@koda-sl/baker-bridge 0.108.0 → 0.109.0-dev.557795bef

package/README.md

@@ -41,8 +41,10 @@ await server.start();
 | `BAKER_API_KEY` | API key for Convex callbacks (`bk_...`) |
 | `BAKER_BASE_BRANCH` | Git base branch for sandbox baseline lookups. Defaults to `main`; `/company`, `/brand`, `/knowledge`, landing definition, and `/flows/:slug` endpoints use the merge-base with this ref when `?baseline=1` is requested |
 | `INTERNAL_SECRET_KEY` | AES key for encrypting flow `_data.json` config at rest |
+| `BAKER_RUNTIME_COMPANY_ID` | Optional. The company the Runtime works for; stamped into each Form destination the bridge seals. Deliberately not `BAKER_COMPANY_ID`, which the scaffold build reads as a production deploy setting |
 | `ANTHROPIC_API_KEY` | Anthropic API key (required by the Agent SDK) |
 | `ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN` | OpenRouter routing (base URL + per-org key) injected into the sandbox. Forwarded to the Agent SDK subprocess so the agent can reach its model |
+| `OPENROUTER_API_KEY` | The same per-org key under its own name. The bridge reads the user's and the agent's words with it before letting two kinds of call through: a question asking the user to pick an avatar's face (the casting picker shows real portraits), and an avatar accent in a language nobody asked for. Unset or unreachable, both calls go through unchecked |
 | `CLAUDE_CODE_EXTRA_BODY` | Optional JSON merged by the CLI into every model request body. The bridge sets/extends it per turn with a per-thread `session_id` so OpenRouter sticky-routes the whole conversation to one provider instance and its instance-scoped prompt cache is re-read across the turn's many tool-call requests (see [Prompt-cache pinning](#prompt-cache-pinning)). It also defaults `provider` to Bedrock first (see [Bedrock is the preferred provider](#bedrock-is-the-preferred-provider)). Any inherited value is merged; our `session_id` and the `web`-plugin opt-out win (see [OpenRouter web plugin is forced off](#openrouter-web-plugin-is-forced-off)). An inherited `provider` replaces the Bedrock default |
 | `BAKER_CHAT_ID` | Present only when running inside a chat sandbox. When set, the bridge relocates Claude Code auto-memory into the cloned repo (`.claude/memory`) — see [Session journal](#session-journal-agent-memory) |
 | `BAKER_ACTING_USER_ID` | Injected into the Agent SDK subprocess env per turn (when the turn's sender is known) so in-sandbox `baker` CLI calls can scope work to the acting user — e.g. `baker mcp add --scope user` |
@@ -51,10 +53,26 @@ await server.start();
 | `NO_COLOR` | Set to `1` on every Agent SDK subprocess so `baker --help` output carries no ANSI escapes — see [Session surface](#session-surface) |
 | `BAKER_AGENT_MODEL` | Optional. Runs every turn in this runtime on the named model instead of the default, and is forwarded to subagents as `CLAUDE_CODE_SUBAGENT_MODEL`. Ignored unless it names a model with a known context window — see [Model selection](#model-selection) |
 | `CLAUDE_CODE_SUBAGENT_MODEL`, `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` | Set on the Agent SDK subprocess only when `BAKER_AGENT_MODEL` is set. Together they override the `model:` each subagent pins in its own frontmatter |
-| `LATITUDE_API_KEY` / `LATITUDE_PROJECT` | Optional, both or neither. When set, every turn is traced to that Latitude project — see [Latitude tracing](#latitude-tracing) |
+| `BAKER_CREDENTIALS` | Set to `1` in a Runtime with Credentials (the credential broker is running). Only then is `request_credential` offered to the agent; otherwise a call to it is refused |
 
 All variables are validated at startup via `@t3-oss/env-core` + `zod`.
 
+## Credential broker (`baker-credential-broker`)
+
+A second bin, run as root in the sandbox before the agent starts, so the agent can use the user's stored credentials without ever seeing them. A third, `baker-credential-broker-supervisor`, takes the same environment, runs the broker and starts it again whenever it exits, stops answering `GET /health`, or fails to start at all; on `SIGTERM` it stops the broker and kills it if it is still running 5 s later; it is what a Runtime starts. It runs out of the OOM killer's reach with the broker's heap capped, and the bridge marks every process its agent starts as the OOM killer's first choice — through a command wrapper it passes as `CLAUDE_CODE_SHELL_PREFIX` (unless the Runtime set one), backed by a 2-second scan — so memory pressure ends one command, never the turn. `src/hono/oom-priority.agent.test.ts` runs the SDK's own agent binary through the wrapper, so an upgrade that changes how it calls `CLAUDE_CODE_SHELL_PREFIX` fails the suite. The agent writes `{{credential:NAME}}` in a request; the broker is an HTTP(S) proxy on `127.0.0.1` that swaps in the real value and swaps it back out of the response.
+
+| Variable | Description |
+|---|---|
+| `CREDENTIAL_BROKER_TOKEN` | Required. Authenticates the broker to Baker's credential routes |
+| `BAKER_CONVEX_SITE_URL` | Required. Baker's site URL |
+| `BAKER_CREDENTIAL_PROXY_PORT` | Proxy port (default `8877`) |
+| `BAKER_CA_DIR` | Where the broker's CA key (0600) and cert live (default `/etc/baker-ca`); run as root it also installs the cert into the system bundle |
+| `BAKER_BROKER_SOCKET` | Unix socket for the bridge (default `/run/baker/broker.sock`): `POST /scrub`, `GET /health` |
+
+The agent's processes get `agentProxyEnv()`: `HTTP(S)_PROXY` pointing at the broker, `NO_PROXY` for loopback plus the model gateway, `NODE_USE_ENV_PROXY=1`, `NODE_EXTRA_CA_CERTS` set to the broker's CA, and `REQUESTS_CA_BUNDLE` / `SSL_CERT_FILE` / `CURL_CA_BUNDLE` set to the system bundle.
+
+Security model: a value is only substituted over https, and only for a host the user allowed for that credential. A placeholder in the URL or a header that is not allowed for the host, or that names no stored credential, is refused (403 / 404, or 503 while credentials can't be fetched) before anything leaves the sandbox. A placeholder that appears only in the body is left as plain text unless it names a credential allowed for that host. Response headers and text bodies up to 10 MB are scrubbed back to placeholders; those responses arrive buffered rather than streamed. The socket never returns a value. Once one fetch has succeeded, `/scrub` answers from the last good table while a refresh is in flight; the bridge retries a failed `/scrub` three times (0.25 s, 1 s, 3 s) before withholding a tool result.
+
 ## Session surface
 
