@cybedefend/vibedefend 1.4.7 → 1.6.0

package/dist/hooks/runtime/judge-triage.js

@@ -0,0 +1,193 @@
+/**
+ * Level 2 — local judge-routing gate (BACK-74 hardening).
+ *
+ * A PURE decision function that the PreToolUse hook integrator calls to decide
+ * WHETHER and HOW to consult the cloud LLM judge. It does NOT call the judge,
+ * touch the network, read the disk, or read the clock — it only maps a bundle
+ * of already-computed local signals to a route + an advisory model tier.
+ *
+ * It replaces the ad-hoc gating currently spread across guard-check.ts:
+ *   - `runJudgeStep`      decides confirm (overturn a regex `deny`), gated by
+ *                         a matched `llmJudgeEnabled` deny rule and the org hint.
+ *   - `runCatchJudgeStep` decides catch (recover a regex `allow`), gated by a
+ *                         deterministic near-miss pre-filter, the org hint, and
+ *                         a hard `severity !== 'critical'` exclusion.
+ *
+ * The new coverage this gate adds (per the hardening SPEC): the catch phase no
+ * longer fires only on a near-miss. A triage verdict of `suspect`/`dangerous`
+ * or an incompletely-parsed command (`NormalizeResult.incomplete`) is enough to
+ * escalate an `allow`/`warn` to the judge — that is where the measured false
+ * negatives (`/bin/rm -rf ~`, `find ~ -delete`, `echo <b64> | base64 -d | sh`,
+ * a written-then-executed script) get a second look. Critical rules stay OUT of
+ * catch by default (`catchIncludesCritical` opts them in) to preserve today's
+ * product default, while still surfacing a slug so the suppression is countable.
+ *
+ * Design rules (shared with the rest of the Level 0–2 work):
+ *   - PURE: no I/O, no network, no clock.
+ *   - NEVER THROWS: every input is guarded; a malformed field degrades toward
+ *     "look closer" / `small`, never toward a crash.
+ *   - DETERMINISTIC: the same input always yields the same decision and the
+ *     same ordered `reasons`.
+ *   - ADVISORY TIER: `tier` only hints which server model to use; the default
+ *     stays `small` so cost/latency are unchanged for the common case.
+ */
+/**
+ * Action-summary length (characters) above which we request the `large` model.
+ * A long action is harder to adjudicate on a glance and more likely to hide a
+ * dangerous tail past a benign head. Strict `>`: exactly the threshold stays
+ * `small`. Exported so tests pin the boundary against the constant, not a
+ * magic number.
+ */
+export const LARGE_ACTION_LENGTH = 400;
+/**
+ * Triage reason slugs that always justify the `large` model when the judge is
+ * consulted. These are the "high-stakes" families from the hardening SPEC:
+ *   - indirect-executable   — the executable came via `$X` / `$(which rm)`.
+ *   - encoded-pipe-to-shell — `echo <b64> | base64 -d | sh` and kin.
+ *   - read-then-exfil       — a secret read chained into an outbound send.
+ * Kept as its own set so adding a family is a one-line change with a test.
+ */
+export const HIGH_STAKES_TRIAGE_SLUGS = new Set([
+    'indirect-executable',
+    'encoded-pipe-to-shell',
+    'read-then-exfil',
+]);
+/**
+ * Compute the advisory model tier for a route that WILL consult the judge, and
+ * append the tier reason slugs to `reasons` (in a stable order). Never called
+ * for a `none` route, so `none` decisions never carry tier reasons and always
+ * report `small`.
+ *
+ * `large` when ANY of:
+ *   - the command could not be fully parsed (blindness → look harder),
+ *   - the aggregate severity is critical or high,
+ *   - the action summary is longer than `LARGE_ACTION_LENGTH`,
+ *   - a high-stakes triage slug is present.
+ * Otherwise `small` (the default that keeps the common case cheap).
+ */
+function computeTier(input, reasons) {
+    let large = false;
+    if (input.normalizeIncomplete) {
+        large = true;
+        reasons.push('tier-normalize-incomplete');
+    }
+    if (input.maxSeverity === 'critical' || input.maxSeverity === 'high') {
+        large = true;
+        reasons.push(`tier-severity-${input.maxSeverity}`);
+    }
+    // Guard a non-finite length defensively (contract says number; never throw).
+    const len = typeof input.actionLength === 'number' && Number.isFinite(input.actionLength)
+        ? input.actionLength
+        : 0;
+    if (len > LARGE_ACTION_LENGTH) {
+        large = true;
+        reasons.push('tier-action-length');
+    }
+    const triageReasons = Array.isArray(input.triageReasons)
+        ? input.triageReasons
+        : [];
+    for (const slug of triageReasons) {
+        if (HIGH_STAKES_TRIAGE_SLUGS.has(slug)) {
+            large = true;
+            reasons.push(`tier-high-stakes:${slug}`);
+        }
+    }
+    return large ? 'large' : 'small';
+}
+/**
+ * Decide whether and how to consult the cloud judge for one action.
