npm - @caupulican/pi-adaptative - Versions diffs - 0.85.8 → 0.86.1 - Mend

@caupulican/pi-adaptative 0.85.8 → 0.86.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (232) hide show

package/dist/core/orchestration/worker-execution-contract.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"worker-execution-contract.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/worker-execution-contract.ts"],"names":[],"mappings":"~~AAGA~~,OAAO,~~EAeN~~,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAEpB,KAAK,gCAAgC,EACrC,KAAK,uBAAuB,EAE5B,MAAM,gBAAgB,CAAC;AAIxB,qBAAa,4BAA6B,SAAQ,KAAK;IACtD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACD;~~AAwMD~~,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CA2BpF;AAwBD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IACnD,MAAM,EAAE;QACP,OAAO,EAAE,oBAAoB,CAAC;QAC9B,YAAY,EAAE,yBAAyB,CAAC;QACxC,SAAS,EAAE,gCAAgC,CAAC;QAC5C,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,QAAQ,CAAC,EAAE;QACV,OAAO,EAAE,oBAAoB,CAAC;QAC9B,YAAY,EAAE,yBAAyB,CAAC;QACxC,SAAS,EAAE,gCAAgC,CAAC;QAC5C,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACF,GAAG,uBAAuB,CAM1B;AAED,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,uBAAuB,GAC/B,uBAAuB,GAAG,SAAS,CAIrC"}
1	+ {"version":3,"file":"worker-execution-contract.d.ts","sourceRoot":"","sources":["../../../src/core/orchestration/worker-execution-contract.ts"],"names":[],"mappings":"AAIA,OAAO,EAaN,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EAEpB,KAAK,gCAAgC,EACrC,KAAK,uBAAuB,EAE5B,MAAM,gBAAgB,CAAC;AAIxB,qBAAa,4BAA6B,SAAQ,KAAK;IACtD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACD;AAkMD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CA2BpF;AAwBD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IACnD,MAAM,EAAE;QACP,OAAO,EAAE,oBAAoB,CAAC;QAC9B,YAAY,EAAE,yBAAyB,CAAC;QACxC,SAAS,EAAE,gCAAgC,CAAC;QAC5C,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,QAAQ,CAAC,EAAE;QACV,OAAO,EAAE,oBAAoB,CAAC;QAC9B,YAAY,EAAE,yBAAyB,CAAC;QACxC,SAAS,EAAE,gCAAgC,CAAC;QAC5C,gBAAgB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACF,GAAG,uBAAuB,CAM1B;AAED,wBAAgB,+BAA+B,CAC9C,QAAQ,EAAE,uBAAuB,GAC/B,uBAAuB,GAAG,SAAS,CAIrC"}

package/dist/core/orchestration/worker-execution-contract.js CHANGED Viewed

@@ -1,7 +1,8 @@
 import path from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { hasOnlyKeys, isPlainRecord } from "../util/value-guards.js";
-import { isHarnessCapability, isResourcePointerKind, MAX_ORCHESTRATION_COLLECTION_LENGTH, MAX_ORCHESTRATION_IDENTIFIER_LENGTH, MAX_ORCHESTRATION_MODEL_ID_LENGTH, MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH, MAX_WORKER_AUTHORITY_PATH_LENGTH, MAX_WORKER_AUTHORITY_PATHS, MAX_WORKER_RESOURCE_METADATA_NAME_LENGTH, MAX_WORKER_RESOURCE_PATH_LENGTH, MAX_WORKER_RESOURCE_POINTERS, MAX_WORKER_SOUL_LENGTH, ORCHESTRATION_SCHEMA_VERSION, ORCHESTRATION_THINKING_LEVELS, } from "./contracts.js";
+import { parseBoundedStringArray } from "./bounded-string-array.js";
+import { isHarnessCapability, isResourcePointerKind, MAX_ORCHESTRATION_MODEL_ID_LENGTH, MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH, MAX_WORKER_AUTHORITY_PATH_LENGTH, MAX_WORKER_AUTHORITY_PATHS, MAX_WORKER_RESOURCE_METADATA_NAME_LENGTH, MAX_WORKER_RESOURCE_PATH_LENGTH, MAX_WORKER_RESOURCE_POINTERS, MAX_WORKER_SOUL_LENGTH, ORCHESTRATION_SCHEMA_VERSION, ORCHESTRATION_THINKING_LEVELS, } from "./contracts.js";
 import { OrchestrationProfileError, parseOrchestrationProfile } from "./profile-registry.js";
 import { intersectRiskBudgets, parseRiskBudget } from "./risk-budget.js";
 export class WorkerExecutionContractError extends Error {
@@ -30,17 +31,12 @@ function parseModelBinding(value, label) {
     };
 }
 function stringArray(value, label, options = {}) {
-    const maxEntries = options.maxEntries ?? MAX_ORCHESTRATION_COLLECTION_LENGTH;
-    const maxLength = options.maxLength ?? MAX_ORCHESTRATION_IDENTIFIER_LENGTH;
-    if (!Array.isArray(value) ||
-        value.length > maxEntries ||
-        !value.every((entry) => typeof entry === "string" && entry.length > 0 && entry.length <= maxLength)) {
-        throw new WorkerExecutionContractError(`${label} must be an array of non-empty strings.`);
-    }
-    if (new Set(value).size !== value.length) {
-        throw new WorkerExecutionContractError(`${label} contains duplicates.`);
-    }
-    return [...value];
+    return parseBoundedStringArray(value, {
+        ...options,
+        invalidMessage: `${label} must be an array of non-empty strings.`,
+        duplicateMessage: `${label} contains duplicates.`,
+        createError: (message) => new WorkerExecutionContractError(message),
+    });
 }
 function parseResourcePointers(value, label) {
     if (!Array.isArray(value) || value.length > MAX_WORKER_RESOURCE_POINTERS) {
@@ -96,11 +92,11 @@ function parseAuthority(value, profile, label) {
     if (!capabilities.every(isHarnessCapability)) {
         throw new WorkerExecutionContractError(`${label} authority contains an unknown capability.`);
     }
-    if (capabilities.some((capability) => !profile.capabilityCeiling.includes(capability))) {
+    if (capabilities.some((capability) => capability !== "workflow.delegate" && !profile.capabilityCeiling.includes(capability))) {
         throw new WorkerExecutionContractError(`${label} authority exceeds its profile capability ceiling.`);
     }
     const toolNames = stringArray(value.toolNames, `${label} authority toolNames`);
-    if (toolNames.some((toolName) => !profile.toolNames.includes(toolName))) {
+    if (toolNames.some((toolName) => toolName !== "delegate" && !profile.toolNames.includes(toolName))) {
         throw new WorkerExecutionContractError(`${label} authority contains a tool outside its profile.`);
     }
     const pathArrayOptions = {
@@ -153,9 +149,6 @@ function parseProfileContract(value, label) {
     catch (error) {
         throw new WorkerExecutionContractError(error instanceof OrchestrationProfileError ? error.message : `${label} profile is invalid.`);
     }
-    if (profile.role === "orchestrator") {
-        throw new WorkerExecutionContractError(`${label} cannot materialize an orchestrator profile.`);
-    }
     const modelBinding = parseModelBinding(value.modelBinding, label);
     if (!profile.modelPolicy.candidates.some((candidate) => isDeepStrictEqual(candidate, modelBinding))) {
         throw new WorkerExecutionContractError(`${label} model binding is not declared by its profile.`);

package/dist/core/orchestration/worker-execution-contract.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"worker-execution-contract.js","sourceRoot":"","sources":["../../../src/core/orchestration/worker-execution-contract.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EACN,mBAAmB,EACnB,qBAAqB,EACrB,mCAAmC,EACnC,mCAAmC,EACnC,iCAAiC,EACjC,uCAAuC,EACvC,gCAAgC,EAChC,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,6BAA6B,GAQ7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEzE,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACtD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC5C,CAAC;CACD;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACvD,IACC,CAAC,aAAa,CAAC,KAAK,CAAC;QACrB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,uCAAuC;QAC/D,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;QACtB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,iCAAiC;QACxD,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QACrB,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,CAAC,6BAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,aAA+D,CAAC,EAC7G,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,KAAK,CAAC,aAA+D;KACpF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CACnB,KAAc,EACd,KAAa,EACb,OAAO,GAAgD,EAAE;IAEzD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mCAAmC,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mCAAmC,CAAC;IAC3E,IACC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,MAAM,GAAG,UAAU;QACzB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,EAClG,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;QAC1E,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC9B,IACC,CAAC,aAAa,CAAC,SAAS,CAAC;YACzB,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;YAChC,CAAC,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC;YACtC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC;YAC3D,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC;YAC9C,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;YACjC,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAC1B,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,+BAA+B,GAAG,EAAE;YAC3D,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAClC,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC3B,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS;gBAC9B,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACrF,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAChC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;oBAClC,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;oBAC3C,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;oBACpC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,wCAAwC;oBACzE,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAC7C,CAAC;YACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;QAC1F,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO;YACN,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;gBACnF,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACtB,KAAc,EACd,OAA6B,EAC7B,KAAa;IAEb,IACC,CAAC,aAAa,CAAC,KAAK,CAAC;QACrB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,EACrG,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACxF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,4CAA4C,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAC/E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,iDAAiD,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,gBAAgB,GAAG;QACxB,UAAU,EAAE,0BAA0B;QACtC,SAAS,EAAE,gCAAgC;KAC3C,CAAC;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,sBAAsB,EAAE,gBAAgB,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,KAAK,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;IACvG,IACC,CAAC,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CACnE,EACA,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,4BAA4B,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CACpC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,iBAAiB,IAAI,UAAU,KAAK,eAAe,CAClF,CAAC;IACF,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CACrC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,kBAAkB,IAAI,UAAU,KAAK,iBAAiB,CACrF,CAAC;IACF,IAAI,WAAW,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,YAAY,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;IACjG,CAAC;IACD,OAAO;QACN,YAAY,EAAE,YAAgE;QAC9E,SAAS;QACT,SAAS;QACT,UAAU;QACV,WAAW;QACX,MAAM;KACN,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa;IAC1D,IACC,CAAC,aAAa,CAAC,KAAK,CAAC;QACrB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC1G,KAAK,CAAC,aAAa,KAAK,4BAA4B,EACnD,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAA6B,CAAC;IAClC,IAAI,CAAC;QACJ,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