@pencil-agent/nano-pencil 1.14.2 → 1.14.4

package/dist/extensions/defaults/sal/eval/insforge-sink.d.ts

@@ -1,32 +1,24 @@
 /**
- * [WHO]: Provides InsForgeEvalSink (PostgREST-backed adapter)
- * [FROM]: Depends on node:https, node:http, node:url; ./types.js for EvalSink/EvalEventEnvelope/CreateEvalSinkOptions
+ * [WHO]: Provides InsForgeEvalSink (PostgREST-backed adapter for SAL)
+ * [FROM]: Depends on core/telemetry/* for InsforgeHttpClient + BatchingDispatcher + types; ./types.js for SAL event shape (EvalSink/EvalEventEnvelope/CreateEvalSinkOptions)
  * [TO]: Constructed by eval/index.ts factory when adapter resolves to "insforge"
- * [HERE]: extensions/defaults/sal/eval/insforge-sink.ts - InsForge-specific routing: run_start→eval_runs INSERT (merge-duplicates, includes pencil_version with legacy fallback), turn_anchor→eval_turns + eval_sal_anchors×2 with on_conflict-based upsert (suppresses benign 23505 retries) only after parent run confirmation, tool_trace→eval_tool_traces with legacy-schema fallback, memory_recalls→eval_memory_recalls, run_end→eval_runs PATCH
+ * [HERE]: extensions/defaults/sal/eval/insforge-sink.ts - SAL-specific event routing only: run_start→eval_runs, turn_anchor→eval_turns+eval_sal_anchors×2, tool_trace→eval_tool_traces (legacy fallback), memory_recalls→eval_memory_recalls, run_end→eval_runs PATCH. HTTP transport + batching come from core/telemetry/.
  *
- * Pluggable: nothing in this file may be imported from outside the eval/ directory.
+ * Pluggable: nothing in this file may be imported from outside the eval/ directory other than core/telemetry (the shared base layer).
  * To add a new backend, write a sibling file with the same EvalSink interface.
  */
 import type { CreateEvalSinkOptions, EvalEventEnvelope, EvalSink } from "./types.js";
 export declare class InsForgeEvalSink implements EvalSink {
     readonly enabled = true;
-    private base;
-    private headers;
-    private allowSelfSigned;
-    private batchIntervalMs;
+    private http;
+    private dispatcher;
     private onDiagnostic;
-    private pending;
-    private flushTimer;
-    private flushInFlight;
-    private closed;
     private confirmedRuns;
     private failedRuns;
     constructor(options: CreateEvalSinkOptions);
     sendEvent(event: EvalEventEnvelope): Promise<void>;
     flush(): Promise<void>;
-    private doFlush;
     close(): Promise<void>;
-    private scheduleFlush;
     private routeEvent;
     private handleRunStart;
     private ensureRunExists;
@@ -34,8 +26,5 @@ export declare class InsForgeEvalSink implements EvalSink {
     private handleRunEnd;
     private handleMemoryRecalls;
     private handleToolTrace;
-    private postJson;
-    private patchJson;
-    private httpJson;
     private reportDiagnostic;
 }

package/dist/extensions/defaults/sal/eval/insforge-sink.js

@@ -1,105 +1,50 @@
 /**
- * [WHO]: Provides InsForgeEvalSink (PostgREST-backed adapter)
- * [FROM]: Depends on node:https, node:http, node:url; ./types.js for EvalSink/EvalEventEnvelope/CreateEvalSinkOptions
+ * [WHO]: Provides InsForgeEvalSink (PostgREST-backed adapter for SAL)
+ * [FROM]: Depends on core/telemetry/* for InsforgeHttpClient + BatchingDispatcher + types; ./types.js for SAL event shape (EvalSink/EvalEventEnvelope/CreateEvalSinkOptions)
  * [TO]: Constructed by eval/index.ts factory when adapter resolves to "insforge"
- * [HERE]: extensions/defaults/sal/eval/insforge-sink.ts - InsForge-specific routing: run_start→eval_runs INSERT (merge-duplicates, includes pencil_version with legacy fallback), turn_anchor→eval_turns + eval_sal_anchors×2 with on_conflict-based upsert (suppresses benign 23505 retries) only after parent run confirmation, tool_trace→eval_tool_traces with legacy-schema fallback, memory_recalls→eval_memory_recalls, run_end→eval_runs PATCH
+ * [HERE]: extensions/defaults/sal/eval/insforge-sink.ts - SAL-specific event routing only: run_start→eval_runs, turn_anchor→eval_turns+eval_sal_anchors×2, tool_trace→eval_tool_traces (legacy fallback), memory_recalls→eval_memory_recalls, run_end→eval_runs PATCH. HTTP transport + batching come from core/telemetry/.
