.js

@@ -0,0 +1,151 @@
+import { accessSync } from 'fs';
+import { readFile } from 'fs/promises';
+import { homedir } from 'os';
+import { dirname, isAbsolute, join, parse } from 'path';
+/**
+ * Key distribution via Harness. When the repo under review carries a
+ * committed `.harness-cli/config.json` (the "this repo belongs to the org"
+ * signal, discovered git-style by walking up from the working directory)
+ * and the user has run `harness login`, provider API keys missing from the
+ * environment are fetched from the Harness backend
+ * (GET /api/v1/model-keys) and injected into the process environment.
+ *
+ * Rules this module must never break:
+ * - The environment always wins: only keys absent from the env are injected.
+ * - The stored {url, token} credential pair is indivisible: the token is
+ *   only ever sent to the host that minted it — NEVER to a URL named by the
+ *   repo's own config, which is attacker-controlled input in a cloned repo.
+ * - Every failure degrades silently to today's behavior (missing keys warn
+ *   or fail exactly as before); the fetch runs under a short timeout so an
+ *   offline machine never hangs a review.
+ * - Keys land in the (injected) env only — never on disk, never in logs.
+ */
+/** Provider names the backend may serve, mapped to the env var rcl reads. */
+const PROVIDER_ENV_VARS = {
+    anthropic: 'ANTHROPIC_API_KEY',
+    openai: 'OPENAI_API_KEY',
+    google: 'GEMINI_API_KEY',
+    openrouter: 'OPENROUTER_API_KEY',
+};
+/** Long enough for a healthy backend, short enough to never stall a review. */
+const FETCH_TIMEOUT_MS = 3_000;
+/** Walk up from `startDir` looking for `.harness-cli/config.json`. */
+export function findHarnessRepoConfig(startDir) {
+    let dir = startDir;
+    const { root } = parse(startDir);
+    for (;;) {
+        const candidate = join(dir, '.harness-cli', 'config.json');
+        try {
+            // Presence is the signal; the file's contents (team, url) are not
+            // trusted for anything here.
+            accessSync(candidate);
+            return candidate;
+        }
+        catch {
+            // keep walking
+        }
+        if (dir === root)
+            return null;
+        dir = dirname(dir);
+    }
+}
+/**
+ * The credential `harness login` stores. The format is frozen on the
+ * harness-cli side (exactly {url, token}) — see its core/credentials.ts.
+ */
+export function defaultCredentialsPath(env) {
+    const xdg = env['XDG_CONFIG_HOME'];
+    const base = xdg !== undefined && xdg !== '' && isAbsolute(xdg) ? xdg : join(homedir(), '.config');
+    return join(base, 'harness', 'credentials.json');
+}
+export async function readStoredCredentials(path) {
+    try {
+        const parsed = JSON.parse(await readFile(path, 'utf-8'));
+        if (typeof parsed === 'object' && parsed !== null) {
+            const { url, token } = parsed;
+            if (typeof url === 'string' && typeof token === 'string' && url !== '' && token !== '') {
+                return { url: url.replace(/\/+$/, ''), token };
+            }
+        }
+    }
+    catch {
+        // Missing or malformed reads as "not logged in".
+    }
+    return null;
+}
+async function fetchModelKeys(baseUrl, token, fetchImpl) {
+    try {
+        const response = await fetchImpl(`${baseUrl}/api/v1/model-keys`, {
+            headers: { authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return null;
+        const body = await response.json();
+        const keys = body?.data?.keys;
+        if (typeof keys !== 'object' || keys === null)
+            return null;
+        const out = {};
+        for (const [provider, key] of Object.entries(keys)) {
+            if (typeof key === 'string' && key !== '')
+                out[provider] = key;
+        }
+        return out;
+    }
+    catch {
+        // Timeout, offline, older backend without the endpoint — all read as
+        // "no keys from Harness".
+        return null;
+    }
+}
+export function missingProviders(env) {
+    const isSet = (name) => (env[name] ?? '').trim() !== '';
+    return Object.entries(PROVIDER_ENV_VARS)
+        .filter(([provider, envVar]) => {
+        // The Google adapter reads either variable; respect both.
+        if (provider === 'google' && isSet('GOOGLE_API_KEY'))
+            return false;
+        return !isSet(envVar);
+    })
+        .map(([provider]) => provider);
+}
+/**
+ * The one entry point: called before config loading (default-model
+ * degradation for a missing OPENROUTER_API_KEY happens there, so the key
+ * must exist earlier). No-op unless keys are missing AND the repo opted in.
+ */
+export async function applyHarnessModelKeys(options = {}) {
+    const env = options.env ?? process.env;
+    if ((env['RCL_NO_HARNESS_KEYS'] ?? '') !== '')
+        return { injected: [] };
+    const missing = missingProviders(env);
+    if (missing.length === 0)
+        return { injected: [] };
+    if (options.credential === undefined && findHarnessRepoConfig(options.cwd ?? process.cwd()) === null)
+        return { injected: [] };
+    const credentials = options.credential ??
+        (await readStoredCredentials(options.credentialsPath ?? defaultCredentialsPath(env)));
+    if (credentials === null) {
+        return {
+            injected: [],
+            note: `Missing ${missing.map((p) => PROVIDER_ENV_VARS[p]).join(', ')} — this repo is Harness-managed; run \`harness login\` and rcl will fetch the keys for you.`,
+        };
+    }
+    const keys = await fetchModelKeys(credentials.url, credentials.token, options.fetchImpl ?? fetch);
+    if (keys === null) {
+        return { injected: [], note: `Could not fetch model keys from ${credentials.url} — continuing with the environment as-is.` };
+    }
+    const injected = [];
+    for (const provider of missing) {
+        const key = keys[provider];
+        if (key !== undefined) {
+            env[PROVIDER_ENV_VARS[provider]] = key;
+            injected.push(provider);
+        }
+    }
+    return {
+        injected,
+        note: injected.length > 0 ? `Using ${injected.join(', ')} key(s) from Harness (${credentials.url}).` : undefined,
+    };
+}
+//# sourceMappingURL=harness.js.map

