@evalops/maestro 0.10.23 → 0.10.24

package/dist/providers/auth.js

@@ -12,7 +12,6 @@
  * |----------|------------------------------------------------|
  * | auto     | Try OAuth first, fallback to API keys (default)|
  * | api-key  | Only use API keys, skip OAuth                  |
- * | claude   | Only use Anthropic OAuth, fail if unavailable  |
  *
  * ## Credential Resolution Order
  *
@@ -29,8 +28,6 @@
  * | env                 | From environment variable                |
  * | custom_literal      | Hardcoded in custom provider config      |
  * | custom_env          | Env var from custom provider config      |
- * | anthropic_oauth_env | Anthropic OAuth token from env           |
- * | anthropic_oauth_file| Anthropic OAuth from stored credentials  |
  * | evalops_oauth_file  | EvalOps managed OAuth from stored credentials |
  * | openai_oauth_file   | OpenAI OAuth from stored credentials     |
  * | openai_codex_oauth_file | OpenAI Codex ChatGPT OAuth from stored credentials |
@@ -56,11 +53,6 @@ import { loadOAuthCredentials } from "../oauth/storage.js";
 import { lookupApiKey } from "./api-keys.js";
 import { getEvalOpsManagedProviderDefinition, isEvalOpsManagedGatewayEnabled, isEvalOpsManagedProvider, isKnownEvalOpsManagedProvider, } from "./evalops-managed.js";
 import { getFreshOpenAIOAuthCredential } from "./openai-auth.js";
-const ANTHROPIC_OAUTH_ENV_VARS = [
-    "CLAUDE_CODE_TOKEN",
-    "ANTHROPIC_OAUTH_TOKEN",
-    "ANTHROPIC_ACCESS_TOKEN",
-];
 function isOpenAIProvider(provider) {
     const normalized = provider.toLowerCase();
     return (normalized !== "openai-codex" &&
@@ -81,7 +73,7 @@ function isGitHubCopilotProvider(provider) {
 }
 function resolveEvalOpsCredentialType(provider) {
     return getEvalOpsManagedProviderDefinition(provider)?.usesAnthropicOAuth
-        ? "anthropic-oauth"
+        ? "bearer-token"
         : "api-key";
 }
 function isRecord(value) {
@@ -321,37 +313,6 @@ export function createAuthResolver(options) {
                 }
             }
         }
-        const preferAnthropicOAuth = normalizedProvider === "anthropic" && options.mode !== "api-key";
-        if (preferAnthropicOAuth) {
-            const envTokenEntry = ANTHROPIC_OAUTH_ENV_VARS.map((envVar) => ({
-                envVar,
-                token: process.env[envVar]?.trim(),
-            })).find((entry) => entry.token);
-            if (envTokenEntry?.token) {
-                return {
-                    provider,
-                    token: envTokenEntry.token,
-                    type: "anthropic-oauth",
-                    source: "anthropic_oauth_env",
-                    envVar: envTokenEntry.envVar,
-                };
-            }
-            // Try OAuth system (oauth.json)
-            const oauthToken = await getOAuthToken("anthropic");
-            if (oauthToken) {
-                const credentials = loadOAuthCredentials("anthropic");
-                return {
-                    provider,
-                    token: oauthToken,
-                    type: "anthropic-oauth",
-                    source: "anthropic_oauth_file",
-                    metadata: credentials?.metadata,
-                };
-            }
-            if (options.mode === "claude") {
-                return undefined;
-            }
-        }
         const lookup = lookupApiKey(provider, explicitKey);
         if (lookup.key) {
             if (lookup.source === "missing") {