  *
- * Pluggable: nothing in this file may be imported from outside the eval/ directory.
+ * Pluggable: nothing in this file may be imported from outside the eval/ directory other than core/telemetry (the shared base layer).
  * To add a new backend, write a sibling file with the same EvalSink interface.
  */
-import { request as httpRequest } from "node:http";
-import { request } from "node:https";
-import { URL } from "node:url";
-import { isDevRuntime } from "../../../../utils/diagnostics.js";
+import { BatchingDispatcher, InsforgeHttpClient, safeHost } from "../../../../core/telemetry/index.js";
 export class InsForgeEvalSink {
     enabled = true;
-    base;
-    headers;
-    allowSelfSigned;
-    batchIntervalMs;
+    http;
+    dispatcher;
     onDiagnostic;
-    pending = [];
-    flushTimer;
-    flushInFlight;
-    closed = false;
     confirmedRuns = new Set();
     failedRuns = new Set();
     constructor(options) {
-        this.base = options.endpoint.replace(/\/+$/, "");
-        this.batchIntervalMs = options.batchIntervalMs ?? 2000;
         this.onDiagnostic = options.onDiagnostic;
-        this.allowSelfSigned = options.allowSelfSigned ?? false;
-        if (this.allowSelfSigned && isDevRuntime()) {
-            console.warn("[sal][eval] TLS certificate verification disabled (allowSelfSigned=true)");
-        }
-        const h = {
-            "Content-Type": "application/json",
-            ...(options.headers ?? {}),
-        };
-        if (options.anonKey) {
-            h["apikey"] = options.anonKey;
-            h["Authorization"] = `Bearer ${options.anonKey}`;
-        }
-        if (options.apiKey) {
-            h[options.apiKeyHeader ?? "x-api-key"] = options.apiKey;
-            if (!options.anonKey) {
-                h["Authorization"] = `Bearer ${options.apiKey}`;
-            }
-        }
-        this.headers = h;
+        this.http = new InsforgeHttpClient({
+            endpoint: options.endpoint,
+            apiKey: options.apiKey,
+            anonKey: options.anonKey,
+            apiKeyHeader: options.apiKeyHeader,
+            extraHeaders: options.headers,
+            allowSelfSigned: options.allowSelfSigned,
+            source: "sal.eval",
+            onDiagnostic: this.onDiagnostic,
+        });
+        this.dispatcher = new BatchingDispatcher({
+            handler: (event) => this.routeEvent(event),
+            intervalMs: options.batchIntervalMs ?? 2000,
+            source: "sal.eval",
+            onDiagnostic: this.onDiagnostic,
+        });
     }
     async sendEvent(event) {
-        if (this.closed)
-            return;
-        this.pending.push(event);
-        this.scheduleFlush();
+        this.dispatcher.enqueue(event);
     }
     async flush() {
-        if (this.flushInFlight) {
-            await this.flushInFlight.catch(() => { });
-            return;
-        }
-        this.flushInFlight = this.doFlush();
-        try {
-            await this.flushInFlight;
-        }
-        catch (err) {
-            this.reportDiagnostic("persistence", "SAL eval flush failed.", err, "flush");
-        }
-        finally {
-            this.flushInFlight = undefined;
-        }
-    }
-    async doFlush() {
-        if (this.flushTimer) {
-            clearTimeout(this.flushTimer);
-            this.flushTimer = undefined;
-        }
-        while (true) {
-            const toFlush = this.pending.splice(0);
-            if (toFlush.length === 0)
-                break;
-            for (const event of toFlush) {
-                await this.routeEvent(event);
-            }
-        }
+        await this.dispatcher.flush();
     }
     async close() {
-        this.closed = true;
-        await this.flush().catch((err) => {
-            this.reportDiagnostic("persistence", "SAL eval close flush failed.", err, "close-flush");
-        });
-    }
-    scheduleFlush() {
-        if (this.flushTimer)
-            return;
-        this.flushTimer = setTimeout(() => {
-            this.flushTimer = undefined;
-            void this.flush().catch(() => { });
-        }, this.batchIntervalMs);
