@mcrescenzo/opencode-workflows 0.1.0

package/workflow-kernel/free-text-redactor.js

@@ -0,0 +1,91 @@
+// free-text-redactor.js — content-based (value) secret masking for user-visible text.
+//
+// The kernel's redactValue (text-json.js) combines key-based redaction for sensitive object
+// keys with this value-based scanner for prose strings. Domain workflows that can discover
+// secrets still run their own in-guest masking before returning report envelopes, so raw
+// values are removed before both durable persistence and operator display.
+//
+// This module is the SHARED, pure, idempotent free-text masker applied at the user-visible
+// DISPLAY boundaries (salvage preview snippet, lane taskSummary/title/errorSummary
+// derivation, compact status text, and notification toast text) BEFORE truncation. It masks
+// common credential-like VALUES embedded in prose so a model that pasted a raw token into
+// assistant text, a lane label, or an error summary cannot leak through a preview/status/toast.
+//
+// Scope note: raw transcripts remain local-sensitive by design; durable controller artifacts
+// and display projections use this scanner through redactValue/redactDurableValue. Approval,
+// source, and diff-plan HASHES are computed from raw approved material and are never fed masked
+// text, so this masking cannot perturb a hash.
+//
+// All regexes are linear (no nested/overlapping quantifiers) to avoid catastrophic
+// backtracking. The fixed placeholder [REDACTED:secret] is deliberately composed of characters
+// ([ ] : and the word "secret"/"redacted") that are NOT present in any secret-value character
+// class below, so a second pass finds nothing to match — the function is idempotent by
+// construction (redact(redact(x)) === redact(x)).
+
+// Fixed, non-reversible replacement. The brackets/colons keep it out of every value char class.
+const PLACEHOLDER = "[REDACTED:secret]";
+
+// Well-known credential SHAPES (whole-token match → mask the entire token).
+//
+// AWS access key id: AKIA + 16+ uppercase alphanumerics (real keys are exactly 20 chars).
+const AWS_ACCESS_KEY_RE = /\bAKIA[0-9A-Z]{16,}\b/g;
+// Provider tokens with a known prefix, allowing internal hyphen-separated segments so the
+// OpenAI `sk-proj-<long>` shape is matched (the prior in-guest regex missed embedded hyphens).
+// Segment form `(?:[A-Za-z0-9]+-)*[A-Za-z0-9]{8,}` is unambiguous (hyphen is the sole
+// delimiter and is not in the segment class) → linear, no catastrophic backtracking.
+const PROVIDER_TOKEN_RE = /\b(sk|pk|ghp|gho|github_pat|xox[baprs])[-_](?:[A-Za-z0-9]+[-_])*[A-Za-z0-9]{8,}/g;
+// PEM private key blocks (lazy up to the matching END marker, or EOF for truncated blocks).
+const PEM_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g;
+
+// `Bearer <token>` / `Authorization: Bearer <token>` — mask only the token portion, keeping the
+// keyword for readability. Capture group 1 is the "bearer " prefix; the trailing value run is the
+// token. Value class excludes whitespace/brackets so it cannot run past the token.
+const BEARER_RE = /(\bbearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
+// HTTP Basic credentials are base64-ish and commonly appear in diagnostics/log errors.
+const BASIC_RE = /(\bbasic\s+)[A-Za-z0-9+/=]{8,}/gi;
+
+// Generic key/value ASSIGNMENTS in env-ish, colon-ish, and JSON-ish contexts:
+//   secret=value   api_key: value   "token":"value"   password = "value"
+// Anchored on the key NAME (so common prose words are not redacted unless they appear as an
+// assignment key), with an optional quote between key and separator to absorb JSON's `"key":`.
+// Only the VALUE (group 2) is masked; the key + separator are preserved so the surrounding text
+// stays readable. The value minimum (8 chars) avoids masking short common words.
+const ASSIGN_RE = /\b(api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|secret[_-]?key|secret|password|passwd|auth[_-]?token|authorization|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?access[_-]?key[_-]?id|client[_-]?secret|private[_-]?key|token)\b["']?\s*[:=]\s*["']?([^\s"'`,;]{8,})/gi;
+
+function maskWhole() {
+  return PLACEHOLDER;
+}
+
+function maskValueOnly(match, key, value) {
+  // `key` is capture group 1 (the key name); `value` is capture group 2 (the secret).
+  // Preserve everything before the value (key + separator + optional quotes); mask only the
+  // value run so the surrounding assignment stays readable.
+  return match.slice(0, match.length - value.length) + PLACEHOLDER;
+}
+
+function maskBearer(match, prefix) {
+  return prefix + PLACEHOLDER;
+}
+
+// Mask common credential-like values embedded in free text. Pure and idempotent.
+//
+// @param {string} text - the source text to mask.
+// @param {object} [options] - reserved for future use (accepted but currently ignored; the
+//   placeholder is fixed so the idempotency guarantee always holds).
+// @returns {string} the text with detected secrets replaced by [REDACTED:secret].
+export function redactFreeTextSecrets(text, options) {
+  if (typeof text !== "string" || text.length === 0) return text;
+  // `options` is intentionally accepted but not consumed: the placeholder is fixed to preserve
+  // the idempotency guarantee, so no knob may change it. Kept on the signature per contract.
+  void options;
+  let out = text;
+  out = out.replace(PROVIDER_TOKEN_RE, maskWhole);
+  out = out.replace(AWS_ACCESS_KEY_RE, maskWhole);
+  out = out.replace(PEM_KEY_RE, maskWhole);
+  out = out.replace(BEARER_RE, maskBearer);
+  out = out.replace(BASIC_RE, maskBearer);
+  out = out.replace(ASSIGN_RE, maskValueOnly);
+  return out;
+}
+
+export { PLACEHOLDER as REDACTED_PLACEHOLDER };