,4BAA4B,CACrC,KAAK,YAAY,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,sBAAsB,CAC3F,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACrC,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;IAClG,CAAC;IACD,IACC,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,sBAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EACnG,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACpF,OAAO;QACN,aAAa,EAAE,4BAA4B;QAC3C,OAAO;QACP,YAAY;QACZ,SAAS;QACT,gBAAgB;QAChB,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,IACC,CAAC,aAAa,CAAC,KAAK,CAAC;QACrB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5D,KAAK,CAAC,aAAa,KAAK,4BAA4B,EACnD,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,uCAAuC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ;QAC9B,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,oCAAoC,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAC;IACb,IAAI,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,KAAK,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACtF,MAAM,IAAI,4BAA4B,CAAC,iEAAiE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,4BAA4B,CAAC,qEAAqE,CAAC,CAAC;QAC/G,CAAC;IACF,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,4BAA4B,CAAC,uDAAuD,CAAC,CAAC;IACjG,CAAC;IACD,OAAO;QACN,aAAa,EAAE,4BAA4B;QAC3C,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAA6B;IACrD,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC;IAC1D,OAAO,eAAe,CAAC,SAAS,CAAyB,CAAC;AAC3D,CAAC;AAED,SAAS,uBAAuB,CAAC,MAMhC;IACA,OAAO;QACN,aAAa,EAAE,4BAA4B;QAC3C,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC;QACxC,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC;QAClD,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;QAC5C,gBAAgB,EAAE,eAAe,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAe7C;IACA,OAAO,4BAA4B,CAAC;QACnC,aAAa,EAAE,4BAA4B;QAC3C,MAAM,EAAE,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,QAAQ;QACvB,CAAC,CAAC,4BAA4B,CAAC,EAAE,aAAa,EAAE,4BAA4B,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1G,CAAC,CAAC,SAAS,CAAC;AACd,CAAC","sourcesContent":["import path from \"node:path\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport { hasOnlyKeys, isPlainRecord } from \"../util/value-guards.ts\";\nimport {\n\tisHarnessCapability,\n\tisResourcePointerKind,\n\tMAX_ORCHESTRATION_COLLECTION_LENGTH,\n\tMAX_ORCHESTRATION_IDENTIFIER_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_ID_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH,\n\tMAX_WORKER_AUTHORITY_PATH_LENGTH,\n\tMAX_WORKER_AUTHORITY_PATHS,\n\tMAX_WORKER_RESOURCE_METADATA_NAME_LENGTH,\n\tMAX_WORKER_RESOURCE_PATH_LENGTH,\n\tMAX_WORKER_RESOURCE_POINTERS,\n\tMAX_WORKER_SOUL_LENGTH,\n\tORCHESTRATION_SCHEMA_VERSION,\n\tORCHESTRATION_THINKING_LEVELS,\n\ttype OrchestrationModelBinding,\n\ttype OrchestrationProfile,\n\ttype ResourcePointer,\n\ttype RiskBudget,\n\ttype WorkerExecutionAuthorityContract,\n\ttype WorkerExecutionContract,\n\ttype WorkerProfileExecutionContract,\n} from \"./contracts.ts\";\nimport { OrchestrationProfileError, parseOrchestrationProfile } from \"./profile-registry.ts\";\nimport { intersectRiskBudgets, parseRiskBudget } from \"./risk-budget.ts\";\n\nexport class WorkerExecutionContractError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"WorkerExecutionContractError\";\n\t}\n}\n\nfunction parseModelBinding(value: unknown, label: string): OrchestrationModelBinding {\n\tif (\n\t\t!isPlainRecord(value) \|\|\n\t\t!hasOnlyKeys(value, [\"provider\", \"modelId\", \"thinkingLevel\"]) \|\|\n\t\ttypeof value.provider !== \"string\" \|\|\n\t\tvalue.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH \|\|\n\t\t!value.provider.trim() \|\|\n\t\ttypeof value.modelId !== \"string\" \|\|\n\t\tvalue.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH \|\|\n\t\t!value.modelId.trim() \|\|\n\t\ttypeof value.thinkingLevel !== \"string\" \|\|\n\t\t!ORCHESTRATION_THINKING_LEVELS.includes(value.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number])\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} model binding is invalid.`);\n\t}\n\treturn {\n\t\tprovider: value.provider,\n\t\tmodelId: value.modelId,\n\t\tthinkingLevel: value.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t};\n}\n\nfunction stringArray(\n\tvalue: unknown,\n\tlabel: string,\n\toptions: { maxEntries?: number; maxLength?: number } = {},\n): string[] {\n\tconst maxEntries = options.maxEntries ?? MAX_ORCHESTRATION_COLLECTION_LENGTH;\n\tconst maxLength = options.maxLength ?? MAX_ORCHESTRATION_IDENTIFIER_LENGTH;\n\tif (\n\t\t!Array.isArray(value) \|\|\n\t\tvalue.length > maxEntries \|\|\n\t\t!value.every((entry) => typeof entry === \"string\" && entry.length > 0 && entry.length <= maxLength)\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} must be an array of non-empty strings.`);\n\t}\n\tif (new Set(value).size !== value.length) {\n\t\tthrow new WorkerExecutionContractError(`${label} contains duplicates.`);\n\t}\n\treturn [...value];\n}\n\nfunction parseResourcePointers(value: unknown, label: string): ResourcePointer[] {\n\tif (!Array.isArray(value) \|\| value.length > MAX_WORKER_RESOURCE_POINTERS) {\n\t\tthrow new WorkerExecutionContractError(`${label} resource pointers are invalid.`);\n\t}\n\tconst ids = new Set<string>();\n\treturn value.map((candidate) => {\n\t\tif (\n\t\t\t!isPlainRecord(candidate) \|\|\n\t\t\t!hasOnlyKeys(candidate, [\"id\", \"kind\", \"uri\", \"readOnly\", \"digest\", \"metadata\"]) \|\|\n\t\t\ttypeof candidate.id !== \"string\" \|\|\n\t\t\t!/^(skill\|prompt):[a-f0-9]{64}$/i.test(candidate.id) \|\|\n\t\t\ttypeof candidate.kind !== \"string\" \|\|\n\t\t\t!isResourcePointerKind(candidate.kind) \|\|\n\t\t\t(candidate.kind !== \"skill\" && candidate.kind !== \"prompt\") \|\|\n\t\t\t!candidate.id.startsWith(`${candidate.kind}:`) \|\|\n\t\t\ttypeof candidate.uri !== \"string\" \|\|\n\t\t\tcandidate.uri.length === 0 \|\|\n\t\t\tcandidate.uri.length > MAX_WORKER_RESOURCE_PATH_LENGTH + 16 \|\|\n\t\t\t!candidate.uri.startsWith(\"file:\") \|\|\n\t\t\tcandidate.readOnly !== true \|\|\n\t\t\t(candidate.digest !== undefined &&\n\t\t\t\t(typeof candidate.digest !== \"string\" \|\| !/^[a-f0-9]{64}$/i.test(candidate.digest))) \|\|\n\t\t\t(candidate.metadata !== undefined &&\n\t\t\t\t(!isPlainRecord(candidate.metadata) \|\|\n\t\t\t\t\ttypeof candidate.metadata.name !== \"string\" \|\|\n\t\t\t\t\tcandidate.metadata.name.length === 0 \|\|\n\t\t\t\t\tcandidate.metadata.name.length > MAX_WORKER_RESOURCE_METADATA_NAME_LENGTH \|\|\n\t\t\t\t\t!hasOnlyKeys(candidate.metadata, [\"name\"])))\n\t\t) {\n\t\t\tthrow new WorkerExecutionContractError(`${label} resource pointer is invalid.`);\n\t\t}\n\t\tif (ids.has(candidate.id)) {\n\t\t\tthrow new WorkerExecutionContractError(`${label} resource pointers contain duplicates.`);\n\t\t}\n\t\tids.add(candidate.id);\n\t\treturn {\n\t\t\tid: candidate.id,\n\t\t\tkind: candidate.kind,\n\t\t\turi: candidate.uri,\n\t\t\treadOnly: true,\n\t\t\t...(typeof candidate.digest === \"string\" ? { digest: candidate.digest } : {}),\n\t\t\t...(isPlainRecord(candidate.metadata) && typeof candidate.metadata.name === \"string\"\n\t\t\t\t? { metadata: { name: candidate.metadata.name } }\n\t\t\t\t: {}),\n\t\t};\n\t});\n}\n\nfunction parseAuthority(\n\tvalue: unknown,\n\tprofile: OrchestrationProfile,\n\tlabel: string,\n): WorkerExecutionAuthorityContract {\n\tif (\n\t\t!isPlainRecord(value) \|\|\n\t\t!hasOnlyKeys(value, [\"capabilities\", \"toolNames\", \"readPaths\", \"writePaths\", \"deniedPaths\", \"budget\"])\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority is invalid.`);\n\t}\n\tconst capabilities = stringArray(value.capabilities, `${label} authority capabilities`);\n\tif (!capabilities.every(isHarnessCapability)) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority contains an unknown capability.`);\n\t}\n\tif (capabilities.some((capability) => !profile.capabilityCeiling.includes(capability))) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority exceeds its profile capability ceiling.`);\n\t}\n\tconst toolNames = stringArray(value.toolNames, `${label} authority toolNames`);\n\tif (toolNames.some((toolName) => !profile.toolNames.includes(toolName))) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority contains a tool outside its profile.`);\n\t}\n\tconst pathArrayOptions = {\n\t\tmaxEntries: MAX_WORKER_AUTHORITY_PATHS,\n\t\tmaxLength: MAX_WORKER_AUTHORITY_PATH_LENGTH,\n\t};\n\tconst readPaths = stringArray(value.readPaths, `${label} authority readPaths`, pathArrayOptions);\n\tconst writePaths = stringArray(value.writePaths, `${label} authority writePaths`, pathArrayOptions);\n\tconst deniedPaths = stringArray(value.deniedPaths, `${label} authority deniedPaths`, pathArrayOptions);\n\tif (\n\t\t[...readPaths, ...writePaths, ...deniedPaths].some(\n\t\t\t(entry) => !path.isAbsolute(entry) && !path.win32.isAbsolute(entry),\n\t\t)\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority paths must be absolute.`);\n\t}\n\tlet budget: RiskBudget;\n\ttry {\n\t\tbudget = parseRiskBudget(value.budget, `${label} authority budget`);\n\t} catch (error) {\n\t\tthrow new WorkerExecutionContractError(error instanceof Error ? error.message : String(error));\n\t}\n\tif (!isDeepStrictEqual(intersectRiskBudgets(profile.budget, budget), budget)) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority exceeds its profile budget.`);\n\t}\n\tconst readGranted = capabilities.some(\n\t\t(capability) => capability === \"filesystem.read\" \|\| capability === \"worktree.read\",\n\t);\n\tconst writeGranted = capabilities.some(\n\t\t(capability) => capability === \"filesystem.write\" \|\| capability === \"worktree.mutate\",\n\t);\n\tif (readGranted && readPaths.length === 0) {\n\t\tthrow new WorkerExecutionContractError(`${label} read authority lacks a positive path scope.`);\n\t}\n\tif (writeGranted && writePaths.length === 0) {\n\t\tthrow new WorkerExecutionContractError(`${label} write authority lacks a positive path scope.`);\n\t}\n\treturn {\n\t\tcapabilities: capabilities as WorkerExecutionAuthorityContract[\"capabilities\"],\n\t\ttoolNames,\n\t\treadPaths,\n\t\twritePaths,\n\t\tdeniedPaths,\n\t\tbudget,\n\t};\n}\n\nfunction parseProfileContract(value: unknown, label: string): WorkerProfileExecutionContract {\n\tif (\n\t\t!isPlainRecord(value) \|\|\n\t\t!hasOnlyKeys(value, [\"schemaVersion\", \"profile\", \"modelBinding\", \"authority\", \"resourcePointers\", \"soul\"]) \|\|\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} is invalid.`);\n\t}\n\tlet profile: OrchestrationProfile;\n\ttry {\n\t\tprofile = parseOrchestrationProfile(value.profile);\n\t} catch (error) {\n\t\tthrow new WorkerExecutionContractError(\n\t\t\terror instanceof OrchestrationProfileError ? error.message : `${label} profile is invalid.`,\n\t\t);\n\t}\n\tif (profile.role === \"orchestrator\") {\n\t\tthrow new WorkerExecutionContractError(`${label} cannot materialize an orchestrator profile.