package/dist/config/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../src/config/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAExD;;;;;;;;;;;;;;;;;GAiBG;AAEH,6EAA6E;AAC7E,MAAM,iBAAiB,GAA2B;IAChD,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,UAAU,EAAE,oBAAoB;CACjC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAuB/B,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,kEAAkE;YAClE,6BAA6B;YAC7B,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAuC;IAC5E,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACnG,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAiC,CAAC;YACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACvF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,KAAa,EACb,SAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,oBAAoB,EAAE;YAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAI,IAAsC,EAAE,IAAI,EAAE,IAAI,CAAC;QACjE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;gBAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC;QACjE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,0BAA0B;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAuC;IACtE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAChE,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE;QAC7B,0DAA0D;QAC1D,IAAI,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAA6B,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEvE,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAElD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,qBAAqB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAE9H,MAAM,WAAW,GACf,OAAO,CAAC,UAAU;QAClB,CAAC,MAAM,qBAAqB,CAAC,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,WAAW,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6FAA6F;SAClK,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IAClG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,mCAAmC,WAAW,CAAC,GAAG,2CAA2C,EAAE,CAAC;IAC/H,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAE,CAAC,GAAG,GAAG,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;KACjH,CAAC;AACJ,CAAC"}

package/dist/config/loader.d.ts

@@ -0,0 +1,13 @@
+import { type Config } from './schema.js';
+/**
+ * A config file was found but could not be used. Never silently recover
+ * from this: falling back to defaults would send code to cloud providers
+ * the user may have explicitly configured away from.
+ */
+export declare class ConfigError extends Error {
+    constructor(message: string);
+}
+export declare const SEARCH_PLACES: string[];
+export declare function loadConfig(configPath?: string, searchFrom?: string, options?: {
+    preserveDefaultRoster?: boolean;
+}): Promise<Config>;