 The Agent SDK ships developer-facing surfaces a marketer's session can never
@@ -87,9 +105,10 @@ use, and each one costs context on every turn. The bridge trims them at the
 - **Tools that reach past one session are disallowed** — `EnterWorktree` and
   `ExitWorktree` (the workspace's branches belong to the chat-branch and publish
   model, which has no account of a second checkout), `Workflow` (fans out dozens
-  of agents in one call on the organization's key), and `SendMessage` (a runtime
-  holds exactly one session, so there is no peer to address). `Task` itself is
-  *not* disallowed — it is the subagent spawn the workspace's own agents ride.
+  of agents in one call on the organization's key). `Task` itself is *not*
+  disallowed — it is the subagent spawn the workspace's own agents ride — and
+  neither is `SendMessage`, which continues a subagent the session already ran;
+  the turn stays open until the continued subagent finishes.
 
 To see what a session actually ends up with, read the tool list off its own
 `init` message (`--output-format stream-json --verbose`) rather than this list:
@@ -108,19 +127,19 @@ subagents in `.claude/agents/`, discovered from disk via
 ## Model selection
 
 Every turn runs on `claude-opus-5-5` by default — a deliberate quality-over-cost
-choice. Opus 5.5 is $4/$20 per MTok on OpenRouter against Sonnet 5's $2/$10, i.e.
+choice. Opus 5.5 is $4/$20 per MTok on OpenRouter against Sonnet 5.5's $2/$10, i.e.
 2x on input, output *and* cache reads. Two things contain the cost: the main
 thread runs at `medium` effort (see **Reasoning effort** below), and the shared
-subagents pin themselves to `claude-sonnet-5` in their own frontmatter rather
+subagents pin themselves to `claude-sonnet-5-5` in their own frontmatter rather
 than inheriting this default — without that pin every fan-out worker would move
 to Opus pricing too.
 
 ### Overriding the model for a whole runtime
 
 Set `BAKER_AGENT_MODEL` to run every turn in that runtime on another model. It
-accepts either form of id (`claude-haiku-4-5` or `anthropic/claude-haiku-4.5`)
+accepts either form of id (`claude-haiku-5-5` or `anthropic/claude-haiku-5.5`)
 and is normalised to what the Agent SDK expects. Development deployments set it
-to `claude-haiku-4-5`, where turnaround matters more than capability.
+to `claude-haiku-5-5`, where turnaround matters more than capability.
 
 Two things it does that a plain model option does not:
 
@@ -157,9 +176,11 @@ prompt text on the newest user message instead; that leaves earlier breakpoints
 intact.
 
 Subagents set their own `effort` (and `model`) in their markdown frontmatter and
-do **not** inherit either from the main thread. The three scaffold-shared agents
-all run `claude-sonnet-5`: `creative-producer` and `landing-finish-reviewer` at
-`effort: low`, `research` at `effort: medium`. Either way it is cache-safe —
+do **not** inherit either from the main thread. The four scaffold-shared agents
+all run `claude-sonnet-5-5`: `landing-finish-reviewer`, `research` and
+`visual-check` at `effort: low`, `creative-producer` at `effort: medium`
+(rebuilding a reference's winning mechanism for a brand is judgment, not a
+mechanical build). Either way it is cache-safe —
 a subagent carries its own context, so it cannot invalidate the parent's prefix.
 
 ## Prompt-cache pinning
@@ -185,23 +206,37 @@ cache stays warm while the Bedrock default is set.
 
 ## Bedrock is the preferred provider
 
-The same `CLAUDE_CODE_EXTRA_BODY` value carries
-`provider: { order: ["amazon-bedrock"], allow_fallbacks: true }`. Without it,
-OpenRouter load-balances Claude across Anthropic, Vertex, Azure and Bedrock by
-price and uptime, and the `session_id` pin then holds the conversation on whichever
-it picked first. With it, every request goes to Bedrock first and only moves to
-another provider when Bedrock is down or rate-limited. An inherited `provider`
-(set in the sandbox's `CLAUDE_CODE_EXTRA_BODY`) replaces this default as an
-operator override.
+The same `CLAUDE_CODE_EXTRA_BODY` value carries a `provider` with
+`allow_fallbacks: true` and this `order`:
+
+```json
+["amazon-bedrock", "amazon-bedrock/eu-west-1", "amazon-bedrock/us-east-1"]
+```
+
+Without it, OpenRouter load-balances Claude across Anthropic, Vertex, Azure and
+Bedrock by price and uptime, and the `session_id` pin then holds the conversation
+on whichever it picked first. With it, every request goes to Bedrock first, then
+to the two regional Bedrock endpoints, and only moves to another provider when all
+three fail. The regions are there because Bedrock's failure mode is AWS capacity,
+not our quota: on weekday mornings the default endpoint answers `503` to most Opus
+5.5 requests for hours, and AWS's advice for a `503` is another region. All three
+run on our own Bedrock key; the providers after them bill OpenRouter credits. An
+inherited `provider` (set in the sandbox's `CLAUDE_CODE_EXTRA_BODY`) replaces this
+default as an operator override.
 