package/dist/providers/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/providers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EACN,gCAAgC,EAChC,6BAA6B,EAC7B,cAAc,GACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACN,mCAAmC,EACnC,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAsCjE,MAAM,wBAAwB,GAAG;IAChC,mBAAmB;IACnB,uBAAuB;IACvB,wBAAwB;CACxB,CAAC;AAEF,SAAS,gBAAgB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,cAAc;QAC7B,CAAC,UAAU,KAAK,QAAQ;YACvB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAChC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAChC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,UAAU,KAAK,cAAc,CAAC;AACtC,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,mBAAmB,IAAI,UAAU,KAAK,oBAAoB,CACzE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACrD,OAAO,mCAAmC,CAAC,QAAQ,CAAC,EAAE,kBAAkB;QACvE,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAG,MAAiB;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB;IAC7C,OAAO,mBAAmB,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK;aACJ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC/D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,yBAAyB,CACjC,QAAgB,EAChB,QAAkC;IAElC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,IAAI,CAAC;IACR,MAAM,UAAU,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,kBAAkB,GACvB,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,gBAAgB,GACrB,CAAC,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,SAAS;QACzC,CAAC,CAAC,UAAU,CAAC,mBAAmB;QAChC,CAAC,CAAC,SAAS,CAAC;QACb,gBAAgB;QAChB,kBAAkB;QAClB,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,CAAC;IACV,MAAM,WAAW,GAChB,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,MAAM,CAAC;IACR,MAAM,cAAc,GACnB,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GACX,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO;QACN,QAAQ,EAAE,gBAAgB;QAC1B,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACrC,QAAkC;IAElC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,OAAO,GAAG,mBAAmB,CAClC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC,CAC9D,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CACxC,QAAQ,EAAE,KAAK,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,KAAK,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,CAAC,wBAAwB,CAAC,CAAC,CACxC,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CACrC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,EACtE,aAAa,CACb,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,IAAI,UAAU,CAAC;IAC1C,MAAM,iBAAiB,GAAG,mBAAmB,CAC5C,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,UAAU,EACpB,YAAY,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAC5C,CAAC;IACF,MAAM,gBAAgB,GAAG,mBAAmB,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,YAAY,CAAC,CAAC,oBAAoB,CAAC,CAAC,EACpC,iBAAiB,CACjB,CAAC;IACF,MAAM,SAAS,GAAG,iBAAiB,IAAI,gBAAgB,CAAC;IACxD,MAAM,WAAW,GAAG,mBAAmB,CACtC,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,mBAAmB,CACtC,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,CAAC;QACZ,2BAA2B;QAC3B,mCAAmC;KACnC,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAClC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,mBAAmB,CACnC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,SAAS,EACnB,YAAY,CAAC,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,YAAY,CAAC,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CACrC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,QAAQ,GAAG,mBAAmB,CACnC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC,CAC9D,CAAC;IACF,MAAM,OAAO,GACZ,mBAAmB,CAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,OAAO,EACjB,YAAY,CAAC,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,CAAC,CAC5D,IAAI,SAAS,CAAC;IAEhB,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE,OAAO;QACjB,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,UAAU;QACxB,iBAAiB,EAAE,MAAM;QACzB,UAAU,EAAE,SAAS;QACrB,kBAAkB,EAAE,gBAAgB;QACpC,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,MAAM;QACf,YAAY,EAAE,UAAU;QACxB,QAAQ;KACR,CAAC,CAAC,MAAM,CACR,CAAC,KAAK,EAA6B,EAAE,CACpC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC3D,CACD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC9B,QAAgB,EAChB,KAAa,EACb,MAA4B,EAC5B,QAAkC,EAClC,MAAe;IAEf,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO;QACN,QAAQ;QACR,KAAK;QACL,IAAI,EAAE,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,MAAM;QACN,MAAM;QACN,OAAO,EAAE;YACR,mBAAmB,EAAE,cAAc;SACnC;QACD,QAAQ;QACR,WAAW,EAAE;YACZ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ,CAAC;YACjD,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC;SAC3D;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,KAAK,EAAE,QAAgB,EAAuC,EAAE;QACtE,IACC,6BAA6B,CAAC,QAAQ,CAAC;YACvC,CAAC,8BAA8B,EAAE,EAChC,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QAED,IAAI,wBAAwB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACxE,IAAI,WAAW,EAAE,CAAC;gBACjB,OAAO,sBAAsB,CAC5B,QAAQ,EACR,WAAW,EACX,wBAAwB,EACxB,WAAW,EAAE,QAAQ,CACrB,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBAC7D,OAAO,sBAAsB,CAC5B,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EAAE,QAAQ,IAAI,WAAW,EAAE,QAAQ,CACvD,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;gBACzD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,yBAAyB;oBACjC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;oBACpE,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9D,eAAe;YACf,MAAM,SAAS,GAAG,MAAM,6BAA6B,EAAE,CAAC;YACxD,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;gBACvB,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,SAAS,CAAC,MAAM;oBACvB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,mBAAmB;oBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAClC,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;gBAC3D,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,2BAA2B;oBACnC,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,aAAa,GAClB,kBAAkB,KAAK,oBAAoB;gBAC1C,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,mBAAmB,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YACtD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBACxD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,SAAS,EAAE,CAAC;oBACf,OAAO;wBACN,QAAQ;wBACR,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;wBACvD,IAAI,EAAE,SAAS;wBACf,MAAM,EAAE,mBAAmB;wBAC3B,QAAQ,EAAE,WAAW,EAAE,QAAQ;qBAC/B,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,oBAAoB,GACzB,kBAAkB,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QAElE,IAAI,oBAAoB,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC/D,MAAM;gBACN,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;aAClC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,aAAa,EAAE,KAAK,EAAE,CAAC;gBAC1B,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,aAAa,CAAC,KAAK;oBAC1B,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,qBAAqB;oBAC7B,MAAM,EAAE,aAAa,CAAC,MAAM;iBAC5B,CAAC;YACH,CAAC;YAED,gCAAgC;YAChC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;gBACtD,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,sBAAsB;oBAC9B,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAC5B,QAAQ,EACR,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,MAAM,EACb,SAAS,EACT,MAAM,CAAC,MAAM,CACb,CAAC;YACH,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Authentication Resolver - Unified Credential Resolution\n *\n * This module provides a unified authentication resolver that handles\n * multiple credential sources and authentication modes for all supported\n * AI providers. It abstracts the complexity of OAuth, API keys, and\n * environment variables into a single interface.\n *\n * ## Authentication Modes\n *\n * | Mode     | Description                                    |\n * |----------|------------------------------------------------|\n * | auto     | Try OAuth first, fallback to API keys (default)|\n * | api-key  | Only use API keys, skip OAuth                  |\n * | claude   | Only use Anthropic OAuth, fail if unavailable  |\n *\n * ## Credential Resolution Order\n *\n * 1. **Explicit API key**: Passed directly via options\n * 2. **OAuth tokens**: Provider-specific OAuth flows (if mode allows)\n * 3. **Environment variables**: Standard env var lookup\n * 4. **Custom providers**: From models registry configuration\n *\n * ## Credential Sources\n *\n * | Source              | Description                              |\n * |---------------------|------------------------------------------|\n * | explicit            | Passed directly to resolver              |\n * | env                 | From environment variable                |\n * | custom_literal      | Hardcoded in custom provider config      |\n * | custom_env          | Env var from custom provider config      |\n * | anthropic_oauth_env | Anthropic OAuth token from env           |\n * | anthropic_oauth_file| Anthropic OAuth from stored credentials  |\n * | evalops_oauth_file  | EvalOps managed OAuth from stored credentials |\n * | openai_oauth_file   | OpenAI OAuth from stored credentials     |\n * | openai_codex_oauth_file | OpenAI Codex ChatGPT OAuth from stored credentials |\n * | google_oauth_file   | Google OAuth from stored credentials     |\n *\n * ## Example\n *\n * ```typescript\n * const resolver = createAuthResolver({ mode: 'auto' });\n * const credential = await resolver('anthropic');\n *\n * if (credential) {\n *   console.log(`Using ${credential.type} from ${credential.source}`);\n *   // Use credential.token for API requests\n * }\n * ```\n *\n * @module providers/auth\n */\n\nimport {\n\tEVALOPS_ORGANIZATION_ID_ENV_VARS,\n\tEVALOPS_WORKSPACE_ID_ENV_VARS,\n\treadEvalOpsEnv,\n} from \"../evalops/env-aliases.js\";\nimport { getOAuthToken } from \"../oauth/index.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { lookupApiKey } from \"./api-keys.js\";\nimport {\n\tgetEvalOpsManagedProviderDefinition,\n\tisEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedProvider,\n\tisKnownEvalOpsManagedProvider,\n} from \"./evalops-managed.js\";\nimport { getFreshOpenAIOAuthCredential } from \"./openai-auth.js\";\n\nexport type AuthMode = \"auto\" | \"api-key\" | \"claude\";\n\nexport type AuthCredentialType = \"api-key\" | \"anthropic-oauth\";\n\nexport type AuthCredentialSource =\n\t| \"explicit\"\n\t| \"env\"\n\t| \"custom_literal\"\n\t| \"custom_env\"\n\t| \"anthropic_oauth_env\"\n\t| \"anthropic_oauth_file\"\n\t| \"evalops_agent_key_file\"\n\t| \"evalops_oauth_file\"\n\t| \"openai_oauth_file\"\n\t| \"openai_codex_oauth_file\"\n\t| \"google_oauth_file\"\n\t| \"github_copilot_oauth_file\";\n\nexport interface AuthCredential {\n\tprovider: string;\n\ttoken: string;\n\ttype: AuthCredentialType;\n\tsource: AuthCredentialSource;\n\tenvVar?: string;\n\theaders?: Record<string, string>;\n\tmetadata?: Record<string, unknown>;\n\trequestBody?: Record<string, unknown>;\n}\n\nexport interface AuthResolverOptions {\n\tmode: AuthMode;\n\texplicitApiKey?: string;\n}\n\ntype AuthResolver = (provider: string) => Promise<AuthCredential | undefined>;\n\nconst ANTHROPIC_OAUTH_ENV_VARS = [\n\t\"CLAUDE_CODE_TOKEN\",\n\t\"ANTHROPIC_OAUTH_TOKEN\",\n\t\"ANTHROPIC_ACCESS_TOKEN\",\n];\n\nfunction isOpenAIProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized !== \"openai-codex\" &&\n\t\t(normalized === \"openai\" ||\n\t\t\tnormalized.startsWith(\"openai/\") ||\n\t\t\tnormalized.includes(\"openai-\"))\n\t);\n}\n\nfunction isOpenAICodexProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn normalized === \"openai-codex\";\n}\n\nfunction isGoogleGeminiCliProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized === \"google-gemini-cli\" || normalized === \"google-antigravity\"\n\t);\n}\n\nfunction isGitHubCopilotProvider(provider: string): boolean {\n\treturn provider.toLowerCase() === \"github-copilot\";\n}\n\nfunction resolveEvalOpsCredentialType(provider: string): AuthCredentialType {\n\treturn getEvalOpsManagedProviderDefinition(provider)?.usesAnthropicOAuth\n\t\t? \"anthropic-oauth\"\n\t\t: \"api-key\";\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getNonEmptyString(value: unknown): string | undefined {\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction firstNonEmptyString(...values: unknown[]): string | undefined {\n\tfor (const value of values) {\n\t\tconst candidate = getNonEmptyString(value);\n\t\tif (candidate) {\n\t\t\treturn candidate;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction readFirstEnv(names: readonly string[]): string | undefined {\n\treturn firstNonEmptyString(...names.map((name) => process.env[name]));\n}\n\nfunction getStringArray(value: unknown): string[] {\n\treturn Array.isArray(value)\n\t\t? value\n\t\t\t\t.map((entry) => (typeof entry === \"string\" ? entry.trim() : \"\"))\n\t\t\t\t.filter((entry) => entry.length > 0)\n\t\t: [];\n}\n\nfunction isFutureTimestamp(value: unknown): boolean {\n\tconst timestamp = getNonEmptyString(value);\n\treturn !timestamp || Date.parse(timestamp) > Date.now();\n}\n\nfunction resolveEvalOpsAgentMcpAPIKey(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst agentMcp = isRecord(metadata?.agentMcp) ? metadata.agentMcp : undefined;\n\tconst apiKey = getNonEmptyString(agentMcp?.apiKey);\n\tif (!apiKey || !isFutureTimestamp(agentMcp?.expiresAt)) {\n\t\treturn undefined;\n\t}\n\tconst scopes = getStringArray(agentMcp?.scopes);\n\tif (scopes.length > 0 && !scopes.includes(\"llm_gateway:invoke\")) {\n\t\treturn undefined;\n\t}\n\treturn apiKey;\n}\n\nfunction resolveEvalOpsOrganizationId(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst candidate = getNonEmptyString(metadata?.organizationId);\n\tif (candidate && candidate.trim().length > 0) {\n\t\treturn candidate.trim();\n\t}\n\treturn readEvalOpsEnv(process.env, EVALOPS_ORGANIZATION_ID_ENV_VARS);\n}\n\nfunction resolveEvalOpsProviderRef(\n\tprovider: string,\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: null;\n\tconst definition = getEvalOpsManagedProviderDefinition(provider);\n\tconst metadataProvider = getNonEmptyString(providerRef?.provider);\n\tconst configuredProvider =\n\t\tprocess.env.MAESTRO_EVALOPS_PROVIDER?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_PROVIDER?.trim();\n\tconst resolvedProvider =\n\t\t(definition && definition.id !== \"evalops\"\n\t\t\t? definition.providerRefProvider\n\t\t\t: undefined) ??\n\t\tmetadataProvider ??\n\t\tconfiguredProvider ??\n\t\tdefinition?.providerRefProvider ??\n\t\t\"openai\";\n\tconst environment =\n\t\tgetNonEmptyString(providerRef?.environment) ??\n\t\tprocess.env.MAESTRO_EVALOPS_ENVIRONMENT?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_ENVIRONMENT?.trim() ??\n\t\t\"prod\";\n\tconst credentialName =\n\t\tgetNonEmptyString(providerRef?.credential_name) ??\n\t\tprocess.env.MAESTRO_EVALOPS_CREDENTIAL_NAME?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME?.trim();\n\tconst teamId =\n\t\tgetNonEmptyString(providerRef?.team_id) ??\n\t\tprocess.env.MAESTRO_EVALOPS_TEAM_ID?