@claudexor/core 1.0.0

package/dist/diff.js

@@ -0,0 +1,325 @@
+/**
+ * The ONE quote-aware unified-diff header parser. Three divergent parsers
+ * used to read patches: a regex in the orchestrator's diffStats that
+ * missed git-quoted headers (non-ASCII/spaces → protected-path and
+ * NEEDS_HUMAN gates silently skipped those files), a line-scan in the
+ * delivery gate that read `--- `-prefixed CONTENT lines as paths (SQL
+ * comments → false apply refusals), and a header tokenizer in
+ * context/evidence that never decoded octal escapes. All three rebase here.
+ *
+ * Structural rules, not regex governance: file metadata (`---`/`+++`,
+ * `rename from/to`, `new/deleted file mode`, binary markers) is honored only
+ * in HEADER position — between a `diff --git` line and that file's first
+ * `@@` hunk — so patch CONTENT can never masquerade as structure.
+ *
+ * PLAIN unified diffs (GNU `diff -ruN`, the workspace's non-git in-place
+ * fallback) have no `diff --git` anchors, so a document that opens with a
+ * plain file header is parsed in PLAIN mode: a file entry opens only on the
+ * full structural triple — a `--- ` line immediately followed by a `+++ `
+ * line and an `@@` hunk header — which keeps deleted `-- sql` content lines
+ * from masquerading as file boundaries. Without this mode every non-git
+ * in-place diff summarized to zero files, silently blinding diffstat and
+ * protected-path/risk gating for that whole run class. Inside a git-anchored
+ * document the git rules above apply unchanged (never mixed per document).
+ * Plain-mode entries default to modified (GNU diff marks absent files with
+ * epoch timestamps, not `/dev/null`, so added/deleted classification is
+ * honored only for explicit `/dev/null` headers) — conservative for gating:
+ * every touched path is visible to policy.
+ */
+/**
+ * Decode one git C-quoted path token: strips surrounding quotes and decodes
+ * `\ooo` octal byte escapes plus the standard single-char escapes, yielding
+ * the real on-disk path (utf8).
+ */
+export function cUnquoteGitPath(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed.startsWith('"') || !trimmed.endsWith('"') || trimmed.length < 2)
+        return trimmed;
+    const inner = trimmed.slice(1, -1);
+    const bytes = [];
+    let i = 0;
+    while (i < inner.length) {
+        const ch = inner[i];
+        if (ch !== "\\") {
+            const encoded = Buffer.from(ch, "utf8");
+            for (const b of encoded)
+                bytes.push(b);
+            i += 1;
+            continue;
+        }
+        const next = inner[i + 1] ?? "";
+        if (/[0-7]/.test(next)) {
+            let oct = "";
+            let j = i + 1;
+            while (j < inner.length && oct.length < 3 && /[0-7]/.test(inner[j])) {
+                oct += inner[j];
+                j += 1;
+            }
+            bytes.push(parseInt(oct, 8));
+            i = j;
+            continue;
+        }
+        const simple = { n: "\n", t: "\t", r: "\r", '"': '"', "\\": "\\", a: "\x07", b: "\b", f: "\f", v: "\v" };
+        bytes.push(...Buffer.from(simple[next] ?? next, "utf8"));
+        i += 2;
+    }
+    return Buffer.from(bytes).toString("utf8");
+}
+/** Split a `diff --git a/x b/x` remainder into its two path tokens (quote-aware). */
+function splitHeaderPaths(rest) {
+    const tokens = [];
+    let i = 0;
+    while (i < rest.length && tokens.length < 2) {
+        while (rest[i] === " ")
+            i += 1;
+        if (i >= rest.length)
+            break;
+        if (rest[i] === '"') {
+            let j = i + 1;
+            while (j < rest.length) {
+                if (rest[j] === "\\") {
+                    j += 2;
+                    continue;
+                }
+                if (rest[j] === '"')
+                    break;
+                j += 1;
+            }
+            tokens.push(cUnquoteGitPath(rest.slice(i, j + 1)));
+            i = j + 1;
+        }
+        else if (tokens.length === 0) {
+            // Unquoted a-path: paths may CONTAIN spaces without quoting when git
+            // can still tokenize them; the reliable boundary is the ` b/` splitter.