+ *
+ * Branches, in evaluation order (each surfaced with a stable reason slug):
+ *
+ *  1. ORG HINT OFF (`org-judge-disabled`) → `none`.
+ *     Highest precedence, every verdict and every signal. The org opted out of
+ *     the judge entirely; nothing below can re-enable it. Mirrors the
+ *     `llmJudgeHint?.enabled === false` early return in BOTH guard-check steps.
+ *
+ *  2. VERDICT `deny` → the confirm (overturn-a-false-positive) path:
+ *     a. `hasJudgeEligibleDenyRule` → `confirm` (`deny-judge-eligible`).
+ *        Unchanged from today. Note it is NOT gated by severity (BACK-150
+ *        removed the critical gate for confirm — severity decides what the
+ *        CALLER does with an overturn, not whether the judge is consulted) nor
+ *        by the triage class: a regex `deny` that triage would call benign is a
+ *        disagreement for the judge to resolve, i.e. a prime false-positive to
+ *        overturn, so the triage-safe skip (branch 4) is deliberately NOT
+ *        applied here.
+ *     b. otherwise → `none` (`deny-no-eligible-rule`). The judge is only ever
+ *        shown deny rules that opted into it (`runJudgeStep`:
+ *        `if (llmRules.length === 0) return undefined`); with no such rule there
+ *        is nothing it could overturn, so we never pay for the call.
+ *
+ *  3. VERDICT `allow`/`warn` → the catch (recover-a-false-negative) path.
+ *     Collect escalation signals: triage `dangerous`/`suspect`, a near-miss,
+ *     or an incomplete parse. This is the NEW coverage — today catch fires only
+ *     on a near-miss; a `suspect`/`dangerous` triage or a parse the normalizer
+ *     could not finish now suffices.
+ *
+ *  4. NO ESCALATION SIGNAL (`triage-safe`) → `none`.
+ *     Reached only when the triage class is `safe` (the sole remaining class)
+ *     AND there is no near-miss and no incomplete parse. `safe` means
+ *     "known-benign; skip the network entirely" — we trust it here. Crucially,
+ *     a near-miss or an incomplete parse OVERRIDES a `safe` triage (they make
+ *     `signals` non-empty), because those are exactly the false negatives a
+ *     naive-verdict could hide and the SPEC's whole reason for this gate; a
+ *     `safe` verdict that nonetheless almost matched a deny rule, or came from a
+ *     command we could not fully read, is not trustworthy enough to skip.
+ *
+ *  5. CRITICAL SUPPRESSION (catch only). When the catch would fire on a
+ *     critical-severity action (`maxSeverity === 'critical'` — the only
+ *     severity signal this pure function has, standing in for today's
+ *     per-candidate `severity !== 'critical'` exclusion):
+ *       - flag off → `none`, but still surface `catch-critical-suppressed` so
+ *         the integrator can log/measure what the current product default drops.
+ *       - flag on  → `catch` (`catch-critical-included`).
+ *     The escalation signals are already in `reasons` either way, so a
+ *     suppressed decision records what WOULD have fired.
+ *
+ *  6. Otherwise → `catch`.
+ */
+export function decideJudgeRoute(input) {
+    const reasons = [];
+    // 1. Org hint off → never judge (overrides every verdict and signal).
+    if (!input.orgJudgeEnabled) {
+        reasons.push('org-judge-disabled');
+        return { route: 'none', tier: 'small', reasons };
+    }
+    // 2. Deny → confirm (overturn a false positive). Triage/severity do not gate
+    //    this; only a judge-eligible deny rule does.
+    if (input.verdict === 'deny') {
+        if (input.hasJudgeEligibleDenyRule) {
+            reasons.push('deny-judge-eligible');
+            return { route: 'confirm', tier: computeTier(input, reasons), reasons };
+        }
+        reasons.push('deny-no-eligible-rule');
+        return { route: 'none', tier: 'small', reasons };
+    }
+    // 3. Allow / warn → catch. Collect escalation signals.
+    const signals = [];
+    if (input.triageClass === 'dangerous')
+        signals.push('triage-dangerous');
+    if (input.triageClass === 'suspect')
+        signals.push('triage-suspect');
+    if (input.hasCatchNearMiss)
+        signals.push('catch-near-miss');
+    if (input.normalizeIncomplete)
+        signals.push('normalize-incomplete');
+    // 4. No escalation signal → trust a `safe` triage and skip the network.
+    if (signals.length === 0) {
+        reasons.push('triage-safe');
+        return { route: 'none', tier: 'small', reasons };
+    }
+    reasons.push(...signals);
+    // 5. Critical suppression (catch only).
+    if (input.maxSeverity === 'critical') {
+        if (!input.catchIncludesCritical) {
+            reasons.push('catch-critical-suppressed');
+            return { route: 'none', tier: 'small', reasons };
+        }
+        reasons.push('catch-critical-included');
+    }
+    // 6. Catch it.
