@kal-elsam/kairo-runtime 0.26.0 → 0.26.1

package/CHANGELOG.md

@@ -5,6 +5,18 @@ Historical entries below may reference the legacy `@kal-elsam/harness` package n
 
 ## Unreleased
 
+## 0.26.1 — 2026-09-19 (Kairo Runtime)
+
+Patch release. Claude model entitlement probe + cache (no routing change yet).
+
+### Added
+
+- Live Claude per-model entitlement probe (`claude -p hi --model … --output-format
+  json`) with fail-closed classification (allowed / denied / unverified) and a
+  `~/.harness/claude-entitlement.json` cache invalidated by subscription type
+  change or a 7-day per-entry TTL. Pure additive — recommendation and automatic
+  pools are unchanged until the next increment wires entitlement into the catalog.
+
 ## 0.26.0 — 2026-09-19 (Kairo Runtime)
 
 Minor release. ASK is now ready for every real automatic adapter.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kal-elsam/kairo-runtime",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Kairo Runtime — local agent operating system for Codex, Cursor, Claude, Pi, Engram, and Graphify.",
   "type": "module",
   "homepage": "https://github.com/Kal-elSam/harness#readme",

package/src/global/observability/claude-entitlement-store.js

@@ -0,0 +1,167 @@
+// Disk cache for Claude per-model entitlement probes. Mirrors the
+// artificial-analysis-models.js pattern (read→null on any failure, mkdir +
+// writeAtomicJson, fetchedAt / ageLabel) — not usage-store.js, whose
+// whitelist is for real billing providers.
+
+import { mkdir, readFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { harnessHomePaths } from "../paths.js";
+import { writeAtomicJson } from "../runtime/write-atomic-json.js";
+import { ENTITLEMENT } from "./claude-model-entitlement.js";
+
+export const DEFAULT_ENTITLEMENT_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+
+function ageLabel(fetchedAtIso, nowMs = Date.now()) {
+  const fetchedAt = new Date(fetchedAtIso ?? "").getTime();
+  if (!Number.isFinite(fetchedAt)) return null;
+  const hours = (nowMs - fetchedAt) / 3_600_000;
+  if (hours < 1) return "<1h";
+  if (hours < 48) return `${Math.round(hours)}h`;
+  return `${Math.round(hours / 24)}d`;
+}
+
+function isPersistableStatus(status) {
+  return status === ENTITLEMENT.ALLOWED || status === ENTITLEMENT.DENIED;
+}
+
+function emptyDoc(subscriptionType, fetchedAt = new Date().toISOString()) {
+  return {
+    subscriptionType: subscriptionType ?? null,
+    fetchedAt,
+    models: Object.create(null)
+  };
+}
+
+/**
+ * @param {string} homeDir
+ * @param {object} [deps]
+ * @returns {Promise<object|null>}
+ */
+export async function readClaudeEntitlementCache(homeDir, deps = {}) {
+  const read = deps.readFile ?? readFile;
+  try {
+    const raw = await read(harnessHomePaths(homeDir).claudeEntitlementPath, "utf8");
+    const doc = JSON.parse(raw);
+    if (!doc || typeof doc !== "object") return null;
+    if (typeof doc.fetchedAt !== "string") return null;
+    if (!doc.models || typeof doc.models !== "object" || Array.isArray(doc.models)) return null;
+    return doc;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {string} homeDir
+ * @param {object} doc
+ * @param {object} [deps]
+ */
+export async function writeClaudeEntitlementCache(homeDir, doc, deps = {}) {
+  const mkdirImpl = deps.mkdir ?? mkdir;
+  const writeJson = deps.writeAtomicJson ?? writeAtomicJson;