+            const bIdx = rest.indexOf(" b/", i);
+            if (bIdx < 0) {
+                const start = i;
+                while (i < rest.length && rest[i] !== " ")
+                    i += 1;
+                tokens.push(rest.slice(start, i));
+            }
+            else {
+                tokens.push(rest.slice(i, bIdx));
+                i = bIdx + 1;
+            }
+        }
+        else {
+            tokens.push(rest.slice(i).trim());
+            i = rest.length;
+        }
+    }
+    const [a, b] = tokens;
+    return a && b ? [a, b] : null;
+}
+const stripPrefix = (value, prefix) => value.startsWith(prefix) ? value.slice(prefix.length) : value;
+/** Strip the GNU-diff timestamp suffix (`\t2026-…`) from a plain header path. */
+function plainHeaderPath(raw) {
+    const tab = raw.indexOf("\t");
+    return cUnquoteGitPath(tab >= 0 ? raw.slice(0, tab) : raw);
+}
+export function parseUnifiedDiff(diff) {
+    const files = [];
+    let current = null;
+    /** Document-level mode, decided by the FIRST structural anchor seen. */
+    let plainDoc = null;
+    let inHunk = false;
+    let sawGitPayload = false;
+    let sawBinaryStub = false;
+    let additions = 0;
+    let deletions = 0;
+    let hunks = 0;
+    const flush = () => {
+        if (!current)
+            return;
+        if (current.binary)
+            current.binaryStub = sawBinaryStub && !sawGitPayload;
+        files.push(current);
+        current = null;
+        sawGitPayload = false;
+        sawBinaryStub = false;
+    };
+    const lines = diff.split("\n");
+    // A plain-mode file boundary is the full structural triple: `--- ` +
+    // `+++ ` + `@@` on consecutive lines. INSIDE a hunk the bar is higher:
+    // content could forge the loose triple (a deleted `-- …` line + an added
+    // `++ …` line + the next hunk header), so a mid-hunk boundary must also
+    // carry a header witness — the GNU tab-separated timestamp (or /dev/null)
+    // on both path lines, which +/- content lines do not have.
+    const headerWitness = (l) => l !== undefined && (l.includes("\t") || l.slice(4).trim() === "/dev/null");
+    const plainFileHeaderAt = (idx, midHunk) => {
+        const triple = (lines[idx]?.startsWith("--- ") ?? false) &&
+            (lines[idx + 1]?.startsWith("+++ ") ?? false) &&
+            (lines[idx + 2]?.startsWith("@@") ?? false);
+        if (!triple)
+            return false;
+        return midHunk ? headerWitness(lines[idx]) && headerWitness(lines[idx + 1]) : true;
+    };
+    for (let idx = 0; idx < lines.length; idx += 1) {
+        const line = lines[idx];
+        if (line.startsWith("diff --git ")) {
+            if (plainDoc === null)
+                plainDoc = false;
+            flush();
+            inHunk = false;
+            const paths = splitHeaderPaths(line.slice("diff --git ".length));
+            current = {
+                oldPath: paths ? stripPrefix(paths[0], "a/") : null,
+                newPath: paths ? stripPrefix(paths[1], "b/") : null,
+                added: false,
+                deleted: false,
+                renamed: false,
+                binary: false,
+                binaryStub: false,
+            };
+            continue;
+        }
+        // A GNU `diff <opts> old new` command echo (never emitted by git) or a
+        // top-level binary stub decides plain mode when it arrives first.