+    return { route: 'catch', tier: computeTier(input, reasons), reasons };
+}
+//# sourceMappingURL=judge-triage.js.map

package/dist/hooks/runtime/judge-triage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge-triage.js","sourceRoot":"","sources":["../../../src/hooks/runtime/judge-triage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAoDH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IACnE,qBAAqB;IACrB,uBAAuB;IACvB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,SAAS,WAAW,CAAC,KAAyB,EAAE,OAAiB;IAC/D,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACrE,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,6EAA6E;IAC7E,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QAC3E,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,CAAC,CAAC;IACR,IAAI,GAAG,GAAG,mBAAmB,EAAE,CAAC;QAC9B,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;QACtD,CAAC,CAAC,KAAK,CAAC,aAAa;QACrB,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,sEAAsE;IACtE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,6EAA6E;IAC7E,iDAAiD;IACjD,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,wBAAwB,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,uDAAuD;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,mBAAmB;QAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAEpE,wEAAwE;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAEzB,wCAAwC;IACxC,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAED,eAAe;IACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;AACxE,CAAC"}

package/dist/hooks/runtime/judge.js

@@ -5,7 +5,9 @@ export function isJudgeBlocked(res) {
 const DEFAULT_TIMEOUT_MS = 1_500;
 export async function callJudge(input, opts = {}) {
     const f = opts.fetchImpl ?? globalThis.fetch;
-    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    // Precedence: an explicit opts.timeoutMs (tests) wins; else the caller's
+    // per-call `budgetMs` (Level 3 deep confirm uses a larger one); else default.
+    const timeoutMs = opts.timeoutMs ?? input.budgetMs ?? DEFAULT_TIMEOUT_MS;
     const url = `${input.apiBaseResolved}/project/${encodeURIComponent(input.projectId)}/action-guards/judge`;
     try {
         const res = await f(url, {
@@ -22,6 +24,8 @@ export async function callJudge(input, opts = {}) {
                 action_summary: input.actionSummary,
                 action_hash: input.actionHash,
                 rules: input.rules,
+                ...(input.tier ? { tier: input.tier } : {}),
+                ...(input.scripts && input.scripts.length > 0 ? { scripts: input.scripts } : {}),
             }),
             signal: AbortSignal.timeout(timeoutMs),
         });
@@ -43,6 +47,8 @@ export async function callJudge(input, opts = {}) {
                 ? data['quota_remaining']
                 : -1,
             quotaExceeded: Boolean(data['quota_exceeded']),
+            ...(typeof data['rule_id'] === 'string' && data['rule_id'] ? { ruleId: data['rule_id'] } : {}),
+            ...(data['fallback'] === true ? { fallback: true } : {}),
             ...(usageWarning ? { usageWarning } : {}),
         };
     }

package/dist/hooks/runtime/judge.js.map

@@ -1 +1 @@
-{"version":3,"file":"judge.js","sourceRoot":"","sources":["../../../src/hooks/runtime/judge.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,kBAAkB,CAAC;AAiD1B,MAAM,UAAU,cAAc,CAC5B,GAAsC;IAEtC,OAAO,GAAG,KAAK,IAAI,IAAI,SAAS,IAAI,GAAG,CAAC;AAC1C,CAAC;AAED,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAiB,EACjB,OAAoE,EAAE;IAEtE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,eAAe,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,sBAAsB,CAAC;IAE1G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS;gBAC/B,cAAc,EAAE,KAAK,CAAC,aAAa;gBACnC,WAAW,EAAE,KAAK,CAAC,UAAU;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC/C,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QACD,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAE3C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,IAAI,GAAI,IAAI,CAAC,IAAgC,IAAI,IAAI,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAE9D,OAAO;YACL,QAAQ;YACR,MAAM,EACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,EAAE;YACtE,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE;YACzE,cAAc,EACZ,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,QAAQ;gBACzC,CAAC,CAAE,IAAI,CAAC,iBAAiB,CAAY;gBACrC,CAAC,CAAC,CAAC,CAAC;YACR,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"judge.js","sourceRoot":"","sources":["../../../src/hooks/runtime/judge.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,kBAAkB,CAAC;AAmF1B,MAAM,UAAU,cAAc,CAC5B,GAAsC;IAEtC,OAAO,GAAG,KAAK,IAAI,IAAI,SAAS,IAAI,GAAG,CAAC;AAC1C,CAAC;AAED,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,KAAiB,EACjB,OAAoE,EAAE;IAEtE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,yEAAyE;IACzE,8EAA8E;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IACzE,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,eAAe,YAAY,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,sBAAsB,CAAC;IAE1G,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;gBACtC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,SAAS;gBAC/B,cAAc,EAAE,KAAK,CAAC,aAAa;gBACnC,WAAW,EAAE,KAAK,CAAC,UAAU;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC/C,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QACD,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAE3C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,IAAI,GAAI,IAAI,CAAC,IAAgC,IAAI,IAAI,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAE9D,OAAO;YACL,QAAQ;YACR,MAAM,EACJ,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,EAAE;YACtE,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE;YACzE,cAAc,EACZ,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,QAAQ;gBACzC,CAAC,CAAE,IAAI,CAAC,iBAAiB,CAAY;gBACrC,CAAC,CAAC,CAAC,CAAC;YACR,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC9C,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/hooks/runtime/pre-compact.js

@@ -3,25 +3,38 @@
  * before Claude Code summarises the conversation context. Catches long
  * sessions where the user keeps replying and Stop never fires.