package/workflow-kernel/gate-shapes.js

@@ -0,0 +1,82 @@
+// Live-gate result shape constructors. These pure helpers build the canonical
+// `{ state, verified, evidence, evidenceStrength? }` gate objects consumed by the
+// CapabilityAdapter / liveGateReport orchestrator and the live-gate probes. Kept in a
+// focused leaf module (no probe or adapter dependencies) so both the adapter and the
+// probe functions can share them without an import cycle.
+import { MAX_STATUS_STRING_CHARS } from "./constants.js";
+import { extractTextFromError, truncateText } from "./text-json.js";
+import {
+  WorkflowCancelledError,
+  WorkflowProbeStructuralError,
+  WorkflowTimeoutError,
+} from "./errors.js";
+
+function gateBlocked(evidence) {
+  return { state: "blocked", verified: false, evidence };
+}
+
+function gateAvailableUnverified(evidence) {
+  return { state: "available-unverified", verified: false, evidence };
+}
+
+// Evidence contract for verified gates: `evidenceStrength` distinguishes directly-observed
+// target behavior ("observed", the default) from a compatibility fallback that verifies only
+// via retained deny rules plus an absent tool attempt ("no-attempt-fallback"). The latter is
+// not equivalent to an observed denial and must be explicitly accepted before release-
+// readiness messaging treats it as enforcement proof.
+function gateVerified(evidence, evidenceStrength = "observed") {
+  return { state: "verified", verified: true, evidence, evidenceStrength };
+}
+
+function gateFailed(evidence) {
+  return { state: "failed-with-evidence", verified: false, evidence };
+}
+
+function forcedGate(value) {
+  if (value && typeof value === "object") {
+    const verified = value.verified === true;
+    const result = {
+      state: value.state || (verified ? "verified" : "available-unverified"),
+      verified,
+      evidence: value.evidence || "forced test input",
+    };
+    if (verified) result.evidenceStrength = value.evidenceStrength ?? "observed";
+    return result;
+  }
+  if (value === "verified" || value === "passed") return gateVerified("forced test input");
+  if (typeof value === "string") return { state: value, verified: false, evidence: "forced test input" };
+  return undefined;
+}
+
+function shapeGate(forcedValue, available, evidence) {
+  return forcedGate(forcedValue) ?? (available ? gateAvailableUnverified(evidence) : gateBlocked(evidence));
+}
+
+// A transport/structural probe failure is NOT denial evidence: the probe could not
+// be run, so it must never verify the gate. We discriminate these by typed error
+// (code/instanceof) BEFORE the denial-text regex, because the regex also matches
+// the probe's own label text (e.g. a "denied-bash probe ... timed out" message),
+// which would otherwise silently escalate authority on latency / API-shape anomalies.
+function transportFailureGate(error, label) {
+  const evidence = truncateText(extractTextFromError(error), MAX_STATUS_STRING_CHARS);
+  if (error instanceof WorkflowTimeoutError || error?.code === "WORKFLOW_TIMEOUT") {
+    return gateFailed(`${label} could not be verified: probe timed out before observing enforcement: ${evidence}`);
+  }
+  if (error instanceof WorkflowCancelledError || error?.code === "WORKFLOW_CANCELLED") {
+    return gateBlocked(`${label} could not be verified: probe was cancelled before observing enforcement: ${evidence}`);
+  }
+  if (error instanceof WorkflowProbeStructuralError || error?.code === "WORKFLOW_PROBE_STRUCTURAL") {
+    return gateBlocked(`${label} could not be verified: ${evidence}`);
+  }
+  return undefined;
+}
+
+export {
+  gateBlocked,
+  gateAvailableUnverified,
+  gateVerified,
+  gateFailed,
+  forcedGate,
+  shapeGate,
+  transportFailureGate,
+};