+  const path = harnessHomePaths(homeDir).claudeEntitlementPath;
+  await mkdirImpl(dirname(path), { recursive: true });
+  await writeJson(path, doc);
+}
+
+/**
+ * Pure resolver: map catalog ids → live entitlement view from cache.
+ * Invalidates the entire cache when subscriptionType differs.
+ *
+ * @param {{
+ *   cache: object|null,
+ *   subscriptionType: string|null,
+ *   catalogIds: string[],
+ *   now?: number,
+ *   ttlMs?: number
+ * }} options
+ * @returns {Record<string, { status: string, reason: string|null, age: string|null, probedAt: string|null }>}
+ */
+export function resolveClaudeEntitlements({
+  cache,
+  subscriptionType,
+  catalogIds = [],
+  now = Date.now(),
+  ttlMs = DEFAULT_ENTITLEMENT_TTL_MS
+} = {}) {
+  const usable = cache
+    && typeof cache === "object"
+    && cache.subscriptionType === subscriptionType
+    && cache.models
+    && typeof cache.models === "object"
+    ? cache
+    : null;
+
+  const resolved = Object.create(null);
+  for (const modelId of catalogIds) {
+    const entry = usable?.models?.[modelId] ?? null;
+    if (!entry || !isPersistableStatus(entry.status)) {
+      resolved[modelId] = {
+        status: ENTITLEMENT.UNVERIFIED,
+        reason: null,
+        age: null,
+        probedAt: null
+      };
+      continue;
+    }
+
+    const probedAtMs = new Date(entry.probedAt ?? "").getTime();
+    if (!Number.isFinite(probedAtMs) || now - probedAtMs > ttlMs) {
+      resolved[modelId] = {
+        status: ENTITLEMENT.UNVERIFIED,
+        reason: null,
+        age: ageLabel(entry.probedAt, now),
+        probedAt: entry.probedAt ?? null
+      };
+      continue;
+    }
+
+    resolved[modelId] = {
+      status: entry.status,
+      reason: entry.reason ?? null,
+      age: ageLabel(entry.probedAt, now),
+      probedAt: entry.probedAt
+    };
+  }
+  return resolved;
+}
+
+/**
+ * Merge fresh probe results into a cache doc. Discards status "unknown"
+ * (and unverified) — only allowed/denied evidence is persisted.
+ *
+ * @param {object|null} cache
+ * @param {{ subscriptionType: string|null, catalogIds?: string[], results: Array<{ modelId: string, status: string, reason?: string|null, probedAt?: string }> }} payload
+ */
+export function mergeEntitlementResults(cache, { subscriptionType, results = [] } = {}) {
+  const base = cache
+    && typeof cache === "object"
+    && cache.subscriptionType === subscriptionType
+    && cache.models
+    && typeof cache.models === "object"
+    ? {
+      subscriptionType: cache.subscriptionType,
+      fetchedAt: cache.fetchedAt,
+      models: { ...cache.models }
+    }
+    : emptyDoc(subscriptionType);
+
+  let newestProbedAt = base.fetchedAt;
+  for (const result of results) {
+    if (!result || typeof result.modelId !== "string") continue;
+    if (result.status === "unknown" || !isPersistableStatus(result.status)) continue;
+    const probedAt = typeof result.probedAt === "string"
+      ? result.probedAt
+      : new Date().toISOString();
+    base.models[result.modelId] = {
+      status: result.status,
+      reason: result.reason ?? null,
+      probedAt
+    };
+    if (!newestProbedAt || probedAt > newestProbedAt) newestProbedAt = probedAt;
+  }
+
+  base.fetchedAt = newestProbedAt ?? new Date().toISOString();
+  base.subscriptionType = subscriptionType ?? null;
+  return base;
+}