  *
- * Only Claude Code, Cursor, and VS Code Copilot expose this event;
- * Windsurf and Codex don't have an equivalent (those clients' adapters
- * simply don't wire this subcommand).
+ * Claude Code, Cursor and VS Code Copilot wire this subcommand. Cursor and
+ * VS Code read no model-facing field on PreCompact, so it stops early there
+ * (see `hasModelChannel` in emit.ts).
  */
 import { sniff } from './sniff.js';
-import { emit } from './emit.js';
+import { emit, hasModelChannel } from './emit.js';
 import { loadRuntimeConfig, readStdinJson } from './config.js';
 import { DIRECT_PROPOSE_DIRECTIVES, resolveProposalMode, } from './proposal-mode.js';
+import { resolveProjectIdWithApi } from './resolve.js';
+import { isSessionInactive, sessionFolderOf, } from './session-activation.js';
 export async function preCompactHook(deps = {}) {
     const readStdin = deps.readStdin ?? readStdinJson;
     const loadConfig = deps.loadConfig ?? loadRuntimeConfig;
     const emitFn = deps.emitFn ?? emit;
     const stdin = await readStdin();
     const event = sniff(stdin);
+    // Cursor and VS Code read no model-facing field on PreCompact (see emit.ts):
+    // stop before the project lookup instead of writing text nobody reads.
+    if (!hasModelChannel(event.client, 'PreCompact'))
+        return;
     const config = loadConfig();
     if (!config)
         return;
     if (!config.hooks.enableSessionReview)
         return;
+    // Only in a folder that maps to a CybeDefend project (machine-wide hooks).
+    const folder = sessionFolderOf(stdin, event.client);
+    if (isSessionInactive(stdin, { store: deps.sessionStore, cwd: folder }))
+        return;
+    const { projectId } = await (deps.resolveProject ?? resolveProjectIdWithApi)(folder);
+    if (!projectId)
+        return;
     if (process.env.CYBEDEFEND_DRY_RUN === '1') {
         emitFn(`## 🛡️ CybeDefend PreCompact (dry-run, client=${event.client})\n`, event.client);
         return;
@@ -29,8 +42,10 @@ export async function preCompactHook(deps = {}) {
     const proposalMode = resolveProposalMode(config);
     const proposeStep = proposalMode === 'ask'
         ? [
-            '3. For uncovered concerns, ask the user via AskUserQuestion whether to propose;',
-            '   on "yes", call `cybe_rules_report_missing` with confirmed_by_user: true.',
+            '3. Only if one durable, reusable rule is missing,',
+            '   ask the user via AskUserQuestion whether to propose it; on "yes", call',
+            '   `cybe_rules_report_missing` with confirmed_by_user: true. If none is',
+            '   missing, do not ask.',
         ]
         : [`3. ${DIRECT_PROPOSE_DIRECTIVES[proposalMode]}`];
     const body = [

package/dist/hooks/runtime/pre-compact.js.map

@@ -1 +1 @@
-{"version":3,"file":"pre-compact.js","sourceRoot":"","sources":["../../../src/hooks/runtime/pre-compact.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAQ5B,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB;QAAE,OAAO;IAE9C,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC3C,MAAM,CACJ,iDAAiD,KAAK,CAAC,MAAM,KAAK,EAClE,KAAK,CAAC,MAAM,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,WAAW,GACf,YAAY,KAAK,KAAK;QACpB,CAAC,CAAC;YACE,iFAAiF;YACjF,6EAA6E;SAC9E;QACH,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG;QACX,2CAA2C;QAC3C,EAAE;QACF,uEAAuE;QACvE,8EAA8E;QAC9E,+DAA+D;QAC/D,2DAA2D;QAC3D,GAAG,WAAW;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"pre-compact.js","sourceRoot":"","sources":["../../../src/hooks/runtime/pre-compact.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAA0B,MAAM,cAAc,CAAC;AAC/E,OAAO,EACL,iBAAiB,EACjB,eAAe,GAEhB,MAAM,yBAAyB,CAAC;AAYjC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC;QAAE,OAAO;IAEzD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB;QAAE,OAAO;IAE9C,2EAA2E;IAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,iBAAiB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAE,OAAO;IAChF,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC3C,MAAM,CACJ,iDAAiD,KAAK,CAAC,MAAM,KAAK,EAClE,KAAK,CAAC,MAAM,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,WAAW,GACf,YAAY,KAAK,KAAK;QACpB,CAAC,CAAC;YACE,mDAAmD;YACnD,2EAA2E;YAC3E,yEAAyE;YACzE,yBAAyB;SAC1B;QACH,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG;QACX,2CAA2C;QAC3C,EAAE;QACF,uEAAuE;QACvE,8EAA8E;QAC9E,+DAA+D;QAC/D,2DAA2D;QAC3D,GAAG,WAAW;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC"}

package/dist/hooks/runtime/resolve.js

@@ -88,6 +88,11 @@ export function resolveProjectId(cwd = process.cwd(), deps = {}) {
  *
  * Windows: env var or login bundle only. Future improvement: `cmdkey /list`
  * → parse, or via a small PowerShell snippet.