 A manual `order` bypasses OpenRouter's sticky routing, so while it is set the
 `session_id` pin above is inert and the `order` is what keeps the cache warm. The
 bare `amazon-bedrock` slug is a single endpoint (regional endpoints are separate
-slugs), so every request lands on the same one; measured, consecutive requests
-read the whole cached prefix back. The cost is on fallback: each request retries
-Bedrock first, so a cache warmed on the fallback provider is not reused while
-Bedrock is flapping. The `session_id` pin still applies whenever an inherited
-`provider` drops the `order`.
+slugs), so while it is healthy every request lands on the same one; measured,
+consecutive requests read the whole cached prefix back. The cost is on fallback.
+Each endpoint keeps its own cache, the regional Bedrock ones included, so a
+request that moves to the next endpoint starts cold and pays its whole prefix;
+and each request retries the default endpoint first, so a cache warmed further
+down the `order` is not reused while Bedrock is flapping. During a capacity
+window every request also waits for the default endpoint's `503` (about 7 s)
+before moving on.
+The `session_id` pin still applies whenever an inherited `provider` drops the
+`order`.
 
 The preference only holds for a request Bedrock can serve, and OpenRouter drops
 Bedrock from the route without an error when it can't. From Opus 5.5 the CLI
@@ -227,19 +262,6 @@ and other server tools are opt-in via `tools` only, so there is nothing to disab
 for those. An admin who sets "Prevent overrides" on the plugin wins over this field —
 the account setting is then the only off-switch.
 
-## Latitude tracing
-
-With `LATITUDE_API_KEY` and `LATITUDE_PROJECT` in the environment, the bridge
-registers Latitude's Claude Code hook (`@latitude-data/claude-code-telemetry`,
-pinned) on `Stop` and `SessionEnd` through the per-query `settings`. At the end
-of each turn it uploads the turn as a trace: the prompt, every model call with
-its tokens, every tool call with its result, subagents and auto-memory. Each
-trace carries the workspace's git repo (`metadata.git.repo`, the company) and
-branch (`metadata.git.branch`, the chat); the Latitude session is the Claude
-session. Session reviews are not traced. Without both
-variables nothing is registered. Content is sent in full; mask attributes with
-`LATITUDE_REDACT_ATTRIBUTES` if needed.
-
 ## Endpoints
 
 | Method | Path | Auth | Description |
@@ -249,8 +271,9 @@ variables nothing is registered. Content is sent in full; mask attributes with
 | `GET` | `/company` | None | Return COMPANY.md as `{ content, title }`; `?baseline=1` also includes `baselineContent` from the git merge-base when available |
 | `GET` | `/brand` | None | Return BRAND.md as `{ content, title }`; `?baseline=1` also includes `baselineContent` from the git merge-base when available |
 | `GET` | `/brand/entry?path=<sub-path>` | None | Return one file inside `src/brand/` by its path (e.g. `logos/logo.webp`). Markdown paths return `{ content, title }` (+ `baselineContent` with `?baseline=1`); every other asset (logos, fonts) streams raw bytes with its `Content-Type`. `?baseline=1` serves the version at the git merge-base (the "before"), used by the per-file Brand changes preview |
-| `GET` | `/knowledge/:collection/:entry` or `/knowledge/:entry` | None | Return knowledge entry as `{ content, title }`; title-only Chat Change slugs are resolved by matching entry ids/titles. `?baseline=1` also includes `baselineContent` from the git merge-base when available |
+| `GET` | `/knowledge/:collection/:entry` or `/knowledge/:entry` | None | Return knowledge entry as `{ content, title }` — `content` is the whole file, frontmatter included (the dashboard shows it as properties); title-only Chat Change slugs are resolved by matching entry ids/titles. `?baseline=1` also includes the whole-file `baselineContent` from the git merge-base when available |
 | `GET` | `/documents/:slug` | None | Serve document binary (pdf, pptx, docx, xlsx) |
+| `GET` | `/checks/:slug` | None | Return a check as `{ slug, scope, manifest, readme, files, related }`: every file of `__tooling__/checks/extensions/<slug>/` (for a base check, only its `waivers.json`) with `content`, `baselineContent` from the git merge-base and a `status` (`added`, `modified`, `deleted`, `unchanged`), plus the `__tooling__/checks/sdk/` modules its scripts import |
 | `GET` | `/landings/:slug/definition` | None | Return landing `_definition.md` as `{ content, title }`; `?baseline=1` also includes `baselineContent` from the git merge-base when available |
 | `GET` | `/flows/:slug` | None | Read flow `_data.json` (decrypted). `?baseline=1` returns `{ flow, baselineFlow, baselineStatus }` — used by the dashboard's structural changes view. `baselineStatus` is `found` (baseline decoded, `baselineFlow` set), `new` (flow absent at the merge-base, i.e. not yet published), `unavailable` (no base ref / merge-base to compare against, or an unexpected git failure), or `undecodable` (baseline present at the merge-base but not readable — invalid JSON or not decryptable with the current key); the last two keep the UI from rendering a misleading full "added" diff |
 | `PUT` | `/flows/:slug` | None | Write flow `_data.json` (encrypts at rest) |
@@ -268,14 +291,20 @@ variables nothing is registered. Content is sent in full; mask attributes with
 
 Every turn also carries an in-process SDK MCP server named `baker_ui` hosting interactive dashboard tools. Its first tool, `request_tag_input`, is the **blocking secure tag form**: the agent invokes it when a marketing tag needs secret values (API keys, access tokens, OAuth connections). The bridge intercepts the call in `canUseTool` (same pattern as `AskUserQuestion`), POSTs `/api/chat/tag-input-request` to Convex so the dashboard renders the form, and suspends the turn until Convex delivers the resolution via `POST /tag-input-decision`. Secret values flow dashboard → Convex tag draft directly; the bridge and the model only ever see the redacted result (`{ status, ref, type, identifier, secretFieldsSet }`). Secret values a model puts into `prefilledConfig` are stripped bridge-side (and again backend-side) — their names become requested fields instead. `prefilledConfig` keys must be real config fields of the tag type (the tool description lists them per type); a call that invents field names is denied with the valid ones, because such a key renders nowhere in the form and would otherwise fail at stage time, after the user already approved. Live wait matches `AskUserQuestion` (15 min); like all blocking prompts, the form itself never expires — the thread parks and a later submission recovers the turn. It is **not** a connection route: a `googleTagManager` tag is the container snippet on the site, while the Tag Manager connection that unlocks the container's contents also has to name a container — which this form cannot do — so `oauthProviderId` is not requestable there and the backend rejects it, pointing the agent at `request_connection`.
 