package/dist/config/loader.js

@@ -0,0 +1,131 @@
+import { cosmiconfig } from 'cosmiconfig';
+import { ConfigSchema } from './schema.js';
+import { DEFAULT_MODELS, DEFAULT_SECONDARY_MODELS, DEFAULT_ASYNC_MODELS, DEFAULT_THRESHOLDS, DEFAULT_TIMEOUT_MS, DEFAULT_ASYNC_TIMEOUT_MS, DEFAULT_QUORUM_FRACTION, DEFAULT_MAX_RETRIES, DEFAULT_CONCURRENCY, DEFAULT_REASONING_EFFORT, } from './defaults.js';
+/**
+ * A config file was found but could not be used. Never silently recover
+ * from this: falling back to defaults would send code to cloud providers
+ * the user may have explicitly configured away from.
+ */
+export class ConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ConfigError';
+    }
+}
+// Declarative formats only. Executable config (.js/.cjs) is deliberately
+// unsupported for discovery: rcl is routinely run inside untrusted
+// checkouts, and search-loading attacker-controlled JS would execute it
+// with the user's API keys in env.
+export const SEARCH_PLACES = [
+    '.review-council.yml',
+    '.review-council.yaml',
+    '.review-council.json',
+];
+export async function loadConfig(configPath, searchFrom, options = {}) {
+    const cwd = searchFrom ?? process.cwd();
+    const explorer = cosmiconfig('review-council', {
+        searchPlaces: SEARCH_PLACES,
+        // 'none' searches only the starting directory — no parent-directory walk
+        // and no global (~/.config) dir, which would otherwise be probed with
+        // cosmiconfig's default executable-config loaders. (stopDir is rejected
+        // alongside a non-'global' strategy, and is unnecessary here.)
+        searchStrategy: 'none',
+    });
+    let result;
+    try {
+        result = configPath
+            ? await explorer.load(configPath)
+            : await explorer.search(cwd);
+    }
+    catch (err) {
+        const source = configPath ?? 'discovered config';
+        throw new ConfigError(`Failed to load config from ${source}: ${String(err)}`);
+    }
+    if (!result || result.isEmpty) {
+        return buildDefaultConfig(options.preserveDefaultRoster);
+    }
+    const parsed = ConfigSchema.safeParse(result.config);
+    if (!parsed.success) {
+        const issues = parsed.error.issues
+            .map((issue) => `  ${issue.path.join('.') || '(root)'}: ${issue.message}`)
+            .join('\n');
+        throw new ConfigError(`Invalid config at ${result.filepath}:\n${issues}`);
+    }
+    return mergeWithDefaults(parsed.data, options.preserveDefaultRoster);
+}
+/**
+ * The default fleet includes openrouter/ models. When OPENROUTER_API_KEY is
+ * absent those voters would fail on every run (the runner refuses to fall
+ * back to OPENAI_API_KEY), silently breaking upgrades from pre-OpenRouter
+ * versions whose users only hold the big-three keys. Defaults therefore
+ * degrade gracefully: openrouter/ entries are dropped with a warning.
+ * Models the user configured explicitly are never filtered — those still
+ * fail loudly per review.
+ */
+function dropOpenRouterDefaultsWithoutKey(models, listName, preserveDefaultRoster = false) {
+    if (preserveDefaultRoster || process.env['OPENROUTER_API_KEY']?.trim())
+        return [...models];
+    const kept = models.filter((m) => !m.startsWith('openrouter/'));
+    const dropped = models.length - kept.length;
+    if (dropped > 0) {
+        // Name the resulting fleet, not just the count: the default secondary
+        // list is entirely openrouter/, so without the key it degrades to
+        // empty and every specialist role falls back to the primary models.
+        const remaining = kept.length > 0 ? kept.join(', ') : '(none)';
+        console.warn(`OPENROUTER_API_KEY is not set — dropping ${dropped} openrouter/ model(s) from the default ${listName}; remaining: ${remaining}. Set the key to run the full default fleet.`);
+    }
+    return kept;
+}
+function buildDefaultConfig(preserveDefaultRoster = false) {
+    return {
+        models: dropOpenRouterDefaultsWithoutKey(DEFAULT_MODELS, 'models', preserveDefaultRoster),
+        secondaryModels: dropOpenRouterDefaultsWithoutKey(DEFAULT_SECONDARY_MODELS, 'secondary models', preserveDefaultRoster),
+        asyncModels: dropOpenRouterDefaultsWithoutKey(DEFAULT_ASYNC_MODELS, 'async models', preserveDefaultRoster),
+        thresholds: { ...DEFAULT_THRESHOLDS },
+        timeout: DEFAULT_TIMEOUT_MS,
+        asyncTimeout: DEFAULT_ASYNC_TIMEOUT_MS,
+        quorumFraction: DEFAULT_QUORUM_FRACTION,
+        maxRetries: DEFAULT_MAX_RETRIES,
+        concurrency: DEFAULT_CONCURRENCY,
+        reasoningEffort: DEFAULT_REASONING_EFFORT,
+    };
+}
+function mergeWithDefaults(config, preserveDefaultRoster = false) {
+    return {
+        models: config.models ?? dropOpenRouterDefaultsWithoutKey(DEFAULT_MODELS, 'models', preserveDefaultRoster),
+        secondaryModels: config.secondaryModels ??
+            (config.models
+                ? []
+                : dropOpenRouterDefaultsWithoutKey(DEFAULT_SECONDARY_MODELS, 'secondary models', preserveDefaultRoster)),
+        // Same containment rule as secondaryModels: an explicit `models` list
+        // means "send code to exactly these providers" — default async reviewers
+        // must not leak the diff to a provider the user configured away from.
+        asyncModels: config.asyncModels ??
+            (config.models
+                ? []
+                : dropOpenRouterDefaultsWithoutKey(DEFAULT_ASYNC_MODELS, 'async models', preserveDefaultRoster)),
+        roles: config.roles,
+        reviewers: config.reviewers,
+        customRoles: config.customRoles,
+        thresholds: {
+            ...DEFAULT_THRESHOLDS,
+            ...config.thresholds,
+        },
+        // Resolved (and validated) at use by resolveGatingConfig.
+        gating: config.gating,
+        output: config.output,
+        timeout: config.timeout ?? DEFAULT_TIMEOUT_MS,
+        asyncTimeout: config.asyncTimeout ?? DEFAULT_ASYNC_TIMEOUT_MS,
+        quorumFraction: config.quorumFraction ?? DEFAULT_QUORUM_FRACTION,
+        maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
+        concurrency: config.concurrency ?? DEFAULT_CONCURRENCY,
+        providerConcurrency: config.providerConcurrency ? { ...config.providerConcurrency } : undefined,
+        reasoningEffort: config.reasoningEffort ?? DEFAULT_REASONING_EFFORT,
+        githubToken: config.githubToken ?? process.env['GITHUB_TOKEN'],
+        context: config.context,
+        spec: config.spec,
+        focus: config.focus,
+        harness: config.harness,
+    };
+}
+//# sourceMappingURL=loader.js.map

