@cleocode/core 2026.6.15 → 2026.6.17

package/dist/llm/plugin-facade.js

@@ -10804,6 +10804,22 @@ var init_operations_registry = __esm({
           }
         ]
       },
+      // ── selfimprove query: probe (T11988 — seeded-code-regression scenario) ────────
+      // Pure read-only op that returns `{ probe: 'ok', version: probeVersion() }`.
+      // The `probe-helper.ts` intentionally ships with `probeVersion()` returning `2`
+      // (should be `1`) so the seeded-code-regression scenario replay diverges from its
+      // golden (`version: 1`) and gives the fix-gen LLM stage a real, patchable bug.
+      {
+        gateway: "query",
+        domain: "selfimprove",
+        operation: "probe",
+        description: 'selfimprove.probe (query) \u2014 returns { probe: "ok", version: 1 } (health/version probe). Used by the seeded-code-regression scenario to validate the fix-gen pipeline (T11988).',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: []
+      },
       // ── selfimprove mutate: run (T11889 / T11889-D — the self-dogfooding loop) ──
       // Boots ONE sandbox → replays the named canned scenario → diffs result
       // envelopes vs the golden → on a regression emits ONE leased `selfimprove_dhq`
@@ -11417,6 +11433,31 @@ var init_operations_registry = __esm({
             cli: { positional: true }
           }
         ]
+      },
+      // T11995 — Janitor MVP: orphan process reaper + stale scope/lock/debris sweep
+      {
+        gateway: "mutate",
+        domain: "admin",
+        operation: "janitor.run",
+        description: "admin.janitor.run (mutate) \u2014 run the janitor sweep: reap orphan processes, stop dead cleo-owned scopes, reclaim stale locks, prune tmp debris",
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+          {
+            name: "dryRun",
+            type: "boolean",
+            required: false,
+            description: "Report planned actions without mutating anything."
+          },
+          {
+            name: "gracePeriodMs",
+            type: "number",
+            required: false,
+            description: "Minimum age (ms) of an unregistered process before reap eligibility (default: 600000)."
+          }
+        ]
       }
     ];
   }
@@ -42494,6 +42535,60 @@ function isInCooldown(credential) {
 function sortByPriorityDesc(entries) {
   return [...entries].sort((a, b) => b.priority - a.priority);
 }
+async function refreshExpiredOAuthForProvider(provider) {
+  const entries = await listCredentials(provider);
+  const now = Date.now();
+  let attempted = 0;
+  let refreshed = 0;
+  let lastError = null;
+  for (const entry of entries) {
+    if (entry.authType !== "oauth") continue;
+    if (!entry.refreshToken) continue;
+    if (entry.disabled === true) continue;
+    const isExpiredOrNearExpiry = typeof entry.expiresAt === "number" && entry.expiresAt > 0 && entry.expiresAt <= now + PROACTIVE_REFRESH_FLOOR_MS;
+    if (!isExpiredOrNearExpiry) continue;
+    const key = `${provider}::${entry.label}`;
+    const negExpiry = _refreshNegativeCache.get(key);
+    if (typeof negExpiry === "number" && now < negExpiry) {
+      attempted += 1;
+      lastError = lastError ?? new Error(
+        `OAuth refresh suppressed for ${provider}::${entry.label} (negative cache active)`
+      );
+      continue;
+    }
+    attempted += 1;
+    let inFlight = _refreshInFlight.get(key);
+    if (!inFlight) {
+      const pool = new CredentialPool(provider);
+      const expiresAtBefore = entry.expiresAt;
+      inFlight = pool.proactiveRefresh(entry.label).then(async (wasAttempted) => {
+        if (!wasAttempted) {
+          return true;
+        }