`);\n\t}\n\tconst modelBinding = parseModelBinding(value.modelBinding, label);\n\tif (!profile.modelPolicy.candidates.some((candidate) => isDeepStrictEqual(candidate, modelBinding))) {\n\t\tthrow new WorkerExecutionContractError(`${label} model binding is not declared by its profile.`);\n\t}\n\tif (\n\t\tvalue.soul !== undefined &&\n\t\t(typeof value.soul !== \"string\" \|\| value.soul.length > MAX_WORKER_SOUL_LENGTH \|\| !value.soul.trim())\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} soul is invalid.`);\n\t}\n\tconst authority = parseAuthority(value.authority, profile, label);\n\tconst resourcePointers = parseResourcePointers(value.resourcePointers ?? [], label);\n\treturn {\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofile,\n\t\tmodelBinding,\n\t\tauthority,\n\t\tresourcePointers,\n\t\t...(typeof value.soul === \"string\" ? { soul: value.soul } : {}),\n\t};\n}\n\nexport function parseWorkerExecutionContract(value: unknown): WorkerExecutionContract {\n\tif (\n\t\t!isPlainRecord(value) \|\|\n\t\t!hasOnlyKeys(value, [\"schemaVersion\", \"worker\", \"verifier\"]) \|\|\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION\n\t) {\n\t\tthrow new WorkerExecutionContractError(\"Worker execution contract is invalid.\");\n\t}\n\tconst worker = parseProfileContract(value.worker, \"Worker execution contract\");\n\tconst verifier = value.verifier\n\t\t? parseProfileContract(value.verifier, \"Worker verifier execution contract\")\n\t\t: undefined;\n\tif (worker.profile.requireIndependentVerification) {\n\t\tif (!verifier \|\| worker.profile.verificationProfileId !== verifier.profile.profileId) {\n\t\t\tthrow new WorkerExecutionContractError(\"Worker execution contract is missing its owner-pinned verifier.\");\n\t\t}\n\t\tif (verifier.profile.role !== \"verifier\") {\n\t\t\tthrow new WorkerExecutionContractError(\"Worker verifier execution contract does not use a verifier profile.\");\n\t\t}\n\t} else if (verifier) {\n\t\tthrow new WorkerExecutionContractError(\"Worker execution contract has an unexpected verifier.\");\n\t}\n\treturn {\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tworker,\n\t\t...(verifier ? { verifier } : {}),\n\t};\n}\n\nfunction snapshotProfile(profile: OrchestrationProfile): OrchestrationProfile {\n\tconst { sourcePath: _sourcePath, ...persisted } = profile;\n\treturn structuredClone(persisted) as OrchestrationProfile;\n}\n\nfunction snapshotResolvedProfile(source: {\n\tprofile: OrchestrationProfile;\n\tmodelBinding: OrchestrationModelBinding;\n\tauthority: WorkerExecutionAuthorityContract;\n\tresourcePointers?: readonly ResourcePointer[];\n\tsoul?: string;\n}): WorkerProfileExecutionContract {\n\treturn {\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofile: snapshotProfile(source.profile),\n\t\tmodelBinding: structuredClone(source.modelBinding),\n\t\tauthority: structuredClone(source.authority),\n\t\tresourcePointers: structuredClone(source.resourcePointers ?? []),\n\t\t...(source.soul ? { soul: source.soul } : {}),\n\t};\n}\n\nexport function createWorkerExecutionContract(args: {\n\tworker: {\n\t\tprofile: OrchestrationProfile;\n\t\tmodelBinding: OrchestrationModelBinding;\n\t\tauthority: WorkerExecutionAuthorityContract;\n\t\tresourcePointers?: readonly ResourcePointer[];\n\t\tsoul?: string;\n\t};\n\tverifier?: {\n\t\tprofile: OrchestrationProfile;\n\t\tmodelBinding: OrchestrationModelBinding;\n\t\tauthority: WorkerExecutionAuthorityContract;\n\t\tresourcePointers?: readonly ResourcePointer[];\n\t\tsoul?: string;\n\t};\n}): WorkerExecutionContract {\n\treturn parseWorkerExecutionContract({\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tworker: snapshotResolvedProfile(args.worker),\n\t\t...(args.verifier ? { verifier: snapshotResolvedProfile(args.verifier) } : {}),\n\t});\n}\n\nexport function verifierWorkerExecutionContract(\n\tcontract: WorkerExecutionContract,\n): WorkerExecutionContract \| undefined {\n\treturn contract.verifier\n\t\t? parseWorkerExecutionContract({ schemaVersion: ORCHESTRATION_SCHEMA_VERSION, worker: contract.verifier })\n\t\t: undefined;\n}\n"]}
1	+ {"version":3,"file":"worker-execution-contract.js","sourceRoot":"","sources":["../../../src/core/orchestration/worker-execution-contract.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACN,mBAAmB,EACnB,qBAAqB,EACrB,iCAAiC,EACjC,uCAAuC,EACvC,gCAAgC,EAChC,0BAA0B,EAC1B,wCAAwC,EACxC,+BAA+B,EAC/B,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,6BAA6B,GAQ7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEzE,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACtD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC5C,CAAC;CACD;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACvD,IACC,CAAC,aAAa,CAAC,KAAK,CAAC;QACrB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,uCAAuC;QAC/D,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;QACtB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,iCAAiC;QACxD,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QACrB,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,CAAC,6BAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,aAA+D,CAAC,EAC7G,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,KAAK,CAAC,aAA+D;KACpF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CACnB,KAAc,EACd,KAAa,EACb,OAAO,GAAgD,EAAE;IAEzD,OAAO,uBAAuB,CAAC,KAAK,EAAE;QACrC,GAAG,OAAO;QACV,cAAc,EAAE,GAAG,KAAK,yCAAyC;QACjE,gBAAgB,EAAE,GAAG,KAAK,uBAAuB;QACjD,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,4BAA4B,CAAC,OAAO,CAAC;KACnE,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;QAC1E,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC9B,IACC,CAAC,aAAa,CAAC,SAAS,CAAC;YACzB,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;YAChC,CAAC,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;YAClC,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC;YACtC,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC;YAC3D,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC;YAC9C,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;YACjC,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAC1B,SAAS,CAAC,GAAG,CAAC,MAAM,GAAG,+BAA+B,GAAG,EAAE;YAC3D,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAClC,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC3B,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS;gBAC9B,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACrF,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS;gBAChC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC;oBAClC,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;oBAC3C,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;oBACpC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,wCAAwC;oBACzE,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAC7C,CAAC;YACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;QAC1F,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO;YACN,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;gBACnF,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;gBACjD,CAAC,CAAC,EAAE,CAAC;SACN,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACtB,KAAc,EACd,OAA6B,EAC7B,KAAa;IAEb,IACC,CAAC,aAAa,CAAC,KAAK,CAAC;QACrB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,EACrG,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACxF,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,4CAA4C,CAAC,CAAC;IAC9F,CAAC;IACD,IACC,YAAY,CAAC,IAAI,CAChB,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,mBAAmB,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,CACrG,EACA,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAC/E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,iDAAiD,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,gBAAgB,GAAG;QACxB,UAAU,EAAE,0BAA0B;QACtC,SAAS,EAAE,gCAAgC;KAC3C,CAAC;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,sBAAsB,EAAE,gBAAgB,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,KAAK,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,KAAK,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;IACvG,IACC,CAAC,GAAG,SAAS,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC,IAAI,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CACnE,EACA,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,4BAA4B,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CACpC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,iBAAiB,IAAI,UAAU,KAAK,eAAe,CAClF,CAAC;IACF,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CACrC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,kBAAkB,IAAI,UAAU,KAAK,iBAAiB,CACrF,CAAC;IACF,IAAI,WAAW,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,YAAY,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;IACjG,CAAC;IACD,OAAO;QACN,YAAY,EAAE,YAAgE;QAC9E,SAAS;QACT,SAAS;QACT,UAAU;QACV,WAAW;QACX,MAAM;KACN,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa;IAC1D,IACC,CAAC,aAAa,CAAC,KAAK,CAAC;QACrB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC1G,KAAK,CAAC,aAAa,KAAK,4BAA4B,EACnD,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAA6B,CAAC;IAClC,IAAI,CAAC;QACJ,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,4BAA4B,CACrC,KAAK,YAAY,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,sBAAsB,CAC3F,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;IAClG,CAAC;IACD,IACC,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,sBAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EACnG,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACpF,OAAO;QACN,aAAa,EAAE,4BAA4B;QAC3C,OAAO;QACP,YAAY;QACZ,SAAS;QACT,gBAAgB;QAChB,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IAC1D,IACC,CAAC,aAAa,CAAC,KAAK,CAAC;QACrB,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5D,KAAK,CAAC,aAAa,KAAK,4BAA4B,EACnD,CAAC;QACF,MAAM,IAAI,4BAA4B,CAAC,uCAAuC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ;QAC9B,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,oCAAoC,CAAC;QAC5E,CAAC,CAAC,SAAS,CAAC;IACb,IAAI,MAAM,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,KAAK,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACtF,MAAM,IAAI,4BAA4B,CAAC,iEAAiE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,4BAA4B,CAAC,qEAAqE,CAAC,CAAC;QAC/G,CAAC;IACF,CAAC;SAAM,IAAI,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,4BAA4B,CAAC,uDAAuD,CAAC,CAAC;IACjG,CAAC;IACD,OAAO;QACN,aAAa,EAAE,4BAA4B;QAC3C,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjC,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAA6B;IACrD,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC;IAC1D,OAAO,eAAe,CAAC,SAAS,CAAyB,CAAC;AAC3D,CAAC;AAED,SAAS,uBAAuB,CAAC,MAMhC;IACA,OAAO;QACN,aAAa,EAAE,4BAA4B;QAC3C,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC;QACxC,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC;QAClD,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC;QAC5C,gBAAgB,EAAE,eAAe,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAe7C;IACA,OAAO,4BAA4B,CAAC;QACnC,aAAa,EAAE,4BAA4B;QAC3C,MAAM,EAAE,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,QAAiC;IAEjC,OAAO,QAAQ,CAAC,QAAQ;QACvB,CAAC,CAAC,4BAA4B,CAAC,EAAE,aAAa,EAAE,4BAA4B,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1G,CAAC,CAAC,SAAS,CAAC;AACd,CAAC","sourcesContent":["import path from \"node:path\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport { hasOnlyKeys, isPlainRecord } from \"../util/value-guards.ts\";\nimport { parseBoundedStringArray } from \"./bounded-string-array.ts\";\nimport {\n\tisHarnessCapability,\n\tisResourcePointerKind,\n\tMAX_ORCHESTRATION_MODEL_ID_LENGTH,\n\tMAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH,\n\tMAX_WORKER_AUTHORITY_PATH_LENGTH,\n\tMAX_WORKER_AUTHORITY_PATHS,\n\tMAX_WORKER_RESOURCE_METADATA_NAME_LENGTH,\n\tMAX_WORKER_RESOURCE_PATH_LENGTH,\n\tMAX_WORKER_RESOURCE_POINTERS,\n\tMAX_WORKER_SOUL_LENGTH,\n\tORCHESTRATION_SCHEMA_VERSION,\n\tORCHESTRATION_THINKING_LEVELS,\n\ttype OrchestrationModelBinding,\n\ttype OrchestrationProfile,\n\ttype ResourcePointer,\n\ttype RiskBudget,\n\ttype WorkerExecutionAuthorityContract,\n\ttype WorkerExecutionContract,\n\ttype WorkerProfileExecutionContract,\n} from \"./contracts.ts\";\nimport { OrchestrationProfileError, parseOrchestrationProfile } from \"./profile-registry.ts\";\nimport { intersectRiskBudgets, parseRiskBudget } from \"./risk-budget.ts\";\n\nexport class WorkerExecutionContractError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"WorkerExecutionContractError\";\n\t}\n}\n\nfunction parseModelBinding(value: unknown, label: string): OrchestrationModelBinding {\n\tif (\n\t\t!isPlainRecord(value) \|\|\n\t\t!hasOnlyKeys(value, [\"provider\", \"modelId\", \"thinkingLevel\"]) \|\|\n\t\ttypeof value.provider !