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_TEAM_ID?.trim();\n\treturn {\n\t\tprovider: resolvedProvider,\n\t\tenvironment,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamId ? { team_id: teamId } : {}),\n\t};\n}\n\nfunction resolveEvalOpsRequestMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst agentMcp = isRecord(metadata?.agentMcp) ? metadata.agentMcp : undefined;\n\tconst agentID = firstNonEmptyString(\n\t\tmetadata?.agentId,\n\t\tmetadata?.agent_id,\n\t\tagentMcp?.agentId,\n\t\tagentMcp?.agent_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_AGENT_ID\", \"MAESTRO_AGENT_ID\"]),\n\t);\n\tconst platformRunID = firstNonEmptyString(\n\t\tmetadata?.runId,\n\t\tmetadata?.run_id,\n\t\tagentMcp?.runId,\n\t\tagentMcp?.run_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_RUN_ID\"]),\n\t);\n\tconst agentRunID = firstNonEmptyString(\n\t\tmetadata?.agentRunId,\n\t\tmetadata?.agent_run_id,\n\t\tagentMcp?.agentRunId,\n\t\tagentMcp?.agent_run_id,\n\t\treadFirstEnv([\"MAESTRO_AGENT_RUN_ID\", \"MAESTRO_EVALOPS_AGENT_RUN_ID\"]),\n\t\tplatformRunID,\n\t);\n\tconst runID = platformRunID ?? agentRunID;\n\tconst platformSessionID = firstNonEmptyString(\n\t\tmetadata?.sessionId,\n\t\tmetadata?.session_id,\n\t\tagentMcp?.sessionId,\n\t\tagentMcp?.session_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_SESSION_ID\"]),\n\t);\n\tconst maestroSessionID = firstNonEmptyString(\n\t\tmetadata?.maestroSessionId,\n\t\tmetadata?.maestro_session_id,\n\t\treadFirstEnv([\"MAESTRO_SESSION_ID\"]),\n\t\tplatformSessionID,\n\t);\n\tconst sessionID = platformSessionID ?? maestroSessionID;\n\tconst workspaceID = firstNonEmptyString(\n\t\tmetadata?.workspaceId,\n\t\tmetadata?.workspace_id,\n\t\tagentMcp?.workspaceId,\n\t\tagentMcp?.workspace_id,\n\t\treadEvalOpsEnv(process.env, EVALOPS_WORKSPACE_ID_ENV_VARS),\n\t);\n\tconst objectiveID = firstNonEmptyString(\n\t\tmetadata?.objectiveId,\n\t\tmetadata?.objective_id,\n\t\tagentMcp?.objectiveId,\n\t\tagentMcp?.objective_id,\n\t\treadFirstEnv([\"MAESTRO_OBJECTIVE_ID\", \"MAESTRO_EVALOPS_OBJECTIVE_ID\"]),\n\t);\n\tconst stepID = firstNonEmptyString(\n\t\tmetadata?.agentRunStepId,\n\t\tmetadata?.agent_run_step_id,\n\t\tmetadata?.stepId,\n\t\tmetadata?.step_id,\n\t\tagentMcp?.agentRunStepId,\n\t\tagentMcp?.agent_run_step_id,\n\t\treadFirstEnv([\n\t\t\t\"MAESTRO_AGENT_RUN_STEP_ID\",\n\t\t\t\"MAESTRO_EVALOPS_AGENT_RUN_STEP_ID\",\n\t\t]),\n\t);\n\tconst traceID = firstNonEmptyString(\n\t\tmetadata?.traceId,\n\t\tmetadata?.trace_id,\n\t\tagentMcp?.traceId,\n\t\tagentMcp?.trace_id,\n\t\treadFirstEnv([\"MAESTRO_TRACE_ID\", \"TRACE_ID\"]),\n\t);\n\tconst threadID = firstNonEmptyString(\n\t\tmetadata?.threadId,\n\t\tmetadata?.thread_id,\n\t\tagentMcp?.threadId,\n\t\tagentMcp?.thread_id,\n\t\treadFirstEnv([\"MAESTRO_THREAD_ID\", \"MAESTRO_EVALOPS_THREAD_ID\"]),\n\t);\n\tconst turnID = firstNonEmptyString(\n\t\tmetadata?.turnId,\n\t\tmetadata?.turn_id,\n\t\tagentMcp?.turnId,\n\t\tagentMcp?.turn_id,\n\t\treadFirstEnv([\"MAESTRO_TURN_ID\", \"MAESTRO_EVALOPS_TURN_ID\"]),\n\t);\n\tconst toolCallID = firstNonEmptyString(\n\t\tmetadata?.toolCallId,\n\t\tmetadata?.tool_call_id,\n\t\tagentMcp?.toolCallId,\n\t\tagentMcp?.tool_call_id,\n\t\treadFirstEnv([\"MAESTRO_TOOL_CALL_ID\", \"MAESTRO_EVALOPS_TOOL_CALL_ID\"]),\n\t);\n\tconst workload = firstNonEmptyString(\n\t\tmetadata?.workload,\n\t\tagentMcp?.workload,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_WORKLOAD\", \"MAESTRO_WORKLOAD\"]),\n\t);\n\tconst surface =\n\t\tfirstNonEmptyString(\n\t\t\tmetadata?.surface,\n\t\t\tagentMcp?.surface,\n\t\t\treadFirstEnv([\"MAESTRO_EVALOPS_SURFACE\", \"MAESTRO_SURFACE\"]),\n\t\t) ?? \"maestro\";\n\n\treturn Object.fromEntries(\n\t\tObject.entries({\n\t\t\tagent_id: agentID,\n\t\t\tworkspace_id: workspaceID,\n\t\t\tobjective_id: objectiveID,\n\t\t\trun_id: runID,\n\t\t\tagent_run_id: agentRunID,\n\t\t\tagent_run_step_id: stepID,\n\t\t\tsession_id: sessionID,\n\t\t\tmaestro_session_id: maestroSessionID,\n\t\t\tsurface,\n\t\t\ttrace_id: traceID,\n\t\t\tthread_id: threadID,\n\t\t\tturn_id: turnID,\n\t\t\ttool_call_id: toolCallID,\n\t\t\tworkload,\n\t\t}).filter(\n\t\t\t(entry): entry is [string, string] =>\n\t\t\t\ttypeof entry[1] === \"string\" && entry[1].trim().length > 0,\n\t\t),\n\t);\n}\n\nfunction buildEvalOpsCredential(\n\tprovider: string,\n\ttoken: string,\n\tsource: AuthCredentialSource,\n\tmetadata?: Record<string, unknown>,\n\tenvVar?: string,\n): AuthCredential | undefined {\n\tconst organizationId = resolveEvalOpsOrganizationId(metadata);\n\tif (!organizationId) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\tprovider,\n\t\ttoken,\n\t\ttype: resolveEvalOpsCredentialType(provider),\n\t\tsource,\n\t\tenvVar,\n\t\theaders: {\n\t\t\t\"X-Organization-ID\": organizationId,\n\t\t},\n\t\tmetadata,\n\t\trequestBody: {\n\t\t\tmetadata: resolveEvalOpsRequestMetadata(metadata),\n\t\t\tprovider_ref: resolveEvalOpsProviderRef(provider, metadata),\n\t\t},\n\t};\n}\n\nexport function createAuthResolver(options: AuthResolverOptions): AuthResolver {\n\tconst explicitKey = options.explicitApiKey?.trim();\n\treturn async (provider: string): Promise<AuthCredential | undefined> => {\n\t\tif (\n\t\t\tisKnownEvalOpsManagedProvider(provider) &&\n\t\t\t!isEvalOpsManagedGatewayEnabled()\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst normalizedProvider = provider.toLowerCase();\n\n\t\tif (explicitKey) {\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(provider, explicitKey, \"explicit\");\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: explicitKey,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: \"explicit\",\n\t\t\t};\n\t\t}\n\n\t\tif (isEvalOpsManagedProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst credentials = loadOAuthCredentials(\"evalops\");\n\t\t\tconst agentAPIKey = resolveEvalOpsAgentMcpAPIKey(credentials?.metadata);\n\t\t\tif (agentAPIKey) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tagentAPIKey,\n\t\t\t\t\t\"evalops_agent_key_file\",\n\t\t\t\t\tcredentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst oauthToken = await getOAuthToken(\"evalops\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst refreshedCredentials = loadOAuthCredentials(\"evalops\");\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\toauthToken,\n\t\t\t\t\t\"evalops_oauth_file\",\n\t\t\t\t\trefreshedCredentials?.metadata ?? credentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (isOpenAICodexProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"openai-codex\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"openai-codex\");\n\t\t\t\tconst accountId =\n\t\t\t\t\ttypeof credentials?.metadata?.accountId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.accountId\n\t\t\t\t\t\t: undefined;\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_codex_oauth_file\",\n\t\t\t\t\theaders: accountId ? { \"chatgpt-account-id\": accountId } : undefined,\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Handle OpenAI Auth\n\t\tif (isOpenAIProvider(provider) && options.mode !== \"api-key\") {\n\t\t\t// OpenAI OAuth\n\t\t\tconst oauthCred = await getFreshOpenAIOAuthCredential();\n\t\t\tif (oauthCred?.apiKey) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthCred.apiKey,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_oauth_file\",\n\t\t\t\t\tmetadata: { mode: oauthCred.mode },\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGitHubCopilotProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"github-copilot\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"github-copilot\");\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"github_copilot_oauth_file\",\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGoogleGeminiCliProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthProvider =\n\t\t\t\tnormalizedProvider === \"google-antigravity\"\n\t\t\t\t\t? \"google-antigravity\"\n\t\t\t\t\t: \"google-gemini-cli\";\n\t\t\tconst oauthToken = await getOAuthToken(oauthProvider);\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(oauthProvider);\n\t\t\t\tconst projectId =\n\t\t\t\t\ttypeof credentials?.metadata?.projectId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.projectId\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (projectId) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken: JSON.stringify({ token: oauthToken, projectId }),\n\t\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\t\tsource: \"google_oauth_file\",\n\t\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst preferAnthropicOAuth =\n\t\t\tnormalizedProvider === \"anthropic\" && options.mode !== \"api-key\";\n\n\t\tif (preferAnthropicOAuth) {\n\t\t\tconst envTokenEntry = ANTHROPIC_OAUTH_ENV_VARS.map((envVar) => ({\n\t\t\t\tenvVar,\n\t\t\t\ttoken: process.env[envVar]?.trim(),\n\t\t\t})).find((entry) => entry.token);\n\t\t\tif (envTokenEntry?.token) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: envTokenEntry.token,\n\t\t\t\t\ttype: \"anthropic-oauth\",\n\t\t\t\t\tsource: \"anthropic_oauth_env\",\n\t\t\t\t\tenvVar: envTokenEntry.envVar,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\t// Try OAuth system (oauth.json)\n\t\t\tconst oauthToken = await getOAuthToken(\"anthropic\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"anthropic\");\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"anthropic-oauth\",\n\t\t\t\t\tsource: \"anthropic_oauth_file\",\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (options.mode === \"claude\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tconst lookup = lookupApiKey(provider, explicitKey);\n\t\tif (lookup.key) {\n\t\t\tif (lookup.source === \"missing\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tlookup.key,\n\t\t\t\t\tlookup.source,\n\t\t\t\t\tundefined,\n\t\t\t\t\tlookup.envVar,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: lookup.key,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: lookup.source,\n\t\t\t\tenvVar: lookup.envVar,\n\t\t\t};\n\t\t}\n\t\treturn undefined;\n\t};\n}\n"]}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/providers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACN,gCAAgC,EAChC,6BAA6B,EAC7B,cAAc,GACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACN,mCAAmC,EACnC,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAoCjE,SAAS,gBAAgB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,cAAc;QAC7B,CAAC,UAAU,KAAK,QAAQ;YACvB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAChC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAChC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,UAAU,KAAK,cAAc,CAAC;AACtC,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,mBAAmB,IAAI,UAAU,KAAK,oBAAoB,CACzE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACrD,OAAO,mCAAmC,CAAC,QAAQ,CAAC,EAAE,kBAAkB;QACvE,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAG,MAAiB;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB;IAC7C,OAAO,mBAAmB,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK;aACJ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC/D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,yBAAyB,CACjC,QAAgB,EAChB,QAAkC;IAElC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,IAAI,CAAC;IACR,MAAM,UAAU,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,kBAAkB,GACvB,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,gBAAgB,GACrB,CAAC,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,SAAS;QACzC,CAAC,CAAC,UAAU,CAAC,mBAAmB;QAChC,CAAC,CAAC,SAAS,CAAC;QACb,gBAAgB;QAChB,kBAAkB;QAClB,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,CAAC;IACV,MAAM,WAAW,GAChB,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,MAAM,CAAC;IACR,MAAM,cAAc,GACnB,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GACX,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO;QACN,QAAQ,EAAE,gBAAgB;QAC1B,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACrC,QAAkC;IAElC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,OAAO,GAAG,mBAAmB,CAClC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC,CAC9D,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CACxC,QAAQ,EAAE,KAAK,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,KAAK,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,CAAC,wBAAwB,CAAC,CAAC,CACxC,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CACrC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,EACtE,aAAa,CACb,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,IAAI,UAAU,CAAC;IAC1C,MAAM,iBAAiB,GAAG,mBAAmB,CAC5C,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,UAAU,EACpB,YAAY,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAC5C,CAAC;IACF,MAAM,gBAAgB,GAAG,mBAAmB,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,YAAY,CAAC,CAAC,oBAAoB,CAAC,CAAC,EACpC,iBAAiB,CACjB,CAAC;IACF,MAAM,SAAS,GAAG,iBAAiB,IAAI,gBAAgB,CAAC;IACxD,MAAM,WAAW,GAAG,mBAAmB,CACtC,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,mBAAmB,CACtC,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,CAAC;QACZ,2BAA2B;QAC3B,mCAAmC;KACnC,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAClC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,mBAAmB,CACnC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,SAAS,EACnB,YAAY,CAAC,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,YAAY,CAAC,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CACrC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,QAAQ,GAAG,mBAAmB,CACnC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC,CAC9D,CAAC;IACF,MAAM,OAAO,GACZ,mBAAmB,CAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,OAAO,EACjB,YAAY,CAAC,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,CAAC,CAC5D,IAAI,SAAS,CAAC;IAEhB,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE,OAAO;QACjB,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,UAAU;QACxB,iBAAiB,EAAE,MAAM;QACzB,UAAU,EAAE,SAAS;QACrB,kBAAkB,EAAE,gBAAgB;QACpC,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,MAAM;QACf,YAAY,EAAE,UAAU;QACxB,QAAQ;KACR,CAAC,CAAC,MAAM,CACR,CAAC,KAAK,EAA6B,EAAE,CACpC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC3D,CACD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC9B,QAAgB,EAChB,KAAa,EACb,MAA4B,EAC5B,QAAkC,EAClC,MAAe;IAEf,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO;QACN,QAAQ;QACR,KAAK;QACL,IAAI,EAAE,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,MAAM;QACN,MAAM;QACN,OAAO,EAAE;YACR,mBAAmB,EAAE,cAAc;SACnC;QACD,QAAQ;QACR,WAAW,EAAE;YACZ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ,CAAC;YACjD,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC;SAC3D;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,KAAK,EAAE,QAAgB,EAAuC,EAAE;QACtE,IACC,6BAA6B,CAAC,QAAQ,CAAC;YACvC,CAAC,8BAA8B,EAAE,EAChC,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QAED,IAAI,wBAAwB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACxE,IAAI,WAAW,EAAE,CAAC;gBACjB,OAAO,sBAAsB,CAC5B,QAAQ,EACR,WAAW,EACX,wBAAwB,EACxB,WAAW,EAAE,QAAQ,CACrB,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBAC7D,OAAO,sBAAsB,CAC5B,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EAAE,QAAQ,IAAI,WAAW,EAAE,QAAQ,CACvD,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;gBACzD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,yBAAyB;oBACjC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;oBACpE,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9D,eAAe;YACf,MAAM,SAAS,GAAG,MAAM,6BAA6B,EAAE,CAAC;YACxD,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;gBACvB,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,SAAS,CAAC,MAAM;oBACvB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,mBAAmB;oBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAClC,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;gBAC3D,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,2BAA2B;oBACnC,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,aAAa,GAClB,kBAAkB,KAAK,oBAAoB;gBAC1C,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,mBAAmB,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YACtD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBACxD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,SAAS,EAAE,CAAC;oBACf,OAAO;wBACN,QAAQ;wBACR,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;wBACvD,IAAI,EAAE,SAAS;wBACf,MAAM,EAAE,mBAAmB;wBAC3B,QAAQ,EAAE,WAAW,EAAE,QAAQ;qBAC/B,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAC5B,QAAQ,EACR,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,MAAM,EACb,SAAS,EACT,MAAM,CAAC,MAAM,CACb,CAAC;YACH,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Authentication Resolver - Unified Credential Resolution\n *\n * This module provides a unified authentication resolver that handles\n * multiple credential sources and authentication modes for all supported\n * AI providers. It abstracts the complexity of OAuth, API keys, and\n * environment variables into a single interface.