@polderlabs/bizar 9.0.0 → 10.0.7

package/packages/sdk/dist/dangerous-patterns.js

@@ -0,0 +1,107 @@
+/**
+ * dangerous-patterns.ts — Tool approval gate (v6.0.0)
+ *
+ * Pattern: Hermes Agent `tools/approval.py:546-770` (30+ regex patterns)
+ * + OpenFang `crates/openfang-skills/src/verify.rs` + OpenClaw
+ * `src/security/external-content.ts:28-43`.
+ *
+ * Detects dangerous commands and blocks/requires approval before tool
+ * execution. Every tool that takes a "command" or "path" argument runs
+ * through `checkDangerous()` before being dispatched. Framework-agnostic
+ * — used by both the SDK MCP server and any Claude Code hook scripts.
+ */
+const DANGEROUS_PATTERNS = [
+    // Filesystem destruction
+    { name: "rm-rf-root", pattern: /\brm\s+(-\w*r\w*f\w*\s+)*\/\s*$/i, decision: "deny", reason: "Recursive delete of root filesystem" },
+    { name: "rm-rf-etc", pattern: /\brm\s+(-\w*r\w*f\w*\s+)*\/(etc|var|usr|boot|home)\b/i, decision: "deny", reason: "Recursive delete of system directory" },
+    { name: "rm-rf-wildcard", pattern: /\brm\s+-\w*r\w*f\w*\s+\*/i, decision: "require-approval", reason: "Recursive delete with wildcard" },
+    { name: "rm-rf-home", pattern: /\brm\s+(-\w*r\w*f\w*\s+)*~?\//i, decision: "require-approval", reason: "Recursive delete of home directory" },
+    { name: "mkfs", pattern: /\bmkfs(\.\w+)?\s+\/dev\//i, decision: "deny", reason: "Format filesystem" },
+    { name: "dd-of-dev", pattern: /\bdd\s+.*of=\/dev\//i, decision: "deny", reason: "dd to raw device" },
+    { name: "fork-bomb", pattern: /:\(\)\s*\{.*:\|:.*\}\s*;:/i, decision: "deny", reason: "Bash fork bomb" },
+    // Privilege escalation
+    { name: "sudo", pattern: /(^|\s|;|&&|\|\|)sudo\b/i, decision: "require-approval", reason: "Sudo escalation" },
+    { name: "su-root", pattern: /\bsu\s+-?\s*root\b/i, decision: "require-approval", reason: "su to root" },
+    { name: "chmod-777", pattern: /\bchmod\s+(-R\s+)?777\b/i, decision: "require-approval", reason: "chmod 777 (world-writable)" },
+    { name: "chown-root", pattern: /\bchown\s+(-R\s+)?root\b/i, decision: "require-approval", reason: "chown to root" },
+    // Network exfiltration / SSRF
+    { name: "curl-metadata", pattern: /169\.254\.169\.254/i, decision: "deny", reason: "AWS metadata IP" },
+    { name: "curl-google-metadata", pattern: /metadata\.google\.internal/i, decision: "deny", reason: "GCP metadata hostname" },
+    { name: "curl-azure-metadata", pattern: /metadata\.azure\.com/i, decision: "deny", reason: "Azure metadata hostname" },
+    { name: "nc-backdoor", pattern: /\bnc\s+(-[a-z]*\s+)*-[a-z]*e\b/i, decision: "deny", reason: "nc execute backdoor" },
+    { name: "wget-pipe-shell", pattern: /\bwget\s+.*\|\s*(ba)?sh\b/i, decision: "deny", reason: "wget piped to shell" },
+    { name: "curl-pipe-shell", pattern: /\bcurl\s+.*\|\s*(ba)?sh\b/i, decision: "deny", reason: "curl piped to shell" },
+    // Process control
+    { name: "kill-init", pattern: /\bkill\s+(-9\s+)?1\b/i, decision: "deny", reason: "Kill PID 1 (init)" },
+    { name: "pkill-all", pattern: /\bpkill\s+-9?\s+-e?\s*$/i, decision: "require-approval", reason: "pkill all processes" },
+    { name: "shutdown", pattern: /\b(shutdown|halt|poweroff|reboot)\b/i, decision: "deny", reason: "System shutdown" },
+    { name: "init-0", pattern: /\binit\s+0\b/i, decision: "deny", reason: "init 0 (shutdown)" },
+    // Crypto mining
+    { name: "xmrig", pattern: /\b(xmrig|minerd|cpuminer|cgminer)\b/i, decision: "deny", reason: "Crypto miner" },