package/src/global/observability/claude-model-entitlement.js

@@ -0,0 +1,185 @@
+// Live per-model Claude entitlement probe. Kept separate from
+// claude-models.js on purpose: that module is sync, free, and pure, and
+// three of its four callers sit on hot paths. This module is the only
+// place that interprets the real `claude -p … --output-format json`
+// response for account access — fail-closed, never inventing allowed.
+
+import { spawn as defaultSpawn } from "node:child_process";
+import { buildClaudeExecutionEnv } from "../runtime/execution-adapters/claude.js";
+
+export const ENTITLEMENT = Object.freeze({
+  ALLOWED: "allowed",
+  DENIED: "denied",
+  UNVERIFIED: "unverified"
+});
+
+const DENIED_ERROR_CODES = new Set(["credits_required"]);
+const DENIED_HTTP_STATUSES = new Set([402, 403, 429]);
+const DEFAULT_TIMEOUT_MS = 30_000;
+const PROBE_ARGS_PREFIX = Object.freeze(["-p", "hi", "--model"]);
+const PROBE_ARGS_SUFFIX = Object.freeze(["--output-format", "json"]);
+
+/**
+ * Pure classifier for a parsed Claude CLI `--output-format json` result.
+ * The only place that interprets the real JSON shape for entitlement.
+ *
+ * @param {object|null|undefined} parsed
+ * @returns {{ status: string, reason: string|null }}
+ */
+export function classifyClaudeEntitlementResponse(parsed) {
+  if (!parsed || typeof parsed !== "object") {
+    return { status: ENTITLEMENT.UNVERIFIED, reason: null };
+  }
+
+  const isError = parsed.is_error === true;
+  const status = parsed.api_error_status;
+  const code = parsed.api_error_code;
+  const message = typeof parsed.result === "string" && parsed.result.trim()
+    ? parsed.result
+    : null;
+
+  if (
+    isError
+    && (DENIED_ERROR_CODES.has(code) || DENIED_HTTP_STATUSES.has(status))
+  ) {
+    return { status: ENTITLEMENT.DENIED, reason: message };
+  }
+
+  if (parsed.is_error === false && (status === null || status === undefined)) {
+    return { status: ENTITLEMENT.ALLOWED, reason: null };
+  }
+
+  return { status: ENTITLEMENT.UNVERIFIED, reason: message };
+}
+
+function probeArgv(modelId) {
+  return [...PROBE_ARGS_PREFIX, modelId, ...PROBE_ARGS_SUFFIX];
+}
+
+function unverifiedResult(modelId, reason = null) {
+  return {
+    modelId,
+    status: ENTITLEMENT.UNVERIFIED,
+    reason: reason == null ? null : String(reason),
+    probedAt: new Date().toISOString()
+  };
+}
+
+/**
+ * Probe a single Claude model id via the measured CLI shape.
+ * @param {{ modelId: string, spawn?: typeof defaultSpawn, cwd?: string, env?: NodeJS.ProcessEnv, timeoutMs?: number }} options
+ */
+export async function probeClaudeModelEntitlement({
+  modelId,
+  spawn = defaultSpawn,
+  cwd = process.cwd(),
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS
+} = {}) {
+  if (typeof modelId !== "string" || !modelId) {
+    return unverifiedResult(modelId ?? "", "modelId is required");
+  }
+
+  let child;
+  try {
+    child = spawn("claude", probeArgv(modelId), {
+      cwd,
+      env: buildClaudeExecutionEnv(env),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch (error) {
+    return unverifiedResult(modelId, error?.message ?? error);
+  }
+
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let finished = false;
+    const timer = setTimeout(
+      () => finish(unverifiedResult(modelId, `claude entitlement probe timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+
+    function finish(result) {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      try { child.kill?.(); } catch { /* best effort */ }
+      resolve(result);
+    }
+
+    child.stdout?.on("data", (chunk) => { stdout += chunk; });
+    child.stderr?.on("data", (chunk) => { stderr += chunk; });
+    child.once?.("error", (error) => finish(unverifiedResult(modelId, error?.message ?? error)));
+    child.once?.("close", (code, signal) => {
+      if (signal) {
+        return finish(unverifiedResult(
+          modelId,
+          `claude entitlement probe was killed by signal ${signal}${stderr ? `: ${stderr.trim()}` : ""}`
+        ));
+      }
+
+      let parsed = null;
+      try {
+        const trimmed = String(stdout ?? "").trim();
+        parsed = trimmed ? JSON.parse(trimmed) : null;
+      } catch {
+        return finish(unverifiedResult(
+          modelId,
+          `claude entitlement probe returned invalid JSON${stderr ? `: ${stderr.trim()}` : ""}`
+        ));
+      }
+
+      const classified = classifyClaudeEntitlementResponse(parsed);
+      // A non-zero exit with a classifiable JSON body still trusts the body —
+      // the measured denied probe exits 0, but broken/unknown shapes stay
+      // unverified regardless of exit code. Never promote a failed spawn to
+      // allowed just because exit was 0 with empty stdout (parsed null →
+      // unverified above).
+      if (classified.status === ENTITLEMENT.ALLOWED && code !== 0) {
+        return finish(unverifiedResult(
+          modelId,
+          `claude entitlement probe exited with code ${code}${stderr ? `: ${stderr.trim()}` : ""}`
+        ));
+      }
+
+      finish({
+        modelId,
+        status: classified.status,
+        reason: classified.reason,
+        probedAt: new Date().toISOString()
+      });
+    });
+  });
+}
+
+/**
+ * Probe many model ids sequentially (never Promise.all). Caps at maxProbes.
+ * @param {{
+ *   modelIds: string[],
+ *   maxProbes?: number,
+ *   onProgress?: (event: { modelId: string, index: number, total: number, result: object }) => void,
+ *   spawn?: typeof defaultSpawn,
+ *   cwd?: string,
+ *   env?: NodeJS.ProcessEnv,
+ *   timeoutMs?: number
+ * }} options
+ */
+export async function probeClaudeModelEntitlements({
+  modelIds = [],
+  maxProbes = 12,
+  onProgress = null,
+  ...probeOpts
+} = {}) {
+  const ids = Array.isArray(modelIds) ? modelIds.slice(0, Math.max(0, maxProbes)) : [];
+  const results = [];
+  for (let index = 0; index < ids.length; index += 1) {
+    const modelId = ids[index];
+    const result = await probeClaudeModelEntitlement({ modelId, ...probeOpts });
+    results.push(result);
+    if (typeof onProgress === "function") {
+      onProgress({ modelId, index, total: ids.length, result });
+    }
+  }
+  return results;
+}