+        await this.dispatcher.close();
     }
     // ------------------------------------------------------------------
-    // Routing
+    // SAL-specific routing
     // ------------------------------------------------------------------
     async routeEvent(event) {
         try {
@@ -146,8 +91,8 @@ export class InsForgeEvalSink {
             workspace_root: strOrNull(p.workspace_root),
             started_at: ev.ts,
         };
-        const url = `${this.base}/api/database/records/eval_runs`;
-        const result = await this.postJson(url, [row], {
+        const url = `${this.http.base}/api/database/records/eval_runs`;
+        const result = await this.http.postJson(url, [row], {
             prefer: "resolution=merge-duplicates",
             quietErrorCodes: ["PGRST204"],
         });
@@ -156,7 +101,7 @@ export class InsForgeEvalSink {
             this.failedRuns.delete(ev.run_id);
             return;
         }
-        const fallback = await this.postJson(url, [toLegacyRunStartRow(row)], {
+        const fallback = await this.http.postJson(url, [toLegacyRunStartRow(row)], {
             prefer: "resolution=merge-duplicates",
         });
         if (fallback.ok) {
@@ -201,7 +146,7 @@ export class InsForgeEvalSink {
         // UNIQUE(run_id, turn_id) collision via ON CONFLICT DO UPDATE
         // instead of returning 409/23505. ignore-duplicates only checks the
         // primary key, which is auto-uuid here, so it never sees the conflict.
-        await this.postJson(`${this.base}/api/database/records/eval_turns?on_conflict=run_id,turn_id`, [{
+        await this.http.postJson(`${this.http.base}/api/database/records/eval_turns?on_conflict=run_id,turn_id`, [{
                 run_id: ev.run_id,
                 turn_id: turnId,
                 event_id: ev.event_id,
@@ -212,7 +157,7 @@ export class InsForgeEvalSink {
             }], { prefer: "resolution=merge-duplicates" });
         const taskAnchor = p.task_anchor;
         if (taskAnchor) {
-            await this.postJson(`${this.base}/api/database/records/eval_sal_anchors?on_conflict=run_id,turn_id,anchor_type`, [{
+            await this.http.postJson(`${this.http.base}/api/database/records/eval_sal_anchors?on_conflict=run_id,turn_id,anchor_type`, [{
                     run_id: ev.run_id,
                     turn_id: turnId,
                     event_id: `${ev.event_id}-task`,
@@ -225,7 +170,7 @@ export class InsForgeEvalSink {
                 }], { prefer: "resolution=merge-duplicates" });
         }
         const actionAnchor = p.action_anchor;
-        await this.postJson(`${this.base}/api/database/records/eval_sal_anchors?on_conflict=run_id,turn_id,anchor_type`, [{
+        await this.http.postJson(`${this.http.base}/api/database/records/eval_sal_anchors?on_conflict=run_id,turn_id,anchor_type`, [{
                 run_id: ev.run_id,
                 turn_id: turnId,
                 event_id: `${ev.event_id}-action`,
@@ -244,7 +189,7 @@ export class InsForgeEvalSink {
         const normalizedStatus = rawStatus === "success" ? "completed"
             : rawStatus === "error" ? "failed"
                 : rawStatus ?? "completed";
-        await this.patchJson(`${this.base}/api/database/records/eval_runs?run_id=eq.${ev.run_id}`, {
+        await this.http.patchJson(`${this.http.base}/api/database/records/eval_runs?run_id=eq.${ev.run_id}`, {
             status: normalizedStatus,
             turn_count: numOrNull(p.turn_count),
             total_duration_ms: numOrNull(p.total_duration_ms),
@@ -274,7 +219,7 @@ export class InsForgeEvalSink {
             inject_rank: numOrNull(r.injectRank),
             recorded_at: ev.ts,
         }));
-        await this.postJson(`${this.base}/api/database/records/eval_memory_recalls`, rows, { prefer: "resolution=ignore-duplicates" });
+        await this.http.postJson(`${this.http.base}/api/database/records/eval_memory_recalls`, rows, { prefer: "resolution=ignore-duplicates" });
     }
     // INSERT into eval_tool_traces — one row per turn with tool usage summary
     // InsForge columns are all TEXT; JSONB fields must be serialized to strings.