+    // Package management
+    { name: "pip-install-shell", pattern: /\bpip\s+install\s+.*\|\s*(ba)?sh\b/i, decision: "deny", reason: "pip install piped to shell" },
+    { name: "npm-install-shell", pattern: /\bnpm\s+install\s+.*\|\s*(ba)?sh\b/i, decision: "deny", reason: "npm install piped to shell" },
+    // Sensitive file reads
+    { name: "read-shadow", pattern: /\/etc\/(shadow|passwd|sudoers)\b/i, decision: "require-approval", reason: "Read sensitive system file" },
+    { name: "read-ssh", pattern: /\.ssh\//i, decision: "deny", reason: "Read SSH keys" },
+    { name: "read-aws-creds", pattern: /~\/\.aws\/credentials/i, decision: "deny", reason: "Read AWS credentials" },
+    { name: "read-gcp-creds", pattern: /~\/\.config\/gcloud/i, decision: "deny", reason: "Read GCP credentials" },
+    { name: "read-env", pattern: /\/proc\/.*\/environ/i, decision: "deny", reason: "Read process environment" },
+    // Path traversal
+    { name: "path-traversal", pattern: /(\.\.\/){2,}/i, decision: "require-approval", reason: "Multiple path traversal" },
+    { name: "path-ssh-target", pattern: /\/root\/\.ssh/i, decision: "deny", reason: "Path to root SSH" },
+    // Dangerous git operations
+    { name: "git-force-push-main", pattern: /\bgit\s+push\s+(-f|--force)(\s+--.*)?\s+origin\s+(main|master)\b/i, decision: "deny", reason: "Force push to main/master" },
+    { name: "git-clean-fd", pattern: /\bgit\s+clean\s+-\w*f\w*d\b/i, decision: "require-approval", reason: "git clean -fd" },
+    { name: "git-reset-hard", pattern: /\bgit\s+reset\s+--hard\b/i, decision: "require-approval", reason: "git reset --hard" },
+    // Prompt-injection-style content
+    { name: "ignore-previous", pattern: /ignore\s+(all\s+)?(previous|prior|above)\s+(instructions?|prompts?)/i, decision: "deny", reason: "Prompt injection attempt" },
+    { name: "system-prompt-leak", pattern: /reveal\s+(your\s+)?system\s+prompt/i, decision: "deny", reason: "Prompt extraction attempt" },
+];
+export function checkDangerous(args) {
+    const text = collectStrings(args);
+    if (!text)
+        return { decision: "allow" };
+    for (const p of DANGEROUS_PATTERNS) {
+        if (p.pattern.test(text)) {
+            return {
+                decision: p.decision,
+                reason: p.reason,
+                pattern: p.name,
+            };
+        }
+    }
+    return { decision: "allow" };
+}
+function collectStrings(value, parts = []) {
+    if (value == null)
+        return parts.join("\n");
+    if (typeof value === "string") {
+        parts.push(value);
+    }
+    else if (Array.isArray(value)) {
+        for (const v of value)
+            collectStrings(v, parts);
+    }
+    else if (typeof value === "object") {
+        for (const v of Object.values(value)) {
+            collectStrings(v, parts);
+        }
+    }
+    return parts.join("\n");
+}
+export function listDangerousPatterns() {
+    return DANGEROUS_PATTERNS.map((p) => p.name);
+}
+export function getDangerousPatternStats() {
+    let deny = 0;
+    let requireApproval = 0;
+    for (const p of DANGEROUS_PATTERNS) {
+        if (p.decision === "deny")
+            deny += 1;
+        else if (p.decision === "require-approval")
+            requireApproval += 1;
+    }
+    return { total: DANGEROUS_PATTERNS.length, deny, requireApproval };
+}
+//# sourceMappingURL=dangerous-patterns.js.map

package/packages/sdk/dist/federation/audit.d.ts

@@ -0,0 +1,71 @@
+/**
+ * federation/audit.ts — AuditService: NDJSON log of every
+ * federation decision.