+ *
+ * A keychain token whose recorded expiry is past is skipped (BACK-240 L2):
+ * handing it out only bought a 401 from the gateway on every hook call. A
+ * token that records no usable expiry (raw blob, field absent or 0) is
+ * still returned, as before (BACK-124).
  */
 export function resolveToken(mcpName, opts = {}) {
     const envToken = process.env.CYBEDEFEND_TOKEN;
@@ -100,8 +105,9 @@ export function resolveToken(mcpName, opts = {}) {
     const platform = opts.platform ?? process.platform;
     const readKeychain = opts.readKeychain ?? readMacOSKeychain;
     if (platform === 'darwin') {
-        return (resolveTokenMacOS(mcpName, opts.mcpUrl, readKeychain) ??
-            resolveTokenCodexMacOS(mcpName, opts.mcpUrl, readKeychain));
+        const now = (opts.now ?? Date.now)();
+        return (resolveTokenMacOS(mcpName, opts.mcpUrl, readKeychain, now) ??
+            resolveTokenCodexMacOS(mcpName, opts.mcpUrl, readKeychain, now));
     }
     if (platform === 'linux')
         return resolveTokenLinux(mcpName);
@@ -118,6 +124,19 @@ export function codexCredentialAccount(mcpName, mcpUrl) {
         .digest('hex');
     return `${mcpName}|${digest.slice(0, 16)}`;
 }
+/**
+ * Whether a keychain credential's recorded expiry is past. Claude Code and
+ * Codex record it in epoch milliseconds; a value below 1e11 can only be
+ * seconds (as milliseconds it would be 1973) and is read as such. Anything
+ * that is not a positive number records no expiry: never expired.
+ */
+function isExpired(expiresAt, now) {
+    if (typeof expiresAt !== 'number' || !Number.isFinite(expiresAt) || expiresAt <= 0) {
+        return false;
+    }
+    const expiresAtMs = expiresAt < 1e11 ? expiresAt * 1000 : expiresAt;
+    return now >= expiresAtMs;
+}
 function readMacOSKeychain(service, account) {
     try {
         const blob = execFileSync('security', [
@@ -137,7 +156,7 @@ function readMacOSKeychain(service, account) {
         return null;
     }
 }
-function resolveTokenMacOS(mcpName, mcpUrl, readKeychain) {
+function resolveTokenMacOS(mcpName, mcpUrl, readKeychain, now) {
     const blob = readKeychain('Claude Code-credentials');
     if (!blob)
         return null;
@@ -152,6 +171,10 @@ function resolveTokenMacOS(mcpName, mcpUrl, readKeychain) {
             if (mcpUrl && typeof entry.serverUrl === 'string' && entry.serverUrl !== mcpUrl) {
                 continue;
             }
+            // An expired token is no token: sent, it only earns a 401.
+            if (isExpired(entry.expiresAt, now)) {
+                continue;
+            }
             return entry.accessToken;
         }
     }
@@ -173,7 +196,7 @@ function resolveTokenMacOS(mcpName, mcpUrl, readKeychain) {
  * (`-s` without `-a`) returns whichever entry comes first, i.e. possibly
  * another server's token.
  */
-function resolveTokenCodexMacOS(mcpName, mcpUrl, readKeychain) {
+function resolveTokenCodexMacOS(mcpName, mcpUrl, readKeychain, now) {
     const accounts = mcpUrl
         ? [codexCredentialAccount(mcpName, mcpUrl), mcpName]
         : [mcpName];
@@ -181,15 +204,17 @@ function resolveTokenCodexMacOS(mcpName, mcpUrl, readKeychain) {
         const blob = readKeychain('Codex MCP Credentials', account);
         if (!blob)
             continue;
-        const token = parseCodexCredential(blob);
+        const token = parseCodexCredential(blob, now);
         if (token)
             return token;
     }
     return null;
 }
-function parseCodexCredential(blob) {
+function parseCodexCredential(blob, now) {
     try {
         const data = JSON.parse(blob);
+        if (isExpired(data.expires_at ?? data.expiresAt, now))
+            return null;
         return (data.token_response?.access_token ??
             data.access_token ??
             data.accessToken ??
@@ -235,6 +260,29 @@ function resolveTokenLinux(mcpName) {
  * Never throws — all errors are converted to null so hook callers remain
  * fail-open.