package/workflow-kernel/git-util.js

@@ -0,0 +1,45 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { DEFAULT_SUBPROCESS_MAX_BUFFER, DEFAULT_SUBPROCESS_TIMEOUT_MS } from "./constants.js";
+
+const execFileAsync = promisify(execFile);
+
+export const DEFAULT_GIT_TIMEOUT_MS = DEFAULT_SUBPROCESS_TIMEOUT_MS;
+export const DEFAULT_GIT_MAX_BUFFER = DEFAULT_SUBPROCESS_MAX_BUFFER;
+
+async function execGit(directory, args, options = {}) {
+  return await execFileAsync("git", args, {
+    cwd: directory,
+    encoding: "utf8",
+    timeout: DEFAULT_GIT_TIMEOUT_MS,
+    maxBuffer: DEFAULT_GIT_MAX_BUFFER,
+    ...options,
+  });
+}
+
+export async function git(directory, args, options = {}) {
+  try {
+    return await execGit(directory, args, options);
+  } catch (error) {
+    const detail = error.stderr || error.stdout || error.message || String(error);
+    throw new Error(`git ${args.join(" ")} failed in ${directory}: ${detail.trim()}`);
+  }
+}
+
+export async function gitSucceeds(directory, args, options = {}) {
+  try {
+    await execGit(directory, args, options);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function gitCapture(directory, args, options = {}) {
+  try {
+    const result = await execGit(directory, args, options);
+    return { ok: true, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+  } catch (error) {
+    return { ok: false, stdout: error.stdout ?? "", stderr: error.stderr ?? "", message: error.message ?? String(error) };
+  }
+}

package/workflow-kernel/index.js

@@ -0,0 +1,72 @@
+// Kernel barrel. Real modules own their symbols; the workflow-plugin orchestrator
+// exposes only its core (sandbox/run/child/apply/git/lane) symbols.
+import WorkflowPlugin from "./workflow-plugin.js";
+import * as kernel from "./index.js";
+export { default } from "./workflow-plugin.js";
+export {
+  acquireAgentSlot,
+  addEditPlanFromResult,
+  applyWorkflow,
+  approvalSummary,
+  assertGitCleanAtBase,
+  cleanupWorktrees,
+  configureWorkflowEntrypoints,
+  createEditWorktree,
+  executeSandbox,
+  gitHead,
+  gitOutput,
+  gitPathTracked,
+  isRunAborted,
+  normalizePatches,
+  planWorkflowEnvelope,
+  releaseAgentSlot,
+  rollbackPatches,
+  runChildAgent,
+  runNestedWorkflow,
+  runWorkflowExecution,
+  salvageRun,
+  startWorkflow,
+  throwIfAborted,
+  validatePatchTargets,
+} from "./workflow-plugin.js";
+export * from "./approval-hashing.js";
+export * from "./async-util.js";
+export * from "./audited-shell-policy.js";
+export * from "./authority-policy.js";
+export * from "./budget-accounting.js";
+export * from "./capability-adapter.js";
+export * from "./child-agent-runner.js";
+export * from "./constants.js";
+export * from "./drain-runtime.js";
+export * from "./errors.js";
+export * from "./event-journal.js";
+export * from "./extension-registry.js";
+export * from "./git-util.js";
+export * from "./integration-mode.js";
+export * from "./lifecycle-control.js";
+export * from "./lane-effort-policy.js";
+export * from "./notification-toast.js";
+export * from "./notification-toast-cards.js";
+export * from "./notification-toast-policy.js";
+export * from "./notification-toast-scope.js";
+export * from "./path-policy.js";
+export * from "./role-template-loading.js";
+export * from "./result-readback.js";
+export * from "./run-context.js";
+export * from "./run-observability.js";
+export * from "./run-store-status.js";
+export * from "./sandbox-executor.js";
+export * from "./session-access.js";
+export * from "./structured-output.js";
+export * from "./test-fix-drain-adapter.js";
+export * from "./text-json.js";
+export * from "./workflow-source.js";
+export * from "./worktree-adapter.js";
+
+// Test-only surface. The orchestrator's WorkflowPlugin.__test carries only its core
+// (sandbox/run/child/apply/git/lane) symbols; the extracted modules own everything else.
+// Aggregate the kernel barrel (this module's own namespace) onto __test so test suites
+// reach module internals via this barrel's default export without importing the entry
+// (opencode-workflows.js). The orchestrator's own __test wins on conflict. Not part of the runtime
+// plugin contract.
+WorkflowPlugin.__test = { ...kernel, ...WorkflowPlugin.__test };