-Its second tool, `request_flow_input`, is the **blocking form-configuration form**: the agent invokes it to configure the confidential parts of a flow ("Form") it cannot author itself — side-effect credentials/connections (`encryptedConfig`, `oauthProviderId`) and widget third-party field definitions (`nodeData.form.external` for HubSpot/Calendly/HighLevel/SavvyCal). The agent authors the surrounding structure in `_data.json` and references it by `nodeId`/`sideEffectId`. Same `canUseTool` park pattern: the bridge POSTs `/api/chat/flow-input-request`, the dashboard renders a tabbed form (secret inputs / OAuth connect+account picker / live resource picker), and on submit Convex delivers the resolved values to `POST /flow-input-decision`. Unlike tags, the resolved values are written **into the branch flow file** through the encrypting `writeFlow` (read → patch node/side-effect → write); the model only ever sees a redacted result: `{ status, nodeId, sideEffectId?, secretFieldsSet, destination?, connected?, fields?, note? }`. `destination` is the non-secret half of what the user chose — the spreadsheet, the sheet, the portal, the Calendly event — so an agent that has just configured an integration does not have to spend a turn on `baker flows show --full` to learn what it configured, and does not map columns against a guess. For a widget node, `fields` carries the autofill keys the picked resource accepts — literally the left-hand side of an `autofilledFields` entry, adapter prefix included, so a SavvyCal custom field arrives as `questions.<id>` because that is what its adapter reads. They come from each provider's own field container (`fieldGroups[].fields[]`, `customQuestions[]`, `customParams.formFields[]`, `customFormFields[]`, `fields[]`, `customFields[]`) rather than from a search for name-shaped strings, so a select's option labels and the resource's own title are not among them (a HubSpot form's `name` is "Contact us"; it is reported under `destination`). A widget with no field list of its own returns none rather than a guess. Both targets go through the same filter: only plain strings and numbers are echoed, and anything in that type's secret list is redacted to a name in `secretFieldsSet`. A few non-secret keys are withheld from `destination` on top of that, because they are not an answer either — an `httpWebhook`'s basic-auth `username` is not a typed credential, so it is not in the secret list, but echoing it hands the model half a credential and nothing on the side effect is addressed by it. Leaked secret values in `prefilledConfig` are stripped bridge-side (and again backend-side). Live wait matches `AskUserQuestion` (15 min); like all blocking prompts, the form itself never expires — the thread parks and a later submission recovers the turn.
+A ChatGPT Ads tag pre-fills its Pixel ID and requests the optional Conversions API key in this secure form. The bridge classifies `apiKey` as a secret, so the agent never sees it and the published page receives only the Pixel ID and a signed server-event reference.
+
+Its second tool, `request_flow_input`, is the **blocking form-configuration form**: the agent invokes it to configure the confidential parts of a flow ("Form") it cannot author itself — side-effect credentials/connections (`encryptedConfig`, `oauthProviderId`) and widget third-party field definitions (`nodeData.form.external` for HubSpot/Calendly/HighLevel/SavvyCal). The agent authors the surrounding structure in `_data.json` and references it by `nodeId`/`sideEffectId`. Same `canUseTool` park pattern: the bridge POSTs `/api/chat/flow-input-request`, the dashboard renders a tabbed form (secret inputs / OAuth connect+account picker / live resource picker), and on submit Convex delivers the resolved values to `POST /flow-input-decision`. Unlike tags, the resolved values are written **into the branch flow file** through the encrypting `writeFlow` (read → patch node/side-effect → write); the model only ever sees a redacted result: `{ status, nodeId, sideEffectId?, secretFieldsSet, destination?, connected?, fields?, note? }`. `destination` is the non-secret half of what the user chose — the spreadsheet, the sheet, the portal, the Calendly event — so an agent that has just configured an integration does not have to spend a turn on `baker flows show --full` to learn what it configured, and does not map columns against a guess. For a widget node, `fields` carries the autofill keys the picked resource accepts — literally the left-hand side of an `autofilledFields` entry, adapter prefix included, so a SavvyCal custom field arrives as `questions.<id>` because that is what its adapter reads. They come from each provider's own field container (`fieldGroups[].fields[]`, `customQuestions[]`, `customParams.formFields[]`, `customFormFields[]`, `fields[]`, `customFields[]`) rather than from a search for name-shaped strings, so a select's option labels and the resource's own title are not among them (a HubSpot form's `name` is "Contact us"; it is reported under `destination`). A widget with no field list of its own returns none rather than a guess. Both targets go through the same filter: only plain strings and numbers are echoed, and anything in that type's secret list is redacted to a name in `secretFieldsSet`. A few non-secret keys are withheld from `destination` on top of that, because they are not an answer either — an `httpWebhook`'s basic-auth `username` is not a typed credential, so it is not in the secret list, but echoing it hands the model half a credential and nothing on the side effect is addressed by it. Leaked secret values in `prefilledConfig` are stripped bridge-side (and again backend-side), and a call whose `prefilledConfig` names a key the side effect's card does not render (an email card reads `email` and `subject`, not `to`) is denied with the valid keys, because the card would drop it silently. A request for an `email` side effect is denied outright with the `baker flows connect … --email … --subject …` call that sets it: nothing in an email destination is secret, so it is the agent's to state, never the user's card. Live wait matches `AskUserQuestion` (15 min); like all blocking prompts, the form itself never expires — the thread parks and a later submission recovers the turn.
 
