@claudexor/schema 1.0.1 → 2.1.1

package/generated/RunTelemetry.schema.json

@@ -188,6 +188,119 @@
                 "default": null,
                 "description": "Model the harness stream actually reported; null when never disclosed (rendered as unverified, never guessed)."
               },
+              "auth_mode": {
+                "anyOf": [
+                  {
+                    "type": "string",
+                    "enum": [
+                      "local_session",
+                      "api_key",
+                      "unknown"
+                    ],
+                    "description": "Auth mode a route runs under: a native local session, an API key, or unknown."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Auth route the attempt actually ran under (local_session subscription vs api_key), disclosed by the adapter's typed started payload; null when never disclosed (treated as unknown, never guessed).",
+                "default": null
+              },
+              "auth_source": {
+                "anyOf": [
+                  {
+                    "type": "string",
+                    "enum": [
+                      "native_session",
+                      "oauth_token_env",
+                      "api_key_env",
+                      "api_key_flag",
+                      "provider_auth_file",
+                      "none"
+                    ],
+                    "description": "Concrete credential source used or probed by a harness."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Concrete credential source the attempt disclosed (native_session/api_key_env/...); null when never disclosed.",
+                "default": null
+              },
+              "profile_id": {
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "default": null,
+                "description": "Credential profile the attempt actually ran under (adapter-stamped); null = engine default or undisclosed."
+              },
+              "requested_model": {
+                "type": [
+                  "string",
+                  "null"
+                ],
+                "default": null,
+                "description": "Model hint the engine sent the attempt; null when the route ran on its default."
+              },
+              "request_requirements": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "capability": {
+                      "type": "string",
+                      "enum": [
+                        "browser",
+                        "path_deny"
+                      ]
+                    },
+                    "harness_id": {
+                      "type": "string",
+                      "minLength": 1
+                    },
+                    "eligible": {
+                      "type": "boolean"
+                    },
+                    "requested": {
+                      "type": "boolean"
+                    },
+                    "effective": {
+                      "type": "boolean"
+                    },
+                    "reason": {
+                      "type": "string",
+                      "enum": [
+                        "not_requested",
+                        "effective",
+                        "manifest_unsupported",
+                        "web_policy_off",
+                        "access_profile_incompatible",
+                        "postdiff_only"
+                      ]
+                    },
+                    "evidence_refs": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "default": []
+                    }
+                  },
+                  "required": [
+                    "capability",
+                    "harness_id",
+                    "eligible",
+                    "requested",
+                    "effective",
+                    "reason"
+                  ],
+                  "additionalProperties": false,
+                  "description": "Preflight resolution of one requested capability on one selected harness lane."
+                },
+                "default": [],
+                "description": "Per-lane requested/effective capability receipts computed at preflight; never inferred by surfaces."
+              },
               "web": {
                 "type": "object",
                 "properties": {
@@ -388,6 +501,50 @@
                 "additionalProperties": false,
                 "description": "Contract/outcome truth for one attempt; tool errors are tracked separately from deliverable production.",
                 "default": {}
+              },
+              "usage": {
+                "type": "object",
+                "properties": {
+                  "input_tokens": {
+                    "anyOf": [
+                      {
+                        "type": "integer",
+                        "minimum": 0
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "default": null
+                  },
+                  "output_tokens": {
+                    "anyOf": [
+                      {
+                        "type": "integer",
+                        "minimum": 0
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "default": null
+                  },
+                  "cached_input_tokens": {
+                    "anyOf": [
+                      {
+                        "type": "integer",
+                        "minimum": 0
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "default": null
+                  }
+                },