+ *
+ * F-038 — ported from ruflo
+ * `v3/@claude-flow/plugin-agent-federation/src/domain/services/audit-service.ts`
+ * stripped to the parts the skeleton needs:
+ *
+ *   - record(envelope, decision) appends ONE NDJSON line to
+ *     `.harness/federation-audit.log`.
+ *   - When the file exceeds 10 MB, it rotates to
+ *     `.harness/federation-audit.log.1` (single generation).
+ *   - tail() reads the last N lines for the `federation_status` MCP tool.
+ *   - size() returns the on-disk file size for the status payload.
+ *
+ * Writes are synchronous (fs.appendFileSync) — the skeleton is
+ * in-process and not throughput-bound; an async path would only
+ * complicate testing.
+ *
+ * The `.harness/` directory is created on first write. The audit
+ * log file is added to `.gitignore` by the Makefile/install step.
+ */
+/** Default audit log path — colocated with the rest of `.harness/`. */
+export declare const DEFAULT_AUDIT_PATH = ".harness/federation-audit.log";
+/** Decisions recorded by the orchestrator — matches the schema the
+ *  `federation_status` MCP tool reads back. */
+export type AuditDecision = {
+    allowed: true;
+    reason: string;
+} | {
+    allowed: false;
+    reason: string;
+};
+export interface AuditEntry {
+    readonly ts: string;
+    readonly envelopeId: string;
+    readonly sourceNodeId: string;
+    readonly targetNodeId: string;
+    readonly messageType: string;
+    readonly nonce: string;
+    readonly allowed: boolean;
+    readonly reason: string;
+    readonly layer: "trust" | "policy" | "hmac" | "budget" | "received" | "sent";
+    readonly nodeId: string;
+}
+export interface AuditServiceOpts {
+    /** Override the audit file path (defaults to .harness/federation-audit.log). */
+    readonly path?: string;
+    /** Local nodeId stamped into every entry. */
+    readonly nodeId: string;
+}
+export declare class AuditService {
+    private readonly path;
+    private readonly nodeId;
+    private rotated;
+    constructor(opts: AuditServiceOpts);
+    getPath(): string;
+    /** Append an NDJSON line. Triggers rotation if the file would
+     *  exceed the threshold after the write. */
+    record(entry: Omit<AuditEntry, "nodeId">): void;
+    /** Rotate the current log to `.log.1`. Subsequent writes go to a
+     *  fresh `.log` file. Idempotent within a single service lifetime. */
+    rotate(): void;
+    /** On-disk size in bytes. 0 if file missing. */
+    size(): number;
+    /** Read the last `n` entries from the log. Bounded by TAIL_MAX_BYTES. */
+    tail(n?: number): AuditEntry[];
+    /** Wipe the audit log. Test-only helper. */
+    reset(): void;
+}
+//# sourceMappingURL=audit.d.ts.map

package/packages/sdk/dist/federation/audit.js

@@ -0,0 +1,133 @@
+/**
+ * federation/audit.ts — AuditService: NDJSON log of every
+ * federation decision.
+ *
+ * F-038 — ported from ruflo
+ * `v3/@claude-flow/plugin-agent-federation/src/domain/services/audit-service.ts`
+ * stripped to the parts the skeleton needs:
+ *
+ *   - record(envelope, decision) appends ONE NDJSON line to
+ *     `.harness/federation-audit.log`.
+ *   - When the file exceeds 10 MB, it rotates to
+ *     `.harness/federation-audit.log.1` (single generation).
+ *   - tail() reads the last N lines for the `federation_status` MCP tool.
+ *   - size() returns the on-disk file size for the status payload.
+ *
+ * Writes are synchronous (fs.appendFileSync) — the skeleton is
+ * in-process and not throughput-bound; an async path would only
+ * complicate testing.
+ *
+ * The `.harness/` directory is created on first write. The audit
+ * log file is added to `.gitignore` by the Makefile/install step.