  */
+/**
+ * Is this JWT past its `exp`?
+ *
+ * Unverified on purpose: we are not authenticating anything here, we are
+ * deciding whether it is worth SENDING. A token whose own claim says it died
+ * cannot be made alive by checking its signature.
+ *
+ * Anything unparseable answers `false` — an opaque token is not evidence of
+ * expiry, and refusing it would break every non-JWT credential.
+ */
+function isExpiredJwt(token) {
+    const payload = token.split('.')[1];
+    if (!payload)
+        return false;
+    try {
+        const json = Buffer.from(payload, 'base64url').toString('utf8');
+        const exp = JSON.parse(json).exp;
+        return typeof exp === 'number' && exp * 1000 <= Date.now();
+    }
+    catch {
+        return false;
+    }
+}
 export async function resolveTokenWithRefresh(mcpName, deps = {}, 
 /** The region's MCP URL, handed to the legacy lookup (Codex account). */
 opts = {}) {
@@ -268,9 +316,35 @@ opts = {}) {
         // so a stale-but-unexpired legacy token can still be used.
     }
     // 3. Fall back to the synchronous legacy keychain lookup (pre-PKCE tokens).
-    return resolveTokenFn(mcpName, opts);
+    //
+    // ⚠️ An EXPIRED legacy token is treated as absent. Returning it produced the
+    // worst possible outcome: the caller sent it, got a bare `401 Token
+    // expired` from somewhere deep in a request chain, retried once with the
+    // same dead token, and reported a mysterious auth failure. The legacy slot
+    // has no refresh token, so nothing downstream could ever fix it — the only
+    // remedy is a fresh `vibedefend login`, and the user has to be told that
+    // rather than left to read a 401.
+    const legacy = resolveTokenFn(mcpName, opts);
+    if (legacy && isExpiredJwt(legacy)) {
+        process.stderr.write(`[vibedefend] the stored credential for "${mcpName}" has expired and cannot be ` +
+            'refreshed (no refresh token in the legacy store). Run `vibedefend login`.\n');
+        return null;
+    }
+    return legacy;
 }
 const RESOLVE_API_TIMEOUT_MS = 4_000;
+/**
+ * BACK-174 — effective activation mode: `CYBEDEFEND_ACTIVATION` (per shell)
+ * wins over the persisted `hooks.activation`; anything else is `auto`, which
+ * is also what a config written before this shipped means.
+ */
+export function resolveActivationMode(config) {
+    const env = process.env.CYBEDEFEND_ACTIVATION;
+    if (env === 'opt-in' || env === 'auto')
+        return env;
+    const hooks = config?.hooks;
+    return hooks?.activation === 'opt-in' ? 'opt-in' : 'auto';
+}
 /**
  * Async superset of {@link resolveProjectId} that adds a gateway
  * auto-discovery step for repos that haven't been `link`-ed yet.
@@ -297,15 +371,33 @@ export async function resolveProjectIdWithApi(cwd = process.cwd(), deps = {}) {
     // 1. env var / config.json projectId always wins — no git, no network.
     if (base.projectId)
         return base;
+    let repository;
+    const none = (inactiveReason) => ({
+        ...base,
+        inactiveReason,
+        ...(repository ? { repository } : {}),
+    });
+    // BACK-174 — opt-in mode: the explicit sources above are the ONLY sources.
+    // No origin lookup, and no repo-link cache either — the cache is a product
+    // of auto-discovery, so honouring it here would resurrect a repo the user
+    // stopped linking. Every hook goes through this function, so this one gate
+    // is what makes an un-linked repo a no-op end to end.
+    const config = (deps.loadConfig ?? loadRuntimeConfig)();
+    if (resolveActivationMode(config) === 'opt-in') {
+        return none('opt-in-not-linked');
+    }
     try {
         // 2. Need a parseable origin to build the cache key + query.
         const getOrigin = deps.getOrigin ?? getOriginRemote;
         const originUrl = getOrigin(cwd);
         if (!originUrl)
-            return base;
+            return none('no-git-origin');
         const remote = parseRemoteUrl(originUrl);
-        if (!remote || remote.provider === null)
-            return base;
+        if (!remote)
+            return none('unsupported-remote');
+        repository = `${remote.host}/${remote.slug}`;
+        if (remote.provider === null)
+            return none('unsupported-remote');
         const key = `${remote.provider}:${remote.host}:${remote.slug}`;
         // 3. Cache — fresh positive short-circuits, fresh negative suppresses.
         const cached = getCachedRepoLink(key, deps.cacheDeps);
@@ -313,23 +405,22 @@ export async function resolveProjectIdWithApi(cwd = process.cwd(), deps = {}) {
             return { projectId: cached.projectId, apiBase: base.apiBase };
         }
         if (cached.kind === 'negative') {
-            return base;
+            return none('no-linked-project');
         }
         // 4. Need config (apiBase + mcpName) and a token before we call out.