+                "additionalProperties": false,
+                "description": "Token usage summed from harness usage events; money is tracked separately in the budget ledger, not here. Each field is null until a harness reports it (cursor reports cost only; raw-api has no cached), so unreported never reads as 0. Do NOT sum into a grand total: codex cached is a subset of input while claude cached is disjoint from input.",
+                "default": {}
               }
             },
             "required": [
@@ -401,12 +558,135 @@
           "default": [],
           "description": "Per-attempt telemetry records."
         },
+        "request_requirements": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/RunTelemetry/properties/attempts/items/properties/request_requirements/items"
+          },
+          "default": [],
+          "description": "All selected-lane capability receipts for this run."
+        },
         "tool_warnings_total": {
           "type": "integer",
           "minimum": 0,
           "default": 0,
           "description": "Sum of attempt tool warnings; rendered separately from terminal state."
         },
+        "usage_totals": {
+          "$ref": "#/definitions/RunTelemetry/properties/attempts/items/properties/usage",
+          "default": {},
+          "description": "Token usage summed from harness usage events; money is tracked separately in the budget ledger, not here. Each field is null until a harness reports it (cursor reports cost only; raw-api has no cached), so unreported never reads as 0. Do NOT sum into a grand total: codex cached is a subset of input while claude cached is disjoint from input."
+        },
+        "auth_route": {
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "requested": {
+                  "type": "string",
+                  "enum": [
+                    "subscription",
+                    "api_key",
+                    "auto"
+                  ],
+                  "description": "Preferred auth route: subscription (native/OAuth session), api_key (a stored API key), or auto (engine picks subscription-first with policy fallback). A preference, not a secret."
+                },
+                "effective": {
+                  "anyOf": [
+                    {
+                      "$ref": "#/definitions/RunTelemetry/properties/attempts/items/properties/auth_mode/anyOf/0"
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ],
+                  "description": "Auth mode a route runs under: a native local session, an API key, or unknown.",
+                  "default": null
+                },
+                "source": {
+                  "anyOf": [
+                    {
+                      "$ref": "#/definitions/RunTelemetry/properties/attempts/items/properties/auth_source/anyOf/0"
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ],
+                  "description": "Concrete credential source used or probed by a harness.",
+                  "default": null
+                },
+                "reason": {
+                  "type": "string",
+                  "enum": [
+                    "as_requested",
+                    "native_first",
+                    "no_native_session_fallback",
+                    "requested_route_unavailable",
+                    "undisclosed"
+                  ],
+                  "description": "Deterministic reason for the effective auth route: as_requested, native_first (auto, INV-061), no_native_session_fallback (auto downgraded to api_key), requested_route_unavailable (explicit preference contradicted), or undisclosed."
+                },
+                "harness_id": {
+                  "type": [
+                    "string",
+                    "null"
+                  ],
+                  "default": null
+                },
+                "attempt_id": {
+                  "type": [
+                    "string",
+                    "null"
+                  ],
+                  "default": null
+                },
+                "profile_id": {
+                  "type": [
+                    "string",
+                    "null"
+                  ],
+                  "default": null,
+                  "description": "Credential profile the deciding attempt ran under; null = engine-default credentials."
+                },
+                "model_mismatch": {
+                  "anyOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "requested": {
+                          "type": "string"
+                        },
+                        "observed": {
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "requested",
+                        "observed"
+                      ],
+                      "additionalProperties": false
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ],
+                  "default": null,
+                  "description": "Requested-vs-observed model mismatch on the deciding attempt; null when they match or either side is unknown."
+                }
+              },
+              "required": [
+                "requested",
+                "reason"
+              ],
+              "additionalProperties": false
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "description": "Auth route receipt: requested preference, disclosed effective route/source, deterministic reason, and the disclosing attempt; surfaces project it verbatim."
+        },
         "generated_at": {
           "type": "string",
           "minLength": 1,