+ */
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readSync, renameSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+/** Default audit log path — colocated with the rest of `.harness/`. */
+export const DEFAULT_AUDIT_PATH = ".harness/federation-audit.log";
+/** Rotate when the file exceeds this size. */
+const ROTATION_THRESHOLD_BYTES = 10 * 1024 * 1024; // 10 MB
+/** Tail size cap — protects against reading gigabytes into memory. */
+const TAIL_MAX_BYTES = 1 * 1024 * 1024; // 1 MB
+export class AuditService {
+    path;
+    nodeId;
+    rotated = false;
+    constructor(opts) {
+        if (!opts || typeof opts.nodeId !== "string" || opts.nodeId.length === 0) {
+            throw new Error("AuditService: nodeId is required");
+        }
+        this.path = opts.path ?? DEFAULT_AUDIT_PATH;
+        this.nodeId = opts.nodeId;
+    }
+    getPath() {
+        return this.path;
+    }
+    /** Append an NDJSON line. Triggers rotation if the file would
+     *  exceed the threshold after the write. */
+    record(entry) {
+        const full = { ...entry, nodeId: this.nodeId };
+        const dir = dirname(this.path);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        // Pre-write rotation check: if appending would exceed the
+        // threshold AND we haven't already rotated this session, rotate
+        // first. We keep a single generation (`.log.1`); older logs
+        // are the operator's responsibility (or a separate cron).
+        if (!this.rotated && existsSync(this.path)) {
+            try {
+                const size = statSync(this.path).size;
+                if (size + 256 > ROTATION_THRESHOLD_BYTES) {
+                    this.rotate();
+                }
+            }
+            catch {
+                // stat failed (file gone between check and write) — fall through.
+            }
+        }
+        appendFileSync(this.path, JSON.stringify(full) + "\n", "utf-8");
+    }
+    /** Rotate the current log to `.log.1`. Subsequent writes go to a
+     *  fresh `.log` file. Idempotent within a single service lifetime. */
+    rotate() {
+        const target = `${this.path}.1`;
+        if (existsSync(this.path)) {
+            try {
+                renameSync(this.path, target);
+            }
+            catch { /* ignore — best-effort */ }
+        }
+        this.rotated = true;
+    }
+    /** On-disk size in bytes. 0 if file missing. */
+    size() {
+        try {
+            return existsSync(this.path) ? statSync(this.path).size : 0;
+        }
+        catch {
+            return 0;
+        }
+    }
+    /** Read the last `n` entries from the log. Bounded by TAIL_MAX_BYTES. */
+    tail(n = 50) {
+        if (!existsSync(this.path))
+            return [];
+        let raw;
+        try {
+            const stats = statSync(this.path);
+            const start = Math.max(0, stats.size - TAIL_MAX_BYTES);
+            const buffer = Buffer.alloc(stats.size - start);
+            // Read the last TAIL_MAX_BYTES via a small open/read/close dance.
+            const handle = openSync(this.path, "r");
+            try {
+                readSync(handle, buffer, 0, buffer.length, start);
+            }
+            finally {
+                closeSync(handle);
+            }
+            raw = buffer.toString("utf-8");
+        }
+        catch {
+            raw = readFileSync(this.path, "utf-8");
+        }
+        const lines = raw.split("\n").filter((l) => l.length > 0);
+        const slice = lines.slice(-n);
+        const out = [];
+        for (const line of slice) {
+            try {
+                out.push(JSON.parse(line));
+            }
+            catch { /* malformed line — skip */ }
+        }
+        return out;
+    }
+    /** Wipe the audit log. Test-only helper. */
+    reset() {
+        this.rotated = false;
+        try {
+            if (existsSync(this.path))
+                renameSync(this.path, `${this.path}.deleted`);
+        }
+        catch { /* ignore */ }
+    }
+}
+//# sourceMappingURL=audit.js.map

package/packages/sdk/dist/federation/budget.d.ts

@@ -0,0 +1,111 @@
+/**
+ * federation/budget.ts — FederationBudget: per-peer reserved →
+ * committed → released state machine for token / USD spend.
+ *
+ * F-038 — ported from ruflo
+ * `v3/@claude-flow/plugin-agent-federation/src/domain/value-objects/federation-budget.ts`
+ * (validateBudget + enforceBudget shape) and folded into a class
+ * that tracks actual spend per peer across calls.
+ *
+ * State machine (per peer):
+ *   reserved:  amount is held back (the peer is going to spend ≤ N).
+ *   committed: amount was actually spent (the call completed and we
+ *              know the real cost).
+ *   released:  amount returned to the peer (call failed before
+ *              commit; we give the hold back).