+        if (plainDoc === null && current === null && (line.startsWith("diff ") || (line.startsWith("Binary files ") && line.endsWith(" differ")))) {
+            plainDoc = true;
+        }
+        if (plainDoc !== false && (current === null || (plainDoc === true && inHunk)) && plainFileHeaderAt(idx, plainDoc === true && inHunk)) {
+            // Plain-mode file boundary: before any file, or right after the
+            // previous plain file's hunks (GNU diff concatenates files this way).
+            plainDoc = true;
+            flush();
+            inHunk = false;
+            const oldRaw = plainHeaderPath(line.slice(4));
+            const newRaw = plainHeaderPath(lines[idx + 1].slice(4));
+            // Same prefix convention as git headers: relativized plain diffs (the
+            // workspace non-git fallback) arrive as a/<rel> b/<rel> and must
+            // project the bare repo-relative path for policy globs.
+            current = {
+                oldPath: oldRaw === "/dev/null" ? null : stripPrefix(oldRaw, "a/"),
+                newPath: newRaw === "/dev/null" ? null : stripPrefix(newRaw, "b/"),
+                added: oldRaw === "/dev/null",
+                deleted: newRaw === "/dev/null",
+                renamed: false,
+                binary: false,
+                binaryStub: false,
+            };
+            idx += 1; // consume the `+++ ` line; the `@@` line is handled next.
+            continue;
+        }
+        if (plainDoc === true && line.startsWith("Binary files ") && line.endsWith(" differ")) {
+            // Plain binary stub arrives with no ---/+++ header of its own. Hunk
+            // content cannot forge this line: content lines always carry a
+            // ' '/'+'/'-' prefix, so a bare `Binary files … differ` is structural.
+            flush();
+            inHunk = false;
+            const body = line.slice("Binary files ".length, -" differ".length);
+            const sep = body.indexOf(" and ");
+            files.push({
+                oldPath: sep >= 0 ? stripPrefix(body.slice(0, sep), "a/") : null,
+                newPath: sep >= 0 ? stripPrefix(body.slice(sep + " and ".length), "b/") : null,
+                added: false,
+                deleted: false,
+                renamed: false,
+                binary: true,
+                binaryStub: true,
+            });
+            continue;
+        }
+        if (plainDoc === true && line.startsWith("diff ")) {
+            // GNU `diff -ruN old new` command line between files: a separator.
+            flush();
+            inHunk = false;
+            continue;
+        }
+        if (line.startsWith("@@")) {
+            inHunk = true;
+            hunks += 1;
+            continue;
+        }
+        if (current && !inHunk) {
+            // HEADER position only: content lines can never reach these branches.
+            if (line.startsWith("new file mode "))
+                current.added = true;
+            else if (line.startsWith("deleted file mode "))
+                current.deleted = true;
+            else if (line.startsWith("rename from ")) {
+                current.renamed = true;
+                current.oldPath = cUnquoteGitPath(line.slice("rename from ".length));
+            }
+            else if (line.startsWith("rename to ")) {
+                current.renamed = true;
+                current.newPath = cUnquoteGitPath(line.slice("rename to ".length));
+            }
+            else if (line.startsWith("--- ")) {
+                const raw = cUnquoteGitPath(line.slice(4));
+                if (raw === "/dev/null") {
+                    current.added = true;
+                    current.oldPath = null;
+                }
+                else {
+                    current.oldPath = stripPrefix(raw, "a/");
+                }
+            }
+            else if (line.startsWith("+++ ")) {
+                const raw = cUnquoteGitPath(line.slice(4));
+                if (raw === "/dev/null") {
+                    current.deleted = true;
+                    current.newPath = null;
+                }
+                else {
+                    current.newPath = stripPrefix(raw, "b/");
+                }
+            }
+            else if (line.startsWith("GIT binary patch")) {
+                current.binary = true;
+                sawGitPayload = true;
+            }
+            else if (line.startsWith("Binary files ") && line.endsWith(" differ")) {
+                current.binary = true;
+                sawBinaryStub = true;
+            }
+            continue;
+        }
+        if (inHunk) {
+            if (line.startsWith("+"))
+                additions += 1;
+            else if (line.startsWith("-"))
+                deletions += 1;
+        }
+    }
+    flush();
+    return { files, additions, deletions, hunks };
+}
+/**
+ * Path-oriented projection of a unified diff for policy/risk gating and
+ * diffstat honesty: which files the patch touches, which are NEW vs
+ * pre-existing, and the +/- counts. Quote-aware via parseUnifiedDiff — a
+ * git-quoted header (non-ASCII, spaces) must never silently DROP a file
+ * from protected-path/NEEDS_HUMAN classification.