-Its third tool, `request_connection`, is the **blocking connection request**: the agent invokes it when a data platform the task needs — Google Ads, LinkedIn Ads, Meta Ads, X Ads, Google Analytics 4, Google Search Console, or Google Tag Manager — is not connected yet, instead of telling the user to go to Settings. Same `canUseTool` park pattern: the bridge POSTs `/api/chat/connection-input-request`, the dashboard renders one tab per platform with the OAuth connect button and the account/property/site/container picker, and on submit Convex delivers the outcome to `POST /connection-input-decision`. Nothing confidential passes through the bridge or the model: the dashboard writes the selection onto the company's connection, and the resolution carries only `{ status, platform, accountLabel?, selected[] }`. Live wait matches `AskUserQuestion` (15 min).
+Its third tool, `request_connection`, is the **blocking connection request**: the agent invokes it when a data platform the task needs — Google Ads, LinkedIn Ads, Meta Ads, X Ads, Google Analytics 4, Google Search Console, or Google Tag Manager — is not connected yet, instead of telling the user to go to Settings. Same `canUseTool` park pattern: the bridge POSTs `/api/chat/connection-input-request`, the dashboard renders one tab per platform with the OAuth connect button and the account/property/site/container picker, and on submit Convex delivers the outcome to `POST /connection-input-decision`. Nothing confidential passes through the bridge or the model: the dashboard writes the selection onto the company's connection, and the resolution carries only `{ status, platform, accountLabel?, selected[] }`. A Google Drive tab may add `choose: "media-folder"` (kept only on Google Drive): the user picks a folder that Baker imports as a media source, and the connected result also carries its `mediaSourceKey`. An ad or data platform tab may add `pick: true` (kept only on platforms with accounts to choose): when the platform is already connected, the card opens its account picker straight away, for the agent that found the account it needs is not selected. Live wait matches `AskUserQuestion` (15 min). It can also ask for a Shopify store (`platform: "shopify"`): the card asks for the store's address and sends the user to Shopify to approve Baker.
+
+The same card adds tools. A `{ server: { name, url, auth?, keyHeader?, scope? } }` entry opens a remote MCP server filled in from the user's instructions (`auth`: `none` \| `key` \| `sign-in`; the key is typed into the card, never into the chat), and an `{ app }` entry connects a managed app from `baker mcp catalog` — the fallback for a vendor with no server of its own. When an app or server comes through, the bridge fetches the turn's MCP servers afresh (`McpServersProvider` with `{ fresh: true }`) and loads them into the running query with `setMcpServers` — `baker_ui` included, since the SDK drops any in-process server left out — before the tool answers, and adds `toolsReady` to the resolution. The provider keeps that set for the next turn, so the tool list changes once. A platform-only resolution never reloads.
 
 Its fourth tool, `request_avatar_casting`, is the **blocking face picker**: an avatar invented from a description gets several casting portraits rendered, the user picks one in the dashboard, and the identity sheet every later render grounds on is fused from that one. Same `canUseTool` park pattern — the bridge POSTs `/api/chat/avatar-casting-request`, Convex renders the candidates and parks the thread, and the pick is delivered to `POST /avatar-casting-decision` as `{ status: "cast", avatarHandle, imageId }` or `{ status: "declined", avatarHandle, reason? }`.
 
 It is also the one blocking tool the bridge opens **on its own**. The agent forgot to call it in every recorded run, in a new way each time, so the trigger is the EVENT rather than the prose around it: a `baker avatars create` for a synthetic avatar registers a pending casting, and it opens before whatever the agent does next. The create is read off the **assistant message** as well as off `canUseTool`, because `canUseTool` is raised only for the ask path and the scaffold allows `Bash(baker:*)` — so every create the product actually runs bypassed the permission callback entirely, and the avatar sat in `generating` with no portraits and no sheet while the agent reported the picker was open. When the create is the turn's last tool call there is no next call to open it before, so the request is posted at turn end and the thread parks on it. An unattended Session has nobody to ask, so the create is rewritten to `--face auto` instead and nothing is left pending — the flag is inserted right after `avatars create` rather than appended, so a piped or redirected command does not hand it to the next program, and an explicit `--face ask` is replaced rather than joined.
 
+The picker does not wait forever. Once every face is on screen, Convex schedules a pick 30 seconds out: if the user has not chosen (or pressed "Give me more time", which clears the deadline), the first face is kept and delivered as `{ status: "cast", avatarHandle, imageId, chosenBy: "auto" }`. The pick runs server-side, so a tab left in the background never stalls the job, and the result text tells the agent nobody chose that face so it never credits the user with it.
+
 A decline comes back to the agent with the remedy attached, not as a bare `{"status":"declined"}`. The tool's description says to sharpen the subject with `baker avatars update` and call it again, but that text sits thousands of tokens up the context and was written before the turn began; read against the bare object, the agent replied "the casting portraits should be showing on your screen right now" to a user who had just rejected all four and whose picker was gone. The result now states the outcome and the next move together, the way a CLI `error.fix` does, and says to ask what to change when no reason was given.
 
 When the agent *does* call `request_avatar_casting` for the avatar a pending casting is already owed to — the tool's description says the picker opens by itself, but the call is tolerated — that call becomes the casting rather than triggering a second one, so the pick is returned to the tool that asked for it. Every other blocking prompt that follows a create still reaches its own handler; the auto-cast runs first, then the original call is routed normally.
@@ -291,7 +320,7 @@ The fetch is resilient by design: results are cached per `(thread, actor)` for 6
 A user can `@`-mention a tool in a message (a green chip in the composer). Two kinds arrive, and the bridge treats them differently because the agent has to reach them differently:
 
 - `@[Label](mcp:<key>)` — a tool that arrives in the session over MCP. The bridge appends an instruction naming the requested tools so the agent prefers them for that turn. A hint, not a restriction: every other tool stays available and the server map is unchanged.
-- `@[Label](integration:<provider>)` — a **Baker integration** (GA4, Search Console, Tag Manager, an ad platform). There is no MCP server for these; they are read with `baker` commands. The bridge appends an instruction naming the command for each one, so an agent told to "read Google Search Console" does not go looking for a tool of that name, find nothing, and report a connected platform as unavailable.
+- `@[Label](integration:<provider>)` — a **Baker integration** (GA4, Search Console, Tag Manager, an ad platform, HubSpot, Shopify). There is no MCP server for these; they are read with `baker` commands. The bridge appends an instruction naming the command for each one, so an agent told to "read Google Search Console" does not go looking for a tool of that name, find nothing, and report a connected platform as unavailable.
 