\n *\n * ## Authentication Modes\n *\n * | Mode     | Description                                    |\n * |----------|------------------------------------------------|\n * | auto     | Try OAuth first, fallback to API keys (default)|\n * | api-key  | Only use API keys, skip OAuth                  |\n *\n * ## Credential Resolution Order\n *\n * 1. **Explicit API key**: Passed directly via options\n * 2. **OAuth tokens**: Provider-specific OAuth flows (if mode allows)\n * 3. **Environment variables**: Standard env var lookup\n * 4. **Custom providers**: From models registry configuration\n *\n * ## Credential Sources\n *\n * | Source              | Description                              |\n * |---------------------|------------------------------------------|\n * | explicit            | Passed directly to resolver              |\n * | env                 | From environment variable                |\n * | custom_literal      | Hardcoded in custom provider config      |\n * | custom_env          | Env var from custom provider config      |\n * | evalops_oauth_file  | EvalOps managed OAuth from stored credentials |\n * | openai_oauth_file   | OpenAI OAuth from stored credentials     |\n * | openai_codex_oauth_file | OpenAI Codex ChatGPT OAuth from stored credentials |\n * | google_oauth_file   | Google OAuth from stored credentials     |\n *\n * ## Example\n *\n * ```typescript\n * const resolver = createAuthResolver({ mode: 'auto' });\n * const credential = await resolver('anthropic');\n *\n * if (credential) {\n *   console.log(`Using ${credential.type} from ${credential.source}`);\n *   // Use credential.token for API requests\n * }\n * ```\n *\n * @module providers/auth\n */\n\nimport {\n\tEVALOPS_ORGANIZATION_ID_ENV_VARS,\n\tEVALOPS_WORKSPACE_ID_ENV_VARS,\n\treadEvalOpsEnv,\n} from \"../evalops/env-aliases.js\";\nimport { getOAuthToken } from \"../oauth/index.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { lookupApiKey } from \"./api-keys.js\";\nimport {\n\tgetEvalOpsManagedProviderDefinition,\n\tisEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedProvider,\n\tisKnownEvalOpsManagedProvider,\n} from \"./evalops-managed.js\";\nimport { getFreshOpenAIOAuthCredential } from \"./openai-auth.js\";\n\nexport type AuthMode = \"auto\" | \"api-key\";\n\nexport type AuthCredentialType = \"api-key\" | \"bearer-token\";\n\nexport type AuthCredentialSource =\n\t| \"explicit\"\n\t| \"env\"\n\t| \"custom_literal\"\n\t| \"custom_env\"\n\t| \"evalops_agent_key_file\"\n\t| \"evalops_oauth_file\"\n\t| \"openai_oauth_file\"\n\t| \"openai_codex_oauth_file\"\n\t| \"google_oauth_file\"\n\t| \"github_copilot_oauth_file\";\n\nexport interface AuthCredential {\n\tprovider: string;\n\ttoken: string;\n\ttype: AuthCredentialType;\n\tsource: AuthCredentialSource;\n\tenvVar?: string;\n\theaders?: Record<string, string>;\n\tmetadata?: Record<string, unknown>;\n\trequestBody?: Record<string, unknown>;\n}\n\nexport interface AuthResolverOptions {\n\tmode: AuthMode;\n\texplicitApiKey?: string;\n}\n\ntype AuthResolver = (provider: string) => Promise<AuthCredential | undefined>;\n\nfunction isOpenAIProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized !== \"openai-codex\" &&\n\t\t(normalized === \"openai\" ||\n\t\t\tnormalized.startsWith(\"openai/\") ||\n\t\t\tnormalized.includes(\"openai-\"))\n\t);\n}\n\nfunction isOpenAICodexProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn normalized === \"openai-codex\";\n}\n\nfunction isGoogleGeminiCliProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized === \"google-gemini-cli\" || normalized === \"google-antigravity\"\n\t);\n}\n\nfunction isGitHubCopilotProvider(provider: string): boolean {\n\treturn provider.toLowerCase() === \"github-copilot\";\n}\n\nfunction resolveEvalOpsCredentialType(provider: string): AuthCredentialType {\n\treturn getEvalOpsManagedProviderDefinition(provider)?.usesAnthropicOAuth\n\t\t? \"bearer-token\"\n\t\t: \"api-key\";\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getNonEmptyString(value: unknown): string | undefined {\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction firstNonEmptyString(...values: unknown[]): string | undefined {\n\tfor (const value of values) {\n\t\tconst candidate = getNonEmptyString(value);\n\t\tif (candidate) {\n\t\t\treturn candidate;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction readFirstEnv(names: readonly string[]): string | undefined {\n\treturn firstNonEmptyString(...names.map((name) => process.env[name]));\n}\n\nfunction getStringArray(value: unknown): string[] {\n\treturn Array.isArray(value)\n\t\t? value\n\t\t\t\t.map((entry) => (typeof entry === \"string\" ? entry.trim() : \"\"))\n\t\t\t\t.filter((entry) => entry.length > 0)\n\t\t: [];\n}\n\nfunction isFutureTimestamp(value: unknown): boolean {\n\tconst timestamp = getNonEmptyString(value);\n\treturn !timestamp || Date.parse(timestamp) > Date.now();\n}\n\nfunction resolveEvalOpsAgentMcpAPIKey(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst agentMcp = isRecord(metadata?.agentMcp) ? metadata.agentMcp : undefined;\n\tconst apiKey = getNonEmptyString(agentMcp?.apiKey);\n\tif (!apiKey || !isFutureTimestamp(agentMcp?.expiresAt)) {\n\t\treturn undefined;\n\t}\n\tconst scopes = getStringArray(agentMcp?.scopes);\n\tif (scopes.length > 0 && !scopes.includes(\"llm_gateway:invoke\")) {\n\t\treturn undefined;\n\t}\n\treturn apiKey;\n}\n\nfunction resolveEvalOpsOrganizationId(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst candidate = getNonEmptyString(metadata?.organizationId);\n\tif (candidate && candidate.trim().length > 0) {\n\t\treturn candidate.trim();\n\t}\n\treturn readEvalOpsEnv(process.env, EVALOPS_ORGANIZATION_ID_ENV_VARS);\n}\n\nfunction resolveEvalOpsProviderRef(\n\tprovider: string,\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: null;\n\tconst definition = getEvalOpsManagedProviderDefinition(provider);\n\tconst metadataProvider = getNonEmptyString(providerRef?.provider);\n\tconst configuredProvider =\n\t\tprocess.env.MAESTRO_EVALOPS_PROVIDER?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_PROVIDER?.trim();\n\tconst resolvedProvider =\n\t\t(definition && definition.id !== \"evalops\"\n\t\t\t? definition.providerRefProvider\n\t\t\t: undefined) ??\n\t\tmetadataProvider ??\n\t\tconfiguredProvider ??\n\t\tdefinition?.providerRefProvider ??\n\t\t\"openai\";\n\tconst environment =\n\t\tgetNonEmptyString(providerRef?.environment) ??\n\t\tprocess.env.MAESTRO_EVALOPS_ENVIRONMENT?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_ENVIRONMENT?.trim() ??\n\t\t\"prod\";\n\tconst credentialName =\n\t\tgetNonEmptyString(providerRef?.credential_name) ??\n\t\tprocess.env.MAESTRO_EVALOPS_CREDENTIAL_NAME?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME?.trim();\n\tconst teamId =\n\t\tgetNonEmptyString(providerRef?.team_id) ??\n\t\tprocess.env.MAESTRO_EVALOPS_TEAM_ID?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_TEAM_ID?.trim();\n\treturn {\n\t\tprovider: resolvedProvider,\n\t\tenvironment,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamId ? { team_id: teamId } : {}),\n\t};\n}\n\nfunction resolveEvalOpsRequestMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst agentMcp = isRecord(metadata?.agentMcp) ? metadata.agentMcp : undefined;\n\tconst agentID = firstNonEmptyString(\n\t\tmetadata?.agentId,\n\t\tmetadata?.agent_id,\n\t\tagentMcp?.agentId,\n\t\tagentMcp?.agent_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_AGENT_ID\", \"MAESTRO_AGENT_ID\"]),\n\t);\n\tconst platformRunID = firstNonEmptyString(\n\t\tmetadata?.runId,\n\t\tmetadata?.run_id,\n\t\tagentMcp?.runId,\n\t\tagentMcp?.run_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_RUN_ID\"]),\n\t);\n\tconst agentRunID = firstNonEmptyString(\n\t\tmetadata?.agentRunId,\n\t\tmetadata?.agent_run_id,\n\t\tagentMcp?.agentRunId,\n\t\tagentMcp?.agent_run_id,\n\t\treadFirstEnv([\"MAESTRO_AGENT_RUN_ID\", \"MAESTRO_EVALOPS_AGENT_RUN_ID\"]),\n\t\tplatformRunID,\n\t);\n\tconst runID = platformRunID ?? agentRunID;\n\tconst platformSessionID = firstNonEmptyString(\n\t\tmetadata?.sessionId,\n\t\tmetadata?.session_id,\n\t\tagentMcp?.sessionId,\n\t\tagentMcp?.session_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_SESSION_ID\"]),\n\t);\n\tconst maestroSessionID = firstNonEmptyString(\n\t\tmetadata?.maestroSessionId,\n\t\tmetadata?.maestro_session_id,\n\t\treadFirstEnv([\"MAESTRO_SESSION_ID\"]),\n\t\tplatformSessionID,\n\t);\n\tconst sessionID = platformSessionID ?? maestroSessionID;\n\tconst workspaceID = firstNonEmptyString(\n\t\tmetadata?.workspaceId,\n\t\tmetadata?.workspace_id,\n\t\tagentMcp?.workspaceId,\n\t\tagentMcp?.workspace_id,\n\t\treadEvalOpsEnv(process.env, EVALOPS_WORKSPACE_ID_ENV_VARS),\n\t);\n\tconst objectiveID = firstNonEmptyString(\n\t\tmetadata?.objectiveId,\n\t\tmetadata?.objective_id,\n\t\tagentMcp?.objectiveId,\n\t\tagentMcp?.objective_id,\n\t\treadFirstEnv([\"MAESTRO_OBJECTIVE_ID\", \"MAESTRO_EVALOPS_OBJECTIVE_ID\"]),\n\t);\n\tconst stepID = firstNonEmptyString(\n\t\tmetadata?.agentRunStepId,\n\t\tmetadata?.agent_run_step_id,\n\t\tmetadata?.stepId,\n\t\tmetadata?.step_id,\n\t\tagentMcp?.agentRunStepId,\n\t\tagentMcp?.agent_run_step_id,\n\t\treadFirstEnv([\n\t\t\t\"MAESTRO_AGENT_RUN_STEP_ID\",\n\t\t\t\"MAESTRO_EVALOPS_AGENT_RUN_STEP_ID\",\n\t\t]),\n\t);\n\tconst traceID = firstNonEmptyString(\n\t\tmetadata?.traceId,\n\t\tmetadata?.trace_id,\n\t\tagentMcp?.traceId,\n\t\tagentMcp?.trace_id,\n\t\treadFirstEnv([\"MAESTRO_TRACE_ID\", \"TRACE_ID\"]),\n\t);\n\tconst threadID = firstNonEmptyString(\n\t\tmetadata?.threadId,\n\t\tmetadata?.thread_id,\n\t\tagentMcp?.threadId,\n\t\tagentMcp?.thread_id,\n\t\treadFirstEnv([\"MAESTRO_THREAD_ID\", \"MAESTRO_EVALOPS_THREAD_ID\"]),\n\t);\n\tconst turnID = firstNonEmptyString(\n\t\tmetadata?.turnId,\n\t\tmetadata?.turn_id,\n\t\tagentMcp?.turnId,\n\t\tagentMcp?.turn_id,\n\t\treadFirstEnv([\"MAESTRO_TURN_ID\", \"MAESTRO_EVALOPS_TURN_ID\"]),\n\t);\n\tconst toolCallID = firstNonEmptyString(\n\t\tmetadata?.toolCallId,\n\t\tmetadata?.tool_call_id,\n\t\tagentMcp?.toolCallId,\n\t\tagentMcp?.tool_call_id,\n\t\treadFirstEnv([\"MAESTRO_TOOL_CALL_ID\", \"MAESTRO_EVALOPS_TOOL_CALL_ID\"]),\n\t);\n\tconst workload = firstNonEmptyString(\n\t\tmetadata?.workload,\n\t\tagentMcp?.workload,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_WORKLOAD\", \"MAESTRO_WORKLOAD\"]),\n\t);\n\tconst surface =\n\t\tfirstNonEmptyString(\n\t\t\tmetadata?.surface,\n\t\t\tagentMcp?.surface,\n\t\t\treadFirstEnv([\"MAESTRO_EVALOPS_SURFACE\", \"MAESTRO_SURFACE\"]),\n\t\t) ?? \"maestro\";\n\n\treturn Object.fromEntries(\n\t\tObject.entries({\n\t\t\tagent_id: agentID,\n\t\t\tworkspace_id: workspaceID,\n\t\t\tobjective_id: objectiveID,\n\t\t\trun_id: runID,\n\t\t\tagent_run_id: agentRunID,\n\t\t\tagent_run_step_id: stepID,\n\t\t\tsession_id: sessionID,\n\t\t\tmaestro_session_id: maestroSessionID,\n\t\t\tsurface,\n\t\t\ttrace_id: traceID,\n\t\t\tthread_id: threadID,\n\t\t\tturn_id: turnID,\n\t\t\ttool_call_id: toolCallID,\n\t\t\tworkload,\n\t\t}).filter(\n\t\t\t(entry): entry is [string, string] =>\n\t\t\t\ttypeof entry[1] === \"string\" && entry[1].trim().length > 0,\n\t\t),\n\t);\n}\n\nfunction buildEvalOpsCredential(\n\tprovider: string,\n\ttoken: string,\n\tsource: AuthCredentialSource,\n\tmetadata?: Record<string, unknown>,\n\tenvVar?: string,\n): AuthCredential | undefined {\n\tconst organizationId = resolveEvalOpsOrganizationId(metadata);\n\tif (!organizationId) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\tprovider,\n\t\ttoken,\n\t\ttype: resolveEvalOpsCredentialType(provider),\n\t\tsource,\n\t\tenvVar,\n\t\theaders: {\n\t\t\t\"X-Organization-ID\": organizationId,\n\t\t},\n\t\tmetadata,\n\t\trequestBody: {\n\t\t\tmetadata: resolveEvalOpsRequestMetadata(metadata),\n\t\t\tprovider_ref: resolveEvalOpsProviderRef(provider, metadata),\n\t\t},\n\t};\n}\n\nexport function createAuthResolver(options: AuthResolverOptions): AuthResolver {\n\tconst explicitKey = options.explicitApiKey?.trim();\n\treturn async (provider: string): Promise<AuthCredential | undefined> => {\n\t\tif (\n\t\t\tisKnownEvalOpsManagedProvider(provider) &&\n\t\t\t!isEvalOpsManagedGatewayEnabled()\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst normalizedProvider = provider.toLowerCase();\n\n\t\tif (explicitKey) {\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(provider, explicitKey, \"explicit\");\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: explicitKey,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: \"explicit\",\n\t\t\t};\n\t\t}\n\n\t\tif (isEvalOpsManagedProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst credentials = loadOAuthCredentials(\"evalops\");\n\t\t\tconst agentAPIKey = resolveEvalOpsAgentMcpAPIKey(credentials?.metadata);\n\t\t\tif (agentAPIKey) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tagentAPIKey,\n\t\t\t\t\t\"evalops_agent_key_file\",\n\t\t\t\t\tcredentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst oauthToken = await getOAuthToken(\"evalops\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst refreshedCredentials = loadOAuthCredentials(\"evalops\");\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\toauthToken,\n\t\t\t\t\t\"evalops_oauth_file\",\n\t\t\t\t\trefreshedCredentials?.metadata ?? credentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (isOpenAICodexProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"openai-codex\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"openai-codex\");\n\t\t\t\tconst accountId =\n\t\t\t\t\ttypeof credentials?.metadata?.accountId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.accountId\n\t\t\t\t\t\t: undefined;\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_codex_oauth_file\",\n\t\t\t\t\theaders: accountId ? { \"chatgpt-account-id\": accountId } : undefined,\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Handle OpenAI Auth\n\t\tif (isOpenAIProvider(provider) && options.mode !== \"api-key\") {\n\t\t\t// OpenAI OAuth\n\t\t\tconst oauthCred = await getFreshOpenAIOAuthCredential();\n\t\t\tif (oauthCred?.apiKey) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthCred.apiKey,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_oauth_file\",\n\t\t\t\t\tmetadata: { mode: oauthCred.mode },\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGitHubCopilotProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"github-copilot\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"github-copilot\");\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"github_copilot_oauth_file\",\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGoogleGeminiCliProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthProvider =\n\t\t\t\tnormalizedProvider === \"google-antigravity\"\n\t\t\t\t\t? \"google-antigravity\"\n\t\t\t\t\t: \"google-gemini-cli\";\n\t\t\tconst oauthToken = await getOAuthToken(oauthProvider);\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(oauthProvider);\n\t\t\t\tconst projectId =\n\t\t\t\t\ttypeof credentials?.metadata?.projectId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.projectId\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (projectId) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken: JSON.stringify({ token: oauthToken, projectId }),\n\t\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\t\tsource: \"google_oauth_file\",\n\t\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst lookup = lookupApiKey(provider, explicitKey);\n\t\tif (lookup.key) {\n\t\t\tif (lookup.source === \"missing\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tlookup.key,\n\t\t\t\t\tlookup.source,\n\t\t\t\t\tundefined,\n\t\t\t\t\tlookup.envVar,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: lookup.key,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: lookup.source,\n\t\t\t\tenvVar: lookup.envVar,\n\t\t\t};\n\t\t}\n\t\treturn undefined;\n\t};\n}\n"]}