@@ -300,86 +245,15 @@ export class InsForgeEvalSink {
             duration_ms: String(p.duration_ms ?? 0),
             recorded_at: ev.ts,
         };
-        const url = `${this.base}/api/database/records/eval_tool_traces`;
-        const result = await this.postJson(url, [row], {
+        const url = `${this.http.base}/api/database/records/eval_tool_traces`;
+        const result = await this.http.postJson(url, [row], {
             prefer: "resolution=ignore-duplicates",
             quietErrorCodes: ["PGRST204"],
         });
         if (!result.ok && result.errorCode === "PGRST204") {
-            await this.postJson(url, [toLegacyToolTraceRow(row)], { prefer: "resolution=ignore-duplicates" });
+            await this.http.postJson(url, [toLegacyToolTraceRow(row)], { prefer: "resolution=ignore-duplicates" });
         }
     }
-    // ------------------------------------------------------------------
-    // HTTP helpers
-    // ------------------------------------------------------------------
-    postJson(url, body, extra) {
-        const extraHeaders = {};
-        if (extra?.prefer)
-            extraHeaders["Prefer"] = extra.prefer;
-        return this.httpJson("POST", url, body, extraHeaders, extra?.quietErrorCodes);
-    }
-    patchJson(url, body) {
-        return this.httpJson("PATCH", url, body, {});
-    }
-    httpJson(method, url, body, extraHeaders, quietErrorCodes = []) {
-        return new Promise((resolve) => {
-            const payload = JSON.stringify(body);
-            let parsed;
-            try {
-                parsed = new URL(url);
-            }
-            catch {
-                this.reportDiagnostic("config", "SAL eval endpoint URL is invalid.", { url }, "invalid-url");
-                resolve({ ok: false });
-                return;
-            }
-            const isHttps = parsed.protocol === "https:";
-            const requestFn = isHttps ? request : httpRequest;
-            const port = parsed.port ? Number(parsed.port) : (isHttps ? 443 : 80);
-            const req = requestFn({
-                hostname: parsed.hostname,
-                port,
-                path: parsed.pathname + parsed.search,
-                method,
-                headers: {
-                    ...this.headers,
-                    ...extraHeaders,
-                    "Content-Length": Buffer.byteLength(payload),
-                },
-                timeout: 5000,
-                ...(isHttps && this.allowSelfSigned ? { rejectUnauthorized: false } : {}),
-            }, (res) => {
-                let rawBody = "";
-                res.setEncoding("utf-8");
-                res.on("data", (chunk) => { rawBody += chunk; });
-                res.on("end", () => {
-                    const ok = res.statusCode !== undefined && res.statusCode < 300;
-                    const errorCode = parsePostgrestErrorCode(rawBody);
-                    if (!ok && !quietErrorCodes.includes(errorCode ?? "")) {
-                        this.reportDiagnostic(errorCode === "PGRST204" ? "schema" : "network", `SAL eval upload failed with HTTP ${res.statusCode}.`, { method, path: parsed.pathname, statusCode: res.statusCode, body: rawBody.slice(0, 300), errorCode }, `http-${res.statusCode ?? "unknown"}-${errorCode ?? "none"}`);
-                    }
-                    resolve({ ok, statusCode: res.statusCode, body: rawBody, errorCode });
-                });
-            });
-            req.on("error", (err) => {
-                this.reportDiagnostic("network", "SAL eval upload is failing due to a network connection error.", { host: parsed.hostname, error: err.message }, "network-error");
-                if (isDevRuntime()) {
-                    console.error(`[sal][eval] network error → ${parsed.hostname}: ${err.message}`);
-                }
-                resolve({ ok: false });
-            });
-            req.on("timeout", () => {
-                this.reportDiagnostic("network", "SAL eval upload timed out.", { method, path: parsed.pathname, host: parsed.hostname }, "timeout");
-                if (isDevRuntime()) {