-        const config = (deps.loadConfig ?? loadRuntimeConfig)();
         if (!config)
-            return base;
+            return none('lookup-failed');
         const apiBase = base.apiBase ?? config.region.apiBase;
         const resolveTokenFn = deps.resolveTokenFn ?? resolveTokenWithRefresh;
         const token = await resolveTokenFn(config.region.mcpName);
         if (!token)
-            return base;
+            return none('not-signed-in');
         // 5. Gateway lookup (bounded).
         const resolveByRepo = deps.resolveByRepo ?? resolveProjectByRepository;
         const matches = await resolveByRepo(apiBase, token, { provider: remote.provider, slug: remote.slug, host: remote.host }, { timeoutMs: deps.timeoutMs ?? RESOLVE_API_TIMEOUT_MS });
         // Network / API error → null, WITHOUT caching (transient; retry next time).
         if (matches === null)
-            return base;
+            return none('lookup-failed');
         // 6. Exactly one enabled match is usable → positive cache (24h).
         if (matches.length === 1 && matches[0].vibedefendEnabled !== false) {
             const m = matches[0];
@@ -338,11 +429,11 @@ export async function resolveProjectIdWithApi(cwd = process.cwd(), deps = {}) {
         }
         // 0 / ≥2 matches, or a disabled project → negative cache (15m).
         writeCachedRepoLink(key, { negative: true }, deps.cacheDeps);
-        return base;
+        return none('no-linked-project');
     }
     catch {
         // Fail-open: any unexpected error yields no projectId, never throws.
-        return base;
+        return none('lookup-failed');
     }
 }
 //# sourceMappingURL=resolve.js.map

package/dist/hooks/runtime/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/hooks/runtime/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAmB,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAe/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAA6B,EAAE;IAE/B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACvD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,GAAG,0BAA0B,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;aACtD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,OAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAC5D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CACL,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;YACrD,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,OAAgB;IAC1D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CACvB,UAAU,EACV;YACE,uBAAuB;YACvB,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI;SACL,EACD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAe,EACf,MAA0B,EAC1B,YAA4B;IAE5B,MAAM,IAAI,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK3B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,UAAU,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW;gBAAE,SAAS;YAClE,gEAAgE;YAChE,2DAA2D;YAC3D,IAAI,MAAM,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,OAAO,KAAK,CAAC,WAAW,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gBAAgB;QAChB,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAC7B,OAAe,EACf,MAA0B,EAC1B,YAA4B;IAE5B,MAAM,QAAQ,GAAG,MAAM;QACrB,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QACpD,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK3B,CAAC;QACF,OAAO,CACL,IAAI,CAAC,cAAc,EAAE,YAAY;YACjC,IAAI,CAAC,YAAY;YACjB,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,KAAK;YACV,IAAI,CACL,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;QACpC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CACxB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,EACxD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,OAAyB,EAAE;AAC3B,yEAAyE;AACzE,OAA4B,EAAE;IAE9B,MAAM,qBAAqB,GAAG,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;IAC9E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IAE3D,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YACpC,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,uEAAuE;YACvE,mDAAmD;YACnD,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,wEAAwE;QACxE,2DAA2D;IAC7D,CAAC;IAED,4EAA4E;IAC5E,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AA+BD,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAAgC,EAAE;IAElC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE9B,uEAAuE;IACvE,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;QACpD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAE/D,uEAAuE;QACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qEAAqE;QACrE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,+BAA+B;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,0BAA0B,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,OAAO,EACP,KAAK,EACL,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACnE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,sBAAsB,EAAE,CACxD,CAAC;QACF,4EAA4E;QAC5E,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAElC,iEAAiE;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACnE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,mBAAmB,CACjB,GAAG,EACH,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,EAClE,IAAI,CAAC,SAAS,CACf,CAAC;YACF,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3D,CAAC;QAED,gEAAgE;QAChE,mBAAmB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/hooks/runtime/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAmB,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EACL,0BAA0B,GAE3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AA+C/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAA6B,EAAE;IAE/B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACvD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,GAAG,0BAA0B,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;aACtD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,OAA4B,EAAE;IAE9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC;IAC5D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,CACL,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC;YAC1D,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;SAClE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,SAAkB,EAAE,GAAW;IAChD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,OAAO,GAAG,IAAI,WAAW,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,OAAgB;IAC1D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CACvB,UAAU,EACV;YACE,uBAAuB;YACvB,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI;SACL,EACD