package/dist/rpc/index.d.ts

@@ -1,7 +1,7 @@
 /**
- * RPC Module for Composer Agent
+ * RPC Module for Maestro Agent
  *
- * Provides typed RPC communication for programmatic control of Composer.
+ * Provides typed RPC communication for programmatic control of Maestro.
  *
  * @module rpc
  */

package/dist/rpc/index.js

@@ -1,7 +1,7 @@
 /**
- * RPC Module for Composer Agent
+ * RPC Module for Maestro Agent
  *
- * Provides typed RPC communication for programmatic control of Composer.
+ * Provides typed RPC communication for programmatic control of Maestro.
  *
  * @module rpc
  */

package/dist/rpc/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rpc/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAcN,YAAY,EACZ,eAAe,GACf,MAAM,gBAAgB,CAAC","sourcesContent":["/**\n * RPC Module for Composer Agent\n *\n * Provides typed RPC communication for programmatic control of Composer.\n *\n * @module rpc\n */\n\nexport { RpcClient, type RpcClientOptions } from \"./rpc-client.js\";\nexport {\n\ttype RpcCommand,\n\ttype RpcPromptCommand,\n\ttype RpcAbortCommand,\n\ttype RpcGetMessagesCommand,\n\ttype RpcGetStateCommand,\n\ttype RpcContinueCommand,\n\ttype RpcCompactCommand,\n\ttype RpcResponse,\n\ttype RpcMessagesResponse,\n\ttype RpcStateResponse,\n\ttype RpcErrorResponse,\n\ttype RpcCompactionResponse,\n\ttype RpcAgentEventType,\n\tisAgentEvent,\n\tisErrorResponse,\n} from \"./rpc-types.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rpc/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAcN,YAAY,EACZ,eAAe,GACf,MAAM,gBAAgB,CAAC","sourcesContent":["/**\n * RPC Module for Maestro Agent\n *\n * Provides typed RPC communication for programmatic control of Maestro.\n *\n * @module rpc\n */\n\nexport { RpcClient, type RpcClientOptions } from \"./rpc-client.js\";\nexport {\n\ttype RpcCommand,\n\ttype RpcPromptCommand,\n\ttype RpcAbortCommand,\n\ttype RpcGetMessagesCommand,\n\ttype RpcGetStateCommand,\n\ttype RpcContinueCommand,\n\ttype RpcCompactCommand,\n\ttype RpcResponse,\n\ttype RpcMessagesResponse,\n\ttype RpcStateResponse,\n\ttype RpcErrorResponse,\n\ttype RpcCompactionResponse,\n\ttype RpcAgentEventType,\n\tisAgentEvent,\n\tisErrorResponse,\n} from \"./rpc-types.js\";\n"]}

package/dist/rpc/rpc-types.d.ts

@@ -1,5 +1,5 @@
 /**
- * RPC Types for Composer Agent
+ * RPC Types for Maestro Agent
  *
  * Defines the typed protocol for JSON-over-stdio RPC communication.
  *

package/dist/rpc/rpc-types.js

@@ -1,5 +1,5 @@
 /**
- * RPC Types for Composer Agent
+ * RPC Types for Maestro Agent
  *
  * Defines the typed protocol for JSON-over-stdio RPC communication.
  *

package/dist/rpc/rpc-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-types.js","sourceRoot":"","sources":["../../src/rpc/rpc-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAwKH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAqB;IACjD,OAAO;QACN,eAAe;QACf,gBAAgB;QAChB,aAAa;QACb,aAAa;QACb,WAAW;QACX,sBAAsB;QACtB,uBAAuB;QACvB,oBAAoB;QACpB,oBAAoB;QACpB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB;QACrB,OAAO;KACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC9B,QAAqB;IAErB,OAAO,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC;AAClC,CAAC","sourcesContent":["/**\n * RPC Types for Composer Agent\n *\n * Defines the typed protocol for JSON-over-stdio RPC communication.\n *\n * @module rpc/rpc-types\n */\n\nimport type {\n\tAgentEvent,\n\tApi,\n\tAppMessage,\n\tMessage,\n\tModel,\n} from \"../agent/types.js\";\n\n// ============================================================================\n// RPC Commands (Client -> Server)\n// ============================================================================\n\n/**\n * Base interface for all RPC commands.\n */\nexport interface RpcCommandBase {\n\ttype: string;\n\t/** Optional request ID for response correlation */\n\tid?: string;\n}\n\n/**\n * Send a prompt to the agent.\n */\nexport interface RpcPromptCommand extends RpcCommandBase {\n\ttype: \"prompt\";\n\t/** The message to send */\n\tmessage: string;\n\t/** Optional attachments */\n\tattachments?: Array<{\n\t\tid: string;\n\t\ttype: \"image\" | \"document\";\n\t\tfileName: string;\n\t\tmimeType: string;\n\t\tsize: number;\n\t\tcontent: string;\n\t}>;\n}\n\n/**\n * Abort the current agent operation.\n */\nexport interface RpcAbortCommand extends RpcCommandBase {\n\ttype: \"abort\";\n}\n\n/**\n * Get the current conversation messages.\n */\nexport interface RpcGetMessagesCommand extends RpcCommandBase {\n\ttype: \"get_messages\";\n}\n\n/**\n * Get the full agent state.\n */\nexport interface RpcGetStateCommand extends RpcCommandBase {\n\ttype: \"get_state\";\n}\n\n/**\n * Continue the conversation without a new user message.\n */\nexport interface RpcContinueCommand extends RpcCommandBase {\n\ttype: \"continue\";\n\toptions?: {\n\t\tsystemPromptOverride?: string;\n\t};\n}\n\n/**\n * Trigger context compaction.\n */\nexport interface RpcCompactCommand extends RpcCommandBase {\n\ttype: \"compact\";\n\tcustomInstructions?: string;\n}\n\n/**\n * Union of all RPC commands.\n */\nexport type RpcCommand =\n\t| RpcPromptCommand\n\t| RpcAbortCommand\n\t| RpcGetMessagesCommand\n\t| RpcGetStateCommand\n\t| RpcContinueCommand\n\t| RpcCompactCommand;\n\n// ============================================================================\n// RPC Responses (Server -> Client)\n// ============================================================================\n\n/**\n * Base interface for all RPC responses.\n */\nexport interface RpcResponseBase {\n\ttype: string;\n\t/** Request ID if provided in command */\n\tid?: string;\n}\n\n/**\n * Response containing conversation messages.\n */\nexport interface RpcMessagesResponse extends RpcResponseBase {\n\ttype: \"messages\";\n\tmessages: Message[];\n}\n\n/**\n * Response containing agent state.\n */\nexport interface RpcStateResponse extends RpcResponseBase {\n\ttype: \"state\";\n\tstate: {\n\t\tmodel: Model<Api>;\n\t\tmessages: Message[];\n\t\tisStreaming: boolean;\n\t\terror: string | null;\n\t\tthinkingLevel: number;\n\t\tsession?: { id: string };\n\t\tqueuedMessageCount: number;\n\t};\n}\n\n/**\n * Error response.\n */\nexport interface RpcErrorResponse extends RpcResponseBase {\n\ttype: \"error\";\n\terror: string;\n}\n\n/**\n * Compaction event response.\n */\nexport interface RpcCompactionResponse extends RpcResponseBase {\n\ttype: \"compaction\";\n\tsummary: string;\n\tfirstKeptEntryIndex: number;\n\ttokensBefore: number;\n\tauto: boolean;\n\tcustomInstructions?: string;\n\ttimestamp: string;\n}\n\n/**\n * Union of all RPC responses.\n */\nexport type RpcResponse =\n\t| RpcMessagesResponse\n\t| RpcStateResponse\n\t| RpcErrorResponse\n\t| RpcCompactionResponse\n\t| AgentEvent;\n\n// ============================================================================\n// Utility Types\n// ============================================================================\n\n/**\n * Agent event types that can be received over RPC.\n */\nexport type RpcAgentEventType = AgentEvent[\"type\"];\n\n/**\n * Check if an RPC response is an agent event.\n */\nexport function isAgentEvent(response: RpcResponse): response is AgentEvent {\n\treturn [\n\t\t\"message_start\",\n\t\t\"message_update\",\n\t\t\"message_end\",\n\t\t\"agent_start\",\n\t\t\"agent_end\",\n\t\t\"tool_execution_start\",\n\t\t\"tool_execution_update\",\n\t\t\"tool_execution_end\",\n\t\t\"tool_batch_summary\",\n\t\t\"tool_phase_summary\",\n\t\t\"tool_retry_required\",\n\t\t\"tool_retry_resolved\",\n\t\t\"error\",\n\t].includes(response.type);\n}\n\n/**\n * Check if an RPC response is an error.\n */\nexport function isErrorResponse(\n\tresponse: RpcResponse,\n): response is RpcErrorResponse {\n\treturn response.type === \"error\";\n}\n"]}
+{"version":3,"file":"rpc-types.js","sourceRoot":"","sources":["../../src/rpc/rpc-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAwKH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,QAAqB;IACjD,OAAO;QACN,eAAe;QACf,gBAAgB;QAChB,aAAa;QACb,aAAa;QACb,WAAW;QACX,sBAAsB;QACtB,uBAAuB;QACvB,oBAAoB;QACpB,oBAAoB;QACpB,oBAAoB;QACpB,qBAAqB;QACrB,qBAAqB;QACrB,OAAO;KACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC9B,QAAqB;IAErB,OAAO,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC;AAClC,CAAC","sourcesContent":["/**\n * RPC Types for Maestro Agent\n *\n * Defines the typed protocol for JSON-over-stdio RPC communication.\n *\n * @module rpc/rpc-types\n */\n\nimport type {\n\tAgentEvent,\n\tApi,\n\tAppMessage,\n\tMessage,\n\tModel,\n} from \"../agent/types.js\";\n\n// ============================================================================\n// RPC Commands (Client -> Server)\n// ============================================================================\n\n/**\n * Base interface for all RPC commands.\n */\nexport interface RpcCommandBase {\n\ttype: string;\n\t/** Optional request ID for response correlation */\n\tid?: string;\n}\n\n/**\n * Send a prompt to the agent.\n */\nexport interface RpcPromptCommand extends RpcCommandBase {\n\ttype: \"prompt\";\n\t/** The message to send */\n\tmessage: string;\n\t/** Optional attachments */\n\tattachments?: Array<{\n\t\tid: string;\n\t\ttype: \"image\" | \"document\";\n\t\tfileName: string;\n\t\tmimeType: string;\n\t\tsize: number;\n\t\tcontent: string;\n\t}>;\n}\n\n/**\n * Abort the current agent operation.\n */\nexport interface RpcAbortCommand extends RpcCommandBase {\n\ttype: \"abort\";\n}\n\n/**\n * Get the current conversation messages.\n */\nexport interface RpcGetMessagesCommand extends RpcCommandBase {\n\ttype: \"get_messages\";\n}\n\n/**\n * Get the full agent state.\n */\nexport interface RpcGetStateCommand extends RpcCommandBase {\n\ttype: \"get_state\";\n}\n\n/**\n * Continue the conversation without a new user message.\n */\nexport interface RpcContinueCommand extends RpcCommandBase {\n\ttype: \"continue\";\n\toptions?: {\n\t\tsystemPromptOverride?: string;\n\t};\n}\n\n/**\n * Trigger context compaction.\n */\nexport interface RpcCompactCommand extends RpcCommandBase {\n\ttype: \"compact\";\n\tcustomInstructions?: string;\n}\n\n/**\n * Union of all RPC commands.\n */\nexport type RpcCommand =\n\t| RpcPromptCommand\n\t| RpcAbortCommand\n\t| RpcGetMessagesCommand\n\t| RpcGetStateCommand\n\t| RpcContinueCommand\n\t| RpcCompactCommand;\n\n// ============================================================================\n// RPC Responses (Server -> Client)\n// ============================================================================\n\n/**\n * Base interface for all RPC responses.\n */\nexport interface RpcResponseBase {\n\ttype: string;\n\t/** Request ID if provided in command */\n\tid?: string;\n}\n\n/**\n * Response containing conversation messages.\n */\nexport interface RpcMessagesResponse extends RpcResponseBase {\n\ttype: \"messages\";\n\tmessages: Message[];\n}\n\n/**\n * Response containing agent state.\n */\nexport interface RpcStateResponse extends RpcResponseBase {\n\ttype: \"state\";\n\tstate: {\n\t\tmodel: Model<Api>;\n\t\tmessages: Message[];\n\t\tisStreaming: boolean;\n\t\terror: string | null;\n\t\tthinkingLevel: number;\n\t\tsession?: { id: string };\n\t\tqueuedMessageCount: number;\n\t};\n}\n\n/**\n * Error response.\n */\nexport interface RpcErrorResponse extends RpcResponseBase {\n\ttype: \"error\";\n\terror: string;\n}\n\n/**\n * Compaction event response.\n */\nexport interface RpcCompactionResponse extends RpcResponseBase {\n\ttype: \"compaction\";\n\tsummary: string;\n\tfirstKeptEntryIndex: number;\n\ttokensBefore: number;\n\tauto: boolean;\n\tcustomInstructions?: string;\n\ttimestamp: string;\n}\n\n/**\n * Union of all RPC responses.\n */\nexport type RpcResponse =\n\t| RpcMessagesResponse\n\t| RpcStateResponse\n\t| RpcErrorResponse\n\t| RpcCompactionResponse\n\t| AgentEvent;\n\n// ============================================================================\n// Utility Types\n// ============================================================================\n\n/**\n * Agent event types that can be received over RPC.\n */\nexport type RpcAgentEventType = AgentEvent[\"type\"];\n\n/**\n * Check if an RPC response is an agent event.\n */\nexport function isAgentEvent(response: RpcResponse): response is AgentEvent {\n\treturn [\n\t\t\"message_start\",\n\t\t\"message_update\",\n\t\t\"message_end\",\n\t\t\"agent_start\",\n\t\t\"agent_end\",\n\t\t\"tool_execution_start\",\n\t\t\"tool_execution_update\",\n\t\t\"tool_execution_end\",\n\t\t\"tool_batch_summary\",\n\t\t\"tool_phase_summary\",\n\t\t\"tool_retry_required\",\n\t\t\"tool_retry_resolved\",\n\t\t\"error\",\n\t].includes(response.type);\n}\n\n/**\n * Check if an RPC response is an error.\n */\nexport function isErrorResponse(\n\tresponse: RpcResponse,\n): response is RpcErrorResponse {\n\treturn response.type === \"error\";\n}\n"]}