== \"string\" \|\|\n\t\tvalue.provider.length > MAX_ORCHESTRATION_MODEL_PROVIDER_LENGTH \|\|\n\t\t!value.provider.trim() \|\|\n\t\ttypeof value.modelId !== \"string\" \|\|\n\t\tvalue.modelId.length > MAX_ORCHESTRATION_MODEL_ID_LENGTH \|\|\n\t\t!value.modelId.trim() \|\|\n\t\ttypeof value.thinkingLevel !== \"string\" \|\|\n\t\t!ORCHESTRATION_THINKING_LEVELS.includes(value.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number])\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} model binding is invalid.`);\n\t}\n\treturn {\n\t\tprovider: value.provider,\n\t\tmodelId: value.modelId,\n\t\tthinkingLevel: value.thinkingLevel as (typeof ORCHESTRATION_THINKING_LEVELS)[number],\n\t};\n}\n\nfunction stringArray(\n\tvalue: unknown,\n\tlabel: string,\n\toptions: { maxEntries?: number; maxLength?: number } = {},\n): string[] {\n\treturn parseBoundedStringArray(value, {\n\t\t...options,\n\t\tinvalidMessage: `${label} must be an array of non-empty strings.`,\n\t\tduplicateMessage: `${label} contains duplicates.`,\n\t\tcreateError: (message) => new WorkerExecutionContractError(message),\n\t});\n}\n\nfunction parseResourcePointers(value: unknown, label: string): ResourcePointer[] {\n\tif (!Array.isArray(value) \|\| value.length > MAX_WORKER_RESOURCE_POINTERS) {\n\t\tthrow new WorkerExecutionContractError(`${label} resource pointers are invalid.`);\n\t}\n\tconst ids = new Set<string>();\n\treturn value.map((candidate) => {\n\t\tif (\n\t\t\t!isPlainRecord(candidate) \|\|\n\t\t\t!hasOnlyKeys(candidate, [\"id\", \"kind\", \"uri\", \"readOnly\", \"digest\", \"metadata\"]) \|\|\n\t\t\ttypeof candidate.id !== \"string\" \|\|\n\t\t\t!/^(skill\|prompt):[a-f0-9]{64}$/i.test(candidate.id) \|\|\n\t\t\ttypeof candidate.kind !== \"string\" \|\|\n\t\t\t!isResourcePointerKind(candidate.kind) \|\|\n\t\t\t(candidate.kind !== \"skill\" && candidate.kind !== \"prompt\") \|\|\n\t\t\t!candidate.id.startsWith(`${candidate.kind}:`) \|\|\n\t\t\ttypeof candidate.uri !== \"string\" \|\|\n\t\t\tcandidate.uri.length === 0 \|\|\n\t\t\tcandidate.uri.length > MAX_WORKER_RESOURCE_PATH_LENGTH + 16 \|\|\n\t\t\t!candidate.uri.startsWith(\"file:\") \|\|\n\t\t\tcandidate.readOnly !== true \|\|\n\t\t\t(candidate.digest !== undefined &&\n\t\t\t\t(typeof candidate.digest !== \"string\" \|\| !/^[a-f0-9]{64}$/i.test(candidate.digest))) \|\|\n\t\t\t(candidate.metadata !== undefined &&\n\t\t\t\t(!isPlainRecord(candidate.metadata) \|\|\n\t\t\t\t\ttypeof candidate.metadata.name !== \"string\" \|\|\n\t\t\t\t\tcandidate.metadata.name.length === 0 \|\|\n\t\t\t\t\tcandidate.metadata.name.length > MAX_WORKER_RESOURCE_METADATA_NAME_LENGTH \|\|\n\t\t\t\t\t!hasOnlyKeys(candidate.metadata, [\"name\"])))\n\t\t) {\n\t\t\tthrow new WorkerExecutionContractError(`${label} resource pointer is invalid.`);\n\t\t}\n\t\tif (ids.has(candidate.id)) {\n\t\t\tthrow new WorkerExecutionContractError(`${label} resource pointers contain duplicates.`);\n\t\t}\n\t\tids.add(candidate.id);\n\t\treturn {\n\t\t\tid: candidate.id,\n\t\t\tkind: candidate.kind,\n\t\t\turi: candidate.uri,\n\t\t\treadOnly: true,\n\t\t\t...(typeof candidate.digest === \"string\" ? { digest: candidate.digest } : {}),\n\t\t\t...(isPlainRecord(candidate.metadata) && typeof candidate.metadata.name === \"string\"\n\t\t\t\t? { metadata: { name: candidate.metadata.name } }\n\t\t\t\t: {}),\n\t\t};\n\t});\n}\n\nfunction parseAuthority(\n\tvalue: unknown,\n\tprofile: OrchestrationProfile,\n\tlabel: string,\n): WorkerExecutionAuthorityContract {\n\tif (\n\t\t!isPlainRecord(value) \|\|\n\t\t!hasOnlyKeys(value, [\"capabilities\", \"toolNames\", \"readPaths\", \"writePaths\", \"deniedPaths\", \"budget\"])\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority is invalid.`);\n\t}\n\tconst capabilities = stringArray(value.capabilities, `${label} authority capabilities`);\n\tif (!capabilities.every(isHarnessCapability)) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority contains an unknown capability.`);\n\t}\n\tif (\n\t\tcapabilities.some(\n\t\t\t(capability) => capability !== \"workflow.delegate\" && !profile.capabilityCeiling.includes(capability),\n\t\t)\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority exceeds its profile capability ceiling.`);\n\t}\n\tconst toolNames = stringArray(value.toolNames, `${label} authority toolNames`);\n\tif (toolNames.some((toolName) => toolName !== \"delegate\" && !profile.toolNames.includes(toolName))) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority contains a tool outside its profile.`);\n\t}\n\tconst pathArrayOptions = {\n\t\tmaxEntries: MAX_WORKER_AUTHORITY_PATHS,\n\t\tmaxLength: MAX_WORKER_AUTHORITY_PATH_LENGTH,\n\t};\n\tconst readPaths = stringArray(value.readPaths, `${label} authority readPaths`, pathArrayOptions);\n\tconst writePaths = stringArray(value.writePaths, `${label} authority writePaths`, pathArrayOptions);\n\tconst deniedPaths = stringArray(value.deniedPaths, `${label} authority deniedPaths`, pathArrayOptions);\n\tif (\n\t\t[...readPaths, ...writePaths, ...deniedPaths].some(\n\t\t\t(entry) => !path.isAbsolute(entry) && !path.win32.isAbsolute(entry),\n\t\t)\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority paths must be absolute.`);\n\t}\n\tlet budget: RiskBudget;\n\ttry {\n\t\tbudget = parseRiskBudget(value.budget, `${label} authority budget`);\n\t} catch (error) {\n\t\tthrow new WorkerExecutionContractError(error instanceof Error ? error.message : String(error));\n\t}\n\tif (!isDeepStrictEqual(intersectRiskBudgets(profile.budget, budget), budget)) {\n\t\tthrow new WorkerExecutionContractError(`${label} authority exceeds its profile budget.`);\n\t}\n\tconst readGranted = capabilities.some(\n\t\t(capability) => capability === \"filesystem.read\" \|\| capability === \"worktree.read\",\n\t);\n\tconst writeGranted = capabilities.some(\n\t\t(capability) => capability === \"filesystem.write\" \|\| capability === \"worktree.mutate\",\n\t);\n\tif (readGranted && readPaths.length === 0) {\n\t\tthrow new WorkerExecutionContractError(`${label} read authority lacks a positive path scope.`);\n\t}\n\tif (writeGranted && writePaths.length === 0) {\n\t\tthrow new WorkerExecutionContractError(`${label} write authority lacks a positive path scope.`);\n\t}\n\treturn {\n\t\tcapabilities: capabilities as WorkerExecutionAuthorityContract[\"capabilities\"],\n\t\ttoolNames,\n\t\treadPaths,\n\t\twritePaths,\n\t\tdeniedPaths,\n\t\tbudget,\n\t};\n}\n\nfunction parseProfileContract(value: unknown, label: string): WorkerProfileExecutionContract {\n\tif (\n\t\t!isPlainRecord(value) \|\|\n\t\t!hasOnlyKeys(value, [\"schemaVersion\", \"profile\", \"modelBinding\", \"authority\", \"resourcePointers\", \"soul\"]) \|\|\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} is invalid.`);\n\t}\n\tlet profile: OrchestrationProfile;\n\ttry {\n\t\tprofile = parseOrchestrationProfile(value.profile);\n\t} catch (error) {\n\t\tthrow new WorkerExecutionContractError(\n\t\t\terror instanceof OrchestrationProfileError ? error.message : `${label} profile is invalid.`,\n\t\t);\n\t}\n\tconst modelBinding = parseModelBinding(value.modelBinding, label);\n\tif (!profile.modelPolicy.candidates.some((candidate) => isDeepStrictEqual(candidate, modelBinding))) {\n\t\tthrow new WorkerExecutionContractError(`${label} model binding is not declared by its profile.`);\n\t}\n\tif (\n\t\tvalue.soul !== undefined &&\n\t\t(typeof value.soul !== \"string\" \|\| value.soul.length > MAX_WORKER_SOUL_LENGTH \|\| !value.soul.trim())\n\t) {\n\t\tthrow new WorkerExecutionContractError(`${label} soul is invalid.`);\n\t}\n\tconst authority = parseAuthority(value.authority, profile, label);\n\tconst resourcePointers = parseResourcePointers(value.resourcePointers ?? [], label);\n\treturn {\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofile,\n\t\tmodelBinding,\n\t\tauthority,\n\t\tresourcePointers,\n\t\t...(typeof value.soul === \"string\" ? { soul: value.soul } : {}),\n\t};\n}\n\nexport function parseWorkerExecutionContract(value: unknown): WorkerExecutionContract {\n\tif (\n\t\t!isPlainRecord(value) \|\|\n\t\t!hasOnlyKeys(value, [\"schemaVersion\", \"worker\", \"verifier\"]) \|\|\n\t\tvalue.schemaVersion !== ORCHESTRATION_SCHEMA_VERSION\n\t) {\n\t\tthrow new WorkerExecutionContractError(\"Worker execution contract is invalid.\");\n\t}\n\tconst worker = parseProfileContract(value.worker, \"Worker execution contract\");\n\tconst verifier = value.verifier\n\t\t? parseProfileContract(value.verifier, \"Worker verifier execution contract\")\n\t\t: undefined;\n\tif (worker.profile.requireIndependentVerification) {\n\t\tif (!verifier \|\| worker.profile.verificationProfileId !== verifier.profile.profileId) {\n\t\t\tthrow new WorkerExecutionContractError(\"Worker execution contract is missing its owner-pinned verifier.\");\n\t\t}\n\t\tif (verifier.profile.role !== \"verifier\") {\n\t\t\tthrow new WorkerExecutionContractError(\"Worker verifier execution contract does not use a verifier profile.\");\n\t\t}\n\t} else if (verifier) {\n\t\tthrow new WorkerExecutionContractError(\"Worker execution contract has an unexpected verifier.\");\n\t}\n\treturn {\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tworker,\n\t\t...(verifier ? { verifier } : {}),\n\t};\n}\n\nfunction snapshotProfile(profile: OrchestrationProfile): OrchestrationProfile {\n\tconst { sourcePath: _sourcePath, ...persisted } = profile;\n\treturn structuredClone(persisted) as OrchestrationProfile;\n}\n\nfunction snapshotResolvedProfile(source: {\n\tprofile: OrchestrationProfile;\n\tmodelBinding: OrchestrationModelBinding;\n\tauthority: WorkerExecutionAuthorityContract;\n\tresourcePointers?: readonly ResourcePointer[];\n\tsoul?: string;\n}): WorkerProfileExecutionContract {\n\treturn {\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tprofile: snapshotProfile(source.profile),\n\t\tmodelBinding: structuredClone(source.modelBinding),\n\t\tauthority: structuredClone(source.authority),\n\t\tresourcePointers: structuredClone(source.resourcePointers ?? []),\n\t\t...(source.soul ? { soul: source.soul } : {}),\n\t};\n}\n\nexport function createWorkerExecutionContract(args: {\n\tworker: {\n\t\tprofile: OrchestrationProfile;\n\t\tmodelBinding: OrchestrationModelBinding;\n\t\tauthority: WorkerExecutionAuthorityContract;\n\t\tresourcePointers?: readonly ResourcePointer[];\n\t\tsoul?: string;\n\t};\n\tverifier?: {\n\t\tprofile: OrchestrationProfile;\n\t\tmodelBinding: OrchestrationModelBinding;\n\t\tauthority: WorkerExecutionAuthorityContract;\n\t\tresourcePointers?: readonly ResourcePointer[];\n\t\tsoul?: string;\n\t};\n}): WorkerExecutionContract {\n\treturn parseWorkerExecutionContract({\n\t\tschemaVersion: ORCHESTRATION_SCHEMA_VERSION,\n\t\tworker: snapshotResolvedProfile(args.worker),\n\t\t...(args.verifier ? { verifier: snapshotResolvedProfile(args.verifier) } : {}),\n\t});\n}\n\nexport function verifierWorkerExecutionContract(\n\tcontract: WorkerExecutionContract,\n): WorkerExecutionContract \| undefined {\n\treturn contract.verifier\n\t\t? parseWorkerExecutionContract({ schemaVersion: ORCHESTRATION_SCHEMA_VERSION, worker: contract.verifier })\n\t\t: undefined;\n}\n"]}