package/workflow-kernel/integration-mode.js

@@ -0,0 +1,155 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { git } from "./git-util.js";
+import { protectedPathReason } from "./path-policy.js";
+
+function normalizeRelativePath(filePath) {
+  const normalized = String(filePath ?? "").replace(/\\/g, "/");
+  if (!normalized || normalized.startsWith("/") || normalized.split("/").includes("..")) {
+    throw new Error(`Unsafe integration path: ${filePath}`);
+  }
+  return normalized;
+}
+
+async function changedPathsSinceBase(directory, baseCommit, options = {}) {
+  const { stdout } = await git(directory, ["diff", "--name-status", baseCommit, "HEAD", "--"], { signal: options.signal });
+  return stdout.split(/\r?\n/).filter(Boolean).map((line) => {
+    const [status, ...parts] = line.split(/\t/);
+    const filePath = normalizeRelativePath(parts.at(-1));
+    return { status, path: filePath, supported: /^[AMTUXB]/.test(status) };
+  });
+}
+
+function detectPathConflicts(laneChanges) {
+  const seen = new Map();
+  const conflicts = [];
+  for (const lane of laneChanges) {
+    for (const change of lane.paths ?? []) {
+      const filePath = normalizeRelativePath(typeof change === "string" ? change : change.path);
+      const previous = seen.get(filePath);
+      if (previous && previous.callId !== lane.callId) {
+        conflicts.push({ path: filePath, lanes: [previous.callId, lane.callId] });
+      } else {
+        seen.set(filePath, { callId: lane.callId });
+      }
+    }
+  }
+  return conflicts;
+}
+
+async function buildPatchesFromIntegration({ integrationPath, baseCommit, paths, secretGlobs, signal }) {
+  const changes = paths?.length ? paths : await changedPathsSinceBase(integrationPath, baseCommit, { signal });
+  const patches = [];
+  const unsupported = [];
+  for (const change of changes) {
+    const filePath = normalizeRelativePath(typeof change === "string" ? change : change.path);
+    const status = typeof change === "string" ? "M" : change.status;
+    if (status && !/^[AMTUXB]/.test(status)) {
+      unsupported.push({ path: filePath, status, reason: "unsupported-change-kind" });
+      continue;
+    }
+    const protectedReason = protectedPathReason(filePath, { secretGlobs });
+    if (protectedReason) {
+      unsupported.push({ path: filePath, status, reason: protectedReason });
+      continue;
+    }
+    const absolute = path.join(integrationPath, filePath);
+    const stat = await fs.lstat(absolute).catch(() => undefined);
+    if (!stat || !stat.isFile()) {
+      unsupported.push({ path: filePath, status, reason: stat?.isSymbolicLink() ? "symlink" : "not-regular-file" });
+      continue;
+    }
+    let content;
+    try {
+      content = await fs.readFile(absolute, "utf8");
+    } catch {
+      unsupported.push({ path: filePath, status, reason: "non-utf8-or-unreadable" });
+      continue;
+    }
+    patches.push({ path: filePath, content, mode: "replace" });
+  }
+  return { patches, unsupported };
+}
+
+function normalizeIntegrationValidationResult(result) {
+  if (result === true) return { accepted: true, status: "passed" };
+  if (result === false) return { accepted: false, status: "failed", reason: "integration validation rejected" };
+  if (!result || typeof result !== "object") return { accepted: false, status: "failed", reason: "integration validation returned no explicit result" };
+  const status = typeof result.status === "string" ? result.status : undefined;
+  const accepted = result.accepted === true
+    || result.ok === true
+    || ["ok", "pass", "passed", "success", "validated"].includes(status);