package/dist/safety/nested-agent-guard.js

@@ -46,7 +46,7 @@ const MAX_AGENT_DEPTH = 2; // Allow one level of nesting for legitimate use case
  * Command patterns that spawn agent instances.
  */
 const AGENT_SPAWN_PATTERNS = [
-    // Composer/Claude Code patterns
+    // Maestro/Claude Code patterns
     /\bcomposer\b/i,
     /\bclaude\b/i,
     /\bclaude-code\b/i,

package/dist/safety/nested-agent-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"nested-agent-guard.js","sourceRoot":"","sources":["../../src/safety/nested-agent-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;AAEzD;;GAEG;AACH,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAC5C,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,sDAAsD;AAEjF;;GAEG;AACH,MAAM,oBAAoB,GAAG;IAC5B,gCAAgC;IAChC,eAAe;IACf,aAAa;IACb,kBAAkB;IAClB,SAAS,EAAE,WAAW;IAEtB,wBAAwB;IACxB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,WAAW;IACX,cAAc;IAEd,+BAA+B;IAC/B,kBAAkB;IAClB,oBAAoB;IACpB,YAAY;CACZ,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAG;IAC1B,oBAAoB;IACpB,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAElB,sBAAsB;IACtB,iBAAiB;IACjB,kBAAkB;IAElB,qBAAqB;IACrB,yBAAyB;IACzB,2BAA2B;CAC3B,CAAC;AAgBF;;GAEG;AACH,MAAM,gBAAgB;IAAtB;QACS,gBAAW,GAAG,KAAK,CAAC;QACpB,aAAQ,GAAG,KAAK,CAAC;QACjB,eAAU,GAAG,CAAC,CAAC;QACf,cAAS,GAAkB,IAAI,CAAC;QAChC,mBAAc,GAAyB,EAAE,CAAC;QAC1C,oBAAe,GAAG,CAAC,CAAC;QACX,mBAAc,GAAG,CAAC,CAAC,CAAC,+BAA+B;QACnD,yBAAoB,GAAG,MAAM,CAAC,CAAC,kBAAkB;IAmNnE,CAAC;IAjNA;;;OAGG;IACH,UAAU;QACT,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,8CAA8C;QAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAE9C,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;YACrB,CAAC;QACF,CAAC;QAED,mCAAmC;QACnC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAE3D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,UAAU;aACtB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACX,OAAO,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe;QAC3B,qCAAqC;QACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,qCAAqC;QACrC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAC5D,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACrC,aAAa,EAAE,OAAO,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBACH,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EACL,oGAAoG;oBACrG,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC;YACH,CAAC;QACF,CAAC;QAED,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,oBAAoB;gBACpB,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;wBACrD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC9B,KAAK,EAAE,IAAI,CAAC,UAAU;wBACtB,QAAQ,EAAE,eAAe;qBACzB,CAAC,CAAC;oBACH,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,yCAAyC,eAAe,iDAAiD;wBACjH,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC;gBACH,CAAC;gBAED,0BAA0B;gBAC1B,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACjD,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;wBACrD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC9B,UAAU,EAAE,IAAI,CAAC,eAAe;wBAChC,SAAS,EAAE,IAAI,CAAC,cAAc;qBAC9B,CAAC,CAAC;oBACH,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,kCAAkC,IAAI,CAAC,cAAc,oEAAoE;wBACjI,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC;gBACH,CAAC;gBAED,iBAAiB;gBACjB,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBAC3C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC9B,OAAO,EAAE,OAAO,CAAC,MAAM;oBACvB,KAAK,EAAE,IAAI,CAAC,UAAU;oBACtB,UAAU,EAAE,IAAI,CAAC,eAAe;iBAChC,CAAC,CAAC;gBAEH,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,0DAA0D;oBAClE,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,kBAAkB,CACjB,GAAW,EACX,OAAe,EACf,YAAqB;QAErB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YACxB,GAAG;YACH,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,YAAY;SACZ,CAAC,CAAC;QAEH,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC1C,GAAG;gBACH,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC9B,gBAAgB,EAAE,IAAI,CAAC,eAAe;aACtC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED;;OAEG;IACK,iBAAiB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,CAC3B,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QACpD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACF,CAAC;IAED;;OAEG;IACH,QAAQ;QAOP,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,UAAU;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,oBAAoB,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;SAChD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QACd,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa;QACZ,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC;IAC3E,CAAC;CACD;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,IAAI,+CAA+C,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC","sourcesContent":["/**\n * Nested Agent Guard\n *\n * Prevents CPU exhaustion from agents spawning nested instances of themselves.\n * This addresses the issue where Claude Code (or similar tools) can inadvertently\n * spawn child instances through bash commands, leading to exponential resource usage.\n *\n * ## Detection Methods\n *\n * 1. **Environment Variable**: Sets MAESTRO_PARENT_PID on startup, child processes\n *    can detect they're running inside a parent instance.\n *\n * 2. **Process Tree Analysis**: Tracks child process spawns and detects recursive patterns.\n *\n * 3. **Command Pattern Detection**: Identifies commands that would spawn nested agents.\n *\n * ## Usage\n *\n * ```typescript\n * import { nestedAgentGuard } from \"./nested-agent-guard.js\";\n *\n * // On startup\n * nestedAgentGuard.initialize();\n *\n * // Check if we're nested\n * if (nestedAgentGuard.isNestedInstance()) {\n *   console.warn(\"Running inside another agent instance\");\n * }\n *\n * // Before spawning commands\n * const check = nestedAgentGuard.checkCommand(\"claude --help\");\n * if (!check.allowed) {\n *   console.error(check.reason);\n * }\n * ```\n */\n\nimport { createLogger } from \"../utils/logger.js\";\n\nconst logger = createLogger(\"safety:nested-agent-guard\");\n\n/**\n * Environment variable set by parent agent instances.\n */\nconst PARENT_PID_ENV = \"MAESTRO_PARENT_PID\";\nconst AGENT_DEPTH_ENV = \"MAESTRO_AGENT_DEPTH\";\nconst MAX_AGENT_DEPTH = 2; // Allow one level of nesting for legitimate use cases\n\n/**\n * Command patterns that spawn agent instances.\n */\nconst AGENT_SPAWN_PATTERNS = [\n\t// Composer/Claude Code patterns\n\t/\\bcomposer\\b/i,\n\t/\\bclaude\\b/i,\n\t/\\bclaude-code\\b/i,\n\t/\\bcc\\s/i, // cc alias\n\n\t// Other agent CLI tools\n\t/\\baider\\b/i,\n\t/\\bcursor\\b/i,\n\t/\\bcontinue\\b/i,\n\t/\\bcody\\b/i,\n\t/\\bcopilot\\b/i,\n\n\t// Generic agent spawn patterns\n\t/\\bagent\\s+run\\b/i,\n\t/\\bagent\\s+start\\b/i,\n\t/--agent\\b/i,\n];\n\n/**\n * Patterns that indicate intentional recursive spawning (higher risk).\n */\nconst HIGH_RISK_PATTERNS = [\n\t// Running in a loop\n\t/while.*composer/i,\n\t/for.*composer/i,\n\t/xargs.*composer/i,\n\n\t// Background spawning\n\t/composer.*&\\s*$/,\n\t/nohup.*composer/i,\n\n\t// Multiple instances\n\t/composer.*&&.*composer/i,\n\t/composer.*\\|\\|.*composer/i,\n];\n\ninterface CommandCheckResult {\n\tallowed: boolean;\n\treason?: string;\n\tseverity: \"info\" | \"warning\" | \"error\";\n\tpattern?: string;\n}\n\ninterface ChildProcessRecord {\n\tpid: number;\n\tcommand: string;\n\ttimestamp: number;\n\tisAgentSpawn: boolean;\n}\n\n/**\n * Nested agent guard implementation.\n */\nclass NestedAgentGuard {\n\tprivate initialized = false;\n\tprivate isNested = false;\n\tprivate agentDepth = 0;\n\tprivate parentPid: number | null = null;\n\tprivate childProcesses: ChildProcessRecord[] = [];\n\tprivate agentSpawnCount = 0;\n\tprivate readonly maxAgentSpawns = 3; // Max agent spawns per session\n\tprivate readonly childProcessWindowMs = 60_000; // 1 minute window\n\n\t/**\n\t * Initialize the guard on startup.\n\t * Sets environment variables for child processes.\n\t */\n\tinitialize(): void {\n\t\tif (this.initialized) return;\n\n\t\t// Check if we're running inside another agent\n\t\tconst parentPidStr = process.env[PARENT_PID_ENV];\n\t\tconst depthStr = process.env[AGENT_DEPTH_ENV];\n\n\t\tif (parentPidStr) {\n\t\t\tthis.parentPid = Number.parseInt(parentPidStr, 10);\n\t\t\tthis.isNested = !Number.isNaN(this.parentPid);\n\t\t}\n\n\t\tif (depthStr) {\n\t\t\tthis.agentDepth = Number.parseInt(depthStr, 10);\n\t\t\tif (Number.isNaN(this.agentDepth)) {\n\t\t\t\tthis.agentDepth = 0;\n\t\t\t}\n\t\t}\n\n\t\t// Set environment for our children\n\t\tprocess.env[PARENT_PID_ENV] = String(process.pid);\n\t\tprocess.env[AGENT_DEPTH_ENV] = String(this.agentDepth + 1);\n\n\t\tif (this.isNested) {\n\t\t\tlogger.warn(\"Running as nested agent instance\", {\n\t\t\t\tparentPid: this.parentPid,\n\t\t\t\tdepth: this.agentDepth,\n\t\t\t});\n\t\t}\n\n\t\tthis.initialized = true;\n\t}\n\n\t/**\n\t * Check if this instance is running inside another agent.\n\t */\n\tisNestedInstance(): boolean {\n\t\treturn this.isNested;\n\t}\n\n\t/**\n\t * Get the current nesting depth.\n\t */\n\tgetDepth(): number {\n\t\treturn this.agentDepth;\n\t}\n\n\t/**\n\t * Check if nesting depth is at or above the limit.\n\t */\n\tisAtMaxDepth(): boolean {\n\t\treturn this.agentDepth >= MAX_AGENT_DEPTH;\n\t}\n\n\t/**\n\t * Check if a command would spawn a nested agent.\n\t */\n\tcheckCommand(command: string): CommandCheckResult {\n\t\t// Clean up old child process records\n\t\tthis.cleanupOldRecords();\n\n\t\t// Check for high-risk patterns first\n\t\tfor (const pattern of HIGH_RISK_PATTERNS) {\n\t\t\tif (pattern.test(command)) {\n\t\t\t\tlogger.warn(\"High-risk nested agent spawn pattern detected\", {\n\t\t\t\t\tcommandPreview: command.slice(0, 100),\n\t\t\t\t\tpatternSource: pattern.source,\n\t\t\t\t});\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Blocked: Command matches high-risk recursive agent spawn pattern. This could cause CPU exhaustion.\",\n\t\t\t\t\tseverity: \"error\",\n\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check for agent spawn patterns\n\t\tfor (const pattern of AGENT_SPAWN_PATTERNS) {\n\t\t\tif (pattern.test(command)) {\n\t\t\t\t// Check depth limit\n\t\t\t\tif (this.isAtMaxDepth()) {\n\t\t\t\t\tlogger.warn(\"Agent spawn blocked due to depth limit\", {\n\t\t\t\t\t\tcommand: command.slice(0, 100),\n\t\t\t\t\t\tdepth: this.agentDepth,\n\t\t\t\t\t\tmaxDepth: MAX_AGENT_DEPTH,\n\t\t\t\t\t});\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Blocked: Maximum agent nesting depth (${MAX_AGENT_DEPTH}) reached. Cannot spawn another agent instance.`,\n\t\t\t\t\t\tseverity: \"error\",\n\t\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\t// Check spawn count limit\n\t\t\t\tif (this.agentSpawnCount >= this.maxAgentSpawns) {\n\t\t\t\t\tlogger.warn(\"Agent spawn blocked due to count limit\", {\n\t\t\t\t\t\tcommand: command.slice(0, 100),\n\t\t\t\t\t\tspawnCount: this.agentSpawnCount,\n\t\t\t\t\t\tmaxSpawns: this.maxAgentSpawns,\n\t\t\t\t\t});\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Blocked: Maximum agent spawns (${this.maxAgentSpawns}) reached in this session. This prevents runaway process spawning.`,\n\t\t\t\t\t\tseverity: \"error\",\n\t\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\t// Allow but warn\n\t\t\t\tlogger.info(\"Agent spawn command detected\", {\n\t\t\t\t\tcommand: command.slice(0, 100),\n\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t\tdepth: this.agentDepth,\n\t\t\t\t\tspawnCount: this.agentSpawnCount,\n\t\t\t\t});\n\n\t\t\t\treturn {\n\t\t\t\t\tallowed: true,\n\t\t\t\t\treason: \"Warning: This command may spawn a nested agent instance.\",\n\t\t\t\t\tseverity: \"warning\",\n\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true, severity: \"info\" };\n\t}\n\n\t/**\n\t * Record a child process spawn.\n\t */\n\trecordChildProcess(\n\t\tpid: number,\n\t\tcommand: string,\n\t\tisAgentSpawn: boolean,\n\t): void {\n\t\tthis.childProcesses.push({\n\t\t\tpid,\n\t\t\tcommand,\n\t\t\ttimestamp: Date.now(),\n\t\t\tisAgentSpawn,\n\t\t});\n\n\t\tif (isAgentSpawn) {\n\t\t\tthis.agentSpawnCount++;\n\t\t\tlogger.info(\"Agent child process spawned\", {\n\t\t\t\tpid,\n\t\t\t\tcommand: command.slice(0, 100),\n\t\t\t\ttotalAgentSpawns: this.agentSpawnCount,\n\t\t\t});\n\t\t}\n\t}\n\n\t/**\n\t * Clean up old child process records.\n\t */\n\tprivate cleanupOldRecords(): void {\n\t\tconst cutoff = Date.now() - this.childProcessWindowMs;\n\t\tconst before = this.childProcesses.length;\n\t\tthis.childProcesses = this.childProcesses.filter(\n\t\t\t(r) => r.timestamp > cutoff,\n\t\t);\n\t\tconst removed = before - this.childProcesses.length;\n\t\tif (removed > 0) {\n\t\t\tlogger.debug(\"Cleaned up child process records\", { removed });\n\t\t}\n\t}\n\n\t/**\n\t * Get statistics about child processes.\n\t */\n\tgetStats(): {\n\t\tisNested: boolean;\n\t\tdepth: number;\n\t\tparentPid: number | null;\n\t\tagentSpawnCount: number;\n\t\trecentChildProcesses: number;\n\t} {\n\t\tthis.cleanupOldRecords();\n\t\treturn {\n\t\t\tisNested: this.isNested,\n\t\t\tdepth: this.agentDepth,\n\t\t\tparentPid: this.parentPid,\n\t\t\tagentSpawnCount: this.agentSpawnCount,\n\t\t\trecentChildProcesses: this.childProcesses.length,\n\t\t};\n\t}\n\n\t/**\n\t * Reset spawn count (e.g., for testing or manual override).\n\t */\n\tresetSpawnCount(): void {\n\t\tthis.agentSpawnCount = 0;\n\t\tlogger.info(\"Agent spawn count reset\");\n\t}\n\n\t/**\n\t * Check if spawning another agent is allowed.\n\t */\n\tcanSpawnAgent(): boolean {\n\t\treturn !this.isAtMaxDepth() && this.agentSpawnCount < this.maxAgentSpawns;\n\t}\n}\n\n/**\n * Global nested agent guard instance.\n */\nexport const nestedAgentGuard = new NestedAgentGuard();\n\n/**\n * Utility function to check if a bash command should be allowed.\n * Returns an error message if blocked, or null if allowed.\n */\nexport function checkBashCommandForNestedAgent(command: string): string | null {\n\tconst result = nestedAgentGuard.checkCommand(command);\n\tif (!result.allowed) {\n\t\treturn result.reason ?? \"Command blocked due to nested agent detection\";\n\t}\n\treturn null;\n}\n"]}