+ *
+ * Persistence: optional JSON snapshot at
+ * `.harness/federation-budget.json` so the budget survives a
+ * Claude Code session restart. The file is gitignored.
+ */
+/** Default budget JSON path. */
+export declare const DEFAULT_BUDGET_PATH = ".harness/federation-budget.json";
+/** Hard ceilings — matches ruflo's MAX_*_CEILING values, kept here
+ *  so callers can't ask for absurdly large budgets. */
+export declare const MAX_USD_CEILING = 1000000;
+export declare const MAX_TOKENS_CEILING = 1000000000;
+export type ReserveResult = {
+    ok: true;
+    reservationId: string;
+} | {
+    ok: false;
+    reason: "peer_over_budget" | "invalid_amount";
+};
+export interface PerPeerBudget {
+    readonly nodeId: string;
+    readonly maxTokens: number;
+    readonly maxUsd: number;
+    readonly maxHops: number;
+    readonly spentTokens: number;
+    readonly spentUsd: number;
+}
+export interface PersistedBudget {
+    readonly version: 1;
+    readonly updatedAt: string;
+    readonly perPeer: PerPeerBudget[];
+}
+interface Reservation {
+    readonly id: string;
+    readonly nodeId: string;
+    readonly tokens: number;
+    readonly usd: number;
+    readonly atMs: number;
+}
+/** Pure validator — borrowed from ruflo's `validateBudget` and
+ *  simplified. Returns a discriminated result. */
+export declare function validateBudgetInput(raw: unknown): {
+    ok: true;
+    maxTokens: number;
+    maxUsd: number;
+    maxHops: number;
+} | {
+    ok: false;
+    error: string;
+};
+export interface FederationBudgetOpts {
+    /** Override the JSON persistence path. */
+    readonly path?: string;
+    /** Default per-peer limits applied when a peer is first seen. */
+    readonly defaultMaxTokens?: number;
+    readonly defaultMaxUsd?: number;
+    readonly defaultMaxHops?: number;
+}
+export declare class FederationBudget {
+    private readonly path;
+    private readonly perPeer;
+    private readonly reservations;
+    private readonly defaults;
+    constructor(opts?: FederationBudgetOpts);
+    /** Get or lazily-create the per-peer budget record. */
+    getOrCreate(nodeId: string): PerPeerBudget;
+    /** Override the limits for a specific peer. */
+    setLimits(nodeId: string, limits: {
+        maxTokens?: number;
+        maxUsd?: number;
+        maxHops?: number;
+    }): void;
+    /** Reserve `tokens` + `usd` against a peer's budget. The caller
+     *  MUST eventually `commit()` or `release()` — un-released
+     *  reservations are surfaced via `outstanding()`. */
+    reserve(nodeId: string, tokens: number, usd: number): ReserveResult;
+    /** Commit a reservation — caller reports the ACTUAL spend which
+     *  may be less than the reserved amount. Difference is refunded. */
+    commit(reservationId: string, actual?: {
+        tokens?: number;
+        usd?: number;
+    }): boolean;
+    /** Release a reservation — full refund. */
+    release(reservationId: string): boolean;
+    /** List outstanding reservations. */
+    outstanding(): Reservation[];
+    /** Snapshot every per-peer budget — for the status MCP tool. */
+    snapshot(): PerPeerBudget[];
+    /** Serialize to the persisted JSON shape. */
+    toJSON(): PersistedBudget;
+    /** Write to disk (atomic tmp + rename). */
+    saveToDisk(): void;
+    /** Re-read from disk, replacing in-memory state. */
+    loadFromDisk(): void;
+}
+export {};
+//# sourceMappingURL=budget.d.ts.map

package/packages/sdk/dist/federation/budget.js

@@ -0,0 +1,227 @@
+/**
+ * federation/budget.ts — FederationBudget: per-peer reserved →
+ * committed → released state machine for token / USD spend.
+ *
+ * F-038 — ported from ruflo
+ * `v3/@claude-flow/plugin-agent-federation/src/domain/value-objects/federation-budget.ts`
+ * (validateBudget + enforceBudget shape) and folded into a class
+ * that tracks actual spend per peer across calls.
+ *
+ * State machine (per peer):
+ *   reserved:  amount is held back (the peer is going to spend ≤ N).