+ */
+export function summarizeDiffPaths(diff) {
+    const parsed = parseUnifiedDiff(diff);
+    const paths = [];
+    const addedPaths = [];
+    const modifiedPaths = [];
+    const existingPaths = [];
+    for (const f of parsed.files) {
+        const path = f.newPath ?? f.oldPath;
+        if (!path)
+            continue;
+        paths.push(path);
+        if (f.added) {
+            addedPaths.push(path);
+        }
+        else {
+            modifiedPaths.push(path);
+            if (f.oldPath)
+                existingPaths.push(f.oldPath);
+            existingPaths.push(path);
+        }
+    }
+    return {
+        paths,
+        addedPaths,
+        modifiedPaths,
+        existingPaths: [...new Set(existingPaths)],
+        additions: parsed.additions,
+        deletions: parsed.deletions,
+    };
+}
+//# sourceMappingURL=diff.js.map

package/dist/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../src/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAuBH;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAC9B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,EAAE,CAAC;gBAC9E,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;gBAChB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QACjI,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM;QAC5B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACrB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,MAAM;gBAC3B,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,CAAC,CAAC;gBAChB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,IAAI,CAAC,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACjC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YACf,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAC5D,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAEhE,iFAAiF;AACjF,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,wEAAwE;IACxE,IAAI,QAAQ,GAAmB,IAAI,CAAC;IACpC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,UAAU,GAAG,aAAa,IAAI,CAAC,aAAa,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,aAAa,GAAG,KAAK,CAAC;QACtB,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,aAAa,GAAG,CAAC,CAAqB,EAAW,EAAE,CACvD,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC,CAAC;IAC7E,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,OAAgB,EAAW,EAAE;QACnE,MAAM,MAAM,GACV,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YACzC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAC7C,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC,CAAC;IAEF,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAW,CAAC;QAClC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,IAAI,QAAQ,KAAK,IAAI;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACxC,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,OAAO,GAAG;gBACR,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACnD,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACnD,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,KAAK;aAClB,CAAC;YACF,SAAS;QACX,CAAC;QACD,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1I,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,IAAI,iBAAiB,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC;YACrI,gEAAgE;YAChE,sEAAsE;YACtE,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,eAAe,CAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,sEAAsE;YACtE,iEAAiE;YACjE,wDAAwD;YACxD,OAAO,GAAG;gBACR,OAAO,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;gBAClE,OAAO,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;gBAClE,KAAK,EAAE,MAAM,KAAK,WAAW;gBAC7B,OAAO,EAAE,MAAM,KAAK,WAAW;gBAC/B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,KAAK;aAClB,CAAC;YACF,GAAG,IAAI,CAAC,CAAC,CAAC,0DAA0D;YACpE,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACtF,oEAAoE;YACpE,+DAA+D;YAC/D,uEAAuE;YACvE,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,KAAK,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBAChE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC9E,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,mEAAmE;YACnE,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,KAAK,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,sEAAsE;YACtE,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;iBACvD,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;gBAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;iBAClE,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,OAAO,CAAC,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;YACvE,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,OAAO,CAAC,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACrE,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3C,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;oBACxB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;oBACrB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3C,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;oBACxB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;oBACvB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,IAAI,CAAC,CAAC;iBACpC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,OAAO;gBAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK;QACL,UAAU;QACV,aAAa;QACb,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAC1C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/doctor.d.ts

@@ -0,0 +1,7 @@
+import type { ConformanceReport } from "@claudexor/schema";
+import type { AdapterRegistry, DoctorSpec } from "./adapter.js";
+/** Clear the doctor cache (call after auth/secrets/settings mutations). */
+export declare function invalidateDoctorCache(): void;
+/** Run conformance probes across all registered adapters; never throws. */
+export declare function runDoctor(adapters: AdapterRegistry, spec: DoctorSpec): Promise<ConformanceReport[]>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAwBhE,2EAA2E;AAC3E,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAkBD,2EAA2E;AAC3E,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAiC9B"}

package/dist/doctor.js

@@ -0,0 +1,75 @@
+import { createHash } from "node:crypto";
+/**
+ * Short-lived doctor cache. Real-harness `doctor()` is expensive (version probe,
+ * native-auth check, and — for the api-key route — a paid isolated smoke), and
+ * the orchestrator calls statusAll more than once per run (reviewers + candidates).