 Both kinds are stripped back to their plain `Label` first — the mention syntax is dashboard serialization and means nothing to the model. The older `mcp:<provider>:<key>` spelling is still read, for messages written before integrations had their own type.
 
@@ -366,7 +395,9 @@ Convex action ──POST /message/async──▶ Bridge AgentSession
   the turn mid-tool-call and Claude Code returns an error-during-execution result
   that surfaces as a failed turn). A turn runs under the SDK `plan` permission mode
   (read-only until approval) when the dispatch carries `planMode: true` (the
-  dashboard's plan-mode toggle); a `/plan …` prompt is the fallback trigger. The
+  dashboard's plan-mode toggle); a `/plan …` prompt is the fallback trigger. Every
+  other turn passes `default` explicitly: an omitted mode starts an OpenRouter
+  session in auto mode, where a classifier rather than `canUseTool` decides. The
   review loop fires only when plan mode is active; if the agent calls
   `ExitPlanMode` outside plan mode it is a no-op passthrough (no review card).
   When the SDK omits inline plan text, the bridge reads Claude Code's reported
@@ -431,8 +462,8 @@ Convex action ──POST /message/async──▶ Bridge AgentSession
   skipped entirely (only `parent_tool_use_id`-free, non-`subagent_type`
   messages count). The `window` is the model's **real OpenRouter context
   length**, resolved from the model id (`contextWindowForModel` in
-  `model-capabilities.ts`): opus 5.5, opus 5 and sonnet 5 are 1M, haiku 4.5
-  is 200k — and resolved from **the model that actually served the request**,
+  `model-capabilities.ts`): opus 5.5, opus 5, sonnet 5.5, sonnet 5 and haiku 5.5 are 1M,
+  haiku 4.5 is 200k — and resolved from **the model that actually served the request**,
   which is not always the session's. A skill can pin its own model for the turn
   via `model:` in its frontmatter, and measuring such a turn against the session's
   1M reads a third full when it is in fact over — the mismatch that hid the publish
@@ -457,10 +488,16 @@ Convex action ──POST /message/async──▶ Bridge AgentSession
   unset: the CLI's own default beats a guess.
   That ceiling is not the window the meter uses, and the pin cannot raise it — see
   the 1M context correction below, which does.
+- **Subagent prompt cache TTL.** Outside a Claude subscription the CLI caches
+  every request on a 5-minute TTL. The bridge sets
+  `settings.subagentPromptCacheTtl: "1h"` so subagents, workflows and helper
+  requests keep their cache across a wait longer than that (a render can take up
+  to 30 minutes). An hour-long cache write costs 2× base input instead of 1.25×.
+  The main conversation is unchanged (`promptCacheTtl` stays unset).
 - **1M context correction.** The bridge sends the `context-1m-2025-08-07` beta for
   every 1M model it routes to (`betasForModel`), **Opus 5.5, the default,
   included**. This is *not* an API requirement: Anthropic serves 1M by default on
-  Opus 5.5, Opus 5 and Sonnet 5, and that beta is the legacy Sonnet 4/4.5
+  Opus 5.5, Opus 5, Sonnet 5.5 and Sonnet 5, and that beta is the legacy Sonnet 4/4.5
   header — verified against the OpenRouter endpoint as identical HTTP 200s with
   and without it. What it corrects is the CLI's **client-side** idea of the
   window: the CLI resolves that locally and reads 1M only for a model id carrying
@@ -749,7 +786,9 @@ findings cite.
 Three things enforce read-only, because each fails differently: the review key's
 scope, `REVIEW_DISALLOWED_TOOLS`, and `reviewBashPolicy` (an allowlist of readers
 that also refuses the ways an allowed binary becomes an arbitrary one — a
-redirect, `xargs`, a command substitution).
+redirect, `xargs`, a command substitution). It reads the command with a real
+shell parser, so a `|` or a tool name inside a quoted jq program, grep pattern
+or path is data, not a second command; anything it cannot parse is refused.
 
 ## Resilience
 
@@ -765,8 +804,11 @@ redirect, `xargs`, a command substitution).
   ends input itself once the turn is really over: a clean result with no
   in-flight tasks, re-checked when the last task settles (a settle isn't
   guaranteed to wake the model into a second result). Turns that ran tasks get
-  a 1s settle window so a just-settled task's queued wake isn't cut off; only
-  genuine model activity cancels it. Model activity after a result also retires
+  a 1s settle window after a result so a just-settled task's queued wake isn't
+  cut off, and a 45s window after the last task settles, because the CLI streams
+  nothing between that settle and the woken turn's first token; only genuine
+  model activity cancels either. The agent's Bash calls may run 30 minutes
+  (`BASH_MAX_TIMEOUT_MS`), the longest the workspace's timeout hook grants. Model activity after a result also retires
   that result: the CLI has woken into a new turn, so the settle re-check waits
   for the woken turn's own result rather than closing stdin under a model that
   is still on time-to-first-token. A 60s exit guard closes the query if the
@@ -774,7 +816,17 @@ redirect, `xargs`, a command substitution).
   BOTH the task_started/task_notification edge bookends and the
   `background_tasks_changed` level signal — a long foreground command the CLI
   auto-backgrounds emits only the latter, and missing it was the main source of
-  the "control-channel closed mid-turn" turn failures.
+  the "control-channel closed mid-turn" turn failures. Tasks the SDK flags
+  `ambient` (housekeeping, auto-started watchers) are not work and never hold
+  the turn; a Monitor the agent asked for is not ambient.
+- Before input ends on a turn that ran tasks, the bridge reads the CLI's running
+  cost and model usage once (5s cap). A task can settle without waking the
+  model, and then the last result does not include what it spent. A wake or a
+  task that lands during that reading cancels the end, as it would a pending one.
+- After a turn that ran tasks has ended, the bridge runs the scaffold's
+  markdown flush and publish recovery itself: those Stop hooks defer while
+  background work runs, and a task that settles without waking the model leaves
+  no later Stop to run them.
 - A stall detector guards each model request: if the stream yields nothing for
   3 min while the CLI should be talking to the model (right after the LAST
   outstanding tool result goes back, or between stream deltas — never during
@@ -783,8 +835,12 @@ redirect, `xargs`, a command substitution).
   so the dying CLI can't keep writing to the resumed transcript), up to 2
   retries. A hung upstream request recovers in minutes instead of killing the
   turn. Outstanding tool_use ids are tracked so parallel tools — one result
-  back while a sibling render still runs — never read as a stall.
-- The SDK iterator is additionally wrapped in a 30 min watchdog: if no event
+  back while a sibling render still runs — never read as a stall. A tool's
+  `tool_progress` heartbeat is ignored: a background task's arrives while the
+  model's stream is stalled.
+- The SDK iterator is additionally wrapped in a 30 min watchdog — 2 h while a
+  tool call or background task is known to be running, since a render or a
+  long command prints nothing until it ends: if no event
   arrives for that long, the run is aborted and the thread is marked errored
   with a legible "lost the connection" message. If the aborted run never
   unwinds (a wedged stream ignoring the close), a 60s grace timer force-delivers