package/dist/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,mCAAmC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;CACvB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAmB,EAAE,UAAmB,EAAE,UAA+C,EAAE;IAC1H,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,gBAAgB,EAAE;QAC7C,YAAY,EAAE,aAAa;QAC3B,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,cAAc,EAAE,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU;YACjB,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,UAAU,IAAI,mBAAmB,CAAC;QACjD,MAAM,IAAI,WAAW,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,kBAAkB,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aACzE,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,qBAAqB,MAAM,CAAC,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gCAAgC,CACvC,MAAyB,EACzB,QAAgB,EAChB,qBAAqB,GAAG,KAAK;IAE7B,IAAI,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,sEAAsE;QACtE,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/D,OAAO,CAAC,IAAI,CACV,4CAA4C,OAAO,0CAA0C,QAAQ,gBAAgB,SAAS,8CAA8C,CAC7K,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,qBAAqB,GAAG,KAAK;IACvD,OAAO;QACL,MAAM,EAAE,gCAAgC,CAAC,cAAc,EAAE,QAAQ,EAAE,qBAAqB,CAAC;QACzF,eAAe,EAAE,gCAAgC,CAAC,wBAAwB,EAAE,kBAAkB,EAAE,qBAAqB,CAAC;QACtH,WAAW,EAAE,gCAAgC,CAAC,oBAAoB,EAAE,cAAc,EAAE,qBAAqB,CAAC;QAC1G,UAAU,EAAE,EAAE,GAAG,kBAAkB,EAAE;QACrC,OAAO,EAAE,kBAAkB;QAC3B,YAAY,EAAE,wBAAwB;QACtC,cAAc,EAAE,uBAAuB;QACvC,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,mBAAmB;QAChC,eAAe,EAAE,wBAAwB;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,qBAAqB,GAAG,KAAK;IACtE,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,gCAAgC,CAAC,cAAc,EAAE,QAAQ,EAAE,qBAAqB,CAAC;QAC1G,eAAe,EACb,MAAM,CAAC,eAAe;YACtB,CAAC,MAAM,CAAC,MAAM;gBACZ,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gCAAgC,CAAC,wBAAwB,EAAE,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QAC5G,sEAAsE;QACtE,yEAAyE;QACzE,sEAAsE;QACtE,WAAW,EACT,MAAM,CAAC,WAAW;YAClB,CAAC,MAAM,CAAC,MAAM;gBACZ,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gCAAgC,CAAC,oBAAoB,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAC;QACpG,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE;YACV,GAAG,kBAAkB;YACrB,GAAG,MAAM,CAAC,UAAU;SACrB;QACD,0DAA0D;QAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,kBAAkB;QAC7C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,wBAAwB;QAC7D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,uBAAuB;QAChE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,mBAAmB;QACpD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,mBAAmB;QACtD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/F,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,wBAAwB;QACnE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC"}