+  return {
+    ...result,
+    accepted,
+    status: status ?? (accepted ? "passed" : "failed"),
+    reason: accepted ? result.reason : (result.reason ?? result.error ?? "integration validation rejected"),
+  };
+}
+
+async function integrateLaneCommits({ adapter, runId, baseCommit, lanes, secretGlobs, signal }) {
+  const laneChanges = [];
+  for (const lane of lanes) {
+    laneChanges.push({ ...lane, paths: lane.paths?.length ? lane.paths : await changedPathsSinceBase(lane.path, baseCommit, { signal }) });
+  }
+  const unsupportedLane = laneChanges.find((lane) => lane.paths.some((change) => {
+    const filePath = typeof change === "string" ? change : change.path;
+    return change.supported === false || protectedPathReason(filePath, { secretGlobs });
+  }));
+  if (unsupportedLane) {
+    return { status: "review-required", culpritLane: unsupportedLane.callId, reason: "unsupported-lane-change", lanes: laneChanges };
+  }
+  const conflicts = detectPathConflicts(laneChanges);
+  if (conflicts.length > 0) {
+    return { status: "review-required", conflicts, reason: "path-conflict", lanes: laneChanges };
+  }
+
+  const integration = await adapter.createIntegrationWorktree({ runId, baseRef: baseCommit });
+  const mergedLanes = [];
+  try {
+    for (const lane of laneChanges.sort((a, b) => String(a.callId).localeCompare(String(b.callId)))) {
+      try {
+        await adapter.merge({ directory: integration.path, ref: lane.branch, message: `merge ${lane.callId}` });
+        mergedLanes.push(lane.callId);
+      } catch (error) {
+        return { status: "review-required", integrationWorktree: integration, mergedLanes, culpritLane: lane.callId, reason: "merge-failed", error: error.message, lanes: laneChanges };
+      }
+    }
+    let validation;
+    if (typeof adapter.validateIntegrationWorktree === "function") {
+      try {
+        validation = normalizeIntegrationValidationResult(await adapter.validateIntegrationWorktree({
+          runId,
+          directory: integration.path,
+          path: integration.path,
+          baseCommit,
+          lanes: laneChanges,
+          mergedLanes,
+          signal,
+        }));
+      } catch (error) {
+        validation = { accepted: false, status: "failed", reason: "integration validation threw", error: error.message };
+      }
+      if (validation.accepted !== true) {
+        return { status: "review-required", integrationWorktree: integration, mergedLanes, reason: "integration-validation-failed", validation, lanes: laneChanges };
+      }
+    }
+    const allChanges = await changedPathsSinceBase(integration.path, baseCommit, { signal });
+    const built = await buildPatchesFromIntegration({ integrationPath: integration.path, baseCommit, paths: allChanges, secretGlobs, signal });
+    if (built.unsupported.length > 0) {
+      return { status: "review-required", integrationWorktree: integration, mergedLanes, reason: "unsupported-integration-change", unsupported: built.unsupported, lanes: laneChanges };
+    }
+    return { status: "awaiting-diff-approval", integrationWorktree: integration, mergedLanes, validation, lanes: laneChanges, patches: built.patches };
+  } catch (error) {
+    return { status: "review-required", integrationWorktree: integration, mergedLanes, reason: "integration-failed", error: error.message, lanes: laneChanges };
+  }
+}
+
+export {
+  buildPatchesFromIntegration,
+  changedPathsSinceBase,
+  detectPathConflicts,
+  integrateLaneCommits,
+  normalizeIntegrationValidationResult,
+  normalizeRelativePath,
+};