package/generated/SecretMetadata.schema.json

@@ -10,16 +10,13 @@
         },
         "backend": {
           "type": "string",
-          "enum": [
-            "keychain",
-            "file"
-          ],
-          "description": "Where the secret is stored: the OS keychain or a file store."
+          "const": "file",
+          "description": "Claudexor v2 file secret store."
         },
         "present": {
           "type": "boolean",
           "default": true,
-          "description": "Whether a value is actually stored."
+          "description": "Whether a value is stored."
         }
       },
       "required": [
@@ -27,7 +24,7 @@
         "backend"
       ],
       "additionalProperties": false,
-      "description": "Secret list row: name, storage backend, and presence — never the value."
+      "description": "Secret metadata; never the value."
     }
   },
   "$schema": "http://json-schema.org/draft-07/schema#"

package/generated/Session.schema.json

@@ -36,6 +36,20 @@
           "description": "How the session can be continued on its native CLI: resume_by_id when a native session id exists, none otherwise.",
           "default": "none"
         },
+        "profile_id": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1,
+              "description": "Non-empty identifier string."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Credential profile the vendor session was created under; resume never crosses profiles (null = engine-default credentials).",
+          "default": null
+        },
         "last_observed_model": {
           "type": [
             "string",

package/generated/SpecPack.schema.json

@@ -128,27 +128,138 @@
           "items": {
             "type": "object",
             "properties": {
-              "id": {
+              "program": {
                 "type": "string",
                 "minLength": 1,
-                "description": "Test command id."
+                "pattern": "\\S",
+                "description": "Executable invoked directly without an implicit shell."
+              },
+              "args": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "default": [],
+                "description": "Exact argv passed to the executable."
+              },
+              "cwd": {
+                "type": "string",
+                "description": "Optional project-relative working directory for the command."
               },
-              "command": {
+              "envAllowlist": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "minLength": 1,
+                  "pattern": "\\S",
+                  "description": "User-supplied string that must contain visible content, not just whitespace."
+                },
+                "default": [],
+                "description": "Non-secret parent environment names explicitly forwarded to the command."
+              },
+              "id": {
                 "type": "string",
-                "description": "Shell command executed as a deterministic gate."
+                "minLength": 1,
+                "description": "Test command id."
               },
               "required": {
                 "type": "boolean",
                 "default": true,
                 "description": "Whether this test must pass (vs advisory)."
+              },
+              "trust_required": {
+                "type": "boolean",
+                "default": false,
+                "description": "Whether this command originated in versioned project config."
+              },
+              "trust_grant": {
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "projectDigest": {
+                        "type": "string",
+                        "minLength": 1,
+                        "description": "Digest of the canonical project identity."
+                      },
+                      "configDigest": {
+                        "type": "string",
+                        "minLength": 1,
+                        "description": "Digest of the parsed versioned project config blob."
+                      },
+                      "commandDigest": {
+                        "type": "string",
+                        "minLength": 1,
+                        "description": "Digest of the canonical command invocation."
+                      },
+                      "executablePath": {
+                        "type": "string",
+                        "description": "Resolved executable path approved by the operator."
+                      },
+                      "executableDigest": {
+                        "type": "string",
+                        "minLength": 1,
+                        "description": "Digest of the resolved executable bytes."
+                      },
+                      "scriptPath": {
+                        "type": [
+                          "string",
+                          "null"
+                        ],
+                        "default": null,
+                        "description": "Resolved script path, when any."
+                      },
+                      "scriptDigest": {
+                        "anyOf": [
+                          {
+                            "type": "string",
+                            "minLength": 1,
+                            "description": "Content hash in algo:hex form, e.g. \"sha256:abcd...\"."
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ],
+                        "description": "Digest of the script bytes.",
+                        "default": null
+                      },
+                      "accessProfile": {
+                        "type": "string",
+                        "enum": [
+                          "readonly",
+                          "workspace_write",
+                          "full",
+                          "external_sandbox_full",
+                          "inherit_native"
+                        ],
+                        "description": "Effective access profile covered by this grant."
+                      }
+                    },
+                    "required": [
+                      "projectDigest",
+                      "configDigest",
+                      "commandDigest",
+                      "executablePath",
+                      "executableDigest",
+                      "accessProfile"
+                    ],
+                    "additionalProperties": false,
+                    "description": "External exact grant for one versioned project test command."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Matching external grant; null when none was found.",
+                "default": null
               }
             },
             "required": [
-              "id",
-              "command"
+              "program",
+              "id"
             ],
             "additionalProperties": false,
-            "description": "A deterministic test command used as a verification gate."
+            "description": "A deterministic typed-argv test command used as a verification gate."
           },
           "default": [],
           "description": "Deterministic test commands frozen into the spec."