package/dist/config/provider-concurrency.d.ts

@@ -0,0 +1,4 @@
+import type { Config } from './schema.js';
+export type ProviderConcurrency = NonNullable<Config['providerConcurrency']>;
+/** Version-owned defaults plus source-bound project overrides. */
+export declare function resolveProviderConcurrency(configured?: Readonly<ProviderConcurrency>): ProviderConcurrency;

package/dist/config/provider-concurrency.js

@@ -0,0 +1,6 @@
+import { DEFAULT_PROVIDER_CONCURRENCY } from './defaults.js';
+/** Version-owned defaults plus source-bound project overrides. */
+export function resolveProviderConcurrency(configured) {
+    return { ...DEFAULT_PROVIDER_CONCURRENCY, ...configured };
+}
+//# sourceMappingURL=provider-concurrency.js.map

package/dist/config/provider-concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-concurrency.js","sourceRoot":"","sources":["../../src/config/provider-concurrency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAK7D,kEAAkE;AAClE,MAAM,UAAU,0BAA0B,CACxC,UAA0C;IAE1C,OAAO,EAAE,GAAG,4BAA4B,EAAE,GAAG,UAAU,EAAE,CAAC;AAC5D,CAAC"}

package/dist/config/providers.d.ts

@@ -0,0 +1,3 @@
+export declare const MODEL_PROVIDERS: readonly ["anthropic", "openai", "google", "openrouter", "openai-compat"];
+export type ModelProvider = (typeof MODEL_PROVIDERS)[number];
+export declare const MODEL_PROVIDER_SET: ReadonlySet<string>;