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAe,EACf,MAA0B,EAC1B,YAA4B,EAC5B,GAAW;IAEX,MAAM,IAAI,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK3B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,UAAU,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW;gBAAE,SAAS;YAClE,gEAAgE;YAChE,2DAA2D;YAC3D,IAAI,MAAM,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,2DAA2D;YAC3D,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,OAAO,KAAK,CAAC,WAAW,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gBAAgB;QAChB,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAC7B,OAAe,EACf,MAA0B,EAC1B,YAA4B,EAC5B,GAAW;IAEX,MAAM,QAAQ,GAAG,MAAM;QACrB,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QACpD,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,GAAW;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAO3B,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,CACL,IAAI,CAAC,cAAc,EAAE,YAAY;YACjC,IAAI,CAAC,YAAY;YACjB,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,KAAK;YACV,IAAI,CACL,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;QACpC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CACxB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,EACxD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,GAAG,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC,GAAG,CAAC;QACxD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,OAAyB,EAAE;AAC3B,yEAAyE;AACzE,OAA4B,EAAE;IAE9B,MAAM,qBAAqB,GAAG,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;IAC9E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;IAE3D,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YACpC,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,qEAAqE;YACrE,0EAA0E;YAC1E,uEAAuE;YACvE,mDAAmD;YACnD,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,wEAAwE;QACxE,2DAA2D;IAC7D,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,6EAA6E;IAC7E,oEAAoE;IACpE,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,kCAAkC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,OAAO,8BAA8B;YAC9E,6EAA6E,CAChF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AA+BD,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAyE;IAEzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC9C,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,EAAE,KAA6C,CAAC;IACpE,OAAO,KAAK,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAAgC,EAAE;IAElC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAE9B,uEAAuE;IACvE,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,UAA8B,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,cAA8B,EAAqB,EAAE,CAAC,CAAC;QACnE,GAAG,IAAI;QACP,cAAc;QACd,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,sDAAsD;IACtD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC,EAAE,CAAC;IACxD,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;QACpD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC/C,UAAU,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEhE,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAE/D,uEAAuE;QACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnC,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAEzC,+BAA+B;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,0BAA0B,CAAC;QACvE,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,OAAO,EACP,KAAK,EACL,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EACnE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,sBAAsB,EAAE,CACxD,CAAC;QACF,4EAA4E;QAC5E,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAEnD,iEAAiE;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACnE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,mBAAmB,CACjB,GAAG,EACH,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,EAClE,IAAI,CAAC,SAAS,CACf,CAAC;YACF,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3D,CAAC;QAED,gEAAgE;QAChE,mBAAmB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/hooks/runtime/retry-policy.js

@@ -0,0 +1,57 @@
+/**
+ * When the hook may ask the gateway again after it said no (BACK-240 L2).
+ *
+ * A 401 means the token is rejected: asking again with the same token gets
+ * the same answer, so the hook waits 1, then 5, then 15 minutes between
+ * attempts. A new token (a refresh, a new login) is tried at once, which is
+ * why a failure records the fingerprint of the token that failed.
+ *
+ * Any other failure (5xx, 429, a timeout, no network) waits
+ * `TRANSIENT_RETRY_MS`, or the response's `Retry-After` when it asks for
+ * longer (at most `MAX_RETRY_AFTER_MS`): retrying on every tool call during
+ * an outage only adds load, and starts a process per call.
+ */
+import { createHash } from 'node:crypto';
+/** Wait after the 1st, 2nd, then 3rd and later consecutive 401. */
+export const UNAUTHORIZED_BACKOFF_MS = [
+    60_000,
+    5 * 60_000,
+    15 * 60_000,
+];
+/** Wait after a transient failure (same as the rules cache's `staleSec`). */
+export const TRANSIENT_RETRY_MS = 60_000;
+/** A `Retry-After` longer than this is capped. */
+export const MAX_RETRY_AFTER_MS = 60 * 60_000;
+/** Wait after a transient failure whose response asked for `retryAfterMs`. */
+export function transientRetryMs(retryAfterMs) {
+    if (retryAfterMs === undefined || !Number.isFinite(retryAfterMs)) {
+        return TRANSIENT_RETRY_MS;
+    }
+    return Math.min(Math.max(retryAfterMs, TRANSIENT_RETRY_MS), MAX_RETRY_AFTER_MS);
+}
+/**
+ * Read a `Retry-After` header (delay in seconds, or an HTTP date) as
+ * milliseconds from `now`. Undefined when absent or unreadable.
+ */
+export function parseRetryAfter(value, now = Date.now()) {
+    if (!value)
+        return undefined;
+    const trimmed = value.trim();
+    if (/^\d+$/.test(trimmed))
+        return Number(trimmed) * 1000;
+    const at = Date.parse(trimmed);
+    return Number.isFinite(at) ? Math.max(0, at - now) : undefined;
+}
+/** Wait before asking again after `consecutive` 401s in a row (1-based). */
+export function unauthorizedBackoffMs(consecutive) {
+    const index = Math.min(Math.max(consecutive, 1), UNAUTHORIZED_BACKOFF_MS.length) - 1;
+    return UNAUTHORIZED_BACKOFF_MS[index];
+}
+/**
+ * A short, one-way fingerprint of a bearer token: enough to tell the token
+ * that was refused from a new one, without writing the token to disk.
+ */
+export function tokenFingerprint(token) {
+    return createHash('sha256').update(token).digest('hex').slice(0, 16);
+}
+//# sourceMappingURL=retry-policy.js.map