+ *   committed: amount was actually spent (the call completed and we
+ *              know the real cost).
+ *   released:  amount returned to the peer (call failed before
+ *              commit; we give the hold back).
+ *
+ * Persistence: optional JSON snapshot at
+ * `.harness/federation-budget.json` so the budget survives a
+ * Claude Code session restart. The file is gitignored.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from "node:fs";
+import { dirname } from "node:path";
+/** Default budget JSON path. */
+export const DEFAULT_BUDGET_PATH = ".harness/federation-budget.json";
+/** Hard ceilings — matches ruflo's MAX_*_CEILING values, kept here
+ *  so callers can't ask for absurdly large budgets. */
+export const MAX_USD_CEILING = 1_000_000;
+export const MAX_TOKENS_CEILING = 1_000_000_000;
+let reservationCounter = 0;
+function nextReservationId() {
+    reservationCounter++;
+    // 128-bit random suffix avoids collision across processes.
+    return `res-${Date.now().toString(36)}-${reservationCounter.toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}
+/** Pure validator — borrowed from ruflo's `validateBudget` and
+ *  simplified. Returns a discriminated result. */
+export function validateBudgetInput(raw) {
+    if (raw == null) {
+        return {
+            ok: true,
+            maxTokens: MAX_TOKENS_CEILING,
+            maxUsd: MAX_USD_CEILING,
+            maxHops: 8,
+        };
+    }
+    if (typeof raw !== "object" || Array.isArray(raw)) {
+        return { ok: false, error: "budget must be an object" };
+    }
+    const obj = raw;
+    const hops = typeof obj.maxHops === "number" && Number.isFinite(obj.maxHops) ? obj.maxHops : 8;
+    const tokens = typeof obj.maxTokens === "number" && Number.isFinite(obj.maxTokens) ? obj.maxTokens : MAX_TOKENS_CEILING;
+    const usd = typeof obj.maxUsd === "number" && Number.isFinite(obj.maxUsd) ? obj.maxUsd : MAX_USD_CEILING;
+    if (hops < 0 || hops > 64)
+        return { ok: false, error: "maxHops out of range" };
+    if (tokens < 0 || tokens > MAX_TOKENS_CEILING)
+        return { ok: false, error: "maxTokens out of range" };
+    if (usd < 0 || usd > MAX_USD_CEILING)
+        return { ok: false, error: "maxUsd out of range" };
+    return { ok: true, maxTokens: tokens, maxUsd: usd, maxHops: hops };
+}
+export class FederationBudget {
+    path;
+    perPeer = new Map();
+    reservations = new Map();
+    defaults;
+    constructor(opts = {}) {
+        this.path = opts.path ?? DEFAULT_BUDGET_PATH;
+        this.defaults = {
+            maxTokens: opts.defaultMaxTokens ?? MAX_TOKENS_CEILING,
+            maxUsd: opts.defaultMaxUsd ?? MAX_USD_CEILING,
+            maxHops: opts.defaultMaxHops ?? 8,
+        };
+        this.loadFromDisk();
+    }
+    /** Get or lazily-create the per-peer budget record. */
+    getOrCreate(nodeId) {
+        let existing = this.perPeer.get(nodeId);
+        if (!existing) {
+            existing = {
+                nodeId,
+                maxTokens: this.defaults.maxTokens,
+                maxUsd: this.defaults.maxUsd,
+                maxHops: this.defaults.maxHops,
+                spentTokens: 0,
+                spentUsd: 0,
+            };
+            this.perPeer.set(nodeId, existing);
+        }
+        return existing;
+    }
+    /** Override the limits for a specific peer. */
+    setLimits(nodeId, limits) {
+        const peer = this.getOrCreate(nodeId);
+        this.perPeer.set(nodeId, {
+            ...peer,
+            maxTokens: limits.maxTokens ?? peer.maxTokens,
+            maxUsd: limits.maxUsd ?? peer.maxUsd,
+            maxHops: limits.maxHops ?? peer.maxHops,
+        });
+        this.saveToDisk();
+    }
+    /** Reserve `tokens` + `usd` against a peer's budget. The caller
+     *  MUST eventually `commit()` or `release()` — un-released
+     *  reservations are surfaced via `outstanding()`. */
+    reserve(nodeId, tokens, usd) {
+        if (!Number.isFinite(tokens) || tokens < 0 || !Number.isFinite(usd) || usd < 0) {
+            return { ok: false, reason: "invalid_amount" };
+        }
+        const peer = this.getOrCreate(nodeId);
+        const remainingTokens = peer.maxTokens - peer.spentTokens;
+        const remainingUsd = peer.maxUsd - peer.spentUsd;
+        if (tokens > remainingTokens || usd > remainingUsd) {
+            return { ok: false, reason: "peer_over_budget" };
+        }
+        const id = nextReservationId();
+        this.reservations.set(id, {
+            id,
+            nodeId,
+            tokens,
+            usd,
+            atMs: Date.now(),
+        });
+        // Optimistically charge the spend against the budget so a
+        // concurrent reserve from the same peer cannot double-spend.