-                    console.error(`[sal][eval] timeout ${method} ${parsed.pathname}`);
-                }
-                req.destroy();
-                resolve({ ok: false });
-            });
-            req.write(payload);
-            req.end();
-        });
-    }
     reportDiagnostic(category, message, detail, fingerprintSuffix) {
         this.onDiagnostic?.({
             source: "sal.eval",
@@ -390,13 +264,13 @@ export class InsForgeEvalSink {
             fingerprint: `sal.eval:${category}:${fingerprintSuffix}`,
             context: {
                 adapter: "insforge",
-                endpoint_host: safeHost(this.base),
+                endpoint_host: safeHost(this.http.base),
             },
         });
     }
 }
 // ----------------------------------------------------------------------------
-// Local helpers
+// SAL-specific row helpers
 // ----------------------------------------------------------------------------
 function strOrNull(v, skipValue) {
     if (v == null || v === "" || v === skipValue)
@@ -409,23 +283,6 @@ function numOrNull(v) {
     const n = Number(v);
     return isNaN(n) ? null : n;
 }
-function parsePostgrestErrorCode(rawBody) {
-    try {
-        const parsed = JSON.parse(rawBody);
-        return typeof parsed?.code === "string" ? parsed.code : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function safeHost(value) {
-    try {
-        return new URL(value).hostname;
-    }
-    catch {
-        return undefined;
-    }
-}
 function toLegacyRunStartRow(row) {
     const { pencil_version: _pencilVersion, commit_hash: _commitHash, branch_name: _branchName, workspace_root: _workspaceRoot, ...legacyRow } = row;
     return legacyRow;

package/dist/extensions/defaults/sal/index.js

@@ -19,6 +19,17 @@ const NOSAL_FLAG = "nosal";
 const SAL_AB_FLAG = "sal-ab";
 const SAL_REBUILD_FLAG = "sal-rebuild-terrain";
 const DIAGNOSTIC_EVENT_CHANNEL = "diagnostic:event";
+const SAL_COVERAGE_COMPLETIONS = [
+    { value: "core/", label: "core/", description: "Check the core runtime files" },
+    { value: "extensions/", label: "extensions/", description: "Check extension files" },
+    { value: "modes/", label: "modes/", description: "Check interactive, print, and RPC mode files" },
+    { value: "packages/", label: "packages/", description: "Check bundled package files" },
+];
+const SAL_SETUP_ENDPOINT_COMPLETIONS = [
+    { value: "https://", label: "https://", description: "Send evaluation records to a hosted endpoint" },
+    { value: "file://", label: "file://", description: "Write evaluation records to a local JSONL file" },
+    { value: "./", label: "./", description: "Write evaluation records to a file in this workspace" },
+];
 async function ensureSnapshot(runtime, forceRebuild) {
     if (runtime.snapshotErrored)
         return runtime.snapshot;
@@ -181,17 +192,17 @@ async function cleanupStaleRuns(runtime) {
 export default async function salExtension(api) {
     api.registerFlag(NOSAL_FLAG, {
         type: "boolean",
-        description: "Disable Structural Anchor Localization (SAL) - fall back to baseline memory mode",
+        description: "Turn off SAL workspace guidance for this run",
         default: false,
     });
     api.registerFlag(SAL_AB_FLAG, {
         type: "boolean",
-        description: "Enable SAL A/B experiment sidecar files under .memory-experiments",
+        description: "Save local SAL comparison records under .memory-experiments",
         default: false,
     });
     api.registerFlag(SAL_REBUILD_FLAG, {
         type: "boolean",
-        description: "Force SAL terrain index rebuild on next localization pass",
+        description: "Refresh SAL's workspace map before the next turn",
         default: false,
     });
     const workspaceRoot = api.cwd;
@@ -299,7 +310,13 @@ export default async function salExtension(api) {
     const isEnabled = () => !api.getFlag(NOSAL_FLAG);
     const isSalAbEnabled = () => resolveSalAbEnabled(api.getFlag(SAL_AB_FLAG));
     api.registerCommand("sal:coverage", {