package/workflow-kernel/lane-effort-policy.js

@@ -0,0 +1,134 @@
+import { WorkflowAuthorityError } from "./errors.js";
+
+export const LANE_EFFORT_VALUES = Object.freeze(["minimal", "low", "medium", "high"]);
+export const LANE_EFFORT_PROVIDER_OPTIONS = Object.freeze({
+  openai: Object.freeze({
+    providerOptionsKey: "openai",
+    optionKey: "reasoningEffort",
+    values: LANE_EFFORT_VALUES,
+  }),
+});
+export const LANE_EFFORT_POLICY_MAX = 1000;
+
+class BoundedLaneEffortMap extends Map {
+  constructor(max = LANE_EFFORT_POLICY_MAX) {
+    super();
+    this.max = max;
+  }
+
+  get(key) {
+    const value = super.get(key);
+    if (value !== undefined && super.delete(key)) super.set(key, value);
+    return value;
+  }
+
+  set(key, value) {
+    if (super.has(key)) super.delete(key);
+    super.set(key, value);
+    while (this.size > this.max) {
+      const oldest = super.keys().next().value;
+      if (oldest === undefined) break;
+      super.delete(oldest);
+    }
+    return this;
+  }
+}
+
+export const laneEffortPolicies = new BoundedLaneEffortMap();
+
+function normalizedID(value) {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (!trimmed) return undefined;
+  return trimmed.toLowerCase();
+}
+
+export function providerID(value) {
+  if (typeof value === "string") return normalizedID(value.split("/")[0]);
+  if (!value || typeof value !== "object") return undefined;
+  return normalizedID(value.providerID)
+    ?? normalizedID(value.providerId)
+    ?? normalizedID(value.id)
+    ?? normalizedID(value.name);
+}
+
+export function modelProviderID(model) {
+  if (typeof model === "string") return providerID(model);
+  if (!model || typeof model !== "object") return undefined;
+  return normalizedID(model.providerID)
+    ?? normalizedID(model.providerId)
+    ?? providerID(model.provider);
+}
+
+export function normalizeLaneEffort(value) {
+  if (value === undefined || value === null || value === false) return undefined;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new WorkflowAuthorityError(`agent() option effort must be one of ${LANE_EFFORT_VALUES.join(", ")}`);
+  }
+  const effort = value.trim().toLowerCase();
+  if (!LANE_EFFORT_VALUES.includes(effort)) {
+    throw new WorkflowAuthorityError(`Invalid agent() option effort: ${value}. Expected one of ${LANE_EFFORT_VALUES.join(", ")}.`);
+  }
+  return effort;
+}
+
+export function laneEffortPolicyForModel(effort, model) {
+  const normalized = normalizeLaneEffort(effort);
+  if (!normalized) return undefined;
+  const modelProvider = modelProviderID(model);
+  const mapping = LANE_EFFORT_PROVIDER_OPTIONS[modelProvider];
+  if (!mapping) {
+    throw new WorkflowAuthorityError(
+      `agent() option effort is currently supported only for OpenAI providers via chat.params; ` +
+      `model provider ${modelProvider ? `"${modelProvider}"` : "could not be determined"}.`,
+    );
+  }
+  if (!mapping.values.includes(normalized)) {
+    throw new WorkflowAuthorityError(`Provider ${modelProvider} does not support effort "${normalized}"`);
+  }
+  return {
+    effort: normalized,
+    providerID: modelProvider,
+    providerOptionsKey: mapping.providerOptionsKey,
+    optionKey: mapping.optionKey,
+  };
+}
+
+export function registerLaneEffort(childID, policy) {
+  if (!childID || !policy) return;
+  laneEffortPolicies.set(String(childID), { ...policy });
+}
+
+export function clearLaneEffort(childID) {
+  if (!childID) return false;
+  return laneEffortPolicies.delete(String(childID));
+}
+
+export function laneEffortPolicyForChild(childID) {
+  return childID ? laneEffortPolicies.get(String(childID)) : undefined;
+}
+
+export function applyLaneEffortParams(input = {}, output = {}) {
+  const policy = laneEffortPolicyForChild(input.sessionID);
+  if (!policy) return false;
+
+  const existingOptions = output.options && typeof output.options === "object" ? output.options : {};
+  const existingProviderOptions = existingOptions.providerOptions && typeof existingOptions.providerOptions === "object"
+    ? existingOptions.providerOptions
+    : {};
+  const existingProvider = existingProviderOptions[policy.providerOptionsKey] && typeof existingProviderOptions[policy.providerOptionsKey] === "object"
+    ? existingProviderOptions[policy.providerOptionsKey]
+    : {};
+
+  output.options = {
+    ...existingOptions,
+    providerOptions: {
+      ...existingProviderOptions,
+      [policy.providerOptionsKey]: {
+        ...existingProvider,
+        [policy.optionKey]: policy.effort,
+      },
+    },
+  };
+  return true;
+}