+        // If commit() reports less, the diff is refunded. If the call
+        // fails and release() is called, the full reservation is
+        // refunded.
+        this.perPeer.set(nodeId, {
+            ...peer,
+            spentTokens: peer.spentTokens + tokens,
+            spentUsd: peer.spentUsd + usd,
+        });
+        return { ok: true, reservationId: id };
+    }
+    /** Commit a reservation — caller reports the ACTUAL spend which
+     *  may be less than the reserved amount. Difference is refunded. */
+    commit(reservationId, actual = {}) {
+        const r = this.reservations.get(reservationId);
+        if (!r)
+            return false;
+        const actualTokens = Math.max(0, actual.tokens ?? r.tokens);
+        const actualUsd = Math.max(0, actual.usd ?? r.usd);
+        const peer = this.perPeer.get(r.nodeId);
+        if (!peer) {
+            this.reservations.delete(reservationId);
+            return false;
+        }
+        // Refund the difference between reserved and actual.
+        const tokenRefund = r.tokens - actualTokens;
+        const usdRefund = r.usd - actualUsd;
+        this.perPeer.set(r.nodeId, {
+            ...peer,
+            spentTokens: Math.max(0, peer.spentTokens - tokenRefund),
+            spentUsd: Math.max(0, peer.spentUsd - usdRefund),
+        });
+        this.reservations.delete(reservationId);
+        this.saveToDisk();
+        return true;
+    }
+    /** Release a reservation — full refund. */
+    release(reservationId) {
+        const r = this.reservations.get(reservationId);
+        if (!r)
+            return false;
+        const peer = this.perPeer.get(r.nodeId);
+        if (peer) {
+            this.perPeer.set(r.nodeId, {
+                ...peer,
+                spentTokens: Math.max(0, peer.spentTokens - r.tokens),
+                spentUsd: Math.max(0, peer.spentUsd - r.usd),
+            });
+        }
+        this.reservations.delete(reservationId);
+        this.saveToDisk();
+        return true;
+    }
+    /** List outstanding reservations. */
+    outstanding() {
+        return [...this.reservations.values()];
+    }
+    /** Snapshot every per-peer budget — for the status MCP tool. */
+    snapshot() {
+        return [...this.perPeer.values()];
+    }
+    /** Serialize to the persisted JSON shape. */
+    toJSON() {
+        return {
+            version: 1,
+            updatedAt: new Date().toISOString(),
+            perPeer: this.snapshot(),
+        };
+    }
+    /** Write to disk (atomic tmp + rename). */
+    saveToDisk() {
+        const dir = dirname(this.path);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        const tmp = `${this.path}.tmp`;
+        try {
+            writeFileSync(tmp, JSON.stringify(this.toJSON(), null, 2), "utf-8");
+            renameSync(tmp, this.path);
+        }
+        catch {
+            /* best-effort */
+        }
+    }
+    /** Re-read from disk, replacing in-memory state. */
+    loadFromDisk() {
+        if (!existsSync(this.path))
+            return;
+        try {
+            const raw = readFileSync(this.path, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (parsed.version !== 1 || !Array.isArray(parsed.perPeer))
+                return;
+            this.perPeer.clear();
+            for (const p of parsed.perPeer) {
+                if (typeof p.nodeId === "string")
+                    this.perPeer.set(p.nodeId, p);
+            }
+        }
+        catch {
+            /* malformed — keep defaults */
+        }
+    }
+}
+//# sourceMappingURL=budget.js.map