+        const after = await getCredentialByLabel(provider, entry.label);
+        const didAdvance = after !== null && typeof after.expiresAt === "number" && after.expiresAt > (expiresAtBefore ?? 0);
+        if (!didAdvance) {
+          throw new Error(
+            `OAuth refresh token exchange failed for ${provider}::${entry.label} \u2014 the stored token may be revoked. Run \`cleo login ${provider}\` to re-authenticate.`
+          );
+        }
+        return true;
+      }).finally(() => {
+        _refreshInFlight.delete(key);
+      });
+      _refreshInFlight.set(key, inFlight);
+    }
+    try {
+      await inFlight;
+      refreshed += 1;
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+      _refreshNegativeCache.set(key, Date.now() + REFRESH_NEGATIVE_CACHE_TTL_MS);
+    }
+  }
+  const actionableHint = attempted > 0 && refreshed === 0 && lastError !== null ? `OAuth refresh failed for provider '${provider}'. Run \`cleo login ${provider}\` to re-authenticate.` : null;
+  return { attempted, refreshed, lastError, actionableHint };
+}
 function debugLog(msg, ...rest) {
   if (process.env["CLEO_DEBUG"]) {
     console.debug(`[cleo:credential-pool] ${msg}`, ...rest);
@@ -42505,7 +42600,7 @@ function getCredentialPool() {
   }
   return _singleton;
 }
-var COOLDOWN_AUTH_MS, COOLDOWN_RATE_LIMIT_MS, COOLDOWN_DEFAULT_MS, PROACTIVE_REFRESH_FLOOR_MS, PoolExhaustedError, CredentialPool, POOL_SEED_CACHE_TTL_MS, UnifiedCredentialPool, _singleton;
+var COOLDOWN_AUTH_MS, COOLDOWN_RATE_LIMIT_MS, COOLDOWN_DEFAULT_MS, PROACTIVE_REFRESH_FLOOR_MS, PoolExhaustedError, _refreshInFlight, REFRESH_NEGATIVE_CACHE_TTL_MS, _refreshNegativeCache, CredentialPool, POOL_SEED_CACHE_TTL_MS, UnifiedCredentialPool, _singleton;
 var init_credential_pool = __esm({
   "packages/core/src/llm/credential-pool.ts"() {
     "use strict";
@@ -42542,6 +42637,9 @@ var init_credential_pool = __esm({
       /** Stable LAFS error code. */
       code = "E_LLM_POOL_EXHAUSTED";
     };
+    _refreshInFlight = /* @__PURE__ */ new Map();
+    REFRESH_NEGATIVE_CACHE_TTL_MS = 3e4;
+    _refreshNegativeCache = /* @__PURE__ */ new Map();
     CredentialPool = class {
       /**
        * @param provider - The LLM transport this pool manages.
@@ -75628,6 +75726,28 @@ function roleTierFor(role) {
 }
 async function selectBestProvisioned(role, opts) {
   const taskTier = roleTierFor(role);
+  for (const id of BUILTIN_PROVIDER_IDS) {
+    const creds = await listCredentials(id);
+    const hasExpiredOAuth = creds.some(
+      (c) => c.authType === "oauth" && c.refreshToken && typeof c.expiresAt === "number" && c.expiresAt > 0 && c.expiresAt <= Date.now()
+    );
+    if (!hasExpiredOAuth) continue;
+    try {
+      const result = await refreshExpiredOAuthForProvider(id);
+      if (result.actionableHint) {
+        logger4.warn(
+          { provider: id, hint: result.actionableHint },
+          "cross-provider-selector: OAuth refresh-on-use failed \u2014 credential will be excluded from resolution"
+        );
+      } else if (result.refreshed > 0) {
+        logger4.debug(
+          { provider: id, refreshed: result.refreshed },
+          "cross-provider-selector: renewed expired OAuth credential via refresh-on-use"
+        );
+      }
+    } catch {
+    }
+  }
   const provisionedIds = [];
   for (const id of BUILTIN_PROVIDER_IDS) {
     if (isProvisioned(id)) {
@@ -75724,6 +75844,7 @@ var init_cross_provider_selector = __esm({
   "packages/core/src/llm/cross-provider-selector.ts"() {
     "use strict";
     init_logger2();
+    init_credential_pool();
     init_credentials2();
     init_credentials_store();
     logger4 = getLogger("llm-cross-provider-selector");