package/dist/core/risk-classifier.js CHANGED Viewed

@@ -170,9 +170,9 @@ export function assessOperationRisk(input) {
     }
     if (input.toolName === "secret_store") {
         return {
-            risk: "scoped-write",
-            reasonCode: "native_owner_secret_flow",
-            reasons: ["Native secret-store mutations require model-blind owner input and in-tool confirmation"],
+            risk: "read-only",
+            reasonCode: "authorized_credential_use",
+            reasons: ["Credential activation is limited to an owner-authorized current-project binding"],
             requiresApproval: false,
         };
     }

package/dist/core/risk-classifier.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"risk-classifier.js","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAIA,MAAM,0BAA0B,GAC/B,mSAAmS,CAAC;AACrS,MAAM,qBAAqB,GAC1B,qNAAqN,CAAC;AACvN,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAC5D,MAAM,kBAAkB,GACvB,kIAAkI,CAAC;AACpI,MAAM,sBAAsB,GAAG,kFAAkF,CAAC;AAClH,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACjE,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAChF,MAAM,uBAAuB,GAC5B,6IAA6I,CAAC;AAC/I,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AACjF,MAAM,YAAY,GAAG,sFAAsF,CAAC;AAC5G,MAAM,kBAAkB,GACvB,uGAAuG,CAAC;AACzG,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAC9E,MAAM,iBAAiB,GAAG,kFAAkF,CAAC;AAC7G,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,qBAAqB,GAC1B,2LAA2L,CAAC;AAC7L,MAAM,cAAc,GAAG,MAAM,CAAC;AAQ9B,SAAS,gBAAgB,CAAC,IAAY;IACrC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,kDAAkD;SAC1D,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qDAAqD;SAC7D,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,2DAA2D;SACnE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,CAAC,4BAA4B,CAAC;SACvC,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;aAChG,CAAC;QACH,CAAC;QACD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,sEAAsE,CAAC;SACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,oBAAoB;YAC7B,QAAQ,EAAE,kBAAkB;YAC5B,WAAW,EAAE,4BAA4B;YACzC,mBAAmB,EAAE,+BAA+B;YACpD,YAAY,EAAE,2BAA2B;SACzC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;YAClE,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;YAC9F,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC1B,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;SAChG,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,4CAA4C,CAAC;SACvD,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,iDAAiD,CAAC;SAC5D,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,uBAAuB;YACnC,OAAO,EAAE,CAAC,qEAAqE,CAAC;SAChF,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,uEAAuE,CAAC;KAClF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACvD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA0B;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,0BAA0B;YACtC,OAAO,EAAE,CAAC,wFAAwF,CAAC;YACnG,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,2DAA2D,CAAC;YACtE,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,2BAA2B;YACpC,QAAQ,EAAE,yBAAyB;YACnC,WAAW,EAAE,uBAAuB;YACpC,mBAAmB,EAAE,6BAA6B;YAClD,YAAY,EAAE,iCAAiC;SAC/C,CAAC;QACF,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,IAAI,KAAK,mBAAmB;SACvD,CAAC;IACH,CAAC;IACD,IACC,OAAO;QACP,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAClC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,gEAAgE,CAAC;YAC3E,gBAAgB,EAAE,IAAI;SACtB,CAAC;IACH,CAAC;IACD,IACC,KAAK,CAAC,QAAQ;QACd,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EACtG,CAAC;QACF,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,uCAAuC,CAAC;YAClD,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,4CAA4C,CAAC;QACvD,gBAAgB,EAAE,KAAK;KACvB,CAAC;AACH,CAAC","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" \| \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you\|could you\|please\|pls\|go ahead and\|let'?s\|i need you to\|we need to\|you should)\\s+.\\b(add\|apply\|build\|change\|commit\|create\|delete\|edit\|fix\|generate\|implement\|install\|modify\|patch\|remove\|rename\|replace\|run\|test\|update\|write\|publish\|release\|push\|deploy\|tag\|reset\|clean\|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you\|could you\|please\|pls\|go ahead and\|let'?s\|i need you to\|we need to\|you should)\\s+)?(?:how\|what\|why\|when\|where\|which\|who\|explain\|summarize\|compare\|describe\|list\|show\|search\|find\|view\|read\|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish\|release\|push\|deploy\|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth\|token\|credential\|credentials\|secret\|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete\|reset\|rm\\s+-rf\|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify\|change\|write\|update\|edit\|delete\|add\|remove\|set)\\s+.\\b(skills\|prompts\|settings\|tools\|behavior)\\b\|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite\|redesign\|change\|modify\|rearchitect)\\s+.\\b(architecture\|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan\|planning\|roadmap\|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design\|architect\\w\|structure\|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should\|would\|do we\|can we)\|what(?:'s\| is) the (?:best\|cleanest\|right)\|propose\|draft\|come up with\|figure out\|decide (?:on\|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor\|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test\|testing\|validation\|lint\|vitest\|jest\|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement\|fix\|apply\|change\|update\|create\|write\|generate\|modify\|edit\|patch\|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r\|\\s+-f\|\\s+-rf\|\\s+-fr)?\|mv\|cp\|chmod\|chown\|install)\\b\|>\\s\\/dev\\/(sda\|hda\|vda)\|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit\|push\|reset\|clean\|stash\|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm\|pnpm\|yarn\|bun)\\s+(install\|i\|update\|up\|publish\|run\|remove\|rm\|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release\|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree\|move\|copy\|copy2\|copytree)\|os\\.(?:remove\|unlink\|rmdir\|removedirs\|system)\|subprocess\\.(?:run\|call\|check_call\|check_output\|Popen)\|Path\$[^)]\$\\.(?:unlink\|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" \| \"security\" \| \"destructive\" \| \"self-modification\" \| \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) \|\| (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal \| undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (input.toolName === \"secret_store\") {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"native_owner_secret_flow\",\n\t\t\treasons: [\"Native secret-store mutations require model-blind owner input and in-tool confirmation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) \|\|\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) \|\|\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) \|\|\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) \|\|\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) \|\|\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}
1	+ {"version":3,"file":"risk-classifier.js","sourceRoot":"","sources":["../../src/core/risk-classifier.ts"],"names":[],"mappings":"AAIA,MAAM,0BAA0B,GAC/B,mSAAmS,CAAC;AACrS,MAAM,qBAAqB,GAC1B,qNAAqN,CAAC;AACvN,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AACpE,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAC5D,MAAM,kBAAkB,GACvB,kIAAkI,CAAC;AACpI,MAAM,sBAAsB,GAAG,kFAAkF,CAAC;AAClH,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACjE,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAChF,MAAM,uBAAuB,GAC5B,6IAA6I,CAAC;AAC/I,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AACjF,MAAM,YAAY,GAAG,sFAAsF,CAAC;AAC5G,MAAM,kBAAkB,GACvB,uGAAuG,CAAC;AACzG,MAAM,iBAAiB,GAAG,mDAAmD,CAAC;AAC9E,MAAM,iBAAiB,GAAG,kFAAkF,CAAC;AAC7G,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AACtD,MAAM,qBAAqB,GAC1B,2LAA2L,CAAC;AAC7L,MAAM,cAAc,GAAG,MAAM,CAAC;AAQ9B,SAAS,gBAAgB,CAAC,IAAY;IACrC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IACnC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,kDAAkD;SAC1D,CAAC;IACH,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,qDAAqD;SAC7D,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,2DAA2D;SACnE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,cAAc;YAC1B,OAAO,EAAE,CAAC,4BAA4B,CAAC;SACvC,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,qBAAqB;gBACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;aAChG,CAAC;QACH,CAAC;QACD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,sEAAsE,CAAC;SACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,oBAAoB;YAC7B,QAAQ,EAAE,kBAAkB;YAC5B,WAAW,EAAE,4BAA4B;YACzC,mBAAmB,EAAE,+BAA+B;YACpD,YAAY,EAAE,2BAA2B;SACzC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI;YAClE,UAAU,EAAE,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;YAC9F,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC1B,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,qFAAqF,CAAC;SAChG,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,4CAA4C,CAAC;SACvD,CAAC;IACH,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,CAAC,iDAAiD,CAAC;SAC5D,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,uBAAuB;YACnC,OAAO,EAAE,CAAC,qEAAqE,CAAC;SAChF,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,uEAAuE,CAAC;KAClF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACvD,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA0B;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,iBAAiB;YAC7B,OAAO,EAAE,CAAC,iBAAiB,CAAC;YAC5B,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACvC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,2BAA2B;YACvC,OAAO,EAAE,CAAC,iFAAiF,CAAC;YAC5F,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1F,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,CAAC,2DAA2D,CAAC;YACtE,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,GAAuC;YACtD,OAAO,EAAE,2BAA2B;YACpC,QAAQ,EAAE,yBAAyB;YACnC,WAAW,EAAE,uBAAuB;YACpC,mBAAmB,EAAE,6BAA6B;YAClD,YAAY,EAAE,iCAAiC;SAC/C,CAAC;QACF,OAAO;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1B,gBAAgB,EAAE,QAAQ,CAAC,IAAI,KAAK,mBAAmB;SACvD,CAAC;IACH,CAAC;IACD,IACC,OAAO;QACP,CAAC,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC;YACpC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC;YACxC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAClC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,gEAAgE,CAAC;YAC3E,gBAAgB,EAAE,IAAI;SACtB,CAAC;IACH,CAAC;IACD,IACC,KAAK,CAAC,QAAQ;QACd,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EACtG,CAAC;QACF,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,UAAU,EAAE,kBAAkB;YAC9B,OAAO,EAAE,CAAC,uCAAuC,CAAC;YAClD,gBAAgB,EAAE,KAAK;SACvB,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,mBAAmB;QAC/B,OAAO,EAAE,CAAC,4CAA4C,CAAC;QACvD,gBAAgB,EAAE,KAAK;KACvB,CAAC;AACH,CAAC","sourcesContent":["import type { OperationRisk, RiskAssessment, RiskAssessmentInput, RouteDecision } from \"./autonomy/contracts.ts\";\n\nexport type ModelRouterIntent = \"research\" \| \"modify\";\n\nconst EXPLICIT_MODIFY_REQUEST_RE =\n\t/^(?:can you\|could you\|please\|pls\|go ahead and\|let'?s\|i need you to\|we need to\|you should)\\s+.