+ * Without a cache an `ask "2+2"` could pay multiple smokes before work starts.
+ * The TTL bounds staleness; mutating auth/secrets/settings should call
+ * `invalidateDoctorCache()` for an immediate refresh.
+ */
+const DOCTOR_TTL_MS = Number(process.env.CLAUDEXOR_DOCTOR_TTL_MS ?? 90_000);
+/**
+ * Non-OK results age out much faster: an out-of-band `codex login` /
+ * `claude /login` (which Claudexor cannot observe to invalidate) should become
+ * routable within seconds, not a full TTL. OK results keep the long TTL since
+ * readiness rarely degrades spontaneously and re-probing it is what costs money.
+ */
+const DOCTOR_NON_OK_TTL_MS = Number(process.env.CLAUDEXOR_DOCTOR_NON_OK_TTL_MS ?? 15_000);
+const doctorCache = new Map();
+/** Clear the doctor cache (call after auth/secrets/settings mutations). */
+export function invalidateDoctorCache() {
+    doctorCache.clear();
+}
+function doctorCacheKey(adapterId, spec) {
+    // The key covers EVERY spec field that can change a probe's outcome: cwd,
+    // the auth-route preference, and any scoped env overlay. Omitting them
+    // would let a scoped-route probe poison (or be served) the default-route
+    // report for the same cwd — a latent cross-route cache bug even though
+    // today's scoped callers bypass runDoctor. Env entries can carry key
+    // MATERIAL, so they enter the key only as a digest, never as plaintext.
+    const envDigest = spec.env
+        ? createHash("sha256")
+            .update(JSON.stringify(Object.entries(spec.env).sort(([a], [b]) => a.localeCompare(b))))
+            .digest("hex")
+            .slice(0, 16)
+        : "";
+    return `${adapterId}::${spec.cwd ?? ""}::${spec.authPreference ?? ""}::${envDigest}`;
+}
+/** Run conformance probes across all registered adapters; never throws. */
+export async function runDoctor(adapters, spec) {
+    const reports = [];
+    const now = Date.now();
+    for (const adapter of adapters.values()) {
+        // Fakes are cheap + deterministic and are reconfigured per test — never cache
+        // them (avoids cross-test contamination); only real adapters benefit.