package/dist/broker/baker-api.d.ts

@@ -0,0 +1,23 @@
+import type { ResolvedCredential } from "./credential-text.ts";
+export type CredentialUse = {
+    name: string;
+    host: string;
+};
+/**
+ * Baker refused the broker's token: Credentials were switched off, the company
+ * suspended, or the Runtime is no longer active. Unlike a failed request, this
+ * is an answer — the broker must stop using what it holds.
+ */
+export declare class CredentialsRefused extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+export type BakerBrokerApi = {
+    fetchCredentials(): Promise<ResolvedCredential[]>;
+    reportUsage(uses: CredentialUse[]): Promise<void>;
+};
+export declare function createBakerBrokerApi(options: {
+    siteUrl: string;
+    token: string;
+}): BakerBrokerApi;
+//# sourceMappingURL=baker-api.d.ts.map

package/dist/broker/baker-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baker-api.d.ts","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAS/D,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAnC,YAAqB,MAAM,EAAE,MAAM,EAElC;CACF;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClD,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD,CAAC;AAIF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CA0BhG"}

package/dist/broker/baker-api.js

@@ -0,0 +1,55 @@
+/**
+ * The broker's two calls to Baker: fetch the company's credentials (the only
+ * route that ever returns a value) and report which were used where. The
+ * shapes mirror `brokerResolveResponseSchema` / `brokerUsageRequestSchema` in
+ * `@baker/api/credentials`, which the published bridge cannot import.
+ * Success is `{ ok: true, data }`; a failure is any non-2xx status with
+ * `{ code, error }`.
+ */
+import { z } from "zod";
+const resolveResponseSchema = z.object({
+    credentials: z.array(z.object({ name: z.string(), value: z.string(), allowedHosts: z.array(z.string()) })),
+});
+const successSchema = z.object({ ok: z.literal(true), data: z.unknown().optional() });
+const failureSchema = z.object({ code: z.string() });
+/**
+ * Baker refused the broker's token: Credentials were switched off, the company
+ * suspended, or the Runtime is no longer active. Unlike a failed request, this
+ * is an answer — the broker must stop using what it holds.
+ */
+export class CredentialsRefused extends Error {
+    status;
+    constructor(status) {
+        super(`Baker refused the broker (${status})`);
+        this.status = status;
+    }
+}
+const TIMEOUT_MS = 10_000;
+export function createBakerBrokerApi(options) {
+    async function post(path, body) {
+        const response = await fetch(new URL(path, options.siteUrl), {
+            method: "POST",
+            headers: { authorization: `Broker ${options.token}`, "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        const payload = await response.json().catch(() => null);
+        if (response.status === 401 || response.status === 403)
+            throw new CredentialsRefused(response.status);
+        if (!response.ok) {
+            const code = failureSchema.safeParse(payload).data?.code ?? "UNKNOWN";
+            throw new Error(`${path} answered ${response.status} ${code}`);
+        }
+        return successSchema.parse(payload).data;
+    }
+    return {
+        async fetchCredentials() {
+            const data = resolveResponseSchema.parse(await post("/api/runtime/credentials/resolve", {}));
+            return data.credentials;
+        },
+        async reportUsage(uses) {
+            await post("/api/runtime/credentials/usage", { uses });
+        },
+    };
+}
+//# sourceMappingURL=baker-api.js.map

package/dist/broker/baker-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baker-api.js","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;CAC3G,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAIrD;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB,MAAM;IAA3B,YAAqB,MAAc;QACjC,KAAK,CAAC,6BAA6B,MAAM,GAAG,CAAC,CAAC;sBAD3B,MAAM;IAE3B,CAAC;CACF;AAOD,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAAC,OAA2C;IAC9E,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAa;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB;YACpB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI;YACpB,MAAM,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/broker-client.d.ts

@@ -0,0 +1,10 @@
+export declare const DEFAULT_BROKER_SOCKET = "/run/baker/broker.sock";
+export type BrokerClientOptions = {
+    socketPath?: string;
+    timeoutMs?: number;
+};
+/** Whether a broker runs in this sandbox: its socket exists. */
+export declare function brokerRunning(options?: BrokerClientOptions): boolean;
+/** `text` with every stored credential value replaced by its placeholder. */
+export declare function scrubViaBroker(text: string, options?: BrokerClientOptions): Promise<string>;
+//# sourceMappingURL=broker-client.d.ts.map

package/dist/broker/broker-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-client.d.ts","sourceRoot":"","sources":["../../src/broker/broker-client.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAG9D,MAAM,MAAM,mBAAmB,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAM9E,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAExE;AA+BD,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrG"}