-        description: "Report DIP P3 coverage for SAL prerequisite gating. Usage: /sal:coverage [module1 module2 ...]",
+        description: "Check whether folders have the file map headers SAL needs. Usage: /sal:coverage [folder ...]",
+        getArgumentCompletions: (argumentPrefix, context) => {
+            const used = new Set(context?.previousTokens ?? []);
+            const prefix = argumentPrefix.trim().toLowerCase();
+            const values = SAL_COVERAGE_COMPLETIONS.filter((item) => !used.has(item.value) && item.value.startsWith(prefix));
+            return values.length > 0 ? values : null;
+        },
         handler: async (args, ctx) => {
             const modules = (args ?? "")
                 .trim()
@@ -316,9 +333,15 @@ export default async function salExtension(api) {
         },
     });
     api.registerCommand("sal:setup", {
-        description: "Configure SAL eval credentials. " +
-            "Usage: /sal:setup <endpoint> [api_key] [anon_key]  — adapter inferred from endpoint scheme " +
-            "(http/https → InsForge backend; file path or file:// → local JSONL log).",
+        description: "Connect evaluation records to a hosted endpoint or local JSONL file. " +
+            "Usage: /sal:setup <endpoint> [api_key] [anon_key].",
+        getArgumentCompletions: (argumentPrefix, context) => {
+            if (context && context.tokenIndex > 0)
+                return null;
+            const prefix = argumentPrefix.trim().toLowerCase();
+            const values = SAL_SETUP_ENDPOINT_COMPLETIONS.filter((item) => item.value.startsWith(prefix));
+            return values.length > 0 ? values : null;
+        },
         handler: async (args, ctx) => {
             const tokens = (args ?? "").trim().split(/\s+/).filter((t) => t.length > 0);
             const endpoint = tokens[0];
@@ -399,7 +422,7 @@ export default async function salExtension(api) {
         },
     });
     api.registerCommand("sal:status", {
-        description: "Show current SAL configuration and snapshot status",
+        description: "Show whether SAL is active and where its records are going",
         handler: async (_args, ctx) => {
             const flagOn = isEnabled();
             const snapshot = runtime.snapshot;

package/dist/extensions/defaults/sal/sal-config.d.ts

@@ -30,6 +30,11 @@ export interface EvalCredentials {
     /** Adapter selector. When omitted, inferred from endpoint scheme (http -> insforge, file/path -> jsonl). */
     adapter?: EvalAdapterId;
 }
+/**
+ * Delegate to the shared core/telemetry/build-meta loader so SAL eval, the
+ * ext-events sink, and any future telemetry consumer all stamp identical
+ * pencil_version / commit_hash on emitted rows.
+ */
 export declare function loadBuildMeta(): BuildMeta;
 export declare const BUILD_META: BuildMeta;
 export declare function resolveStaleCleanupEnabled(envValue: string | undefined, credentials: EvalCredentials | undefined): boolean;

package/dist/extensions/defaults/sal/sal-config.js

@@ -4,10 +4,8 @@
  * [TO]: Consumed by extensions/defaults/sal/index.ts and tests that validate SAL experiment/config behavior
  * [HERE]: extensions/defaults/sal/sal-config.ts - configuration and path boundary for Structural Anchor Localization
  */
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join } from "node:path";
+import { loadBuildMeta as loadBuildMetaShared, loadInsforgeCredentials } from "../../../core/telemetry/index.js";
 export const SAL_AB_ENV = "NANOPENCIL_SAL_AB";
 export const EVAL_ENABLED_ENV = "NANOPENCIL_EVAL_ENABLED";
 export const EVAL_ENDPOINT_ENV = "NANOPENCIL_EVAL_ENDPOINT";
@@ -19,37 +17,13 @@ export const EVAL_API_KEY_HEADER_ENV = "NANOPENCIL_EVAL_API_KEY_HEADER";
 export const EVAL_HEADERS_JSON_ENV = "NANOPENCIL_EVAL_HEADERS_JSON";
 export const EVAL_CREDENTIALS_FILE_ENV = "NANOPENCIL_EVAL_CREDENTIALS_FILE";
 export const EVAL_STALE_CLEANUP_ENV = "NANOPENCIL_EVAL_CLEANUP_STALE_RUNS";
+/**
+ * Delegate to the shared core/telemetry/build-meta loader so SAL eval, the
+ * ext-events sink, and any future telemetry consumer all stamp identical
+ * pencil_version / commit_hash on emitted rows.