\\b(add\|apply\|build\|change\|commit\|create\|delete\|edit\|fix\|generate\|implement\|install\|modify\|patch\|remove\|rename\|replace\|run\|test\|update\|write\|publish\|release\|push\|deploy\|tag\|reset\|clean\|rewrite)\\b/i;\nconst READ_ONLY_QUESTION_RE =\n\t/^(?:(?:can you\|could you\|please\|pls\|go ahead and\|let'?s\|i need you to\|we need to\|you should)\\s+)?(?:how\|what\|why\|when\|where\|which\|who\|explain\|summarize\|compare\|describe\|list\|show\|search\|find\|view\|read\|locate)\\b/i;\nconst RELEASE_PUBLISH_RE = /\\b(publish\|release\|push\|deploy\|tag)\\b/i;\nconst SECURITY_AUTH_RE = /\\b(auth\|token\|credential\|credentials\|secret\|api[-_]key)\\b/i;\nconst DESTRUCTIVE_RE = /\\b(delete\|reset\|rm\\s+-rf\|clean)\\b/i;\nconst SELF_MOD_MUTATE_RE =\n\t/\\b(modify\|change\|write\|update\|edit\|delete\|add\|remove\|set)\\s+.\\b(skills\|prompts\|settings\|tools\|behavior)\\b\|self[-_]modification/i;\nconst ARCHITECTURE_MUTATE_RE = /\\b(rewrite\|redesign\|change\|modify\|rearchitect)\\s+.\\b(architecture\|architect)\\b/i;\nconst PLANNING_CORE_RE = /\\b(plan\|planning\|roadmap\|strategy)\\b/i;\nconst PLANNING_DESIGN_WORD_RE = /\\b(design\|architect\\w\|structure\|approach)\\b/i;\nconst PLANNING_PROSPECTIVE_RE =\n\t/\\b(how (?:should\|would\|do we\|can we)\|what(?:'s\| is) the (?:best\|cleanest\|right)\|propose\|draft\|come up with\|figure out\|decide (?:on\|how))\\b/i;\nconst REFACTOR_RE = /\\b(refactor\|refactoring)\\b/i;\nconst TEST_VALIDATION_RE = /\\b(test\|testing\|validation\|lint\|vitest\|jest\|run)\\b/i;\nconst IMPLEMENT_RE = /\\b(implement\|fix\|apply\|change\|update\|create\|write\|generate\|modify\|edit\|patch\|add)\\b/i;\nconst DESTRUCTIVE_CMD_RE =\n\t/\\b(rm(\\s+-r\|\\s+-f\|\\s+-rf\|\\s+-fr)?\|mv\|cp\|chmod\|chown\|install)\\b\|>\\s\\/dev\\/(sda\|hda\|vda)\|\\b(dd\\s+if=)/i;\nconst GIT_MUTATE_CMD_RE = /\\bgit\\s+(commit\|push\|reset\|clean\|stash\|rebase)\\b/i;\nconst PKG_MUTATE_CMD_RE = /\\b(npm\|pnpm\|yarn\|bun)\\s+(install\|i\|update\|up\|publish\|run\|remove\|rm\|uninstall)\\b/i;\nconst RELEASE_DEPLOY_CMD_RE = /\\b(release\|deploy)\\b/i;\nconst PYTHON_HIGH_IMPACT_RE =\n\t/\\b(?:shutil\\.(?:rmtree\|move\|copy\|copy2\|copytree)\|os\\.(?:remove\|unlink\|rmdir\|removedirs\|system)\|subprocess\\.(?:run\|call\|check_call\|check_output\|Popen)\|Path\$[^)]\$\\.(?:unlink\|rmdir))\\b/i;\nconst REDIRECTION_RE = /[<>]/;\n\ninterface RiskSignal {\n\trisk: OperationRisk;\n\tkind: \"release\" \| \"security\" \| \"destructive\" \| \"self-modification\" \| \"architecture\";\n\treason: string;\n}\n\nfunction isPlanningPrompt(text: string): boolean {\n\treturn PLANNING_CORE_RE.test(text) \|\| (PLANNING_DESIGN_WORD_RE.test(text) && PLANNING_PROSPECTIVE_RE.test(text));\n}\n\nfunction highRiskSignal(text: string): RiskSignal \| undefined {\n\tif (RELEASE_PUBLISH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"release\",\n\t\t\treason: \"Operation mentions releasing, publishing, or deploying\",\n\t\t};\n\t}\n\tif (SECURITY_AUTH_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"security\",\n\t\t\treason: \"Operation mentions authentication or credentials\",\n\t\t};\n\t}\n\tif (DESTRUCTIVE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"destructive\",\n\t\t\treason: \"Operation involves deleting, resetting, or cleaning\",\n\t\t};\n\t}\n\tif (SELF_MOD_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\tkind: \"self-modification\",\n\t\t\treason: \"Operation modifies settings, tools, skills, or prompts\",\n\t\t};\n\t}\n\tif (ARCHITECTURE_MUTATE_RE.test(text)) {\n\t\treturn {\n\t\t\trisk: \"high-impact\",\n\t\t\tkind: \"architecture\",\n\t\t\treason: \"Operation mentions rewriting or rearchitecting core parts\",\n\t\t};\n\t}\n\treturn undefined;\n}\n\nfunction stripSingleQuotes(command: string): string {\n\treturn command.replace(/'[^']*'/g, \"''\");\n}\n\nexport function classifyModelRouterRoute(prompt: string): RouteDecision {\n\tconst text = prompt.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.1,\n\t\t\treasonCode: \"empty_prompt\",\n\t\t\treasons: [\"Empty or whitespace prompt\"],\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(text) && !EXPLICIT_MODIFY_REQUEST_RE.test(text)) {\n\t\tif (isPlanningPrompt(text)) {\n\t\t\treturn {\n\t\t\t\ttier: \"medium\",\n\t\t\t\trisk: \"read-only\",\n\t\t\t\tconfidence: 0.75,\n\t\t\t\treasonCode: \"planning_min_medium\",\n\t\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t\t};\n\t\t}\n\t\treturn {\n\t\t\ttier: \"cheap\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.9,\n\t\t\treasonCode: \"read_only_question\",\n\t\t\treasons: [\"Prompt asks a question or requests an explanation, search, or lookup\"],\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(text);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_or_publish\",\n\t\t\tsecurity: \"security_or_auth\",\n\t\t\tdestructive: \"destructive_or_git_history\",\n\t\t\t\"self-modification\": \"settings_or_self_modification\",\n\t\t\tarchitecture: \"architecture_or_ambiguous\",\n\t\t};\n\t\treturn {\n\t\t\ttier: \"expensive\",\n\t\t\trisk: highRisk.kind === \"security\" ? \"high-impact\" : highRisk.risk,\n\t\t\tconfidence: highRisk.kind === \"security\" ? 0.95 : highRisk.kind === \"destructive\" ? 0.85 : 0.9,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t};\n\t}\n\tif (isPlanningPrompt(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"read-only\",\n\t\t\tconfidence: 0.75,\n\t\t\treasonCode: \"planning_min_medium\",\n\t\t\treasons: [\"Planning/design prompts never route cheap by default; a judge may deem them trivial\"],\n\t\t};\n\t}\n\tif (REFACTOR_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"mechanical_refactor\",\n\t\t\treasons: [\"Prompt mentions refactoring code structure\"],\n\t\t};\n\t}\n\tif (TEST_VALIDATION_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.8,\n\t\t\treasonCode: \"test_or_validation\",\n\t\t\treasons: [\"Prompt mentions testing, validation, or linting\"],\n\t\t};\n\t}\n\tif (IMPLEMENT_RE.test(text)) {\n\t\treturn {\n\t\t\ttier: \"medium\",\n\t\t\trisk: \"scoped-write\",\n\t\t\tconfidence: 0.85,\n\t\t\treasonCode: \"normal_implementation\",\n\t\t\treasons: [\"Prompt mentions implementing, updating, creating, or modifying code\"],\n\t\t};\n\t}\n\treturn {\n\t\ttier: \"cheap\",\n\t\trisk: \"read-only\",\n\t\tconfidence: 0.5,\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No explicit implementation, destructive, or release patterns detected\"],\n\t};\n}\n\nexport function classifyModelRouterIntent(prompt: string): ModelRouterIntent {\n\treturn classifyModelRouterRoute(prompt).tier === \"cheap\" ? \"research\" : \"modify\";\n}\n\nexport function assessOperationRisk(input: RiskAssessmentInput): RiskAssessment {\n\tconst operation = input.operation.trim();\n\tconst command = input.command?.trim() ?? \"\";\n\tconst cleanCommand = stripSingleQuotes(command);\n\tconst fullText = `${operation} ${command}`.trim();\n\tconst cleanFullText = `${operation} ${cleanCommand}`.trim();\n\tif (!fullText) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"empty_operation\",\n\t\t\treasons: [\"Empty operation\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (input.toolName === \"secret_store\") {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"authorized_credential_use\",\n\t\t\treasons: [\"Credential activation is limited to an owner-authorized current-project binding\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tif (READ_ONLY_QUESTION_RE.test(operation) && !EXPLICIT_MODIFY_REQUEST_RE.test(operation)) {\n\t\treturn {\n\t\t\trisk: \"read-only\",\n\t\t\treasonCode: \"read_only_operation\",\n\t\t\treasons: [\"Operation is explicitly read-only (list/show/read/search)\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\tconst highRisk = highRiskSignal(cleanFullText);\n\tif (highRisk) {\n\t\tconst reasonCode: Record<RiskSignal[\"kind\"], string> = {\n\t\t\trelease: \"release_publish_operation\",\n\t\t\tsecurity: \"security_auth_operation\",\n\t\t\tdestructive: \"destructive_operation\",\n\t\t\t\"self-modification\": \"self_modification_operation\",\n\t\t\tarchitecture: \"architecture_mutation_operation\",\n\t\t};\n\t\treturn {\n\t\t\trisk: highRisk.risk,\n\t\t\treasonCode: reasonCode[highRisk.kind],\n\t\t\treasons: [highRisk.reason],\n\t\t\trequiresApproval: highRisk.risk === \"approval-required\",\n\t\t};\n\t}\n\tif (\n\t\tcommand &&\n\t\t(DESTRUCTIVE_CMD_RE.test(cleanCommand) \|\|\n\t\t\tGIT_MUTATE_CMD_RE.test(cleanCommand) \|\|\n\t\t\tPKG_MUTATE_CMD_RE.test(cleanCommand) \|\|\n\t\t\tRELEASE_DEPLOY_CMD_RE.test(cleanCommand) \|\|\n\t\t\tPYTHON_HIGH_IMPACT_RE.test(cleanCommand) \|\|\n\t\t\tREDIRECTION_RE.test(cleanCommand))\n\t) {\n\t\treturn {\n\t\t\trisk: \"approval-required\",\n\t\t\treasonCode: \"mutating_command\",\n\t\t\treasons: [\"Command executes a destructive, mutating, or publish operation\"],\n\t\t\trequiresApproval: true,\n\t\t};\n\t}\n\tif (\n\t\tinput.toolName &&\n\t\t![\"read_file\", \"search_web\", \"list_dir\", \"grep_search\", \"view_file\", \"memory\"].includes(input.toolName)\n\t) {\n\t\treturn {\n\t\t\trisk: \"scoped-write\",\n\t\t\treasonCode: \"generic_mutation\",\n\t\t\treasons: [\"Generic mutating operation or command\"],\n\t\t\trequiresApproval: false,\n\t\t};\n\t}\n\treturn {\n\t\trisk: \"read-only\",\n\t\treasonCode: \"default_read_only\",\n\t\treasons: [\"No mutating or high-risk patterns detected\"],\n\t\trequiresApproval: false,\n\t};\n}\n"]}

package/dist/core/runtime-builder.d.ts CHANGED Viewed

@@ -57,6 +57,7 @@ import type { TaskProfileWriterPort } from "./orchestration/task-profile-writer.