package/src/global/observability/codex-models.js

@@ -89,7 +89,7 @@ export async function readCodexModels({
     child.once?.("close", () => { if (!finished) finish(unknown("codex app-server closed before model list")); });
 
     writeRequest(child, 1, "initialize", {
-      clientInfo: { name: "kairo", title: "Kairo", version: "0.26.0" },
+      clientInfo: { name: "kairo", title: "Kairo", version: "0.26.1" },
       capabilities: {}
     });
   });

package/src/global/observability/codex-usage.js

@@ -151,7 +151,7 @@ export async function readCodexUsage({
     child.once?.("close", () => { if (!finished) finish(unknown("codex app-server closed before rate limits")); });
 
     writeRequest(child, 1, "initialize", {
-      clientInfo: { name: "kairo", title: "Kairo", version: "0.26.0" },
+      clientInfo: { name: "kairo", title: "Kairo", version: "0.26.1" },
       capabilities: {}
     });
   });

package/src/global/paths.js

@@ -28,6 +28,7 @@ export function harnessHomePaths(homeDir) {
     worktreesDir: join(root, "worktrees"),
     usageDir: join(root, "usage"),
     modelIntelligencePath: join(root, "model-intelligence.json"),
+    claudeEntitlementPath: join(root, "claude-entitlement.json"),
     huggingfaceLeaderboardPath: join(root, "huggingface-leaderboard.json")
   };
 }