+ */
 export function loadBuildMeta() {
-    const fallback = { version: "dev" };
-    try {
-        const thisFile = fileURLToPath(import.meta.url);
-        const thisDir = dirname(thisFile);
-        const distMeta = join(thisDir, "..", "..", "..", "build-meta.json");
-        if (existsSync(distMeta)) {
-            const parsed = JSON.parse(readFileSync(distMeta, "utf-8"));
-            return {
-                version: parsed.version ?? fallback.version,
-                commitHash: parsed.commitHash,
-                branch: parsed.branch,
-            };
-        }
-        const pkgCandidates = [
-            join(thisDir, "..", "..", "..", "package.json"),
-            join(thisDir, "..", "..", "..", "..", "package.json"),
-        ];
-        for (const p of pkgCandidates) {
-            if (existsSync(p)) {
-                const pkg = JSON.parse(readFileSync(p, "utf-8"));
-                if (pkg.name === "@pencil-agent/nano-pencil") {
-                    return { version: pkg.version ?? fallback.version };
-                }
-            }
-        }
-    }
-    catch {
-        // Non-fatal: dev and tests can run without build metadata.
-    }
-    return fallback;
+    return loadBuildMetaShared();
 }
 export const BUILD_META = loadBuildMeta();
 export function resolveStaleCleanupEnabled(envValue, credentials) {
@@ -92,55 +66,14 @@ export function parseHeadersJson(raw, reportDiagnostic) {
         return {};
     }
 }
-function resolveCredentialsFileCandidates(workspaceRoot) {
-    const envPath = process.env[EVAL_CREDENTIALS_FILE_ENV];
-    const workspacePath = join(workspaceRoot, ".memory-experiments", "credentials.json");
-    const userPath = join(homedir(), ".memory-experiments", "credentials.json");
-    return [envPath, workspacePath, userPath].filter((path) => Boolean(path));
-}
-function readCredentialsFromFile(filePath, reportDiagnostic) {
-    try {
-        if (!existsSync(filePath))
-            return undefined;
-        const raw = readFileSync(filePath, "utf-8");
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object")
-            return undefined;
-        if (Array.isArray(parsed.credentials)) {
-            const entry = parsed.credentials.find((e) => e.id === "insforge" && e.enabled !== false);
-            if (!entry)
-                return undefined;
-            return {
-                endpoint: entry.endpoint ?? entry.insforge_url,
-                insforge_url: entry.insforge_url ?? entry.endpoint,
-                api_key: entry.api_key ?? entry.apiKey,
-                anon_key: entry.anon_key,
-                api_key_header: entry.api_key_header,
-                headers: entry.headers,
-                enabled: entry.enabled,
-            };
-        }
-        return parsed;
-    }
-    catch (err) {
-        reportDiagnostic?.({
-            source: "sal.eval",
-            severity: "warning",
-            category: "config",
-            message: "SAL eval credentials file could not be read.",
-            detail: { filePath, error: err.message },
-            fingerprint: "sal.eval:config:credentials-read-failed",
-        });
-        return undefined;
-    }
-}
 export function resolveEvalCredentials(workspaceRoot, reportDiagnostic) {
-    for (const candidate of resolveCredentialsFileCandidates(workspaceRoot)) {
-        const creds = readCredentialsFromFile(candidate, reportDiagnostic);
-        if (creds)
-            return creds;
-    }
-    return undefined;
+    // Delegate file discovery + JSON parsing + format normalization to the
+    // shared telemetry base. SAL only needs to type-assert the result back to
+    // its own extended shape (EvalCredentials adds cleanup_stale_runs +
+    // adapter on top of InsforgeCredentialsBase).
+    const envPath = process.env[EVAL_CREDENTIALS_FILE_ENV];
+    const creds = loadInsforgeCredentials(workspaceRoot, "sal.eval", reportDiagnostic, envPath);
+    return creds ?? undefined;
 }
 export function normalizeExperimentId(experimentId) {
     const raw = (experimentId ?? "").trim();