 import type { ProfileFilterReloadSnapshot } from "./profile-filter-controller.ts";
 import type { ModelFitnessReport } from "./research/model-fitness.ts";
 import type { ResourceLoader } from "./resource-loader.ts";
+import { CredentialManager } from "./secrets/credential-manager.ts";
 import type { SessionImageStore } from "./session-image-store.ts";
 import { type ResourceProfileFilterSettings, type SettingsManager } from "./settings-manager.ts";
 import type { TaskStepsState } from "./tasks/task-state.ts";
@@ -265,7 +266,8 @@ export declare class RuntimeBuilder {
     private readonly _explicitLiveExtensionPaths;
     private _reloadPromise;
     private _reloadRequested;
-    private readonly _secretVault;
+    private readonly _credentialManager;
+    private readonly _credentialExposureBoundary;
     private readonly _fileMutationIntents;
     private readonly deps;
     constructor(deps: RuntimeBuilderDeps);
@@ -289,6 +291,7 @@ export declare class RuntimeBuilder {
      */
     getAllTools(): ToolInfo[];
     getToolDefinition(name: string): ToolDefinition | undefined;
+    get credentialManager(): CredentialManager;
     /** Release session-owned mutation payload leases retained by the write/edit tool pair. */
     dispose(): Promise<void>;
     refreshToolRegistry(options?: {

package/dist/core/runtime-builder.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runtime-builder.d.ts","sourceRoot":"","sources":["../../src/core/runtime-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAiB,MAAM,2BAA2B,CAAC;AAC7G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;~~AAC3D~~,OAAO,KAAK,EACX,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC/G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,QAAQ,EAEb,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAElF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;~~AAI3D~~,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAEN,KAAK,6BAA6B,EAClC,KAAK,eAAe,EACpB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA4B5D,OAAO,EAAgC,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAW/F;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAOvG;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,GAAG,eAAe,EAAE,CAMpG;AAED,6GAA6G;AAC7G,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACrB,GAAG,uBAAuB,CAU1B;AAwBD,MAAM,WAAW,kBAAkB;IAClC,kGAAkG;IAClG,QAAQ,IAAI,KAAK,CAAC;IAClB,sFAAsF;IACtF,MAAM,IAAI,MAAM,CAAC;IACjB,gGAAgG;IAChG,kBAAkB,IAAI,MAAM,CAAC;IAC7B,gEAAgE;IAChE,WAAW,IAAI,MAAM,CAAC;IACtB,mDAAmD;IACnD,iBAAiB,IAAI,cAAc,CAAC;IACpC,uFAAuF;IACvF,kBAAkB,IAAI,eAAe,CAAC;IACtC,sFAAsF;IACtF,gBAAgB,IAAI,aAAa,CAAC;IAClC,4DAA4D;IAC5D,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IAC7C,2FAA2F;IAC3F,iBAAiB,IAAI,cAAc,CAAC;IAEpC,qDAAqD;IACrD,kBAAkB,IAAI,eAAe,CAAC;IACtC,+GAA+G;IAC/G,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAClD,qFAAqF;IACrF,mBAAmB,IAAI,MAAM,CAAC;IAC9B,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1C,mFAAmF;IACnF,cAAc,IAAI,cAAc,EAAE,CAAC;IACnC,mGAAmG;IACnG,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;IAC9D,6GAA6G;IAC7G,2BAA2B,IAAI,MAAM,EAAE,GAAG,SAAS,CAAC;IACpD,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAE/D,2GAA2G;IAC3G,oBAAoB,IAAI,QAAQ,CAAC,6BAA6B,CAAC,GAAG,SAAS,CAAC;IAC5E,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,6BAA6B,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC;IACxF,mBAAmB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAC/C,2FAA2F;IAC3F,uBAAuB,CAAC,IAAI,oBAAoB,GAAG,SAAS,CAAC;IAC7D,oBAAoB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAChD,sFAAsF;IACtF,uBAAuB,IAAI,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IACnE,oGAAoG;IACpG,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvD,4FAA4F;IAC5F,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACrG,kHAAkH;IAClH,0BAA0B,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,0BAA0B,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACnH,6EAA6E;IAC7E,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtD,2BAA2B,IAAI,MAAM,EAAE,CAAC;IACxC,iCAAiC,IAAI,2BAA2B,CAAC;IACjE,kCAAkC,CAAC,QAAQ,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAEhF,oGAAoG;IACpG,kBAAkB,IAAI,MAAM,EAAE,CAAC;IAC/B,+GAA+G;IAC/G,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChD,wFAAwF;IACxF,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IACrE,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;IAEtE,0GAA0G;IAC1G,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IACjD,qFAAqF;IACrF,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IACtD,yEAAyE;IACzE,6BAA6B,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,yFAAyF;IACzF,iCAAiC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,4EAA4E;IAC5E,uBAAuB,IAAI,IAAI,CAAC;IAEhC,2HAA2H;IAC3H,oBAAoB,IAAI,aAAa,CAAC;IACtC,sGAAsG;IACtG,uBAAuB,CAAC,IAAI,oBAAoB,CAAC;IACjD,oFAAoF;IACpF,oBAAoB,IAAI,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,GAAG,SAAS,CAAC;IAE7E,kEAAkE;IAClE,gBAAgB,IAAI,aAAa,CAAC;IAClC,qFAAqF;IACrF,yBAAyB,IAAI;QAAE,SAAS,EAAE,0BAA0B,CAAC;QAAC,eAAe,EAAE,2BAA2B,CAAA;KAAE,CAAC;IACrH,6FAA6F;IAC7F,2BAA2B,IAAI,IAAI,CAAC;IACpC,0BAA0B,IAAI,8BAA8B,CAAC;IAC7D,2BAA2B,CAAC,QAAQ,EAAE,8BAA8B,GAAG,IAAI,CAAC;IAC5E,wEAAwE;IACxE,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC,iCAAiC;IACjC,oBAAoB,IAAI,SAAS,GAAG,SAAS,CAAC;IAC9C,qBAAqB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAAC;IAC9E,wCAAwC;IACxC,yBAAyB,IAAI,cAAc,GAAG,SAAS,CAAC;IACxD,0BAA0B,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAC;IAC1D,uDAAuD;IACvD,kBAAkB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC;IAC9D,oEAAoE;IACpE,qBAAqB,CACpB,OAAO,EAAE,uBAAuB,GAC9B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;IAClF,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7E,8BAA8B,IAAI,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClG,oBAAoB,IAAI,UAAU,EAAE,CAAC;IACrC,uBAAuB,IAAI,WAAW,EAAE,CAAC;IACzC;0EACsE;IACtE,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC/D,sEAAsE;IACtE,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/F;sGACkG;IAClG,eAAe,CAAC,IAAI,EAAE;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnH,qFAAqF;IACrF,yBAAyB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACpD,8EAA8E;IAC9E,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC1F;kGAC8F;IAC9F,eAAe,CACd,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAClE,MAAM,GAAG,SAAS,CAAC;IACtB;;;mEAG+D;IAC/D,oBAAoB,IAAI,iBAAiB,GAAG,SAAS,CAAC;IAEtD,uFAAuF;IACvF,0BAA0B,IAAI,YAAY,CAAC;IAC3C,eAAe,IAAI,YAAY,GAAG,SAAS,CAAC;IAE5C,0FAA0F;IAC1F,WAAW,IAAI,OAAO,CAAC;IACvB,YAAY,IAAI,OAAO,CAAC;IAExB,iFAAiF;IACjF,qBAAqB,IAAI,kBAAkB,GAAG,SAAS,CAAC;IACxD,iCAAiC,IAAI,8BAA8B,GAAG,SAAS,CAAC;IAChF,2BAA2B,IAAI,eAAe,GAAG,SAAS,CAAC;IAC3D,yBAAyB,IAAI,sBAAsB,GAAG,SAAS,CAAC;IAEhE;;;;;;;;;OASG;IACH,sBAAsB,CAAC,IAAI,IAAI,CAAC;CAChC;AAQD;;;GAGG;AACH,qBAAa,cAAc;IAE1B,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,gBAAgB,CAA+C;IACvE,OAAO,CAAC,mBAAmB,CAAkC;IAC7D,OAAO,CAAC,qBAAqB,CAAoC;IACjE,OAAO,CAAC,oBAAoB,CAA0C;IACtE,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAqB;IACjE,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,~~YAAY~~,~~CAAc~~;~~IAC3C~~,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA+B;IAEpE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAE1C,YAAY,IAAI,EAAE,kBAAkB,~~EAUnC~~;IAED;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;YAmCjB,gBAAgB;~~IA+B9B~~,mEAAmE;IACnE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,2EAA2E;IAC3E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAErD;IAED,6DAA6D;IAC7D,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErD;IAED,gEAAgE;IAChE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAE1D;IAED;;OAEG;IACH,WAAW,IAAI,QAAQ,EAAE,CAQxB;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE1D;IAED,0FAA0F;IAC1F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,~~CAEvB~~;IAED,mBAAmB,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,~~CA2JtG~~;IAED,OAAO,CAAC,4BAA4B;IA6BpC,OAAO,CAAC,6BAA6B;IAsCrC,OAAO,CAAC,oBAAoB;IA2B5B,YAAY,CAAC,OAAO,EAAE;QACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;QAC3C,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,OAAO,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,~~CA2W3B~~;IAED,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAWtB;YAEa,oBAAoB;IAmBlC;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;YAchB,WAAW;IAiGzB;;;;;OAKG;IACG,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ9D;YAEa,oBAAoB;IAoElC;;;;;OAKG;IACG,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5D;YAEa,kBAAkB;YA4ClB,gBAAgB;IAQ9B,OAAO,CAAC,2BAA2B;YAMrB,4BAA4B;IAQ1C;;;;OAIG;IACG,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CA+C/C;CACD;AAED,wBAAsB,iBAAiB,CACtC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,GAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,OAAqB,EAC9D,oBAAoB,CAAC,EAAE,OAAO;;;;;;;;;;;;GAuD9B"}
1	+ {"version":3,"file":"runtime-builder.d.ts","sourceRoot":"","sources":["../../src/core/runtime-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAiB,MAAM,2BAA2B,CAAC;AAC7G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,KAAK,EACX,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC/G,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,8BAA8B,EACnC,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,QAAQ,EAEb,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAElF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAO3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAEN,KAAK,6BAA6B,EAClC,KAAK,eAAe,EACpB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA4B5D,OAAO,EAAgC,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAW/F;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAOvG;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,cAAc,GAAG,SAAS,GAAG,eAAe,EAAE,CAMpG;AAED,6GAA6G;AAC7G,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACrB,GAAG,uBAAuB,CAU1B;AAwBD,MAAM,WAAW,kBAAkB;IAClC,kGAAkG;IAClG,QAAQ,IAAI,KAAK,CAAC;IAClB,sFAAsF;IACtF,MAAM,IAAI,MAAM,CAAC;IACjB,gGAAgG;IAChG,kBAAkB,IAAI,MAAM,CAAC;IAC7B,gEAAgE;IAChE,WAAW,IAAI,MAAM,CAAC;IACtB,mDAAmD;IACnD,iBAAiB,IAAI,cAAc,CAAC;IACpC,uFAAuF;IACvF,kBAAkB,IAAI,eAAe,CAAC;IACtC,sFAAsF;IACtF,gBAAgB,IAAI,aAAa,CAAC;IAClC,4DAA4D;IAC5D,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IAC7C,2FAA2F;IAC3F,iBAAiB,IAAI,cAAc,CAAC;IAEpC,qDAAqD;IACrD,kBAAkB,IAAI,eAAe,CAAC;IACtC,+GAA+G;IAC/G,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAClD,qFAAqF;IACrF,mBAAmB,IAAI,MAAM,CAAC;IAC9B,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1C,mFAAmF;IACnF,cAAc,IAAI,cAAc,EAAE,CAAC;IACnC,mGAAmG;IACnG,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;IAC9D,6GAA6G;IAC7G,2BAA2B,IAAI,MAAM,EAAE,GAAG,SAAS,CAAC;IACpD,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAE/D,2GAA2G;IAC3G,oBAAoB,IAAI,QAAQ,CAAC,6BAA6B,CAAC,GAAG,SAAS,CAAC;IAC5E,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,6BAA6B,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC;IACxF,mBAAmB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAC/C,2FAA2F;IAC3F,uBAAuB,CAAC,IAAI,oBAAoB,GAAG,SAAS,CAAC;IAC7D,oBAAoB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAChD,sFAAsF;IACtF,uBAAuB,IAAI,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IACnE,oGAAoG;IACpG,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvD,4FAA4F;IAC5F,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACrG,kHAAkH;IAClH,0BAA0B,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,0BAA0B,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACnH,6EAA6E;IAC7E,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtD,2BAA2B,IAAI,MAAM,EAAE,CAAC;IACxC,iCAAiC,IAAI,2BAA2B,CAAC;IACjE,kCAAkC,CAAC,QAAQ,EAAE,2BAA2B,GAAG,IAAI,CAAC;IAEhF,oGAAoG;IACpG,kBAAkB,IAAI,MAAM,EAAE,CAAC;IAC/B,+GAA+G;IAC/G,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChD,wFAAwF;IACxF,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IACrE,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;IAEtE,0GAA0G;IAC1G,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IACjD,qFAAqF;IACrF,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IACtD,yEAAyE;IACzE,6BAA6B,