+        const cacheable = DOCTOR_TTL_MS > 0 && !adapter.id.startsWith("fake");
+        const key = doctorCacheKey(adapter.id, spec);
+        if (cacheable) {
+            const hit = doctorCache.get(key);
+            const ttl = hit?.report.status === "ok" ? DOCTOR_TTL_MS : DOCTOR_NON_OK_TTL_MS;
+            if (hit && now - hit.at < ttl) {
+                reports.push(hit.report);
+                continue;
+            }
+        }
+        let report;
+        try {
+            report = await adapter.doctor(spec);
+        }
+        catch (err) {
+            report = {
+                harness_id: adapter.id,
+                status: "unavailable",
+                checks: [],
+                enabled_intents: [],
+                disabled_intents: [],
+                reasons: [err instanceof Error ? err.message : String(err)],
+            };
+        }
+        if (cacheable)
+            doctorCache.set(key, { report, at: now });
+        reports.push(report);
+    }
+    return reports;
+}
+//# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,CAAC,CAAC;AAC5E;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,MAAM,CAAC,CAAC;AAK1F,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;AAExD,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB;IACnC,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,IAAgB;IACzD,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG;QACxB,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;aACjB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACvF,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACjB,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,GAAG,SAAS,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,cAAc,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;AACvF,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAyB,EACzB,IAAgB;IAEhB,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,8EAA8E;QAC9E,sEAAsE;QACtE,MAAM,SAAS,GAAG,aAAa,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,GAAG,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAC/E,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG;gBACP,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,EAAE;gBACV,eAAe,EAAE,EAAE;gBACnB,gBAAgB,EAAE,EAAE;gBACpB,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aAC5D,CAAC;QACJ,CAAC;QACD,IAAI,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/effort.d.ts

@@ -0,0 +1,18 @@
+import type { EffortHint } from "@claudexor/schema";
+/**
+ * Map a requested reasoning-effort hint onto the nearest level a harness
+ * actually supports.
+ *
+ * - `requested` null/undefined → null (no effort was asked for; pass no flag).
+ * - `supported` empty → null (effort is NOT a tunable surface for this adapter;
+ *   it passes no effort flag at all — honest, not a silent clamp to a default).
+ * - `requested` exactly supported → returned unchanged.
+ * - otherwise CLAMP to the nearest supported level BY RANK: above the strongest
+ *   supported → the strongest; below the weakest → the weakest; in-between → the
+ *   closest by rank, ties resolving to the LOWER (cheaper) level.
+ *
+ * Pure and data-driven: the adapter feeds its own declared `effort_levels` and
+ * never hard-codes a clamp table.
+ */
+export declare function normalizeEffort(requested: EffortHint | null | undefined, supported: readonly EffortHint[]): EffortHint | null;
+//# sourceMappingURL=effort.d.ts.map

package/dist/effort.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effort.d.ts","sourceRoot":"","sources":["../src/effort.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAiBpD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,EACxC,SAAS,EAAE,SAAS,UAAU,EAAE,GAC/B,UAAU,GAAG,IAAI,CAiBnB"}

package/dist/effort.js

@@ -0,0 +1,49 @@
+import { EffortHint as EffortHintSchema } from "@claudexor/schema";
+/**
+ * The full cross-harness reasoning-effort ladder, ordered weakest→strongest.
+ * DERIVED from the EffortHint enum's declaration order (the single source) so the
+ * ladder can never drift from the enum: a future level (e.g. `ultra`) appended to
+ * the enum is automatically ranked and every adapter clamps it with no code
+ * change. An EffortHint's RANK is its index here; the normalizer below clamps any
+ * requested level onto the nearest level a given adapter actually supports.
+ */
+const EFFORT_LADDER = EffortHintSchema.options;
+function rank(level) {
+    return EFFORT_LADDER.indexOf(level);
+}
+/**
+ * Map a requested reasoning-effort hint onto the nearest level a harness
+ * actually supports.
+ *
+ * - `requested` null/undefined → null (no effort was asked for; pass no flag).
+ * - `supported` empty → null (effort is NOT a tunable surface for this adapter;
+ *   it passes no effort flag at all — honest, not a silent clamp to a default).
+ * - `requested` exactly supported → returned unchanged.
+ * - otherwise CLAMP to the nearest supported level BY RANK: above the strongest
+ *   supported → the strongest; below the weakest → the weakest; in-between → the
+ *   closest by rank, ties resolving to the LOWER (cheaper) level.