+{"version":3,"file":"nested-agent-guard.js","sourceRoot":"","sources":["../../src/safety/nested-agent-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,2BAA2B,CAAC,CAAC;AAEzD;;GAEG;AACH,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAC5C,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,sDAAsD;AAEjF;;GAEG;AACH,MAAM,oBAAoB,GAAG;IAC5B,+BAA+B;IAC/B,eAAe;IACf,aAAa;IACb,kBAAkB;IAClB,SAAS,EAAE,WAAW;IAEtB,wBAAwB;IACxB,YAAY;IACZ,aAAa;IACb,eAAe;IACf,WAAW;IACX,cAAc;IAEd,+BAA+B;IAC/B,kBAAkB;IAClB,oBAAoB;IACpB,YAAY;CACZ,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAG;IAC1B,oBAAoB;IACpB,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAElB,sBAAsB;IACtB,iBAAiB;IACjB,kBAAkB;IAElB,qBAAqB;IACrB,yBAAyB;IACzB,2BAA2B;CAC3B,CAAC;AAgBF;;GAEG;AACH,MAAM,gBAAgB;IAAtB;QACS,gBAAW,GAAG,KAAK,CAAC;QACpB,aAAQ,GAAG,KAAK,CAAC;QACjB,eAAU,GAAG,CAAC,CAAC;QACf,cAAS,GAAkB,IAAI,CAAC;QAChC,mBAAc,GAAyB,EAAE,CAAC;QAC1C,oBAAe,GAAG,CAAC,CAAC;QACX,mBAAc,GAAG,CAAC,CAAC,CAAC,+BAA+B;QACnD,yBAAoB,GAAG,MAAM,CAAC,CAAC,kBAAkB;IAmNnE,CAAC;IAjNA;;;OAGG;IACH,UAAU;QACT,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,8CAA8C;QAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAE9C,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;YACrB,CAAC;QACF,CAAC;QAED,mCAAmC;QACnC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAE3D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,UAAU;aACtB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,QAAQ;QACP,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,YAAY;QACX,OAAO,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe;QAC3B,qCAAqC;QACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,qCAAqC;QACrC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAC5D,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACrC,aAAa,EAAE,OAAO,CAAC,MAAM;iBAC7B,CAAC,CAAC;gBACH,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EACL,oGAAoG;oBACrG,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC;YACH,CAAC;QACF,CAAC;QAED,iCAAiC;QACjC,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,oBAAoB;gBACpB,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;oBACzB,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;wBACrD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC9B,KAAK,EAAE,IAAI,CAAC,UAAU;wBACtB,QAAQ,EAAE,eAAe;qBACzB,CAAC,CAAC;oBACH,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,yCAAyC,eAAe,iDAAiD;wBACjH,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC;gBACH,CAAC;gBAED,0BAA0B;gBAC1B,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACjD,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;wBACrD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBAC9B,UAAU,EAAE,IAAI,CAAC,eAAe;wBAChC,SAAS,EAAE,IAAI,CAAC,cAAc;qBAC9B,CAAC,CAAC;oBACH,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,kCAAkC,IAAI,CAAC,cAAc,oEAAoE;wBACjI,QAAQ,EAAE,OAAO;wBACjB,OAAO,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC;gBACH,CAAC;gBAED,iBAAiB;gBACjB,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBAC3C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC9B,OAAO,EAAE,OAAO,CAAC,MAAM;oBACvB,KAAK,EAAE,IAAI,CAAC,UAAU;oBACtB,UAAU,EAAE,IAAI,CAAC,eAAe;iBAChC,CAAC,CAAC;gBAEH,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,0DAA0D;oBAClE,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC;YACH,CAAC;QACF,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,kBAAkB,CACjB,GAAW,EACX,OAAe,EACf,YAAqB;QAErB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YACxB,GAAG;YACH,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,YAAY;SACZ,CAAC,CAAC;QAEH,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC1C,GAAG;gBACH,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC9B,gBAAgB,EAAE,IAAI,CAAC,eAAe;aACtC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED;;OAEG;IACK,iBAAiB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,CAC3B,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QACpD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACF,CAAC;IAED;;OAEG;IACH,QAAQ;QAOP,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,UAAU;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,oBAAoB,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM;SAChD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QACd,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,aAAa;QACZ,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC;IAC3E,CAAC;CACD;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe;IAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,MAAM,IAAI,+CAA+C,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC","sourcesContent":["/**\n * Nested Agent Guard\n *\n * Prevents CPU exhaustion from agents spawning nested instances of themselves.\n * This addresses the issue where Claude Code (or similar tools) can inadvertently\n * spawn child instances through bash commands, leading to exponential resource usage.\n *\n * ## Detection Methods\n *\n * 1. **Environment Variable**: Sets MAESTRO_PARENT_PID on startup, child processes\n *    can detect they're running inside a parent instance.\n *\n * 2. **Process Tree Analysis**: Tracks child process spawns and detects recursive patterns.\n *\n * 3. **Command Pattern Detection**: Identifies commands that would spawn nested agents.\n *\n * ## Usage\n *\n * ```typescript\n * import { nestedAgentGuard } from \"./nested-agent-guard.js\";\n *\n * // On startup\n * nestedAgentGuard.initialize();\n *\n * // Check if we're nested\n * if (nestedAgentGuard.isNestedInstance()) {\n *   console.warn(\"Running inside another agent instance\");\n * }\n *\n * // Before spawning commands\n * const check = nestedAgentGuard.checkCommand(\"claude --help\");\n * if (!check.allowed) {\n *   console.error(check.reason);\n * }\n * ```\n */\n\nimport { createLogger } from \"../utils/logger.js\";\n\nconst logger = createLogger(\"safety:nested-agent-guard\");\n\n/**\n * Environment variable set by parent agent instances.\n */\nconst PARENT_PID_ENV = \"MAESTRO_PARENT_PID\";\nconst AGENT_DEPTH_ENV = \"MAESTRO_AGENT_DEPTH\";\nconst MAX_AGENT_DEPTH = 2; // Allow one level of nesting for legitimate use cases\n\n/**\n * Command patterns that spawn agent instances.\n */\nconst AGENT_SPAWN_PATTERNS = [\n\t// Maestro/Claude Code patterns\n\t/\\bcomposer\\b/i,\n\t/\\bclaude\\b/i,\n\t/\\bclaude-code\\b/i,\n\t/\\bcc\\s/i, // cc alias\n\n\t// Other agent CLI tools\n\t/\\baider\\b/i,\n\t/\\bcursor\\b/i,\n\t/\\bcontinue\\b/i,\n\t/\\bcody\\b/i,\n\t/\\bcopilot\\b/i,\n\n\t// Generic agent spawn patterns\n\t/\\bagent\\s+run\\b/i,\n\t/\\bagent\\s+start\\b/i,\n\t/--agent\\b/i,\n];\n\n/**\n * Patterns that indicate intentional recursive spawning (higher risk).\n */\nconst HIGH_RISK_PATTERNS = [\n\t// Running in a loop\n\t/while.*composer/i,\n\t/for.*composer/i,\n\t/xargs.*composer/i,\n\n\t// Background spawning\n\t/composer.*&\\s*$/,\n\t/nohup.*composer/i,\n\n\t// Multiple instances\n\t/composer.*&&.*composer/i,\n\t/composer.*\\|\\|.*composer/i,\n];\n\ninterface CommandCheckResult {\n\tallowed: boolean;\n\treason?: string;\n\tseverity: \"info\" | \"warning\" | \"error\";\n\tpattern?: string;\n}\n\ninterface ChildProcessRecord {\n\tpid: number;\n\tcommand: string;\n\ttimestamp: number;\n\tisAgentSpawn: boolean;\n}\n\n/**\n * Nested agent guard implementation.\n */\nclass NestedAgentGuard {\n\tprivate initialized = false;\n\tprivate isNested = false;\n\tprivate agentDepth = 0;\n\tprivate parentPid: number | null = null;\n\tprivate childProcesses: ChildProcessRecord[] = [];\n\tprivate agentSpawnCount = 0;\n\tprivate readonly maxAgentSpawns = 3; // Max agent spawns per session\n\tprivate readonly childProcessWindowMs = 60_000; // 1 minute window\n\n\t/**\n\t * Initialize the guard on startup.\n\t * Sets environment variables for child processes.\n\t */\n\tinitialize(): void {\n\t\tif (this.initialized) return;\n\n\t\t// Check if we're running inside another agent\n\t\tconst parentPidStr = process.env[PARENT_PID_ENV];\n\t\tconst depthStr = process.env[AGENT_DEPTH_ENV];\n\n\t\tif (parentPidStr) {\n\t\t\tthis.parentPid = Number.parseInt(parentPidStr, 10);\n\t\t\tthis.isNested = !Number.isNaN(this.parentPid);\n\t\t}\n\n\t\tif (depthStr) {\n\t\t\tthis.agentDepth = Number.parseInt(depthStr, 10);\n\t\t\tif (Number.isNaN(this.agentDepth)) {\n\t\t\t\tthis.agentDepth = 0;\n\t\t\t}\n\t\t}\n\n\t\t// Set environment for our children\n\t\tprocess.env[PARENT_PID_ENV] = String(process.pid);\n\t\tprocess.env[AGENT_DEPTH_ENV] = String(this.agentDepth + 1);\n\n\t\tif (this.isNested) {\n\t\t\tlogger.warn(\"Running as nested agent instance\", {\n\t\t\t\tparentPid: this.parentPid,\n\t\t\t\tdepth: this.agentDepth,\n\t\t\t});\n\t\t}\n\n\t\tthis.initialized = true;\n\t}\n\n\t/**\n\t * Check if this instance is running inside another agent.\n\t */\n\tisNestedInstance(): boolean {\n\t\treturn this.isNested;\n\t}\n\n\t/**\n\t * Get the current nesting depth.\n\t */\n\tgetDepth(): number {\n\t\treturn this.agentDepth;\n\t}\n\n\t/**\n\t * Check if nesting depth is at or above the limit.\n\t */\n\tisAtMaxDepth(): boolean {\n\t\treturn this.agentDepth >= MAX_AGENT_DEPTH;\n\t}\n\n\t/**\n\t * Check if a command would spawn a nested agent.\n\t */\n\tcheckCommand(command: string): CommandCheckResult {\n\t\t// Clean up old child process records\n\t\tthis.cleanupOldRecords();\n\n\t\t// Check for high-risk patterns first\n\t\tfor (const pattern of HIGH_RISK_PATTERNS) {\n\t\t\tif (pattern.test(command)) {\n\t\t\t\tlogger.warn(\"High-risk nested agent spawn pattern detected\", {\n\t\t\t\t\tcommandPreview: command.slice(0, 100),\n\t\t\t\t\tpatternSource: pattern.source,\n\t\t\t\t});\n\t\t\t\treturn {\n\t\t\t\t\tallowed: false,\n\t\t\t\t\treason:\n\t\t\t\t\t\t\"Blocked: Command matches high-risk recursive agent spawn pattern. This could cause CPU exhaustion.\",\n\t\t\t\t\tseverity: \"error\",\n\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Check for agent spawn patterns\n\t\tfor (const pattern of AGENT_SPAWN_PATTERNS) {\n\t\t\tif (pattern.test(command)) {\n\t\t\t\t// Check depth limit\n\t\t\t\tif (this.isAtMaxDepth()) {\n\t\t\t\t\tlogger.warn(\"Agent spawn blocked due to depth limit\", {\n\t\t\t\t\t\tcommand: command.slice(0, 100),\n\t\t\t\t\t\tdepth: this.agentDepth,\n\t\t\t\t\t\tmaxDepth: MAX_AGENT_DEPTH,\n\t\t\t\t\t});\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Blocked: Maximum agent nesting depth (${MAX_AGENT_DEPTH}) reached. Cannot spawn another agent instance.`,\n\t\t\t\t\t\tseverity: \"error\",\n\t\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\t// Check spawn count limit\n\t\t\t\tif (this.agentSpawnCount >= this.maxAgentSpawns) {\n\t\t\t\t\tlogger.warn(\"Agent spawn blocked due to count limit\", {\n\t\t\t\t\t\tcommand: command.slice(0, 100),\n\t\t\t\t\t\tspawnCount: this.agentSpawnCount,\n\t\t\t\t\t\tmaxSpawns: this.maxAgentSpawns,\n\t\t\t\t\t});\n\t\t\t\t\treturn {\n\t\t\t\t\t\tallowed: false,\n\t\t\t\t\t\treason: `Blocked: Maximum agent spawns (${this.maxAgentSpawns}) reached in this session. This prevents runaway process spawning.`,\n\t\t\t\t\t\tseverity: \"error\",\n\t\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\t// Allow but warn\n\t\t\t\tlogger.info(\"Agent spawn command detected\", {\n\t\t\t\t\tcommand: command.slice(0, 100),\n\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t\tdepth: this.agentDepth,\n\t\t\t\t\tspawnCount: this.agentSpawnCount,\n\t\t\t\t});\n\n\t\t\t\treturn {\n\t\t\t\t\tallowed: true,\n\t\t\t\t\treason: \"Warning: This command may spawn a nested agent instance.\",\n\t\t\t\t\tseverity: \"warning\",\n\t\t\t\t\tpattern: pattern.source,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn { allowed: true, severity: \"info\" };\n\t}\n\n\t/**\n\t * Record a child process spawn.\n\t */\n\trecordChildProcess(\n\t\tpid: number,\n\t\tcommand: string,\n\t\tisAgentSpawn: boolean,\n\t): void {\n\t\tthis.childProcesses.push({\n\t\t\tpid,\n\t\t\tcommand,\n\t\t\ttimestamp: Date.now(),\n\t\t\tisAgentSpawn,\n\t\t});\n\n\t\tif (isAgentSpawn) {\n\t\t\tthis.agentSpawnCount++;\n\t\t\tlogger.info(\"Agent child process spawned\", {\n\t\t\t\tpid,\n\t\t\t\tcommand: command.slice(0, 100),\n\t\t\t\ttotalAgentSpawns: this.agentSpawnCount,\n\t\t\t});\n\t\t}\n\t}\n\n\t/**\n\t * Clean up old child process records.\n\t */\n\tprivate cleanupOldRecords(): void {\n\t\tconst cutoff = Date.now() - this.childProcessWindowMs;\n\t\tconst before = this.childProcesses.length;\n\t\tthis.childProcesses = this.childProcesses.filter(\n\t\t\t(r) => r.timestamp > cutoff,\n\t\t);\n\t\tconst removed = before - this.childProcesses.length;\n\t\tif (removed > 0) {\n\t\t\tlogger.debug(\"Cleaned up child process records\", { removed });\n\t\t}\n\t}\n\n\t/**\n\t * Get statistics about child processes.\n\t */\n\tgetStats(): {\n\t\tisNested: boolean;\n\t\tdepth: number;\n\t\tparentPid: number | null;\n\t\tagentSpawnCount: number;\n\t\trecentChildProcesses: number;\n\t} {\n\t\tthis.cleanupOldRecords();\n\t\treturn {\n\t\t\tisNested: this.isNested,\n\t\t\tdepth: this.agentDepth,\n\t\t\tparentPid: this.parentPid,\n\t\t\tagentSpawnCount: this.agentSpawnCount,\n\t\t\trecentChildProcesses: this.childProcesses.length,\n\t\t};\n\t}\n\n\t/**\n\t * Reset spawn count (e.g., for testing or manual override).\n\t */\n\tresetSpawnCount(): void {\n\t\tthis.agentSpawnCount = 0;\n\t\tlogger.info(\"Agent spawn count reset\");\n\t}\n\n\t/**\n\t * Check if spawning another agent is allowed.\n\t */\n\tcanSpawnAgent(): boolean {\n\t\treturn !this.isAtMaxDepth() && this.agentSpawnCount < this.maxAgentSpawns;\n\t}\n}\n\n/**\n * Global nested agent guard instance.\n */\nexport const nestedAgentGuard = new NestedAgentGuard();\n\n/**\n * Utility function to check if a bash command should be allowed.\n * Returns an error message if blocked, or null if allowed.\n */\nexport function checkBashCommandForNestedAgent(command: string): string | null {\n\tconst result = nestedAgentGuard.checkCommand(command);\n\tif (!result.allowed) {\n\t\treturn result.reason ?? \"Command blocked due to nested agent detection\";\n\t}\n\treturn null;\n}\n"]}