package/dist/broker/broker-client.js

@@ -0,0 +1,60 @@
+/**
+ * The bridge's side of the broker socket. Dependency-free on purpose: the
+ * bridge imports it on the hot path of every tool result.
+ *
+ * When no broker runs (no socket file — local dev, or a Runtime without
+ * credentials) every call is a fast no-op and `scrubViaBroker` returns the
+ * text unchanged. Any other failure (timeout, 413, 429, a crashed broker) is
+ * thrown so the caller decides whether to hold the text back.
+ */
+import { existsSync } from "node:fs";
+import { request } from "node:http";
+export const DEFAULT_BROKER_SOCKET = "/run/baker/broker.sock";
+const DEFAULT_TIMEOUT_MS = 2_000;
+function isMissingSocket(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+/** Whether a broker runs in this sandbox: its socket exists. */
+export function brokerRunning(options = {}) {
+    return existsSync(options.socketPath ?? DEFAULT_BROKER_SOCKET);
+}
+function call(path, body, options) {
+    const socketPath = options.socketPath ?? DEFAULT_BROKER_SOCKET;
+    if (!brokerRunning(options))
+        return Promise.resolve(null);
+    return new Promise((resolve, reject) => {
+        const req = request({
+            socketPath,
+            path,
+            method: "POST",
+            headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) },
+            timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => {
+                const text = Buffer.concat(chunks).toString("utf8");
+                if (res.statusCode === 200)
+                    resolve(text);
+                else
+                    reject(new Error(`credential broker ${path} answered ${res.statusCode}`));
+            });
+            res.on("error", reject);
+        });
+        req.on("timeout", () => req.destroy(new Error(`credential broker ${path} timed out`)));
+        req.on("error", (error) => (isMissingSocket(error) ? resolve(null) : reject(error)));
+        req.end(body);
+    });
+}
+/** `text` with every stored credential value replaced by its placeholder. */
+export async function scrubViaBroker(text, options = {}) {
+    const response = await call("/scrub", JSON.stringify({ text }), options);
+    if (response === null)
+        return text;
+    const parsed = JSON.parse(response);
+    if (typeof parsed === "object" && parsed !== null && "text" in parsed && typeof parsed.text === "string") {
+        return parsed.text;
+    }
+    throw new Error("credential broker /scrub answered without text");
+}
+//# sourceMappingURL=broker-client.js.map

package/dist/broker/broker-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-client.js","sourceRoot":"","sources":["../../src/broker/broker-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAC9D,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAIjC,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,OAAO,GAAwB,EAAE;IAC7D,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY,EAAE,OAA4B;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CACjB;YACE,UAAU;YACV,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YAC1F,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;SACjD,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;;oBACrC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,aAAa,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;QACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,OAAO,GAAwB,EAAE;IAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzG,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC"}

package/dist/broker/broker-process.d.ts

@@ -0,0 +1,10 @@
+import type { BrokerProcess } from "./supervisor.ts";
+/**
+ * Starts the broker as a child of the supervisor. A spawn that fails (ENOENT,
+ * EAGAIN, EMFILE — likeliest under the memory pressure the supervisor exists
+ * for) emits `error` and possibly no `exit`; it settles `exited` all the same,
+ * so the supervisor's back-off retries it. A synchronous throw is the
+ * supervisor's to catch.
+ */
+export declare function spawnBroker(command: string, args: readonly string[], env: NodeJS.ProcessEnv, log: (message: string) => void): BrokerProcess;
+//# sourceMappingURL=broker-process.d.ts.map

package/dist/broker/broker-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-process.d.ts","sourceRoot":"","sources":["../../src/broker/broker-process.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAc,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC7B,aAAa,CAUf"}

package/dist/broker/broker-process.js

@@ -0,0 +1,20 @@
+import { spawn } from "node:child_process";
+/**
+ * Starts the broker as a child of the supervisor. A spawn that fails (ENOENT,
+ * EAGAIN, EMFILE — likeliest under the memory pressure the supervisor exists
+ * for) emits `error` and possibly no `exit`; it settles `exited` all the same,
+ * so the supervisor's back-off retries it. A synchronous throw is the
+ * supervisor's to catch.
+ */
+export function spawnBroker(command, args, env, log) {
+    const child = spawn(command, args, { stdio: "inherit", env });
+    const exited = new Promise((resolve) => {
+        child.once("exit", (code, signal) => resolve({ code, signal }));
+        child.once("error", (error) => {
+            log(`could not start broker: ${error.message}`);
+            resolve({ code: null, signal: null });
+        });
+    });
+    return { exited, kill: (signal) => void child.kill(signal) };
+}
+//# sourceMappingURL=broker-process.js.map

package/dist/broker/broker-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-process.js","sourceRoot":"","sources":["../../src/broker/broker-process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,IAAuB,EACvB,GAAsB,EACtB,GAA8B;IAE9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;QACjD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,GAAG,CAAC,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist/broker/broker-process.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=broker-process.test.d.ts.map

package/dist/broker/broker-process.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-process.test.d.ts","sourceRoot":"","sources":["../../src/broker/broker-process.test.ts"],"names":[],"mappings":""}

package/dist/broker/broker-process.test.js

@@ -0,0 +1,13 @@
+import { describe, expect, it } from "vitest";
+import { spawnBroker } from "./broker-process.js";
+describe("spawnBroker", () => {
+    // Node reports ENOENT, EAGAIN and EMFILE as an `error` event, with no `exit`
+    // after it: unheard, it crashed the supervisor; heard, it is a broker that exited.
+    it("reports a broker that could not be spawned as one that exited, with the reason", async () => {
+        const reasons = [];
+        const broker = spawnBroker("/nonexistent/node", [], {}, (line) => reasons.push(line));
+        await expect(broker.exited).resolves.toEqual({ code: null, signal: null });
+        expect(reasons.join("")).toContain("ENOENT");
+    });
+});
+//# sourceMappingURL=broker-process.test.js.map

package/dist/broker/broker-process.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-process.test.js","sourceRoot":"","sources":["../../src/broker/broker-process.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,6EAA6E;IAC7E,mFAAmF;IACnF,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,MAAM,GAAG,WAAW,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEtF,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}