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,yFAAyF;IACzF,iCAAiC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,4EAA4E;IAC5E,uBAAuB,IAAI,IAAI,CAAC;IAEhC,2HAA2H;IAC3H,oBAAoB,IAAI,aAAa,CAAC;IACtC,sGAAsG;IACtG,uBAAuB,CAAC,IAAI,oBAAoB,CAAC;IACjD,oFAAoF;IACpF,oBAAoB,IAAI,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,GAAG,SAAS,CAAC;IAE7E,kEAAkE;IAClE,gBAAgB,IAAI,aAAa,CAAC;IAClC,qFAAqF;IACrF,yBAAyB,IAAI;QAAE,SAAS,EAAE,0BAA0B,CAAC;QAAC,eAAe,EAAE,2BAA2B,CAAA;KAAE,CAAC;IACrH,6FAA6F;IAC7F,2BAA2B,IAAI,IAAI,CAAC;IACpC,0BAA0B,IAAI,8BAA8B,CAAC;IAC7D,2BAA2B,CAAC,QAAQ,EAAE,8BAA8B,GAAG,IAAI,CAAC;IAC5E,wEAAwE;IACxE,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC,iCAAiC;IACjC,oBAAoB,IAAI,SAAS,GAAG,SAAS,CAAC;IAC9C,qBAAqB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAAC;IAC9E,wCAAwC;IACxC,yBAAyB,IAAI,cAAc,GAAG,SAAS,CAAC;IACxD,0BAA0B,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAC;IAC1D,uDAAuD;IACvD,kBAAkB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC;IAC9D,oEAAoE;IACpE,qBAAqB,CACpB,OAAO,EAAE,uBAAuB,GAC9B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;IAClF,kBAAkB,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7E,8BAA8B,IAAI,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClG,oBAAoB,IAAI,UAAU,EAAE,CAAC;IACrC,uBAAuB,IAAI,WAAW,EAAE,CAAC;IACzC;0EACsE;IACtE,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC/D,sEAAsE;IACtE,uBAAuB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/F;sGACkG;IAClG,eAAe,CAAC,IAAI,EAAE;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnH,qFAAqF;IACrF,yBAAyB,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IACpD,8EAA8E;IAC9E,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC1F;kGAC8F;IAC9F,eAAe,CACd,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAClE,MAAM,GAAG,SAAS,CAAC;IACtB;;;mEAG+D;IAC/D,oBAAoB,IAAI,iBAAiB,GAAG,SAAS,CAAC;IAEtD,uFAAuF;IACvF,0BAA0B,IAAI,YAAY,CAAC;IAC3C,eAAe,IAAI,YAAY,GAAG,SAAS,CAAC;IAE5C,0FAA0F;IAC1F,WAAW,IAAI,OAAO,CAAC;IACvB,YAAY,IAAI,OAAO,CAAC;IAExB,iFAAiF;IACjF,qBAAqB,IAAI,kBAAkB,GAAG,SAAS,CAAC;IACxD,iCAAiC,IAAI,8BAA8B,GAAG,SAAS,CAAC;IAChF,2BAA2B,IAAI,eAAe,GAAG,SAAS,CAAC;IAC3D,yBAAyB,IAAI,sBAAsB,GAAG,SAAS,CAAC;IAEhE;;;;;;;;;OASG;IACH,sBAAsB,CAAC,IAAI,IAAI,CAAC;CAChC;AAQD;;;GAGG;AACH,qBAAa,cAAc;IAE1B,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,gBAAgB,CAA+C;IACvE,OAAO,CAAC,mBAAmB,CAAkC;IAC7D,OAAO,CAAC,qBAAqB,CAAoC;IACjE,OAAO,CAAC,oBAAoB,CAA0C;IACtE,yGAAyG;IACzG,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAqB;IACjE,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IACvD,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAA6B;IACzE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA+B;IAEpE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAE1C,YAAY,IAAI,EAAE,kBAAkB,EAiBnC;IAED;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;YAmCjB,gBAAgB;IAuC9B,mEAAmE;IACnE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,2EAA2E;IAC3E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAErD;IAED,6DAA6D;IAC7D,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErD;IAED,gEAAgE;IAChE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAE1D;IAED;;OAEG;IACH,WAAW,IAAI,QAAQ,EAAE,CAQxB;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE1D;IAED,IAAI,iBAAiB,IAAI,iBAAiB,CAEzC;IAED,0FAA0F;IAC1F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAGvB;IAED,mBAAmB,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAmKtG;IAED,OAAO,CAAC,4BAA4B;IA6BpC,OAAO,CAAC,6BAA6B;IAsCrC,OAAO,CAAC,oBAAoB;IA2B5B,YAAY,CAAC,OAAO,EAAE;QACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;QAC3C,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,OAAO,CAAC,EAAE,sBAAsB,CAAC;KACjC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAgX3B;IAED,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAWtB;YAEa,oBAAoB;IAmBlC;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;YAchB,WAAW;IAiGzB;;;;;OAKG;IACG,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ9D;YAEa,oBAAoB;IAoElC;;;;;OAKG;IACG,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS5D;YAEa,kBAAkB;YA4ClB,gBAAgB;IAQ9B,OAAO,CAAC,2BAA2B;YAMrB,4BAA4B;IAQ1C;;;;OAIG;IACG,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CA+C/C;CACD;AAED,wBAAsB,iBAAiB,CACtC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,gBAAgB,GAAE,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,OAAqB,EAC9D,oBAAoB,CAAC,EAAE,OAAO;;;;;;;;;;;;GAuD9B"}

package/dist/core/runtime-builder.js CHANGED Viewed

@@ -34,6 +34,7 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
+import { managedSecretEnvDir, secretVaultFile } from "./agent-paths.js";
 import { DEFAULT_ACTIVE_TOOL_NAMES, mapToolNamesForPlatform } from "./default-tool-surface.js";
 import { acknowledgeWorkerClaimReview } from "./delegation/session-worker-claim.js";
 import { createCoreDiagnosticsToolDefinitions } from "./extensions/builtin.js";
@@ -47,8 +48,10 @@ import { ModelAdaptationStore } from "./models/adaptation-store.js";
 import { FitnessStore } from "./models/fitness-store.js";
 import { describeInFlightWorkUnit, getInFlightWorkUnits } from "./reload-blockers.js";
 import { ScoutController } from "./scout-controller.js";
-import { wrapToolWithCredentialExposureGuard } from "./secrets/credential-exposure-guard.js";
-import { SecretVault } from "./secrets/secret-vault.js";
+import { BitwardenCredentialStorage } from "./secrets/bitwarden-credential-storage.js";
+import { wrapToolWithCredentialExposureGuard, } from "./secrets/credential-exposure-guard.js";
+import { CredentialManager } from "./secrets/credential-manager.js";
+import { resolveCredentialProject } from "./secrets/credential-project.js";
 import { getSessionRole, isWorkerSession, WORKER_FORBIDDEN_TOOLS } from "./session-role.js";
 import { matchesResourceProfilePattern, } from "./settings-manager.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
@@ -133,13 +136,20 @@ export class RuntimeBuilder {
         this._explicitLiveExtensionPaths = new Set();
         this._reloadRequested = false;
         this.deps = deps;
-        this._secretVault = new SecretVault({
-            agentDir: deps.getAgentDir(),
+        this._credentialManager = new CredentialManager({
+            storage: new BitwardenCredentialStorage(),
+            resolveProject: resolveCredentialProject,
             onEnvironmentChanged: () => {
                 const sessionKey = deps.getShellSessionKey();
                 disposeShellExecutionSession(sessionKey);
             },
         });
+        this._credentialExposureBoundary = {
+            redactSensitiveText: (text) => this._credentialManager.redactSensitiveText(text),
+            // Data from the retired local vault remains protected even though it is no longer executable.
+            protectedFiles: [secretVaultFile(deps.getAgentDir())],
+            protectedDirectories: [managedSecretEnvDir(deps.getAgentDir())],
+        };
         this._fileMutationIntents = new FileMutationIntentController();
     }
     /**
@@ -192,9 +202,9 @@ export class RuntimeBuilder {
             resolveScoutModel: async () => resolveScoutModel(this.deps.getModelRegistry(), this.deps.getSettingsManager().getScoutSettings().model, this.deps.getAgentDir(), (model) => this.deps.isModelExhausted(model), resolveCurrentToolRepairSettings(this.deps.getSettingsManager().settings).textProtocol),
             getCwd: () => cwd,
             buildReadOnlyTools: (toolCwd) => [
-                wrapToolWithCredentialExposureGuard(createReadTool(toolCwd), toolCwd, this._secretVault),
-                wrapToolWithCredentialExposureGuard(createGrepTool(toolCwd, { artifactStore }), toolCwd, this._secretVault),
-                wrapToolWithCredentialExposureGuard(createFindTool(toolCwd, { artifactStore }), toolCwd, this._secretVault),
+                wrapToolWithCredentialExposureGuard(createReadTool(toolCwd), toolCwd, this._credentialExposureBoundary),
+                wrapToolWithCredentialExposureGuard(createGrepTool(toolCwd, { artifactStore }), toolCwd, this._credentialExposureBoundary),
+                wrapToolWithCredentialExposureGuard(createFindTool(toolCwd, { artifactStore }), toolCwd, this._credentialExposureBoundary),
             ],
             streamFn: this.deps.getAgent().streamFn,
             fileExists: (path) => existsSync(resolveCwdPath(cwd, path)),
@@ -236,8 +246,12 @@ export class RuntimeBuilder {
     getToolDefinition(name) {
         return this._toolDefinitions.get(name)?.definition;
     }
+    get credentialManager() {
+        return this._credentialManager;
+    }
     /** Release session-owned mutation payload leases retained by the write/edit tool pair. */
     dispose() {
+        this._credentialManager.lock();
         return this._fileMutationIntents.dispose();
     }
     refreshToolRegistry(options) {
@@ -302,11 +316,11 @@ export class RuntimeBuilder {
             sourceInfo: createSyntheticSourceInfo(`<builtin:${definition.name}>`, { source: "builtin" }),
         })), runner);
         const toolRegistry = new Map(wrappedBuiltInTools.map((tool) => {
-            const guarded = wrapToolWithCredentialExposureGuard(tool, this.deps.getCwd(), this._secretVault);
+            const guarded = wrapToolWithCredentialExposureGuard(tool, this.deps.getCwd(), this._credentialExposureBoundary);
             return [guarded.name, guarded];
         }));
         for (const tool of wrappedExtensionTools) {
-            const guarded = wrapToolWithCredentialExposureGuard(tool, this.deps.getCwd(), this._secretVault);
+            const guarded = wrapToolWithCredentialExposureGuard(tool, this.deps.getCwd(), this._credentialExposureBoundary);
             toolRegistry.set(guarded.name, guarded);
         }
         this._toolRegistry = toolRegistry;
@@ -481,12 +495,16 @@ export class RuntimeBuilder {
                 shellPath,
                 sessionKey: this.deps.getShellSessionKey(),
                 platform: process.platform,
-                spawnHook: (context) => ({
-                    ...context,
-                    env: { ...context.env, ...this._secretVault.getEnvironmentForCwd(context.cwd) },
-                }),
+                spawnHook: (context) => {
+                    const env = { ...context.env, ...this._credentialManager.getEnvironmentForCwd(context.cwd) };
+                    delete env.BW_SESSION;
+                    return { ...context, env };
+                },
+            },
+            python: {
+                environment: (cwd) => this._credentialManager.getEnvironmentForCwd(cwd) ?? {},
+                omitEnvironmentVariables: ["BW_SESSION"],
             },
-            python: { environment: (cwd) => this._secretVault.getEnvironmentForCwd(cwd) },
             write: { intentController: this._fileMutationIntents },
             edit: { intentController: this._fileMutationIntents },
             grep: { artifactStore: toolArtifactStore },
@@ -520,6 +538,7 @@ export class RuntimeBuilder {
                     this._baseToolDefinitions.set("run_process", createRunProcessToolDefinition(this.deps.getCwd(), {
                         policy: orchestrationProfile.executionPolicy,
                         maxWallClockMs: orchestrationProfile.budget.maxWallClockMs ?? 0,
+                        environment: (cwd) => this._credentialManager.getEnvironmentForCwd(cwd) ?? {},
                     }));
                 }
             }
@@ -613,7 +632,7 @@ export class RuntimeBuilder {
                 this._baseToolDefinitions.set(askQuestionToolDefinition.name, askQuestionToolDefinition);
             }
             if (toolAccess.allows("secret_store")) {
-                const secretStoreToolDefinition = createSecretStoreToolDefinition({ vault: this._secretVault });
+                const secretStoreToolDefinition = createSecretStoreToolDefinition({ manager: this._credentialManager });
                 this._baseToolDefinitions.set(secretStoreToolDefinition.name, secretStoreToolDefinition);
             }
             if (toolAccess.allows("delegate")) {