package/dist/safety/policy.d.ts

@@ -1,13 +1,13 @@
 /**
  * Enterprise Policy System - Access Control and Safety Enforcement
  *
- * This module implements enterprise-grade policy enforcement for the Composer CLI,
+ * This module implements enterprise-grade policy enforcement for the Maestro CLI,
  * enabling organizations to control what tools, models, paths, and network hosts
  * can be accessed during agent execution.
  *
  * ## Policy File Location
  *
- * Policies are loaded from `~/.maestro/policy.json` (or the legacy Composer
+ * Policies are loaded from `~/.maestro/policy.json` (or the legacy `.composer`
  * policy file as a fallback) and `.maestro/workspace.toml` in the current
  * workspace. The global JSON file is typically deployed by enterprise IT and
  * should be protected with appropriate permissions. Workspace TOML applies a

package/dist/safety/policy.js

@@ -1,13 +1,13 @@
 /**
  * Enterprise Policy System - Access Control and Safety Enforcement
  *
- * This module implements enterprise-grade policy enforcement for the Composer CLI,
+ * This module implements enterprise-grade policy enforcement for the Maestro CLI,
  * enabling organizations to control what tools, models, paths, and network hosts
  * can be accessed during agent execution.
  *
  * ## Policy File Location
  *
- * Policies are loaded from `~/.maestro/policy.json` (or the legacy Composer
+ * Policies are loaded from `~/.maestro/policy.json` (or the legacy `.composer`
  * policy file as a fallback) and `.maestro/workspace.toml` in the current
  * workspace. The global JSON file is typically deployed by enterprise IT and
  * should be protected with appropriate permissions. Workspace TOML applies a