+ *
+ * Pure and data-driven: the adapter feeds its own declared `effort_levels` and
+ * never hard-codes a clamp table.
+ */
+export function normalizeEffort(requested, supported) {
+    if (requested === null || requested === undefined)
+        return null;
+    if (supported.length === 0)
+        return null;
+    if (supported.includes(requested))
+        return requested;
+    const want = rank(requested);
+    let best = null;
+    let bestDistance = Number.POSITIVE_INFINITY;
+    for (const level of supported) {
+        const distance = Math.abs(rank(level) - want);
+        // Strictly-closer wins; on a tie keep the LOWER-ranked (cheaper) candidate.
+        if (distance < bestDistance || (distance === bestDistance && best !== null && rank(level) < rank(best))) {
+            best = level;
+            bestDistance = distance;
+        }
+    }
+    return best;
+}
+//# sourceMappingURL=effort.js.map

package/dist/effort.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effort.js","sourceRoot":"","sources":["../src/effort.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,aAAa,GAA0B,gBAAgB,CAAC,OAAO,CAAC;AAEtE,SAAS,IAAI,CAAC,KAAiB;IAC7B,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAwC,EACxC,SAAgC;IAEhC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9C,4EAA4E;QAC5E,IAAI,QAAQ,GAAG,YAAY,IAAI,CAAC,QAAQ,KAAK,YAAY,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxG,IAAI,GAAG,KAAK,CAAC;YACb,YAAY,GAAG,QAAQ,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/env-scope.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Declarative env-scrub SSOT for harness children.
+ *
+ * Previously each adapter hand-rolled a partial denylist: codex scrubbed only
+ * OpenAI vars, claude only Anthropic/AWS/Google, cursor only its base-URL. The
+ * result was a cross-provider credential LEAK — a codex child inherited the
+ * user's `ANTHROPIC_API_KEY`, a claude child inherited `OPENAI_API_KEY`, etc.
+ *
+ * The contract is now uniform: scrub EVERY known provider credential / redirect
+ * env var from a harness child, then have the adapter re-add ONLY the single
+ * variable its chosen auth route legitimately needs (after the scrub). Base-URL
+ * redirects are always scrubbed so a redirect can never exfiltrate a seeded
+ * credential.
+ */
+export declare const PROVIDER_SECRET_ENV: readonly string[];
+/**
+ * Build an env patch (`{VAR: null}`) that scrubs every provider secret EXCEPT the
+ * ones in `keep` (the vars the adapter's chosen route legitimately uses, which it
+ * sets explicitly afterward). Apply this AFTER spreading `spec.env`.
+ */
+export declare function providerScrubEnv(keep?: readonly string[]): Record<string, null>;
+/**
+ * Minimal env an interactive CLI genuinely needs to run (locale, terminal, temp,
+ * and PATH to find its own binary + tools). Everything else is dropped under
+ * `env_inheritance: "clean"` — agent env isolation. Exact var values still come
+ * from the parent; only the KEY SET is restricted. Provider secrets are NOT in
+ * the allowlist (defense-in-depth on top of providerScrubEnv), and the adapter
+ * re-adds its single chosen credential explicitly afterward.
+ */
+export declare const CLEAN_ENV_ALLOWLIST: readonly string[];
+/**
+ * Build the base child env for a given inheritance mode. `mirror_native` copies
+ * the parent env (the native CLIs' default); `clean` copies only the minimal
+ * allowlist (agent isolation). The adapter's `spec.env` overrides + the
+ * providerScrubEnv patch are applied ON TOP of this by the spawn layer.
+ */
+export declare function composeBaseEnv(inheritance: "mirror_native" | "clean", source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=env-scope.d.ts.map

package/dist/env-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-scope.d.ts","sourceRoot":"","sources":["../src/env-scope.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EA6ChD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAOnF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAoChD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,eAAe,GAAG,OAAO,EACtC,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CASnB"}